refactor: 将目录结构从 www 重命名为 nginx

- 将 default、git、note 目录下的 README.md 文件从 www目录移动到 nginx 目录
- 更新文件内容中的下载路径，从 www 改为 nginx- 修改 note 目录下的 deploy.sh 脚本执行路径

nginx/README.md

@@ -0,0 +1,47 @@
+# Nginx
+
+## 安装 Nginx
+
+安装 Nginx
+
+```bash
+apt-get update && apt-get install nginx
+```
+
+启动 Nginx
+
+```bash
+systemctl start nginx
+```
+
+开机自启动
+
+```bash
+systemctl enable nginx
+```
+
+查看状态
+
+```bash
+systemctl status nginx
+```
+
+## Nginx 配置
+
+下载配置
+
+```bash
+curl -fsSL https://git.sugarscat.cn/me/bash/-/raw/main/nginx/nginx.conf > /etc/nginx/nginx.conf
+```
+
+测试配置
+
+```bash
+nginx -t
+```
+
+重启 nginx
+
+```bash
+systemctl restart nginx
+```

nginx/default/README.md

@@ -0,0 +1,29 @@
+# default
+
+## Nginx 配置
+
+> 该配置需要在 `/etc/nginx/ssl/` 目录下创建 `fullchain.pem` 和 `privkey.pem` 证书文件。
+
+下载配置
+
+```bash
+curl -fsSL https://git.sugarscat.cn/me/bash/-/raw/main/nginx/default/nginx.conf > /etc/nginx/sites-available/default
+```
+
+启用配置
+
+```bash
+ln -s /etc/nginx/sites-available/default /etc/nginx/sites-enabled/default
+```
+
+测试配置
+
+```bash
+nginx -t
+```
+
+重启 nginx
+
+```bash
+systemctl restart nginx
+```

nginx/default/nginx.conf

@@ -0,0 +1,96 @@
+##
+# You should look at the following URL's in order to grasp a solid understanding
+# of Nginx configuration files in order to fully unleash the power of Nginx.
+# https://www.nginx.com/resources/wiki/start/
+# https://www.nginx.com/resources/wiki/start/topics/tutorials/config_pitfalls/
+# https://wiki.debian.org/Nginx/DirectoryStructure
+#
+# In most cases, administrators will remove this file from sites-enabled/ and
+# leave it as reference inside of sites-available where it will continue to be
+# updated by the nginx packaging team.
+#
+# This file will automatically load configuration files provided by other
+# applications, such as Drupal or Wordpress. These applications will be made
+# available underneath a path with that package name, such as /drupal8.
+#
+# Please see /usr/share/doc/nginx-doc/examples/ for more detailed examples.
+##
+
+# Default server configuration
+#
+server {
+    listen 80 default_server;
+    listen [::]:80 default_server;
+
+    # SSL configuration
+    #
+    listen 443 ssl default_server;
+    listen [::]:443 ssl default_server;
+
+    # ssl 设置
+    ssl_certificate /etc/nginx/ssl/fullchain.pem;
+    ssl_certificate_key /etc/nginx/ssl/privkey.pem;
+
+    #
+    # Note: You should disable gzip for SSL traffic.
+    # See: https://bugs.debian.org/773332
+    #
+    # Read up on ssl_ciphers to ensure a secure configuration.
+    # See: https://bugs.debian.org/765782
+    #
+    # Self signed certs generated by the ssl-cert package
+    # Don't use them in a production server!
+    #
+    # include snippets/snakeoil.conf;
+
+    root /var/www/html;
+
+    # Add index.php to the list if you are using PHP
+    index index.html index.htm index.nginx-debian.html;
+
+    server_name _;
+
+    location / {
+        # First attempt to serve request as file, then
+        # as directory, then fall back to displaying a 404.
+        return 403;
+    }
+
+    # pass PHP scripts to FastCGI server
+    #
+    #location ~ \.php$ {
+    #	include snippets/fastcgi-php.conf;
+    #
+    #	# With php-fpm (or other unix sockets):
+    #	fastcgi_pass unix:/run/php/php7.4-fpm.sock;
+    #	# With php-cgi (or other tcp sockets):
+    #	fastcgi_pass 127.0.0.1:9000;
+    #}
+
+    # deny access to .htaccess files, if Apache's document root
+    # concurs with nginx's one
+    #
+    #location ~ /\.ht {
+    #	deny all;
+    #}
+}
+
+
+# Virtual Host configuration for example.com
+#
+# You can move that to a different file under sites-available/ and symlink that
+# to sites-enabled/ to enable it.
+#
+#server {
+#	listen 80;
+#	listen [::]:80;
+#
+#	server_name example.com;
+#
+#	root /var/www/example.com;
+#	index index.html;
+#
+#	location / {
+#		try_files $uri $uri/ =404;
+#	}
+#}

nginx/git/README.md

@@ -0,0 +1,29 @@
+# git.sugarscat.cn
+
+## Nginx 配置
+
+> 该配置需要在 `/etc/nginx/ssl/` 目录下创建 `fullchain.pem` 和 `privkey.pem` 证书文件。
+
+下载配置
+
+```bash
+curl -fsSL https://git.sugarscat.cn/me/bash/-/raw/main/nginx/git/nginx.conf > /etc/nginx/sites-available/git.sugarscat.cn
+```
+
+启用配置
+
+```bash
+ln -s /etc/nginx/sites-available/git.sugarscat.cn /etc/nginx/sites-enabled/git.sugarscat.cn
+```
+
+测试配置
+
+```bash
+nginx -t
+```
+
+重启 nginx
+
+```bash
+systemctl restart nginx
+```

nginx/git/nginx.conf

@@ -0,0 +1,51 @@
+server {
+    listen 80 ;
+    listen 443 ssl http2 ;
+    server_name git.sugarscat.cn;
+    index index.php index.html index.htm default.php default.htm default.html;
+    proxy_set_header Host $host;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Host $server_name;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_http_version 1.1;
+    proxy_set_header Upgrade $http_upgrade;
+    proxy_set_header Connection "upgrade";
+    # acme.sh
+    location ^~ /.well-known/acme-challenge {
+        allow all;
+        root /var/www/html;
+    }
+    # 重定向
+    if ($scheme = http) {
+        return 301 https://$host$request_uri;
+    }
+    # ssl 设置
+    ssl_certificate /etc/nginx/ssl/fullchain.pem;
+    ssl_certificate_key /etc/nginx/ssl/privkey.pem;
+
+    ssl_protocols TLSv1.3 TLSv1.2 TLSv1.1 TLSv1;
+    ssl_ciphers EECDH+CHACHA20:EECDH+CHACHA20-draft:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5;
+    ssl_prefer_server_ciphers on;
+    ssl_session_cache shared:SSL:10m;
+    ssl_session_timeout 10m;
+    add_header Strict-Transport-Security "max-age=31536000";
+    error_page 497 https://$host$request_uri;
+    proxy_set_header X-Forwarded-Proto https;
+    ssl_stapling on;
+    ssl_stapling_verify on;
+
+    location ^~ / {
+        proxy_pass https://127.0.0.1:8080;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header REMOTE-HOST $remote_addr;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_http_version 1.1;
+        add_header X-Cache $upstream_cache_status;
+        add_header Strict-Transport-Security "max-age=31536000";
+        add_header Cache-Control no-cache;
+    }
+}

nginx/nginx.conf

@@ -0,0 +1,90 @@
+user www-data;
+worker_processes auto;
+pid /run/nginx.pid;
+include /etc/nginx/modules-enabled/*.conf;
+
+events {
+    worker_connections 1024;
+    # multi_accept on;
+}
+
+http {
+
+    ##
+    # Basic Settings
+    ##
+
+    sendfile on;
+    tcp_nopush on;
+    types_hash_max_size 2048;
+    # server_tokens off;
+
+    # server_names_hash_bucket_size 64;
+    # server_name_in_redirect off;
+
+    include /etc/nginx/mime.types;
+    default_type application/octet-stream;
+
+    server_names_hash_bucket_size 512;
+    client_header_buffer_size 32k;
+    client_max_body_size 50m;
+    keepalive_timeout 60;
+    keepalive_requests 100000;
+
+    ##
+    # SSL Settings
+    ##
+
+    ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; # Dropping SSLv3, ref: POODLE
+    ssl_prefer_server_ciphers on;
+
+    ##
+    # Logging Settings
+    ##
+
+    access_log /var/log/nginx/access.log;
+    error_log /var/log/nginx/error.log;
+
+    ##
+    # Gzip Settings
+    ##
+
+    gzip on;
+    gzip_min_length  1k;
+    gzip_buffers     4 16k;
+    gzip_http_version 1.1;
+    gzip_comp_level 2;
+    gzip_types     text/plain application/javascript application/x-javascript text/javascript text/css application/xml;
+    gzip_vary on;
+    gzip_proxied   expired no-cache no-store private auth;
+    gzip_disable   "MSIE [1-6]\.";
+
+    ##
+    # Virtual Host Configs
+    ##
+
+    include /etc/nginx/conf.d/*.conf;
+    include /etc/nginx/sites-enabled/*;
+}
+
+
+#mail {
+#	# See sample authentication script at:
+#	# http://wiki.nginx.org/ImapAuthenticateWithApachePhpScript
+#
+#	# auth_http localhost/auth.php;
+#	# pop3_capabilities "TOP" "USER";
+#	# imap_capabilities "IMAP4rev1" "UIDPLUS";
+#
+#	server {
+#		listen     localhost:110;
+#		protocol   pop3;
+#		proxy      on;
+#	}
+#
+#	server {
+#		listen     localhost:143;
+#		protocol   imap;
+#		proxy      on;
+#	}
+#}

nginx/note/README.md

@@ -0,0 +1,57 @@
+# note.sugarscat.cn
+
+## 下载部署脚本
+
+```bash
+mkdir -p /opt/www/note && cd /opt/www/note
+```
+
+```bash
+curl -fsSL https://git.sugarscat.cn/me/bash/-/raw/main/nginx/note/deploy.sh > deploy.sh && chmod +x deploy.sh
+```
+
+## 定时执行脚本
+
+```bash
+crontab -e
+```
+
+每天天 0 点 执行一次：
+
+```bash
+0 0 * * * /opt/nginx/note/deploy.sh >> /opt/www/note/deploy.log 2>&1
+```
+
+查看定时器列表
+
+```bash
+crontab -l
+```
+
+## Nginx 配置
+
+> 该配置需要在 `/etc/nginx/ssl/` 目录下创建 `fullchain.pem` 和 `privkey.pem` 证书文件。
+
+下载配置
+
+```bash
+curl -fsSL https://git.sugarscat.cn/me/bash/-/raw/main/nginx/note/nginx.conf > /etc/nginx/sites-available/note.sugarscat.cn
+```
+
+启用配置
+
+```bash
+ln -s /etc/nginx/sites-available/note.sugarscat.cn /etc/nginx/sites-enabled/note.sugarscat.cn
+```
+
+测试配置
+
+```bash
+nginx -t
+```
+
+重启 nginx
+
+```bash
+systemctl restart nginx
+```

nginx/note/deploy.sh

@@ -0,0 +1,53 @@
+#!/bin/bash
+
+# 开启严格模式
+set -e
+
+# 定义变量
+REPO_URL="https://git.sugarscat.cn/me/note"
+TARGET_DIR="/var/www/note"
+DIST_DIR=".vitepress/dist"
+TEMP_DIR=$(mktemp -d)  # 生成临时目录
+
+# 清理临时目录的函数（在脚本退出时执行）
+cleanup() {
+  rm -rf "$TEMP_DIR"
+}
+trap cleanup EXIT
+
+echo "开始下载最新构建产物..."
+curl -L -o "$TEMP_DIR/artifact.zip" "$REPO_URL/-/jobs/artifacts/main/download?job=build"
+
+# shellcheck disable=SC2181
+if [ $? -ne 0 ]; then
+  echo "下载失败，请检查网络连接或重新尝试。"
+  exit 1
+fi
+
+# 检查 unzip 是否可用，不可用时自动安装
+if ! command -v unzip &> /dev/null; then
+  echo "unzip 未安装，开始安装 ···"
+  if command -v apt-get &> /dev/null; then
+    sudo apt-get update
+    sudo apt-get install -y unzip
+  elif command -v yum &> /dev/null; then
+    sudo yum install -y unzip
+  else
+    echo "无法安装 unzip，请手动安装。"
+    exit 1
+  fi
+fi
+
+echo "解压文件..."
+unzip -q "$TEMP_DIR/artifact.zip" -d "$TEMP_DIR"
+
+# 确保目标目录存在
+sudo mkdir -p "$TARGET_DIR"
+
+echo "清空目标目录..."
+sudo rm -rf "$TARGET_DIR"/*
+
+echo "移动文件到目标目录..."
+sudo mv "$TEMP_DIR/$DIST_DIR"/* "$TARGET_DIR"
+
+echo "部署完成！"

nginx/note/nginx.conf

@@ -0,0 +1,43 @@
+server {
+    listen 80 ;
+    listen 443 ssl http2 ;
+    server_name note.sugarscat.cn;
+
+    # acme.sh
+    location ^~ /.well-known/acme-challenge {
+        allow all;
+        root /var/www/html;
+    }
+    # 重定向
+    if ($scheme = http) {
+        return 301 https://$host$request_uri;
+    }
+
+    # ssl 设置
+    ssl_certificate /etc/nginx/ssl/fullchain.pem;
+    ssl_certificate_key /etc/nginx/ssl/privkey.pem;
+
+    ssl_protocols TLSv1.3 TLSv1.2 TLSv1.1 TLSv1;
+    ssl_ciphers EECDH+CHACHA20:EECDH+CHACHA20-draft:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5;
+    ssl_prefer_server_ciphers on;
+    ssl_session_cache shared:SSL:10m;
+    ssl_session_timeout 10m;
+    add_header Strict-Transport-Security "max-age=31536000";
+    error_page 497 https://$host$request_uri;
+    proxy_set_header X-Forwarded-Proto https;
+    ssl_stapling on;
+    ssl_stapling_verify on;
+
+    root /var/www/note;
+    index index.html;
+    
+    try_files $uri $uri.html $uri/ =404;
+
+    error_page 404 /404.html;
+    error_page 403 /404.html;
+
+    location ~* ^/assets/ {
+        expires 1y;
+        add_header Cache-Control "public, immutable";
+    }
+}

nginx/website/deploy.sh

@@ -0,0 +1,33 @@
+#!/bin/bash
+
+# 开启严格模式
+set -e
+
+# 定义变量
+REPO_URL="https://git.sugarscat.cn/me/website"
+TARGET_DIR="/var/www/website"
+DIST_DIR="dist"
+TEMP_DIR=$(mktemp -d)  # 生成临时目录
+
+# 清理临时目录的函数（在脚本退出时执行）
+cleanup() {
+  rm -rf "$TEMP_DIR"
+}
+trap cleanup EXIT
+
+echo "开始下载最新构建产物..."
+curl -L -o "$TEMP_DIR/artifact.zip" "$REPO_URL/-/jobs/artifacts/main/download?job=build"
+
+echo "解压文件..."
+unzip -q "$TEMP_DIR/artifact.zip" -d "$TEMP_DIR"
+
+# 确保目标目录存在
+sudo mkdir -p "$TARGET_DIR"
+
+echo "清空目标目录..."
+sudo rm -rf "$TARGET_DIR"/*
+
+echo "移动文件到目标目录..."
+sudo mv "$TEMP_DIR/$DIST_DIR"/* "$TARGET_DIR"
+
+echo "部署完成！"