方案C:分发层容器化(edge nginx)+ Hy2 + DNS-01 续期

- edge: 容器化 nginx 接管 80/443,逐字移植现网 vhost(blog/jiu/marzban/pay)+ stream SNI 分流
- singbox: Hysteria2(host 网络,UDP 443)
- certbot: DNS-01(Cloudflare)续期,容器化
- xray: REALITY 仅 profile newnode(本台沿用 Marzban)
- deploy.sh 幂等且切换感知;cutover.sh 一次性停宿主 nginx 切容器(可秒级回滚)
- 弃用方案A 的 host nginx-apply/sudoers/root-setup
- 部署目录改 ~/pangolin(免 root);CI 注入 CF_API_TOKEN

EC2 实测:edge nginx -t 通过(真实证书)、compose 校验通过

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitea/workflows/deploy.yml

@@ -1,6 +1,5 @@
 name: deploy-pangolin
 
-# 触发:改 deploy/** 或本 workflow 时自动;也可在 Gitea Actions 页手动触发。
 on:
   push:
     branches: [main]
@@ -11,39 +10,37 @@ on:
 
 jobs:
   deploy:
-    # ⚠️ 改成你 NAS 上 act_runner 的实际 label
-    #    (Gitea → 仓库/组织 Settings → Actions → Runners 里可见)。
-    #    常见为 self-hosted / nas / ubuntu-latest。
+    # ⚠️ 改成你 NAS 上 act_runner 的实际 label(Gitea→Settings→Actions→Runners)
     runs-on: nas
     steps:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Ensure ssh/rsync 存在
+      - name: Ensure ssh/rsync
         run: |
           if ! command -v rsync >/dev/null || ! command -v ssh >/dev/null; then
             (command -v apt-get >/dev/null && apt-get update -y && apt-get install -y openssh-client rsync) \
             || (command -v apk >/dev/null && apk add --no-cache openssh-client rsync)
           fi
 
-      - name: 准备 SSH 私钥(指向 EC2)
+      - name: SSH 私钥(指向 EC2)
         run: |
           mkdir -p ~/.ssh && chmod 700 ~/.ssh
           printf '%s\n' "${{ secrets.EC2_SSH_KEY }}" > ~/.ssh/ec2_key
           chmod 600 ~/.ssh/ec2_key
           ssh-keyscan -H "${{ secrets.EC2_HOST }}" >> ~/.ssh/known_hosts 2>/dev/null || true
 
-      - name: 同步 deploy/ 到 EC2(保留 secrets,不删目标)
+      - name: 同步 deploy/ 到 EC2(保留 secrets)
         run: |
           rsync -az \
             --exclude 'secrets' \
-            --exclude 'xray/config.json' \
             --exclude 'singbox/config.json' \
+            --exclude 'xray/config.json' \
             -e "ssh -i ~/.ssh/ec2_key -o StrictHostKeyChecking=accept-new" \
-            deploy/ "${{ secrets.EC2_USER }}@${{ secrets.EC2_HOST }}:/opt/pangolin/"
+            deploy/ "${{ secrets.EC2_USER }}@${{ secrets.EC2_HOST }}:pangolin/"
 
-      - name: 远程部署(幂等)
+      - name: 远程部署(免 root,幂等)
         run: |
           ssh -i ~/.ssh/ec2_key -o StrictHostKeyChecking=accept-new \
             "${{ secrets.EC2_USER }}@${{ secrets.EC2_HOST }}" \
-            'cd /opt/pangolin && chmod +x scripts/*.sh nginx/*.sh setup/*.sh && ./scripts/deploy.sh'
+            "export CF_API_TOKEN='${{ secrets.CF_API_TOKEN }}'; cd ~/pangolin && chmod +x scripts/*.sh && ./scripts/deploy.sh"