我的VPS服务部署记录

services:
   postgres:
      image: postgres:18
      restart: always
      ports:
        - "5435:5432"
      environment:
        POSTGRES_DB: postgres
        POSTGRES_USER: postgres
        POSTGRES_PASSWORD: vps@027!
        TZ: Asia/Shanghai
      healthcheck:
        test:
          ["CMD", "pg_isready", "-U", "postgres", "-d", "postgres"]
        interval: 5s
        timeout: 10s
        retries: 5
      networks:
        - vps

networks:
   vps:
      external: true

services:
  umami:
    image: ghcr.io/umami-software/umami:postgresql-latest
    container_name: umami
    ports:
      - "3003:3000"
    environment:
      DATABASE_URL: postgresql://postgres:vps@027!@postgres:5432/umami
      DATABASE_TYPE: postgresql
      HASH_SALT: vps@2025
      TRACKER_SCRIPT_NAME: random-string.js
      TZ: "Asia/Shanghai"
      GENERIC_TIMEZONE: "Asia/Shanghai"
    networks:
      - vps
    restart: always

networks:
   vps:
    external: true

srcipt.js => random-string.js

server {
    listen 80;
    listen [::]:80;
    server_name umami.chensoul.cc;

    return 301 https://$host$request_uri;
}

server {
    listen          443 ssl;
    server_name     umami.chensoul.cc;

    ssl_certificate      /etc/nginx/ssl/fullchain.cer;
    ssl_certificate_key  /etc/nginx/ssl/chensoul.cc.key;

    ssl_session_cache    shared:SSL:1m;
    ssl_session_timeout  5m;

    ssl_ciphers  HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers  on;

    location / {
        proxy_pass http://127.0.0.1:3003;

        proxy_set_header Host $http_host;
       proxy_set_header X-Real-IP $remote_addr;
       proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
       proxy_set_header X-Forwarded-Proto $scheme;

        add_header X-Cache $upstream_cache_status;
        add_header Cache-Control no-cache;
        expires 12h;
    }
}

services:
  memos:
    image: neosmemo/memos:0.18.2
    container_name: memos
    environment:
      - MEMOS_DRIVER=postgres
      - MEMOS_DSN=postgres://postgres:vps@027!@postgres:5432/memos?sslmode=disable
    volumes:
      - ~/.memos/:/var/opt/memos
    ports:
      - '5230:5230'
    networks:
      - vps

networks:
  vps:
    external: true

server {
    listen 80;
    listen [::]:80;
    server_name memos.chensoul.cc;

    return 301 https://$host$request_uri;
}

server {
    listen          443 ssl;
    server_name     memos.chensoul.cc;

    ssl_certificate      /etc/nginx/ssl/fullchain.cer;
    ssl_certificate_key  /etc/nginx/ssl/chensoul.cc.key;

    ssl_session_cache    shared:SSL:1m;
    ssl_session_timeout  5m;

    ssl_ciphers  HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers  on;

    location / {
        proxy_pass http://127.0.0.1:5230;
        proxy_set_header Host $http_host;
       proxy_set_header X-Real-IP $remote_addr;
       proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
       proxy_set_header X-Forwarded-Proto $scheme;

    }
}

services:
  n8n:
    image: n8nio/n8n
    container_name: n8n
    restart: always
    environment:
      - NODE_ENV=production
      - DB_TYPE=postgresdb
      - DB_POSTGRESDB_HOST=postgres
      - DB_POSTGRESDB_PORT=5432
      - DB_POSTGRESDB_DATABASE=n8n
      - DB_POSTGRESDB_USER=postgres
      - DB_POSTGRESDB_PASSWORD=vps@027!
      - TZ="Asia/Shanghai"
      - GENERIC_TIMEZONE="Asia/Shanghai"
      - N8N_DEFAULT_LOCALE=zh-CN

      # 是否启用诊断和个性化推荐
      - N8N_DIAGNOSTICS_ENABLED=false
      - N8N_PERSONALIZATION_ENABLED=false
      # 是否在启动时重新安装缺失的包
      - N8N_REINSTALL_MISSING_PACKAGES=true

      - WEBHOOK_URL=https://n8n.chensoul.cc/
      - N8N_HOST=n8n.chensoul.cc
      - N8N_ENCRYPTION_KEY=2cc5b5f9e31b43ff3817c1d04e5fa735
    ports:
      - '5678:5678'
    networks:
      - vps

networks:
  vps:
    external: true

server {
    listen 80;
    listen [::]:80;
    server_name n8n.chensoul.cc;

    return 301 https://$host$request_uri;
}

server {
    listen          443 ssl;
    server_name     n8n.chensoul.cc;

    ssl_certificate      /etc/nginx/ssl/fullchain.cer;
    ssl_certificate_key  /etc/nginx/ssl/chensoul.cc.key;

    ssl_session_cache    shared:SSL:1m;
    ssl_session_timeout  5m;

    ssl_ciphers  HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers  on;

    location / {
      proxy_pass http://127.0.0.1:5678;
      proxy_set_header Host $http_host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;

      proxy_http_version 1.1;
      proxy_set_header Connection 'upgrade';
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Origin 'https://n8n.chensoul.cc';
      access_log /var/log/nginx/n8n.log combined buffer=128k flush=5s;
    }
}

services:
  linkding:
    #image: woohoodai/linkding-cn:latest
    image: sissbruecker/linkding
    container_name: linkding
    restart: unless-stopped
    environment:
      - LD_SUPERUSER_NAME=admin
      - LD_SUPERUSER_PASSWORD=E2KWxxxx
      - LD_DB_ENGINE=postgres
      - LD_DB_DATABASE=linkding
      - LD_DB_HOST=postgres
      - LD_DB_USER=postgres
      - LD_DB_PASSWORD=vps@027!
    ports:
      - "9090:9090"
    networks:
      - vps

networks:
  vps:
    external: true

server {
    listen 80;
    listen [::]:80;
    server_name linkding.chensoul.cc;

    return 301 https://$host$request_uri;
}

server {
    listen          443 ssl;
    server_name     linkding.chensoul.cc;

    ssl_certificate      /etc/nginx/ssl/fullchain.cer;
    ssl_certificate_key  /etc/nginx/ssl/chensoul.cc.key;

    ssl_session_cache    shared:SSL:1m;
    ssl_session_timeout  5m;

    ssl_ciphers  HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers  on;

    location / {
      proxy_pass http://127.0.0.1:9090;
      proxy_set_header Host $http_host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;

      proxy_http_version 1.1;
      proxy_set_header Connection 'upgrade';
      proxy_set_header Upgrade $http_upgrade;

      access_log /var/log/nginx/linkding.log combined buffer=128k flush=5s;
    }
}

services:
  artalk:
    container_name: artalk
    image: artalk/artalk-go
    restart: unless-stopped
    ports:
      - "23366:23366"
    environment:
      - TZ=Asia/Shanghai
      - ATK_LOCALE=zh-CN
      - ATK_SITE_DEFAULT=Chensoul Blog
      - ATK_SITE_URL=https://blog.chensoul.cc
      - ATK_TRUSTED_DOMAINS=https://blog.chensoul.cc http://localhost:1313
      - ATK_DB_TYPE=pgsql
      - ATK_DB_HOST=postgres
      - ATK_DB_PORT=5432
      - ATK_DB_NAME=artalk
      - ATK_DB_USER=postgres
      - ATK_DB_PASSWORD=vps@027!
      - ATK_ADMIN_NOTIFY_BARK_ENABLED=true
      - ATK_ADMIN_NOTIFY_BARK_SERVER=https://bark.chensoul.cc/AXWM5ZKnKa9Lp3rijBsVDm
      - ATK_ADMIN_NOTIFY_TELEGRAM_ENABLED=true
      - ATK_ADMIN_NOTIFY_TELEGRAM_API_TOKEN=8286091453:AAE2pucQXfliz_QGac1zVZEFIrrxVOLe938
      - ATK_ADMIN_NOTIFY_TELEGRAM_RECEIVERS=[-1001632154815]
    networks:
      - vps

networks:
  vps:
    external: true

server {
    listen 80;
    listen [::]:80;
    server_name artalk.chensoul.cc;

    return 301 https://$host$request_uri;
}

server {
    listen          443 ssl;
    server_name     artalk.chensoul.cc;

    ssl_certificate      /etc/nginx/ssl/fullchain.cer;
    ssl_certificate_key  /etc/nginx/ssl/chensoul.cc.key;

    ssl_session_cache    shared:SSL:1m;
    ssl_session_timeout  5m;

    ssl_ciphers  HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers  on;

    location / {
      proxy_pass http://127.0.0.1:23366;

      proxy_set_header Host $http_host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;
    }
}

services:
  wakapi:
    image: ghcr.io/muety/wakapi
    container_name: wakapi
    restart: always
    ports:
      - "3020:3000"
    environment:
      - WAKAPI_PASSWORD_SALT=chensoul
      - WAKAPI_DB_TYPE=postgres
      - WAKAPI_DB_NAME=wakapi
      - WAKAPI_DB_PORT=5432
      - WAKAPI_DB_HOST=postgres
      - WAKAPI_DB_USER=postgres
      - WAKAPI_DB_PASSWORD=vps@027!
    volumes:
      - wakapi_data:/data
    networks:
      - vps

volumes:
  wakapi_data:

networks:
  vps:
    external: true

server {
    listen 80;
    listen [::]:80;
    server_name wakapi.chensoul.cc;

    return 301 https://$host$request_uri;
}

server {
    listen          443 ssl;
    server_name     wakapi.chensoul.cc;

    ssl_certificate      /etc/nginx/ssl/fullchain.cer;
    ssl_certificate_key  /etc/nginx/ssl/chensoul.cc.key;

    ssl_session_cache    shared:SSL:1m;
    ssl_session_timeout  5m;

    ssl_ciphers  HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers  on;

    location / {
      proxy_pass http://127.0.0.1:3020;

      proxy_set_header Host $host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;
      proxy_set_header REMOTE-HOST $remote_addr;
      proxy_buffering off;
    }
}

services:
  uptime:
    image: louislam/uptime-kuma:2
    container_name: uptime
    volumes:
      - ~/.uptime-kuma://app/data
    ports:
      - "3001:3001"
    restart: always
    networks:
      - vps

networks:
  vps:
    external: true

server {
    listen 80;
    listen [::]:80;
    server_name uptime.chensoul.cc;

    return 301 https://$host$request_uri;
}

server {
    listen          443 ssl;
    server_name     uptime.chensoul.cc;

    ssl_certificate      /etc/nginx/ssl/fullchain.cer;
    ssl_certificate_key  /etc/nginx/ssl/chensoul.cc.key;

    ssl_session_cache    shared:SSL:1m;
    ssl_session_timeout  5m;

    ssl_ciphers  HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers  on;

    location / {
        proxy_pass http://127.0.0.1:3001;
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        proxy_http_version 1.1;
        proxy_set_header   Upgrade $http_upgrade;
        proxy_set_header   Connection "upgrade";
    }
}

server {
    listen 80;
    listen [::]:80;
    server_name bark.chensoul.cc;

    return 301 https://$host$request_uri;
}

server {
    listen          443 ssl;
    server_name     bark.chensoul.cc;

    ssl_certificate      /etc/nginx/ssl/fullchain.cer;
    ssl_certificate_key  /etc/nginx/ssl/chensoul.cc.key;

    ssl_session_cache    shared:SSL:1m;
    ssl_session_timeout  5m;

    ssl_ciphers  HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers  on;

    location / {
      proxy_pass http://127.0.0.1:3020;

     proxy_set_header Host $http_host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;
    }
}

#!/bin/bash
set -euo pipefail

CONTAINER_NAME="postgres"
BACKUP_BASE="/data/backup"
BACKUP_DIR="$BACKUP_BASE/postgres"
DATE=$(date +%Y%m%d_%H00)   # 如 20260303_1601
DATABASES=(memos umami linkding artalk wakapi n8n)

mkdir -p "$BACKUP_DIR"

SQL_FILES=()
for DB_NAME in "${DATABASES[@]}"; do
  BACKUP_FILE="${DB_NAME}_${DATE}.sql"
  docker exec "$CONTAINER_NAME" pg_dump -U postgres "$DB_NAME" > "$BACKUP_DIR/$BACKUP_FILE"
  SQL_FILES+=("$BACKUP_FILE")
  echo "DB $DB_NAME backup success: $BACKUP_FILE"
done

# 将本次所有 .sql 打成一个 tar.gz（仍用 gzip 压缩）
ARCHIVE="${CONTAINER_NAME}_${DATE}.tar.gz"
tar -czf "$BACKUP_DIR/$ARCHIVE" -C "$BACKUP_DIR" "${SQL_FILES[@]}"
echo "Archive: $ARCHIVE"

# 已打包后可删本次 .sql，避免占双倍空间；若要在 git 里保留明文 sql 请注释下面两行
for f in "${SQL_FILES[@]}"; do
  rm -f "$BACKUP_DIR/$f"
done

# 删除超过 1 天的 tar.gz（按修改时间）
find "$BACKUP_DIR" -maxdepth 1 -type f -name '${CONTAINER_NAME}_*.tar.gz' -mtime +1 -delete

rclone sync $BACKUP_DIR r2:backup/postgres -P

#!/bin/bash
set -euo pipefail

BACKUP_BASE="/data/backup"
BACKUP_DIR="$BACKUP_BASE/n8n"
WORKFLOWS_DIR="$BACKUP_DIR/workflows"
DATE=$(date +%Y%m%d_%H00)   # 如 20260303_1600

mkdir -p $BACKUP_DIR/workflows

# 导出工作流到容器临时目录，再拷出并按名称重命名
WORKFLOWS_TMP=$(mktemp -d)
trap 'rm -rf "$WORKFLOWS_TMP"' EXIT
docker exec -u node n8n n8n export:workflow --backup --output=./backup_workflows
docker cp n8n:/home/node/backup_workflows/. "$WORKFLOWS_TMP"
for f in "$WORKFLOWS_TMP"/*; do
  [ -f "$f" ] || continue
  name=$(jq -r '.name' "$f" 2>/dev/null)
  echo "$f $name"
  [ -n "$name" ] && [ "$name" != "null" ] && command mv -f "$f" "$BACKUP_DIR/workflows/${name}.json"
done

# 导出凭证到当日目录
docker exec -u node n8n n8n export:credentials --all --output=./credentials.json
docker cp n8n:/home/node/credentials.json "$BACKUP_DIR/credentials.json"

rclone sync $BACKUP_DIR r2:backup/n8n -P

#!/usr/bin/env bash
set -euo pipefail

CONTAINER_NAME="postgres"
BACKUP_DIR="/opt/vps-backup/postgres"
BACKUP_POSTFIX="2026031809"   # 改为实际备份时间
DATABASES=(memos umami linkding artalk)

# 判断数据库是否存在（存在返回 1，不存在返回 0）
db_exists() {
  local db="$1"
  docker exec "$CONTAINER_NAME" psql -U postgres -d postgres -tAc "SELECT 1 FROM pg_database WHERE datname = '$db';" 2>/dev/null | grep -q 1
}

for DB_NAME in "${DATABASES[@]}"; do
  F="${DB_NAME}_${BACKUP_POSTFIX}.sql"
  if [ ! -f "$BACKUP_DIR/$F" ]; then
    echo "跳过（文件不存在）: $F"
    continue
  fi

  docker cp "$BACKUP_DIR/$F" "$CONTAINER_NAME:/tmp/$F"

  if db_exists "$DB_NAME"; then
    docker compose -f /opt/vps-backup/dockerfile/$DB_NAME.yaml down
    # 数据库已存在：禁止新连接、断开已有连接、删库、重建
    docker exec "$CONTAINER_NAME" psql -U postgres -d postgres -c "ALTER DATABASE $DB_NAME CONNECT LIMIT 0;" 2>/dev/null || true
    docker exec "$CONTAINER_NAME" psql -U postgres -d postgres -c "SELECT pg_terminate_backend(pid) FROM pg_stat_activity WHERE datname = '$DB_NAME' AND pid <> pg_backend_pid();" 2>/dev/null || true
    sleep 1
    docker exec "$CONTAINER_NAME" psql -U postgres -d postgres -c "DROP DATABASE IF EXISTS $DB_NAME;"
    docker exec "$CONTAINER_NAME" psql -U postgres -d postgres -c "CREATE DATABASE $DB_NAME OWNER postgres;"
  else
    # 数据库不存在：直接新建
    docker exec "$CONTAINER_NAME" psql -U postgres -d postgres -c "CREATE DATABASE $DB_NAME OWNER postgres;"
  fi

  docker exec "$CONTAINER_NAME" psql -U postgres -d "$DB_NAME" -f "/tmp/$F"
  docker exec "$CONTAINER_NAME" rm -f "/tmp/$F"
  echo "已恢复: $DB_NAME"
done

#!/usr/bin/env bash
# AlmaLinux 9 一键初始化：系统设置 + Nginx + SSL（acme.sh）+ Docker
# 用法：修改变量或环境变量后执行 bash almalinux9-setup.sh（需 root）

set -e

# ---------- 系统设置 ----------
HOSTNAME="${HOSTNAME:-vps}"
MIRROR="${MIRROR:-}"
GIT_USER="${GIT_USER:-chensoul}"
GIT_EMAIL="${GIT_EMAIL:-ichensoul@gmail.com}"
CREATE_USER="${CREATE_USER:-}"
SWAP_GB="${SWAP_GB:-0}"
SSH_KEY_ONLY="${SSH_KEY_ONLY:-no}"
PERMIT_ROOT="${PERMIT_ROOT:-prohibit-password}"
INSTALL_FAIL2BAN="${INSTALL_FAIL2BAN:-no}"
# ---------- Nginx / SSL / Docker ----------
INSTALL_NGINX="${INSTALL_NGINX:-yes}"
INSTALL_SSL="${INSTALL_SSL:-yes}"
INSTALL_DOCKER="${INSTALL_DOCKER:-yes}"
DOMAIN="${DOMAIN:-}"
CF_Token="${CF_Token:-}"
CF_Account_ID="${CF_Account_ID:-}"
CF_Key="${CF_Key:-}"
CF_Email="${CF_Email:-$GIT_EMAIL}"   # 不设则与 GIT_EMAIL 一致

[[ $(id -u) -eq 0 ]] || { echo "请使用 root 运行"; exit 1; }

echo "[1/11] 设置主机名 ..."
[[ -z "$HOSTNAME" ]] || hostnamectl set-hostname "$HOSTNAME"

echo "[2/11] 配置 dnf 源（清理默认并创建精简 repo） ..."
case "$MIRROR" in
  "")       REPO_BASE="https://repo.almalinux.org" ;;
  aliyun)   REPO_BASE="https://mirrors.aliyun.com" ;;
  aws-bos)  REPO_BASE="https://bos.aws.repo.almalinux.org" ;;
  aws-den)  REPO_BASE="https://den.aws.repo.almalinux.org" ;;
  *)        echo "未知 MIRROR: $MIRROR"; exit 1 ;;
esac
mkdir -p /etc/yum.repos.d/bak
mv /etc/yum.repos.d/*.repo /etc/yum.repos.d/bak/ 2>/dev/null || true
cat > /etc/yum.repos.d/almalinux.repo << REPOEOF
[baseos]
name=AlmaLinux 9 - BaseOS
baseurl=$REPO_BASE/almalinux/9/BaseOS/\$basearch/os/
gpgcheck=1
enabled=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-AlmaLinux-9

[appstream]
name=AlmaLinux 9 - AppStream
baseurl=$REPO_BASE/almalinux/9/AppStream/\$basearch/os/
gpgcheck=1
enabled=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-AlmaLinux-9
REPOEOF
dnf clean all && dnf makecache

echo "[3/11] 更新系统并安装常用软件 ..."
dnf update -y
dnf install -y git vim jq chrony

echo "[4/11] 时钟同步与时区 ..."
systemctl enable chronyd && systemctl start chronyd
chronyc -a makestep || true
timedatectl set-timezone Asia/Shanghai

echo "[5/11] Git 全局配置 ..."
git config --global user.name "$GIT_USER"
git config --global user.email "$GIT_EMAIL"

echo "[6/11] 可选：创建 sudo 用户 ..."
if [[ -n "$CREATE_USER" ]]; then
  if ! id "$CREATE_USER" &>/dev/null; then
    useradd -m -s /bin/bash "$CREATE_USER"
    usermod -aG wheel "$CREATE_USER"
    echo "请为 $CREATE_USER 设置密码："
    passwd "$CREATE_USER"
  else
    usermod -aG wheel "$CREATE_USER"
    echo "用户 $CREATE_USER 已存在，已加入 wheel。"
  fi
fi

echo "[7/11] 可选：Swap ..."
if [[ "$SWAP_GB" -gt 0 ]] && [[ ! -f /swapfile ]]; then
  fallocate -l "${SWAP_GB}G" /swapfile
  chmod 600 /swapfile && mkswap /swapfile && swapon /swapfile
  echo '/swapfile swap swap defaults 0 0' >> /etc/fstab
  swapon --show
fi

echo "[8/11] 可选：SSH 加固与 fail2ban ..."
if [[ "$SSH_KEY_ONLY" == "yes" || "$PERMIT_ROOT" != "yes" ]]; then
  cp -a /etc/ssh/sshd_config /etc/ssh/sshd_config.bak
  if [[ "$SSH_KEY_ONLY" == "yes" ]]; then
    sed -i 's/^#*PasswordAuthentication.*/PasswordAuthentication no/; s/^#*PubkeyAuthentication.*/PubkeyAuthentication yes/' /etc/ssh/sshd_config
    grep -q '^PasswordAuthentication ' /etc/ssh/sshd_config || echo 'PasswordAuthentication no' >> /etc/ssh/sshd_config
    grep -q '^PubkeyAuthentication ' /etc/ssh/sshd_config || echo 'PubkeyAuthentication yes' >> /etc/ssh/sshd_config
  fi
  if [[ "$PERMIT_ROOT" != "yes" ]]; then
    sed -i "s/^#*PermitRootLogin.*/PermitRootLogin $PERMIT_ROOT/" /etc/ssh/sshd_config
    grep -q '^PermitRootLogin ' /etc/ssh/sshd_config || echo "PermitRootLogin $PERMIT_ROOT" >> /etc/ssh/sshd_config
  fi
  systemctl restart sshd
fi
if [[ "$INSTALL_FAIL2BAN" == "yes" ]]; then
  dnf install -y epel-release
  dnf install -y fail2ban fail2ban-firewalld
  systemctl enable fail2ban --now
fi

echo "[9/11] Nginx ..."
if [[ "$INSTALL_NGINX" == "yes" ]]; then
  if [[ ! -f /etc/yum.repos.d/nginx.repo ]]; then
    cat > /etc/yum.repos.d/nginx.repo << 'NGINXREPO'
[nginx-stable]
name=nginx stable repo
baseurl=https://nginx.org/packages/rhel/9/$basearch/
gpgcheck=1
enabled=1
gpgkey=https://nginx.org/keys/nginx_signing.key
module_hotfixes=true
NGINXREPO
  fi
  dnf remove -y nginx-core nginx-filesystem nginx-mod-* 2>/dev/null || true
  dnf install -y nginx
  systemctl enable nginx && systemctl start nginx
  dnf install -y firewalld 2>/dev/null || true
  firewall-cmd --zone=public --permanent --add-service=http 2>/dev/null || true
  firewall-cmd --zone=public --permanent --add-service=https 2>/dev/null || true
  firewall-cmd --reload 2>/dev/null || true
  setsebool -P httpd_can_network_connect on 2>/dev/null || true
  echo "Nginx 安装完成。"
fi

echo "[10/11] SSL（acme.sh）..."
if [[ "$INSTALL_SSL" == "yes" ]]; then
  mkdir -p /etc/nginx/ssl
  if [[ ! -x /root/.acme.sh/acme.sh ]]; then
    curl -sSL https://get.acme.sh | sh -s "email=$GIT_EMAIL"
  fi
  export CF_Token CF_Account_ID CF_Key CF_Email
  if [[ -n "$DOMAIN" ]] && { [[ -n "$CF_Token" ]] || [[ -n "$CF_Key" ]]; }; then
    echo "申请证书：$DOMAIN 与 *.$DOMAIN ..."
    /root/.acme.sh/acme.sh --issue --server letsencrypt --dns dns_cf -d "$DOMAIN" -d "*.$DOMAIN" --ecc
    cp /root/.acme.sh/"${DOMAIN}"_ecc/{"$DOMAIN".cer,"$DOMAIN".key,fullchain.cer,ca.cer} /etc/nginx/ssl/
    /root/.acme.sh/acme.sh --installcert -d "$DOMAIN" -d "*.$DOMAIN" --ecc \
      --cert-file /etc/nginx/ssl/"$DOMAIN".cer \
      --key-file /etc/nginx/ssl/"$DOMAIN".key \
      --fullchain-file /etc/nginx/ssl/fullchain.cer \
      --ca-file /etc/nginx/ssl/ca.cer \
      --reloadcmd "nginx -s reload"
    echo "证书已安装并配置自动续期。"
  else
    echo "未设置 DOMAIN 或 CloudFlare 凭证，仅完成 acme.sh 与 /etc/nginx/ssl。"
  fi
fi

echo "[11/11] Docker ..."
if [[ "$INSTALL_DOCKER" == "yes" ]]; then
  if ! command -v docker &>/dev/null; then
    curl -fsSL https://get.docker.com | sh
  fi
  systemctl enable docker && systemctl start docker
  iptables -P FORWARD ACCEPT 2>/dev/null || true
  docker network create vps 2>/dev/null || true
  echo "Docker 安装完成，已创建网络 vps（若不存在）。"
fi

echo "全部完成。"