From bc77e85b7d42c2e6180aae392426e3a28a71e154 Mon Sep 17 00:00:00 2001
From: wangjia <809946525@qq.com>
Date: Sat, 30 May 2026 11:52:32 +0800
Subject: [PATCH] =?UTF-8?q?root-setup:=20=E5=90=8C=E6=97=B6=E5=88=9B?=
 =?UTF-8?q?=E5=BB=BA=E5=B9=B6=E6=8E=88=E6=9D=83=20/opt/pangolin=20?=
 =?UTF-8?q?=E9=83=A8=E7=BD=B2=E7=9B=AE=E5=BD=95?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 deploy/setup/root-setup.sh | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/deploy/setup/root-setup.sh b/deploy/setup/root-setup.sh
index 0e1bc36..b1a0d01 100755
--- a/deploy/setup/root-setup.sh
+++ b/deploy/setup/root-setup.sh
@@ -3,8 +3,9 @@
 #   sudo bash /opt/pangolin/setup/root-setup.sh
 #
 # 作用:
-#   1. 安装受限特权脚本到 /usr/local/sbin/pangolin-nginx-apply.sh(root:root 0755)
-#   2. 安装 sudoers 片段,授权 ec2-user 仅 NOPASSWD 调用上述脚本
+#   1. 创建部署目录 /opt/pangolin(归属部署用户,后续 CI/手动 rsync 写入)
+#   2. 安装受限特权脚本到 /usr/local/sbin/pangolin-nginx-apply.sh(root:root 0755)
+#   3. 安装 sudoers 片段,授权 ec2-user 仅 NOPASSWD 调用上述脚本
 # 之后 CI(ec2-user)即可非交互地增量更新 nginx 路由,且无法获得通用 root。
 set -euo pipefail
 
@@ -13,14 +14,20 @@ if [[ "$(id -u)" -ne 0 ]]; then
   exit 1
 fi
 
-SRC_DIR="$(cd "$(dirname "$0")/.." && pwd)"   # -> /opt/pangolin/deploy 或仓库 deploy/
+SRC_DIR="$(cd "$(dirname "$0")/.." && pwd)"   # -> 本脚本所在的 deploy/(可在 /tmp 暂存或 /opt/pangolin)
 APPLY_SRC="${SRC_DIR}/nginx/pangolin-nginx-apply.sh"
 APPLY_DST="/usr/local/sbin/pangolin-nginx-apply.sh"
 SUDOERS="/etc/sudoers.d/pangolin"
 DEPLOY_USER="${PANGOLIN_DEPLOY_USER:-ec2-user}"
+DEPLOY_DIR="${PANGOLIN_DEPLOY_DIR:-/opt/pangolin}"
 
 [[ -f "$APPLY_SRC" ]] || { echo "找不到 $APPLY_SRC" >&2; exit 1; }
 
+# 1) 部署目录
+mkdir -p "$DEPLOY_DIR"
+chown "${DEPLOY_USER}:${DEPLOY_USER}" "$DEPLOY_DIR"
+echo "[root-setup] 已准备部署目录 $DEPLOY_DIR(归属 ${DEPLOY_USER})"
+
 install -o root -g root -m 0755 "$APPLY_SRC" "$APPLY_DST"
 echo "[root-setup] 已安装 $APPLY_DST"