create-dwy 0.5.1 → 0.6.0

package/templates/claude-global/skills/dwy-deploy-audit/scripts/check_env.sh

@@ -0,0 +1,64 @@
+#!/usr/bin/env bash
+# 环境变量与文件权限检查
+TARGET="$1"; shift
+SSH_OPTS=("$@")
+
+ssh "${SSH_OPTS[@]}" "${TARGET}" bash -s <<'REMOTE'
+echo "--- 全局搜索 .env 文件位置 (限制深度,跳过 /proc /sys) ---"
+sudo -n find /home /opt /srv /var/www /root /etc -maxdepth 6 -type f \
+  \( -name ".env" -o -name ".env.*" -o -name "*.env" \) \
+  ! -name "*.example" ! -name "*.sample" ! -name "*.template" \
+  -printf "%M  %u:%g  %p  (%s bytes)\n" 2>/dev/null \
+  || find /home /opt /srv /var/www -maxdepth 6 -type f \
+       \( -name ".env" -o -name ".env.*" \) \
+       ! -name "*.example" ! -name "*.sample" \
+       -printf "%M  %u:%g  %p  (%s bytes)\n" 2>/dev/null \
+  || echo "[!] 无 sudo,部分目录无法扫描"
+
+echo ""
+echo "--- nginx 静态根目录是否包含敏感文件 ---"
+NGINX_DUMP=$(sudo -n nginx -T 2>/dev/null || nginx -T 2>/dev/null || true)
+if [[ -n "$NGINX_DUMP" ]]; then
+  ROOTS=$(echo "$NGINX_DUMP" | awk '/^[[:space:]]*root /{print $2}' | tr -d ';' | sort -u)
+  for r in $ROOTS; do
+    echo ">> root = $r"
+    [[ -d "$r" ]] || { echo "  [!] 目录不存在或不可读"; continue; }
+    for s in ".env" ".git" ".DS_Store" "package.json" "composer.json" "wp-config.php"; do
+      if [[ -e "$r/$s" ]]; then
+        echo "  [!] 暴露: $r/$s"
+      fi
+    done
+  done
+fi
+
+echo ""
+echo "--- 关键文件权限 ---"
+for f in /etc/shadow /etc/passwd /etc/sudoers /etc/ssh/sshd_config /etc/nginx/nginx.conf; do
+  ls -l "$f" 2>/dev/null || echo "  [i] $f 不可读"
+done
+
+echo ""
+echo "--- 应用进程运行用户 (期望非 root) ---"
+ps -eo user,pid,cmd --sort=user 2>/dev/null | grep -E "(node|python|uvicorn|gunicorn|java|php-fpm|fastapi|uwsgi)" | grep -v grep | head -20
+
+echo ""
+echo "--- sudo 免密配置 ---"
+sudo -n cat /etc/sudoers 2>/dev/null | grep -v "^#" | grep -v "^$" | head -20 || echo "[i] 无 sudo 权限读取 /etc/sudoers"
+sudo -n ls /etc/sudoers.d/ 2>/dev/null | head -10
+
+echo ""
+echo "--- 全局环境变量泄漏排查 (是否有密码/key 写在 /etc/environment 或 /etc/profile) ---"
+for f in /etc/environment /etc/profile /etc/bash.bashrc; do
+  if [[ -r "$f" ]]; then
+    grep -iE "password|secret|token|api_key|apikey" "$f" 2>/dev/null \
+      | sed -E 's/(password|secret|token|api[_-]?key)([^=]*=)([^[:space:]]+)/\1\2<REDACTED>/gi' \
+      || true
+  fi
+done
+
+echo ""
+echo "--- crontab 中是否有可疑命令 ---"
+sudo -n crontab -l 2>/dev/null | head -20 || crontab -l 2>/dev/null | head -20
+echo "--- /etc/cron.d/ /etc/cron.daily/ ---"
+ls /etc/cron.d/ /etc/cron.daily/ 2>/dev/null | head -20
+REMOTE

package/templates/claude-global/skills/dwy-deploy-audit/scripts/check_https.sh

@@ -0,0 +1,60 @@
+#!/usr/bin/env bash
+# HTTPS / SSL 证书检查
+TARGET="$1"; shift
+SSH_OPTS=("$@")
+
+ssh "${SSH_OPTS[@]}" "${TARGET}" bash -s <<'REMOTE'
+echo "--- 检测可能的 HTTPS 站点 (从 nginx 配置) ---"
+DOMAINS=()
+NGINX_DUMP=$(sudo -n nginx -T 2>/dev/null || nginx -T 2>/dev/null || true)
+if [[ -n "$NGINX_DUMP" ]]; then
+  while IFS= read -r d; do
+    [[ -n "$d" && "$d" != "_" && "$d" != "localhost" ]] && DOMAINS+=("$d")
+  done < <(echo "$NGINX_DUMP" | awk '/server_name/ {for(i=2;i<=NF;i++) print $i}' | tr -d ';' | sort -u)
+fi
+
+if [[ ${#DOMAINS[@]} -eq 0 ]]; then
+  DOMAINS+=("localhost")
+fi
+
+echo "目标域名: ${DOMAINS[*]}"
+
+for D in "${DOMAINS[@]}"; do
+  echo ""
+  echo "===== $D ====="
+
+  echo "--- HTTPS 可达性 ---"
+  HTTPS_CODE=$(curl -k -sS -o /dev/null -w "%{http_code}" --max-time 5 "https://$D" 2>/dev/null || echo "000")
+  HTTP_CODE=$(curl -sS -o /dev/null -w "%{http_code} -> %{redirect_url}" --max-time 5 "http://$D" 2>/dev/null || echo "000")
+  echo "  https://$D  -> HTTP $HTTPS_CODE"
+  echo "  http://$D   -> HTTP $HTTP_CODE"
+
+  echo "--- 证书信息 ---"
+  CERT=$(echo | timeout 5 openssl s_client -servername "$D" -connect "${D}:443" -showcerts 2>/dev/null </dev/null)
+  if [[ -z "$CERT" ]]; then
+    echo "  [!] 无法获取证书 (可能未启用 HTTPS 或域名无 DNS)"
+    continue
+  fi
+  echo "$CERT" | openssl x509 -noout -subject -issuer -dates 2>/dev/null
+
+  echo "--- SAN ---"
+  echo "$CERT" | openssl x509 -noout -ext subjectAltName 2>/dev/null | grep -i "DNS:" | head -3
+
+  echo "--- 剩余天数 ---"
+  END=$(echo "$CERT" | openssl x509 -noout -enddate 2>/dev/null | cut -d= -f2)
+  if [[ -n "$END" ]]; then
+    END_TS=$(date -d "$END" +%s 2>/dev/null || date -j -f "%b %d %H:%M:%S %Y %Z" "$END" +%s 2>/dev/null)
+    NOW_TS=$(date +%s)
+    if [[ -n "$END_TS" ]]; then
+      DAYS=$(( (END_TS - NOW_TS) / 86400 ))
+      echo "  剩余 $DAYS 天 (过期时间: $END)"
+    fi
+  fi
+
+  echo "--- TLS 协议支持 ---"
+  for proto in tls1 tls1_1 tls1_2 tls1_3; do
+    R=$(echo | timeout 3 openssl s_client -"$proto" -connect "${D}:443" 2>&1 </dev/null | grep -E "Protocol|handshake failure|wrong version" | head -1)
+    printf "  %-8s %s\n" "$proto" "$R"
+  done
+done
+REMOTE

package/templates/claude-global/skills/dwy-deploy-audit/scripts/check_logs.sh

@@ -0,0 +1,209 @@
+#!/usr/bin/env bash
+# 日志大小与防爆检查 (只读)
+#
+# 检查范围:
+#   - Docker 单容器 json-log 大小
+#   - Docker daemon log-opts 是否生效到具体容器
+#   - Nginx access/error log 大小 + logrotate 覆盖
+#   - systemd journal 占用 + SystemMaxUse 配置
+#   - 应用日志目录 (自动探测 /var/log/<svc>、/opt/*/logs、/home/*/logs)
+#   - 总日志占用 vs 根盘剩余, 估算撑天数
+
+TARGET="$1"; shift
+SSH_OPTS=("$@")
+
+ssh "${SSH_OPTS[@]}" "${TARGET}" bash -s <<'REMOTE'
+ROOT_FREE_MB=$(df -BM --output=avail / 2>/dev/null | tail -1 | tr -d ' M')
+ROOT_FREE_MB=${ROOT_FREE_MB:-0}
+NOW_TS=$(date +%s)
+
+echo "--- 根盘可用 ---"
+df -h / 2>/dev/null
+echo "可用: ${ROOT_FREE_MB} MB"
+
+# ============================================================
+echo ""
+echo "--- Docker 容器 json-log 大小 (单文件 Top 20) ---"
+if command -v docker >/dev/null 2>&1; then
+  # 收集 daemon log-opts 用于关联判定
+  DAEMON_JSON=$(sudo -n cat /etc/docker/daemon.json 2>/dev/null \
+                || cat /etc/docker/daemon.json 2>/dev/null || echo "")
+  DAEMON_MAX_SIZE=$(echo "$DAEMON_JSON" \
+    | grep -oE '"max-size"[[:space:]]*:[[:space:]]*"[^"]+"' \
+    | head -1 | grep -oE '"[^"]+"$' | tr -d '"')
+  echo "daemon.json log-opts max-size: ${DAEMON_MAX_SIZE:-(未配置)}"
+  echo ""
+
+  # 列出所有 json-log: <size> <path>
+  LOG_LIST=$(sudo -n find /var/lib/docker/containers -maxdepth 2 -name "*-json.log" \
+              -printf '%s %p\n' 2>/dev/null \
+              || find /var/lib/docker/containers -maxdepth 2 -name "*-json.log" \
+                 -printf '%s %p\n' 2>/dev/null)
+
+  if [[ -z "$LOG_LIST" ]]; then
+    echo "[i] 无法读取 /var/lib/docker/containers (需 sudo) 或无 json-log"
+  else
+    DOCKER_LOG_TOTAL_BYTES=0
+    # 排序+top 20, 反查容器名
+    while IFS=' ' read -r size path; do
+      [[ -z "$size" ]] && continue
+      DOCKER_LOG_TOTAL_BYTES=$(( DOCKER_LOG_TOTAL_BYTES + size ))
+      cid=$(basename "$(dirname "$path")")
+      cid_short="${cid:0:12}"
+      name=$(docker inspect -f '{{.Name}}' "$cid" 2>/dev/null | sed 's|^/||')
+      [[ -z "$name" ]] && name="<已删除>"
+      size_mb=$(( size / 1024 / 1024 ))
+      printf "  %-32s %6d MB  %s\n" "$name" "$size_mb" "$path"
+
+      # 单文件大小告警
+      if [[ "$size_mb" -ge 1024 ]] && [[ -z "$DAEMON_MAX_SIZE" ]]; then
+        echo "    [!!!] CRITICAL: 单容器日志 ${size_mb} MB 且 daemon 无 log-opts 大小限制"
+      elif [[ "$size_mb" -ge 500 ]]; then
+        echo "    [!!] HIGH: 单容器日志 ${size_mb} MB"
+      fi
+    done < <(echo "$LOG_LIST" | sort -rn | head -20)
+
+    DOCKER_LOG_TOTAL_MB=$(( DOCKER_LOG_TOTAL_BYTES / 1024 / 1024 ))
+    echo ""
+    echo "Docker json-log 合计: ${DOCKER_LOG_TOTAL_MB} MB"
+  fi
+
+  echo ""
+  echo "--- 各容器是否覆盖 logging driver (compose level 优先于 daemon level) ---"
+  docker ps -q 2>/dev/null | while read c; do
+    name=$(docker inspect -f '{{.Name}}'                              "$c" | sed 's|^/||')
+    lt=$(docker inspect -f   '{{.HostConfig.LogConfig.Type}}'         "$c" 2>/dev/null)
+    lc=$(docker inspect -f   '{{json .HostConfig.LogConfig.Config}}'  "$c" 2>/dev/null)
+    [[ -z "$lc" || "$lc" == "null" ]] && lc='{}'
+    printf "  %-32s driver=%-12s opts=%s\n" "$name" "${lt:-?}" "$lc"
+    if [[ "$lt" == "json-file" && "$lc" == "{}" && -z "$DAEMON_MAX_SIZE" ]]; then
+      echo "    [!!] HIGH: 容器无 logging.options 且 daemon 无 max-size, 日志可无限增长"
+    fi
+  done
+else
+  echo "[i] Docker 未安装,跳过容器日志检查"
+  DOCKER_LOG_TOTAL_MB=0
+fi
+
+# ============================================================
+echo ""
+echo "--- Nginx 日志 ---"
+if [[ -d /var/log/nginx ]]; then
+  ls -lh /var/log/nginx/ 2>/dev/null | head -20
+  NGINX_LOG_BYTES=$(sudo -n du -sb /var/log/nginx 2>/dev/null | awk '{print $1}' \
+                    || du -sb /var/log/nginx 2>/dev/null | awk '{print $1}')
+  NGINX_LOG_MB=$(( ${NGINX_LOG_BYTES:-0} / 1024 / 1024 ))
+  echo "合计: ${NGINX_LOG_MB} MB"
+
+  # access.log / error.log 单文件大小
+  for f in /var/log/nginx/access.log /var/log/nginx/error.log; do
+    [[ -f "$f" ]] || continue
+    sz_mb=$(( $(stat -c %s "$f" 2>/dev/null || echo 0) / 1024 / 1024 ))
+    if [[ "$sz_mb" -ge 500 ]]; then
+      echo "[!!] HIGH: $f 单文件 ${sz_mb} MB"
+    fi
+  done
+
+  # logrotate 覆盖
+  if [[ -f /etc/logrotate.d/nginx ]]; then
+    echo "[OK] /etc/logrotate.d/nginx 存在"
+  else
+    echo "[!!] HIGH: nginx 已部署但无 /etc/logrotate.d/nginx, 日志可能无限增长"
+  fi
+else
+  echo "[i] /var/log/nginx 不存在, 跳过"
+  NGINX_LOG_MB=0
+fi
+
+# ============================================================
+echo ""
+echo "--- systemd journal 占用 ---"
+if command -v journalctl >/dev/null 2>&1; then
+  JOURNAL_USAGE=$(journalctl --disk-usage 2>/dev/null | grep -oE '[0-9.]+[KMG]B?' | tail -1)
+  echo "journalctl --disk-usage: ${JOURNAL_USAGE:-?}"
+  # 转 MB (粗略)
+  case "$JOURNAL_USAGE" in
+    *G*) JOURNAL_MB=$(echo "$JOURNAL_USAGE" | sed 's/[GBb]//g' | awk '{print int($1*1024)}') ;;
+    *M*) JOURNAL_MB=$(echo "$JOURNAL_USAGE" | sed 's/[MBb]//g' | awk '{print int($1)}') ;;
+    *K*) JOURNAL_MB=0 ;;
+    *)   JOURNAL_MB=0 ;;
+  esac
+
+  # SystemMaxUse 配置
+  SMU=$(grep -E "^[[:space:]]*SystemMaxUse" /etc/systemd/journald.conf 2>/dev/null \
+        | head -1 | awk -F= '{gsub(/[ \t]/,"",$2); print $2}')
+  echo "SystemMaxUse: ${SMU:-(未配置, 默认按磁盘 10% 自动控)}"
+
+  if [[ "$JOURNAL_MB" -ge 2048 && -z "$SMU" ]]; then
+    echo "[!!] HIGH: journal 已 ${JOURNAL_MB} MB 且未配 SystemMaxUse"
+  fi
+else
+  JOURNAL_MB=0
+fi
+
+# ============================================================
+echo ""
+echo "--- 应用日志目录 (自动探测 Top 5) ---"
+APP_LOG_TOTAL_MB=0
+# 优先 sudo, 失败再退化; 不要用 OR fallback (du 退出码可能因部分不可读而非零, 会被双重执行)
+APP_LOG_LIST=$(sudo -n du -smc /var/log/*/ /opt/*/logs /opt/*/log /home/*/logs /srv/*/logs 2>/dev/null \
+  | grep -v 'total$' | sort -rn | head -10)
+if [[ -z "$APP_LOG_LIST" ]]; then
+  APP_LOG_LIST=$(du -smc /var/log/*/ /opt/*/logs /opt/*/log /home/*/logs /srv/*/logs 2>/dev/null \
+    | grep -v 'total$' | sort -rn | head -10)
+fi
+echo "$APP_LOG_LIST"
+APP_LOG_TOTAL_MB=$(echo "$APP_LOG_LIST" | awk '{s+=$1} END{print s+0}')
+
+# ============================================================
+echo ""
+echo "--- 日志总占用 vs 根盘剩余 (撑天数粗估) ---"
+TOTAL_LOG_MB=$(( DOCKER_LOG_TOTAL_MB + NGINX_LOG_MB + JOURNAL_MB + APP_LOG_TOTAL_MB ))
+echo "Docker json-log: ${DOCKER_LOG_TOTAL_MB} MB"
+echo "Nginx 日志:      ${NGINX_LOG_MB} MB"
+echo "systemd journal: ${JOURNAL_MB} MB"
+echo "应用日志合计:    ${APP_LOG_TOTAL_MB} MB"
+echo "日志合计:        ${TOTAL_LOG_MB} MB"
+echo "根盘可用:        ${ROOT_FREE_MB} MB"
+
+# 撑天数估算: 取所有 docker json-log 的 (size / 容器存活天数) 加总作为 daily growth
+GROWTH_MB=0
+if command -v docker >/dev/null 2>&1; then
+  for c in $(docker ps -q 2>/dev/null); do
+    cid_full=$(docker inspect -f '{{.Id}}' "$c" 2>/dev/null)
+    log_path="/var/lib/docker/containers/${cid_full}/${cid_full}-json.log"
+    sz=$(sudo -n stat -c %s "$log_path" 2>/dev/null || stat -c %s "$log_path" 2>/dev/null || echo 0)
+    started=$(docker inspect -f '{{.State.StartedAt}}' "$c" 2>/dev/null)
+    started_ts=$(date -d "$started" +%s 2>/dev/null || echo 0)
+    if [[ "$started_ts" -gt 0 && "$sz" -gt 0 ]]; then
+      age_sec=$(( NOW_TS - started_ts ))
+      [[ "$age_sec" -lt 60 ]] && age_sec=60   # 防除零, 至少按 1 分钟算
+      daily_bytes=$(( sz * 86400 / age_sec ))
+      daily_mb=$(( daily_bytes / 1024 / 1024 ))
+      GROWTH_MB=$(( GROWTH_MB + daily_mb ))
+    fi
+  done
+fi
+
+echo "估算 Docker 日志日均增量: ${GROWTH_MB} MB/day (基于容器存活时长)"
+
+if [[ "$GROWTH_MB" -gt 0 && "$ROOT_FREE_MB" -gt 0 ]]; then
+  DAYS=$(( ROOT_FREE_MB / GROWTH_MB ))
+  echo "按当前增速预计可撑: ${DAYS} 天 (粗估, 仅算 docker json-log)"
+  if   [[ "$DAYS" -lt 30 ]]; then echo "[!!!] CRITICAL: 不足 30 天, 必须立即配 log-opts 或扩盘"
+  elif [[ "$DAYS" -lt 90 ]]; then echo "[!!] HIGH: 不足 90 天, 建议尽快补 log-opts max-size"
+  else echo "[OK] 撑天数 >= 90 天"
+  fi
+else
+  echo "[i] 无法估算日均增量 (容器刚起或无日志)"
+fi
+
+# ============================================================
+echo ""
+echo "--- 关键服务 logrotate 规则一览 (只读复述) ---"
+for app in nginx postgresql redis docker rsyslog; do
+  if [[ -f "/etc/logrotate.d/$app" ]]; then
+    echo "  [OK] /etc/logrotate.d/$app"
+  fi
+done
+REMOTE

package/templates/claude-global/skills/dwy-deploy-audit/scripts/check_nginx.sh

@@ -0,0 +1,92 @@
+#!/usr/bin/env bash
+# Nginx 配置检查 (只读)
+TARGET="$1"; shift
+SSH_OPTS=("$@")
+
+ssh "${SSH_OPTS[@]}" "${TARGET}" bash -s <<'REMOTE'
+if ! command -v nginx >/dev/null 2>&1; then
+  echo "[i] nginx 未安装,跳过"
+  exit 0
+fi
+
+echo "--- nginx version ---"
+nginx -v 2>&1
+
+echo ""
+echo "--- nginx 进程运行用户 ---"
+ps -eo user,pid,cmd | grep "[n]ginx: master" | head -1
+
+echo ""
+echo "--- nginx -T (effective config, 需 sudo 或 nginx 用户可读) ---"
+NGINX_DUMP=$(sudo -n nginx -T 2>/dev/null || nginx -T 2>/dev/null || true)
+if [[ -z "$NGINX_DUMP" ]]; then
+  echo "[!] 无法 dump nginx 配置,改读 /etc/nginx/"
+  ls -la /etc/nginx/ 2>/dev/null
+  echo "--- /etc/nginx/nginx.conf (head) ---"
+  head -80 /etc/nginx/nginx.conf 2>/dev/null
+  echo "--- sites-enabled / conf.d ---"
+  for d in /etc/nginx/sites-enabled /etc/nginx/conf.d; do
+    [[ -d "$d" ]] && ls -la "$d" 2>/dev/null
+  done
+else
+  echo "$NGINX_DUMP" | grep -E "^# configuration file" | head -20
+  echo ""
+  echo "--- KEY DIRECTIVES (filtered from nginx -T) ---"
+  echo "$NGINX_DUMP" | grep -Ei "^[[:space:]]*(listen|server_name|return|rewrite|ssl_protocols|ssl_ciphers|ssl_prefer_server_ciphers|ssl_certificate|ssl_certificate_key|server_tokens|access_log|error_log|client_max_body_size|client_body_timeout|add_header|autoindex|location|root|alias|proxy_pass)" \
+    | grep -v "^[[:space:]]*#" | head -200
+
+  echo ""
+  echo "--- HSTS / Security Headers 检查 ---"
+  echo "$NGINX_DUMP" | grep -i "Strict-Transport-Security\|X-Frame-Options\|X-Content-Type-Options\|Content-Security-Policy\|Referrer-Policy" || echo "[!] 未找到任何安全 header"
+
+  echo ""
+  echo "--- HTTP→HTTPS 跳转检查 ---"
+  echo "$NGINX_DUMP" | awk '/listen[[:space:]]+80/,/}/' | grep -i "return\|rewrite" | head -10 || echo "[!] 80 端口可能未配置强制跳转"
+
+  echo ""
+  echo "--- server_tokens ---"
+  echo "$NGINX_DUMP" | grep -E "^[[:space:]]*server_tokens" || echo "[!] server_tokens 未显式配置 (默认 on,会暴露版本)"
+
+  echo ""
+  echo "--- access_log / error_log ---"
+  echo "$NGINX_DUMP" | grep -E "^[[:space:]]*(access_log|error_log)" | head -10
+
+  echo ""
+  echo "--- client_max_body_size (对齐 dwy-payload-limits) ---"
+  echo "$NGINX_DUMP" | grep -E "^[[:space:]]*client_max_body_size" || echo "[!] 未显式配置 client_max_body_size"
+
+  echo ""
+  echo "--- 限流配置 (limit_req / limit_conn 防 CC / 暴力请求) ---"
+  ZONE_DEFS=$(echo "$NGINX_DUMP" | grep -E "^[[:space:]]*limit_(req|conn)_zone" || true)
+  if [[ -z "$ZONE_DEFS" ]]; then
+    echo "[!] CRITICAL: 未发现任何 limit_req_zone / limit_conn_zone 定义,无 CC 攻击防护"
+  else
+    echo "已定义 zone:"
+    echo "$ZONE_DEFS"
+    echo ""
+    echo "应用位置 (limit_req / limit_conn):"
+    echo "$NGINX_DUMP" | grep -E "^[[:space:]]*limit_(req|conn)[[:space:]]" || echo "[!] zone 已定义但未在 server/location 中应用"
+    echo ""
+    LIMIT_STATUS=$(echo "$NGINX_DUMP" | grep -E "^[[:space:]]*limit_req_status" | head -1)
+    echo "limit_req_status: ${LIMIT_STATUS:-(默认 503,建议 429)}"
+  fi
+
+  echo ""
+  echo "--- 慢速攻击防护 (slowloris) ---"
+  for d in client_body_timeout client_header_timeout send_timeout keepalive_timeout; do
+    val=$(echo "$NGINX_DUMP" | grep -E "^[[:space:]]*${d}[[:space:]]" | head -1)
+    echo "${d}: ${val:-(未显式配置,使用默认)}"
+  done
+fi
+
+echo ""
+echo "--- nginx 配置语法检查 ---"
+sudo -n nginx -t 2>&1 || nginx -t 2>&1 || echo "[i] 无法执行 nginx -t"
+
+echo ""
+echo "--- 危险路径暴露快测 (本机回环) ---"
+for path in "/.env" "/.git/HEAD" "/.git/config" "/admin" "/phpmyadmin" "/.DS_Store"; do
+  code=$(curl -k -s -o /dev/null -w "%{http_code}" --max-time 3 "https://localhost${path}" 2>/dev/null || echo "000")
+  printf "  %-20s -> https://localhost  HTTP %s\n" "$path" "$code"
+done
+REMOTE

package/templates/claude-global/skills/dwy-deploy-audit/scripts/check_resilience.sh

@@ -0,0 +1,157 @@
+#!/usr/bin/env bash
+# 自愈能力 / 资源耗尽防护检查 (只读)
+#
+# 检查范围:
+#   B 类: 系统服务开机自启 (sshd / nginx / docker / postgres / redis / frps / fail2ban / 自定义)
+#   D 类: 资源耗尽防护 (swap / ulimit / logrotate / 磁盘使用率 / 应用进程内存上限)
+#
+# 服务器意外重启后,这些配置决定了服务能否自动恢复;资源耗尽场景决定了
+# 服务能否在异常下保住基本运行而不被全局拖垮。
+
+TARGET="$1"; shift
+SSH_OPTS=("$@")
+
+ssh "${SSH_OPTS[@]}" "${TARGET}" bash -s <<'REMOTE'
+echo "########## B. 系统服务开机自启 ##########"
+
+# 默认必检清单
+DEFAULT_SERVICES=(sshd ssh nginx docker docker.socket postgresql postgres redis redis-server fail2ban frps frpc supervisor crond cron)
+
+echo "--- 默认必检清单 ---"
+for svc in "${DEFAULT_SERVICES[@]}"; do
+  # systemctl status 区分: not-found / disabled / enabled / static / masked
+  enabled=$(systemctl is-enabled "$svc" 2>/dev/null || echo "n/a")
+  active=$(systemctl is-active "$svc" 2>/dev/null || echo "n/a")
+  if [[ "$enabled" == "n/a" && "$active" == "n/a" ]]; then
+    continue  # 该服务未安装,跳过
+  fi
+  case "$enabled" in
+    enabled|enabled-runtime|alias|static)
+      icon="[OK]" ;;
+    disabled)
+      icon="[!!!] CRITICAL: 已部署但未开机自启,服务器重启后不会启动" ;;
+    masked)
+      icon="[!!!] CRITICAL: 服务被 mask,无法启动" ;;
+    *)
+      icon="[?] enabled=$enabled" ;;
+  esac
+  printf "  %-20s active=%-10s enabled=%-12s %s\n" "$svc" "$active" "$enabled" "$icon"
+done
+
+echo ""
+echo "--- 自动探测: 当前 enabled 的所有 unit (供人工核对应用主进程是否在内) ---"
+systemctl list-unit-files --type=service --state=enabled 2>/dev/null \
+  | awk 'NR>1 && $1 != "" {print "  " $1}' \
+  | head -40 || echo "[i] 无法列出 unit-files"
+
+echo ""
+echo "--- 自动探测: 当前 running 但 disabled 的服务 (重启后会消失) ---"
+running_services=$(systemctl list-units --type=service --state=running --no-pager --no-legend 2>/dev/null | awk '{print $1}')
+for svc in $running_services; do
+  enabled=$(systemctl is-enabled "$svc" 2>/dev/null)
+  if [[ "$enabled" == "disabled" ]]; then
+    echo "  [!!] $svc  正在运行但 disabled,重启后会丢失"
+  fi
+done
+
+
+echo ""
+echo "########## D. 资源耗尽防护 ##########"
+
+echo "--- 内存与 swap ---"
+free -h 2>/dev/null || vmstat -s 2>/dev/null | head -10
+SWAP_SIZE=$(awk '/SwapTotal/ {print $2}' /proc/meminfo 2>/dev/null)
+if [[ -z "$SWAP_SIZE" || "$SWAP_SIZE" == "0" ]]; then
+  echo "[!] MEDIUM: 未配置 swap,内存吃紧时直接 OOM kill"
+  echo "      建议: 至少配置 1-2GB swap (fallocate / dd + mkswap + swapon + /etc/fstab)"
+else
+  echo "[OK] swap 已配置: $((SWAP_SIZE / 1024)) MB"
+fi
+
+echo ""
+echo "--- 根分区使用率 ---"
+df -h / 2>/dev/null
+ROOT_USE=$(df / --output=pcent 2>/dev/null | tail -1 | tr -d ' %')
+if [[ -n "$ROOT_USE" ]]; then
+  if [[ "$ROOT_USE" -ge 90 ]]; then
+    echo "[!!!] CRITICAL: 根分区使用率 ${ROOT_USE}%, 即将写满"
+  elif [[ "$ROOT_USE" -ge 80 ]]; then
+    echo "[!] MEDIUM: 根分区使用率 ${ROOT_USE}%, 建议清理"
+  else
+    echo "[OK] 根分区使用率 ${ROOT_USE}%"
+  fi
+fi
+
+echo ""
+echo "--- /var/log 与 /var/lib/docker 大小 ---"
+sudo -n du -sh /var/log /var/lib/docker /var/lib/postgresql 2>/dev/null \
+  || du -sh /var/log /var/lib/docker /var/lib/postgresql 2>/dev/null \
+  || echo "[i] 部分目录不可读"
+
+echo ""
+echo "--- logrotate 配置 ---"
+if [[ -f /etc/logrotate.conf ]]; then
+  echo "[OK] /etc/logrotate.conf 存在"
+  ls /etc/logrotate.d/ 2>/dev/null | head -20 | sed 's|^|  |'
+else
+  echo "[!] HIGH: /etc/logrotate.conf 不存在,日志可能无限增长"
+fi
+
+# 关键服务是否有 logrotate 规则
+echo ""
+echo "--- 关键服务 logrotate 规则 ---"
+for app in nginx postgresql redis docker rsyslog; do
+  if [[ -f "/etc/logrotate.d/$app" ]]; then
+    echo "  [OK] /etc/logrotate.d/$app"
+  else
+    if systemctl is-enabled "$app" >/dev/null 2>&1 || systemctl is-enabled "${app}-server" >/dev/null 2>&1; then
+      echo "  [!] $app 已部署但无 logrotate 规则"
+    fi
+  fi
+done
+
+echo ""
+echo "--- 文件描述符上限 (system + 关键服务) ---"
+echo "  系统 fs.file-max:    $(sysctl -n fs.file-max 2>/dev/null)"
+echo "  系统 fs.nr_open:     $(sysctl -n fs.nr_open 2>/dev/null)"
+for app in nginx postgres redis-server; do
+  pid=$(pgrep -f "[${app:0:1}]${app:1}" | head -1)
+  if [[ -n "$pid" ]]; then
+    soft=$(awk '/Max open files/ {print $4}' /proc/$pid/limits 2>/dev/null)
+    hard=$(awk '/Max open files/ {print $5}' /proc/$pid/limits 2>/dev/null)
+    echo "  $app (pid $pid): soft=$soft hard=$hard"
+    if [[ -n "$soft" && "$soft" -lt 4096 ]]; then
+      echo "    [!] MEDIUM: ulimit -n 偏低 ($soft),高并发场景可能耗尽"
+    fi
+  fi
+done
+
+echo ""
+echo "--- /etc/security/limits.conf 自定义条目 ---"
+sudo -n grep -vE "^[[:space:]]*#|^[[:space:]]*$" /etc/security/limits.conf 2>/dev/null \
+  || grep -vE "^[[:space:]]*#|^[[:space:]]*$" /etc/security/limits.conf 2>/dev/null \
+  || echo "[i] limits.conf 不可读"
+ls /etc/security/limits.d/ 2>/dev/null | sed 's|^|  /etc/security/limits.d/|'
+
+echo ""
+echo "--- 内存压力指标 (PSI) ---"
+if [[ -r /proc/pressure/memory ]]; then
+  cat /proc/pressure/memory
+else
+  echo "[i] PSI 不可用 (内核 < 4.20 或未启用)"
+fi
+
+echo ""
+echo "--- 关键容器内存上限 (避免容器吃掉宿主机) ---"
+if command -v docker >/dev/null 2>&1; then
+  docker ps -q 2>/dev/null | while read c; do
+    name=$(docker inspect -f '{{.Name}}' "$c" 2>/dev/null | sed 's|^/||')
+    mem=$(docker inspect -f '{{.HostConfig.Memory}}' "$c" 2>/dev/null)
+    if [[ "$mem" == "0" ]]; then
+      echo "  [!] $name  无内存上限,异常时可能耗尽宿主机"
+    else
+      echo "  [OK] $name  Memory=$((mem / 1024 / 1024)) MB"
+    fi
+  done
+fi
+REMOTE