わたしの部屋

1
[
2
  {
3
    "AllowedOrigins": ["*"],
4
    "AllowedMethods": ["GET", "HEAD"],
5
    "AllowedHeaders": ["*"],
6
    "ExposeHeaders": [],
7
    "MaxAgeSeconds": 3600
8
  }
9
]

1
name: Trigger Code Repo Build
2

3
on:
4
  push:
5
    branches:
6
      - main
7
    paths:
8
      - "posts/**"
9
      - "spec/**"
10
      - "data/**"
11
      - "images/**"
12
  workflow_dispatch: {}
13

14
jobs:
15
  dispatch:
16
    runs-on: ubuntu-latest
17
    steps:
18
      - name: Dispatch to code repo
19
        uses: peter-evans/repository-dispatch@v3
20
        with:
21
          token: ${{ secrets.DISPATCH_TOKEN }}
22
          repository: Dawn6666666/MyBlog
23
          event-type: content-updated

1
name: Deploy to Server
2

3
on:
4
  push:
5
    branches: [ custom-main ]
6
    paths-ignore:
7
      - "docs/**"
8
      - "README*.md"
9
      - ".github/**"
10
  repository_dispatch:
11
    types: [ content-updated ]
12
  workflow_dispatch:
13

14
concurrency:
15
  group: ${{ github.workflow }}-${{ github.ref }}
16
  cancel-in-progress: true
17

18
permissions:
19
  contents: read
20

21
jobs:
22
  build-and-deploy:
23
    runs-on: ubuntu-latest
24
    timeout-minutes: 10
25
    steps:
26
      - name: Checkout
27
        uses: actions/checkout@v6
28

29
      - name: Setup pnpm
30
        uses: pnpm/action-setup@v6
31
        with:
32
          run_install: false
33

34
      - name: Setup Node.js
35
        uses: actions/setup-node@v6
36
        with:
37
          node-version: 22
38
          cache: pnpm
39

40
      - name: Restore Astro cache
41
        uses: actions/cache@v4
42
        with:
43
          path: |
44
            .astro
45
            node_modules/.astro
46
          key: ${{ runner.os }}-astro-${{ hashFiles('pnpm-lock.yaml', 'astro.config.mjs', 'src/config/**/*.ts') }}
47
          restore-keys: |
48
            ${{ runner.os }}-astro-
49

50
      - name: Install dependencies
51
        run: pnpm install --frozen-lockfile --prefer-offline
52

53
      - name: Sync content repo
54
        run: pnpm run sync-content
55
        env:
56
          ENABLE_CONTENT_SYNC: true
57
          CONTENT_REPO_URL: https://x-access-token:${{ secrets.CONTENT_REPO_TOKEN }}@github.com/Dawn6666666/MyBlog-Content.git
58
          CONTENT_SYNC_PULL: false
59
          GIT_TERMINAL_PROMPT: 0
60

61
      - name: Build site
62
        run: pnpm run build
63
        env:
64
          ENABLE_CONTENT_SYNC: true
65
          CONTENT_REPO_URL: https://x-access-token:${{ secrets.CONTENT_REPO_TOKEN }}@github.com/Dawn6666666/MyBlog-Content.git
66
          CONTENT_SYNC_PULL: false
67
          GIT_TERMINAL_PROMPT: 0
68
          BILI_SESSDATA: ${{ secrets.BILI_SESSDATA }}
69
          UMAMI_SHARE_URL: ${{ secrets.UMAMI_SHARE_URL }}
70

71
      - name: Deploy to dual servers
72
        env:
73
          DEPLOY_PORT: 22
74
          DEPLOY_DIR: /www/wwwroot/MyBlog
75
          DEPLOY_HOST_CN: ${{ secrets.DEPLOY_HOST_CN }}
76
          DEPLOY_USER_CN: ${{ secrets.DEPLOY_USER_CN }}
77
          DEPLOY_SSH_KEY_CN: ${{ secrets.DEPLOY_SSH_KEY_CN }}
78
          DEPLOY_HOST_OVERSEA: ${{ secrets.DEPLOY_HOST_OVERSEA }}
79
          DEPLOY_USER_OVERSEA: ${{ secrets.DEPLOY_USER_OVERSEA }}
80
          DEPLOY_SSH_KEY_OVERSEA: ${{ secrets.DEPLOY_SSH_KEY_OVERSEA }}
81
        run: |
82
          set -euo pipefail
83

84
          deploy_one() {
85
            local name="$1"
86
            local host="$2"
87
            local user="$3"
88
            local key="$4"
89

90
            if [ -z "$host" ] || [ -z "$user" ] || [ -z "$key" ]; then
91
              echo "Missing deploy secret(s) for $name"
92
              exit 1
93
            fi
94

95
            mkdir -p ~/.ssh
96
            chmod 700 ~/.ssh
97
            printf '%s\n' "$key" > ~/.ssh/deploy_key_"$name"
98
            chmod 600 ~/.ssh/deploy_key_"$name"
99
            ssh-keyscan -p "$DEPLOY_PORT" -H "$host" >> ~/.ssh/known_hosts
100

101
            ssh -i ~/.ssh/deploy_key_"$name" -p "$DEPLOY_PORT" "$user@$host" \
102
              "mkdir -p '$DEPLOY_DIR/dist'"
103

104
            rsync -az --delete \
105
              -e "ssh -i ~/.ssh/deploy_key_$name -p $DEPLOY_PORT" \
106
              --exclude=".user.ini" \
107
              --exclude=".well-known" \
108
              dist/ "$user@$host:$DEPLOY_DIR/dist/"
109
          }
110

111
          # 后台并行投递两台机器，最后用 wait 聚合退出码
112
          deploy_one cn "$DEPLOY_HOST_CN" "$DEPLOY_USER_CN" "$DEPLOY_SSH_KEY_CN" &
113
          pid_cn=$!
114
          deploy_one oversea "$DEPLOY_HOST_OVERSEA" "$DEPLOY_USER_OVERSEA" "$DEPLOY_SSH_KEY_OVERSEA" &
115
          pid_oversea=$!
116

117
          status=0
118
          wait "$pid_cn" || status=$?
119
          wait "$pid_oversea" || status=$?
120
          exit "$status"

1
# 剔除 TLSv1.1，仅放行主流安全的版本
2
ssl_protocols TLSv1.2 TLSv1.3;

1
server {
2
    listen 80;
3
    listen 443 ssl;
4
    listen 443 quic;
5
    http2 on;
6
    server_name www.dawn114514.site dawn114514.site;
7
    index index.html index.htm;
8
    root /www/wwwroot/MyBlog/dist;
9

10
    include /www/server/panel/vhost/nginx/extension/xxx.xxx.xxx.xxx/*.conf;
11
    include /www/server/panel/vhost/nginx/well-known/xxx.xxx.xxx.xxx.conf;
12

13
    ssl_certificate      /www/server/panel/vhost/cert/xxx.xxx.xxx.xxx/fullchain.pem;
14
    ssl_certificate_key  /www/server/panel/vhost/cert/xxx.xxx.xxx.xxx/privkey.pem;
15

16
    ssl_protocols TLSv1.2 TLSv1.3;
17
    ssl_ciphers EECDH+CHACHA20:EECDH+CHACHA20-draft:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:!MD5;
18
    ssl_prefer_server_ciphers on;
19
    ssl_session_tickets on;
20
    ssl_session_cache shared:SSL:10m;
21
    ssl_session_timeout 10m;
22

23
    # 启用 HTTP/3 (QUIC) 支持以降低连接延迟
24
    add_header Strict-Transport-Security "max-age=31536000";
25
    add_header Alt-Svc 'quic=":443"; h3=":443"';
26
    error_page 497 https://$host$request_uri;
27

28
    location / {
29
        try_files $uri $uri/ /index.html;
30
    }
31

32
    # 针对自建服务 A 与自建服务 B 的 WebSocket 反向代理转发
33
    # 依赖外部 0.websocket.conf 的全局 Upgrade map 指令
34
}

1
sudo apt-get update
2
sudo apt-get install -y nginx certbot python3-certbot-nginx

1
sudo certbot --nginx -d dawn114514.site -d www.dawn114514.site \
2
  --agree-tos --register-unsafely-without-email --non-interactive

1
# 先查看当前规则和行号，定位 REJECT 行所在的位置（注意用 -L 而不是 -S，-L 才支持 --line-numbers）
2
sudo iptables -L INPUT -n --line-numbers
3

4
# 假设查到 REJECT 在第 6 行，就把 80/443 的 ACCEPT 插到它前面
5
# 先在第 6 行处插入 80 放行（这条会顶替原第 6 行的位置，REJECT 顺延到第 7 行）
6
sudo iptables -I INPUT 6 -p tcp --dport 80 -j ACCEPT
7
# 再在第 7 行处插入 443 放行（在 REJECT 之前）
8
sudo iptables -I INPUT 7 -p tcp --dport 443 -j ACCEPT
9
# 实操时请把行号替换为你机器上 REJECT 所在的真实编号，不要照抄
10

11
# 验证规则顺序是否正确（ACCEPT 必须在 REJECT 前面）
12
sudo iptables -L INPUT -n --line-numbers
13

14
# 重启后规则会丢失，需要持久化
15
sudo apt-get install -y iptables-persistent
16
sudo netfilter-persistent save

1
server {
2
    server_name dawn114514.site www.dawn114514.site yyy.yyy.yyy.yyy _;
3
    root /www/wwwroot/MyBlog/dist;
4
    index index.html;
5

6
    location / {
7
        try_files $uri $uri/ /index.html;
8
    }
9

10
    # 对静态资源文件启用 30 天超长缓存，优化首屏加载
11
    location ~* \.(?:css|js|mjs|json|xml|txt|ico|png|jpg|jpeg|gif|webp|avif|svg|woff2?|ttf|otf|mp3|flac|ogg)$ {
12
        try_files $uri =404;
13
        expires 30d;
14
        add_header Cache-Control "public, max-age=2592000, immutable";
15
    }
16

17
    error_page 404 /404.html;
18

19
    # Certbot 自动化注入的 SSL 配置
20
    listen [::]:443 ssl ipv6only=on;
21
    listen 443 ssl;
22
    ssl_certificate /etc/letsencrypt/live/dawn114514.site/fullchain.pem;
23
    ssl_certificate_key /etc/letsencrypt/live/dawn114514.site/privkey.pem;
24
    include /etc/letsencrypt/options-ssl-nginx.conf;
25
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
26
}
27

28
server {
29
    if ($host = www.dawn114514.site) {
30
        return 301 https://$host$request_uri;
31
    }
32
    if ($host = dawn114514.site) {
33
        return 301 https://$host$request_uri;
34
    }
35

36
    listen 80 default_server;
37
    listen [::]:80 default_server;
38
    server_name dawn114514.site www.dawn114514.site yyy.yyy.yyy.yyy _;
39
    return 404;
40
}