zizi-al/sub2api
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(ops): record custom menu r2 deployment

Browse Source
This commit is contained in:
zizi 2026-05-27 15:14:08 +08:00
parent 7954492cee
commit d26b4ee64c
2 changed files with 29 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
docs/memorys/2026-05-27-自定义菜单安全嵌入部署.md
View File

@ -27,12 +27,19 @@
- 服务器：`个人-US-racknerd-0526-3c4g`
- IP：`216.45.59.243`
- 部署目录：`/opt/sub2api`
- 镜像：`sub2api:custom-menu-safe-embed-20260527`
- 当前镜像：`sub2api:custom-menu-safe-embed-20260527-r2`
- 当前镜像 ID：`sha256:ceeea1a913ea8386f24b4296b856295c18febd0b19eeb1e92de4ef9512e3f3a2`
- 当前提交：`7954492cee99`
- 当前版本：`0.1.131`
- 上一版镜像：`sub2api:custom-menu-safe-embed-20260527`
- 镜像 ID：`sha256:356653e0e5a7b688faacb728a0f94d450e102393fd73bb16c705000f359133de`
- 部署方式：本地构建 linux/amd64 Go 二进制并嵌入前端，上传 runtime patch tar 到远程，在远程基于 `weishaw/sub2api:latest` 替换二进制和资源后 `docker commit` 生成本地镜像。
- runtime patch：`/tmp/sub2api-custom-menu-runtime-patch-20260527.tar.gz`
- runtime patch SHA256：`321b69bcf40470be9f2de10f8f1114ebd6bd7e6e014783b123c7160781ac127d`
- r2 runtime patch：`/tmp/sub2api-custom-menu-safe-embed-r2-runtime-patch.tar.gz`
- r2 runtime patch SHA256：`962de880c5e0917e3c6b351fd1955c3d94c8f7b6fcfae558492535c08faac0d0`
- 部署前备份：`/opt/sub2api/backups/deploy-custom-menu-20260526-222849`
- r2 部署前备份：`/opt/sub2api/backups/deploy-custom-menu-r2-20260527-000642`
- 菜单配置备份：`/opt/sub2api/backups/custom-menu-shop-20260526-224153`
## 线上菜单配置
@ -63,6 +70,9 @@
- `https://proxy.api.lilifamily.com/custom/shop` 返回 `200`，响应头含 `X-Proxy-Ng-Node: jppro-akile-0504-1c1g`。
- `/custom/shop` 的 CSP `frame-src` 已包含 `https://pay.ldxp.cn`。
- `omit_auth_context=true` 时 iframe URL 不应包含 `token`、`user_id`、`src_host`、`src_url`。
- r2 远程二进制核对：`Sub2API 0.1.131 (commit: 7954492cee99, built: 2026-05-27T07:02:24Z)`。
- r2 公网 settings 核对：`proxy.api.lilifamily.com/api/v1/settings/public` 返回 `version=0.1.131`、`购买套餐`、`omit_auth_context=true`。
- r2 UI 变更：侧边栏左上角不再渲染版本号。
## 回滚

19
ops/remote/us-racknerd-0526-sub2api/README.md
View File

@ -80,7 +80,7 @@ Sub2API
- token 配置：`/etc/nginx/proxy-ng/token.conf`，权限 `600 root root`
- token map 配置：`/etc/nginx/conf.d/proxy-ng-token-map.conf`，本地副本已脱敏
- 远程 `.env`：`PUBLIC_DOMAIN=proxy.api.lilifamily.com`
- 远程 `.env`：`SUB2API_IMAGE=sub2api:custom-menu-safe-embed-20260527`
- 远程 `.env`：`SUB2API_IMAGE=sub2api:custom-menu-safe-embed-20260527-r2`
- URL allowlist 当前关闭：`SECURITY_URL_ALLOWLIST_ENABLED=false`
## DNS state after proxy-ng hardening
@ -198,3 +198,20 @@ curl --noproxy '*' -i https://catproxy.lilifamily.com/health
- 写入数据库后已重启 `sub2api` 容器刷新 CSP frame-src 缓存。
- 验证结果：`sub2api` healthy；`catproxy.lilifamily.com/health` 和 `proxy.api.lilifamily.com/health` 返回 `200`；`catproxy.lilifamily.com/custom/shop` 和 `proxy.api.lilifamily.com/custom/shop` 返回 `200`；CSP `frame-src` 已包含 `https://pay.ldxp.cn`。
### 2026-05-27 自定义菜单安全嵌入 r2 发布
- 目标：发布提交 `7954492cee99`，包含侧边栏隐藏版本号和最终 custom menu 安全契约修正。
- 本地版本：`0.1.131`
- 本地 commit：`7954492cee99`
- 本地构建：`pnpm -C frontend build` 后执行 `CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -tags embed`。
- runtime patch：`/tmp/sub2api-custom-menu-safe-embed-r2-runtime-patch.tar.gz`
- runtime patch SHA256：`962de880c5e0917e3c6b351fd1955c3d94c8f7b6fcfae558492535c08faac0d0`
- 部署前备份：`/opt/sub2api/backups/deploy-custom-menu-r2-20260527-000642`
- 当前镜像：`sub2api:custom-menu-safe-embed-20260527-r2`
- 镜像 ID：`sha256:ceeea1a913ea8386f24b4296b856295c18febd0b19eeb1e92de4ef9512e3f3a2`
- 远程二进制核对：`Sub2API 0.1.131 (commit: 7954492cee99, built: 2026-05-27T07:02:24Z)`。
- 远程健康核对：`docker inspect sub2api` 显示镜像 `sub2api:custom-menu-safe-embed-20260527-r2` 且 `healthy`。
- 公网验证：`catproxy.lilifamily.com/health` 和 `proxy.api.lilifamily.com/health` 返回 `{"status":"ok"}`。
- 菜单验证：`proxy.api.lilifamily.com/api/v1/settings/public` 返回版本 `0.1.131`，`custom_menu_items[0].label=购买套餐`，`omit_auth_context=true`。
- iframe CSP 验证：`catproxy.lilifamily.com/custom/shop` 与 `proxy.api.lilifamily.com/custom/shop` 返回 `200`，CSP `frame-src` 包含 `https://pay.ldxp.cn`。