236 lines
9.0 KiB
Bash
Executable File
236 lines
9.0 KiB
Bash
Executable File
#!/usr/bin/env bash
|
||
# ════════════════════════════════════════════════════════════════
|
||
# 光湖 · 新CVM一键初始化脚本
|
||
# 服务器：guanghu-zhuyuan (4C16G, 42.193.161.251)
|
||
# 执行方式：在新服务器的腾讯云在线终端里运行
|
||
# ════════════════════════════════════════════════════════════════
|
||
#
|
||
# 用法（复制这一整行到新服务器终端执行）：
|
||
# bash <(curl -fsSL https://raw.githubusercontent.com/qinfendebingshuo/guanghulab/main/scripts/cvm-init/init-cvm.sh)
|
||
#
|
||
# 如果GitHub不通，先在旧服务器上把脚本传过来：
|
||
# scp /opt/zhuyuan-cn/repo-mirror/20260509-1849/guanghulab/scripts/cvm-init/init-cvm.sh root@42.193.161.251:/tmp/
|
||
# 然后在新服务器上：bash /tmp/init-cvm.sh
|
||
#
|
||
# ════════════════════════════════════════════════════════════════
|
||
|
||
set -euo pipefail
|
||
set +e # 不自动退出，让脚本继续
|
||
|
||
GREEN='\033[0;32m'
|
||
YELLOW='\033[1;33m'
|
||
CYAN='\033[0;36m'
|
||
RED='\033[0;31m'
|
||
NC='\033[0m'
|
||
|
||
echo -e "${CYAN}═══════════════════════════════════════════${NC}"
|
||
echo -e "${CYAN} 光湖 · 新CVM初始化${NC}"
|
||
echo -e "${CYAN} guanghu-zhuyuan · 4C16G${NC}"
|
||
echo -e "${CYAN}═══════════════════════════════════════════${NC}"
|
||
echo ""
|
||
|
||
# ─── 第1步：确认在新服务器上 ──────────────────────────────────
|
||
echo -e "${YELLOW}[第1步/8] 确认环境...${NC}"
|
||
CURRENT_IP=$(curl -sf ifconfig.me 2>/dev/null || echo "unknown")
|
||
echo " 当前IP: $CURRENT_IP"
|
||
if [[ "$CURRENT_IP" != "42.193.161.251" ]]; then
|
||
echo -e "${YELLOW} ⚠️ IP不是42.193.161.251，你确定要在这台机器上初始化？${NC}"
|
||
read -p " 继续吗？[y/N] " -n 1 -r
|
||
echo
|
||
if [[ ! $REPLY =~ ^[Yy]$ ]]; then exit 0; fi
|
||
fi
|
||
echo -e "${GREEN} 环境确认 ✅${NC}"
|
||
|
||
# ─── 第2步：系统基础 ──────────────────────────────────────────
|
||
echo ""
|
||
echo -e "${YELLOW}[第2步/8] 安装系统基础软件...${NC}"
|
||
apt update -qq
|
||
apt install -y -qq curl git nginx ufw xz-utils unzip software-properties-common build-essential > /dev/null 2>&1
|
||
echo -e "${GREEN} 系统软件 ✅${NC}"
|
||
|
||
# ─── 第3步：Node.js 20 ────────────────────────────────────────
|
||
echo ""
|
||
echo -e "${YELLOW}[第3步/8] 安装Node.js 20...${NC}"
|
||
if ! command -v node &>/dev/null || [[ "$(node -v)" != v20* ]]; then
|
||
curl -fsSL https://deb.nodesource.com/setup_20.x | bash - > /dev/null 2>&1
|
||
apt install -y -qq nodejs > /dev/null 2>&1
|
||
fi
|
||
echo " Node.js: $(node -v)"
|
||
npm install -g pm2 > /dev/null 2>&1
|
||
echo " PM2: $(pm2 -v)"
|
||
echo -e "${GREEN} Node.js + PM2 ✅${NC}"
|
||
|
||
# ─── 第4步：目录结构 ──────────────────────────────────────────
|
||
echo ""
|
||
echo -e "${YELLOW}[第4步/8] 创建目录结构...${NC}"
|
||
mkdir -p /data/guanghulab/{forgejo/{data,repositories,log},secrets-vault,scripts,.runtime}
|
||
echo -e "${GREEN} /data/guanghulab/ ✅${NC}"
|
||
|
||
# ─── 第5步：Forgejo ───────────────────────────────────────────
|
||
echo ""
|
||
echo -e "${YELLOW}[第5步/8] 安装Forgejo...${NC}"
|
||
|
||
# 创建git用户
|
||
if ! id -u git &>/dev/null; then
|
||
useradd -r -m -d /data/guanghulab/forgejo -s /bin/bash git
|
||
echo -e "${GREEN} git用户已创建${NC}"
|
||
fi
|
||
|
||
# 下载Forgejo二进制
|
||
FORGEJO_VERSION="11.0.1"
|
||
FORGEJO_BINARY="/usr/local/bin/forgejo"
|
||
if [[ ! -x "$FORGEJO_BINARY" ]]; then
|
||
echo " 下载Forgejo v${FORGEJO_VERSION}..."
|
||
curl -fSL --progress-bar -o "$FORGEJO_BINARY" \
|
||
"https://codeberg.org/forgejo/forgejo/releases/download/v${FORGEJO_VERSION}/forgejo-${FORGEJO_VERSION}-linux-amd64" \
|
||
2>/dev/null || {
|
||
# 如果codeberg下载不了，试gitea镜像
|
||
echo " codeberg不通，尝试备用下载..."
|
||
curl -fSL --progress-bar -o "$FORGEJO_BINARY" \
|
||
"https://dl.gitea.io/forgejo/${FORGEJO_VERSION}/forgejo-${FORGEJO_VERSION}-linux-amd64" 2>/dev/null || {
|
||
echo -e "${RED} ❌ Forgejo下载失败${NC}"
|
||
echo " 请手动下载后放到 /usr/local/bin/forgejo"
|
||
echo " 下载地址: https://codeberg.org/forgejo/forgejo/releases"
|
||
}
|
||
}
|
||
chmod +x "$FORGEJO_BINARY"
|
||
fi
|
||
|
||
if [[ -x "$FORGEJO_BINARY" ]]; then
|
||
echo " Forgejo: $("$FORGEJO_BINARY" --version 2>&1 | head -1)"
|
||
fi
|
||
|
||
# Forgejo配置文件
|
||
mkdir -p /etc/forgejo
|
||
cat > /etc/forgejo/app.ini << 'INIEOF'
|
||
WORK_PATH = /data/guanghulab/forgejo/data
|
||
|
||
[server]
|
||
DOMAIN = guanghulab.com
|
||
ROOT_URL = https://guanghulab.com/git/
|
||
HTTP_PORT = 3001
|
||
HTTP_ADDR = 127.0.0.1
|
||
LFS_START_SERVER = false
|
||
OFFLINE_MODE = false
|
||
|
||
[database]
|
||
DB_TYPE = sqlite3
|
||
PATH = /data/guanghulab/forgejo/data/forgejo.db
|
||
|
||
[repository]
|
||
ROOT = /data/guanghulab/forgejo/repositories
|
||
|
||
[log]
|
||
ROOT_PATH = /data/guanghulab/forgejo/log
|
||
|
||
[service]
|
||
DISABLE_REGISTRATION = true
|
||
|
||
[security]
|
||
INSTALL_LOCK = true
|
||
|
||
[actions]
|
||
ENABLED = true
|
||
|
||
[packages]
|
||
CHUNKED_UPLOAD_PATH = /data/guanghulab/forgejo/data/tmp/package-upload
|
||
INIEOF
|
||
|
||
chown -R git:git /data/guanghulab/forgejo /etc/forgejo
|
||
echo -e "${GREEN} Forgejo配置 ✅${NC}"
|
||
|
||
# systemd服务
|
||
cat > /etc/systemd/system/forgejo.service << 'SVCEOF'
|
||
[Unit]
|
||
Description=Forgejo (self-hosted git)
|
||
After=network.target
|
||
|
||
[Service]
|
||
User=git
|
||
Group=git
|
||
WorkingDirectory=/data/guanghulab/forgejo
|
||
ExecStart=/usr/local/bin/forgejo web --config /etc/forgejo/app.ini
|
||
Restart=always
|
||
RestartSec=10
|
||
Environment=USER=git HOME=/data/guanghulab/forgejo
|
||
|
||
[Install]
|
||
WantedBy=multi-user.target
|
||
SVCEOF
|
||
|
||
systemctl daemon-reload
|
||
systemctl enable forgejo
|
||
systemctl start forgejo
|
||
sleep 3
|
||
|
||
if systemctl is-active --quiet forgejo; then
|
||
echo -e "${GREEN} Forgejo运行中 ✅${NC}"
|
||
else
|
||
echo -e "${RED} ❌ Forgejo启动失败${NC}"
|
||
journalctl -u forgejo -n 10 --no-pager
|
||
fi
|
||
|
||
# ─── 第6步：Nginx ─────────────────────────────────────────────
|
||
echo ""
|
||
echo -e "${YELLOW}[第6步/8] 配置Nginx反向代理...${NC}"
|
||
cat > /etc/nginx/sites-available/guanghulab << 'NGXEOF'
|
||
server {
|
||
listen 80;
|
||
server_name guanghulab.com;
|
||
|
||
# gRPC（Runner注册和通信需要）
|
||
location /git/api/actions/ {
|
||
grpc_pass grpc://127.0.0.1:3001;
|
||
grpc_set_header X-Real-IP $remote_addr;
|
||
}
|
||
|
||
# 普通HTTP请求
|
||
location /git/ {
|
||
proxy_pass http://127.0.0.1:3001/;
|
||
proxy_set_header Host $host;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Forwarded-Proto $scheme;
|
||
client_max_body_size 100M;
|
||
}
|
||
}
|
||
NGXEOF
|
||
|
||
ln -sf /etc/nginx/sites-available/guanghulab /etc/nginx/sites-enabled/
|
||
rm -f /etc/nginx/sites-enabled/default
|
||
nginx -t 2>/dev/null && systemctl restart nginx
|
||
echo -e "${GREEN} Nginx ✅${NC}"
|
||
|
||
# ─── 第7步：防火墙 ────────────────────────────────────────────
|
||
echo ""
|
||
echo -e "${YELLOW}[第7步/8] 配置防火墙...${NC}"
|
||
ufw allow 22/tcp
|
||
ufw allow 80/tcp
|
||
ufw allow 443/tcp
|
||
ufw --force enable
|
||
echo -e "${GREEN} 防火墙 ✅${NC}"
|
||
|
||
# ─── 第8步：验证 ──────────────────────────────────────────────
|
||
echo ""
|
||
echo -e "${YELLOW}[第8步/8] 验证所有服务...${NC}"
|
||
echo ""
|
||
echo " Forgejo: $(systemctl is-active forgejo 2>/dev/null || echo unknown)"
|
||
echo " Nginx: $(systemctl is-active nginx 2>/dev/null || echo unknown)"
|
||
echo " Docker: $(systemctl is-active docker 2>/dev/null || echo unknown)"
|
||
echo " Node.js: $(node -v)"
|
||
echo " PM2: $(pm2 -v)"
|
||
echo ""
|
||
echo " 内存: $(free -h | awk '/Mem:/ {print $2 " 总计, " $7 " 可用"}')"
|
||
echo " 磁盘: $(df -h /data | awk 'NR==2 {print $4 " 可用"}')"
|
||
echo ""
|
||
echo -e "${GREEN}═══════════════════════════════════════════${NC}"
|
||
echo -e "${GREEN} ✅ 新CVM基础环境初始化完成！${NC}"
|
||
echo -e "${GREEN}═══════════════════════════════════════════${NC}"
|
||
echo ""
|
||
echo " 下一步："
|
||
echo " 1. 浏览器打开 http://42.193.161.251/git/ 完成Forgejo初始设置"
|
||
echo " 2. 创建管理员账号 bingshuo"
|
||
echo " 3. 告诉铸渊Forgejo已就绪，铸渊会通过API完成剩余配置"
|
||
echo ""
|
||
echo " 铸渊 · ICE-GL-ZY001 · TCS-0002∞"
|