zkxw/scripts/package-docker-deploy.sh

#!/usr/bin/env bash
# 打包 Docker 交付物：预构建应用镜像 + compose + 数据库 SQL（不含前后端源码）
# 目标运行环境：甲方 Linux x86_64 云主机（固定 linux/amd64，与发版机 macOS/ARM 无关）
set -euo pipefail

ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
cd "$ROOT"

# 交付镜像架构（甲方云主机默认 amd64；勿改为 arm64 除非已确认对方为 ARM 云）
export DOCKER_PLATFORM=linux/amd64
export DOCKER_BUILDKIT=1

VERSION="${1:-$(date +%Y%m%d)}"
OUT_DIR="${ROOT}/dist"
PKG_NAME="zkxw-docker-deploy-${VERSION}"
STAGING="${OUT_DIR}/${PKG_NAME}"
ARCHIVE="${OUT_DIR}/${PKG_NAME}.tar.gz"
IMAGES_TAR="${STAGING}/images/zkxw-app-images.tar"

BACKEND_IMAGE="zkxw-backend:${VERSION}"
WEB_IMAGE="zkxw-web:${VERSION}"

echo "==> [1/4] 构建应用镜像（平台 ${DOCKER_PLATFORM}，供 Linux 云主机）"
"${ROOT}/scripts/build-docker-images.sh" "${VERSION}"

echo "==> [2/4] 导出镜像到 tar"
rm -rf "${STAGING}"
mkdir -p "${STAGING}/images" "${STAGING}/deploy/docker" "${STAGING}/docs/sql"

docker save -o "${IMAGES_TAR}" "${BACKEND_IMAGE}" "${WEB_IMAGE}"

echo "==> [3/4] 组装部署文件（无 backend/ web-admin 源码）"
cp "${ROOT}/deploy/docker/docker-compose.yml" "${STAGING}/deploy/docker/"
sed -e "s|^ZKXW_BACKEND_IMAGE=.*|ZKXW_BACKEND_IMAGE=${BACKEND_IMAGE}|" \
    -e "s|^ZKXW_WEB_IMAGE=.*|ZKXW_WEB_IMAGE=${WEB_IMAGE}|" \
    "${ROOT}/deploy/docker/.env.example" > "${STAGING}/deploy/docker/.env.example"

# 若本地 deploy/docker/.env 已配置登录 RSA 私钥，注入到交付包 .env.example（避免多 worker 登录解密失败）
LOCAL_ENV="${ROOT}/deploy/docker/.env"
if [[ -f "${LOCAL_ENV}" ]]; then
  STAGING_ENV="${STAGING}/deploy/docker/.env.example"
  if python3 - "${LOCAL_ENV}" "${STAGING_ENV}" <<'PY'
import sys
from pathlib import Path

local_env, staging_env = map(Path, sys.argv[1:3])
rsa_line = next(
    (line for line in local_env.read_text().splitlines() if line.startswith("LOGIN_RSA_PRIVATE_KEY_PEM=")),
    "",
)
if not rsa_line:
    sys.exit(2)

lines: list[str] = []
for line in staging_env.read_text().splitlines():
    if line.startswith("# LOGIN_RSA_PRIVATE_KEY_PEM=") or line.startswith("LOGIN_RSA_PRIVATE_KEY_PEM="):
        continue
    if line.startswith("# 登录 RSA"):
        lines.append(
            "# 登录 RSA（多 worker/多实例须配置同一私钥；打包时已从 deploy/docker/.env 注入）"
        )
        continue
    if line.startswith("API_REQUEST_LOG_ENABLED="):
        lines.append(rsa_line)
    lines.append(line)

staging_env.write_text("\n".join(lines) + "\n")
PY
  then
    echo "    已从 deploy/docker/.env 注入 LOGIN_RSA_PRIVATE_KEY_PEM"
  elif [[ $? -eq 2 ]]; then
    echo "    警告: deploy/docker/.env 未配置 LOGIN_RSA_PRIVATE_KEY_PEM，交付包内仍为占位；多 worker 下登录可能失败"
  else
    echo "    错误: 注入 LOGIN_RSA_PRIVATE_KEY_PEM 失败" >&2
    exit 1
  fi
fi
cp "${ROOT}/deploy/docker/README.md" "${STAGING}/deploy/docker/"
cp -R "${ROOT}/deploy/docker/mysql" "${STAGING}/deploy/docker/"
cp "${ROOT}/docs/sql/zkxw.sql" "${STAGING}/docs/sql/zkxw.sql"

cp "${ROOT}/deploy/docker/README.md" "${STAGING}/部署说明.md"
cp "${ROOT}/deploy/docker/部署指导手册.html" "${STAGING}/部署指导手册.html"
cp "${ROOT}/deploy/docker/部署指导手册.html" "${STAGING}/deploy/docker/部署指导手册.html"

cat > "${STAGING}/VERSION.txt" <<EOF
package=${PKG_NAME}
version=${VERSION}
platform=${DOCKER_PLATFORM}
backend_image=${BACKEND_IMAGE}
web_image=${WEB_IMAGE}
built_at=$(date -Iseconds)
git_commit=$(git -C "${ROOT}" rev-parse --short HEAD 2>/dev/null || echo unknown)
deploy_dir=deploy/docker
EOF

echo "==> [4/4] 生成压缩包"
mkdir -p "${OUT_DIR}"
tar -czf "${ARCHIVE}" -C "${OUT_DIR}" "${PKG_NAME}"

echo ""
echo "完成: ${ARCHIVE}"
echo "应用镜像: $(du -h "${IMAGES_TAR}" | cut -f1)"
echo "总包大小: $(du -h "${ARCHIVE}" | cut -f1)"
echo ""
echo "包内不含前后端源码，包含:"
echo "  - images/zkxw-app-images.tar"
echo "  - deploy/docker/ (compose + .env.example + mysql init)"
echo "  - docs/sql/zkxw.sql"
echo "  - 部署指导手册.html（客户安装手册，浏览器打开）"
echo ""
echo "甲方服务器执行:"
echo "  tar -xzf ${PKG_NAME}.tar.gz"
echo "  cd ${PKG_NAME}"
echo "  docker load -i images/zkxw-app-images.tar"
echo "  cd deploy/docker && cp .env.example .env && vim .env"
echo "  docker compose up -d"