Initial commit

2026-07-17 18:49:07 +08:00
commit 9c7d7abdd4
100 changed files with 41337 additions and 0 deletions
@@ -0,0 +1,115 @@
+#!/bin/bash
+# SSL证书申请脚本 - stock.allbyai.cn
+# 使用 acme.sh + DNS 验证方式申请免费SSL证书
+# 适用于 DNSPod 有 Web 防护导致 HTTP 验证失败的情况
+# 在服务器上执行此脚本
+
+set -e
+
+DOMAIN="stock.allbyai.cn"
+SSL_DIR="/etc/nginx/ssl"
+ACME_HOME="/home/ubuntu/.acme.sh"
+
+echo "=========================================="
+echo "为 ${DOMAIN} 完成SSL证书安装"
+echo "=========================================="
+
+# 检查 acme.sh 是否已安装
+if [ ! -f "${ACME_HOME}/acme.sh" ]; then
+    echo "错误: acme.sh 未安装，请先运行初始化"
+    exit 1
+fi
+
+# 检查 DNS TXT 记录
+echo "[1/4] 检查 DNS TXT 记录..."
+TXT_RECORD=$(dig +short TXT _acme-challenge.stock.allbyai.cn 2>/dev/null || echo "")
+if [ -z "$TXT_RECORD" ]; then
+    echo ""
+    echo "错误: DNS TXT 记录未找到！"
+    echo ""
+    echo "请在 DNSPod 添加以下 TXT 记录:"
+    echo "  主机记录: _acme-challenge.stock"
+    echo "  记录值: cM9lSA4-uKk-yjrvA38HYtmA1h7E3DzgIXVJq8IsSNo"
+    echo ""
+    echo "添加后等待 1-2 分钟，然后重新运行此脚本"
+    exit 1
+fi
+echo "DNS TXT 记录已找到: $TXT_RECORD"
+
+# 创建 SSL 目录
+echo "[2/4] 创建 SSL 目录..."
+mkdir -p ${SSL_DIR}
+
+# 完成证书申请
+echo "[3/4] 完成证书申请..."
+${ACME_HOME}/acme.sh --renew -d ${DOMAIN} --yes-I-know-dns-manual-mode-enough-go-ahead-please
+
+# 安装证书
+echo "[4/4] 安装证书到 Nginx..."
+${ACME_HOME}/acme.sh --install-cert -d ${DOMAIN} \
+    --key-file ${SSL_DIR}/${DOMAIN}.key \
+    --fullchain-file ${SSL_DIR}/${DOMAIN}.crt \
+    --reloadcmd "systemctl reload nginx"
+
+# 更新 Nginx 配置
+echo "[5/5] 更新 Nginx 配置..."
+cat > /etc/nginx/sites-available/${DOMAIN} << 'NGINX_CONF'
+# Nginx配置 - stock.allbyai.cn (HTTPS)
+server {
+    listen 80;
+    server_name stock.allbyai.cn;
+    return 301 https://$server_name$request_uri;
+}
+
+server {
+    listen 443 ssl http2;
+    server_name stock.allbyai.cn;
+
+    ssl_certificate /etc/nginx/ssl/stock.allbyai.cn.crt;
+    ssl_certificate_key /etc/nginx/ssl/stock.allbyai.cn.key;
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
+    ssl_prefer_server_ciphers off;
+
+    access_log /var/log/nginx/stock.allbyai.cn.access.log;
+    error_log /var/log/nginx/stock.allbyai.cn.error.log;
+
+    location / {
+        proxy_pass http://127.0.0.1:3333;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection 'upgrade';
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_cache_bypass $http_upgrade;
+        proxy_read_timeout 300s;
+        proxy_connect_timeout 75s;
+    }
+
+    location /static/ {
+        alias /opt/stock-app/static/;
+        expires 7d;
+        add_header Cache-Control "public, immutable";
+    }
+}
+NGINX_CONF
+
+# 重载 Nginx
+nginx -t && systemctl reload nginx
+
+echo ""
+echo "=========================================="
+echo "SSL证书安装完成！"
+echo ""
+echo "访问地址: https://${DOMAIN}"
+echo ""
+echo "证书信息:"
+echo "  - 证书路径: ${SSL_DIR}/${DOMAIN}.crt"
+echo "  - 密钥路径: ${SSL_DIR}/${DOMAIN}.key"
+echo "  - 有效期: 90天"
+echo "  - 自动续期: 已配置 (acme.sh cron)"
+echo ""
+echo "手动续期命令: ${ACME_HOME}/acme.sh --renew -d ${DOMAIN} --force"
+echo "=========================================="