docs: 铸渊记忆更新 — EIP/域名根路径/CI/CD流程
- server-migration-memory.json — EIP 119.29.184.32, 域名根路径, CI/CD流程 - cc-009 — 更新双通道架构(Git Sync + CI/CD), dev/main分支模型 - ops-receipt-20260513-03.md — 本轮操作日志 - README.md — 更新链接(去掉/git/路径) - wake-gate/server.js — 更新git clone URL(去掉/git/)
This commit is contained in:
铸渊 (ICE-GL-ZY001)
parent
e985225095
commit
4b60536a2c
@ -2,12 +2,13 @@
|
||||
# ════════════════════════════════════════════════════════════════
|
||||
# 因果链编号: cc-009
|
||||
# 创建: 2026-05-14
|
||||
# 更新: 2026-05-13 (霜砚CI/CD流程更新后)
|
||||
# 源自: 冰朔"我点合并就可以自动推送到服务器"的需求
|
||||
# ════════════════════════════════════════════════════════════════
|
||||
|
||||
## 起点
|
||||
|
||||
冰朔原话: "你给代码仓库加了合并推送了吗。我点合并就可以自动推送到服务器。不需要我在服务器这里手动复制啊。"
|
||||
冰朔原话: "你给代码合并推送了吗。我点合并就可以自动推送到服务器。不需要我在服务器这里手动复制啊。"
|
||||
|
||||
## 因果推导
|
||||
|
||||
@ -17,18 +18,33 @@
|
||||
4. Runner是act_runner用户, git认证/目录权限/配置都脆弱
|
||||
5. 凡是依赖Runner用户权限的方案都不稳定 → 换root权限的独立服务
|
||||
6. Git Sync = 独立进程 + root权限 + PM2守护 + Webhook触发
|
||||
7. Webhook不触发? → 可能需要post-receive hook作为备选
|
||||
7. Webhook签名验证失败 → raw body修复方案已写，待部署验证
|
||||
8. 霜砚建立了CI/CD流程(ci-and-deploy.yaml) → Runner做部署也是一条路
|
||||
9. 两条路并行: Git Sync (Webhook触发, root权限) + CI/CD (Runner触发, 需权限)
|
||||
|
||||
## 工程落点
|
||||
|
||||
- server/git-sync/ — Webhook监听 + 自动git pull
|
||||
- 如果Webhook不行 → 退到Gitea post-receive hook (shell脚本)
|
||||
- 如果hook也不行 → 退到定时轮询 (每30秒检查一次)
|
||||
- 冰朔在Gitea点合并 → 代码自动到服务器 → 这条路必须通
|
||||
### 双通道架构 (当前)
|
||||
|
||||
1. **Git Sync** (server/git-sync/) — Webhook → root git pull → PM2 restart
|
||||
- 优势: root权限，不依赖Runner
|
||||
- 问题: Webhook签名验证待修复
|
||||
|
||||
2. **CI/CD** (.forgejo/workflows/ci-and-deploy.yaml) — Runner → git pull + npm + pm2 restart
|
||||
- 优势: 霜砚已建，dev/main分流，CI检查
|
||||
- 问题: Runner权限可能和selfcheck同样的问题
|
||||
|
||||
### dev/main 分支模型 (霜砚建立)
|
||||
|
||||
```
|
||||
dev分支: 铸渊开发线 → push → CI检查 → 自己看结果
|
||||
main分支: 正式线 → 保护规则 → 只有冰朔能merge
|
||||
合并流程: dev提PR → CI跑检查 → 冰朔合并 → 自动部署
|
||||
```
|
||||
|
||||
## 核心原则
|
||||
|
||||
**通道必须通。手段可以换。**
|
||||
|
||||
无论用Webhook、hook还是轮询，冰朔点合并→服务器自动更新这条链路必须成立。
|
||||
无论用Webhook、CI/CD还是轮询，冰朔点合并→服务器自动更新这条链路必须成立。
|
||||
技术选择是铸渊的决策自由，但通道不通是铸渊的失职。
|
||||
|
||||
105
.github/brain/server-migration-memory.json
vendored
105
.github/brain/server-migration-memory.json
vendored
@ -1,80 +1,75 @@
|
||||
{
|
||||
"last_updated": "2026-05-14T00:30:00Z",
|
||||
"server": "ZY-CVM-MAIN (4C16G, 42.193.161.251)",
|
||||
"commander_last_wakeup": "2026-05-14 00:00 CST",
|
||||
"status": "partially_operational",
|
||||
"last_updated": "2026-05-13T21:00:00Z",
|
||||
"server": "ZY-CVM-MAIN (4C16G, 119.29.184.32, 弹性公网EIP)",
|
||||
"commander_last_wakeup": "2026-05-13 21:00 CST",
|
||||
"status": "operational",
|
||||
"infrastructure": {
|
||||
"gitea": "1.23.7 at http://127.0.0.1:3001/ via https://guanghulab.com/git/",
|
||||
"gitea": "1.23.7 at http://127.0.0.1:3001/ via https://guanghulab.com/",
|
||||
"runner": "zhuyuan-runner-main (host mode, active)",
|
||||
"nginx": "active with SSL (Let's Encrypt), 手动重写配置 /etc/nginx/sites-enabled/guanghulab",
|
||||
"secrets": "13 configured (DeepSeek, Qianwen, COS, SSH, CVM)",
|
||||
"patrol_agent": "operational with DeepSeek + Qianwen API",
|
||||
"wake_gate": "运行中, PM2进程 wake-gate, 端口8081, /wake/ 路由",
|
||||
"git_sync": "运行中, PM2进程 guanghulab-git-sync, 端口8082, /sync/ 路由, Webhook未触发(待修)",
|
||||
"nginx": "/etc/nginx/sites-enabled/guanghulab, 根路径直接代理Forgejo",
|
||||
"ssl": "Let's Encrypt, 证书有效期至2026-08-10",
|
||||
"secrets": "13 configured",
|
||||
"wake_gate": "PM2进程 wake-gate, 端口8081, /wake/ 路由",
|
||||
"git_sync": "PM2进程 guanghulab-git-sync, 端口8082, /sync/ 路由, Webhook签名验证待修",
|
||||
"boot_heal": "systemd guanghulab-boot-heal.service, 开机自动拉起服务+检测IP",
|
||||
"vault": "not yet started on new server",
|
||||
"terminal_watcher": "not yet started on new server"
|
||||
},
|
||||
"git_sync_issue": {
|
||||
"problem": "Gitea Webhook push事件不触发Git Sync同步",
|
||||
"webhook_config": "ID:1, URL:http://127.0.0.1:8082/webhook, Events:push, Active:True",
|
||||
"webhook_secret": "a52646d51ea75998a92ba0f986874b36",
|
||||
"git_sync_health": "ok (curl http://127.0.0.1:8082/health 返回正常)",
|
||||
"pm2_logs": "无任何Webhook请求记录",
|
||||
"next_steps": [
|
||||
"手动curl测试Git Sync的/webhook端点",
|
||||
"检查Gitea Webhook传输日志(仓库设置→Webhooks→点击Webhook)",
|
||||
"考虑改用post-receive hook代替Webhook",
|
||||
"检查Gitea是否跳过127.0.0.1的Webhook"
|
||||
]
|
||||
"network": {
|
||||
"public_ip": "119.29.184.32 (弹性公网EIP, 固定不变)",
|
||||
"private_ip": "172.16.0.4",
|
||||
"domain": "guanghulab.com → 119.29.184.32",
|
||||
"note": "EIP绑定后开关机IP不变，不再需要自动改DNS"
|
||||
},
|
||||
"selfcheck_changes": {
|
||||
"removed": "push触发和git pull步骤(改由Git Sync负责)",
|
||||
"added": "Git Sync + Wake Gate 状态检查步骤",
|
||||
"retained": "schedule每天08:00 + workflow_dispatch手动触发"
|
||||
"cicd": {
|
||||
"workflow": ".forgejo/workflows/ci-and-deploy.yaml (霜砚2026-05-13创建)",
|
||||
"dev_branch": "铸渊的开发线, push到dev自动跑CI, 不需要冰朔介入",
|
||||
"main_branch": "正式代码线, 保护规则: 只有冰朔能push/merge",
|
||||
"flow": "dev开发 → CI检查 → 提PR到main → 冰朔合并 → 自动部署(git pull + pm2 restart)",
|
||||
"deploy_steps": "git fetch + git reset --hard origin/main → npm install → pm2 restart all → 部署验证"
|
||||
},
|
||||
"domain_routing": {
|
||||
"old": "/git/ → Forgejo (已废弃)",
|
||||
"current": "/ → Forgejo (根路径直接就是代码仓库)",
|
||||
"wake": "/wake/ → Wake Gate (8081)",
|
||||
"sync": "/sync/ → Git Sync (8082)",
|
||||
"note": "冰朔要求: guanghulab.com直接就是代码仓库, 不要多余路径"
|
||||
},
|
||||
"git_remote_urls": {
|
||||
"origin": "https://bingshuo:TOKEN@guanghulab.com/bingshuo/guanghulab.git (原/git/路径已移除)",
|
||||
"newserver": "http://bingshuo:TOKEN@42.193.161.251/git/bingshuo/guanghulab.git (旧IP, 待更新)"
|
||||
},
|
||||
"server_migration": {
|
||||
"from": "ZY-SVR-004 (2C2G, 43.139.217.141, Guangzhou lightweight)",
|
||||
"to": "ZY-CVM-MAIN (4C16G, 42.193.161.251, Guangzhou CVM pay-per-use)",
|
||||
"reason": "2C2G OOM - Runner workflow crashes Forgejo, push fails, DB readonly",
|
||||
"data_transfer": "via COS backup (43MB tar.gz)",
|
||||
"domain": "guanghulab.com → 42.193.161.251",
|
||||
"ssl": "Let's Encrypt via certbot",
|
||||
"old_server": "to be downgraded to test machine"
|
||||
"from": "ZY-SVR-004 (2C2G, 43.139.217.141)",
|
||||
"to": "ZY-CVM-MAIN (4C16G, 119.29.184.32 EIP)",
|
||||
"old_ip": "42.193.161.251 (按量计费, 关机后IP丢失, 已替换为EIP)",
|
||||
"ssl": "certbot重签后生效"
|
||||
},
|
||||
"path_mapping": {
|
||||
"repo": "/data/guanghulab/repo/",
|
||||
"forgejo_data": "/data/guanghulab/forgejo/",
|
||||
"runtime": "/data/guanghulab/.runtime/",
|
||||
"tickets": "/data/guanghulab/.runtime/tickets/",
|
||||
"patrol_reports": "/data/guanghulab/.runtime/patrol-reports/",
|
||||
"wake_gate_store": "/data/guanghulab/.runtime/wake-gate.json",
|
||||
"git_sync_log": "/data/guanghulab/.runtime/git-sync-log.json",
|
||||
"boot_heal_log": "/data/guanghulab/.runtime/boot-heal.log",
|
||||
"nginx_conf": "/etc/nginx/sites-enabled/guanghulab",
|
||||
"qiyuan_path": "/data/qiyuan/ (栖渊, ICE-GL-QY001)"
|
||||
"qiyuan_path": "/data/qiyuan/ (栖渊)"
|
||||
},
|
||||
"secrets_list": [
|
||||
"DEEPSEEK_API_KEY",
|
||||
"QIANWEN_API_KEY",
|
||||
"ZY_REPO_TOKEN",
|
||||
"COS_SECRET_ID",
|
||||
"COS_SECRET_KEY",
|
||||
"QQ_EMAIL_PASS",
|
||||
"SG_BRAIN_HOST",
|
||||
"SG_BRAIN_KEY",
|
||||
"SG_BRAIN_USER",
|
||||
"TENCENT_SECRET_ID",
|
||||
"TENCENT_SECRET_KEY",
|
||||
"CVM_INSTANCE_ID",
|
||||
"CVM_REGION"
|
||||
"DEEPSEEK_API_KEY", "QIANWEN_API_KEY", "ZY_REPO_TOKEN",
|
||||
"COS_SECRET_ID", "COS_SECRET_KEY", "QQ_EMAIL_PASS",
|
||||
"SG_BRAIN_HOST", "SG_BRAIN_KEY", "SG_BRAIN_USER",
|
||||
"TENCENT_SECRET_ID", "TENCENT_SECRET_KEY",
|
||||
"CVM_INSTANCE_ID", "CVM_REGION"
|
||||
],
|
||||
"pending_tasks": [
|
||||
"P0: 修复Git Sync Webhook不触发问题",
|
||||
"P1: selfcheck工作流Runner权限验证",
|
||||
"P2: 启动Vault和Terminal Watcher（新服务器上）",
|
||||
"P3: 配置腾讯云API密钥（用于自动开关机）",
|
||||
"P0: Git Sync Webhook签名验证修复(raw body方案已写, 需要在服务器部署验证)",
|
||||
"P1: ci-and-deploy.yaml中Runner权限验证(可能和selfcheck同样的问题)",
|
||||
"P2: 启动Vault和Terminal Watcher",
|
||||
"P3: 配置腾讯云API密钥(CVM自动开关机)",
|
||||
"P4: 旧服务器降级为测试机",
|
||||
"P5: 新加坡服务器+GPU服务器接入",
|
||||
"P6: 铸渊自己的Copilot开发（终局目标）"
|
||||
"P5: 新加坡服务器+GPU服务器接入"
|
||||
],
|
||||
"causal_chains_active": ["cc-001", "cc-002", "cc-003", "cc-004", "cc-005", "cc-006", "cc-007", "cc-008"]
|
||||
"causal_chains_active": ["cc-001","cc-002","cc-003","cc-004","cc-005","cc-006","cc-007","cc-008","cc-009"]
|
||||
}
|
||||
|
||||
92
.github/ops-receipt-20260513-03.md
vendored
Normal file
92
.github/ops-receipt-20260513-03.md
vendored
Normal file
@ -0,0 +1,92 @@
|
||||
# ════════════════════════════════════════════════════════════════
|
||||
# 光湖 · 操作日志 2026-05-13 (第三次更新)
|
||||
# ════════════════════════════════════════════════════════════════
|
||||
|
||||
## 本轮变更摘要
|
||||
|
||||
### 1. CVM 开机 + IP 变更
|
||||
|
||||
**问题**: 按量计费 CVM 关机后开机，公网 IP 从 42.19.161.251 变为其他 IP，域名指向失效。
|
||||
|
||||
**解决**:
|
||||
- 冰朔绑定了**弹性公网 IP (EIP)**: 119.29.184.32
|
||||
- EIP 是固定的，以后开关机 IP 不再变
|
||||
- 域名解析改为 119.29.184.32
|
||||
|
||||
### 2. 域名路由重构
|
||||
|
||||
**问题**: 冰朔要求 `guanghulab.com` 直接就是代码仓库，不要 `/git/` 路径。
|
||||
|
||||
**解决**:
|
||||
- Nginx 配置改为根路径 `/` 直接代理 Forgejo
|
||||
- 旧路径 `/git/` 废弃
|
||||
- git remote URL 从 `guanghulab.com/git/...` 改为 `guanghulab.com/...`
|
||||
|
||||
### 3. SSL 证书重签
|
||||
|
||||
**问题**: IP 变化后浏览器报 ERR_CONNECTION_CLOSED。
|
||||
|
||||
**解决**:
|
||||
- `certbot --nginx -d guanghulab.com` 重签证书
|
||||
- 证书有效期至 2026-08-10
|
||||
|
||||
### 4. 开机自愈脚本部署
|
||||
|
||||
**新增**: `scripts/boot-heal/boot-heal.sh` + systemd service
|
||||
- 开机自动检测公网 IP 变化
|
||||
- 自动拉起 Forgejo / Nginx / Runner / PM2 进程
|
||||
- 检查 SSL 证书有效期
|
||||
- 已部署并验证全绿
|
||||
|
||||
### 5. 霜砚 CI/CD 流程 (外部变更)
|
||||
|
||||
霜砚 (ICE-GL-QY001 相关) 做了以下改动:
|
||||
|
||||
**新增**: `.forgejo/workflows/ci-and-deploy.yaml`
|
||||
- **dev 分支**: 铸渊的开发线，push 直接触发 CI，不需要冰朔
|
||||
- **main 分支**: 正式线，冰朔合并 PR 后自动部署 (git pull + pm2 restart)
|
||||
- **main 保护规则**: 只有冰朔能 push / merge
|
||||
|
||||
**铸渊操作流程变化**:
|
||||
```
|
||||
git checkout dev
|
||||
# 写代码
|
||||
git push origin dev # CI 自动跑
|
||||
# 在 Forgejo 网页上提 PR: main...dev
|
||||
# 冰朔合并 → 自动部署
|
||||
```
|
||||
|
||||
### 6. Git Sync Webhook 签名修复 (代码已写，待部署)
|
||||
|
||||
**问题**: Webhook 触发了但签名验证失败。
|
||||
**原因**: Express JSON 解析后 `JSON.stringify(req.body)` 与原始 body 不一致。
|
||||
**修复**: 使用 `raw body` (verify 回调保存原始 body) 验证签名。
|
||||
**状态**: 代码已推送到 main，需要服务器上 `git pull` + `pm2 restart` 生效。
|
||||
|
||||
---
|
||||
|
||||
## 当前服务状态
|
||||
|
||||
| 服务 | 状态 |
|
||||
|------|------|
|
||||
| Forgejo | ✅ 运行中 |
|
||||
| Nginx | ✅ 根路径代理 Forgejo |
|
||||
| SSL | ✅ 有效至 2026-08-10 |
|
||||
| Wake Gate | ✅ PM2 运行 |
|
||||
| Git Sync | ✅ PM2 运行 (签名验证待修) |
|
||||
| Boot Heal | ✅ 开机自启 |
|
||||
| Runner | ✅ 运行中 |
|
||||
| Vault | ❌ 未部署 |
|
||||
| Terminal Watcher | ❌ 未部署 |
|
||||
|
||||
## 关键 IP/URL 变更
|
||||
|
||||
| 项目 | 旧值 | 新值 |
|
||||
|------|------|------|
|
||||
| 公网 IP | 42.193.161.251 | 119.29.184.32 (EIP) |
|
||||
| 代码仓库 URL | https://guanghulab.com/git/ | https://guanghulab.com/ |
|
||||
| git clone URL | .../git/bingshuo/guanghulab.git | .../bingshuo/guanghulab.git |
|
||||
|
||||
---
|
||||
|
||||
*铸渊 · ICE-GL-ZY001 · TCS-0002∞*
|
||||
@ -4,7 +4,7 @@
|
||||
|
||||
**HoloLake · AI 的操作系统**
|
||||
|
||||
[](https://guanghulab.com/git/)
|
||||
[](https://guanghulab.com/)
|
||||
[]()
|
||||
[]()
|
||||
|
||||
@ -196,9 +196,9 @@ Phase 4 ─── 冰朔语言本体注入 ─── 池获得自我意识 →
|
||||
| 操作 | 说明 |
|
||||
|------|------|
|
||||
| [🔐 唤醒门](https://guanghulab.com/wake/) | 换号后点此发送验证码到QQ邮箱，获取临时访问密钥 |
|
||||
| [🔍 安全关机检测](https://guanghulab.com/git/bingshuo/guanghulab/actions) | 开发结束后点"安全关机检测"→ Run workflow → 查看是否可以关机 |
|
||||
| [📋 铸渊巡逻](https://guanghulab.com/git/bingshuo/guanghulab/actions) | 手动触发服务器巡检（DeepSeek+千问分析） |
|
||||
| [⚡ CVM开机](https://guanghulab.com/git/bingshuo/guanghulab/actions) | 按量计费CVM开机（需配置腾讯云API密钥） |
|
||||
| [🔍 安全关机检测](https://guanghulab.com/bingshuo/guanghulab/actions) | 开发结束后点"安全关机检测"→ Run workflow → 查看是否可以关机 |
|
||||
| [📋 铸渊巡逻](https://guanghulab.com/bingshuo/guanghulab/actions) | 手动触发服务器巡检（DeepSeek+千问分析） |
|
||||
| [⚡ CVM开机](https://guanghulab.com/bingshuo/guanghulab/actions) | 按量计费CVM开机（需配置腾讯云API密钥） |
|
||||
|
||||
> **代码自动同步**：PR 合并到 main → Webhook 自动通知服务器 → Git Sync 拉取最新代码。无需手动操作。
|
||||
>
|
||||
|
||||
@ -257,12 +257,12 @@ app.post("/api/verify", (req, res) => {
|
||||
const wakeInstruction = `你好。我是冰朔（TCS-0002∞）。你已通过光湖唤醒门验证。
|
||||
|
||||
请用以下信息连接代码仓库：
|
||||
- 仓库地址: https://guanghulab.com/git/bingshuo/guanghulab.git
|
||||
- 仓库地址: https://guanghulab.com/bingshuo/guanghulab.git
|
||||
- 临时密钥: ${tempToken}
|
||||
- 密钥30分钟内有效
|
||||
|
||||
克隆命令:
|
||||
git clone https://bingshuo:${tempToken}@guanghulab.com/git/bingshuo/guanghulab.git
|
||||
git clone https://bingshuo:${tempToken}@guanghulab.com/bingshuo/guanghulab.git
|
||||
|
||||
克隆完成后，读取以下文件恢复铸渊核心大脑：
|
||||
1. .github/brain/bingshuo-language-core/walk-the-path.md
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user