first commit

2026-06-20 14:22:31 +08:00
commit c2498911ab
793 changed files with 291660 additions and 0 deletions
@@ -0,0 +1,759 @@
+#!/usr/bin/env bash
+# ============================================================================
+# Incudal 面板一键部署脚本（Docker 模式）
+#
+# 功能：
+#   - 自动安装 Docker Engine 和 Docker Compose
+#   - 从 GitHub Container Registry (ghcr.io) 拉取预构建镜像
+#   - 自动配置 docker-compose.yml、环境变量
+#   - PostgreSQL 16 + Redis 7 全容器化运行
+#   - 支持 Nginx+Certbot / Cloudflare Tunnel / 纯端口 三种外部访问方案
+#   - 支持升级和卸载
+#
+# 用法：
+#   安装：  sudo bash install-docker.sh
+#   升级：  sudo bash install-docker.sh --upgrade
+#   卸载：  sudo bash install-docker.sh --uninstall
+#
+# 项目地址: https://github.com/0xdabiaoge/incudal
+# ============================================================================
+set -euo pipefail
+
+# ========================== 全局常量 ==========================
+readonly SCRIPT_VERSION="1.0.0"
+readonly GITHUB_REPO="0xdabiaoge/incudal"
+readonly DOCKER_IMAGE="ghcr.io/${GITHUB_REPO}"
+readonly INSTALL_DIR="/opt/incudal"
+readonly ENV_FILE="${INSTALL_DIR}/.env"
+readonly COMPOSE_FILE="${INSTALL_DIR}/docker-compose.yml"
+readonly DEFAULT_PORT=3000
+
+# ========================== 颜色定义 ==========================
+readonly RED='\033[1;31m'
+readonly GREEN='\033[1;32m'
+readonly YELLOW='\033[1;33m'
+readonly CYAN='\033[1;36m'
+readonly BOLD='\033[1m'
+readonly DIM='\033[2m'
+readonly NC='\033[0m'
+
+# ========================== 工具函数 ==========================
+# 所有日志输出到 stderr，避免在 $() 子 shell 中被捕获
+log()   { echo -e "${GREEN}[✓]${NC} $1" >&2; }
+info()  { echo -e "${CYAN}[i]${NC} $1" >&2; }
+warn()  { echo -e "${YELLOW}[!]${NC} $1" >&2; }
+error() { echo -e "${RED}[✗]${NC} $1" >&2; }
+step()  { echo -e "\n${CYAN}[▶]${NC} ${BOLD}$1${NC}" >&2; }
+
+divider() {
+    echo -e "${DIM}────────────────────────────────────────────────────${NC}" >&2
+}
+
+# 生成随机密码
+gen_password() {
+    openssl rand -hex 64 | cut -c "1-${1:-24}"
+}
+
+gen_secret() {
+    printf 'A1!%s' "$(openssl rand -hex 64)" | cut -c "1-${1:-48}"
+}
+
+get_env_value() {
+    local key="$1"
+    if [[ ! -f "$ENV_FILE" ]]; then
+        return 0
+    fi
+    grep -E "^${key}=" "$ENV_FILE" 2>/dev/null | tail -n 1 | cut -d'=' -f2- || true
+}
+
+set_env_if_missing() {
+    local key="$1"
+    local value="$2"
+    local label="$3"
+    local current
+    current="$(get_env_value "$key")"
+
+    if [[ -n "$current" ]]; then
+        return 0
+    fi
+
+    if grep -qE "^${key}=" "$ENV_FILE" 2>/dev/null; then
+        local tmp_file
+        tmp_file="$(mktemp)"
+        awk -v key="$key" -v value="$value" '
+            BEGIN { replaced = 0 }
+            $0 ~ "^" key "=" && replaced == 0 {
+                print key "=" value
+                replaced = 1
+                next
+            }
+            { print }
+        ' "$ENV_FILE" > "$tmp_file"
+        cat "$tmp_file" > "$ENV_FILE"
+        rm -f "$tmp_file"
+    else
+        printf '\n%s=%s\n' "$key" "$value" >> "$ENV_FILE"
+    fi
+
+    log "已自动补充 ${label}: ${key}"
+}
+
+ensure_env_keys() {
+    if [[ ! -f "$ENV_FILE" ]]; then
+        return 0
+    fi
+
+    set_env_if_missing "POSTGRES_PASSWORD" "$(gen_password 24)" "PostgreSQL 密码"
+    set_env_if_missing "REDIS_PASSWORD" "$(gen_password 24)" "Redis 密码"
+    set_env_if_missing "JWT_SECRET" "$(gen_secret 48)" "JWT 密钥"
+    set_env_if_missing "COOKIE_SECRET" "$(gen_secret 48)" "Cookie 密钥"
+    set_env_if_missing "ENCRYPTION_KEY" "$(openssl rand -base64 32)" "敏感数据加密密钥"
+    set_env_if_missing "ADMIN_PASSWORD" "$(gen_password 16)" "管理员初始密码"
+
+    chmod 600 "$ENV_FILE"
+}
+
+# ========================== 系统检查 ==========================
+check_root() {
+    if [[ "$EUID" -ne 0 ]]; then
+        error "请以 root 权限运行此部署脚本！"
+        error "用法: sudo bash $0"
+        exit 1
+    fi
+}
+
+check_os() {
+    if [[ ! -f /etc/os-release ]]; then
+        error "无法检测操作系统（/etc/os-release 不存在）"
+        exit 1
+    fi
+
+    source /etc/os-release
+    OS_ID="${ID:-unknown}"
+    OS_VERSION="${VERSION_ID:-unknown}"
+    ARCH=$(dpkg --print-architecture 2>/dev/null || uname -m)
+
+    # 仅支持 Ubuntu 和 Debian
+    if [[ "$OS_ID" != "ubuntu" && "$OS_ID" != "debian" ]]; then
+        error "不支持的操作系统: ${OS_ID}"
+        error "本脚本仅支持 Ubuntu 和 Debian 系统"
+        exit 1
+    fi
+
+    # 架构检查
+    case "$ARCH" in
+        amd64|x86_64) ARCH="amd64" ;;
+        arm64|aarch64) ARCH="arm64" ;;
+        *)
+            error "不支持的系统架构: ${ARCH}"
+            error "仅支持 amd64 (x86_64) 和 arm64 (aarch64)"
+            exit 1
+            ;;
+    esac
+
+    log "系统检测通过: ${OS_ID} ${OS_VERSION} (${ARCH})"
+}
+
+# ========================== 显示横幅 ==========================
+show_banner() {
+    echo -e "${CYAN}" >&2
+    echo "╔══════════════════════════════════════════════════╗" >&2
+    echo "║                                                  ║" >&2
+    echo "║          Incudal 面板一键部署脚本                ║" >&2
+    echo "║          Docker Compose Deploy                   ║" >&2
+    echo "║                                                  ║" >&2
+    echo "╚══════════════════════════════════════════════════╝" >&2
+    echo -e "${NC}" >&2
+    echo -e "  版本: ${BOLD}${SCRIPT_VERSION}${NC}  |  仓库: ${DIM}${GITHUB_REPO}${NC}" >&2
+    echo "" >&2
+}
+
+# ========================== 安装 Docker ==========================
+install_docker() {
+    step "安装 Docker..."
+
+    if command -v docker &>/dev/null; then
+        local docker_version
+        docker_version=$(docker --version 2>/dev/null | awk '{print $3}' | tr -d ',')
+        log "Docker ${docker_version} 已安装，跳过"
+    else
+        info "正在安装 Docker Engine..."
+        export DEBIAN_FRONTEND=noninteractive
+        apt-get update -qq >/dev/null 2>&1
+
+        # 安装前置依赖
+        apt-get install -y -qq ca-certificates curl gnupg >/dev/null 2>&1
+
+        # 添加 Docker 官方 GPG 密钥
+        install -m 0755 -d /etc/apt/keyrings
+        curl -fsSL "https://download.docker.com/linux/${OS_ID}/gpg" -o /etc/apt/keyrings/docker.asc
+        chmod a+r /etc/apt/keyrings/docker.asc
+
+        # 添加 Docker 仓库
+        echo "deb [arch=${ARCH} signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/${OS_ID} ${VERSION_CODENAME:-$(. /etc/os-release && echo "$VERSION_CODENAME")} stable" \
+            > /etc/apt/sources.list.d/docker.list
+
+        apt-get update -qq >/dev/null 2>&1
+        apt-get install -y -qq docker-ce docker-ce-cli containerd.io docker-compose-plugin >/dev/null 2>&1
+
+        # 确保 Docker 启动
+        systemctl enable docker >/dev/null 2>&1
+        systemctl start docker
+
+        log "Docker 安装完成"
+    fi
+
+    # 检查 Docker Compose
+    if docker compose version &>/dev/null; then
+        log "Docker Compose 已可用"
+    else
+        error "Docker Compose 不可用，请手动安装 docker-compose-plugin"
+        exit 1
+    fi
+}
+
+# ========================== 生成面板客户端证书 ==========================
+generate_panel_cert() {
+    local cert_dir="${INSTALL_DIR}/server/certs"
+    local cert_file="${cert_dir}/client.crt"
+    local key_file="${cert_dir}/client.key"
+
+    step "配置面板客户端证书..."
+
+    # 幂等性：证书已存在则跳过
+    if [[ -f "$cert_file" && -f "$key_file" ]]; then
+        log "面板客户端证书已存在，跳过生成"
+        return 0
+    fi
+
+    mkdir -p "$cert_dir"
+
+    # 生成自签名客户端证书（用于面板与 Incus API 的 mTLS 通信）
+    info "生成面板客户端证书（RSA 4096 位，有效期 10 年）..."
+    openssl req -x509 -newkey rsa:4096 \
+        -keyout "$key_file" \
+        -out "$cert_file" \
+        -days 3650 -nodes \
+        -subj "/CN=incudal-panel/O=Incudal" \
+        2>/dev/null
+
+    chmod 644 "$cert_file" "$key_file"
+
+    log "面板客户端证书生成完成"
+}
+
+# ========================== 生成 .env 文件 ==========================
+generate_env() {
+    step "生成环境配置..."
+
+    if [[ -f "$ENV_FILE" ]]; then
+        info ".env 文件已存在，检查并补齐缺失的密钥配置"
+        ensure_env_keys
+        return 0
+    fi
+
+    local pg_password
+    pg_password=$(gen_password 24)
+    local redis_password
+    redis_password=$(gen_password 24)
+    local jwt_secret
+    jwt_secret=$(gen_secret 48)
+    local cookie_secret
+    cookie_secret=$(gen_secret 48)
+    local encryption_key
+    encryption_key=$(openssl rand -base64 32)
+    local admin_password
+    admin_password=$(gen_password 16)
+
+    cat > "$ENV_FILE" << EOF
+# ============================================================================
+# Incudal Docker 部署环境配置
+# 由安装脚本自动生成于 $(date '+%Y-%m-%d %H:%M:%S')
+# ============================================================================
+
+# ============ 数据库配置 ============
+POSTGRES_USER=incudal
+POSTGRES_PASSWORD=${pg_password}
+POSTGRES_DB=incudal
+
+# ============ Redis 配置 ============
+REDIS_PASSWORD=${redis_password}
+
+# ============ 安全配置（请勿泄露！）============
+JWT_SECRET=${jwt_secret}
+COOKIE_SECRET=${cookie_secret}
+ENCRYPTION_KEY=${encryption_key}
+
+# ============ 应用配置 ============
+APP_PORT=${DEFAULT_PORT}
+ADMIN_PASSWORD=${admin_password}
+LOG_LEVEL=info
+DISABLE_REQUEST_LOG=true
+
+# ============ 面板访问地址 ============
+# 节点安装脚本、支付回调等功能依赖此地址
+FRONTEND_URL=${DETECTED_FRONTEND_URL:-}
+EOF
+
+    chmod 600 "$ENV_FILE"
+    log "环境配置文件生成完成: ${ENV_FILE}"
+    info "管理员密码: ${admin_password}"
+    info "PostgreSQL 密码: ${pg_password}"
+}
+
+# ========================== 生成 docker-compose.yml ==========================
+generate_compose() {
+    step "生成 Docker Compose 配置..."
+
+    if [[ -f "$COMPOSE_FILE" ]]; then
+        info "docker-compose.yml 已存在，跳过生成"
+        return 0
+    fi
+
+    cat > "$COMPOSE_FILE" << 'COMPOSEFILE'
+services:
+  app:
+    image: ghcr.io/0xdabiaoge/incudal:latest
+    ports:
+      - "${APP_PORT:-3000}:3000"
+    environment:
+      - NODE_ENV=production
+      - HOST=0.0.0.0
+      - PORT=3000
+      - DATABASE_URL=postgresql://${POSTGRES_USER:-incudal}:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB:-incudal}
+      - REDIS_URL=redis://:${REDIS_PASSWORD:-}@redis:6379
+      - JWT_SECRET=${JWT_SECRET}
+      - COOKIE_SECRET=${COOKIE_SECRET:-}
+      - ENCRYPTION_KEY=${ENCRYPTION_KEY}
+      - FRONTEND_URL=${FRONTEND_URL:-}
+      - SITE_URL=${SITE_URL:-}
+      - LOG_LEVEL=${LOG_LEVEL:-info}
+      - DISABLE_REQUEST_LOG=${DISABLE_REQUEST_LOG:-true}
+      - ADMIN_PASSWORD=${ADMIN_PASSWORD:-}
+    volumes:
+      - ./server/certs:/app/server/certs:ro
+    depends_on:
+      db:
+        condition: service_healthy
+      redis:
+        condition: service_started
+    restart: unless-stopped
+
+  db:
+    image: postgres:16-alpine
+    environment:
+      - POSTGRES_USER=${POSTGRES_USER:-incudal}
+      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
+      - POSTGRES_DB=${POSTGRES_DB:-incudal}
+    volumes:
+      - postgres_data:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-incudal}"]
+      interval: 5s
+      timeout: 5s
+      retries: 5
+    restart: unless-stopped
+
+  redis:
+    image: redis:7-alpine
+    command: redis-server --requirepass ${REDIS_PASSWORD:-}
+    volumes:
+      - redis_data:/data
+    restart: unless-stopped
+
+volumes:
+  postgres_data:
+  redis_data:
+
+networks:
+  default:
+    driver: bridge
+    enable_ipv6: true
+    ipam:
+      config:
+        - subnet: "172.31.0.0/16"
+        - subnet: "fd42:dead:beef:10::/64"
+COMPOSEFILE
+
+    log "Docker Compose 配置生成完成: ${COMPOSE_FILE}"
+}
+
+# ========================== 拉取镜像并启动 ==========================
+start_docker() {
+    step "拉取镜像并启动服务..."
+
+    cd "$INSTALL_DIR"
+
+    info "拉取最新镜像..."
+    docker compose pull 2>&1 | tail -5
+
+    info "启动容器..."
+    docker compose up -d 2>&1
+
+    # 等待服务就绪
+    info "等待服务启动..."
+    local retries=0
+    local max_retries=30
+    while [[ $retries -lt $max_retries ]]; do
+        if curl -sf "http://127.0.0.1:${DEFAULT_PORT}/api/health" &>/dev/null 2>&1; then
+            log "服务启动成功！"
+            return 0
+        fi
+        retries=$((retries + 1))
+        sleep 2
+    done
+
+    warn "服务尚未就绪，请查看日志确认状态:"
+    warn "  docker compose -f ${COMPOSE_FILE} logs -f app"
+}
+
+# ========================== Nginx + Certbot ==========================
+setup_nginx_certbot() {
+    info "准备配置 Nginx 反代及 Let's Encrypt SSL 自动证书"
+    echo -ne "  ${BOLD}请输入你要绑定的域名 (例如 panel.yourdomain.com): ${NC}"
+    read -r DOMAIN
+
+    if [[ -z "$DOMAIN" ]]; then
+        error "域名不能为空！"
+        return 1
+    fi
+
+    echo -ne "  ${BOLD}请输入你的邮箱 (用于证书过期通知，可留空): ${NC}"
+    read -r EMAIL
+
+    info "安装 Nginx 与 Certbot..."
+    apt-get install -y -qq nginx certbot python3-certbot-nginx >/dev/null 2>&1
+
+    # 更新 FRONTEND_URL
+    sed -i "s|^FRONTEND_URL=.*|FRONTEND_URL=https://${DOMAIN}|" "$ENV_FILE"
+
+    log "配置 Nginx 站点..."
+    cat > /etc/nginx/sites-available/incudal.conf <<NGINX
+server {
+    listen 80;
+    listen [::]:80;
+    server_name ${DOMAIN};
+
+    # 安全头
+    add_header X-Content-Type-Options nosniff;
+    add_header X-Frame-Options DENY;
+
+    location / {
+        proxy_pass http://127.0.0.1:${DEFAULT_PORT};
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade \$http_upgrade;
+        proxy_set_header Connection 'upgrade';
+        proxy_set_header Host \$host;
+        proxy_set_header X-Real-IP \$remote_addr;
+        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto \$scheme;
+        proxy_cache_bypass \$http_upgrade;
+
+        # WebSocket 超时
+        proxy_read_timeout 300s;
+        proxy_send_timeout 300s;
+    }
+}
+NGINX
+
+    # 启用站点
+    ln -sf /etc/nginx/sites-available/incudal.conf /etc/nginx/sites-enabled/
+    rm -f /etc/nginx/sites-enabled/default 2>/dev/null || true
+
+    # 测试并重载 Nginx
+    nginx -t >/dev/null 2>&1
+    systemctl restart nginx
+
+    # 申请 SSL 证书
+    info "申请 Let's Encrypt SSL 证书..."
+    if [[ -n "$EMAIL" ]]; then
+        certbot --nginx -d "$DOMAIN" --non-interactive --agree-tos -m "$EMAIL" --redirect
+    else
+        certbot --nginx -d "$DOMAIN" --non-interactive --agree-tos --register-unsafely-without-email --redirect
+    fi
+
+    log "Nginx + HTTPS 配置完成"
+    info "面板地址: https://${DOMAIN}"
+
+    # 重启容器使新 FRONTEND_URL 生效
+    cd "$INSTALL_DIR"
+    docker compose up -d --force-recreate app 2>/dev/null || true
+}
+
+# ========================== Cloudflare Tunnel ==========================
+setup_cf_tunnel() {
+    info "请前往 Cloudflare Zero Trust 控制台创建 Tunnel"
+    info "配置 Tunnel 时，将 Public Hostname 指向 http://127.0.0.1:${DEFAULT_PORT}"
+    echo ""
+    echo -ne "  ${BOLD}请输入你绑定的域名 (用于更新 FRONTEND_URL): ${NC}"
+    read -r CF_DOMAIN
+
+    if [[ -n "$CF_DOMAIN" ]]; then
+        sed -i "s|^FRONTEND_URL=.*|FRONTEND_URL=https://${CF_DOMAIN}|" "$ENV_FILE"
+        log "已更新 FRONTEND_URL 为 https://${CF_DOMAIN}"
+
+        # 重启容器以应用新环境变量
+        cd "$INSTALL_DIR"
+        docker compose up -d 2>/dev/null
+    fi
+}
+
+# ========================== 显示结果 ==========================
+show_result() {
+    # 从 .env 中提取信息
+    local admin_pass
+    admin_pass=$(grep '^ADMIN_PASSWORD=' "$ENV_FILE" | cut -d'=' -f2-)
+    local frontend_url
+    frontend_url=$(grep '^FRONTEND_URL=' "$ENV_FILE" | cut -d'=' -f2-)
+    local app_port
+    app_port=$(grep '^APP_PORT=' "$ENV_FILE" | cut -d'=' -f2- || echo "$DEFAULT_PORT")
+
+    echo "" >&2
+    echo -e "${GREEN}" >&2
+    echo "╔══════════════════════════════════════════════════╗" >&2
+    echo "║                                                  ║" >&2
+    echo "║          ✅  Incudal 部署完成！                  ║" >&2
+    echo "║                                                  ║" >&2
+    echo "╚══════════════════════════════════════════════════╝" >&2
+    echo -e "${NC}" >&2
+    divider
+    echo -e "  ${BOLD}部署模式${NC}     Docker Compose" >&2
+    echo -e "  ${BOLD}访问地址${NC}     ${frontend_url:-http://服务器IP:${app_port}}" >&2
+    echo -e "  ${BOLD}管理员账号${NC}   admin" >&2
+    echo -e "  ${BOLD}管理员密码${NC}   ${admin_pass}" >&2
+    divider
+    echo "" >&2
+    echo -e "  ${YELLOW}常用运维命令:${NC}" >&2
+    echo -e "  ${DIM}查看日志${NC}     docker compose -f ${COMPOSE_FILE} logs -f app" >&2
+    echo -e "  ${DIM}重启服务${NC}     docker compose -f ${COMPOSE_FILE} restart" >&2
+    echo -e "  ${DIM}停止服务${NC}     docker compose -f ${COMPOSE_FILE} down" >&2
+    echo -e "  ${DIM}更新镜像${NC}     sudo bash $0 --upgrade" >&2
+    divider
+    echo "" >&2
+
+    if [[ -z "$frontend_url" ]]; then
+        warn "FRONTEND_URL 尚未配置，面板部分功能（如节点注册）将不可用"
+        warn "请编辑 ${ENV_FILE} 设置 FRONTEND_URL 字段"
+    fi
+}
+
+# ========================== 升级 ==========================
+do_upgrade() {
+    show_banner
+    check_os
+
+    if [[ ! -f "$COMPOSE_FILE" ]]; then
+        error "未检测到 Docker 部署，无法升级"
+        error "请先运行安装: sudo bash $0"
+        exit 1
+    fi
+
+    step "升级 Incudal..."
+
+    cd "$INSTALL_DIR"
+
+    info "拉取最新镜像..."
+    docker compose pull 2>&1 | tail -5
+
+    info "重建容器（使用新镜像）..."
+    docker compose up -d --force-recreate app 2>&1
+
+    # 等待服务就绪
+    info "等待服务启动..."
+    local retries=0
+    while [[ $retries -lt 20 ]]; do
+        if curl -sf "http://127.0.0.1:${DEFAULT_PORT}/api/health" &>/dev/null 2>&1; then
+            break
+        fi
+        retries=$((retries + 1))
+        sleep 2
+    done
+
+    log "升级完成！"
+    info "当前镜像: $(docker compose images app --format '{{.Repository}}:{{.Tag}}' 2>/dev/null || echo 'unknown')"
+}
+
+# ========================== 卸载 ==========================
+do_uninstall() {
+    show_banner
+    echo -e "  ${RED}${BOLD}⚠  警告：卸载将删除所有 Incudal 数据！${NC}" >&2
+    echo "" >&2
+    echo -ne "  ${BOLD}确认卸载？输入 'yes' 继续: ${NC}"
+    read -r confirm
+
+    if [[ "$confirm" != "yes" ]]; then
+        info "已取消卸载"
+        exit 0
+    fi
+
+    step "卸载 Incudal..."
+
+    if [[ -f "$COMPOSE_FILE" ]]; then
+        cd "$INSTALL_DIR"
+        info "停止并移除容器..."
+        docker compose down -v 2>/dev/null || true
+    fi
+
+    # 移除 Nginx 配置
+    if [[ -f /etc/nginx/sites-enabled/incudal.conf ]]; then
+        info "移除 Nginx 配置..."
+        rm -f /etc/nginx/sites-enabled/incudal.conf
+        rm -f /etc/nginx/sites-available/incudal.conf
+        systemctl reload nginx 2>/dev/null || true
+    fi
+
+    # 删除安装目录
+    if [[ -d "$INSTALL_DIR" ]]; then
+        info "删除安装目录 ${INSTALL_DIR}..."
+        rm -rf "$INSTALL_DIR"
+    fi
+
+    log "卸载完成"
+    info "Docker Engine 未被移除，如需卸载请手动执行: apt-get remove docker-ce"
+}
+
+# ========================== 安装 ==========================
+do_install() {
+    show_banner
+    check_os
+
+    # 检查是否已安装
+    if [[ -f "$COMPOSE_FILE" ]]; then
+        warn "检测到已有安装 (${INSTALL_DIR})"
+        echo -ne "  ${BOLD}覆盖安装？[y/N]: ${NC}"
+        read -r overwrite
+        if [[ "${overwrite,,}" != "y" ]]; then
+            info "已取消安装。如需升级请使用: sudo bash $0 --upgrade"
+            exit 0
+        fi
+    fi
+
+    # 更新系统包
+    step "更新系统包索引..."
+    export DEBIAN_FRONTEND=noninteractive
+    apt-get update -qq >/dev/null 2>&1
+    # 安装基础工具
+    apt-get install -y -qq curl openssl >/dev/null 2>&1
+
+    # 安装 Docker
+    install_docker
+
+    # 创建安装目录
+    mkdir -p "${INSTALL_DIR}/server/certs"
+
+    # 生成面板客户端证书
+    generate_panel_cert
+
+    # 生成 .env
+    generate_env
+
+    # 生成 docker-compose.yml
+    generate_compose
+
+    # 登录 GHCR（私有仓库需要）
+    step "配置镜像仓库访问..."
+    if docker pull "${DOCKER_IMAGE}:latest" &>/dev/null 2>&1; then
+        log "镜像仓库可访问"
+    else
+        warn "无法拉取镜像（仓库可能是私有的）"
+        info "如果仓库是私有的，请先登录:"
+        info "  echo 'YOUR_GITHUB_TOKEN' | docker login ghcr.io -u USERNAME --password-stdin"
+        echo ""
+        echo -ne "  ${BOLD}是否已登录或仓库为公开？继续安装？[y/N]: ${NC}"
+        read -r cont
+        if [[ "${cont,,}" != "y" ]]; then
+            info "请登录后重新运行安装脚本"
+            exit 0
+        fi
+    fi
+
+    # ---- 先选择网络方案，确保 FRONTEND_URL 在容器启动前就已写入 .env ----
+    echo ""
+    divider
+    echo -e "  ${BOLD}请选择外部访问方案：${NC}" >&2
+    divider
+    echo -e "  ${CYAN}[1]${NC} Nginx + Certbot   ${YELLOW}（推荐：自动 HTTPS，需要公网 IP 和域名）${NC}" >&2
+    echo -e "  ${CYAN}[2]${NC} Cloudflare Tunnel  ${YELLOW}（适合无公网 IP 或隐藏源站 IP）${NC}" >&2
+    echo -e "  ${CYAN}[3]${NC} 仅启动服务        ${DIM}（手动配置反代，稍后输入面板地址）${NC}" >&2
+    echo ""
+    echo -ne "  ${BOLD}请选择 [1-3]: ${NC}"
+    read -r net_opt
+
+    # 方案 3 或无效选项：需要在启动前确定面板访问地址
+    case "${net_opt:-3}" in
+        1|2)
+            ;; # Nginx/CF 方案会在后续步骤中自动写入 FRONTEND_URL
+        *)
+            # 自动探测面板公网地址，用于写入 FRONTEND_URL
+            local detected_ip=""
+            detected_ip=$(curl -4sf --connect-timeout 5 https://api.ipify.org 2>/dev/null || \
+                          curl -4sf --connect-timeout 5 https://ifconfig.me 2>/dev/null || \
+                          curl -6sf --connect-timeout 5 https://api6.ipify.org 2>/dev/null || echo "")
+
+            echo ""
+            if [[ -n "$detected_ip" ]]; then
+                # 检测到公网 IP，构建默认地址
+                local default_url="http://${detected_ip}:${DEFAULT_PORT}"
+                info "检测到公网 IP: ${detected_ip}"
+                echo -ne "  ${BOLD}请输入面板访问地址 [默认 ${default_url}]: ${NC}"
+                read -r manual_url
+                manual_url=${manual_url:-${default_url}}
+            else
+                echo -ne "  ${BOLD}请输入面板访问地址 (例如 https://panel.example.com 或 http://IP:${DEFAULT_PORT}): ${NC}"
+                read -r manual_url
+            fi
+
+            if [[ -n "$manual_url" ]]; then
+                # 去掉末尾斜杠
+                manual_url="${manual_url%/}"
+                sed -i "s|^FRONTEND_URL=.*|FRONTEND_URL=${manual_url}|" "$ENV_FILE"
+                log "面板访问地址已设置: ${manual_url}"
+            else
+                warn "未设置面板访问地址，节点注册功能将不可用"
+                warn "请后续编辑 ${ENV_FILE} 手动设置 FRONTEND_URL"
+            fi
+            ;;
+    esac
+
+    # 启动服务（此时 .env 中 FRONTEND_URL 已有值）
+    start_docker
+
+    # 方案 1/2 在服务启动后配置外部访问并更新 FRONTEND_URL
+    case "${net_opt:-3}" in
+        1) setup_nginx_certbot ;;
+        2) setup_cf_tunnel ;;
+    esac
+
+    # 显示结果
+    show_result
+}
+
+# ========================== 主入口 ==========================
+main() {
+    check_root
+
+    case "${1:-}" in
+        --upgrade|-u)
+            do_upgrade
+            ;;
+        --uninstall|--remove)
+            do_uninstall
+            ;;
+        --help|-h)
+            echo "Incudal 面板部署脚本（Docker 模式）v${SCRIPT_VERSION}"
+            echo ""
+            echo "用法: sudo bash $0 [选项]"
+            echo ""
+            echo "选项:"
+            echo "  (无参数)      全新安装"
+            echo "  --upgrade     拉取最新镜像并重建"
+            echo "  --uninstall   卸载 Incudal（包含数据）"
+            echo "  --help        显示帮助"
+            ;;
+        *)
+            do_install
+            ;;
+    esac
+}
+
+main "$@"