wangjia
1a346c32c1
deploy-pangolin / deploy (push) Has been cancelled
- edge: 容器化 nginx 接管 80/443,逐字移植现网 vhost(blog/jiu/marzban/pay)+ stream SNI 分流 - singbox: Hysteria2(host 网络,UDP 443) - certbot: DNS-01(Cloudflare)续期,容器化 - xray: REALITY 仅 profile newnode(本台沿用 Marzban) - deploy.sh 幂等且切换感知;cutover.sh 一次性停宿主 nginx 切容器(可秒级回滚) - 弃用方案A 的 host nginx-apply/sudoers/root-setup - 部署目录改 ~/pangolin(免 root);CI 注入 CF_API_TOKEN EC2 实测:edge nginx -t 通过(真实证书)、compose 校验通过 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
51 lines
1.9 KiB
Bash
Executable File
51 lines
1.9 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# cutover.sh —— 一次性切换:宿主 nginx → pangolin-edge 容器(需 root 一次)。
|
|
# sudo bash /home/ec2-user/pangolin/scripts/cutover.sh
|
|
# 选空闲时段执行;代理(Marzban REALITY)会有秒级重连,Shadowrocket 自动恢复。
|
|
# 失败可秒级回滚:docker-compose -p pangolin stop edge && systemctl start nginx
|
|
set -euo pipefail
|
|
|
|
if [[ "$(id -u)" -ne 0 ]]; then
|
|
echo "请以 root 运行:sudo bash $0" >&2
|
|
exit 1
|
|
fi
|
|
|
|
cd "$(dirname "$0")/.." # -> deploy/
|
|
EDGE_IMAGE="nginx:1.27-alpine"
|
|
|
|
echo "==> [1/4] 切换前校验 edge 配置(含证书路径)"
|
|
docker run --rm \
|
|
-v "$PWD/edge/nginx.conf:/etc/nginx/nginx.conf:ro" \
|
|
-v "$PWD/edge/stream.conf:/etc/nginx/stream.conf:ro" \
|
|
-v "$PWD/edge/conf.d:/etc/nginx/conf.d:ro" \
|
|
-v /etc/letsencrypt:/etc/letsencrypt:ro \
|
|
-v /opt/jiu:/opt/jiu:ro \
|
|
-v /var/www/pay:/var/www/pay:ro \
|
|
"$EDGE_IMAGE" nginx -t
|
|
|
|
echo "==> [2/4] 停用宿主 nginx 并起 edge 容器(交接窗口,秒级)"
|
|
systemctl stop nginx
|
|
systemctl disable nginx 2>/dev/null || true
|
|
docker-compose -p pangolin up -d edge singbox
|
|
|
|
echo "==> [3/4] 等待并健康检查"
|
|
sleep 2
|
|
fail=0
|
|
# REALITY 经 443 → 10443(Marzban),SNI=www.cloudflare.com 应握手成功
|
|
if echo | timeout 10 openssl s_client -connect 127.0.0.1:443 -servername www.cloudflare.com >/dev/null 2>&1; then
|
|
echo " [REALITY] 443 握手 OK"; else echo " [REALITY] 握手失败"; fail=1; fi
|
|
# 业务 vhost(经 stream→本机 8443/8444/8445)
|
|
for d in blog jiu vpn; do
|
|
code="$(curl -ks -o /dev/null -w '%{http_code}' --resolve ${d}.51yanmei.com:443:127.0.0.1 https://${d}.51yanmei.com/ 2>/dev/null || echo 000)"
|
|
echo " [${d}] https -> ${code}"
|
|
[[ "$code" =~ ^[2-4][0-9][0-9]$ ]] || fail=1
|
|
done
|
|
|
|
echo "==> [4/4] 结果"
|
|
if [[ "$fail" == "0" ]]; then
|
|
echo " 切换成功 ✅(宿主 nginx 已停,配置保留可回滚)"
|
|
else
|
|
echo " ❌ 检查未全通过。回滚:docker-compose -p pangolin stop edge && systemctl start nginx" >&2
|
|
exit 1
|
|
fi
|