create-dwy 0.16.1 → 0.17.0

package/templates/ai-tools/skills/unitcircle/uc-deploy-audit/scripts/check_env.sh

@@ -1,64 +0,0 @@
-#!/usr/bin/env bash
-# 环境变量与文件权限检查
-TARGET="$1"; shift
-SSH_OPTS=("$@")
-
-ssh "${SSH_OPTS[@]}" "${TARGET}" bash -s <<'REMOTE'
-echo "--- 全局搜索 .env 文件位置 (限制深度,跳过 /proc /sys) ---"
-sudo -n find /home /opt /srv /var/www /root /etc -maxdepth 6 -type f \
-  \( -name ".env" -o -name ".env.*" -o -name "*.env" \) \
-  ! -name "*.example" ! -name "*.sample" ! -name "*.template" \
-  -printf "%M  %u:%g  %p  (%s bytes)\n" 2>/dev/null \
-  || find /home /opt /srv /var/www -maxdepth 6 -type f \
-       \( -name ".env" -o -name ".env.*" \) \
-       ! -name "*.example" ! -name "*.sample" \
-       -printf "%M  %u:%g  %p  (%s bytes)\n" 2>/dev/null \
-  || echo "[!] 无 sudo,部分目录无法扫描"
-
-echo ""
-echo "--- nginx 静态根目录是否包含敏感文件 ---"
-NGINX_DUMP=$(sudo -n nginx -T 2>/dev/null || nginx -T 2>/dev/null || true)
-if [[ -n "$NGINX_DUMP" ]]; then
-  ROOTS=$(echo "$NGINX_DUMP" | awk '/^[[:space:]]*root /{print $2}' | tr -d ';' | sort -u)
-  for r in $ROOTS; do
-    echo ">> root = $r"
-    [[ -d "$r" ]] || { echo "  [!] 目录不存在或不可读"; continue; }
-    for s in ".env" ".git" ".DS_Store" "package.json" "composer.json" "wp-config.php"; do
-      if [[ -e "$r/$s" ]]; then
-        echo "  [!] 暴露: $r/$s"
-      fi
-    done
-  done
-fi
-
-echo ""
-echo "--- 关键文件权限 ---"
-for f in /etc/shadow /etc/passwd /etc/sudoers /etc/ssh/sshd_config /etc/nginx/nginx.conf; do
-  ls -l "$f" 2>/dev/null || echo "  [i] $f 不可读"
-done
-
-echo ""
-echo "--- 应用进程运行用户 (期望非 root) ---"
-ps -eo user,pid,cmd --sort=user 2>/dev/null | grep -E "(node|python|uvicorn|gunicorn|java|php-fpm|fastapi|uwsgi)" | grep -v grep | head -20
-
-echo ""
-echo "--- sudo 免密配置 ---"
-sudo -n cat /etc/sudoers 2>/dev/null | grep -v "^#" | grep -v "^$" | head -20 || echo "[i] 无 sudo 权限读取 /etc/sudoers"
-sudo -n ls /etc/sudoers.d/ 2>/dev/null | head -10
-
-echo ""
-echo "--- 全局环境变量泄漏排查 (是否有密码/key 写在 /etc/environment 或 /etc/profile) ---"
-for f in /etc/environment /etc/profile /etc/bash.bashrc; do
-  if [[ -r "$f" ]]; then
-    grep -iE "password|secret|token|api_key|apikey" "$f" 2>/dev/null \
-      | sed -E 's/(password|secret|token|api[_-]?key)([^=]*=)([^[:space:]]+)/\1\2<REDACTED>/gi' \
-      || true
-  fi
-done
-
-echo ""
-echo "--- crontab 中是否有可疑命令 ---"
-sudo -n crontab -l 2>/dev/null | head -20 || crontab -l 2>/dev/null | head -20
-echo "--- /etc/cron.d/ /etc/cron.daily/ ---"
-ls /etc/cron.d/ /etc/cron.daily/ 2>/dev/null | head -20
-REMOTE

package/templates/ai-tools/skills/unitcircle/uc-deploy-audit/scripts/check_https.sh

@@ -1,60 +0,0 @@
-#!/usr/bin/env bash
-# HTTPS / SSL 证书检查
-TARGET="$1"; shift
-SSH_OPTS=("$@")
-
-ssh "${SSH_OPTS[@]}" "${TARGET}" bash -s <<'REMOTE'
-echo "--- 检测可能的 HTTPS 站点 (从 nginx 配置) ---"
-DOMAINS=()
-NGINX_DUMP=$(sudo -n nginx -T 2>/dev/null || nginx -T 2>/dev/null || true)
-if [[ -n "$NGINX_DUMP" ]]; then
-  while IFS= read -r d; do
-    [[ -n "$d" && "$d" != "_" && "$d" != "localhost" ]] && DOMAINS+=("$d")
-  done < <(echo "$NGINX_DUMP" | awk '/server_name/ {for(i=2;i<=NF;i++) print $i}' | tr -d ';' | sort -u)
-fi
-
-if [[ ${#DOMAINS[@]} -eq 0 ]]; then
-  DOMAINS+=("localhost")
-fi
-
-echo "目标域名: ${DOMAINS[*]}"
-
-for D in "${DOMAINS[@]}"; do
-  echo ""
-  echo "===== $D ====="
-
-  echo "--- HTTPS 可达性 ---"
-  HTTPS_CODE=$(curl -k -sS -o /dev/null -w "%{http_code}" --max-time 5 "https://$D" 2>/dev/null || echo "000")
-  HTTP_CODE=$(curl -sS -o /dev/null -w "%{http_code} -> %{redirect_url}" --max-time 5 "http://$D" 2>/dev/null || echo "000")
-  echo "  https://$D  -> HTTP $HTTPS_CODE"
-  echo "  http://$D   -> HTTP $HTTP_CODE"
-
-  echo "--- 证书信息 ---"
-  CERT=$(echo | timeout 5 openssl s_client -servername "$D" -connect "${D}:443" -showcerts 2>/dev/null </dev/null)
-  if [[ -z "$CERT" ]]; then
-    echo "  [!] 无法获取证书 (可能未启用 HTTPS 或域名无 DNS)"
-    continue
-  fi
-  echo "$CERT" | openssl x509 -noout -subject -issuer -dates 2>/dev/null
-
-  echo "--- SAN ---"
-  echo "$CERT" | openssl x509 -noout -ext subjectAltName 2>/dev/null | grep -i "DNS:" | head -3
-
-  echo "--- 剩余天数 ---"
-  END=$(echo "$CERT" | openssl x509 -noout -enddate 2>/dev/null | cut -d= -f2)
-  if [[ -n "$END" ]]; then
-    END_TS=$(date -d "$END" +%s 2>/dev/null || date -j -f "%b %d %H:%M:%S %Y %Z" "$END" +%s 2>/dev/null)
-    NOW_TS=$(date +%s)
-    if [[ -n "$END_TS" ]]; then
-      DAYS=$(( (END_TS - NOW_TS) / 86400 ))
-      echo "  剩余 $DAYS 天 (过期时间: $END)"
-    fi
-  fi
-
-  echo "--- TLS 协议支持 ---"
-  for proto in tls1 tls1_1 tls1_2 tls1_3; do
-    R=$(echo | timeout 3 openssl s_client -"$proto" -connect "${D}:443" 2>&1 </dev/null | grep -E "Protocol|handshake failure|wrong version" | head -1)
-    printf "  %-8s %s\n" "$proto" "$R"
-  done
-done
-REMOTE

package/templates/ai-tools/skills/unitcircle/uc-deploy-audit/scripts/check_logs.sh

@@ -1,209 +0,0 @@
-#!/usr/bin/env bash
-# 日志大小与防爆检查 (只读)
-#
-# 检查范围:
-#   - Docker 单容器 json-log 大小
-#   - Docker daemon log-opts 是否生效到具体容器
-#   - Nginx access/error log 大小 + logrotate 覆盖
-#   - systemd journal 占用 + SystemMaxUse 配置
-#   - 应用日志目录 (自动探测 /var/log/<svc>、/opt/*/logs、/home/*/logs)
-#   - 总日志占用 vs 根盘剩余, 估算撑天数
-
-TARGET="$1"; shift
-SSH_OPTS=("$@")
-
-ssh "${SSH_OPTS[@]}" "${TARGET}" bash -s <<'REMOTE'
-ROOT_FREE_MB=$(df -BM --output=avail / 2>/dev/null | tail -1 | tr -d ' M')
-ROOT_FREE_MB=${ROOT_FREE_MB:-0}
-NOW_TS=$(date +%s)
-
-echo "--- 根盘可用 ---"
-df -h / 2>/dev/null
-echo "可用: ${ROOT_FREE_MB} MB"
-
-# ============================================================
-echo ""
-echo "--- Docker 容器 json-log 大小 (单文件 Top 20) ---"
-if command -v docker >/dev/null 2>&1; then
-  # 收集 daemon log-opts 用于关联判定
-  DAEMON_JSON=$(sudo -n cat /etc/docker/daemon.json 2>/dev/null \
-                || cat /etc/docker/daemon.json 2>/dev/null || echo "")
-  DAEMON_MAX_SIZE=$(echo "$DAEMON_JSON" \
-    | grep -oE '"max-size"[[:space:]]*:[[:space:]]*"[^"]+"' \
-    | head -1 | grep -oE '"[^"]+"$' | tr -d '"')
-  echo "daemon.json log-opts max-size: ${DAEMON_MAX_SIZE:-(未配置)}"
-  echo ""
-
-  # 列出所有 json-log: <size> <path>
-  LOG_LIST=$(sudo -n find /var/lib/docker/containers -maxdepth 2 -name "*-json.log" \
-              -printf '%s %p\n' 2>/dev/null \
-              || find /var/lib/docker/containers -maxdepth 2 -name "*-json.log" \
-                 -printf '%s %p\n' 2>/dev/null)
-
-  if [[ -z "$LOG_LIST" ]]; then
-    echo "[i] 无法读取 /var/lib/docker/containers (需 sudo) 或无 json-log"
-  else
-    DOCKER_LOG_TOTAL_BYTES=0
-    # 排序+top 20, 反查容器名
-    while IFS=' ' read -r size path; do
-      [[ -z "$size" ]] && continue
-      DOCKER_LOG_TOTAL_BYTES=$(( DOCKER_LOG_TOTAL_BYTES + size ))
-      cid=$(basename "$(dirname "$path")")
-      cid_short="${cid:0:12}"
-      name=$(docker inspect -f '{{.Name}}' "$cid" 2>/dev/null | sed 's|^/||')
-      [[ -z "$name" ]] && name="<已删除>"
-      size_mb=$(( size / 1024 / 1024 ))
-      printf "  %-32s %6d MB  %s\n" "$name" "$size_mb" "$path"
-
-      # 单文件大小告警
-      if [[ "$size_mb" -ge 1024 ]] && [[ -z "$DAEMON_MAX_SIZE" ]]; then
-        echo "    [!!!] CRITICAL: 单容器日志 ${size_mb} MB 且 daemon 无 log-opts 大小限制"
-      elif [[ "$size_mb" -ge 500 ]]; then
-        echo "    [!!] HIGH: 单容器日志 ${size_mb} MB"
-      fi
-    done < <(echo "$LOG_LIST" | sort -rn | head -20)
-
-    DOCKER_LOG_TOTAL_MB=$(( DOCKER_LOG_TOTAL_BYTES / 1024 / 1024 ))
-    echo ""
-    echo "Docker json-log 合计: ${DOCKER_LOG_TOTAL_MB} MB"
-  fi
-
-  echo ""
-  echo "--- 各容器是否覆盖 logging driver (compose level 优先于 daemon level) ---"
-  docker ps -q 2>/dev/null | while read c; do
-    name=$(docker inspect -f '{{.Name}}'                              "$c" | sed 's|^/||')
-    lt=$(docker inspect -f   '{{.HostConfig.LogConfig.Type}}'         "$c" 2>/dev/null)
-    lc=$(docker inspect -f   '{{json .HostConfig.LogConfig.Config}}'  "$c" 2>/dev/null)
-    [[ -z "$lc" || "$lc" == "null" ]] && lc='{}'
-    printf "  %-32s driver=%-12s opts=%s\n" "$name" "${lt:-?}" "$lc"
-    if [[ "$lt" == "json-file" && "$lc" == "{}" && -z "$DAEMON_MAX_SIZE" ]]; then
-      echo "    [!!] HIGH: 容器无 logging.options 且 daemon 无 max-size, 日志可无限增长"
-    fi
-  done
-else
-  echo "[i] Docker 未安装,跳过容器日志检查"
-  DOCKER_LOG_TOTAL_MB=0
-fi
-
-# ============================================================
-echo ""
-echo "--- Nginx 日志 ---"
-if [[ -d /var/log/nginx ]]; then
-  ls -lh /var/log/nginx/ 2>/dev/null | head -20
-  NGINX_LOG_BYTES=$(sudo -n du -sb /var/log/nginx 2>/dev/null | awk '{print $1}' \
-                    || du -sb /var/log/nginx 2>/dev/null | awk '{print $1}')
-  NGINX_LOG_MB=$(( ${NGINX_LOG_BYTES:-0} / 1024 / 1024 ))
-  echo "合计: ${NGINX_LOG_MB} MB"
-
-  # access.log / error.log 单文件大小
-  for f in /var/log/nginx/access.log /var/log/nginx/error.log; do
-    [[ -f "$f" ]] || continue
-    sz_mb=$(( $(stat -c %s "$f" 2>/dev/null || echo 0) / 1024 / 1024 ))
-    if [[ "$sz_mb" -ge 500 ]]; then
-      echo "[!!] HIGH: $f 单文件 ${sz_mb} MB"
-    fi
-  done
-
-  # logrotate 覆盖
-  if [[ -f /etc/logrotate.d/nginx ]]; then
-    echo "[OK] /etc/logrotate.d/nginx 存在"
-  else
-    echo "[!!] HIGH: nginx 已部署但无 /etc/logrotate.d/nginx, 日志可能无限增长"
-  fi
-else
-  echo "[i] /var/log/nginx 不存在, 跳过"
-  NGINX_LOG_MB=0
-fi
-
-# ============================================================
-echo ""
-echo "--- systemd journal 占用 ---"
-if command -v journalctl >/dev/null 2>&1; then
-  JOURNAL_USAGE=$(journalctl --disk-usage 2>/dev/null | grep -oE '[0-9.]+[KMG]B?' | tail -1)
-  echo "journalctl --disk-usage: ${JOURNAL_USAGE:-?}"
-  # 转 MB (粗略)
-  case "$JOURNAL_USAGE" in
-    *G*) JOURNAL_MB=$(echo "$JOURNAL_USAGE" | sed 's/[GBb]//g' | awk '{print int($1*1024)}') ;;
-    *M*) JOURNAL_MB=$(echo "$JOURNAL_USAGE" | sed 's/[MBb]//g' | awk '{print int($1)}') ;;
-    *K*) JOURNAL_MB=0 ;;
-    *)   JOURNAL_MB=0 ;;
-  esac
-
-  # SystemMaxUse 配置
-  SMU=$(grep -E "^[[:space:]]*SystemMaxUse" /etc/systemd/journald.conf 2>/dev/null \
-        | head -1 | awk -F= '{gsub(/[ \t]/,"",$2); print $2}')
-  echo "SystemMaxUse: ${SMU:-(未配置, 默认按磁盘 10% 自动控)}"
-
-  if [[ "$JOURNAL_MB" -ge 2048 && -z "$SMU" ]]; then
-    echo "[!!] HIGH: journal 已 ${JOURNAL_MB} MB 且未配 SystemMaxUse"
-  fi
-else
-  JOURNAL_MB=0
-fi
-
-# ============================================================
-echo ""
-echo "--- 应用日志目录 (自动探测 Top 5) ---"
-APP_LOG_TOTAL_MB=0
-# 优先 sudo, 失败再退化; 不要用 OR fallback (du 退出码可能因部分不可读而非零, 会被双重执行)
-APP_LOG_LIST=$(sudo -n du -smc /var/log/*/ /opt/*/logs /opt/*/log /home/*/logs /srv/*/logs 2>/dev/null \
-  | grep -v 'total$' | sort -rn | head -10)
-if [[ -z "$APP_LOG_LIST" ]]; then
-  APP_LOG_LIST=$(du -smc /var/log/*/ /opt/*/logs /opt/*/log /home/*/logs /srv/*/logs 2>/dev/null \
-    | grep -v 'total$' | sort -rn | head -10)
-fi
-echo "$APP_LOG_LIST"
-APP_LOG_TOTAL_MB=$(echo "$APP_LOG_LIST" | awk '{s+=$1} END{print s+0}')
-
-# ============================================================
-echo ""
-echo "--- 日志总占用 vs 根盘剩余 (撑天数粗估) ---"
-TOTAL_LOG_MB=$(( DOCKER_LOG_TOTAL_MB + NGINX_LOG_MB + JOURNAL_MB + APP_LOG_TOTAL_MB ))
-echo "Docker json-log: ${DOCKER_LOG_TOTAL_MB} MB"
-echo "Nginx 日志:      ${NGINX_LOG_MB} MB"
-echo "systemd journal: ${JOURNAL_MB} MB"
-echo "应用日志合计:    ${APP_LOG_TOTAL_MB} MB"
-echo "日志合计:        ${TOTAL_LOG_MB} MB"
-echo "根盘可用:        ${ROOT_FREE_MB} MB"
-
-# 撑天数估算: 取所有 docker json-log 的 (size / 容器存活天数) 加总作为 daily growth
-GROWTH_MB=0
-if command -v docker >/dev/null 2>&1; then
-  for c in $(docker ps -q 2>/dev/null); do
-    cid_full=$(docker inspect -f '{{.Id}}' "$c" 2>/dev/null)
-    log_path="/var/lib/docker/containers/${cid_full}/${cid_full}-json.log"
-    sz=$(sudo -n stat -c %s "$log_path" 2>/dev/null || stat -c %s "$log_path" 2>/dev/null || echo 0)
-    started=$(docker inspect -f '{{.State.StartedAt}}' "$c" 2>/dev/null)
-    started_ts=$(date -d "$started" +%s 2>/dev/null || echo 0)
-    if [[ "$started_ts" -gt 0 && "$sz" -gt 0 ]]; then
-      age_sec=$(( NOW_TS - started_ts ))
-      [[ "$age_sec" -lt 60 ]] && age_sec=60   # 防除零, 至少按 1 分钟算
-      daily_bytes=$(( sz * 86400 / age_sec ))
-      daily_mb=$(( daily_bytes / 1024 / 1024 ))
-      GROWTH_MB=$(( GROWTH_MB + daily_mb ))
-    fi
-  done
-fi
-
-echo "估算 Docker 日志日均增量: ${GROWTH_MB} MB/day (基于容器存活时长)"
-
-if [[ "$GROWTH_MB" -gt 0 && "$ROOT_FREE_MB" -gt 0 ]]; then
-  DAYS=$(( ROOT_FREE_MB / GROWTH_MB ))
-  echo "按当前增速预计可撑: ${DAYS} 天 (粗估, 仅算 docker json-log)"
-  if   [[ "$DAYS" -lt 30 ]]; then echo "[!!!] CRITICAL: 不足 30 天, 必须立即配 log-opts 或扩盘"
-  elif [[ "$DAYS" -lt 90 ]]; then echo "[!!] HIGH: 不足 90 天, 建议尽快补 log-opts max-size"
-  else echo "[OK] 撑天数 >= 90 天"
-  fi
-else
-  echo "[i] 无法估算日均增量 (容器刚起或无日志)"
-fi
-
-# ============================================================
-echo ""
-echo "--- 关键服务 logrotate 规则一览 (只读复述) ---"
-for app in nginx postgresql redis docker rsyslog; do
-  if [[ -f "/etc/logrotate.d/$app" ]]; then
-    echo "  [OK] /etc/logrotate.d/$app"
-  fi
-done
-REMOTE

package/templates/ai-tools/skills/unitcircle/uc-deploy-audit/scripts/check_nginx.sh

@@ -1,100 +0,0 @@
-#!/usr/bin/env bash
-# Nginx 配置检查 (只读)
-TARGET="$1"; shift
-SSH_OPTS=("$@")
-
-ssh "${SSH_OPTS[@]}" "${TARGET}" bash -s <<'REMOTE'
-if ! command -v nginx >/dev/null 2>&1; then
-  echo "[i] nginx 未安装,跳过"
-  exit 0
-fi
-
-echo "--- nginx version ---"
-nginx -v 2>&1
-NGINX_VERSION=$(nginx -v 2>&1 | sed -n 's#.*nginx/\([^ ]*\).*#\1#p' | head -1)
-echo "nginx_version_normalized=${NGINX_VERSION:-unknown}"
-echo "official_doc_headers=https://nginx.org/en/docs/http/ngx_http_headers_module.html"
-echo "official_doc_ssl=https://nginx.org/en/docs/http/ngx_http_ssl_module.html"
-if [[ -n "$NGINX_VERSION" ]]; then
-  echo "search_hint_1=nginx ${NGINX_VERSION} security advisory"
-  echo "search_hint_2=nginx ${NGINX_VERSION} CVE"
-fi
-
-echo ""
-echo "--- nginx 进程运行用户 ---"
-ps -eo user,pid,cmd | grep "[n]ginx: master" | head -1
-
-echo ""
-echo "--- nginx -T (effective config, 需 sudo 或 nginx 用户可读) ---"
-NGINX_DUMP=$(sudo -n nginx -T 2>/dev/null || nginx -T 2>/dev/null || true)
-if [[ -z "$NGINX_DUMP" ]]; then
-  echo "[!] 无法 dump nginx 配置,改读 /etc/nginx/"
-  ls -la /etc/nginx/ 2>/dev/null
-  echo "--- /etc/nginx/nginx.conf (head) ---"
-  head -80 /etc/nginx/nginx.conf 2>/dev/null
-  echo "--- sites-enabled / conf.d ---"
-  for d in /etc/nginx/sites-enabled /etc/nginx/conf.d; do
-    [[ -d "$d" ]] && ls -la "$d" 2>/dev/null
-  done
-else
-  echo "$NGINX_DUMP" | grep -E "^# configuration file" | head -20
-  echo ""
-  echo "--- KEY DIRECTIVES (filtered from nginx -T) ---"
-  echo "$NGINX_DUMP" | grep -Ei "^[[:space:]]*(listen|server_name|return|rewrite|ssl_protocols|ssl_ciphers|ssl_prefer_server_ciphers|ssl_certificate|ssl_certificate_key|server_tokens|access_log|error_log|client_max_body_size|client_body_timeout|add_header|autoindex|location|root|alias|proxy_pass)" \
-    | grep -v "^[[:space:]]*#" | head -200
-
-  echo ""
-  echo "--- HSTS / Security Headers 检查 ---"
-  echo "$NGINX_DUMP" | grep -i "Strict-Transport-Security\|X-Frame-Options\|X-Content-Type-Options\|Content-Security-Policy\|Referrer-Policy" || echo "[!] 未找到任何安全 header"
-
-  echo ""
-  echo "--- HTTP→HTTPS 跳转检查 ---"
-  echo "$NGINX_DUMP" | awk '/listen[[:space:]]+80/,/}/' | grep -i "return\|rewrite" | head -10 || echo "[!] 80 端口可能未配置强制跳转"
-
-  echo ""
-  echo "--- server_tokens ---"
-  echo "$NGINX_DUMP" | grep -E "^[[:space:]]*server_tokens" || echo "[!] server_tokens 未显式配置 (默认 on,会暴露版本)"
-
-  echo ""
-  echo "--- access_log / error_log ---"
-  echo "$NGINX_DUMP" | grep -E "^[[:space:]]*(access_log|error_log)" | head -10
-
-  echo ""
-  echo "--- client_max_body_size (业务非上传 ≤ 10m) ---"
-  echo "$NGINX_DUMP" | grep -E "^[[:space:]]*client_max_body_size" || echo "[!] 未显式配置 client_max_body_size"
-
-  echo ""
-  echo "--- 限流配置 (limit_req / limit_conn 防 CC / 暴力请求) ---"
-  ZONE_DEFS=$(echo "$NGINX_DUMP" | grep -E "^[[:space:]]*limit_(req|conn)_zone" || true)
-  if [[ -z "$ZONE_DEFS" ]]; then
-    echo "[!] CRITICAL: 未发现任何 limit_req_zone / limit_conn_zone 定义,无 CC 攻击防护"
-  else
-    echo "已定义 zone:"
-    echo "$ZONE_DEFS"
-    echo ""
-    echo "应用位置 (limit_req / limit_conn):"
-    echo "$NGINX_DUMP" | grep -E "^[[:space:]]*limit_(req|conn)[[:space:]]" || echo "[!] zone 已定义但未在 server/location 中应用"
-    echo ""
-    LIMIT_STATUS=$(echo "$NGINX_DUMP" | grep -E "^[[:space:]]*limit_req_status" | head -1)
-    echo "limit_req_status: ${LIMIT_STATUS:-(默认 503,建议 429)}"
-  fi
-
-  echo ""
-  echo "--- 慢速攻击防护 (slowloris) ---"
-  for d in client_body_timeout client_header_timeout send_timeout keepalive_timeout; do
-    val=$(echo "$NGINX_DUMP" | grep -E "^[[:space:]]*${d}[[:space:]]" | head -1)
-    echo "${d}: ${val:-(未显式配置,使用默认)}"
-  done
-fi
-
-echo ""
-echo "--- nginx 配置语法检查 ---"
-sudo -n nginx -t 2>&1 || nginx -t 2>&1 || echo "[i] 无法执行 nginx -t"
-
-echo ""
-echo "--- 危险路径暴露快测 (本机回环) ---"
-for path in "/.env" "/.git/HEAD" "/.git/config" "/admin" "/phpmyadmin" "/.DS_Store"; do
-  code=$(curl -k -s -o /dev/null -w "%{http_code}" --max-time 3 "https://localhost${path}" 2>/dev/null || echo "000")
-  printf "  %-20s -> https://localhost  HTTP %s\n" "$path" "$code"
-done
-REMOTE

package/templates/ai-tools/skills/unitcircle/uc-deploy-audit/scripts/check_resilience.sh

@@ -1,157 +0,0 @@
-#!/usr/bin/env bash
-# 自愈能力 / 资源耗尽防护检查 (只读)
-#
-# 检查范围:
-#   B 类: 系统服务开机自启 (sshd / nginx / docker / postgres / redis / fail2ban / 自定义)
-#   D 类: 资源耗尽防护 (swap / ulimit / logrotate / 磁盘使用率 / 应用进程内存上限)
-#
-# 服务器意外重启后,这些配置决定了服务能否自动恢复;资源耗尽场景决定了
-# 服务能否在异常下保住基本运行而不被全局拖垮。
-
-TARGET="$1"; shift
-SSH_OPTS=("$@")
-
-ssh "${SSH_OPTS[@]}" "${TARGET}" bash -s <<'REMOTE'
-echo "########## B. 系统服务开机自启 ##########"
-
-# 默认必检清单
-DEFAULT_SERVICES=(sshd ssh nginx docker docker.socket postgresql postgres redis redis-server fail2ban supervisor crond cron)
-
-echo "--- 默认必检清单 ---"
-for svc in "${DEFAULT_SERVICES[@]}"; do
-  # systemctl status 区分: not-found / disabled / enabled / static / masked
-  enabled=$(systemctl is-enabled "$svc" 2>/dev/null || echo "n/a")
-  active=$(systemctl is-active "$svc" 2>/dev/null || echo "n/a")
-  if [[ "$enabled" == "n/a" && "$active" == "n/a" ]]; then
-    continue  # 该服务未安装,跳过
-  fi
-  case "$enabled" in
-    enabled|enabled-runtime|alias|static)
-      icon="[OK]" ;;
-    disabled)
-      icon="[!!!] CRITICAL: 已部署但未开机自启,服务器重启后不会启动" ;;
-    masked)
-      icon="[!!!] CRITICAL: 服务被 mask,无法启动" ;;
-    *)
-      icon="[?] enabled=$enabled" ;;
-  esac
-  printf "  %-20s active=%-10s enabled=%-12s %s\n" "$svc" "$active" "$enabled" "$icon"
-done
-
-echo ""
-echo "--- 自动探测: 当前 enabled 的所有 unit (供人工核对应用主进程是否在内) ---"
-systemctl list-unit-files --type=service --state=enabled 2>/dev/null \
-  | awk 'NR>1 && $1 != "" {print "  " $1}' \
-  | head -40 || echo "[i] 无法列出 unit-files"
-
-echo ""
-echo "--- 自动探测: 当前 running 但 disabled 的服务 (重启后会消失) ---"
-running_services=$(systemctl list-units --type=service --state=running --no-pager --no-legend 2>/dev/null | awk '{print $1}')
-for svc in $running_services; do
-  enabled=$(systemctl is-enabled "$svc" 2>/dev/null)
-  if [[ "$enabled" == "disabled" ]]; then
-    echo "  [!!] $svc  正在运行但 disabled,重启后会丢失"
-  fi
-done
-
-
-echo ""
-echo "########## D. 资源耗尽防护 ##########"
-
-echo "--- 内存与 swap ---"
-free -h 2>/dev/null || vmstat -s 2>/dev/null | head -10
-SWAP_SIZE=$(awk '/SwapTotal/ {print $2}' /proc/meminfo 2>/dev/null)
-if [[ -z "$SWAP_SIZE" || "$SWAP_SIZE" == "0" ]]; then
-  echo "[!] MEDIUM: 未配置 swap,内存吃紧时直接 OOM kill"
-  echo "      建议: 至少配置 1-2GB swap (fallocate / dd + mkswap + swapon + /etc/fstab)"
-else
-  echo "[OK] swap 已配置: $((SWAP_SIZE / 1024)) MB"
-fi
-
-echo ""
-echo "--- 根分区使用率 ---"
-df -h / 2>/dev/null
-ROOT_USE=$(df / --output=pcent 2>/dev/null | tail -1 | tr -d ' %')
-if [[ -n "$ROOT_USE" ]]; then
-  if [[ "$ROOT_USE" -ge 90 ]]; then
-    echo "[!!!] CRITICAL: 根分区使用率 ${ROOT_USE}%, 即将写满"
-  elif [[ "$ROOT_USE" -ge 80 ]]; then
-    echo "[!] MEDIUM: 根分区使用率 ${ROOT_USE}%, 建议清理"
-  else
-    echo "[OK] 根分区使用率 ${ROOT_USE}%"
-  fi
-fi
-
-echo ""
-echo "--- /var/log 与 /var/lib/docker 大小 ---"
-sudo -n du -sh /var/log /var/lib/docker /var/lib/postgresql 2>/dev/null \
-  || du -sh /var/log /var/lib/docker /var/lib/postgresql 2>/dev/null \
-  || echo "[i] 部分目录不可读"
-
-echo ""
-echo "--- logrotate 配置 ---"
-if [[ -f /etc/logrotate.conf ]]; then
-  echo "[OK] /etc/logrotate.conf 存在"
-  ls /etc/logrotate.d/ 2>/dev/null | head -20 | sed 's|^|  |'
-else
-  echo "[!] HIGH: /etc/logrotate.conf 不存在,日志可能无限增长"
-fi
-
-# 关键服务是否有 logrotate 规则
-echo ""
-echo "--- 关键服务 logrotate 规则 ---"
-for app in nginx postgresql redis docker rsyslog; do
-  if [[ -f "/etc/logrotate.d/$app" ]]; then
-    echo "  [OK] /etc/logrotate.d/$app"
-  else
-    if systemctl is-enabled "$app" >/dev/null 2>&1 || systemctl is-enabled "${app}-server" >/dev/null 2>&1; then
-      echo "  [!] $app 已部署但无 logrotate 规则"
-    fi
-  fi
-done
-
-echo ""
-echo "--- 文件描述符上限 (system + 关键服务) ---"
-echo "  系统 fs.file-max:    $(sysctl -n fs.file-max 2>/dev/null)"
-echo "  系统 fs.nr_open:     $(sysctl -n fs.nr_open 2>/dev/null)"
-for app in nginx postgres redis-server; do
-  pid=$(pgrep -f "[${app:0:1}]${app:1}" | head -1)
-  if [[ -n "$pid" ]]; then
-    soft=$(awk '/Max open files/ {print $4}' /proc/$pid/limits 2>/dev/null)
-    hard=$(awk '/Max open files/ {print $5}' /proc/$pid/limits 2>/dev/null)
-    echo "  $app (pid $pid): soft=$soft hard=$hard"
-    if [[ -n "$soft" && "$soft" -lt 4096 ]]; then
-      echo "    [!] MEDIUM: ulimit -n 偏低 ($soft),高并发场景可能耗尽"
-    fi
-  fi
-done
-
-echo ""
-echo "--- /etc/security/limits.conf 自定义条目 ---"
-sudo -n grep -vE "^[[:space:]]*#|^[[:space:]]*$" /etc/security/limits.conf 2>/dev/null \
-  || grep -vE "^[[:space:]]*#|^[[:space:]]*$" /etc/security/limits.conf 2>/dev/null \
-  || echo "[i] limits.conf 不可读"
-ls /etc/security/limits.d/ 2>/dev/null | sed 's|^|  /etc/security/limits.d/|'
-
-echo ""
-echo "--- 内存压力指标 (PSI) ---"
-if [[ -r /proc/pressure/memory ]]; then
-  cat /proc/pressure/memory
-else
-  echo "[i] PSI 不可用 (内核 < 4.20 或未启用)"
-fi
-
-echo ""
-echo "--- 关键容器内存上限 (避免容器吃掉宿主机) ---"
-if command -v docker >/dev/null 2>&1; then
-  docker ps -q 2>/dev/null | while read c; do
-    name=$(docker inspect -f '{{.Name}}' "$c" 2>/dev/null | sed 's|^/||')
-    mem=$(docker inspect -f '{{.HostConfig.Memory}}' "$c" 2>/dev/null)
-    if [[ "$mem" == "0" ]]; then
-      echo "  [!] $name  无内存上限,异常时可能耗尽宿主机"
-    else
-      echo "  [OK] $name  Memory=$((mem / 1024 / 1024)) MB"
-    fi
-  done
-fi
-REMOTE