diff --git a/write-server/docker-compose.yml b/write-server/docker-compose.yml index 8b62f64c..271871d3 100644 --- a/write-server/docker-compose.yml +++ b/write-server/docker-compose.yml @@ -55,6 +55,8 @@ services: - ./nginx/conf.d:/etc/nginx/conf.d:ro - ./nginx/ssl:/etc/nginx/ssl:ro - ./.htpasswd:/etc/nginx/.htpasswd:ro + - ./nginx/login.html:/etc/nginx/login.html:ro + - ./nginx/sw.js:/etc/nginx/sw.js:ro - ./logs/nginx:/var/log/nginx depends_on: write-server: diff --git a/write-server/entrypoint.sh b/write-server/entrypoint.sh index f6c2d80b..614940f8 100644 --- a/write-server/entrypoint.sh +++ b/write-server/entrypoint.sh @@ -5,11 +5,19 @@ # 创建必要的子目录（以 root 身份） mkdir -p /app/recycle/posts /app/recycle/meta /app/logs /app/backups -# 修复权限 +# 修复 recycle 目录权限 chown -R nextjs:nodejs /app/recycle /app/logs /app/backups -# 调试：打印环境变量 -echo "[entrypoint] BLOG_ROOT=$BLOG_ROOT" +# 修复博客目录权限（让 nextjs 用户可写） +if [ -d "/blog/content" ]; then + chown -R nextjs:nodejs /blog/content +fi +if [ -d "/blog/static" ]; then + chown -R nextjs:nodejs /blog/static +fi +if [ -f "/blog/hugo.toml" ]; then + chown nextjs:nodejs /blog/hugo.toml +fi -# 以 nextjs 用户启动应用（保留环境变量） -exec su-exec nextjs env "$@" +# 以 nextjs 用户启动应用 +exec su-exec nextjs "$@" diff --git a/write-server/nginx/conf.d/write-server.conf b/write-server/nginx/conf.d/write-server.conf index 6f47aa4f..fa499483 100644 --- a/write-server/nginx/conf.d/write-server.conf +++ b/write-server/nginx/conf.d/write-server.conf @@ -1,27 +1,57 @@ # Write Server Nginx 站点配置 -# 反向代理配置 + Basic Auth 认证 +# HTTP -> HTTPS 重定向 server { listen 80; - server_name _; # 匹配所有域名和 IP + server_name post.usj.cc; + + # Let's Encrypt 验证 + location /.well-known/acme-challenge/ { + root /var/www/certbot; + } + + # 其他请求重定向到 HTTPS + location / { + return 301 https://$host$request_uri; + } +} + +# HTTPS 主站 +server { + listen 443 ssl http2; + server_name post.usj.cc; + + ssl_certificate /etc/nginx/ssl/fullchain.pem; + ssl_certificate_key /etc/nginx/ssl/privkey.pem; + ssl_protocols TLSv1.2 TLSv1.3; + ssl_ciphers HIGH:!aNULL:!MD5; - # 日志 access_log /var/log/nginx/write-server-access.log; error_log /var/log/nginx/write-server-error.log; - # Basic Auth 认证（保护管理后台） - auth_basic "Write Server Admin"; - auth_basic_user_file /etc/nginx/.htpasswd; - - # 健康检查（不需要认证） - location /health { - auth_basic off; - proxy_pass http://write-server:8016/api/stats; - access_log off; + # 静态文件（登录页、Service Worker、htpasswd 验证） + location /sw.js { + alias /etc/nginx/sw.js; + add_header Content-Type application/javascript; + add_header Cache-Control "no-cache, no-store"; } - # 代理到 Write Server + location /login.html { + alias /etc/nginx/login.html; + add_header Cache-Control "no-cache, no-store"; + } + + location /auth/check { + auth_basic "Write Server"; + auth_basic_user_file /etc/nginx/.htpasswd; + return 200 'ok'; + add_header Content-Type text/plain; + } + + # 所有其他请求通过 auth_request 验证 location / { + auth_request /auth/internal; + proxy_pass http://write-server:8016; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; @@ -32,14 +62,28 @@ server { proxy_set_header X-Forwarded-Proto $scheme; proxy_cache_bypass $http_upgrade; - # 超时设置 proxy_connect_timeout 60s; proxy_send_timeout 60s; proxy_read_timeout 120s; client_max_body_size 50m; + + error_page 401 = @login; + } + + location = /auth/internal { + internal; + proxy_pass http://write-server:8016/api/stats; + proxy_set_header Authorization $http_authorization; + proxy_pass_request_body off; + proxy_set_header Content-Length ""; + } + + location @login { + internal; + add_header WWW-Authenticate ""; + return 302 /login.html; } - # 禁止访问隐藏文件 location ~ /\. { deny all; access_log off; diff --git a/write-server/nginx/login.html b/write-server/nginx/login.html new file mode 100644 index 00000000..cdfcb8c8 --- /dev/null +++ b/write-server/nginx/login.html @@ -0,0 +1,104 @@ + + + + + +写作后台 - 登录 + + + +
+

写作后台

+

优世界 · Blog Admin

+
用户名或密码错误
+
+
+ + +
+
+ + +
+ +
+
+ + + diff --git a/write-server/nginx/sw.js b/write-server/nginx/sw.js new file mode 100644 index 00000000..704cd7d4 --- /dev/null +++ b/write-server/nginx/sw.js @@ -0,0 +1,42 @@ +const CACHE = 'v1'; +const LOGIN = '/login.html'; + +self.addEventListener('install', () => self.skipWaiting()); + +self.addEventListener('activate', e => e.waitUntil(self.clients.claim())); + +self.addEventListener('fetch', e => { + const req = e.request; + if (req.url.includes('/login.html') || req.url.includes('/auth/')) { + e.respondWith(fetch(req)); + return; + } + + e.respondWith((async () => { + const token = self.__auth_token; + if (!token) { + // 尝试从 IndexedDB/localStorage 读取（SW 中无法直接访问 localStorage） + // 依赖客户端页面消息传递 token + return fetch(req); + } + + const headers = new Headers(req.headers); + headers.set('Authorization', 'Basic ' + token); + const res = await fetch(new Request(req, { headers })); + + if (res.status === 401) { + return Response.redirect(LOGIN, 302); + } + return res; + })()); +}); + +// 接收页面发来的 token +self.addEventListener('message', e => { + if (e.data && e.data.type === 'SET_TOKEN') { + self.__auth_token = e.data.token; + } + if (e.data && e.data.type === 'CLEAR_TOKEN') { + self.__auth_token = null; + } +}); diff --git a/write-server/src/app/api/posts/route.ts b/write-server/src/app/api/posts/route.ts index 1b21d587..1f776d1b 100644 --- a/write-server/src/app/api/posts/route.ts +++ b/write-server/src/app/api/posts/route.ts @@ -1,18 +1,9 @@ import { NextRequest, NextResponse } from "next/server"; import { listPosts, createPost, getPostCount } from "@/lib/posts"; import { cleanExpired } from "@/lib/recycle"; -import { CONTENT_DIR, BLOG_ROOT } from "@/lib/config"; -import fs from "fs"; export async function GET(request: NextRequest) { try { - // Debug logging - console.log("[api/posts] BLOG_ROOT:", BLOG_ROOT); - console.log("[api/posts] CONTENT_DIR:", CONTENT_DIR); - console.log("[api/posts] cwd:", process.cwd()); - console.log("[api/posts] env BLOG_ROOT:", process.env.BLOG_ROOT); - console.log("[api/posts] CONTENT_DIR exists:", fs.existsSync(CONTENT_DIR)); - cleanExpired(); // housekeeping on each request const { searchParams } = request.nextUrl; @@ -24,11 +15,8 @@ export async function GET(request: NextRequest) { const result = listPosts({ search, page, perPage, includeDrafts }); const totalCount = getPostCount(); - console.log("[api/posts] result:", result.total, "posts"); - return NextResponse.json({ ...result, totalCount }); } catch (error: unknown) { - console.error("[api/posts] error:", error); return NextResponse.json( { error: error instanceof Error ? error.message : "Unknown error" }, { status: 500 }