From 06ba76e22bb56a57c488361a06d8daba3a17674b Mon Sep 17 00:00:00 2001
From: wangjia <809946525@qq.com>
Date: Mon, 6 Jul 2026 16:47:32 +0800
Subject: [PATCH] =?UTF-8?q?feat(deploy):=208080=20=E6=94=B6=20loopback=20+?=
 =?UTF-8?q?=20=E5=85=B3=208080=20=E9=98=B2=E7=81=AB=E5=A2=99=20+=20?=
 =?UTF-8?q?=E5=81=A5=E5=BA=B7=E6=A3=80=E6=9F=A5=E6=94=B9=E6=9C=AC=E5=9C=B0?=
 =?UTF-8?q?/=E9=9A=A7=E9=81=93(=E9=80=80=E5=BD=B9=E6=98=8E=E6=96=87?=
 =?UTF-8?q?=E6=8E=A7=E5=88=B6=E5=8F=A3)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013nMthbVEmQquxBRKb9Fj8u
---
 deploy/single-node/deploy.sh | 8 ++------
 scripts/ci/deploy-server.sh  | 4 +++-
 2 files changed, 5 insertions(+), 7 deletions(-)

diff --git a/deploy/single-node/deploy.sh b/deploy/single-node/deploy.sh
index 6c88549..4c38ed2 100755
--- a/deploy/single-node/deploy.sh
+++ b/deploy/single-node/deploy.sh
@@ -164,7 +164,7 @@ cat > "$ETC/server.env" <<EOF
 DB_DRIVER=sqlite
 DB_DSN=$DB_FILE
 REDIS_ADDR=127.0.0.1:6379
-ADDR=:$HTTP_PORT
+ADDR=127.0.0.1:$HTTP_PORT
 JWT_PRIVATE_KEY_PATH=$ETC/jwt_private.pem
 JWT_KEY_ID=node-key-1
 JWT_PUBLIC_KEYS=node-key-1:$ETC/jwt_public.pem
@@ -287,11 +287,7 @@ log "启用 sing-box + 启动 agent ..."
 systemctl enable sing-box.service
 systemctl enable --now pangolin-agent.service
 
-# 放行控制面 API 端口(若 ufw 启用)。⚠️ 明文,生产应前置 TLS。
-if command -v ufw >/dev/null 2>&1 && ufw status 2>/dev/null | grep -q "Status: active"; then
-  ufw allow "${HTTP_PORT}/tcp" >/dev/null 2>&1 || true
-  log "ufw 放行 ${HTTP_PORT}/tcp(控制面 API,明文)"
-fi
+# 控制面 API 已绑 127.0.0.1(经 cloudflared 隧道对外),不放行 8080/tcp。
 
 # ── cloudflared:按需启用(需 /etc/pangolin/cloudflared.env 提供 TUNNEL_TOKEN)───
 if [ -f /etc/pangolin/cloudflared.env ]; then
diff --git a/scripts/ci/deploy-server.sh b/scripts/ci/deploy-server.sh
index 1a9dbf6..90f7406 100644
--- a/scripts/ci/deploy-server.sh
+++ b/scripts/ci/deploy-server.sh
@@ -54,6 +54,8 @@ systemctl start pangolin-server
 systemctl is-active pangolin-server
 REMOTE
 
-curl -fsS -m 10 --retry 5 --retry-connrefused "http://${DEPLOY_HOST}:8080/healthz" >/dev/null && echo "healthz OK"
+# 8080 现仅 loopback(经 cloudflared 隧道对外):ssh 内本地校验 + 经隧道校验对外真实可达。
+$SSH "root@${DEPLOY_HOST}" 'curl -fsS -m 10 --retry 5 --retry-connrefused http://127.0.0.1:8080/healthz >/dev/null && echo "healthz(local) OK"'
+curl -fsS -m 10 --retry 5 "https://api.yanmeiai.com/healthz" >/dev/null && echo "healthz(tunnel) OK"
 
 echo "==> deploy-server: done"