这是测试新闻的正文内容
包含多个段落
', + category: '公司新闻', + tags: ['测试', '自动化'], + status: 'published', + }, + { + type: 'product', + title: `测试产品-${Date.now()}`, + slug: `test-product-${Date.now()}`, + excerpt: '这是一个测试产品的描述', + content: '测试产品的详细介绍
', + category: '软件产品', + tags: ['产品', '测试'], + status: 'published', + }, + { + type: 'service', + title: `测试服务-${Date.now()}`, + slug: `test-service-${Date.now()}`, + excerpt: '这是一个测试服务的描述', + content: '测试服务的详细介绍
', + category: '软件开发', + tags: ['服务', '测试'], + status: 'published', + }, + { + type: 'case', + title: `测试案例-${Date.now()}`, + slug: `test-case-${Date.now()}`, + excerpt: '这是一个测试案例的描述', + content: '测试案例的详细介绍
', + category: '企业服务', + tags: ['案例', '测试'], + status: 'published', + }, +]; + +async function loginAsAdmin(page: Page) { + await page.goto(`${BASE_URL}/admin/login`); + await page.waitForLoadState('networkidle'); + + const emailInput = page.locator('input[name="email"], input[type="email"]'); + const passwordInput = page.locator('input[name="password"], input[type="password"]'); + const submitButton = page.locator('button[type="submit"]'); + + await emailInput.fill(ADMIN_EMAIL); + await passwordInput.fill(ADMIN_PASSWORD); + await submitButton.click(); + + await page.waitForURL(/\/admin(?!\/login)/, { timeout: 10000 }); + await page.waitForLoadState('networkidle'); +} + +async function createContent(page: Page, contentData: ContentData): Promise草稿内容
', + category: '公司新闻', + tags: ['草稿'], + status: 'draft', + }; + + const contentId = await createContent(page, draftContent); + expect(contentId).not.toBeNull(); + + await page.goto(`${BASE_URL}/admin/content`); + await page.waitForLoadState('networkidle'); + + const contentRow = page.locator(`tr:has-text("${draftContent.title}")`); + await expect(contentRow).toBeVisible(); + + const statusBadge = contentRow.locator('td:has-text("草稿")'); + await expect(statusBadge).toBeVisible(); + + await page.goto(`${BASE_URL}/news`); + await page.waitForLoadState('networkidle'); + + const newsCard = page.locator(`text="${draftContent.title}"`); + await expect(newsCard).not.toBeVisible(); + + if (contentId) { + await deleteContent(page, contentId); + } + }); + + test('TC-006: 编辑已发布的内容', async ({ page }) => { + const contentData = testContents[0]; + const contentId = await createContent(page, contentData); + + expect(contentId).not.toBeNull(); + + await page.goto(`${BASE_URL}/admin/content/${contentId}`); + await page.waitForLoadState('domcontentloaded'); + await page.waitForSelector('input[type="text"]', { state: 'visible', timeout: 10000 }); + + const updatedTitle = `${contentData.title}-已修改`; + const titleInput = page.locator('input[type="text"]').first(); + await titleInput.fill(updatedTitle); + + const saveButton = page.locator('button:has-text("保存草稿")'); + await saveButton.click(); + + await page.waitForResponse(resp => + resp.url().includes(`/api/admin/content/${contentId}`) && + resp.request().method() === 'PUT', + { timeout: 15000 } + ); + + await page.goto(`${BASE_URL}/news`); + await page.waitForLoadState('networkidle'); + + const updatedCard = page.locator(`text="${updatedTitle}"`); + await expect(updatedCard).toBeVisible(); + + if (contentId) { + await deleteContent(page, contentId); + } + }); + + test('TC-007: 删除内容', async ({ page }) => { + const contentData = testContents[0]; + const contentId = await createContent(page, contentData); + + expect(contentId).not.toBeNull(); + + await deleteContent(page, contentId!); + + await page.goto(`${BASE_URL}/admin/content`); + await page.waitForLoadState('networkidle'); + + const contentRow = page.locator(`tr:has-text("${contentData.title}")`); + await expect(contentRow).not.toBeVisible(); + + await page.goto(`${BASE_URL}/news`); + await page.waitForLoadState('networkidle'); + + const newsCard = page.locator(`text="${contentData.title}"`); + await expect(newsCard).not.toBeVisible(); + }); + + test('TC-008: 归档内容', async ({ page }) => { + const contentData = testContents[0]; + const contentId = await createContent(page, contentData); + + expect(contentId).not.toBeNull(); + + await page.goto(`${BASE_URL}/admin/content/${contentId}`); + await page.waitForLoadState('domcontentloaded'); + await page.waitForSelector('select', { state: 'visible', timeout: 10000 }); + + const statusSelect = page.locator('select').nth(1); + await statusSelect.selectOption('archived'); + + const saveButton = page.locator('button:has-text("保存草稿")'); + await saveButton.click(); + + await page.waitForResponse(resp => + resp.url().includes(`/api/admin/content/${contentId}`) && + resp.request().method() === 'PUT', + { timeout: 15000 } + ); + + await page.goto(`${BASE_URL}/admin/content`); + await page.waitForLoadState('networkidle'); + + const contentRow = page.locator(`tr:has-text("${contentData.title}")`); + await expect(contentRow).toBeVisible(); + + const statusBadge = contentRow.locator('td:has-text("已归档")'); + await expect(statusBadge).toBeVisible(); + + await page.goto(`${BASE_URL}/news`); + await page.waitForLoadState('networkidle'); + + const newsCard = page.locator(`text="${contentData.title}"`); + await expect(newsCard).not.toBeVisible(); + + if (contentId) { + await deleteContent(page, contentId); + } + }); + + test('TC-015: 空内容提交验证', async ({ page }) => { + await page.goto(`${BASE_URL}/admin/content/new`); + await page.waitForLoadState('networkidle'); + await page.waitForTimeout(2000); + + const publishButton = page.locator('button:has-text("发布")'); + await publishButton.click(); + + await page.waitForTimeout(1000); + + const errorMessage = page.locator('text=/请输入标题|标题不能为空|请输入|必填/'); + await expect(errorMessage.first()).toBeVisible(); + }); + + test('TC-018: 未登录用户访问后台', async ({ context }) => { + const newPage = await context.newPage(); + + await newPage.goto(`${BASE_URL}/admin/content`); + await newPage.waitForLoadState('networkidle'); + + expect(newPage.url()).toContain('/admin/login'); + + await newPage.close(); + }); +}); + +test.describe('前端内容展示验证', () => { + test('新闻页面加载正常', async ({ page }) => { + await page.goto(`${BASE_URL}/news`); + await page.waitForLoadState('networkidle'); + + await expect(page.locator('h1, .page-header')).toContainText('新闻'); + + const newsCards = page.locator('article, .card, [class*="news-item"]'); + const count = await newsCards.count(); + expect(count).toBeGreaterThan(0); + }); + + test('产品页面加载正常', async ({ page }) => { + await page.goto(`${BASE_URL}/products`); + await page.waitForLoadState('networkidle'); + + await expect(page.locator('h1, .page-header')).toContainText('产品'); + + const productCards = page.locator('article, .card, [class*="product"]'); + const count = await productCards.count(); + expect(count).toBeGreaterThan(0); + }); + + test('服务页面加载正常', async ({ page }) => { + await page.goto(`${BASE_URL}/services`); + await page.waitForLoadState('networkidle'); + + await expect(page.locator('h1, .page-header')).toContainText('服务'); + }); + + test('案例页面加载正常', async ({ page }) => { + await page.goto(`${BASE_URL}/cases`); + await page.waitForLoadState('networkidle'); + + await expect(page.locator('h1, .page-header')).toContainText('案例'); + }); +}); + +test.describe('性能测试', () => { + test('TC-025: 后台列表加载性能', async ({ page }) => { + await loginAsAdmin(page); + + const startTime = Date.now(); + await page.goto(`${BASE_URL}/admin/content`); + await page.waitForLoadState('networkidle'); + const loadTime = Date.now() - startTime; + + console.log(`后台列表加载时间: ${loadTime}ms`); + expect(loadTime).toBeLessThan(3000); + }); + + test('前端新闻页面加载性能', async ({ page }) => { + const startTime = Date.now(); + await page.goto(`${BASE_URL}/news`); + await page.waitForLoadState('networkidle'); + const loadTime = Date.now() - startTime; + + console.log(`前端新闻页面加载时间: ${loadTime}ms`); + expect(loadTime).toBeLessThan(3000); + }); +}); + +test.describe('安全测试', () => { + test('TC-031: XSS攻击防护', async ({ page }) => { + await loginAsAdmin(page); + + const xssContent: ContentData = { + type: 'news', + title: `XSS测试-${Date.now()}`, + slug: `xss-test-${Date.now()}`, + excerpt: '测试摘要', + content: '测试内容
', + category: '公司新闻', + tags: ['安全测试'], + status: 'published', + }; + + const contentId = await createContent(page, xssContent); + + expect(contentId).not.toBeNull(); + + await page.goto(`${BASE_URL}/news`); + await page.waitForLoadState('networkidle'); + + const xssTriggered = await page.evaluate(() => { + return (window as any).xssTriggered === true; + }); + + expect(xssTriggered).toBe(false); + + if (contentId) { + await deleteContent(page, contentId); + } + }); + + test('TC-033: API权限验证', async ({ request }) => { + const response = await request.post(`${BASE_URL}/api/admin/content`, { + data: { + type: 'news', + title: '未授权测试', + slug: 'unauthorized-test', + content: '测试内容', + }, + }); + + expect(response.status()).toBe(403); + }); +}); + +test.describe('跨浏览器兼容性测试', () => { + test('响应式设计 - 移动端', async ({ page }) => { + await page.setViewportSize({ width: 375, height: 667 }); + + await page.goto(`${BASE_URL}/news`); + await page.waitForLoadState('networkidle'); + + await expect(page.locator('header')).toBeVisible(); + await expect(page.locator('footer')).toBeVisible(); + }); + + test('响应式设计 - 平板端', async ({ page }) => { + await page.setViewportSize({ width: 768, height: 1024 }); + + await page.goto(`${BASE_URL}/news`); + await page.waitForLoadState('networkidle'); + + await expect(page.locator('header')).toBeVisible(); + await expect(page.locator('footer')).toBeVisible(); + }); +}); diff --git a/forgejo-14.0.3-amd64.tar.gz b/forgejo-14.0.3-amd64.tar.gz new file mode 100644 index 0000000..ab0c7d2 Binary files /dev/null and b/forgejo-14.0.3-amd64.tar.gz differ diff --git a/forgejo-app.ini b/forgejo-app.ini new file mode 100644 index 0000000..97c1470 --- /dev/null +++ b/forgejo-app.ini @@ -0,0 +1,68 @@ +APP_NAME = Gitea: Git with a cup of tea +RUN_MODE = prod +WORK_PATH = /data/gitea + +[repository] +ROOT = /data/git/repositories + +[repository.local] +LOCAL_COPY_PATH = /data/gitea/tmp/local-repo + +[repository.upload] +TEMP_PATH = /data/gitea/uploads + +[server] +APP_DATA_PATH = /data/gitea +DOMAIN = localhost +SSH_DOMAIN = git.f.novalon.cn +HTTP_PORT = 3000 +ROOT_URL = https://git.f.novalon.cn +DISABLE_SSH = false +SSH_PORT = 22 +SSH_LISTEN_PORT = 22 +LFS_START_SERVER = true +LFS_JWT_SECRET = zaXtgFY-twRUX-ygYDPOkIcPg9SYYDOCZ6gDJEjMJFQ + +[database] +PATH = /data/gitea/gitea.db +DB_TYPE = postgres +HOST = postgresql:5432 +NAME = forgejo +USER = forgejo +PASSWD = forgejo_novalon_prod_f50f952069d79d00 +LOG_SQL = false + +[indexer] +ISSUE_INDEXER_PATH = /data/gitea/indexers/issues.bleve + +[session] +PROVIDER_CONFIG = /data/gitea/sessions + +[picture] +AVATAR_UPLOAD_PATH = /data/gitea/avatars +REPOSITORY_AVATAR_UPLOAD_PATH = /data/gitea/repo-avatars + +[attachment] +PATH = /data/gitea/attachments + +[log] +MODE = console +LEVEL = info +ROOT_PATH = /data/gitea/log + +[security] +INSTALL_LOCK = true +SECRET_KEY = +REVERSE_PROXY_LIMIT = 1 +REVERSE_PROXY_TRUSTED_PROXIES = * +INTERNAL_TOKEN = eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJuYmYiOjE3NzQ1OTYzNjl9.6ts7iCdm7v26GwKlLug170fuECEQ7Dymnw7pMTxaOTY + +[service] +DISABLE_REGISTRATION = true +REQUIRE_SIGNIN_VIEW = false + +[lfs] +PATH = /data/git/lfs + +[oauth2] +JWT_SECRET = 955VyK_E5nJvYcNqNLutqm1A4h3E-BfRQiwk3oNS3oo diff --git a/nginx-docker-compose.yml b/nginx-docker-compose.yml new file mode 100644 index 0000000..1347895 --- /dev/null +++ b/nginx-docker-compose.yml @@ -0,0 +1,22 @@ +version: "3.8" + +services: + nginx: + image: nginx:alpine + container_name: novalon-nginx + restart: unless-stopped + ports: + - "80:80" + - "443:443" + volumes: + - ./nginx.conf:/etc/nginx/nginx.conf:ro + - ./ssl:/etc/nginx/ssl:ro + - ./logs:/var/log/nginx + - ../certbot:/var/www/certbot + networks: + - novalon-network + +networks: + novalon-network: + driver: bridge + external: true diff --git a/nginx-individual.conf b/nginx-individual.conf new file mode 100644 index 0000000..1fdbdac --- /dev/null +++ b/nginx-individual.conf @@ -0,0 +1,270 @@ +user nginx; +worker_processes auto; +error_log /var/log/nginx/error.log warn; +pid /var/run/nginx.pid; + +events { + worker_connections 1024; +} + +http { + include /etc/nginx/mime.types; + default_type application/octet-stream; + + log_format main '$remote_addr - $remote_user [$time_local] "$request" ' + '$status $body_bytes_sent "$http_referer" ' + '"$http_user_agent" "$http_x_forwarded_for"'; + + access_log /var/log/nginx/access.log main; + + sendfile on; + tcp_nopush on; + tcp_nodelay on; + keepalive_timeout 65; + types_hash_max_size 2048; + client_max_body_size 100M; + + gzip on; + gzip_disable "msie6"; + gzip_vary on; + gzip_proxied any; + gzip_comp_level 6; + gzip_buffers 16 8k; + gzip_http_version 1.1; + gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+text text/javascript; + + upstream novalon_app { + server novalon-website:3000; + } + + upstream forgejo_app { + server forgejo:3000; + } + + upstream woodpecker_app { + server woodpecker-server:8000; + } + + upstream registry_app { + server registry:5000; + } + + # ========== novalon.cn 主域名 ========== + server { + listen 80; + server_name novalon.cn www.novalon.cn; + + location /.well-known/acme-challenge/ { + root /var/www/certbot; + } + + location / { + return 301 https://$host$request_uri; + } + } + + server { + listen 443 ssl http2; + server_name novalon.cn www.novalon.cn; + + ssl_certificate /etc/nginx/ssl/fullchain.pem; + ssl_certificate_key /etc/nginx/ssl/privkey.pem; + ssl_protocols TLSv1.2 TLSv1.3; + ssl_ciphers HIGH:!aNULL:!MD5; + ssl_prefer_server_ciphers on; + + ssl_session_cache shared:SSL:10m; + ssl_session_timeout 10m; + + add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; + add_header X-Frame-Options "SAMEORIGIN" always; + add_header X-Content-Type-Options "nosniff" always; + add_header X-XSS-Protection "1; mode=block" always; + + location / { + proxy_pass http://novalon_app; + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection 'upgrade'; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_cache_bypass $http_upgrade; + + proxy_connect_timeout 60s; + proxy_send_timeout 60s; + proxy_read_timeout 60s; + } + + location /_next/static { + proxy_pass http://novalon_app; + proxy_cache_valid 200 60m; + add_header Cache-Control "public, immutable, max-age=31536000, s-maxage=31536000"; + } + + location /static { + proxy_pass http://novalon_app; + proxy_cache_valid 200 60m; + add_header Cache-Control "public, immutable, max-age=31536000, s-maxage=31536000"; + } + } + + # ========== git.f.novalon.cn (Forgejo) - 使用单独证书 ========== + server { + listen 80; + server_name git.f.novalon.cn; + + location /.well-known/acme-challenge/ { + root /var/www/certbot; + } + + location / { + return 301 https://$host$request_uri; + } + } + + server { + listen 443 ssl http2; + server_name git.f.novalon.cn; + + ssl_certificate /etc/nginx/ssl/git.f.novalon.cn/fullchain.pem; + ssl_certificate_key /etc/nginx/ssl/git.f.novalon.cn/privkey.pem; + ssl_protocols TLSv1.2 TLSv1.3; + ssl_ciphers HIGH:!aNULL:!MD5; + ssl_prefer_server_ciphers on; + + ssl_session_cache shared:SSL:10m; + ssl_session_timeout 10m; + + add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; + add_header X-Frame-Options "SAMEORIGIN" always; + add_header X-Content-Type-Options "nosniff" always; + add_header X-XSS-Protection "1; mode=block" always; + + location / { + proxy_pass http://forgejo_app; + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection 'upgrade'; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_cache_bypass $http_upgrade; + + proxy_connect_timeout 60s; + proxy_send_timeout 60s; + proxy_read_timeout 60s; + } + } + + # ========== ci.f.novalon.cn (Woodpecker CI) - 使用单独证书 ========== + server { + listen 80; + server_name ci.f.novalon.cn; + + location /.well-known/acme-challenge/ { + root /var/www/certbot; + } + + location / { + return 301 https://$host$request_uri; + } + } + + server { + listen 443 ssl http2; + server_name ci.f.novalon.cn; + + ssl_certificate /etc/nginx/ssl/ci.f.novalon.cn/fullchain.pem; + ssl_certificate_key /etc/nginx/ssl/ci.f.novalon.cn/privkey.pem; + ssl_protocols TLSv1.2 TLSv1.3; + ssl_ciphers HIGH:!aNULL:!MD5; + ssl_prefer_server_ciphers on; + + ssl_session_cache shared:SSL:10m; + ssl_session_timeout 10m; + + add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; + add_header X-Frame-Options "SAMEORIGIN" always; + add_header X-Content-Type-Options "nosniff" always; + add_header X-XSS-Protection "1; mode=block" always; + + location / { + proxy_pass http://woodpecker_app; + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection 'upgrade'; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_cache_bypass $http_upgrade; + + proxy_connect_timeout 60s; + proxy_send_timeout 60s; + proxy_read_timeout 60s; + } + } + + # ========== registry.f.novalon.cn (Docker Registry) - 使用单独证书 ========== + server { + listen 80; + server_name registry.f.novalon.cn; + + location /.well-known/acme-challenge/ { + root /var/www/certbot; + } + + location / { + return 301 https://$host$request_uri; + } + } + + server { + listen 443 ssl http2; + server_name registry.f.novalon.cn; + + ssl_certificate /etc/nginx/ssl/registry.f.novalon.cn/fullchain.pem; + ssl_certificate_key /etc/nginx/ssl/registry.f.novalon.cn/privkey.pem; + ssl_protocols TLSv1.2 TLSv1.3; + ssl_ciphers HIGH:!aNULL:!MD5; + ssl_prefer_server_ciphers on; + + ssl_session_cache shared:SSL:10m; + ssl_session_timeout 10m; + + add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; + add_header X-Frame-Options "SAMEORIGIN" always; + add_header X-Content-Type-Options "nosniff" always; + add_header X-XSS-Protection "1; mode=block" always; + + location / { + proxy_pass http://registry_app; + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection 'upgrade'; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_cache_bypass $http_upgrade; + + proxy_connect_timeout 60s; + proxy_send_timeout 300s; + proxy_read_timeout 300s; + + proxy_buffering off; + proxy_request_buffering off; + } + + location /v2/ { + proxy_pass http://registry_app/v2/; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + } + } +} diff --git a/nginx-temp-for-cert.conf b/nginx-temp-for-cert.conf new file mode 100644 index 0000000..21d8428 --- /dev/null +++ b/nginx-temp-for-cert.conf @@ -0,0 +1,216 @@ +user nginx; +worker_processes auto; +error_log /var/log/nginx/error.log warn; +pid /var/run/nginx.pid; + +events { + worker_connections 1024; +} + +http { + include /etc/nginx/mime.types; + default_type application/octet-stream; + + log_format main '$remote_addr - $remote_user [$time_local] "$request" ' + '$status $body_bytes_sent "$http_referer" ' + '"$http_user_agent" "$http_x_forwarded_for"'; + + access_log /var/log/nginx/access.log main; + + sendfile on; + tcp_nopush on; + tcp_nodelay on; + keepalive_timeout 65; + types_hash_max_size 2048; + client_max_body_size 100M; + + gzip on; + gzip_disable "msie6"; + gzip_vary on; + gzip_proxied any; + gzip_comp_level 6; + gzip_buffers 16 8k; + gzip_http_version 1.1; + gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+text text/javascript; + + upstream novalon_app { + server novalon-website:3000; + } + + upstream forgejo_app { + server forgejo:3000; + } + + upstream woodpecker_app { + server woodpecker-server:8000; + } + + upstream registry_app { + server registry:5000; + } + + # ========== novalon.cn 主域名 ========== + server { + listen 80; + server_name novalon.cn www.novalon.cn; + + location /.well-known/acme-challenge/ { + root /var/www/certbot; + } + + location / { + return 301 https://$host$request_uri; + } + } + + server { + listen 443 ssl; + server_name novalon.cn www.novalon.cn; + + ssl_certificate /etc/nginx/ssl/fullchain.pem; + ssl_certificate_key /etc/nginx/ssl/privkey.pem; + ssl_protocols TLSv1.2 TLSv1.3; + ssl_ciphers HIGH:!aNULL:!MD5; + ssl_prefer_server_ciphers on; + + ssl_session_cache shared:SSL:10m; + ssl_session_timeout 10m; + + add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; + add_header X-Frame-Options "SAMEORIGIN" always; + add_header X-Content-Type-Options "nosniff" always; + add_header X-XSS-Protection "1; mode=block" always; + + location / { + proxy_pass http://novalon_app; + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection 'upgrade'; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_cache_bypass $http_upgrade; + + proxy_connect_timeout 60s; + proxy_send_timeout 60s; + proxy_read_timeout 60s; + } + + location /_next/static { + proxy_pass http://novalon_app; + proxy_cache_valid 200 60m; + add_header Cache-Control "public, immutable, max-age=31536000, s-maxage=31536000"; + } + + location /static { + proxy_pass http://novalon_app; + proxy_cache_valid 200 60m; + add_header Cache-Control "public, immutable, max-age=31536000, s-maxage=31536000"; + } + } + + # ========== git.f.novalon.cn (临时HTTP配置用于证书申请) ========== + server { + listen 80; + server_name git.f.novalon.cn; + + location /.well-known/acme-challenge/ { + root /var/www/certbot; + } + + location / { + proxy_pass http://forgejo_app; + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection 'upgrade'; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_cache_bypass $http_upgrade; + } + } + + # ========== ci.f.novalon.cn (临时HTTP配置用于证书申请) ========== + server { + listen 80; + server_name ci.f.novalon.cn; + + location /.well-known/acme-challenge/ { + root /var/www/certbot; + } + + location / { + proxy_pass http://woodpecker_app; + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection 'upgrade'; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_cache_bypass $http_upgrade; + } + } + + # ========== registry.f.novalon.cn (已有证书，配置HTTPS) ========== + server { + listen 80; + server_name registry.f.novalon.cn; + + location /.well-known/acme-challenge/ { + root /var/www/certbot; + } + + location / { + return 301 https://$host$request_uri; + } + } + + server { + listen 443 ssl; + server_name registry.f.novalon.cn; + + ssl_certificate /etc/nginx/ssl/registry.f.novalon.cn/fullchain.pem; + ssl_certificate_key /etc/nginx/ssl/registry.f.novalon.cn/privkey.pem; + ssl_protocols TLSv1.2 TLSv1.3; + ssl_ciphers HIGH:!aNULL:!MD5; + ssl_prefer_server_ciphers on; + + ssl_session_cache shared:SSL:10m; + ssl_session_timeout 10m; + + add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; + add_header X-Frame-Options "SAMEORIGIN" always; + add_header X-Content-Type-Options "nosniff" always; + add_header X-XSS-Protection "1; mode=block" always; + + location / { + proxy_pass http://registry_app; + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection 'upgrade'; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_cache_bypass $http_upgrade; + + proxy_connect_timeout 60s; + proxy_send_timeout 300s; + proxy_read_timeout 300s; + + proxy_buffering off; + proxy_request_buffering off; + } + + location /v2/ { + proxy_pass http://registry_app/v2/; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + } + } +} diff --git a/nginx-wildcard.conf b/nginx-wildcard.conf new file mode 100644 index 0000000..c8d0322 --- /dev/null +++ b/nginx-wildcard.conf @@ -0,0 +1,270 @@ +user nginx; +worker_processes auto; +error_log /var/log/nginx/error.log warn; +pid /var/run/nginx.pid; + +events { + worker_connections 1024; +} + +http { + include /etc/nginx/mime.types; + default_type application/octet-stream; + + log_format main '$remote_addr - $remote_user [$time_local] "$request" ' + '$status $body_bytes_sent "$http_referer" ' + '"$http_user_agent" "$http_x_forwarded_for"'; + + access_log /var/log/nginx/access.log main; + + sendfile on; + tcp_nopush on; + tcp_nodelay on; + keepalive_timeout 65; + types_hash_max_size 2048; + client_max_body_size 100M; + + gzip on; + gzip_disable "msie6"; + gzip_vary on; + gzip_proxied any; + gzip_comp_level 6; + gzip_buffers 16 8k; + gzip_http_version 1.1; + gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+text text/javascript; + + upstream novalon_app { + server novalon-website:3000; + } + + upstream forgejo_app { + server forgejo:3000; + } + + upstream woodpecker_app { + server woodpecker-server:8000; + } + + upstream registry_app { + server registry:5000; + } + + # ========== novalon.cn 主域名 ========== + server { + listen 80; + server_name novalon.cn www.novalon.cn; + + location /.well-known/acme-challenge/ { + root /var/www/certbot; + } + + location / { + return 301 https://$host$request_uri; + } + } + + server { + listen 443 ssl http2; + server_name novalon.cn www.novalon.cn; + + ssl_certificate /etc/nginx/ssl/fullchain.pem; + ssl_certificate_key /etc/nginx/ssl/privkey.pem; + ssl_protocols TLSv1.2 TLSv1.3; + ssl_ciphers HIGH:!aNULL:!MD5; + ssl_prefer_server_ciphers on; + + ssl_session_cache shared:SSL:10m; + ssl_session_timeout 10m; + + add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; + add_header X-Frame-Options "SAMEORIGIN" always; + add_header X-Content-Type-Options "nosniff" always; + add_header X-XSS-Protection "1; mode=block" always; + + location / { + proxy_pass http://novalon_app; + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection 'upgrade'; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_cache_bypass $http_upgrade; + + proxy_connect_timeout 60s; + proxy_send_timeout 60s; + proxy_read_timeout 60s; + } + + location /_next/static { + proxy_pass http://novalon_app; + proxy_cache_valid 200 60m; + add_header Cache-Control "public, immutable, max-age=31536000, s-maxage=31536000"; + } + + location /static { + proxy_pass http://novalon_app; + proxy_cache_valid 200 60m; + add_header Cache-Control "public, immutable, max-age=31536000, s-maxage=31536000"; + } + } + + # ========== git.f.novalon.cn (Forgejo) - 使用通配符证书 ========== + server { + listen 80; + server_name git.f.novalon.cn; + + location /.well-known/acme-challenge/ { + root /var/www/certbot; + } + + location / { + return 301 https://$host$request_uri; + } + } + + server { + listen 443 ssl http2; + server_name git.f.novalon.cn; + + ssl_certificate /etc/nginx/ssl/wildcard/fullchain.pem; + ssl_certificate_key /etc/nginx/ssl/wildcard/privkey.pem; + ssl_protocols TLSv1.2 TLSv1.3; + ssl_ciphers HIGH:!aNULL:!MD5; + ssl_prefer_server_ciphers on; + + ssl_session_cache shared:SSL:10m; + ssl_session_timeout 10m; + + add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; + add_header X-Frame-Options "SAMEORIGIN" always; + add_header X-Content-Type-Options "nosniff" always; + add_header X-XSS-Protection "1; mode=block" always; + + location / { + proxy_pass http://forgejo_app; + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection 'upgrade'; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_cache_bypass $http_upgrade; + + proxy_connect_timeout 60s; + proxy_send_timeout 60s; + proxy_read_timeout 60s; + } + } + + # ========== ci.f.novalon.cn (Woodpecker CI) - 使用通配符证书 ========== + server { + listen 80; + server_name ci.f.novalon.cn; + + location /.well-known/acme-challenge/ { + root /var/www/certbot; + } + + location / { + return 301 https://$host$request_uri; + } + } + + server { + listen 443 ssl http2; + server_name ci.f.novalon.cn; + + ssl_certificate /etc/nginx/ssl/wildcard/fullchain.pem; + ssl_certificate_key /etc/nginx/ssl/wildcard/privkey.pem; + ssl_protocols TLSv1.2 TLSv1.3; + ssl_ciphers HIGH:!aNULL:!MD5; + ssl_prefer_server_ciphers on; + + ssl_session_cache shared:SSL:10m; + ssl_session_timeout 10m; + + add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; + add_header X-Frame-Options "SAMEORIGIN" always; + add_header X-Content-Type-Options "nosniff" always; + add_header X-XSS-Protection "1; mode=block" always; + + location / { + proxy_pass http://woodpecker_app; + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection 'upgrade'; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_cache_bypass $http_upgrade; + + proxy_connect_timeout 60s; + proxy_send_timeout 60s; + proxy_read_timeout 60s; + } + } + + # ========== registry.f.novalon.cn (Docker Registry) - 使用通配符证书 ========== + server { + listen 80; + server_name registry.f.novalon.cn; + + location /.well-known/acme-challenge/ { + root /var/www/certbot; + } + + location / { + return 301 https://$host$request_uri; + } + } + + server { + listen 443 ssl http2; + server_name registry.f.novalon.cn; + + ssl_certificate /etc/nginx/ssl/wildcard/fullchain.pem; + ssl_certificate_key /etc/nginx/ssl/wildcard/privkey.pem; + ssl_protocols TLSv1.2 TLSv1.3; + ssl_ciphers HIGH:!aNULL:!MD5; + ssl_prefer_server_ciphers on; + + ssl_session_cache shared:SSL:10m; + ssl_session_timeout 10m; + + add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; + add_header X-Frame-Options "SAMEORIGIN" always; + add_header X-Content-Type-Options "nosniff" always; + add_header X-XSS-Protection "1; mode=block" always; + + location / { + proxy_pass http://registry_app; + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection 'upgrade'; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_cache_bypass $http_upgrade; + + proxy_connect_timeout 60s; + proxy_send_timeout 300s; + proxy_read_timeout 300s; + + proxy_buffering off; + proxy_request_buffering off; + } + + location /v2/ { + proxy_pass http://registry_app/v2/; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + } + } +} diff --git a/public/images/备案图标.png b/public/images/备案图标.png deleted file mode 100644 index 2a13ba2..0000000 Binary files a/public/images/备案图标.png and /dev/null differ diff --git a/scripts/deploy-subdomain-ssl.sh b/scripts/deploy-subdomain-ssl.sh new file mode 100644 index 0000000..111019f --- /dev/null +++ b/scripts/deploy-subdomain-ssl.sh @@ -0,0 +1,137 @@ +#!/bin/bash + +set -e + +echo "=========================================" +echo "二级域名SSL证书配置部署脚本" +echo "=========================================" +echo "" +echo "请选择SSL证书申请方案:" +echo "" +echo "方案A: 通配符证书 (DNS验证)" +echo " - 一个证书覆盖所有 *.f.novalon.cn" +echo " - 需要腾讯云API密钥" +echo " - 适合: 有API密钥且希望简化证书管理" +echo "" +echo "方案B: 单独证书 (HTTP验证)" +echo " - 为每个域名单独申请证书" +echo " - 无需API密钥" +echo " - 适合: 没有API密钥或希望独立管理每个域名" +echo "" +read -p "请选择方案 [A/B]: " choice + +case $choice in + [Aa]) + echo "" + echo "选择方案A: 通配符证书" + + if [ -f "scripts/ssl-wildcard-dns.sh" ]; then + echo "" + echo "上传SSL证书申请脚本..." + scp scripts/ssl-wildcard-dns.sh root@139.155.109.62:/home/novalon/docker-app/ + ssh root@139.155.109.62 "chmod +x /home/novalon/docker-app/ssl-wildcard-dns.sh" + echo "✓ SSL证书申请脚本已上传" + else + echo "✗ 找不到ssl-wildcard-dns.sh文件" + exit 1 + fi + + echo "" + echo "上传Nginx配置..." + if [ -f "nginx-wildcard.conf" ]; then + scp nginx-wildcard.conf root@139.155.109.62:/home/novalon/docker-app/novalon-nginx/nginx.conf + echo "✓ Nginx配置已上传" + else + echo "✗ 找不到nginx-wildcard.conf文件" + exit 1 + fi + + echo "" + echo "=========================================" + echo "请在服务器上执行以下命令:" + echo "=========================================" + echo "" + echo "ssh root@139.155.109.62" + echo "" + echo "export TENCENTCLOUD_SECRET_ID=your-secret-id" + echo "export TENCENTCLOUD_SECRET_KEY=your-secret-key" + echo "" + echo "cd /home/novalon/docker-app" + echo "./ssl-wildcard-dns.sh" + echo "" + echo "docker restart novalon-nginx" + echo "" + echo "=========================================" + ;; + + [Bb]) + echo "" + echo "选择方案B: 单独证书" + + if [ -f "scripts/ssl-individual-http.sh" ]; then + echo "" + echo "上传SSL证书申请脚本..." + scp scripts/ssl-individual-http.sh root@139.155.109.62:/home/novalon/docker-app/ + ssh root@139.155.109.62 "chmod +x /home/novalon/docker-app/ssl-individual-http.sh" + echo "✓ SSL证书申请脚本已上传" + else + echo "✗ 找不到ssl-individual-http.sh文件" + exit 1 + fi + + echo "" + echo "上传Nginx配置..." + if [ -f "nginx-individual.conf" ]; then + scp nginx-individual.conf root@139.155.109.62:/home/novalon/docker-app/novalon-nginx/nginx.conf + echo "✓ Nginx配置已上传" + else + echo "✗ 找不到nginx-individual.conf文件" + exit 1 + fi + + echo "" + read -p "是否现在申请证书? [y/N]: " confirm + if [ "$confirm" = "y" ] || [ "$confirm" = "Y" ]; then + echo "" + echo "申请SSL证书..." + ssh root@139.155.109.62 "cd /home/novalon/docker-app && ./ssl-individual-http.sh" + + echo "" + echo "重启Nginx容器..." + ssh root@139.155.109.62 "docker restart novalon-nginx" + else + echo "" + echo "=========================================" + echo "请在服务器上执行以下命令:" + echo "=========================================" + echo "" + echo "ssh root@139.155.109.62" + echo "" + echo "cd /home/novalon/docker-app" + echo "./ssl-individual-http.sh" + echo "" + echo "docker restart novalon-nginx" + echo "" + echo "=========================================" + fi + ;; + + *) + echo "无效选择" + exit 1 + ;; +esac + +echo "" +echo "=========================================" +echo "部署完成!" +echo "=========================================" +echo "" +echo "测试访问:" +echo " - https://git.f.novalon.cn" +echo " - https://ci.f.novalon.cn" +echo " - https://registry.f.novalon.cn" +echo "" +echo "检查SSL证书:" +echo " openssl s_client -connect git.f.novalon.cn:443 -servername git.f.novalon.cn | openssl x509 -noout -text | grep -A 1 'Subject Alternative Name'" +echo "=========================================" diff --git a/scripts/deploy-wildcard-domain.sh b/scripts/deploy-wildcard-domain.sh new file mode 100755 index 0000000..c81e9bd --- /dev/null +++ b/scripts/deploy-wildcard-domain.sh @@ -0,0 +1,73 @@ +#!/bin/bash + +set -e + +echo "=========================================" +echo "二级域名配置部署脚本" +echo "=========================================" + +echo "" +echo "步骤1: 验证DNS解析..." +echo "检查 *.f.novalon.cn 解析..." + +if nslookup git.f.novalon.cn | grep -q "139.155.109.62"; then + echo "✓ DNS解析正常" +else + echo "✗ DNS解析未生效，请等待DNS传播" + exit 1 +fi + +echo "" +echo "步骤2: 上传Nginx配置..." +if [ -f "nginx-wildcard.conf" ]; then + scp nginx-wildcard.conf root@139.155.109.62:/home/novalon/docker-app/nginx.conf + echo "✓ Nginx配置已上传" +else + echo "✗ 找不到nginx-wildcard.conf文件" + exit 1 +fi + +echo "" +echo "步骤3: 上传SSL证书申请脚本..." +if [ -f "scripts/setup-wildcard-ssl.sh" ]; then + scp scripts/setup-wildcard-ssl.sh root@139.155.109.62:/home/novalon/docker-app/ + ssh root@139.155.109.62 "chmod +x /home/novalon/docker-app/setup-wildcard-ssl.sh" + echo "✓ SSL证书申请脚本已上传" +else + echo "✗ 找不到setup-wildcard-ssl.sh文件" + exit 1 +fi + +echo "" +echo "步骤4: 申请通配符SSL证书..." +echo "注意: 需要腾讯云API密钥" +echo "" +echo "请在服务器上执行以下命令:" +echo "ssh root@139.155.109.62" +echo "export TENCENTCLOUD_SECRET_ID=your-secret-id" +echo "export TENCENTCLOUD_SECRET_KEY=your-secret-key" +echo "cd /home/novalon/docker-app && ./setup-wildcard-ssl.sh" +echo "" +echo "或者直接运行 (需要提供密钥):" +read -p "是否现在申请证书? (需要腾讯云API密钥) [y/N]: " confirm + +if [ "$confirm" = "y" ] || [ "$confirm" = "Y" ]; then + read -p "请输入腾讯云Secret ID: " secret_id + read -p "请输入腾讯云Secret Key: " secret_key + + ssh root@139.155.109.62 "export TENCENTCLOUD_SECRET_ID='$secret_id' && export TENCENTCLOUD_SECRET_KEY='$secret_key' && cd /home/novalon/docker-app && ./setup-wildcard-ssl.sh" +fi + +echo "" +echo "=========================================" +echo "部署完成!" +echo "=========================================" +echo "" +echo "后续步骤:" +echo "1. 如果未自动申请证书，请手动执行SSL证书申请脚本" +echo "2. 重启Nginx容器: docker restart novalon-nginx" +echo "3. 测试访问:" +echo " - https://git.f.novalon.cn" +echo " - https://ci.f.novalon.cn" +echo " - https://registry.f.novalon.cn" +echo "=========================================" diff --git a/scripts/setup-gitea-oauth2-auto.sh b/scripts/setup-gitea-oauth2-auto.sh new file mode 100644 index 0000000..b13c326 --- /dev/null +++ b/scripts/setup-gitea-oauth2-auto.sh @@ -0,0 +1,83 @@ +#!/bin/bash + +echo "=========================================" +echo "Gitea OAuth2应用自动配置" +echo "=========================================" + +echo "" +echo "步骤1: 生成管理员Access Token..." +# 使用正确的scope (all包含所有权限) +OUTPUT=$(docker exec -u git forgejo gitea admin user generate-access-token \ + --username novalon-admin \ + --token-name oauth2-setup-$(date +%s) \ + --scopes all 2>&1) + +echo "$OUTPUT" + +# 从输出中提取token +TOKEN=$(echo "$OUTPUT" | grep -oP 'Access token: \K.*' || echo "") + +echo "" +echo "步骤2: 使用Token创建OAuth2应用..." + +if [ -n "$TOKEN" ]; then + echo "Token已生成: ${TOKEN:0:20}..." + + # 使用API创建OAuth2应用 + RESPONSE=$(docker exec forgejo curl -s -X POST "http://localhost:3000/api/v1/applications/oauth2" \ + -H "Authorization: token $TOKEN" \ + -H "Content-Type: application/json" \ + -d '{ + "name": "Woodpecker CI", + "redirect_uri": "https://ci.f.novalon.cn/authorize", + "confidential_client": true + }') + + echo "API响应: $RESPONSE" + + # 提取Client ID和Secret + CLIENT_ID=$(echo "$RESPONSE" | grep -oP '"client_id":"\K[^"]+' || echo "") + CLIENT_SECRET=$(echo "$RESPONSE" | grep -oP '"client_secret":"\K[^"]+' || echo "") + + if [ -n "$CLIENT_ID" ] && [ -n "$CLIENT_SECRET" ]; then + echo "" + echo "=========================================" + echo "✅ OAuth2应用创建成功!" + echo "=========================================" + echo "" + echo "Client ID: $CLIENT_ID" + echo "Client Secret: $CLIENT_SECRET" + echo "" + echo "请将以下内容添加到.env文件:" + echo "WOODPECKER_FORGEJO_CLIENT=$CLIENT_ID" + echo "WOODPECKER_FORGEJO_SECRET=$CLIENT_SECRET" + echo "" + echo "然后重启Woodpecker服务:" + echo "cd /home/novalon/docker-app/novalon-cicd" + echo "docker-compose restart woodpecker-server" + echo "=========================================" + exit 0 + else + echo "警告: 无法从API响应中提取凭证" + fi +else + echo "警告: 无法生成Token" +fi + +echo "" +echo "=========================================" +echo "⚠️ 自动配置失败，请手动完成" +echo "=========================================" +echo "" +echo "1. 访问 https://git.f.novalon.cn" +echo "2. 登录凭证:" +echo " 用户名: novalon-admin" +echo " 密码: Novalon@Admin2026" +echo "" +echo "3. 创建OAuth2应用:" +echo " 头像 -> 设置 -> 应用 -> OAuth2应用 -> 创建应用" +echo " 名称: Woodpecker CI" +echo " 重定向URI: https://ci.f.novalon.cn/authorize" +echo "" +echo "4. 记录Client ID和Secret并更新.env文件" +echo "=========================================" diff --git a/scripts/setup-gitea-oauth2.sh b/scripts/setup-gitea-oauth2.sh new file mode 100644 index 0000000..68859c8 --- /dev/null +++ b/scripts/setup-gitea-oauth2.sh @@ -0,0 +1,51 @@ +#!/bin/bash + +echo "=========================================" +echo "Gitea OAuth2应用配置" +echo "=========================================" + +echo "" +echo "步骤1: 生成管理员Access Token..." +# 生成access token +docker exec -u git forgejo gitea admin user generate-access-token \ + --username novalon-admin \ + --token-name oauth2-setup \ + --scopes write:application,read:application,write:user,read:user + +echo "" +echo "步骤2: 从数据库获取Token..." +# 从数据库获取token (Gitea存储的是hash，我们需要原始token) +# 查看access_token表 +docker exec postgresql psql -U forgejo -d forgejo -c \ + "SELECT id, uid, name, created_unix FROM access_token WHERE name='oauth2-setup' ORDER BY created_unix DESC LIMIT 1;" + +echo "" +echo "步骤3: 尝试使用API创建OAuth2应用..." +# 由于我们无法直接获取原始token，让我们使用Web UI方式 +echo "" +echo "=========================================" +echo "请手动完成以下步骤:" +echo "=========================================" +echo "" +echo "1. 访问 https://git.f.novalon.cn" +echo "2. 使用以下凭证登录:" +echo " 用户名: novalon-admin" +echo " 密码: Novalon@Admin2026" +echo "" +echo "3. 点击右上角头像 -> 设置 -> 应用 -> OAuth2应用" +echo "4. 点击'创建新的OAuth2应用'" +echo "5. 填写以下信息:" +echo " 应用名称: Woodpecker CI" +echo " 重定向URI: https://ci.f.novalon.cn/authorize" +echo "6. 点击'创建应用'" +echo "7. 记录生成的Client ID和Client Secret" +echo "" +echo "8. 将凭证更新到.env文件:" +echo " WOODPECKER_FORGEJO_CLIENT={description}
+请先登录
- - 前往登录 - -