create-dwy 0.5.0 → 0.6.0

package/templates/claude-global/skills/dwy-deploy-audit/scripts/check_capacity.sh

@@ -0,0 +1,278 @@
+#!/usr/bin/env bash
+# 硬件规格识别 + 当前服务资源配置盘点 (只读)
+#
+# 输出 raw data, 由主 Claude 对照 SKILL.md 4.10 的推荐分级表生成
+# "推荐 vs 当前" 对比报告。
+#
+# 检查范围:
+#   - 宿主硬件: CPU 核数 / 总内存 / 根盘容量 / swap
+#   - 当前容器: mem_limit / cpus / shm_size / 实际占用
+#   - Postgres 启动参数: shared_buffers / effective_cache_size / work_mem 等
+#   - Redis 启动参数:    maxmemory / maxmemory-policy / appendonly / save
+#   - compose 文件中的资源声明 (供 grep 比对)
+
+TARGET="$1"; shift
+SSH_OPTS=("$@")
+
+ssh "${SSH_OPTS[@]}" "${TARGET}" bash -s <<'REMOTE'
+echo "--- 宿主硬件规格 ---"
+CPU_CORES=$(nproc 2>/dev/null || echo "?")
+CPU_MODEL=$(LC_ALL=C lscpu 2>/dev/null | awk -F: '/^Model name/ {gsub(/^[ \t]+/,"",$2); print $2; exit}')
+[[ -z "$CPU_MODEL" ]] && CPU_MODEL=$(awk -F: '/model name/ {gsub(/^[ \t]+/,"",$2); print $2; exit}' /proc/cpuinfo 2>/dev/null)
+MEM_TOTAL_KB=$(awk '/MemTotal/ {print $2}' /proc/meminfo 2>/dev/null)
+MEM_AVAIL_KB=$(awk '/MemAvailable/ {print $2}' /proc/meminfo 2>/dev/null)
+SWAP_TOTAL_KB=$(awk '/SwapTotal/ {print $2}' /proc/meminfo 2>/dev/null)
+MEM_TOTAL_MB=$(( ${MEM_TOTAL_KB:-0} / 1024 ))
+MEM_AVAIL_MB=$(( ${MEM_AVAIL_KB:-0} / 1024 ))
+SWAP_TOTAL_MB=$(( ${SWAP_TOTAL_KB:-0} / 1024 ))
+
+# 推荐分档(对齐 SKILL.md 4.10 的 2/4/8/16 GB 表)
+if   [[ $MEM_TOTAL_MB -ge 14000 ]]; then TIER="16GB"
+elif [[ $MEM_TOTAL_MB -ge 7000  ]]; then TIER="8GB"
+elif [[ $MEM_TOTAL_MB -ge 3500  ]]; then TIER="4GB"
+elif [[ $MEM_TOTAL_MB -ge 1500  ]]; then TIER="2GB"
+else                                     TIER="<2GB"
+fi
+
+echo "CPU 核数: $CPU_CORES"
+echo "CPU 型号: ${CPU_MODEL:-unknown}"
+echo "总内存:   ${MEM_TOTAL_MB} MB"
+echo "可用内存: ${MEM_AVAIL_MB} MB"
+echo "Swap:     ${SWAP_TOTAL_MB} MB"
+echo "推荐分档: ${TIER} (主 Claude 据此查推荐表)"
+
+echo ""
+echo "--- 根盘容量 ---"
+df -h / 2>/dev/null
+ROOT_FREE_MB=$(df -BM --output=avail / 2>/dev/null | tail -1 | tr -d ' M')
+echo "根盘可用: ${ROOT_FREE_MB:-?} MB"
+
+if ! command -v docker >/dev/null 2>&1; then
+  echo ""
+  echo "[i] Docker 未安装,跳过容器资源检查"
+  exit 0
+fi
+
+echo ""
+echo "--- 当前运行容器资源限制 (raw, 0=无限制) ---"
+SUM_MEM_LIMIT=0
+HAS_UNLIMITED_DB=0
+docker ps -q 2>/dev/null | while read c; do
+  name=$(docker inspect -f '{{.Name}}'                      "$c" 2>/dev/null | sed 's|^/||')
+  image=$(docker inspect -f '{{.Config.Image}}'             "$c" 2>/dev/null)
+  mem=$(docker inspect -f '{{.HostConfig.Memory}}'          "$c" 2>/dev/null)
+  cpu_q=$(docker inspect -f '{{.HostConfig.CpuQuota}}'      "$c" 2>/dev/null)
+  cpu_p=$(docker inspect -f '{{.HostConfig.CpuPeriod}}'     "$c" 2>/dev/null)
+  shm=$(docker inspect -f '{{.HostConfig.ShmSize}}'         "$c" 2>/dev/null)
+  pids=$(docker inspect -f '{{.HostConfig.PidsLimit}}'      "$c" 2>/dev/null)
+
+  mem_mb=$(( mem / 1024 / 1024 ))
+  shm_mb=$(( shm / 1024 / 1024 ))
+  if [[ -n "$cpu_q" && "$cpu_q" != "0" && -n "$cpu_p" && "$cpu_p" != "0" ]]; then
+    cpus=$(awk -v q="$cpu_q" -v p="$cpu_p" 'BEGIN{printf "%.2f", q/p}')
+  else
+    cpus="unlimited"
+  fi
+
+  printf "  %-32s image=%-40s mem_limit=%s cpus=%s shm=%sm pids=%s\n" \
+    "$name" "$image" \
+    "$([ "$mem" = "0" ] && echo 'unlimited' || echo "${mem_mb}m")" \
+    "$cpus" "$shm_mb" "${pids:-unlimited}"
+
+  # 关键服务无 mem_limit
+  if [[ "$mem" == "0" ]] && echo "$image" | grep -qiE 'redis|postgres|mysql|mariadb|mongo|clickhouse|elasticsearch'; then
+    echo "    [!!] HIGH: $name (image=$image) 未设 mem_limit, 异常时可能耗尽宿主内存"
+  fi
+done
+
+echo ""
+echo "--- 容器实际内存占用 (docker stats 单帧) ---"
+timeout 8 docker stats --no-stream --format \
+  'table {{.Name}}\t{{.MemUsage}}\t{{.MemPerc}}\t{{.CPUPerc}}' 2>/dev/null \
+  || echo "[i] docker stats 超时或不可用"
+
+echo ""
+echo "--- Postgres 启动参数 (从 docker inspect Args 提取) ---"
+PG_FOUND=0
+for c in $(docker ps -q 2>/dev/null); do
+  image=$(docker inspect -f '{{.Config.Image}}' "$c" 2>/dev/null)
+  if echo "$image" | grep -qi "postgres"; then
+    PG_FOUND=1
+    name=$(docker inspect -f '{{.Name}}' "$c" 2>/dev/null | sed 's|^/||')
+    # Cmd / Args 拼成空格分隔字符串
+    cmd_str=$(docker inspect -f '{{range .Config.Cmd}}{{.}} {{end}}' "$c" 2>/dev/null)
+    args_str=$(docker inspect -f '{{range .Args}}{{.}} {{end}}' "$c" 2>/dev/null)
+    full="$cmd_str $args_str"
+
+    echo ""
+    echo "[$name] image=$image"
+    # 从 -c key=value 提取 Postgres 调优参数
+    for key in shared_buffers effective_cache_size work_mem maintenance_work_mem max_connections \
+               wal_buffers max_wal_size random_page_cost log_min_duration_statement; do
+      val=$(echo "$full" | grep -oE "${key}=[^ ]+" | head -1)
+      printf "  %-30s %s\n" "$key" "${val:-(默认)}"
+    done
+
+    # 从 docker inspect 取 shm_size (Postgres 关键)
+    shm=$(docker inspect -f '{{.HostConfig.ShmSize}}' "$c" 2>/dev/null)
+    shm_mb=$(( shm / 1024 / 1024 ))
+    if [[ "$shm_mb" -lt 128 ]]; then
+      echo "  [!] MEDIUM: shm_size=${shm_mb}m 偏低 (大查询可能 'no space left on /dev/shm', 推荐 >=256m)"
+    else
+      echo "  [OK] shm_size=${shm_mb}m"
+    fi
+
+    # 校验 shared_buffers 是否过大
+    sb_val=$(echo "$full" | grep -oE 'shared_buffers=[^ ]+' | head -1 | cut -d= -f2)
+    if [[ -n "$sb_val" && -n "$MEM_TOTAL_MB" ]]; then
+      sb_mb=$(echo "$sb_val" | awk '
+        /[Gg][Bb]?$/ { sub(/[Gg][Bb]?$/,""); print $0*1024; next }
+        /[Mm][Bb]?$/ { sub(/[Mm][Bb]?$/,""); print $0;      next }
+        /[Kk][Bb]?$/ { sub(/[Kk][Bb]?$/,""); print $0/1024; next }
+                     { print $0/1024/1024 }
+      ')
+      sb_mb=${sb_mb%.*}
+      if [[ -n "$sb_mb" && "$sb_mb" -gt $((MEM_TOTAL_MB / 2)) ]]; then
+        echo "  [!!] HIGH: shared_buffers=${sb_val} 已超过宿主总内存 50%, 易触发 OOM"
+      fi
+    fi
+  fi
+done
+[[ "$PG_FOUND" == "0" ]] && echo "[i] 未发现 Postgres 容器"
+
+echo ""
+echo "--- Redis 启动参数 (从 docker inspect Args 提取) ---"
+REDIS_FOUND=0
+for c in $(docker ps -q 2>/dev/null); do
+  image=$(docker inspect -f '{{.Config.Image}}' "$c" 2>/dev/null)
+  if echo "$image" | grep -qi "redis"; then
+    REDIS_FOUND=1
+    name=$(docker inspect -f '{{.Name}}' "$c" 2>/dev/null | sed 's|^/||')
+    cmd_str=$(docker inspect -f '{{range .Config.Cmd}}{{.}} {{end}}' "$c" 2>/dev/null)
+    args_str=$(docker inspect -f '{{range .Args}}{{.}} {{end}}' "$c" 2>/dev/null)
+    full="$cmd_str $args_str"
+
+    echo ""
+    echo "[$name] image=$image"
+    # Redis 启动参数格式: --key value
+    for key in maxmemory maxmemory-policy appendonly appendfsync save tcp-keepalive timeout; do
+      # 把密码字段脱敏
+      val=$(echo "$full" | grep -oE -- "--${key} [^ ]+" | head -1 | sed "s/^--${key} //")
+      printf "  %-25s %s\n" "$key" "${val:-(默认/未设)}"
+    done
+
+    # 是否设了密码 (脱敏只看是否存在)
+    if echo "$full" | grep -qE -- '--requirepass [^ ]+'; then
+      echo "  requirepass               <REDACTED, 已设>"
+    else
+      echo "  requirepass               (未设, 见 check_db.sh CRITICAL)"
+    fi
+
+    # maxmemory 二元判定
+    mm=$(echo "$full" | grep -oE -- '--maxmemory [^ ]+' | head -1 | awk '{print $2}')
+    if [[ -z "$mm" || "$mm" == "0" ]]; then
+      echo "  [!!!] CRITICAL: maxmemory 未设置或为 0, Redis 可能耗尽宿主内存"
+    fi
+
+    # appendonly + 检查 volume 是否挂载
+    if ! echo "$full" | grep -qE -- '--appendonly +yes'; then
+      echo "  [!] MEDIUM: 未启用 AOF, 重启会丢最近 RDB save 间隔内的数据"
+    fi
+  fi
+done
+[[ "$REDIS_FOUND" == "0" ]] && echo "[i] 未发现 Redis 容器"
+
+echo ""
+echo "--- compose 文件中的资源声明 (供人工核对) ---"
+COMPOSE_FILES=$(sudo -n find /home /opt /srv /root -maxdepth 5 \
+  \( -name "docker-compose*.yml" -o -name "compose*.yml" \) 2>/dev/null \
+  | grep -vE '\.bak|\.old' | head -10)
+[[ -z "$COMPOSE_FILES" ]] && COMPOSE_FILES=$(find /home /opt /srv /root -maxdepth 5 \
+  \( -name "docker-compose*.yml" -o -name "compose*.yml" \) 2>/dev/null \
+  | grep -vE '\.bak|\.old' | head -10)
+
+for f in $COMPOSE_FILES; do
+  echo ""
+  echo "[$f]"
+  grep -nE '^[[:space:]]+(mem_limit|mem_reservation|cpus|shm_size|memory|cpu_quota|--maxmemory|--maxmemory-policy|--appendonly|shared_buffers|effective_cache_size|work_mem)[[:space:]:]' \
+    "$f" 2>/dev/null | head -30 \
+    || echo "  (无资源声明)"
+done
+
+echo ""
+echo "--- 日志兜底推荐档 (基于根盘 + 容器规模, 对照 SKILL.md 4.10) ---"
+ROOT_TOTAL_MB=$(df -BM --output=size / 2>/dev/null | tail -1 | tr -d ' M')
+ROOT_TOTAL_GB=$(( ${ROOT_TOTAL_MB:-0} / 1024 ))
+RUNNING_COUNT=$(docker ps -q 2>/dev/null | wc -l | tr -d ' ')
+echo "根盘容量: ${ROOT_TOTAL_GB} GB"
+echo "运行容器数: ${RUNNING_COUNT}"
+
+# 推荐档分级
+if   [[ $ROOT_TOTAL_GB -lt 50 ]];   then REC_TIER="入门"; REC_SIZE="10m"; REC_FILE="3"
+elif [[ $ROOT_TOTAL_GB -lt 150 ]]; then
+  REC_TIER="标准"
+  if [[ $RUNNING_COUNT -gt 5 ]]; then REC_SIZE="20m"; REC_FILE="5"
+  else                                REC_SIZE="50m"; REC_FILE="5"; fi
+else REC_TIER="大型"; REC_SIZE="100m"; REC_FILE="5"
+fi
+echo "推荐档: ${REC_TIER}"
+echo "推荐 daemon log-opts: max-size=${REC_SIZE}, max-file=${REC_FILE}, compress=true"
+
+# 拿当前 daemon.json log-opts (复用 check_docker.sh 的逻辑)
+DAEMON_JSON=$(sudo -n cat /etc/docker/daemon.json 2>/dev/null \
+              || cat /etc/docker/daemon.json 2>/dev/null || echo "")
+CUR_SIZE=$(echo "$DAEMON_JSON" | grep -oE '"max-size"[[:space:]]*:[[:space:]]*"[^"]+"' \
+            | head -1 | grep -oE '"[^"]+"$' | tr -d '"')
+CUR_FILE=$(echo "$DAEMON_JSON" | grep -oE '"max-file"[[:space:]]*:[[:space:]]*"[^"]+"' \
+            | head -1 | grep -oE '"[^"]+"$' | tr -d '"')
+echo "当前 daemon.json: max-size=${CUR_SIZE:-(未配置)}, max-file=${CUR_FILE:-(未配置)}"
+
+# 简单对比标记
+if [[ -z "$CUR_SIZE" ]]; then
+  echo "[!!!] CRITICAL: daemon 无 log-opts.max-size, 长跑容器日志会无限增长"
+elif [[ "$CUR_SIZE" == "$REC_SIZE" ]]; then
+  echo "[OK] max-size 与推荐档一致"
+else
+  echo "[i] 当前 max-size=${CUR_SIZE} 与推荐档 ${REC_SIZE} 不同 (主 Claude 据 SKILL.md 4.10 判定是否偏离 50%)"
+fi
+
+# 估算所有容器日志合计 quota = max-size × max-file × 容器数, 看占根盘比
+# 不依赖 bc(部分镜像/最小系统不带), 用 awk 解析单位
+if [[ -n "$CUR_SIZE" ]]; then
+  size_mb=$(echo "$CUR_SIZE" | awk '
+    BEGIN{IGNORECASE=1}
+    /[gG]$/ { sub(/[gG]$/,""); print int($0*1024); exit }
+    /[mM]$/ { sub(/[mM]$/,""); print int($0);      exit }
+    /[kK]$/ { sub(/[kK]$/,""); print int($0/1024); exit }
+            { print int($0); exit }
+  ')
+  file_n=${CUR_FILE:-1}
+  total_quota_mb=$(( ${size_mb:-0} * file_n * RUNNING_COUNT ))
+  if [[ "$ROOT_TOTAL_MB" -gt 0 ]]; then
+    pct=$(( total_quota_mb * 100 / ROOT_TOTAL_MB ))
+    echo "所有容器最大日志 quota 合计: ${total_quota_mb} MB (占根盘 ${pct}%, 期望 < 5%)"
+    if [[ "$pct" -gt 5 ]]; then
+      echo "[!!] HIGH: 日志 quota 合计 ${pct}% 已超根盘 5% 上限"
+    fi
+  fi
+fi
+
+echo ""
+echo "--- 资源占比汇总 (供 Claude 校验 65% 上限规则) ---"
+echo "宿主总内存: ${MEM_TOTAL_MB} MB"
+TOTAL_LIMIT_MB=$(docker ps -q 2>/dev/null \
+  | xargs -I{} docker inspect -f '{{.HostConfig.Memory}}' {} 2>/dev/null \
+  | awk 'BEGIN{s=0} {s+=$1} END{print int(s/1024/1024)}')
+echo "所有容器 mem_limit 合计: ${TOTAL_LIMIT_MB} MB"
+if [[ "$MEM_TOTAL_MB" -gt 0 ]]; then
+  pct=$(( TOTAL_LIMIT_MB * 100 / MEM_TOTAL_MB ))
+  echo "占宿主总内存: ${pct}%"
+  if [[ "$pct" -gt 75 ]]; then
+    echo "[!!] HIGH: 容器硬限合计 > 75% 宿主内存, OS/nginx/监控 留 buffer 不足"
+  elif [[ "$pct" -lt 30 ]]; then
+    echo "[i] INFO: 容器硬限合计 < 30%, 可能资源利用不足"
+  else
+    echo "[OK] 容器硬限合计在 30%-75% 区间"
+  fi
+fi
+REMOTE

package/templates/claude-global/skills/dwy-deploy-audit/scripts/check_db.sh

@@ -0,0 +1,122 @@
+#!/usr/bin/env bash
+# 数据库 (PostgreSQL / Redis) 暴露检查
+TARGET="$1"; shift
+SSH_OPTS=("$@")
+
+ssh "${SSH_OPTS[@]}" "${TARGET}" bash -s <<'REMOTE'
+echo "########## PostgreSQL ##########"
+if ! command -v psql >/dev/null 2>&1 && ! pgrep -f "postgres" >/dev/null 2>&1; then
+  echo "[i] PostgreSQL 未安装/未运行,跳过"
+else
+  echo "--- 进程 ---"
+  pgrep -af postgres | head -5
+
+  echo ""
+  echo "--- 监听端口 (期望: 仅 127.0.0.1 或内网) ---"
+  (ss -tlnp 2>/dev/null || netstat -tlnp 2>/dev/null) | grep -E ":(5432|5433)" || echo "[i] 未发现 5432/5433 监听"
+
+  echo ""
+  echo "--- 配置文件位置 ---"
+  PG_CONF=$(sudo -n -u postgres psql -tAc "SHOW config_file" 2>/dev/null || \
+            find /etc/postgresql /var/lib/pgsql /var/lib/postgresql -name postgresql.conf 2>/dev/null | head -1)
+  PG_HBA=$(sudo -n -u postgres psql -tAc "SHOW hba_file" 2>/dev/null || \
+            find /etc/postgresql /var/lib/pgsql /var/lib/postgresql -name pg_hba.conf 2>/dev/null | head -1)
+  echo "postgresql.conf: ${PG_CONF:-未找到}"
+  echo "pg_hba.conf:     ${PG_HBA:-未找到}"
+
+  echo ""
+  echo "--- postgresql.conf 关键项 ---"
+  if [[ -r "$PG_CONF" ]]; then
+    grep -E "^[[:space:]]*(listen_addresses|port|password_encryption|ssl|log_connections|log_disconnections|log_min_duration_statement)[[:space:]]*=" "$PG_CONF" 2>/dev/null
+  else
+    sudo -n cat "$PG_CONF" 2>/dev/null | grep -E "^[[:space:]]*(listen_addresses|password_encryption|ssl|log_connections)" || echo "[!] 配置不可读"
+  fi
+
+  echo ""
+  echo "--- pg_hba.conf 认证方式 (期望: 无 trust) ---"
+  if [[ -r "$PG_HBA" ]]; then
+    grep -vE "^[[:space:]]*#|^[[:space:]]*$" "$PG_HBA" 2>/dev/null
+  else
+    sudo -n cat "$PG_HBA" 2>/dev/null | grep -vE "^[[:space:]]*#|^[[:space:]]*$" || echo "[!] pg_hba.conf 不可读"
+  fi
+
+  echo ""
+  echo "--- PG 版本 & 数据库列表 ---"
+  sudo -n -u postgres psql -tAc "SELECT version()" 2>/dev/null | head -1 || echo "[i] 无法连接 PG"
+  sudo -n -u postgres psql -tAc "SELECT datname FROM pg_database WHERE datistemplate=false" 2>/dev/null || true
+fi
+
+echo ""
+echo "########## Redis ##########"
+if ! command -v redis-cli >/dev/null 2>&1 && ! pgrep -f "redis-server" >/dev/null 2>&1; then
+  echo "[i] Redis 未安装/未运行,跳过"
+else
+  echo "--- 进程 ---"
+  pgrep -af redis-server | head -5
+
+  echo ""
+  echo "--- 监听端口 (期望: 仅 127.0.0.1 或内网) ---"
+  (ss -tlnp 2>/dev/null || netstat -tlnp 2>/dev/null) | grep -E ":(6379|6380)" || echo "[i] 未发现 6379/6380 监听"
+
+  echo ""
+  echo "--- redis.conf 位置与关键项 ---"
+  REDIS_CONF=$(ps -eo cmd | grep "[r]edis-server" | grep -oE "/[^ ]+\.conf" | head -1)
+  REDIS_CONF=${REDIS_CONF:-/etc/redis/redis.conf}
+  echo "redis.conf: $REDIS_CONF"
+  if [[ -r "$REDIS_CONF" ]]; then
+    grep -E "^[[:space:]]*(bind|port|protected-mode|requirepass|rename-command|tls-port|maxmemory|maxmemory-policy)" "$REDIS_CONF" 2>/dev/null \
+      | sed -E 's/(requirepass[[:space:]]+).*/\1<REDACTED>/'
+  else
+    sudo -n grep -E "^[[:space:]]*(bind|port|protected-mode|requirepass|rename-command|tls-port)" "$REDIS_CONF" 2>/dev/null \
+      | sed -E 's/(requirepass[[:space:]]+).*/\1<REDACTED>/' || echo "[!] redis.conf 不可读"
+  fi
+
+  echo ""
+  echo "--- maxmemory 判定 (运行时取值,优于 conf 文件) ---"
+  MAXMEM=$(timeout 3 redis-cli -h 127.0.0.1 CONFIG GET maxmemory 2>/dev/null | tail -1)
+  MAXMEM_POLICY=$(timeout 3 redis-cli -h 127.0.0.1 CONFIG GET maxmemory-policy 2>/dev/null | tail -1)
+  if [[ -z "$MAXMEM" ]]; then
+    echo "[i] redis-cli 无密码连接失败,从 conf 文件读取"
+    MAXMEM=$(grep -E "^[[:space:]]*maxmemory[[:space:]]" "$REDIS_CONF" 2>/dev/null | awk '{print $2}' | tail -1)
+    MAXMEM_POLICY=$(grep -E "^[[:space:]]*maxmemory-policy[[:space:]]" "$REDIS_CONF" 2>/dev/null | awk '{print $2}' | tail -1)
+  fi
+  echo "maxmemory: ${MAXMEM:-(未取得)}"
+  echo "maxmemory-policy: ${MAXMEM_POLICY:-(未取得)}"
+
+  TOTAL_MEM=$(awk '/MemTotal/ {print $2}' /proc/meminfo 2>/dev/null)
+  if [[ -n "$TOTAL_MEM" ]]; then
+    TOTAL_MEM_BYTES=$((TOTAL_MEM * 1024))
+    echo "服务器总内存: $((TOTAL_MEM / 1024)) MB ($TOTAL_MEM_BYTES bytes)"
+  fi
+
+  if [[ "$MAXMEM" == "0" || -z "$MAXMEM" ]]; then
+    echo "[!!!] HIGH: maxmemory=0(无上限),Redis 可能耗尽服务器内存触发 OOM kill"
+    echo "      建议: 设置为服务器物理内存的 50%-70% (CONFIG SET maxmemory <bytes>)"
+  else
+    echo "[OK] maxmemory 已设置"
+    if [[ "$MAXMEM_POLICY" == "noeviction" ]]; then
+      echo "[!] INFO: maxmemory-policy=noeviction,达到上限时拒写但不淘汰,业务方需感知"
+    fi
+  fi
+
+  echo ""
+  echo "--- 尝试无密码连接 (如能成功 → CRITICAL) ---"
+  if timeout 3 redis-cli -h 127.0.0.1 ping 2>/dev/null | grep -q PONG; then
+    echo "[!!!] CRITICAL: Redis 127.0.0.1 无密码可连!"
+  else
+    echo "[OK] 无密码连接被拒绝"
+  fi
+
+  echo ""
+  echo "--- Redis INFO server (需 auth, 跳过若失败) ---"
+  timeout 3 redis-cli -h 127.0.0.1 INFO server 2>/dev/null | grep -E "redis_version|os|arch_bits" | head -5 || echo "[i] 需要密码或无法连接"
+fi
+
+echo ""
+echo "########## 公网可达性自测 ##########"
+PUB_IP=$(curl -fsS --max-time 5 https://api.ipify.org 2>/dev/null)
+echo "公网 IP (best effort): ${PUB_IP:-unknown}"
+if [[ -n "$PUB_IP" ]]; then
+  echo "[i] 注意: 真实公网可达性需从外网测试,此处仅本机视角"
+fi
+REMOTE

package/templates/claude-global/skills/dwy-deploy-audit/scripts/check_docker.sh

@@ -0,0 +1,249 @@
+#!/usr/bin/env bash
+# Docker 安全检查
+TARGET="$1"; shift
+SSH_OPTS=("$@")
+
+ssh "${SSH_OPTS[@]}" "${TARGET}" bash -s <<'REMOTE'
+if ! command -v docker >/dev/null 2>&1; then
+  echo "[i] Docker 未安装,跳过"
+  exit 0
+fi
+
+echo "--- docker version ---"
+docker version --format '{{.Server.Version}} (client: {{.Client.Version}})' 2>/dev/null || docker --version
+
+echo ""
+echo "--- docker daemon 监听 ---"
+(ss -tlnp 2>/dev/null || netstat -tlnp 2>/dev/null) | grep -E ":(2375|2376)" \
+  && echo "[!!!] CRITICAL: Docker daemon 暴露 TCP 端口" \
+  || echo "[OK] Docker daemon 未暴露 TCP 端口"
+
+echo ""
+echo "--- 运行中容器列表 ---"
+docker ps --format "table {{.Names}}\t{{.Image}}\t{{.Status}}\t{{.Ports}}" 2>/dev/null
+
+echo ""
+echo "--- 容器端口绑定 (期望: 内部服务不暴露 0.0.0.0) ---"
+docker ps --format "{{.Names}}|{{.Ports}}" 2>/dev/null | while IFS='|' read -r name ports; do
+  if echo "$ports" | grep -qE "0\.0\.0\.0:(5432|6379|3306|27017|9200|11211)"; then
+    echo "  [!!!] $name 暴露内部服务端口到 0.0.0.0: $ports"
+  else
+    echo "  [OK] $name $ports"
+  fi
+done
+
+echo ""
+echo "--- 镜像 tag 分级检查 (生产期望: 固定到具体 patch, 跑 /dwy-docker-image 选 N-1 minor) ---"
+# 浮动 tag 黑名单 (无版本号或仅描述类的)
+FLOATING_TAGS='^(latest|stable|mainline|edge|current|alpine|slim|bookworm|bullseye|buster|jammy|focal|noble|nightly)$'
+docker ps --format "{{.Names}}|{{.Image}}" 2>/dev/null | while IFS='|' read -r name image; do
+  # 拆 image 与 tag (注意 image 可能含 registry 域名如 ghcr.io/foo/bar:tag)
+  if [[ "$image" == *"@sha256:"* ]]; then
+    # tag@digest 形式 → digest 钉死, 最严格
+    echo "  [OK+] $name  digest 钉死: $image"
+    continue
+  fi
+  # 取最后一个冒号后内容当 tag (port 形式 registry:5000/foo:tag 也只取最后)
+  base="${image%:*}"
+  tag="${image##*:}"
+  if [[ "$base" == "$image" ]]; then
+    # 没有冒号 → 无 tag (等同 :latest)
+    echo "  [!!!] CRITICAL $name  $image  省略 tag (等同 :latest), 不可重现"
+    continue
+  fi
+  # 提取 tag 起始的语义版本前缀, 支持 "X" / "X.Y" / "X.Y.Z" / "X.Y.Z-suffix"
+  ver_prefix=$(echo "$tag" | grep -oE '^[0-9]+(\.[0-9]+){0,3}')
+  if [[ -n "$ver_prefix" ]]; then
+    seg_count=$(echo "$ver_prefix" | awk -F. '{print NF}')
+  else
+    seg_count=0
+  fi
+
+  if [[ "$tag" == "latest" ]]; then
+    echo "  [!!!] CRITICAL $name  $image  使用 :latest"
+  elif echo "$tag" | grep -qE "$FLOATING_TAGS"; then
+    echo "  [!!] HIGH    $name  $image  浮动 tag :$tag (随上游漂移)"
+  elif [[ "$seg_count" == 0 ]]; then
+    # 非数字开头, 可能是 commit hash / build id / 自定义 tag
+    echo "  [i]          $name  $image  非 semver tag :$tag (确认是否 immutable; 如自建镜像走构建 id 视为 OK)"
+  elif [[ "$seg_count" == 1 ]]; then
+    echo "  [!!] HIGH    $name  $image  仅 major :$tag, 应固定到 minor 或 patch"
+  elif [[ "$seg_count" == 2 ]]; then
+    # 两段: postgres/mysql/mariadb/alpine/debian/ubuntu 已是 patch; nginx/redis/node 等三段 semver 则需升 patch
+    echo "  [i]          $name  $image  两段 :$ver_prefix (postgres/mysql/alpine 视为 patch OK; redis/nginx/node 等需固定到三段)"
+  else
+    # 三段及以上 (含 -alpine 等后缀)
+    echo "  [OK] $name  $image"
+  fi
+done
+echo ""
+echo "[i] 修复:对每条 [!!!] / [!!] / [!] 的镜像,跑 /dwy-docker-image 用 query_dockerhub.py 拿 N-1 minor 推荐版本"
+
+echo ""
+echo "--- 容器是否以 root 运行 ---"
+for c in $(docker ps -q 2>/dev/null); do
+  name=$(docker inspect -f '{{.Name}}' "$c" | sed 's|^/||')
+  user=$(docker inspect -f '{{.Config.User}}' "$c")
+  user="${user:-root}"
+  if [[ "$user" == "root" || "$user" == "0" || "$user" == "0:0" ]]; then
+    echo "  [!] $name  以 root 运行 (User=${user})"
+  else
+    echo "  [OK] $name  user=$user"
+  fi
+done
+
+echo ""
+echo "--- 特权容器检查 ---"
+for c in $(docker ps -q 2>/dev/null); do
+  name=$(docker inspect -f '{{.Name}}' "$c" | sed 's|^/||')
+  priv=$(docker inspect -f '{{.HostConfig.Privileged}}' "$c")
+  caps=$(docker inspect -f '{{.HostConfig.CapAdd}}' "$c")
+  if [[ "$priv" == "true" ]]; then
+    echo "  [!!!] $name  --privileged"
+  fi
+  if [[ "$caps" != "[]" && "$caps" != "<no value>" ]]; then
+    echo "  [!] $name  额外 capabilities: $caps"
+  fi
+done
+
+echo ""
+echo "--- docker.sock 挂载检查 ---"
+for c in $(docker ps -q 2>/dev/null); do
+  name=$(docker inspect -f '{{.Name}}' "$c" | sed 's|^/||')
+  mounts=$(docker inspect -f '{{range .Mounts}}{{.Source}}->{{.Destination}} {{end}}' "$c")
+  if echo "$mounts" | grep -q "docker.sock"; then
+    echo "  [!!!] $name  挂载了 docker.sock: $mounts"
+  fi
+done
+
+echo ""
+echo "--- docker daemon 配置 ---"
+DAEMON_JSON=$(sudo -n cat /etc/docker/daemon.json 2>/dev/null || cat /etc/docker/daemon.json 2>/dev/null || echo "")
+if [[ -z "$DAEMON_JSON" ]]; then
+  echo "[i] 无 daemon.json 或不可读"
+else
+  echo "$DAEMON_JSON"
+fi
+
+echo ""
+echo "--- 容器 RestartPolicy (服务器重启后能否自动起来) ---"
+for c in $(docker ps -aq 2>/dev/null); do
+  name=$(docker inspect -f '{{.Name}}' "$c" 2>/dev/null | sed 's|^/||')
+  policy=$(docker inspect -f '{{.HostConfig.RestartPolicy.Name}}' "$c" 2>/dev/null)
+  state=$(docker inspect -f '{{.State.Status}}' "$c" 2>/dev/null)
+  case "$policy" in
+    always|unless-stopped)
+      echo "  [OK] $name  state=$state  policy=$policy"
+      ;;
+    on-failure)
+      echo "  [!] $name  state=$state  policy=on-failure (手动 stop / OOM 后不会重启)"
+      ;;
+    no|"")
+      [[ "$state" == "running" ]] \
+        && echo "  [!!!] CRITICAL: $name  state=running  policy=${policy:-no} (服务器重启后不会自动启动)" \
+        || echo "  [i] $name  state=$state  policy=${policy:-no}"
+      ;;
+    *)
+      echo "  [?] $name  policy=$policy (未知)"
+      ;;
+  esac
+done
+
+echo ""
+echo "--- 日志驱动配置 (防容器日志写满磁盘) ---"
+LOG_DRIVER=$(echo "$DAEMON_JSON" | grep -oE '"log-driver"[[:space:]]*:[[:space:]]*"[^"]+"' | head -1)
+LOG_MAX_SIZE=$(echo "$DAEMON_JSON" | grep -oE '"max-size"[[:space:]]*:[[:space:]]*"[^"]+"' | head -1)
+LOG_MAX_FILE=$(echo "$DAEMON_JSON" | grep -oE '"max-file"[[:space:]]*:[[:space:]]*"[^"]+"' | head -1)
+echo "log-driver: ${LOG_DRIVER:-(默认 json-file)}"
+echo "max-size:   ${LOG_MAX_SIZE:-(未配置, 单容器日志可无限增长)}"
+echo "max-file:   ${LOG_MAX_FILE:-(未配置)}"
+if [[ -z "$LOG_MAX_SIZE" ]]; then
+  echo "[!!] HIGH: 未限制单容器日志大小,长跑容器可能写满磁盘"
+  echo "      建议: daemon.json 加 \"log-opts\": {\"max-size\": \"100m\", \"max-file\": \"3\"}"
+fi
+
+echo ""
+echo "--- docker compose 文件位置 (用于人工核查) ---"
+sudo -n find /home /opt /srv /root -maxdepth 5 \( -name "docker-compose*.yml" -o -name "compose.yml" \) 2>/dev/null | head -10
+
+echo ""
+echo "--- 镜像源加速检查 (国内服务器拉境外镜像必装) ---"
+# a. 时区判定 (粗判境内)
+TZ_VAL=$(timedatectl show -p Timezone --value 2>/dev/null || readlink -f /etc/localtime 2>/dev/null | sed 's|.*/zoneinfo/||')
+echo "服务器时区: ${TZ_VAL:-unknown}"
+LIKELY_CN=0
+case "$TZ_VAL" in
+  Asia/Shanghai|Asia/Chongqing|Asia/Urumqi|Asia/Harbin|Asia/Hong_Kong|PRC) LIKELY_CN=1 ;;
+esac
+[[ "$LIKELY_CN" == "1" ]] && echo "→ 时区在 PRC, 拉境外 registry 不加速会非常慢" \
+                          || echo "→ 时区非 PRC, 加速可选"
+
+# b. daemon.json registry-mirrors
+echo ""
+MIRRORS=$(echo "$DAEMON_JSON" | grep -oE '"registry-mirrors"[[:space:]]*:[[:space:]]*\[[^]]*\]' | head -1)
+if [[ -n "$MIRRORS" ]]; then
+  echo "daemon registry-mirrors:"
+  echo "  $MIRRORS"
+  # 简单识别推荐源
+  echo "$MIRRORS" | grep -oE 'https?://[a-zA-Z0-9.-]+' | while read u; do
+    case "$u" in
+      *daocloud*|*aliyun*|*aliyuncs*|*ustc*|*tsinghua*|*163*|*tencent*|*huaweicloud*)
+        echo "    [OK] $u (国内加速源)" ;;
+      *)
+        echo "    [i]  $u (非已知国内主流源, 确认是否仍可用)" ;;
+    esac
+  done
+else
+  if [[ "$LIKELY_CN" == "1" ]]; then
+    echo "[!!] HIGH: daemon.json 未配 registry-mirrors, 国内服务器拉 docker.io 镜像会非常慢"
+  else
+    echo "[i] daemon.json 未配 registry-mirrors (境外服务器一般不需要)"
+  fi
+  echo "      修复: 跑 /dwy-mirror-source 自动写入阿里云/中科大/daocloud 镜像源"
+fi
+
+# c. 当前运行中容器使用的境外 registry (registry-mirrors 仅对 docker.io 生效)
+echo ""
+echo "--- 运行容器 image registry 来源 (registry-mirrors 仅救 docker.io, 其他要改前缀) ---"
+docker ps --format "{{.Names}}|{{.Image}}" 2>/dev/null | while IFS='|' read -r name image; do
+  # 拆 registry: 必须含 "/" 且首段含 "." (域名) 或 ":" (port) 才算独立 registry
+  # 否则视为隐式 docker.io (单段名 redis 或 namespace/name 格式 bitnami/redis)
+  if [[ "$image" != */* ]]; then
+    registry="docker.io"
+  else
+    first_seg="${image%%/*}"
+    if [[ "$first_seg" == *.* || "$first_seg" == *:* ]]; then
+      registry="$first_seg"
+    else
+      registry="docker.io"
+    fi
+  fi
+
+  case "$registry" in
+    docker.io)
+      tag="OK 走 daemon registry-mirrors 加速"
+      [[ -z "$MIRRORS" && "$LIKELY_CN" == "1" ]] && tag="[!!] 未配 mirror 国内拉取慢"
+      ;;
+    gcr.io|ghcr.io|k8s.gcr.io|registry.k8s.io|quay.io|mcr.microsoft.com|nvcr.io|docker.elastic.co)
+      if [[ "$LIKELY_CN" == "1" ]]; then
+        tag="[!!] HIGH 境外 registry, registry-mirrors 不生效, 必须把 image 名改 *.m.daocloud.io 前缀"
+      else
+        tag="[i] 境外 registry"
+      fi
+      ;;
+    *daocloud*|*aliyun*|*aliyuncs*|*ustc*)
+      tag="[OK] 已用国内镜像前缀"
+      ;;
+    *)
+      tag="[i] 自建/私有 registry"
+      ;;
+  esac
+  printf "  %-32s registry=%-32s %s\n" "$name" "$registry" "$tag"
+done
+
+echo ""
+echo "[i] 修复路径:"
+echo "      1. docker.io 加速  → /dwy-mirror-source 自动配 daemon registry-mirrors"
+echo "      2. gcr/ghcr/k8s    → 把 image 改 <registry>.m.daocloud.io 前缀, 见 dwy-mirror-source 镜像替换表"
+echo "      3. 镜像版本不固定  → /dwy-docker-image 选 N-1 minor 重新固定"
+REMOTE