.woodpecker.yaml

@@ -1,14 +1,9 @@
-# 第 95 次部署
+# 第 89 次部署
+# 💡 全局变量块
 variables:
-  # --- 仓库与私服配置 ---
+  - &APP_REGISTRY "push.lovestory.cyou"
-  - &APP_REGISTRY "push.lovestory.cyou"                    # 推送镜像的私服域名
+  - &APP_PULL_REGISTRY "registry.lovestory.cyou"
-  - &APP_PULL_REGISTRY "registry.lovestory.cyou"            # 拉取基础镜像的私服域名
+  - &PROJECT_NAME "abhors/demo"
-  - &PROJECT_NAME "abhors/demo"                            # 项目镜像路径与名称
-  - &PROJECT_PORT "8080"                                   # 运行及映射端口
-  - &FULL_PUSH_REPO "push.lovestory.cyou/abhors/demo"      # 拼接后的完整推送地址
-  - &FULL_PULL_REPO "push.lovestory.cyou/abhors/demo:latest" # 远程部署拉取的目标地址
-
-  # --- 部署目标机配置 ---
   - &CONTAINER_NAME "demo-container"
   - &DEPLOY_HOST "43.143.243.136"
   - &DEPLOY_PORT "22"
@@ -28,34 +23,34 @@ steps:
       branch: master
 
   - name: 官方标准构建与推送 (宿主机物理硬缓存版)
-    image: docker.m.daocloud.io/woodpeckerci/plugin-docker-buildx:latest-insecure
+    image: woodpeckerci/plugin-docker-buildx:latest-insecure
-    privileged: true
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
+    privileged: true
     settings:
-      repo: *FULL_PUSH_REPO
+      insecure: true
-      registry: *APP_REGISTRY
+      repo: push.lovestory.cyou/abhors/demo
+      registry: push.lovestory.cyou
       username:
         from_secret: nexus_docker_username
       password:
         from_secret: nexus_docker_password
-      mirror: https://registry.lovestory.cyou
+      mirror: http://registry.lovestory.cyou
+      buildkit_config: |
+        [registry."docker.io"]
+          mirrors = ["docker.1ms.run", "dockerpull.org", "1ms.run"]
+        [registry."push.lovestory.cyou"]
+          http = true
+          insecure = true
+        [registry."registry.lovestory.cyou"]
+          http = true
+          insecure = true
     when:
       event: push
       branch: master
 
   - name: 远程终端部署
-    image: registry.lovestory.cyou/appleboy/drone-ssh:latest
+    image: push.lovestory.cyou/appleboy/drone-ssh:latest
-
-    # 💡 遵循官方文档指引 Step 1：必须在最外层写 environment 块，且必须全部大写！
-    # 把我们顶部的 YAML 锚点变量，在这里全部转化为系统大写环境变量
-    environment:
-      REMOTE_HOST: *DEPLOY_HOST
-      CONTAINER_NAME: *CONTAINER_NAME
-      FULL_PULL_REPO: *FULL_PULL_REPO
-      APP_REGISTRY: *APP_REGISTRY
-      PROJECT_PORT: *PROJECT_PORT
-
     settings:
       host: *DEPLOY_HOST
       port: *DEPLOY_PORT
@@ -63,31 +58,17 @@ steps:
         from_secret: *DEPLOY_USER_SECRET
       password:
         from_secret: *DEPLOY_PASS_SECRET
-      secrets: [ nexus_docker_username, nexus_docker_password ] # 这俩属于私密Secret，直接进通道
+      secrets: [ nexus_docker_username, nexus_docker_password ]
-
+      envs: [ nexus_docker_username, nexus_docker_password ]
-      # 💡 遵循官方文档指引 Step 2：在 envs 里声明上面这些变量的名字（不区分大小写，插件会自动大写）
-      # 这样插件就会把这些变量强行同步到远程主机的 SSH 终端进程里
-      envs:
-        - remote_host
-        - container_name
-        - full_pull_repo
-        - app_registry
-        - project_port
-        - nexus_docker_username
-        - nexus_docker_password
-
-      # 💡 遵循官方文档指引 Step 3：在脚本里统一改用标准的 $大写 符号来吃环境变量
       script:
         - echo "========================================="
-        - echo "🚀 开始部署节点：$REMOTE_HOST"   # 👈 严格按文档走，100% 能打印出 IP
+        - echo "🚀 开始部署节点：*DEPLOY_HOST"
         - echo "========================================="
-
+        - docker login --username "$nexus_docker_username" --password "$nexus_docker_password" "push.lovestory.cyou"
-        # 所有的参数均在远程机器通过系统大写变量精准传参
+        - docker stop "demo-container" || true
-        - docker login --username "$nexus_docker_username" --password "$nexus_docker_password" "$APP_REGISTRY"
+        - docker rm "demo-container" || true
-        - docker stop "$CONTAINER_NAME" || true
+        - docker pull "push.lovestory.cyou/abhors/demo:latest"
-        - docker rm "$CONTAINER_NAME" || true
+        - docker run -d --name "demo-container" -p 8080:8080 --restart always "push.lovestory.cyou/abhors/demo:latest"
-        - docker pull "$FULL_PULL_REPO"
-        - docker run -d --name "$CONTAINER_NAME" -p "$PROJECT_PORT":"$PROJECT_PORT" --restart always "$FULL_PULL_REPO"
     when:
       event: push
       branch: master

dockercompose/gitea/docker-compose.yml

@@ -1,20 +0,0 @@
-#docker-compose.yml
-services:
-  gitea:
-    image: gitea/gitea:1.21.7
-    container_name: gitea
-    restart: always
-    environment:
-      - USER_UID=1000
-      - USER_GID=1000
-      - GITEA__server__DOMAIN=gitea.lovestory.cyou
-      - GITEA__server__SSH_DOMAIN=gitea.lovestory.cyou
-      - GITEA__server__ROOT_URL=http://gitea.lovestory.cyou/
-    volumes:
-      # 所有代码、用户数据、自带的 SQLite 数据库文件，全都会存在本地的 ./gitea-data 文件夹里
-      - ./gitea-data:/data
-      - /etc/timezone:/etc/timezone:ro
-      - /etc/localtime:/etc/localtime:ro
-    ports:
-      - "3000:3000" # 网页访问端口
-      - "2222:22"   # SSH 克隆代码端口

dockercompose/nexus/cmd.sh

@@ -1,4 +0,0 @@
-#!/bin/bash
-# 启动nexus需要先给目录权限否则启动不了
-mkdir nexus-data
-chown -R 200:200 nexus-data

dockercompose/nexus/docker-compose.yml

@@ -1,14 +0,0 @@
-services:
-  nexus:
-    image: sonatype/nexus3:latest
-    container_name: nexus
-    restart: always
-    ports:
-      - "8081:8081"
-      - "8082:8082"
-      - "8083:8083"
-    volumes:
-      - ./nexus-data:/nexus-data
-    environment:
-      # Nexus 默认比较吃内存，如果服务器配置有限，建议限制其 JVM 内存，1G~2G 即可
-      - INSTALL4J_ADD_VM_PARAMS=-Xms1g -Xmx1g -XX:MaxDirectMemorySize=1g

dockercompose/nginx/docker-compose.yml

@@ -1,17 +0,0 @@
-services:
-  nginx:
-    image: nginx:latest
-    container_name: nginx
-    restart: always
-    ports:
-      - "80:80"
-      - "443:443"
-    volumes:
-      # 完全按照你的原版物理路径映射
-      - /opt/docker/nginx/logs:/etc/nginx/logs
-      - /opt/docker/nginx/html:/etc/nginx/html
-      - /opt/docker/nginx/cert:/etc/nginx/cert
-      - /opt/docker/nginx/conf:/etc/nginx/conf
-
-      # 核心主配置文件（确保执行过刚才的拷贝，宿主机上有这个文件）
-      - /opt/docker/nginx/conf/nginx.conf:/etc/nginx/nginx.conf

dockercompose/woodpecker/docker-compose.yml

@@ -1,42 +0,0 @@
-services:
-  woodpecker-server:
-    image: woodpeckerci/woodpecker-server:v3
-    ports:
-      - 8000:8000
-    volumes:
-      - woodpecker-server-data:/var/lib/woodpecker/
-    restart: always
-    environment:
-      - WOODPECKER_OPEN=true
-      - WOODPECKER_HOST=https://lovestory.cyou
-      # 👇 加上这行，把 abhors 换成你真正的 GitHub 用户名（注意大小写敏感）
-      - WOODPECKER_ADMIN=abhors
-      - WOODPECKER_AGENT_SECRET=2f26c6a0e97e00c65a9e89fc39a95be532c19cb600c53fa555eada297c3569cb
-      #      - WOODPECKER_GITHUB=true
-      #      - WOODPECKER_GITHUB_CLIENT=Ov23liStAMZlR7jk5kiT
-      #      - WOODPECKER_GITHUB_SECRET=2157f7be71f2a6c91d6a859c622a29b1e1af3951
-
-      - WOODPECKER_GITEA=true
-      - WOODPECKER_GITEA_URL=https://gitea.lovestory.cyou
-      - WOODPECKER_GITEA_CLIENT=718dc249-2edc-4edd-8bc9-06ba569c2007
-      - WOODPECKER_GITEA_SECRET=gto_zovinkqbrekitnhoiez5376dhzkccvz7253ndyaxqjq2gcb2okdq
-
-  woodpecker-agent:
-    image: woodpeckerci/woodpecker-agent:v3
-    # v3 版本中，通常不需要显式写 command: agent，镜像默认就是 agent 运行
-    restart: always
-    privileged: true
-    depends_on:
-      - woodpecker-server
-    volumes:
-      - woodpecker-agent-config:/etc/woodpecker
-      - /var/run/docker.sock:/var/run/docker.sock
-    environment:
-      - WOODPECKER_SERVER=woodpecker-server:9000
-      - WOODPECKER_AGENT_SECRET=2f26c6a0e97e00c65a9e89fc39a95be532c19cb600c53fa555eada297c3569cb
-      # 👇 关键：特权插件白名单环境变量必须配置在 Agent 端，而不是 Server 端
-      - WOODPECKER_PLUGINS_PRIVILEGED=*,plugins/docker,docker.io/plugins/docker,plugins/docker:latest
-
-volumes:
-  woodpecker-server-data:
-  woodpecker-agent-config:

nginx/conf/conf.d/gitea.lovestory.cyou.conf-https

@@ -1,18 +0,0 @@
-server {
-    listen 443 ssl;
-    server_name gitea.lovestory.cyou;
-
-    ssl_certificate /etc/nginx/cert/gitea.lovestory.cyou.pem;
-    ssl_certificate_key /etc/nginx/cert/gitea.lovestory.cyou.key;
-
-    client_max_body_size 0;
-    chunked_transfer_encoding on;
-
-    location / {
-        proxy_pass http://172.29.114.102:3000;
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header REMOTE-HOST $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-    }
-}

nginx/conf/conf.d/push.lovestory.cyou.conf-http

@@ -1,17 +0,0 @@
-server {
-    listen       80;
-    server_name  push.lovestory.cyou; # 👈 走纯 HTTP
-
-    client_max_body_size 0;
-
-    location / {
-        proxy_pass http://10.2.0.14:8083; # 转发到 Nexus 宿主私有仓端口
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-
-        proxy_set_header Authorization $http_authorization;
-        proxy_pass_header Authorization;
-    }
-}

nginx/conf/conf.d/push.lovestory.cyou.conf-https

@@ -1,32 +0,0 @@
-server {
-    listen 80;
-    server_name push.lovestory.cyou;
-    
-    # 💡 顺手把所有的 80 纯 HTTP 流量全部强转到 443 HTTPS，彻底顺了 BuildKit 的心愿
-    return 301 https://$host$request_uri;
-}
-
-server {
-    listen 443 ssl; # 👈 开启正规的 SSL 监听，满足它的 HTTPS 强迫症
-    server_name push.lovestory.cyou;
-
-    # 💡 挂载刚才生成的自签名证书
-    ssl_certificate /etc/nginx/cert/push.lovestory.cyou.pem;
-    ssl_certificate_key /etc/nginx/cert/push.lovestory.cyou.key;
-
-    # 优化配置，防止大镜像层上传超时或被拦截
-    client_max_body_size 0;
-    chunked_transfer_encoding on;
-
-    location / {
-        # 💡 这里填写你 Nexus 服务的真实本地内网地址和端口（比如 8081）
-        proxy_pass http://10.2.0.14:8083; 
-        
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        
-        # 💡 极其重要：告诉后端的 Nexus，现在前端套了 HTTPS，让 Nexus 别乱报异常
-        proxy_set_header X-Forwarded-Proto https; 
-    }
-}

nginx/conf/conf.d/registry.lovestory.cyou-http

@@ -1,15 +0,0 @@
-server {
-    listen       80;
-    server_name  registry.lovestory.cyou; # 👈 走纯 HTTP
-
-    # 🚨 极其重要：解除 Nginx 默认的 1M 上传限制
-    client_max_body_size 0;
-
-    location / {
-        proxy_pass http://10.2.0.14:8082; # 转发到 Nexus 组仓库端口
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme; # 自动适配当前协议
-    }
-}

nginx/conf/conf.d/registry.lovestory.cyou.conf-https

@@ -1,24 +0,0 @@
-server {
-    listen 443 ssl; # 👈 开启正规的 SSL 监听，满足它的 HTTPS 强迫症
-    server_name registry.lovestory.cyou;
-
-    # 💡 挂载刚才生成的自签名证书
-    ssl_certificate /etc/nginx/cert/registry.lovestory.cyou.pem;
-    ssl_certificate_key /etc/nginx/cert/registry.lovestory.cyou.key;
-
-    # 优化配置，防止大镜像层上传超时或被拦截
-    client_max_body_size 0;
-    chunked_transfer_encoding on;
-
-    location / {
-        # 💡 这里填写你 Nexus 服务的真实本地内网地址和端口（比如 8081）
-        proxy_pass http://10.2.0.14:8082;
-
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-
-        # 💡 极其重要：告诉后端的 Nexus，现在前端套了 HTTPS，让 Nexus 别乱报异常
-        proxy_set_header X-Forwarded-Proto https;
-    }
-}

nginx/conf/conf.d/woodpecker.lovestory.cyou.conf-https

@@ -1,18 +0,0 @@
-server {
-    listen 443 ssl;
-    server_name woodpecker.lovestory.cyou;
-
-    ssl_certificate /etc/nginx/cert/woodpecker.lovestory.cyou.pem;
-    ssl_certificate_key /etc/nginx/cert/woodpecker.lovestory.cyou.key;
-
-    client_max_body_size 0;
-    chunked_transfer_encoding on;
-
-    location / {
-        proxy_pass http://172.29.114.102:8000;
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header REMOTE-HOST $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-    }
-}

nginx/conf/nginx.conf

@@ -1,56 +0,0 @@
-worker_processes  auto;
-
-events {
-
-    # worker_connections  1024;
-    worker_connections  20480;
-
-}
-
-http {
-    include       mime.types;
-    default_type  application/octet-stream;
-    sendfile        on;
-    keepalive_timeout  65;
-
-    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
-                      '$status $body_bytes_sent "$http_referer" '
-                      '"$http_user_agent" "$http_x_forwarded_for"';
-
-    # 建议改用绝对路径，防止容器找不到 logs 目录
-    access_log  /etc/nginx/logs/access.log  main;
-
-    # 💡 关键：WebSocket 支持
-    map $http_upgrade $connection_upgrade {
-        default upgrade;
-        ''      close;
-    }
-
-    server_names_hash_bucket_size  128;
-    client_header_buffer_size   32k;
-    large_client_header_buffers 4 32k;
-    client_max_body_size 1024m;
-    proxy_connect_timeout 60;
-    proxy_read_timeout 300;
-    proxy_send_timeout 300;
-
-    fastcgi_buffers 8 128k;
-    send_timeout       300;
-    client_header_timeout 300;
-    client_body_timeout  300;
-    reset_timedout_connection  on;
-
-    # --- Gzip 配置开始 ---
-    gzip  on;
-    gzip_min_length    1k;
-    gzip_buffers       4 16k;
-    gzip_http_version  1.1;
-    gzip_comp_level    2;
-    gzip_types         text/plain application/x-javascript text/css application/xml image/png application/zip application/x-shockwave-flash application/javascript application/json;
-    gzip_disable "MSIE [1-6]\.";
-    gzip_vary          on;
-    # --- Gzip 配置结束 ---
-
-    # 引入子配置文件
-    include /etc/nginx/conf/conf.d/*.conf;
-}