lzwlab_cn/deploy_transfer.py

"""将 lzwlab.cn 文件快传部署到远程服务器（幂等，可重复执行）。

用法（凭据从 Authentication.md 解析；应用登录密码通过环境变量传入，不落盘）：

    LZWLAB_APP_PASSWORD='你的应用登录密码' python deploy_transfer.py --username admin

服务器端安装：
  - apt 安装 python3-flask、gunicorn
  - 应用代码安装到 /opt/lzwlab-transfer（root 所有）
  - 运行用户 lzwlab（systemd 服务，监听 127.0.0.1:8090）
  - 数据目录 /var/lib/lzwlab-transfer，配置 /etc/lzwlab-transfer/config.json（密码仅存 scrypt 哈希）
  - systemd 定时器每 10 分钟清理过期文件
  - 更新 nginx 反代配置与首页链接
"""
import argparse
import json
import os
import re
import sys
import time

import paramiko

ROOT = os.path.dirname(os.path.abspath(__file__))
sys.path.insert(0, os.path.join(ROOT, "transfer"))
import auth  # noqa: E402

REMOTE_TMP = "/tmp/lzwlab-transfer-deploy"
APP_DIR = "/opt/lzwlab-transfer"
DATA_DIR = "/var/lib/lzwlab-transfer"
CONFIG_PATH = "/etc/lzwlab-transfer/config.json"
LOG_DIR = "/var/log/lzwlab-transfer"
SERVICE_USER = "lzwlab"
PORT = 8090

LOCAL_FILES = [
    ("transfer/app.py", "app.py"),
    ("transfer/auth.py", "auth.py"),
    ("transfer/storage.py", "storage.py"),
    ("transfer/cleanup.py", "cleanup.py"),
    ("transfer/templates/index.html", "templates/index.html"),
]
SYSTEMD_FILES = [
    ("transfer/systemd/lzwlab-transfer.service", "lzwlab-transfer.service"),
    ("transfer/systemd/lzwlab-transfer-cleanup.service", "lzwlab-transfer-cleanup.service"),
    ("transfer/systemd/lzwlab-transfer-cleanup.timer", "lzwlab-transfer-cleanup.timer"),
]


def parse_auth() -> tuple[str, str, str]:
    text = open(os.path.join(ROOT, "Authentication.md"), encoding="utf-8").read()
    def find(label: str) -> str:
        m = re.search(label + r"\s*[:：]\s*(\S+)", text)
        if not m:
            sys.exit("无法解析 Authentication.md 中的 " + label)
        return m.group(1)
    return find("IP地址"), find("用户名"), find("密码")


def connect(ip: str, user: str, pw: str) -> paramiko.SSHClient:
    cli = paramiko.SSHClient()
    cli.set_missing_host_key_policy(paramiko.AutoAddPolicy())
    cli.connect(ip, port=22, username=user, password=pw, timeout=20,
                look_for_keys=False, allow_agent=False, banner_timeout=30)
    return cli


def run(ssh: paramiko.SSHClient, cmd: str, timeout: int = 600) -> tuple[int, str, str]:
    print("  $ " + cmd)
    _in, out, err = ssh.exec_command(cmd, timeout=timeout)
    out_s = out.read().decode("utf-8", "replace")
    err_s = err.read().decode("utf-8", "replace")
    code = out.channel.recv_exit_status()
    if out_s.strip():
        print(out_s.strip())
    if err_s.strip():
        print("[stderr]", err_s.strip())
    return code, out_s, err_s


def must(ssh: paramiko.SSHClient, cmd: str, timeout: int = 600) -> str:
    code, out, err = run(ssh, cmd, timeout)
    if code != 0:
        sys.exit("命令失败（exit=%d）：%s" % (code, cmd))
    return out


def sftp_mkdir_p(sftp: paramiko.SFTPClient, remote_dir: str) -> None:
    try:
        sftp.stat(remote_dir)
    except IOError:
        parent = os.path.dirname(remote_dir.rstrip("/"))
        if parent and parent != remote_dir:
            sftp_mkdir_p(sftp, parent)
        sftp.mkdir(remote_dir)


def upload(ssh: paramiko.SSHClient, local: str, remote: str) -> None:
    print("  [upload] %s -> %s" % (local, remote))
    sftp = ssh.open_sftp()
    try:
        sftp_mkdir_p(sftp, os.path.dirname(remote))
        sftp.put(os.path.join(ROOT, local), remote)
    finally:
        sftp.close()


def main() -> None:
    ap = argparse.ArgumentParser()
    ap.add_argument("--username", default="admin", help="应用登录用户名（默认 admin）")
    ap.add_argument("--password-env", default="LZWLAB_APP_PASSWORD",
                    help="应用登录密码所在的环境变量名")
    ap.add_argument("--skip-apt", action="store_true", help="跳过 apt 安装依赖")
    args = ap.parse_args()

    password = os.environ.get(args.password_env, "")
    if len(password) < 8:
        sys.exit("请通过环境变量 %s 提供至少 8 位的应用登录密码" % args.password_env)

    ip, ssh_user, ssh_pw = parse_auth()
    print("目标服务器：%s@%s" % (ssh_user, ip))
    ssh = connect(ip, ssh_user, ssh_pw)
    try:
        # 1. 依赖
        if not args.skip_apt:
            code, _, err = run(ssh, "sudo -n env DEBIAN_FRONTEND=noninteractive "
                                    "apt-get install -y python3-flask gunicorn", timeout=900)
            if code != 0:
                print("直接安装失败，尝试先 apt-get update …")
                must(ssh, "sudo -n apt-get update -qq", timeout=900)
                must(ssh, "sudo -n env DEBIAN_FRONTEND=noninteractive "
                          "apt-get install -y python3-flask gunicorn", timeout=900)

        # 2. 目录、运行用户与数据目录
        must(ssh, "sudo -n mkdir -p %s %s/templates %s/files %s /etc/lzwlab-transfer"
             % (APP_DIR, APP_DIR, DATA_DIR, LOG_DIR))
        code, _, _ = run(ssh, "id -u %s >/dev/null 2>&1" % SERVICE_USER)
        if code != 0:
            must(ssh, "sudo -n useradd --system --home-dir %s --shell /usr/sbin/nologin %s"
                 % (APP_DIR, SERVICE_USER))
        must(ssh, "sudo -n chown -R %s:%s %s %s" % (SERVICE_USER, SERVICE_USER, DATA_DIR, LOG_DIR))
        must(ssh, "sudo -n chmod 750 %s" % LOG_DIR)
        must(ssh, "sudo -n rm -rf %s && mkdir -p %s" % (REMOTE_TMP, REMOTE_TMP))

        # 3. 上传应用文件
        for local, name in LOCAL_FILES:
            upload(ssh, local, "%s/%s" % (REMOTE_TMP, name))
        for local, name in SYSTEMD_FILES:
            upload(ssh, local, "%s/systemd/%s" % (REMOTE_TMP, name))
        upload(ssh, "index.html", "%s/index.html" % REMOTE_TMP)
        upload(ssh, "lzwlab.nginx.conf", "%s/lzwlab.cn.conf" % REMOTE_TMP)

        # 4. 生成配置（仅包含密码哈希，不保存明文）
        cfg = {
            "secret_key": auth.random_secret(),
            "cookie_secure": True,
            "max_content_length": 5 * 1024 ** 3,
            "data_dir": DATA_DIR,
            "database_path": DATA_DIR + "/files.db",  # 远端为 Linux 路径，不能用 Windows 的 os.path.join
            "session_days": 7,
            "users": {
                args.username: {"password_hash": auth.hash_password(password)}
            },
        }
        print("  [generate] 应用配置（用户：%s）" % args.username)
        sftp = ssh.open_sftp()
        try:
            with sftp.open("%s/config.json" % REMOTE_TMP, "w") as fh:
                fh.write(json.dumps(cfg, ensure_ascii=False, indent=2))
        finally:
            sftp.close()

        # 5. 安装应用、配置与 systemd
        for _, name in LOCAL_FILES:
            must(ssh, "sudo -n install -m 644 -o root -g root %s/%s %s/%s"
                 % (REMOTE_TMP, name, APP_DIR, name))
        must(ssh, "sudo -n install -m 640 -o root -g %s %s/config.json %s"
             % (SERVICE_USER, REMOTE_TMP, CONFIG_PATH))
        for _, name in SYSTEMD_FILES:
            must(ssh, "sudo -n install -m 644 -o root -g root %s/systemd/%s /etc/systemd/system/%s"
                 % (REMOTE_TMP, name, name))
        must(ssh, "sudo -n install -m 644 -o root -g root %s/index.html /var/www/lzwlab.cn/index.html"
             % REMOTE_TMP)
        must(ssh, "sudo -n install -m 644 -o root -g root %s/lzwlab.cn.conf "
                  "/etc/nginx/sites-available/lzwlab.cn" % REMOTE_TMP)

        # 6. 启动服务与定时器
        must(ssh, "sudo -n systemctl daemon-reload")
        must(ssh, "sudo -n systemctl enable --now lzwlab-transfer.service lzwlab-transfer-cleanup.timer")
        must(ssh, "sudo -n systemctl restart lzwlab-transfer.service")
        must(ssh, "sudo -n systemctl enable lzwlab-transfer-cleanup.timer && "
                  "sudo -n systemctl start lzwlab-transfer-cleanup.timer")
        time.sleep(1)

        # 7. 校验并重载 nginx
        must(ssh, "sudo -n nginx -t")
        must(ssh, "sudo -n systemctl reload nginx")
        must(ssh, "sudo -n rm -rf %s" % REMOTE_TMP)

        print()
        print("== 部署完成，服务状态 ==")
        run(ssh, "systemctl is-active lzwlab-transfer.service lzwlab-transfer-cleanup.timer")
        run(ssh, "curl -s -o /dev/null -w 'local https /transfer/ => %{http_code}\n' "
                 "-k https://127.0.0.1/transfer/ -H 'Host: lzwlab.cn'")
        print("应用入口：https://lzwlab.cn/transfer/")
        print("登录用户：%s（密码为环境变量 %s 中提供的值）" % (args.username, args.password_env))
    finally:
        ssh.close()


if __name__ == "__main__":
    main()