From e4f1059880b8eae32f8654da542a768ff5ff3257 Mon Sep 17 00:00:00 2001 From: Codex Date: Mon, 26 Oct 2026 14:33:19 +0800 Subject: [PATCH] fix: apply managed Nginx public entry without service restart --- backend/internal/api/identity_gateway.go | 20 ++++ backend/internal/api/identity_gateway_test.go | 9 ++ backend/internal/api/tls.go | 54 +++++++++- backend/internal/nginxgateway/gateway.go | 100 +++++++++++++++--- backend/internal/nginxgateway/gateway_test.go | 42 ++++++++ backend/internal/tlsservice/tlsservice.go | 23 +++- .../internal/tlsservice/tlsservice_test.go | 29 +++++ docs/specs/SDD-005-nginx-live-public-entry.md | 61 +++++++++++ frontend/src/locales/en-US.json | 10 +- frontend/src/locales/zh-CN.json | 10 +- .../settings/components/GatewaySettings.vue | 13 ++- 11 files changed, 338 insertions(+), 33 deletions(-) create mode 100644 backend/internal/nginxgateway/gateway_test.go create mode 100644 docs/specs/SDD-005-nginx-live-public-entry.md diff --git a/backend/internal/api/identity_gateway.go b/backend/internal/api/identity_gateway.go index 5f01102..a2f8e5f 100644 --- a/backend/internal/api/identity_gateway.go +++ b/backend/internal/api/identity_gateway.go @@ -38,6 +38,26 @@ func authGatewayPort(publicBase string) (int, error) { return port, nil } +func checkAuthGatewayChange(oldBase, newBase string) error { + if oldBase == "" || oldBase == newBase { + return nil + } + port, err := authGatewayPort(oldBase) + if err != nil { + return err + } + if port != 0 { + return &activeAuthEntry{} + } + return nil +} + +type activeAuthEntry struct{} + +func (*activeAuthEntry) Error() string { + return "运行中的 OIDC 专线仍使用旧公网地址，请先停止或迁移专线" +} + type gatewayConflict struct{} func (*gatewayConflict) Error() string { diff --git a/backend/internal/api/identity_gateway_test.go b/backend/internal/api/identity_gateway_test.go index f42f49c..cdc546c 100644 --- a/backend/internal/api/identity_gateway_test.go +++ b/backend/internal/api/identity_gateway_test.go @@ -29,6 +29,12 @@ func TestAuthGatewayPortFollowsRunningOIDCTunnel(t *testing.T) { t.Fatal(err) } check(19090) + if err := checkAuthGatewayChange("https://vpn.example.com", "http://vpn.example.com"); err == nil { + t.Fatal("active OIDC callback must block public entry change") + } + if err := checkAuthGatewayChange("https://vpn.example.com", "https://vpn.example.com"); err != nil { + t.Fatalf("unchanged public entry should be allowed: %v", err) + } if port, err := authGatewayPort("https://other.example.com"); err != nil || port != 0 { t.Fatalf("wrong domain routed: %d, %v", port, err) } @@ -36,4 +42,7 @@ func TestAuthGatewayPortFollowsRunningOIDCTunnel(t *testing.T) { t.Fatal(err) } check(0) + if err := checkAuthGatewayChange("https://vpn.example.com", "http://vpn.example.com"); err != nil { + t.Fatalf("stopped OIDC tunnel should allow change: %v", err) + } } diff --git a/backend/internal/api/tls.go b/backend/internal/api/tls.go index d553516..478fce2 100644 --- a/backend/internal/api/tls.go +++ b/backend/internal/api/tls.go @@ -26,14 +26,19 @@ func (s *Server) nginxSetupStatus(c *gin.Context) { func (s *Server) activateNginx(c *gin.Context) { status := tlsservice.Status() - if status.Mode != "nginx" || status.ConfiguredMode != "nginx" || status.RestartRequired || status.ConfiguredDomain == "" { - c.JSON(http.StatusPreconditionFailed, gin.H{"error": "请先保存 Nginx 模式和公网入口，重启 opsx-vpn 后再启用站点"}) + if status.Mode != "nginx" || status.ConfiguredMode != "nginx" || status.ConfiguredDomain == "" { + c.JSON(http.StatusPreconditionFailed, gin.H{"error": "请先启用 Nginx 模式并保存公网入口；切换入口模式需重启 opsx-vpn"}) return } scheme := status.ConfiguredScheme if scheme == "" { scheme = "https" } + authPort, err := authGatewayPort(status.ConfiguredPublicBase) + if err != nil { + c.JSON(http.StatusConflict, gin.H{"error": err.Error()}) + return + } if !nginxgateway.Begin() { c.JSON(http.StatusConflict, gin.H{"error": "入口配置正在运行，请等待完成"}) return @@ -54,11 +59,15 @@ func (s *Server) activateNginx(c *gin.Context) { write("info", "检查现有站点并启用 HTTP-01 验证。\n") } opts := nginxconfig.RenderOptions{Domain: status.ConfiguredDomain, Scheme: scheme, Port: status.ConfiguredPort} - if err := nginxgateway.RunEntry(opts, s.router.Routes(), func(message string) { write("output", message) }); err != nil { + if err := nginxgateway.RunEntryWithAuth(opts, s.router.Routes(), authPort, func(message string) { write("output", message) }); err != nil { store.Audit(c.GetString("username"), "nginx_activate", "failed", err.Error()) write("error", err.Error()) return } + if err := tlsservice.AdoptNginxConfiguration(service.BaseDir()); err != nil { + write("error", "站点已更新，但状态同步失败："+err.Error()) + return + } store.Audit(c.GetString("username"), "nginx_activate", "completed", status.ConfiguredPublicBase) write("done", "站点和入口已就绪。") } @@ -157,13 +166,48 @@ func (s *Server) setTLSDomain(c *gin.Context) { if req.Port != nil { port = *req.Port } + status := tlsservice.Status() + newBase := tlsservice.PublicBaseURL(scheme, strings.ToLower(strings.TrimSpace(req.Domain)), port) + if newBase == "" || port < 0 || port > 65535 { + c.JSON(http.StatusBadRequest, gin.H{"error": "公网域名、协议或端口无效"}) + return + } + // The Go listener cannot be rebound in place; Nginx owns its own sockets. + if status.Mode == "nginx" && status.ConfiguredMode == "nginx" && nginxgateway.Stage() != "none" { + s.gatewayMu.Lock() + defer s.gatewayMu.Unlock() + if err := checkAuthGatewayChange(status.PublicBase, newBase); err != nil { + c.JSON(http.StatusConflict, gin.H{"error": err.Error()}) + return + } + authPort, err := authGatewayPort(newBase) + if err != nil { + c.JSON(http.StatusConflict, gin.H{"error": err.Error()}) + return + } + opts := nginxconfig.RenderOptions{Domain: req.Domain, Scheme: scheme, Port: port} + err = nginxgateway.UpdateEntry(opts, status.ConfiguredDomain, s.router.Routes(), authPort, func() error { + if err := tlsservice.ConfigurePublicEntry(service.BaseDir(), scheme, req.Domain, port); err != nil { + return err + } + return tlsservice.AdoptNginxConfiguration(service.BaseDir()) + }) + if err != nil { + c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()}) + return + } + store.Audit(c.GetString("username"), "tls_domain_applied", newBase, "Nginx 已重载") + c.JSON(http.StatusOK, gin.H{"status": tlsservice.Status(), "restart_required": false, "applied": true}) + return + } if err := tlsservice.ConfigurePublicEntry(service.BaseDir(), scheme, req.Domain, port); err != nil { c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()}) return } store.Audit(c.GetString("username"), "tls_domain_configured", tlsservice.PublicBaseURL(scheme, strings.ToLower(strings.TrimSpace(req.Domain)), port), "需重启后生效") - status := tlsservice.Status() - c.JSON(http.StatusOK, gin.H{"status": status, "restart_required": status.RestartRequired}) + status = tlsservice.Status() + c.JSON(http.StatusOK, gin.H{"status": status, "restart_required": status.RestartRequired, + "site_activation_required": status.Mode == "nginx" && status.ConfiguredMode == "nginx" && nginxgateway.Stage() == "none"}) } func (s *Server) uploadTLSCertificate(c *gin.Context) { diff --git a/backend/internal/nginxgateway/gateway.go b/backend/internal/nginxgateway/gateway.go index c34d472..5f157cc 100644 --- a/backend/internal/nginxgateway/gateway.go +++ b/backend/internal/nginxgateway/gateway.go @@ -4,6 +4,8 @@ package nginxgateway import ( "context" + "crypto/tls" + "crypto/x509" "errors" "fmt" "net" @@ -72,7 +74,21 @@ func RefreshAuth(domain string, routes gin.RoutesInfo, authPort int) error { } func RefreshAuthEntry(opts nginxconfig.RenderOptions, routes gin.RoutesInfo, authPort int) error { - if Running() { + return refreshEntry(opts, routes, authPort, false, "", nil) +} + +// UpdateEntry applies a validated public entry to an existing managed site. +// persist is called after a successful reload; failure restores the old site. +func UpdateEntry(opts nginxconfig.RenderOptions, expectedDomain string, routes gin.RoutesInfo, authPort int, persist func() error) error { + if !Begin() { + return errors.New("公网入口操作正在进行") + } + defer End() + return refreshEntry(opts, routes, authPort, true, expectedDomain, persist) +} + +func refreshEntry(opts nginxconfig.RenderOptions, routes gin.RoutesInfo, authPort int, allowChange bool, expectedDomain string, persist func() error) error { + if Running() && !allowChange { return errors.New("公网入口操作正在进行") } scheme := strings.ToLower(strings.TrimSpace(opts.Scheme)) @@ -88,7 +104,7 @@ func RefreshAuthEntry(opts nginxconfig.RenderOptions, routes gin.RoutesInfo, aut return err } stage := Stage() - if scheme == "https" && stage != "https" { + if scheme == "https" && stage != "https" && !allowChange { return errors.New("请先启用 HTTPS 站点") } if scheme == "http" && stage == "none" { @@ -98,32 +114,80 @@ func RefreshAuthEntry(opts nginxconfig.RenderOptions, routes gin.RoutesInfo, aut if err != nil { return err } + if allowChange && !strings.Contains(string(previous), "# Install this HTTP site first.") && !strings.Contains(string(previous), "# Plain HTTP public entry") { + return errors.New("现有站点不是 opsx-vpn 托管配置，拒绝覆盖") + } + if allowChange && (expectedDomain == "" || !strings.Contains(string(previous), "server_name "+expectedDomain+";")) { + return errors.New("现有站点域名与运行配置不匹配，拒绝覆盖") + } domain := strings.ToLower(strings.TrimSpace(opts.Domain)) - if !strings.Contains(string(previous), "server_name "+domain+";") { + if !allowChange && !strings.Contains(string(previous), "server_name "+domain+";") { return errors.New("现有站点域名与配置不匹配") } + if allowChange && scheme == "https" { + fullchain, privkey, _ := tlsservice.CertificateFiles(domain) + pair, err := tls.LoadX509KeyPair(fullchain, privkey) + if err != nil || len(pair.Certificate) == 0 { + return errors.New("目标域名没有可用的 HTTPS 证书，请先准备证书") + } + leaf, err := x509.ParseCertificate(pair.Certificate[0]) + if err != nil || leaf.VerifyHostname(domain) != nil || time.Now().Before(leaf.NotBefore) || !time.Now().Before(leaf.NotAfter) { + return errors.New("目标域名证书无效或已过期") + } + } + if allowChange { + listenPort := tlsservice.EffectivePort(scheme, opts.Port) + portAlreadyManaged := strings.Contains(string(previous), fmt.Sprintf("listen %d;", listenPort)) || + strings.Contains(string(previous), fmt.Sprintf("listen %d ssl", listenPort)) + if !portAlreadyManaged { + listener, err := net.Listen("tcp", fmt.Sprintf("0.0.0.0:%d", listenPort)) + if err != nil { + return fmt.Errorf("目标端口 %d 已占用: %w", listenPort, err) + } + listener.Close() + } + } httpSite, httpsSite, err := nginxconfig.RenderWithOptions(opts, routes, authPort) if err != nil { return err } if string(previous) == httpSite+httpsSite { + if persist != nil { + return persist() + } return nil } - if err := writeSite(httpSite + httpsSite); err != nil { + validate := func() error { return command(func(string) {}, 15*time.Second, "nginx", "-t") } + reload := func() error { return command(func(string) {}, 15*time.Second, "systemctl", "reload", "nginx") } + return swapManagedSite(string(previous), httpSite+httpsSite, persist, writeSite, validate, reload) +} + +func swapManagedSite(previous, next string, persist func() error, write func(string) error, validate, reload func() error) error { + if err := write(next); err != nil { return err } - rollback := func() { - _ = writeSite(string(previous)) - _ = command(func(string) {}, 15*time.Second, "nginx", "-t") - _ = command(func(string) {}, 15*time.Second, "systemctl", "reload", "nginx") + rollback := func(cause error) error { + if err := write(previous); err != nil { + return fmt.Errorf("%w；恢复旧站点失败: %v", cause, err) + } + if err := validate(); err != nil { + return fmt.Errorf("%w；旧站点配置校验失败: %v", cause, err) + } + if err := reload(); err != nil { + return fmt.Errorf("%w；恢复旧站点重载失败: %v", cause, err) + } + return cause } - if err := command(func(string) {}, 15*time.Second, "nginx", "-t"); err != nil { - rollback() - return err + if err := validate(); err != nil { + return rollback(err) } - if err := command(func(string) {}, 15*time.Second, "systemctl", "reload", "nginx"); err != nil { - rollback() - return err + if err := reload(); err != nil { + return rollback(err) + } + if persist != nil { + if err := persist(); err != nil { + return rollback(err) + } } return nil } @@ -246,6 +310,12 @@ func Run(domain string, routes gin.RoutesInfo, emit func(string)) error { // RunEntry activates the public entry for the given scheme/port. HTTP skips ACME. func RunEntry(opts nginxconfig.RenderOptions, routes gin.RoutesInfo, emit func(string)) error { + return RunEntryWithAuth(opts, routes, 0, emit) +} + +// RunEntryWithAuth preserves a running OpenVPN browser-auth upstream when +// regenerating an already managed site. +func RunEntryWithAuth(opts nginxconfig.RenderOptions, routes gin.RoutesInfo, authPort int, emit func(string)) error { domain := strings.ToLower(strings.TrimSpace(opts.Domain)) scheme := strings.ToLower(strings.TrimSpace(opts.Scheme)) if scheme == "" { @@ -265,7 +335,7 @@ func RunEntry(opts nginxconfig.RenderOptions, routes gin.RoutesInfo, emit func(s } else if err := checkSites(); err != nil { return err } - httpSite, httpsSite, err := nginxconfig.RenderWithOptions(opts, routes, 0) + httpSite, httpsSite, err := nginxconfig.RenderWithOptions(opts, routes, authPort) if err != nil { return err } diff --git a/backend/internal/nginxgateway/gateway_test.go b/backend/internal/nginxgateway/gateway_test.go new file mode 100644 index 0000000..144d3d9 --- /dev/null +++ b/backend/internal/nginxgateway/gateway_test.go @@ -0,0 +1,42 @@ +package nginxgateway + +import ( + "errors" + "testing" +) + +func TestSwapManagedSiteRestoresPreviousOnFailure(t *testing.T) { + for _, failAt := range []string{"validate", "reload", "persist"} { + t.Run(failAt, func(t *testing.T) { + site := "old" + validations, reloads := 0, 0 + write := func(content string) error { site = content; return nil } + validate := func() error { + validations++ + if failAt == "validate" && site == "new" { + return errors.New("invalid nginx config") + } + return nil + } + reload := func() error { + reloads++ + if failAt == "reload" && site == "new" { + return errors.New("reload failed") + } + return nil + } + persist := func() error { + if failAt == "persist" { + return errors.New("save failed") + } + return nil + } + if err := swapManagedSite("old", "new", persist, write, validate, reload); err == nil { + t.Fatal("expected failure") + } + if site != "old" || validations < 2 || reloads < 1 { + t.Fatalf("old site not restored: site=%s validations=%d reloads=%d", site, validations, reloads) + } + }) + } +} diff --git a/backend/internal/tlsservice/tlsservice.go b/backend/internal/tlsservice/tlsservice.go index ff7c344..03f8857 100644 --- a/backend/internal/tlsservice/tlsservice.go +++ b/backend/internal/tlsservice/tlsservice.go @@ -282,6 +282,25 @@ func ConfigureMode(dataDir, mode string) error { return writePersisted(dataDir, "tls-mode", mode) } +// AdoptNginxConfiguration updates the in-process public address after the +// managed Nginx site has passed validation and reloaded successfully. +func AdoptNginxConfiguration(dataDir string) error { + config, err := configFromEnvironment(dataDir) + if err != nil { + return err + } + if config.mode != "nginx" { + return fmt.Errorf("当前入口不是 Nginx 模式") + } + state.Lock() + defer state.Unlock() + if state.config.mode != "nginx" || state.config.dataDir != dataDir { + return fmt.Errorf("运行模式不支持热更新 Nginx 入口") + } + state.config = config + return nil +} + // Start keeps certificates in the persistent data directory. Issuance occurs // on the first TLS handshake, and autocert handles renewal. func Start(handler http.Handler, dataDir string) error { @@ -377,8 +396,8 @@ func Status() CertificateStatus { status.ConfiguredScheme = normalizeScheme(desired.scheme) status.ConfiguredPort = desired.port status.ConfiguredPublicBase = PublicBaseURL(status.ConfiguredScheme, desired.domain, desired.port) - status.RestartRequired = desired.domain != config.domain || desired.mode != config.mode || - normalizeScheme(desired.scheme) != scheme || desired.port != config.port + status.RestartRequired = desired.mode != config.mode || (config.mode != "nginx" && + (desired.domain != config.domain || normalizeScheme(desired.scheme) != scheme || desired.port != config.port)) } if config.mode == "nginx" { // Certbot or uploaded PEMs own HTTPS certificates. HTTP needs no leaf. diff --git a/backend/internal/tlsservice/tlsservice_test.go b/backend/internal/tlsservice/tlsservice_test.go index 09fe9dd..02859e5 100644 --- a/backend/internal/tlsservice/tlsservice_test.go +++ b/backend/internal/tlsservice/tlsservice_test.go @@ -89,6 +89,35 @@ func TestNginxModeDoesNotBindGoListeners(t *testing.T) { } } +func TestNginxEntryCanAdoptWithoutRestart(t *testing.T) { + t.Setenv("VPN_TLS_MODE", "") + t.Setenv("VPN_TLS_DOMAIN", "") + t.Setenv("VPN_TLS_SCHEME", "") + t.Setenv("VPN_TLS_PORT", "") + dir := t.TempDir() + if err := ConfigureMode(dir, "nginx"); err != nil { + t.Fatal(err) + } + if err := ConfigurePublicEntry(dir, "https", "first.example.com", 443); err != nil { + t.Fatal(err) + } + if err := Start(http.NotFoundHandler(), dir); err != nil { + t.Fatal(err) + } + if err := ConfigurePublicEntry(dir, "http", "second.example.com", 8080); err != nil { + t.Fatal(err) + } + if s := Status(); s.PublicBase == "http://second.example.com:8080" || s.RestartRequired { + t.Fatalf("unapplied nginx config must not claim the new entry or require process restart: %+v", s) + } + if err := AdoptNginxConfiguration(dir); err != nil { + t.Fatal(err) + } + if s := Status(); s.RestartRequired || s.ConfiguredPublicBase != "http://second.example.com:8080" || s.PublicBase != s.ConfiguredPublicBase { + t.Fatalf("nginx config was not adopted: %+v", s) + } +} + func TestPublicBaseURL(t *testing.T) { cases := []struct { scheme, host string diff --git a/docs/specs/SDD-005-nginx-live-public-entry.md b/docs/specs/SDD-005-nginx-live-public-entry.md new file mode 100644 index 0000000..86deeea --- /dev/null +++ b/docs/specs/SDD-005-nginx-live-public-entry.md @@ -0,0 +1,61 @@ +# SDD-005：Nginx 公网入口保存后即时生效 + +| 字段 | 内容 | +|---|---| +| 版本 / 变更级别 | 0.1 / S3 | +| 设计状态 | 已形成 | +| 实现状态 | 已实现；本地 Go 测试及前端构建通过，生产热切换未演练 | +| 负责人 / 日期 | opsx-vpn / 2026-10-26 | +| 关联需求 | 在 Nginx 模式修改 HTTP/HTTPS 公网入口，无须重启管理进程；管理端口保持 18080 | +| 批准状态 | 用户提出修改 | + +## 1. 背景、目标与范围 + +- 现状：`api.setTLSDomain` 仅调用 `tlsservice.ConfigurePublicEntry` 写入 `data/tls-*`；`tlsservice.Status` 比较启动配置并要求重启。`nginxgateway.RefreshAuthEntry` 只能刷新同域名；页面先保存域名再另存模式，显示不准确的“重启后监听 80/443”。 +- 目标：已运行 Nginx 模式、已有托管站点时，保存协议、域名或端口会重写托管 Nginx 配置、`nginx -t` 和 reload，成功后更新内存配置及状态，返回即时生效；入口始终反代现有 18080 管理服务。 +- 边界：首次安装/启用站点依旧单独执行并提供申请证书的日志；Go autocert 模式和入口模式切换仍需重启，因为涉及 Go 监听器。生产当前 HTTPS 入口不自动切换到 HTTP。 +- 保留：原 HTTP-01 路由白名单、已有 OpenVPN/OIDC 回调、证书路径及未提交文件。 + +## 2. 需求与约束 + +- FR-01：已启用 Nginx 站点时保存公网入口即时更新站点及状态，不改变应用管理监听端口。 +- FR-02：失败时包括缺失/过期目标证书、端口冲突、`nginx -t`/reload 或配置持久化失败，恢复旧站点和旧状态并返回具体错误。 +- FR-03：首次配置但尚无托管站点时，保存后提示“待启用站点”，点击启用后无须重启；切换进程入口模式明确提示重启。 +- FR-04：运行中的 OpenVPN OIDC 使用旧公网回调时，禁止修改会使其回调失效的入口地址。 +- NFR-01：只允许管理员修改；拒绝覆盖不属于本应用的站点；更新操作与证书上传/身份路由刷新互斥。 + +## 3. 架构与方案 + +保存接口按运行模式分支：Nginx 托管站点先校验新域名证书与活跃 OIDC 引用，在锁内生成站点、备份原内容、原子替换、测试及 reload，再持久化公网配置并更新 `tlsservice` 内存；任何步骤失败回滚站点与配置。未启用站点只保存草稿；启用站点成功后更新内存。Go 模式原有需重启语义保留。前端按 `restart_required`、`site_activation_required` 和 `applied` 分别提示。 + +## 4. 接口、数据与配置契约 + +- `PUT /api/system/tls/domain` 请求体仍为 `{domain, scheme, port}`，响应增加 `applied` 与 `site_activation_required`；模式接口不变。 +- `GET /api/system/tls` 继续提供配置/运行状态；已完成热更新时 `restart_required=false`。 +- 没有数据库迁移或新配置文件。`VPN_TLS_*` 环境变量仍优先且不能被 UI 覆盖。 + +## 5. 风险与验收 + +| 风险或失败场景 | 防护 / 恢复 | 可观察信号 | +|---|---|---| +| 新入口证书不可用 | 拒绝 HTTPS 切换，旧站点不动 | 4xx 及原证书继续可用 | +| Nginx 校验/重载失败 | 恢复站点并重新 reload；返回错误 | 5xx、`nginx -t`、健康检查 | +| 已连接 OIDC 专线回调旧地址 | 拒绝修改公网地址 | 409 与原专线可用 | +| 旧站点归属不明 | 拒绝覆盖 | 错误提示；人工检查 | + +| AC | 对应需求 | 前置与操作 | 预期结果 | 验证方式 | 结果 | +|---|---|---|---|---|---| +| AC-01 | FR-01, NFR-01 | Nginx HTTPS 已启用，保存相同域名/端口 | 不重启，健康检查可用，状态即时同步 | 单测、实机回归 | 状态更新单测通过；在线保存待验证 | +| AC-02 | FR-02 | 无证书、无效端口或模拟 reload 失败 | 不丢失旧入口、状态不变化 | 单测与配置检查 | 回滚单测通过；在线异常待验证 | +| AC-03 | FR-03 | 尚未启用站点保存，再启用 | 不要求重启；Go 模式仍准确提醒 | 单测、前端构建 | 本地通过；首次启用实机待验证 | +| AC-04 | FR-04 | 有 OIDC 专线运行时修改回调根地址 | 拒绝并保留原站点 | API 模块测试 | 本地拒绝与停用后放行测试通过；在线拒绝路径待验证 | + +## 6. 发布与恢复 + +本地 Go 测试、前端构建通过后提交。若部署，先备份程序/数据库和托管站点，保持 HTTPS 现状，先构建前端和后端，再切换管理进程。核验公网 HTTPS、OIDC 发现、`nginx -t`、OpenVPN 进程与 18080 健康。故障时恢复旧程序和站点并 reload；不删除证书或 `data/`。不计划在线演练切换为 HTTP。 + +## 7. 待决问题 + +| 问题 | 是否阻塞 | 推荐方案 | +|---|---|---| +| 新域名尚无证书时是否自动签发 | 不阻塞即时更新已配置站点 | 拒绝带故障风险的热切换，先通过证书流程准备证书；未来单独设计零停机多域名签发 | diff --git a/frontend/src/locales/en-US.json b/frontend/src/locales/en-US.json index b84b12c..bf351ac 100644 --- a/frontend/src/locales/en-US.json +++ b/frontend/src/locales/en-US.json @@ -900,21 +900,23 @@ "domain": "Configured domain", "activeDomain": "Active domain", "saveDomain": "Save domain", - "restartRequired": "Domain saved; restart OpsX VPN to enable ports 80/443 and automatic issuance", + "restartRequired": "Gateway mode saved; switching between Go and Nginx requires restarting the management service", + "siteActivationRequired": "Entry saved; prepare and enable the Nginx site below for first use", + "applied": "Public entry updated; Nginx configuration is active", "saveFailed": "Could not save domain", "dns": "DNS", "certificate": "Certificate", "valid": "Valid", "pending": "Pending first HTTPS handshake", "notConfigured": "Disabled", - "saved": "Domain configuration saved", + "saved": "Public entry saved", "issuer": "Issuer", "expires": "Expires", "renewal": "Renewal", "automatic": "Automatic (autocert)", "ports": "HTTP / HTTPS ports", "externalPorts": "Managed by external Nginx; listener status not checked", - "setupHint": "Restart to apply a saved domain or mode. Before switching to Nginx, follow the deployment guide to install it, issue a certificate, and validate the configuration. Go mode caches certificates in data/acme; saving settings alone does not issue a certificate.", + "setupHint": "Changes to an active Nginx gateway apply on save. Prepare a certificate for initial setup. Only switching between Go and Nginx modes requires a restart.", "refresh": "Refresh status", "openHttps": "Open HTTPS health check", "loadFailed": "Could not load certificate status", @@ -922,7 +924,7 @@ "goMode": "Go automatic certificate (binds 80/443)", "nginxMode": "Nginx proxy (external 80/443)", "saveMode": "Save entry mode", - "nginxHint": "Save the Nginx mode and domain, restart the service, then enable the site and request a certificate. Public ports 80/443 must be open.", + "nginxHint": "An active Nginx gateway reloads on save. Initial setup requires enabling the site separately; the management service remains on port 18080.", "externalRenewal": "Managed by Certbot", "previewNginx": "Preview Nginx configuration", "previewOnly": "Configuration preview; HTTP handles issuance and HTTPS starts after the certificate exists.", diff --git a/frontend/src/locales/zh-CN.json b/frontend/src/locales/zh-CN.json index 5b2cb52..585e552 100644 --- a/frontend/src/locales/zh-CN.json +++ b/frontend/src/locales/zh-CN.json @@ -900,21 +900,23 @@ "domain": "配置域名", "activeDomain": "当前监听域名", "saveDomain": "保存域名", - "restartRequired": "域名已保存，重启 opsx-vpn 后才会监听 80/443 并启用自动签发", + "restartRequired": "入口模式已保存；切换 Go 与 Nginx 模式需重启管理服务", + "siteActivationRequired": "入口已保存；首次启用站点请到下方准备并启用 Nginx", + "applied": "公网入口已更新，Nginx 配置已生效", "saveFailed": "保存域名失败", "dns": "DNS 解析", "certificate": "证书", "valid": "有效", "pending": "等待首次 HTTPS 请求签发", "notConfigured": "未启用", - "saved": "域名配置已保存", + "saved": "公网入口已保存", "issuer": "颁发者", "expires": "到期时间", "renewal": "续签", "automatic": "自动（autocert）", "ports": "HTTP / HTTPS 端口", "externalPorts": "由外部 Nginx 管理，尚未检测监听状态", - "setupHint": "保存域名或入口模式后需重启生效；切换为 Nginx 前须按部署文档完成安装、证书签发和配置校验。Go 模式证书缓存于 data/acme；保存配置本身不会签发证书。", + "setupHint": "已启用的 Nginx 入口保存后立即生效；首次启用站点需准备证书。只有切换 Go 与 Nginx 模式才需重启。", "refresh": "刷新状态", "openHttps": "打开 HTTPS 健康检查", "loadFailed": "读取证书状态失败", @@ -922,7 +924,7 @@ "goMode": "Go 自动证书（进程监听 80/443）", "nginxMode": "Nginx 代理（外部监听 80/443）", "saveMode": "保存入口模式", - "nginxHint": "选择 Nginx 模式并保存域名后重启服务，再点击启用站点申请证书。端口 80/443 需允许公网访问。", + "nginxHint": "已启用的 Nginx 入口保存后立即重载；首次配置需单独启用站点。管理服务继续监听 18080。", "externalRenewal": "由 Certbot 管理", "previewNginx": "预览 Nginx 配置", "previewOnly": "以下为配置预览；HTTP 站点用于签发，HTTPS 站点在证书存在后启用。", diff --git a/frontend/src/views/settings/components/GatewaySettings.vue b/frontend/src/views/settings/components/GatewaySettings.vue index c71bad5..eea759f 100644 --- a/frontend/src/views/settings/components/GatewaySettings.vue +++ b/frontend/src/views/settings/components/GatewaySettings.vue @@ -54,6 +54,7 @@ + @@ -383,16 +384,22 @@ async function savePublicEntry() { if (!entry.host) return ElMessage.warning(t('tls.hostRequired')) tlsSaving.value = true try { + let modeRes = null + if (entry.mode !== tlsStatus.value?.configured_mode) { + const result = await api.put('/system/tls/mode', { mode: entry.mode }) + modeRes = result.data + } const { data: domainRes } = await api.put('/system/tls/domain', { domain: entry.host, scheme: entry.scheme, port: entry.port, }) tlsStatus.value = domainRes.status - const { data: modeRes } = await api.put('/system/tls/mode', { mode: entry.mode }) - tlsStatus.value = modeRes.status || domainRes.status nginxPreview.value = null - ElMessage.success((domainRes.restart_required || modeRes.restart_required) ? t('tls.restartRequired') : t('tls.saved')) + if (domainRes.restart_required || modeRes?.restart_required) ElMessage.success(t('tls.restartRequired')) + else if (domainRes.site_activation_required) ElMessage.success(t('tls.siteActivationRequired')) + else ElMessage.success(t(domainRes.applied ? 'tls.applied' : 'tls.saved')) + await refreshAll() } catch (e) { ElMessage.error(e.response?.data?.error || t('tls.saveFailed')) } finally { tlsSaving.value = false } }