Phase 0: 容器化数据面 + CI/CD 自动部署

- deploy/: Xray VLESS+REALITY (11443, 经宿主 nginx SNI 分流) + sing-box Hysteria2 (UDP 443) docker-compose - 幂等 deploy.sh / gen-secrets.sh / print-clients.sh;受限 nginx-apply 特权脚本 + 一次性 root-setup - .gitea/workflows/deploy.yml: NAS runner 经 SSH 远程部署到 EC2 - docs/ plan/: 设计方案与实施计划 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-05-30 11:48:21 +08:00
parent 833b8365da
commit cf96989e01
23 changed files with 1048 additions and 2 deletions
@@ -0,0 +1,49 @@
+name: deploy-pangolin
+
+# 触发:改 deploy/** 或本 workflow 时自动;也可在 Gitea Actions 页手动触发。
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'deploy/**'
+      - '.gitea/workflows/deploy.yml'
+  workflow_dispatch:
+
+jobs:
+  deploy:
+    # ⚠️ 改成你 NAS 上 act_runner 的实际 label
+    #    (Gitea → 仓库/组织 Settings → Actions → Runners 里可见)。
+    #    常见为 self-hosted / nas / ubuntu-latest。
+    runs-on: nas
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Ensure ssh/rsync 存在
+        run: |
+          if ! command -v rsync >/dev/null || ! command -v ssh >/dev/null; then
+            (command -v apt-get >/dev/null && apt-get update -y && apt-get install -y openssh-client rsync) \
+            || (command -v apk >/dev/null && apk add --no-cache openssh-client rsync)
+          fi
+
+      - name: 准备 SSH 私钥(指向 EC2)
+        run: |
+          mkdir -p ~/.ssh && chmod 700 ~/.ssh
+          printf '%s\n' "${{ secrets.EC2_SSH_KEY }}" > ~/.ssh/ec2_key
+          chmod 600 ~/.ssh/ec2_key
+          ssh-keyscan -H "${{ secrets.EC2_HOST }}" >> ~/.ssh/known_hosts 2>/dev/null || true
+
+      - name: 同步 deploy/ 到 EC2(保留 secrets,不删目标)
+        run: |
+          rsync -az \
+            --exclude 'secrets' \
+            --exclude 'xray/config.json' \
+            --exclude 'singbox/config.json' \
+            -e "ssh -i ~/.ssh/ec2_key -o StrictHostKeyChecking=accept-new" \
+            deploy/ "${{ secrets.EC2_USER }}@${{ secrets.EC2_HOST }}:/opt/pangolin/"
+
+      - name: 远程部署(幂等)
+        run: |
+          ssh -i ~/.ssh/ec2_key -o StrictHostKeyChecking=accept-new \
+            "${{ secrets.EC2_USER }}@${{ secrets.EC2_HOST }}" \
+            'cd /opt/pangolin && chmod +x scripts/*.sh nginx/*.sh setup/*.sh && ./scripts/deploy.sh'