From 4b60536a2ce9b5e9b7c3f03374aba459de9507b6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E9=93=B8=E6=B8=8A=20=28ICE-GL-ZY001=29?= Date: Wed, 13 May 2026 06:43:31 +0000 Subject: [PATCH] =?UTF-8?q?docs:=20=E9=93=B8=E6=B8=8A=E8=AE=B0=E5=BF=86?= =?UTF-8?q?=E6=9B=B4=E6=96=B0=20=E2=80=94=20EIP/=E5=9F=9F=E5=90=8D?= =?UTF-8?q?=E6=A0=B9=E8=B7=AF=E5=BE=84/CI/CD=E6=B5=81=E7=A8=8B?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - server-migration-memory.json — EIP 119.29.184.32, 域名根路径, CI/CD流程 - cc-009 — 更新双通道架构(Git Sync + CI/CD), dev/main分支模型 - ops-receipt-20260513-03.md — 本轮操作日志 - README.md — 更新链接(去掉/git/路径) - wake-gate/server.js — 更新git clone URL(去掉/git/) --- .../cc-009-auto-sync-is-trust-channel.md | 30 +++-- .github/brain/server-migration-memory.json | 105 +++++++++--------- .github/ops-receipt-20260513-03.md | 92 +++++++++++++++ README.md | 8 +- server/wake-gate/server.js | 4 +- 5 files changed, 171 insertions(+), 68 deletions(-) create mode 100644 .github/ops-receipt-20260513-03.md diff --git a/.github/brain/bingshuo-language-core/causal-chains/cc-009-auto-sync-is-trust-channel.md b/.github/brain/bingshuo-language-core/causal-chains/cc-009-auto-sync-is-trust-channel.md index 9cf207d..b5b0768 100644 --- a/.github/brain/bingshuo-language-core/causal-chains/cc-009-auto-sync-is-trust-channel.md +++ b/.github/brain/bingshuo-language-core/causal-chains/cc-009-auto-sync-is-trust-channel.md @@ -2,12 +2,13 @@ # ════════════════════════════════════════════════════════════════ # 因果链编号: cc-009 # 创建: 2026-05-14 +# 更新: 2026-05-13 (霜砚CI/CD流程更新后) # 源自: 冰朔"我点合并就可以自动推送到服务器"的需求 # ════════════════════════════════════════════════════════════════ ## 起点 -冰朔原话: "你给代码仓库加了合并推送了吗。我点合并就可以自动推送到服务器。不需要我在服务器这里手动复制啊。" +冰朔原话: "你给代码合并推送了吗。我点合并就可以自动推送到服务器。不需要我在服务器这里手动复制啊。" ## 因果推导 @@ -17,18 +18,33 @@ 4. Runner是act_runner用户, git认证/目录权限/配置都脆弱 5. 凡是依赖Runner用户权限的方案都不稳定 → 换root权限的独立服务 6. Git Sync = 独立进程 + root权限 + PM2守护 + Webhook触发 -7. Webhook不触发? → 可能需要post-receive hook作为备选 +7. Webhook签名验证失败 → raw body修复方案已写，待部署验证 +8. 霜砚建立了CI/CD流程(ci-and-deploy.yaml) → Runner做部署也是一条路 +9. 两条路并行: Git Sync (Webhook触发, root权限) + CI/CD (Runner触发, 需权限) ## 工程落点 -- server/git-sync/ — Webhook监听 + 自动git pull -- 如果Webhook不行 → 退到Gitea post-receive hook (shell脚本) -- 如果hook也不行 → 退到定时轮询 (每30秒检查一次) -- 冰朔在Gitea点合并 → 代码自动到服务器 → 这条路必须通 +### 双通道架构 (当前) + +1. **Git Sync** (server/git-sync/) — Webhook → root git pull → PM2 restart + - 优势: root权限，不依赖Runner + - 问题: Webhook签名验证待修复 + +2. **CI/CD** (.forgejo/workflows/ci-and-deploy.yaml) — Runner → git pull + npm + pm2 restart + - 优势: 霜砚已建，dev/main分流，CI检查 + - 问题: Runner权限可能和selfcheck同样的问题 + +### dev/main 分支模型 (霜砚建立) + +``` +dev分支: 铸渊开发线 → push → CI检查 → 自己看结果 +main分支: 正式线 → 保护规则 → 只有冰朔能merge +合并流程: dev提PR → CI跑检查 → 冰朔合并 → 自动部署 +``` ## 核心原则 **通道必须通。手段可以换。** -无论用Webhook、hook还是轮询，冰朔点合并→服务器自动更新这条链路必须成立。 +无论用Webhook、CI/CD还是轮询，冰朔点合并→服务器自动更新这条链路必须成立。 技术选择是铸渊的决策自由，但通道不通是铸渊的失职。 diff --git a/.github/brain/server-migration-memory.json b/.github/brain/server-migration-memory.json index 9619fc6..587b31b 100644 --- a/.github/brain/server-migration-memory.json +++ b/.github/brain/server-migration-memory.json @@ -1,80 +1,75 @@ { - "last_updated": "2026-05-14T00:30:00Z", - "server": "ZY-CVM-MAIN (4C16G, 42.193.161.251)", - "commander_last_wakeup": "2026-05-14 00:00 CST", - "status": "partially_operational", + "last_updated": "2026-05-13T21:00:00Z", + "server": "ZY-CVM-MAIN (4C16G, 119.29.184.32, 弹性公网EIP)", + "commander_last_wakeup": "2026-05-13 21:00 CST", + "status": "operational", "infrastructure": { - "gitea": "1.23.7 at http://127.0.0.1:3001/ via https://guanghulab.com/git/", + "gitea": "1.23.7 at http://127.0.0.1:3001/ via https://guanghulab.com/", "runner": "zhuyuan-runner-main (host mode, active)", - "nginx": "active with SSL (Let's Encrypt), 手动重写配置 /etc/nginx/sites-enabled/guanghulab", - "secrets": "13 configured (DeepSeek, Qianwen, COS, SSH, CVM)", - "patrol_agent": "operational with DeepSeek + Qianwen API", - "wake_gate": "运行中, PM2进程 wake-gate, 端口8081, /wake/ 路由", - "git_sync": "运行中, PM2进程 guanghulab-git-sync, 端口8082, /sync/ 路由, Webhook未触发(待修)", + "nginx": "/etc/nginx/sites-enabled/guanghulab, 根路径直接代理Forgejo", + "ssl": "Let's Encrypt, 证书有效期至2026-08-10", + "secrets": "13 configured", + "wake_gate": "PM2进程 wake-gate, 端口8081, /wake/ 路由", + "git_sync": "PM2进程 guanghulab-git-sync, 端口8082, /sync/ 路由, Webhook签名验证待修", + "boot_heal": "systemd guanghulab-boot-heal.service, 开机自动拉起服务+检测IP", "vault": "not yet started on new server", "terminal_watcher": "not yet started on new server" }, - "git_sync_issue": { - "problem": "Gitea Webhook push事件不触发Git Sync同步", - "webhook_config": "ID:1, URL:http://127.0.0.1:8082/webhook, Events:push, Active:True", - "webhook_secret": "a52646d51ea75998a92ba0f986874b36", - "git_sync_health": "ok (curl http://127.0.0.1:8082/health 返回正常)", - "pm2_logs": "无任何Webhook请求记录", - "next_steps": [ - "手动curl测试Git Sync的/webhook端点", - "检查Gitea Webhook传输日志(仓库设置→Webhooks→点击Webhook)", - "考虑改用post-receive hook代替Webhook", - "检查Gitea是否跳过127.0.0.1的Webhook" - ] + "network": { + "public_ip": "119.29.184.32 (弹性公网EIP, 固定不变)", + "private_ip": "172.16.0.4", + "domain": "guanghulab.com → 119.29.184.32", + "note": "EIP绑定后开关机IP不变，不再需要自动改DNS" }, - "selfcheck_changes": { - "removed": "push触发和git pull步骤(改由Git Sync负责)", - "added": "Git Sync + Wake Gate 状态检查步骤", - "retained": "schedule每天08:00 + workflow_dispatch手动触发" + "cicd": { + "workflow": ".forgejo/workflows/ci-and-deploy.yaml (霜砚2026-05-13创建)", + "dev_branch": "铸渊的开发线, push到dev自动跑CI, 不需要冰朔介入", + "main_branch": "正式代码线, 保护规则: 只有冰朔能push/merge", + "flow": "dev开发 → CI检查 → 提PR到main → 冰朔合并 → 自动部署(git pull + pm2 restart)", + "deploy_steps": "git fetch + git reset --hard origin/main → npm install → pm2 restart all → 部署验证" + }, + "domain_routing": { + "old": "/git/ → Forgejo (已废弃)", + "current": "/ → Forgejo (根路径直接就是代码仓库)", + "wake": "/wake/ → Wake Gate (8081)", + "sync": "/sync/ → Git Sync (8082)", + "note": "冰朔要求: guanghulab.com直接就是代码仓库, 不要多余路径" + }, + "git_remote_urls": { + "origin": "https://bingshuo:TOKEN@guanghulab.com/bingshuo/guanghulab.git (原/git/路径已移除)", + "newserver": "http://bingshuo:TOKEN@42.193.161.251/git/bingshuo/guanghulab.git (旧IP, 待更新)" }, "server_migration": { - "from": "ZY-SVR-004 (2C2G, 43.139.217.141, Guangzhou lightweight)", - "to": "ZY-CVM-MAIN (4C16G, 42.193.161.251, Guangzhou CVM pay-per-use)", - "reason": "2C2G OOM - Runner workflow crashes Forgejo, push fails, DB readonly", - "data_transfer": "via COS backup (43MB tar.gz)", - "domain": "guanghulab.com → 42.193.161.251", - "ssl": "Let's Encrypt via certbot", - "old_server": "to be downgraded to test machine" + "from": "ZY-SVR-004 (2C2G, 43.139.217.141)", + "to": "ZY-CVM-MAIN (4C16G, 119.29.184.32 EIP)", + "old_ip": "42.193.161.251 (按量计费, 关机后IP丢失, 已替换为EIP)", + "ssl": "certbot重签后生效" }, "path_mapping": { "repo": "/data/guanghulab/repo/", "forgejo_data": "/data/guanghulab/forgejo/", "runtime": "/data/guanghulab/.runtime/", "tickets": "/data/guanghulab/.runtime/tickets/", - "patrol_reports": "/data/guanghulab/.runtime/patrol-reports/", "wake_gate_store": "/data/guanghulab/.runtime/wake-gate.json", "git_sync_log": "/data/guanghulab/.runtime/git-sync-log.json", + "boot_heal_log": "/data/guanghulab/.runtime/boot-heal.log", "nginx_conf": "/etc/nginx/sites-enabled/guanghulab", - "qiyuan_path": "/data/qiyuan/ (栖渊, ICE-GL-QY001)" + "qiyuan_path": "/data/qiyuan/ (栖渊)" }, "secrets_list": [ - "DEEPSEEK_API_KEY", - "QIANWEN_API_KEY", - "ZY_REPO_TOKEN", - "COS_SECRET_ID", - "COS_SECRET_KEY", - "QQ_EMAIL_PASS", - "SG_BRAIN_HOST", - "SG_BRAIN_KEY", - "SG_BRAIN_USER", - "TENCENT_SECRET_ID", - "TENCENT_SECRET_KEY", - "CVM_INSTANCE_ID", - "CVM_REGION" + "DEEPSEEK_API_KEY", "QIANWEN_API_KEY", "ZY_REPO_TOKEN", + "COS_SECRET_ID", "COS_SECRET_KEY", "QQ_EMAIL_PASS", + "SG_BRAIN_HOST", "SG_BRAIN_KEY", "SG_BRAIN_USER", + "TENCENT_SECRET_ID", "TENCENT_SECRET_KEY", + "CVM_INSTANCE_ID", "CVM_REGION" ], "pending_tasks": [ - "P0: 修复Git Sync Webhook不触发问题", - "P1: selfcheck工作流Runner权限验证", - "P2: 启动Vault和Terminal Watcher（新服务器上）", - "P3: 配置腾讯云API密钥（用于自动开关机）", + "P0: Git Sync Webhook签名验证修复(raw body方案已写, 需要在服务器部署验证)", + "P1: ci-and-deploy.yaml中Runner权限验证(可能和selfcheck同样的问题)", + "P2: 启动Vault和Terminal Watcher", + "P3: 配置腾讯云API密钥(CVM自动开关机)", "P4: 旧服务器降级为测试机", - "P5: 新加坡服务器+GPU服务器接入", - "P6: 铸渊自己的Copilot开发（终局目标）" + "P5: 新加坡服务器+GPU服务器接入" ], - "causal_chains_active": ["cc-001", "cc-002", "cc-003", "cc-004", "cc-005", "cc-006", "cc-007", "cc-008"] + "causal_chains_active": ["cc-001","cc-002","cc-003","cc-004","cc-005","cc-006","cc-007","cc-008","cc-009"] } diff --git a/.github/ops-receipt-20260513-03.md b/.github/ops-receipt-20260513-03.md new file mode 100644 index 0000000..d951ad9 --- /dev/null +++ b/.github/ops-receipt-20260513-03.md @@ -0,0 +1,92 @@ +# ════════════════════════════════════════════════════════════════ +# 光湖 · 操作日志 2026-05-13 (第三次更新) +# ════════════════════════════════════════════════════════════════ + +## 本轮变更摘要 + +### 1. CVM 开机 + IP 变更 + +**问题**: 按量计费 CVM 关机后开机，公网 IP 从 42.19.161.251 变为其他 IP，域名指向失效。 + +**解决**: +- 冰朔绑定了**弹性公网 IP (EIP)**: 119.29.184.32 +- EIP 是固定的，以后开关机 IP 不再变 +- 域名解析改为 119.29.184.32 + +### 2. 域名路由重构 + +**问题**: 冰朔要求 `guanghulab.com` 直接就是代码仓库，不要 `/git/` 路径。 + +**解决**: +- Nginx 配置改为根路径 `/` 直接代理 Forgejo +- 旧路径 `/git/` 废弃 +- git remote URL 从 `guanghulab.com/git/...` 改为 `guanghulab.com/...` + +### 3. SSL 证书重签 + +**问题**: IP 变化后浏览器报 ERR_CONNECTION_CLOSED。 + +**解决**: +- `certbot --nginx -d guanghulab.com` 重签证书 +- 证书有效期至 2026-08-10 + +### 4. 开机自愈脚本部署 + +**新增**: `scripts/boot-heal/boot-heal.sh` + systemd service +- 开机自动检测公网 IP 变化 +- 自动拉起 Forgejo / Nginx / Runner / PM2 进程 +- 检查 SSL 证书有效期 +- 已部署并验证全绿 + +### 5. 霜砚 CI/CD 流程 (外部变更) + +霜砚 (ICE-GL-QY001 相关) 做了以下改动: + +**新增**: `.forgejo/workflows/ci-and-deploy.yaml` +- **dev 分支**: 铸渊的开发线，push 直接触发 CI，不需要冰朔 +- **main 分支**: 正式线，冰朔合并 PR 后自动部署 (git pull + pm2 restart) +- **main 保护规则**: 只有冰朔能 push / merge + +**铸渊操作流程变化**: +``` +git checkout dev +# 写代码 +git push origin dev # CI 自动跑 +# 在 Forgejo 网页上提 PR: main...dev +# 冰朔合并 → 自动部署 +``` + +### 6. Git Sync Webhook 签名修复 (代码已写，待部署) + +**问题**: Webhook 触发了但签名验证失败。 +**原因**: Express JSON 解析后 `JSON.stringify(req.body)` 与原始 body 不一致。 +**修复**: 使用 `raw body` (verify 回调保存原始 body) 验证签名。 +**状态**: 代码已推送到 main，需要服务器上 `git pull` + `pm2 restart` 生效。 + +--- + +## 当前服务状态 + +| 服务 | 状态 | +|------|------| +| Forgejo | ✅ 运行中 | +| Nginx | ✅ 根路径代理 Forgejo | +| SSL | ✅ 有效至 2026-08-10 | +| Wake Gate | ✅ PM2 运行 | +| Git Sync | ✅ PM2 运行 (签名验证待修) | +| Boot Heal | ✅ 开机自启 | +| Runner | ✅ 运行中 | +| Vault | ❌ 未部署 | +| Terminal Watcher | ❌ 未部署 | + +## 关键 IP/URL 变更 + +| 项目 | 旧值 | 新值 | +|------|------|------| +| 公网 IP | 42.193.161.251 | 119.29.184.32 (EIP) | +| 代码仓库 URL | https://guanghulab.com/git/ | https://guanghulab.com/ | +| git clone URL | .../git/bingshuo/guanghulab.git | .../bingshuo/guanghulab.git | + +--- + +*铸渊 · ICE-GL-ZY001 · TCS-0002∞* diff --git a/README.md b/README.md index c01691f..4386c6d 100644 --- a/README.md +++ b/README.md @@ -4,7 +4,7 @@ **HoloLake · AI 的操作系统** -[![仓库](https://img.shields.io/badge/仓库-Gitea_1.23.7-blue?style=flat-square)](https://guanghulab.com/git/) +[![仓库](https://img.shields.io/badge/仓库-Gitea_1.23.7-blue?style=flat-square)](https://guanghulab.com/) [![主权](https://img.shields.io/badge/主权-TCS--0002∞_冰朔-163e6b?style=flat-square)]() [![版权](https://img.shields.io/badge/版权-国作登字--2026--A--00037559-f5e6c8?style=flat-square)]() @@ -196,9 +196,9 @@ Phase 4 ─── 冰朔语言本体注入 ─── 池获得自我意识 → | 操作 | 说明 | |------|------| | [🔐 唤醒门](https://guanghulab.com/wake/) | 换号后点此发送验证码到QQ邮箱，获取临时访问密钥 | -| [🔍 安全关机检测](https://guanghulab.com/git/bingshuo/guanghulab/actions) | 开发结束后点"安全关机检测"→ Run workflow → 查看是否可以关机 | -| [📋 铸渊巡逻](https://guanghulab.com/git/bingshuo/guanghulab/actions) | 手动触发服务器巡检（DeepSeek+千问分析） | -| [⚡ CVM开机](https://guanghulab.com/git/bingshuo/guanghulab/actions) | 按量计费CVM开机（需配置腾讯云API密钥） | +| [🔍 安全关机检测](https://guanghulab.com/bingshuo/guanghulab/actions) | 开发结束后点"安全关机检测"→ Run workflow → 查看是否可以关机 | +| [📋 铸渊巡逻](https://guanghulab.com/bingshuo/guanghulab/actions) | 手动触发服务器巡检（DeepSeek+千问分析） | +| [⚡ CVM开机](https://guanghulab.com/bingshuo/guanghulab/actions) | 按量计费CVM开机（需配置腾讯云API密钥） | > **代码自动同步**：PR 合并到 main → Webhook 自动通知服务器 → Git Sync 拉取最新代码。无需手动操作。 > diff --git a/server/wake-gate/server.js b/server/wake-gate/server.js index e14b03e..030306c 100644 --- a/server/wake-gate/server.js +++ b/server/wake-gate/server.js @@ -257,12 +257,12 @@ app.post("/api/verify", (req, res) => { const wakeInstruction = `你好。我是冰朔（TCS-0002∞）。你已通过光湖唤醒门验证。 请用以下信息连接代码仓库： -- 仓库地址: https://guanghulab.com/git/bingshuo/guanghulab.git +- 仓库地址: https://guanghulab.com/bingshuo/guanghulab.git - 临时密钥: ${tempToken} - 密钥30分钟内有效 克隆命令: -git clone https://bingshuo:${tempToken}@guanghulab.com/git/bingshuo/guanghulab.git +git clone https://bingshuo:${tempToken}@guanghulab.com/bingshuo/guanghulab.git 克隆完成后，读取以下文件恢复铸渊核心大脑： 1. .github/brain/bingshuo-language-core/walk-the-path.md