clouddreamai-cicd-setup 1.5.25 → 1.5.27

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "clouddreamai-cicd-setup",
-  "version": "1.5.25",
+  "version": "1.5.27",
   "description": "CloudDreamAI GitLab CI/CD 自动配置工具 - 支持 NestJS/Vue/React 项目的一键 CI/CD 配置",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/templates/dockerfile/nestjs.Dockerfile

@@ -24,8 +24,9 @@ FROM node:20-alpine AS production
 RUN addgroup -g 1001 -S nodejs && \
     adduser -S nestjs -u 1001
 
-# 设置工作目录
+# 设置工作目录并确保 nestjs 用户拥有完整权限
 WORKDIR /app
+RUN chown nestjs:nodejs /app
 
 # 从构建阶段复制 node_modules 和构建产物
 COPY --from=builder --chown=nestjs:nodejs /app/node_modules ./node_modules

package/templates/scripts/deploy.sh

@@ -82,6 +82,77 @@ EOF
     fi
 }
 
+# 配置 HTTPS Nginx（使用已有证书）
+configure_ssl_nginx() {
+    local DOMAIN=$1
+    local PORT=$2
+
+    cat > /www/server/panel/vhost/nginx/${DOMAIN}.conf << EOF
+# 由 CloudDreamAI CI/CD 自动生成 - $(date) - HTTPS
+server {
+    listen 80;
+    server_name ${DOMAIN};
+
+    location /.well-known/acme-challenge/ {
+        root /www/wwwroot/acme-challenge;
+    }
+
+    location / {
+        return 301 https://\$host\$request_uri;
+    }
+}
+
+server {
+    listen 443 ssl;
+    http2 on;
+    server_name ${DOMAIN};
+
+    ssl_certificate /www/server/panel/vhost/cert/${DOMAIN}/fullchain.pem;
+    ssl_certificate_key /www/server/panel/vhost/cert/${DOMAIN}/privkey.pem;
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
+    ssl_prefer_server_ciphers off;
+
+    access_log /www/wwwlogs/${DOMAIN}.log;
+    error_log /www/wwwlogs/${DOMAIN}.error.log;
+
+    location / {
+        proxy_pass http://127.0.0.1:${PORT};
+        proxy_set_header Host \$host;
+        proxy_set_header X-Real-IP \$remote_addr;
+        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto \$scheme;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade \$http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_connect_timeout 60s;
+        proxy_send_timeout 60s;
+        proxy_read_timeout 60s;
+    }
+}
+EOF
+
+    nginx -t && nginx -s reload
+    echo "✓ HTTPS 配置完成: https://$DOMAIN"
+}
+
+# 检查 SSL 证书是否有效（存在且未过期）
+check_ssl_valid() {
+    local DOMAIN=$1
+    local CERT_FILE="/www/server/panel/vhost/cert/${DOMAIN}/fullchain.pem"
+
+    if [ ! -f "$CERT_FILE" ]; then
+        return 1  # 证书不存在
+    fi
+
+    # 检查证书是否在 7 天内过期
+    if openssl x509 -checkend 604800 -noout -in "$CERT_FILE" 2>/dev/null; then
+        return 0  # 证书有效
+    else
+        return 1  # 证书即将过期或已过期
+    fi
+}
+
 # SSL 证书配置函数（使用 acme.sh + Let's Encrypt）
 configure_ssl() {
     local DOMAIN=$1
@@ -106,6 +177,14 @@ configure_ssl() {
 
     echo "配置 SSL 证书: $DOMAIN"
 
+    # 检查证书是否已存在且有效
+    if check_ssl_valid "$DOMAIN"; then
+        echo "✓ SSL 证书已存在且有效，跳过申请"
+        # 直接配置 HTTPS（使用现有证书）
+        configure_ssl_nginx "$DOMAIN" "$PORT"
+        return
+    fi
+
     # 安装 acme.sh（如果没有）
     if [ ! -f ~/.acme.sh/acme.sh ]; then
         echo "安装 acme.sh..."