xiaoquan/rent
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: 使用 Gitea Secrets 管理全部密钥

Browse Source 
- deploy.yml 从 secrets 动态生成 .env，部署后自动删除
- docker-compose.prod.yml 支持全部业务配置注入（短信/微信/支付宝等）
- .env.example 只保留 GITEA_RUNNER_TOKEN，其他密钥全部迁移到 Secrets
- 更新 deploy/README.md 文档，完整列出 Secrets 配置清单

服务器上不再存储任何密码文件，安全性大幅提升

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
xiaoquan
2026-06-01 21:01:22 +08:00
parent 501adf7819
commit b358dbdab1
6 changed files with 117 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/deploy.yml
+44 -8
View File
@@ -66,17 +66,43 @@ jobs:
steps:
- uses: actions/checkout@v4
- name: Generate .env from secrets
run: |
cat > deploy/docker/.env.prod << 'EOF'
PROD_DB_PASSWORD=${{ secrets.PROD_DB_PASSWORD }}
PROD_JWT_SECRET=${{ secrets.PROD_JWT_SECRET }}
PROD_JWT_EXPIRES_IN=${{ secrets.PROD_JWT_EXPIRES_IN }}
PROD_JWT_REFRESH_EXPIRES_IN=${{ secrets.PROD_JWT_REFRESH_EXPIRES_IN }}
PROD_SMS_ACCESS_KEY_ID=${{ secrets.PROD_SMS_ACCESS_KEY_ID }}
PROD_SMS_ACCESS_KEY_SECRET=${{ secrets.PROD_SMS_ACCESS_KEY_SECRET }}
PROD_SMS_SIGN_NAME=${{ secrets.PROD_SMS_SIGN_NAME }}
PROD_SMS_TEMPLATE_CODE=${{ secrets.PROD_SMS_TEMPLATE_CODE }}
PROD_WECHAT_APPID=${{ secrets.PROD_WECHAT_APPID }}
PROD_WECHAT_SECRET=${{ secrets.PROD_WECHAT_SECRET }}
PROD_WECHAT_MCHID=${{ secrets.PROD_WECHAT_MCHID }}
PROD_WECHAT_SERIAL_NO=${{ secrets.PROD_WECHAT_SERIAL_NO }}
PROD_WECHAT_APIV3_KEY=${{ secrets.PROD_WECHAT_APIV3_KEY }}
PROD_WECHAT_PRIVATE_KEY=${{ secrets.PROD_WECHAT_PRIVATE_KEY }}
PROD_WECHAT_PAY_NOTIFY_URL=${{ secrets.PROD_WECHAT_PAY_NOTIFY_URL }}
PROD_WECHAT_REFUND_NOTIFY_URL=${{ secrets.PROD_WECHAT_REFUND_NOTIFY_URL }}
PROD_ALIPAY_APPID=${{ secrets.PROD_ALIPAY_APPID }}
PROD_ALIPAY_PRIVATE_KEY=${{ secrets.PROD_ALIPAY_PRIVATE_KEY }}
PROD_API_BASE_URL=${{ secrets.PROD_API_BASE_URL }}
EOF
chmod 600 deploy/docker/.env.prod
- name: Deploy to production
run: |
echo "部署到生产环境..."
cd deploy/docker
docker-compose -f docker-compose.prod.yml down --remove-orphans
docker-compose -f docker-compose.prod.yml build --parallel
docker-compose -f docker-compose.prod.yml up -d
docker-compose -f docker-compose.prod.yml --env-file .env.prod down --remove-orphans
docker-compose -f docker-compose.prod.yml --env-file .env.prod build --parallel
docker-compose -f docker-compose.prod.yml --env-file .env.prod up -d
docker image prune -f
echo "等待服务启动..."
sleep 10
docker-compose -f docker-compose.prod.yml ps
docker-compose -f docker-compose.prod.yml --env-file .env.prod ps
rm -f .env.prod
deploy-test:
runs-on: [self-hosted, rent-deploy]
@@ -85,14 +111,24 @@ jobs:
steps:
- uses: actions/checkout@v4
- name: Generate .env from secrets
run: |
cat > deploy/docker/.env.test << 'EOF'
TEST_DB_PASSWORD=${{ secrets.TEST_DB_PASSWORD }}
TEST_JWT_SECRET=${{ secrets.TEST_JWT_SECRET }}
TEST_API_BASE_URL=${{ secrets.TEST_API_BASE_URL }}
EOF
chmod 600 deploy/docker/.env.test
- name: Deploy to test
run: |
echo "部署到测试环境..."
cd deploy/docker
docker-compose -f docker-compose.test.yml down --remove-orphans
docker-compose -f docker-compose.test.yml build --parallel
docker-compose -f docker-compose.test.yml up -d
docker-compose -f docker-compose.test.yml --env-file .env.test down --remove-orphans
docker-compose -f docker-compose.test.yml --env-file .env.test build --parallel
docker-compose -f docker-compose.test.yml --env-file .env.test up -d
docker image prune -f
echo "等待服务启动..."
sleep 10
docker-compose -f docker-compose.test.yml ps
docker-compose -f docker-compose.test.yml --env-file .env.test ps
rm -f .env.test