From d26b4ee64c5ec12e8af4d2cbd06ff14c66ef1007 Mon Sep 17 00:00:00 2001 From: zizi Date: Wed, 27 May 2026 15:14:08 +0800 Subject: [PATCH] docs(ops): record custom menu r2 deployment --- .../2026-05-27-自定义菜单安全嵌入部署.md | 12 +++++++++++- ops/remote/us-racknerd-0526-sub2api/README.md | 19 ++++++++++++++++++- 2 files changed, 29 insertions(+), 2 deletions(-) diff --git a/docs/memorys/2026-05-27-自定义菜单安全嵌入部署.md b/docs/memorys/2026-05-27-自定义菜单安全嵌入部署.md index 0bcfd812..069950c1 100644 --- a/docs/memorys/2026-05-27-自定义菜单安全嵌入部署.md +++ b/docs/memorys/2026-05-27-自定义菜单安全嵌入部署.md @@ -27,12 +27,19 @@ - 服务器：`个人-US-racknerd-0526-3c4g` - IP：`216.45.59.243` - 部署目录：`/opt/sub2api` -- 镜像：`sub2api:custom-menu-safe-embed-20260527` +- 当前镜像：`sub2api:custom-menu-safe-embed-20260527-r2` +- 当前镜像 ID：`sha256:ceeea1a913ea8386f24b4296b856295c18febd0b19eeb1e92de4ef9512e3f3a2` +- 当前提交：`7954492cee99` +- 当前版本：`0.1.131` +- 上一版镜像：`sub2api:custom-menu-safe-embed-20260527` - 镜像 ID：`sha256:356653e0e5a7b688faacb728a0f94d450e102393fd73bb16c705000f359133de` - 部署方式：本地构建 linux/amd64 Go 二进制并嵌入前端，上传 runtime patch tar 到远程，在远程基于 `weishaw/sub2api:latest` 替换二进制和资源后 `docker commit` 生成本地镜像。 - runtime patch：`/tmp/sub2api-custom-menu-runtime-patch-20260527.tar.gz` - runtime patch SHA256：`321b69bcf40470be9f2de10f8f1114ebd6bd7e6e014783b123c7160781ac127d` +- r2 runtime patch：`/tmp/sub2api-custom-menu-safe-embed-r2-runtime-patch.tar.gz` +- r2 runtime patch SHA256：`962de880c5e0917e3c6b351fd1955c3d94c8f7b6fcfae558492535c08faac0d0` - 部署前备份：`/opt/sub2api/backups/deploy-custom-menu-20260526-222849` +- r2 部署前备份：`/opt/sub2api/backups/deploy-custom-menu-r2-20260527-000642` - 菜单配置备份：`/opt/sub2api/backups/custom-menu-shop-20260526-224153` ## 线上菜单配置 @@ -63,6 +70,9 @@ - `https://proxy.api.lilifamily.com/custom/shop` 返回 `200`，响应头含 `X-Proxy-Ng-Node: jppro-akile-0504-1c1g`。 - `/custom/shop` 的 CSP `frame-src` 已包含 `https://pay.ldxp.cn`。 - `omit_auth_context=true` 时 iframe URL 不应包含 `token`、`user_id`、`src_host`、`src_url`。 +- r2 远程二进制核对：`Sub2API 0.1.131 (commit: 7954492cee99, built: 2026-05-27T07:02:24Z)`。 +- r2 公网 settings 核对：`proxy.api.lilifamily.com/api/v1/settings/public` 返回 `version=0.1.131`、`购买套餐`、`omit_auth_context=true`。 +- r2 UI 变更：侧边栏左上角不再渲染版本号。 ## 回滚 diff --git a/ops/remote/us-racknerd-0526-sub2api/README.md b/ops/remote/us-racknerd-0526-sub2api/README.md index 5f47412c..d67aef30 100644 --- a/ops/remote/us-racknerd-0526-sub2api/README.md +++ b/ops/remote/us-racknerd-0526-sub2api/README.md @@ -80,7 +80,7 @@ Sub2API - token 配置：`/etc/nginx/proxy-ng/token.conf`，权限 `600 root root` - token map 配置：`/etc/nginx/conf.d/proxy-ng-token-map.conf`，本地副本已脱敏 - 远程 `.env`：`PUBLIC_DOMAIN=proxy.api.lilifamily.com` -- 远程 `.env`：`SUB2API_IMAGE=sub2api:custom-menu-safe-embed-20260527` +- 远程 `.env`：`SUB2API_IMAGE=sub2api:custom-menu-safe-embed-20260527-r2` - URL allowlist 当前关闭：`SECURITY_URL_ALLOWLIST_ENABLED=false` ## DNS state after proxy-ng hardening @@ -198,3 +198,20 @@ curl --noproxy '*' -i https://catproxy.lilifamily.com/health - 写入数据库后已重启 `sub2api` 容器刷新 CSP frame-src 缓存。 - 验证结果：`sub2api` healthy；`catproxy.lilifamily.com/health` 和 `proxy.api.lilifamily.com/health` 返回 `200`；`catproxy.lilifamily.com/custom/shop` 和 `proxy.api.lilifamily.com/custom/shop` 返回 `200`；CSP `frame-src` 已包含 `https://pay.ldxp.cn`。 + +### 2026-05-27 自定义菜单安全嵌入 r2 发布 + +- 目标：发布提交 `7954492cee99`，包含侧边栏隐藏版本号和最终 custom menu 安全契约修正。 +- 本地版本：`0.1.131` +- 本地 commit：`7954492cee99` +- 本地构建：`pnpm -C frontend build` 后执行 `CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -tags embed`。 +- runtime patch：`/tmp/sub2api-custom-menu-safe-embed-r2-runtime-patch.tar.gz` +- runtime patch SHA256：`962de880c5e0917e3c6b351fd1955c3d94c8f7b6fcfae558492535c08faac0d0` +- 部署前备份：`/opt/sub2api/backups/deploy-custom-menu-r2-20260527-000642` +- 当前镜像：`sub2api:custom-menu-safe-embed-20260527-r2` +- 镜像 ID：`sha256:ceeea1a913ea8386f24b4296b856295c18febd0b19eeb1e92de4ef9512e3f3a2` +- 远程二进制核对：`Sub2API 0.1.131 (commit: 7954492cee99, built: 2026-05-27T07:02:24Z)`。 +- 远程健康核对：`docker inspect sub2api` 显示镜像 `sub2api:custom-menu-safe-embed-20260527-r2` 且 `healthy`。 +- 公网验证：`catproxy.lilifamily.com/health` 和 `proxy.api.lilifamily.com/health` 返回 `{"status":"ok"}`。 +- 菜单验证：`proxy.api.lilifamily.com/api/v1/settings/public` 返回版本 `0.1.131`，`custom_menu_items[0].label=购买套餐`，`omit_auth_context=true`。 +- iframe CSP 验证：`catproxy.lilifamily.com/custom/shop` 与 `proxy.api.lilifamily.com/custom/shop` 返回 `200`，CSP `frame-src` 包含 `https://pay.ldxp.cn`。