From 140957262eeeb6baf866f92446db069920b95043 Mon Sep 17 00:00:00 2001 From: ibuler Date: Wed, 26 Aug 2026 11:27:35 +0800 Subject: [PATCH 01/18] perf: default http server --- Dockerfile | 1 + https_server.conf | 48 +++++++++++++++++++++++++++++++++++++++++++++++ init.sh | 8 ++++++-- 3 files changed, 55 insertions(+), 2 deletions(-) create mode 100644 https_server.conf diff --git a/Dockerfile b/Dockerfile index 807b2a5..218846e 100644 --- a/Dockerfile +++ b/Dockerfile @@ -42,4 +42,5 @@ COPY nginx.conf /etc/nginx/nginx.conf COPY includes /etc/nginx/includes COPY default.conf /etc/nginx/conf.d/default.conf COPY http_server.conf /etc/nginx/sites-enabled/http_server.conf +COPY https_server.conf /etc/nginx/sites-enabled/https_server.conf COPY init.sh /docker-entrypoint.d/40-init-config.sh diff --git a/https_server.conf b/https_server.conf new file mode 100644 index 0000000..5c95698 --- /dev/null +++ b/https_server.conf @@ -0,0 +1,48 @@ +# Todo: May be can auto discovery +upstream http_server { + ip_hash; + server web:8080; # 这个是可以通过容器访问, 外部访问是 80端口 +} + +server { + listen 80; + # listen [::]:80; + # server_name demo.jumpserver.org; # 取消注释并自行修改成你自己的域名 + return 307 https://$host$request_uri; +} + +server { + listen 443 ssl; + http2 on; + # listen [::]:443 ssl; + # server_name demo.jumpserver.org; # 取消注释并自行修改成你自己的域名 + server_tokens off; + ssl_certificate cert/server.crt; # 修改 server.crt 为你的证书, 不要改路径 cert/ + ssl_certificate_key cert/server.key; # 修改 server.key 为你的证书, 不要改路径 cert/ + ssl_session_timeout 1d; + ssl_session_cache shared:MozSSL:10m; + ssl_session_tickets off; + ssl_protocols TLSv1.2 TLSv1.3; + ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384; + ssl_prefer_server_ciphers off; + + client_max_body_size 5000m; + + location / { + proxy_pass http://http_server; + proxy_buffering off; + proxy_request_buffering off; + proxy_http_version 1.1; + proxy_set_header Host $host; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection $http_connection; + proxy_set_header X-Forwarded-For $remote_addr; + # proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; # 如果上层还有其他 slb 需要使用 $proxy_add_x_forwarded_for 获取真实 ip + + proxy_ignore_client_abort on; + proxy_connect_timeout 600; + proxy_send_timeout 600; + proxy_read_timeout 600; + send_timeout 6000; + } +} diff --git a/init.sh b/init.sh index dda08c1..a9d0511 100755 --- a/init.sh +++ b/init.sh @@ -1,6 +1,6 @@ #!/bin/bash # -https_port=${HTTPS_PORT:-443} +HTTPS_PORT=${HTTPS_PORT:-443} function config_nginx() { @@ -81,8 +81,12 @@ function config_https() { sed -i "s@https://\$host\$request_uri;@https://\$host:${HTTPS_PORT}\$request_uri;@g" "${config_file}" fi + if [ "${HTTPS_PORT}" != "443" ]; then + sed -i "s@listen 443 ssl;@listen ${HTTPS_PORT} ssl;@g" "${config_file}" + fi + if [ "${USE_IPV6}" == "1" ]; then - sed -i "s@# listen \[::\]:443@listen \[::\]:443@g" "${config_file}" + sed -i "s@# listen \[::\]:443 ssl;@listen [::]:${HTTPS_PORT} ssl;@g" "${config_file}" fi if [ -n "${SSL_CERTIFICATE}" ] && [ -f "/etc/nginx/cert/${SSL_CERTIFICATE}" ]; then From a334dd8025fe0730332adf5b4faeaf0e5e7b47f3 Mon Sep 17 00:00:00 2001 From: feng <1304903146@qq.com> Date: Wed, 26 Aug 2026 18:04:19 +0800 Subject: [PATCH 02/18] fix: use JDMC component flag --- includes/{kotl.conf.disabled => jdmc.conf.disabled} | 0 init.sh | 6 +++--- 2 files changed, 3 insertions(+), 3 deletions(-) rename includes/{kotl.conf.disabled => jdmc.conf.disabled} (100%) diff --git a/includes/kotl.conf.disabled b/includes/jdmc.conf.disabled similarity index 100% rename from includes/kotl.conf.disabled rename to includes/jdmc.conf.disabled diff --git a/init.sh b/init.sh index a9d0511..c61fc73 100755 --- a/init.sh +++ b/init.sh @@ -124,10 +124,10 @@ function config_components() { safe_move /etc/nginx/includes/chen.conf /etc/nginx/includes/chen.conf.disabled fi - if [ "${KOTL_ENABLED}" == "1" ]; then - safe_move /etc/nginx/includes/kotl.conf.disabled /etc/nginx/includes/kotl.conf + if [ "${JDMC_ENABLED}" == "1" ]; then + safe_move /etc/nginx/includes/jdmc.conf.disabled /etc/nginx/includes/jdmc.conf else - safe_move /etc/nginx/includes/kotl.conf /etc/nginx/includes/kotl.conf.disabled + safe_move /etc/nginx/includes/jdmc.conf /etc/nginx/includes/jdmc.conf.disabled fi if [ "${FACELIVE_ENABLED}" == "0" ]; then From 6c7db0c98fc9b788c583ac760dc6735dafc2f2fb Mon Sep 17 00:00:00 2001 From: feng <1304903146@qq.com> Date: Wed, 26 Aug 2026 19:20:39 +0800 Subject: [PATCH 03/18] refactor: enable JDMC proxy for enterprise --- init.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/init.sh b/init.sh index c61fc73..2f38b3a 100755 --- a/init.sh +++ b/init.sh @@ -124,7 +124,7 @@ function config_components() { safe_move /etc/nginx/includes/chen.conf /etc/nginx/includes/chen.conf.disabled fi - if [ "${JDMC_ENABLED}" == "1" ]; then + if [ "${USE_XPACK}" == "1" ]; then safe_move /etc/nginx/includes/jdmc.conf.disabled /etc/nginx/includes/jdmc.conf else safe_move /etc/nginx/includes/jdmc.conf /etc/nginx/includes/jdmc.conf.disabled From 9cac1efd8492e439e472e30a0c4291c2fbf30c50 Mon Sep 17 00:00:00 2001 From: feng <1304903146@qq.com> Date: Thu, 27 Aug 2026 11:13:01 +0800 Subject: [PATCH 04/18] perf: ai --- includes/chat_ai.conf.disabled | 14 ++++++++++++++ init.sh | 6 ++++++ 2 files changed, 20 insertions(+) create mode 100644 includes/chat_ai.conf.disabled diff --git a/includes/chat_ai.conf.disabled b/includes/chat_ai.conf.disabled new file mode 100644 index 0000000..57b39f6 --- /dev/null +++ b/includes/chat_ai.conf.disabled @@ -0,0 +1,14 @@ +location ^~ /api/v1/chat-ai/ { + proxy_pass http://ai:8088; + proxy_buffering off; + proxy_cache off; + proxy_request_buffering off; + proxy_http_version 1.1; + proxy_set_header Host $http_host; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_connect_timeout 60; + proxy_send_timeout 600; + proxy_read_timeout 600; + send_timeout 600; +} diff --git a/init.sh b/init.sh index 2f38b3a..ce76072 100755 --- a/init.sh +++ b/init.sh @@ -112,6 +112,12 @@ function config_components() { safe_move /etc/nginx/includes/core.conf /etc/nginx/includes/core.conf.disabled fi + if [ "${CHAT_AI_SERVICE_ENABLED}" == "1" ]; then + safe_move /etc/nginx/includes/chat_ai.conf.disabled /etc/nginx/includes/chat_ai.conf + else + safe_move /etc/nginx/includes/chat_ai.conf /etc/nginx/includes/chat_ai.conf.disabled + fi + if [ "${KOKO_ENABLED}" == "0" ]; then safe_move /etc/nginx/includes/koko.conf /etc/nginx/includes/koko.conf.disabled fi From 677d2b5ee05ccc6b4a81207a27e1606df01e76a2 Mon Sep 17 00:00:00 2001 From: ibuler Date: Wed, 2 Sep 2026 17:10:21 +0800 Subject: [PATCH 05/18] perf: update default keys --- Dockerfile | 1 + example/example.crt | 19 +++++++++++++ example/example.key | 28 ++++++++++++++++++++ includes/facelive.conf.disabled | 15 ----------- includes/lion.conf | 15 ----------- init.sh | 47 ++++++++++++++++++++------------- 6 files changed, 77 insertions(+), 48 deletions(-) create mode 100644 example/example.crt create mode 100644 example/example.key delete mode 100644 includes/facelive.conf.disabled delete mode 100644 includes/lion.conf diff --git a/Dockerfile b/Dockerfile index 218846e..39e0a83 100644 --- a/Dockerfile +++ b/Dockerfile @@ -40,6 +40,7 @@ COPY --from=luna /opt/luna /opt/luna COPY versions.txt /opt/download/versions.txt COPY nginx.conf /etc/nginx/nginx.conf COPY includes /etc/nginx/includes +COPY example /etc/nginx/example COPY default.conf /etc/nginx/conf.d/default.conf COPY http_server.conf /etc/nginx/sites-enabled/http_server.conf COPY https_server.conf /etc/nginx/sites-enabled/https_server.conf diff --git a/example/example.crt b/example/example.crt new file mode 100644 index 0000000..5aa6549 --- /dev/null +++ b/example/example.crt @@ -0,0 +1,19 @@ +-----BEGIN CERTIFICATE----- +MIIDCTCCAfGgAwIBAgIUDuZGvwzXjUIKAuB993+Z4RNZXoEwDQYJKoZIhvcNAQEL +BQAwFDESMBAGA1UEAwwJbG9jYWxob3N0MB4XDTI2MDgyNjA1MjQxMFoXDTM2MDgy +MzA1MjQxMVowFDESMBAGA1UEAwwJbG9jYWxob3N0MIIBIjANBgkqhkiG9w0BAQEF +AAOCAQ8AMIIBCgKCAQEAwLeA47PjnHxFoJEQcAnphRoAz5WQ/IbEMFXRZUC/DH4G +r8B25rOblfH7w5zdowgqM5LSzdMAEFTtJt9Z5IFmYgFwijxTE04NBSAo6JFXVQeW +0MMzi/7Q/p4+6UMRmDTglkfiiRlBRIrx2rUdCezj1BntrdVZuvCS4JfJ19iW0dUR +VqvuloUDmluhv18Nv7O/Sr7dedZWG3t1EuKrpc8HnWuCHwR3lm3V9jJxcJUBKTu6 +B+LM2JxHa7XjQlLIQNvFa6LB7zQ+DKr4TAuzuzfpZhysXAX/sVIwBiKKnQ+6Gcuj +0CSuy8wiE0vEA8vbYWNqdAVski0Zoes88Cu5InPKhQIDAQABo1MwUTAdBgNVHQ4E +FgQUPmhCIuDVL7+Eu86oCngoxnBkAYswHwYDVR0jBBgwFoAUPmhCIuDVL7+Eu86o +CngoxnBkAYswDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAi9AF +GeYJz+0DVRIlqwX7FcBbs2jQkLvGb1sxWUixCekBEWa3d4481Qb76MlUPvTQOqVE +3i7Jf1kaJoEsRUVF8wjmCAe6cc2vinCzBn9Vz+f1H6yKdZNcH9yEUnaO8SyzKT7w +ejMoT/C5/7kVGrPF9JH6j6o/UqASgJAzn7F5jhnMeySfR7h7qaaHOutrnUeDcxa6 +t0NfN5x8eT7ufza6+6gC98eayb0RqUrTaQ45HXa1mYwio4EJbzRjitDjaII2RxXm +kdXagY3AGR6nkycOGhm1MBCsoM5xW7c+/qdCl9EryDWDf2mvI6Q9j0XsAhBkjveP +DJ4A4buX9HRk6elihw== +-----END CERTIFICATE----- diff --git a/example/example.key b/example/example.key new file mode 100644 index 0000000..4eeb400 --- /dev/null +++ b/example/example.key @@ -0,0 +1,28 @@ +-----BEGIN PRIVATE KEY----- +MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDAt4Djs+OcfEWg +kRBwCemFGgDPlZD8hsQwVdFlQL8MfgavwHbms5uV8fvDnN2jCCozktLN0wAQVO0m +31nkgWZiAXCKPFMTTg0FICjokVdVB5bQwzOL/tD+nj7pQxGYNOCWR+KJGUFEivHa +tR0J7OPUGe2t1Vm68JLgl8nX2JbR1RFWq+6WhQOaW6G/Xw2/s79Kvt151lYbe3US +4qulzweda4IfBHeWbdX2MnFwlQEpO7oH4szYnEdrteNCUshA28VrosHvND4MqvhM +C7O7N+lmHKxcBf+xUjAGIoqdD7oZy6PQJK7LzCITS8QDy9thY2p0BWySLRmh6zzw +K7kic8qFAgMBAAECggEAA4nn3vm1pNdcIlenkp1/LgeAZ+kAkYwaXCNA36tLSfwI +1jKIvGTxGjuOrbsN3GmEK0N3hXoDY6/IVWqY6JFyHNVj7wkU79ZpQzFulUURJamP +AzEiaC0UqPULUkmXloQaDG7J4efJ0AVkU+mRdlYx1McCtN3YpcGD7bkImfykwFOX +p8ol3PgHQJkPxaHuGGk9yDaNUmPRz9JBAQz/fd3BLTX7ue9YtatS2gCSmaY4/kbX +oI6VOavBwV5SRaeOgsfFi1IAsgPJ2dI9W/WCHRBqHM7Hgsi9f+gHrUEewXSC7Dh7 +2FHVrHxiHlCD1IQei+8nFjg3ZK218T52t3RAdJt5PQKBgQD248PnRjrWjHjIRJ6T +cwMXtNa36xzfMd1R4nC0jmbpNJxeyUNnwg0twl9/scTtMULvpX7/w7hRNreeDQT/ +64Dy6TVKENPxzf7RT3s5Ly3g5owMRrue9sLLQImacVzkgoytgCIRpfYjROg9wi26 +FSzOaSkFSgwYCYXxu3qpGRVG9wKBgQDH0/7zHzbwzajoem6tSEdavFcJJiiYN60F +8BKL53KIkb89OGykDpLV9I2CL0zFiPYhbxECl9nqT1sDI6Qdsb9VEF9st8Tc5kjw +W441VJMJYxUA7QfyDm76IiLJE3m9/f5SFXMmVVkJVjs+usy/TXf0tuVAE5ralxNQ +1uJZq94vYwKBgQDyXYXjdD4ugJfRggtqFG3kx9JBmr0tHnZ1/CVIGsNMDCm1oz5Y +jVcCpN27LXh0oPdk6sJRsoEuuNhof794vGhKDkYR/5MQvXh5Yd1FtdsD/U9efdGR +rAxuG1z6EG9wo/gWGsNXL+UBmpOijQz2r/Lcbr+mQZq9vhuPwswXVFhe4QKBgErX +yeuBS3CRdqvr/zwDkEYZuHeCxT2NzM4mhqvDuhAQlpH1aitgEfr0p3OVB6oMjDMl +iDdybHnn0uywEq3Ufxb7FOKBSch6r+LmR7MNxCyF4b4BCTLN2R7yXhj1pGlWkkRo +KEK5QKnQlEwAZuNXvo/3WJHRRfSNFPz4Hrr7NjKFAoGAB3aDQUDGfWE1CdB0XDPL ++/IB/BRIuxjvwyg1eFHHSMc6C1FFmn3mG65oCC18DmZMPFag4lPuXW5ylR0LJkSz +IchcUKO5dlr64cwBSmVAJKR8Gtj7kcp9hAhIMQKDNWE1h93RuSz2VFBd00n1fwlT +/toLw7peVpKft+Y+k/SGhXo= +-----END PRIVATE KEY----- diff --git a/includes/facelive.conf.disabled b/includes/facelive.conf.disabled deleted file mode 100644 index 45ebe87..0000000 --- a/includes/facelive.conf.disabled +++ /dev/null @@ -1,15 +0,0 @@ -location /facelive/ { - proxy_pass http://facelive:9999; - proxy_buffering off; - proxy_http_version 1.1; - proxy_request_buffering off; - proxy_set_header Upgrade $http_upgrade; - proxy_set_header Connection "upgrade"; - proxy_set_header Host $host; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_ignore_client_abort on; - proxy_connect_timeout 600; - proxy_send_timeout 600; - proxy_read_timeout 600; - send_timeout 6000; -} diff --git a/includes/lion.conf b/includes/lion.conf deleted file mode 100644 index 4f83ddd..0000000 --- a/includes/lion.conf +++ /dev/null @@ -1,15 +0,0 @@ -location /lion/ { - proxy_pass http://lion:8081; - proxy_buffering off; - proxy_http_version 1.1; - proxy_request_buffering off; - proxy_set_header Upgrade $http_upgrade; - proxy_set_header Connection "upgrade"; - proxy_set_header Host $host; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_ignore_client_abort on; - proxy_connect_timeout 600; - proxy_send_timeout 600; - proxy_read_timeout 600; - send_timeout 6000; -} diff --git a/init.sh b/init.sh index a9d0511..802a67c 100755 --- a/init.sh +++ b/init.sh @@ -64,6 +64,32 @@ function config_http() { config_nginx "${config_file}" } +function config_certificate() { + cert_dir=/etc/nginx/cert + example_dir=/etc/nginx/example + cert_name=${SSL_CERTIFICATE:-server.crt} + key_name=${SSL_CERTIFICATE_KEY:-server.key} + cert_file=${cert_dir}/${cert_name} + key_file=${cert_dir}/${key_name} + + mkdir -p "${cert_dir}" + + if [[ ! -f "${cert_file}" && ! -f "${key_file}" ]]; then + if [[ -n "${SSL_CERTIFICATE}" || -n "${SSL_CERTIFICATE_KEY}" ]]; then + echo "SSL certificate and private key not found: ${cert_file}, ${key_file}" + exit 1 + fi + + cp -f "${example_dir}/example.crt" "${cert_file}" + cp -f "${example_dir}/example.key" "${key_file}" + elif [[ ! -f "${cert_file}" || ! -f "${key_file}" ]]; then + echo "SSL certificate and private key must both exist: ${cert_file}, ${key_file}" + exit 1 + fi + + chmod 600 "${cert_file}" "${key_file}" +} + function config_https() { config_file=/etc/nginx/conf.d/https_server.conf if [ -f "${config_file}" ]; then @@ -71,6 +97,7 @@ function config_https() { fi cp -f /etc/nginx/sites-enabled/https_server.conf "${config_file}" + config_certificate config_nginx "${config_file}" sed -i "s@server web:.*;@server localhost:51980;@g" "${config_file}" @@ -89,12 +116,8 @@ function config_https() { sed -i "s@# listen \[::\]:443 ssl;@listen [::]:${HTTPS_PORT} ssl;@g" "${config_file}" fi - if [ -n "${SSL_CERTIFICATE}" ] && [ -f "/etc/nginx/cert/${SSL_CERTIFICATE}" ]; then - sed -i "s@ssl_certificate .*;@ssl_certificate cert/${SSL_CERTIFICATE};@g" "${config_file}" - fi - if [ -n "${SSL_CERTIFICATE_KEY}" ] && [ -f "/etc/nginx/cert/${SSL_CERTIFICATE_KEY}" ]; then - sed -i "s@ssl_certificate_key .*;@ssl_certificate_key cert/${SSL_CERTIFICATE_KEY};@g" "${config_file}" - fi + sed -i "s@ssl_certificate .*;@ssl_certificate cert/${cert_name};@g" "${config_file}" + sed -i "s@ssl_certificate_key .*;@ssl_certificate_key cert/${key_name};@g" "${config_file}" if [ -n "${CLIENT_MAX_BODY_SIZE}" ]; then sed -i "s@client_max_body_size .*;@client_max_body_size ${CLIENT_MAX_BODY_SIZE};@g" "${config_file}" fi @@ -116,10 +139,6 @@ function config_components() { safe_move /etc/nginx/includes/koko.conf /etc/nginx/includes/koko.conf.disabled fi - if [ "${LION_ENABLED}" == "0" ]; then - safe_move /etc/nginx/includes/lion.conf /etc/nginx/includes/lion.conf.disabled - fi - if [ "${CHEN_ENABLED}" == "0" ]; then safe_move /etc/nginx/includes/chen.conf /etc/nginx/includes/chen.conf.disabled fi @@ -130,17 +149,9 @@ function config_components() { safe_move /etc/nginx/includes/kotl.conf /etc/nginx/includes/kotl.conf.disabled fi - if [ "${FACELIVE_ENABLED}" == "0" ]; then - safe_move /etc/nginx/includes/facelive.conf /etc/nginx/includes/facelive.conf.disabled - fi - if [[ "${USE_XPACK}" == "1" && "${RAZOR_ENABLED}" != "0" ]]; then safe_move /etc/nginx/includes/razor.conf.disabled /etc/nginx/includes/razor.conf fi - - if [[ "${USE_XPACK}" == "1" && "${FACELIVE_ENABLED}" == "1" ]]; then - safe_move /etc/nginx/includes/facelive.conf.disabled /etc/nginx/includes/facelive.conf - fi } function copy_versions_to_core() { From ea2e98f9423eb7705373779d76ad0ff651716547 Mon Sep 17 00:00:00 2001 From: ibuler Date: Wed, 2 Sep 2026 17:58:36 +0800 Subject: [PATCH 06/18] perf update init docker --- init.sh | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-) diff --git a/init.sh b/init.sh index 7e8534f..6a91ffa 100755 --- a/init.sh +++ b/init.sh @@ -67,19 +67,28 @@ function config_http() { function config_certificate() { cert_dir=/etc/nginx/cert example_dir=/etc/nginx/example - cert_name=${SSL_CERTIFICATE:-server.crt} - key_name=${SSL_CERTIFICATE_KEY:-server.key} + default_cert_name=server.crt + default_key_name=server.key + cert_name=${SSL_CERTIFICATE:-${default_cert_name}} + key_name=${SSL_CERTIFICATE_KEY:-${default_key_name}} cert_file=${cert_dir}/${cert_name} key_file=${cert_dir}/${key_name} mkdir -p "${cert_dir}" - if [[ ! -f "${cert_file}" && ! -f "${key_file}" ]]; then + if [[ ! -f "${cert_file}" || ! -f "${key_file}" ]]; then if [[ -n "${SSL_CERTIFICATE}" || -n "${SSL_CERTIFICATE_KEY}" ]]; then - echo "SSL certificate and private key not found: ${cert_file}, ${key_file}" - exit 1 + echo "Warning: SSL certificate or private key not found: ${cert_file}, ${key_file}" + echo "Falling back to the default certificate pair: ${default_cert_name}, ${default_key_name}" fi + cert_name=${default_cert_name} + key_name=${default_key_name} + cert_file=${cert_dir}/${cert_name} + key_file=${cert_dir}/${key_name} + fi + + if [[ ! -f "${cert_file}" && ! -f "${key_file}" ]]; then cp -f "${example_dir}/example.crt" "${cert_file}" cp -f "${example_dir}/example.key" "${key_file}" elif [[ ! -f "${cert_file}" || ! -f "${key_file}" ]]; then From 232f576e82db0e601e241a351a6256300f22a3a9 Mon Sep 17 00:00:00 2001 From: ibuler Date: Thu, 3 Sep 2026 10:33:44 +0800 Subject: [PATCH 07/18] refactor: unify web entrypoints --- Dockerfile | 1 - default.conf | 2 +- http_server.conf | 23 --------------------- https_server.conf | 28 +++++++++++++++++++++---- init.sh | 52 ++++++++++++++--------------------------------- 5 files changed, 40 insertions(+), 66 deletions(-) delete mode 100644 http_server.conf diff --git a/Dockerfile b/Dockerfile index 39e0a83..8cd30c2 100644 --- a/Dockerfile +++ b/Dockerfile @@ -42,6 +42,5 @@ COPY nginx.conf /etc/nginx/nginx.conf COPY includes /etc/nginx/includes COPY example /etc/nginx/example COPY default.conf /etc/nginx/conf.d/default.conf -COPY http_server.conf /etc/nginx/sites-enabled/http_server.conf COPY https_server.conf /etc/nginx/sites-enabled/https_server.conf COPY init.sh /docker-entrypoint.d/40-init-config.sh diff --git a/default.conf b/default.conf index 5356604..8a481b0 100644 --- a/default.conf +++ b/default.conf @@ -1,5 +1,5 @@ server { - listen 51980; # 如果不开启 https, 这里会 sed 成 80 + listen 51980; # 容器内部 Web 服务端口，不对外映射 # listen [::]:51980; client_max_body_size 4096m; diff --git a/http_server.conf b/http_server.conf deleted file mode 100644 index 8f41c05..0000000 --- a/http_server.conf +++ /dev/null @@ -1,23 +0,0 @@ -server { - listen 80; - # listen [::]:80; - # server_name demo.jumpserver.org; # 取消注释并自行修改成你自己的域名 - - client_max_body_size 5000m; - - location / { - proxy_pass http://localhost:51980; - proxy_buffering off; - proxy_request_buffering off; - proxy_http_version 1.1; - proxy_set_header Host $host; - proxy_set_header Upgrade $http_upgrade; - proxy_set_header Connection $http_connection; - proxy_set_header X-Forwarded-For $remote_addr; - proxy_ignore_client_abort on; - proxy_connect_timeout 600; - proxy_send_timeout 600; - proxy_read_timeout 600; - send_timeout 6000; - } -} \ No newline at end of file diff --git a/https_server.conf b/https_server.conf index 5c95698..3eb5559 100644 --- a/https_server.conf +++ b/https_server.conf @@ -5,14 +5,34 @@ upstream http_server { } server { - listen 80; + listen 80; # 容器内部固定端口，对外映射由 installer 控制 # listen [::]:80; # server_name demo.jumpserver.org; # 取消注释并自行修改成你自己的域名 - return 307 https://$host$request_uri; + # HTTPS_REDIRECT + + client_max_body_size 5000m; + + location / { + proxy_pass http://http_server; + proxy_buffering off; + proxy_request_buffering off; + proxy_http_version 1.1; + proxy_set_header Host $host; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection $http_connection; + # 默认作为第一层；仅显式 USE_LB=0 时由启动脚本改为信任上游代理头。 + proxy_set_header X-Forwarded-For $remote_addr; + + proxy_ignore_client_abort on; + proxy_connect_timeout 600; + proxy_send_timeout 600; + proxy_read_timeout 600; + send_timeout 6000; + } } server { - listen 443 ssl; + listen 443 ssl; # 容器内部固定端口，对外映射由 installer 控制 http2 on; # listen [::]:443 ssl; # server_name demo.jumpserver.org; # 取消注释并自行修改成你自己的域名 @@ -36,8 +56,8 @@ server { proxy_set_header Host $host; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $http_connection; + # 默认作为第一层；仅显式 USE_LB=0 时由启动脚本改为信任上游代理头。 proxy_set_header X-Forwarded-For $remote_addr; - # proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; # 如果上层还有其他 slb 需要使用 $proxy_add_x_forwarded_for 获取真实 ip proxy_ignore_client_abort on; proxy_connect_timeout 600; diff --git a/init.sh b/init.sh index 6a91ffa..5a5d6ca 100755 --- a/init.sh +++ b/init.sh @@ -1,8 +1,5 @@ #!/bin/bash # -HTTPS_PORT=${HTTPS_PORT:-443} - - function config_nginx() { config_file=$1 if [ ! -f "${config_file}" ]; then @@ -10,10 +7,6 @@ function config_nginx() { exit 1 fi - if [ -z "${USE_LB}" ]; then - USE_LB=1 - fi - if [ "${USE_IPV6}" == "1" ]; then sed -i "s@# listen \[::\]:80;@listen \[::\]:80;@g" "${config_file}" if [ -f "/etc/nginx/conf.d/default.conf" ]; then @@ -30,10 +23,13 @@ function config_nginx() { sed -i "s@client_max_body_size .*;@client_max_body_size ${CLIENT_MAX_BODY_SIZE};@g" /etc/nginx/conf.d/*.conf fi - if [ "${USE_LB}" == "1" ]; then - sed -i 's@proxy_set_header X-Forwarded-For .*;@proxy_set_header X-Forwarded-For $remote_addr;@g' "${config_file}" - else + # Only an explicit USE_LB=0 means there is a trusted proxy in front of us. + # Otherwise this server is the trust boundary and must discard client-supplied + # X-Forwarded-For values. + if [ "${USE_LB:-1}" == "0" ]; then sed -i 's@proxy_set_header X-Forwarded-For .*;@proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;@g' "${config_file}" + else + sed -i 's@proxy_set_header X-Forwarded-For .*;@proxy_set_header X-Forwarded-For $remote_addr;@g' "${config_file}" fi } @@ -52,18 +48,6 @@ function config_helm() { fi } -# Installer mount -# https://github.com/jumpserver/installer/blob/dev/compose/docker-compose-lb.yml#L14 -function config_http() { - config_file=/etc/nginx/conf.d/http_server.conf - if [ -f "${config_file}" ]; then - rm -f "${config_file}" - fi - cp -f /etc/nginx/sites-enabled/http_server.conf "${config_file}" - - config_nginx "${config_file}" -} - function config_certificate() { cert_dir=/etc/nginx/cert example_dir=/etc/nginx/example @@ -110,19 +94,17 @@ function config_https() { config_nginx "${config_file}" sed -i "s@server web:.*;@server localhost:51980;@g" "${config_file}" - if [ "${HTTPS_PORT}" != "443" ]; then - # Old - sed -i "s@https://\$server_name\$request_uri;@https://\$host:${HTTPS_PORT}\$request_uri;@g" "${config_file}" - # New - sed -i "s@https://\$host\$request_uri;@https://\$host:${HTTPS_PORT}\$request_uri;@g" "${config_file}" - fi - - if [ "${HTTPS_PORT}" != "443" ]; then - sed -i "s@listen 443 ssl;@listen ${HTTPS_PORT} ssl;@g" "${config_file}" + if [[ -n "${HTTPS_PORT}" && "${HTTPS_PORT}" != "0" ]]; then + if [ "${HTTPS_PORT}" == "443" ]; then + redirect_url='https://$host$request_uri' + else + redirect_url="https://\$host:${HTTPS_PORT}\$request_uri" + fi + sed -i "s@ # HTTPS_REDIRECT@ return 307 ${redirect_url};@g" "${config_file}" fi if [ "${USE_IPV6}" == "1" ]; then - sed -i "s@# listen \[::\]:443 ssl;@listen [::]:${HTTPS_PORT} ssl;@g" "${config_file}" + sed -i "s@# listen \[::\]:443 ssl;@listen [::]:443 ssl;@g" "${config_file}" fi sed -i "s@ssl_certificate .*;@ssl_certificate cert/${cert_name};@g" "${config_file}" @@ -187,11 +169,7 @@ function main() { exit 0 fi - if [ -f "/etc/nginx/sites-enabled/https_server.conf" ]; then - config_https - else - config_http - fi + config_https config_components if [ -f "/etc/init.d/cron" ]; then From 2a170a433014c7f501ee7af195dc0e2de091e8d6 Mon Sep 17 00:00:00 2001 From: ibuler Date: Thu, 3 Sep 2026 15:16:45 +0800 Subject: [PATCH 08/18] refactor: decouple client downloads from web-static --- .github/workflows/check-deps-versions.yml | 20 ++++++++++++++++---- Dockerfile | 1 + Dockerfile-static | 2 +- README.md | 5 +++++ client-version.txt | 3 +++ init.sh | 3 +++ prepare.sh | 15 +-------------- versions.txt | 2 -- 8 files changed, 30 insertions(+), 21 deletions(-) create mode 100644 client-version.txt diff --git a/.github/workflows/check-deps-versions.yml b/.github/workflows/check-deps-versions.yml index 006b335..c5a909f 100644 --- a/.github/workflows/check-deps-versions.yml +++ b/.github/workflows/check-deps-versions.yml @@ -1,4 +1,6 @@ on: + repository_dispatch: + types: [client-released] schedule: - cron: "0 1 * * *" push: @@ -44,15 +46,21 @@ jobs: - name: Checkout existing branch or create new one run: | if [ "$branch_exists" == "true" ]; then - git checkout pr@${{ matrix.branch }}@upgrade_client + git checkout -B pr@${{ matrix.branch }}@upgrade_client origin/${{ matrix.branch }} else git checkout -b pr@${{ matrix.branch }}@upgrade_client fi - name: Check client version + env: + RELEASED_CLIENT_VERSION: ${{ github.event.client_payload.version }} run: | - version=$(curl -s https://api.github.com/repos/jumpserver/clients/releases/latest | jq -r .tag_name) - sed -i "s/Client_VERSION=.*/Client_VERSION=${version}/g" versions.txt + if [ -n "$RELEASED_CLIENT_VERSION" ]; then + version="$RELEASED_CLIENT_VERSION" + else + version=$(curl --fail --silent --show-error 'https://api.github.com/repos/jumpserver/luna/releases?per_page=1' | jq -er '.[0].tag_name | ltrimstr("v")') + fi + sed -i "s/CLIENT_VERSION=.*/CLIENT_VERSION=${version}/g" client-version.txt - name: Check tinker version run: | @@ -72,4 +80,8 @@ jobs: run: | git add . git commit -m "Update pkg versions" - git push origin pr@${{ matrix.branch }}@upgrade_client + if [ "$branch_exists" == "true" ]; then + git push --force-with-lease origin pr@${{ matrix.branch }}@upgrade_client + else + git push origin pr@${{ matrix.branch }}@upgrade_client + fi diff --git a/Dockerfile b/Dockerfile index 8cd30c2..68e7d82 100644 --- a/Dockerfile +++ b/Dockerfile @@ -38,6 +38,7 @@ WORKDIR /opt COPY --from=lina /opt/lina /opt/lina COPY --from=luna /opt/luna /opt/luna COPY versions.txt /opt/download/versions.txt +COPY client-version.txt /opt/download/client-version.txt COPY nginx.conf /etc/nginx/nginx.conf COPY includes /etc/nginx/includes COPY example /etc/nginx/example diff --git a/Dockerfile-static b/Dockerfile-static index ae84f32..2225348 100644 --- a/Dockerfile-static +++ b/Dockerfile-static @@ -2,7 +2,7 @@ FROM alpine:3.20 ARG TARGETARCH WORKDIR /tmp -COPY . . +COPY prepare.sh versions.txt ./ RUN set -ex \ && apk add --no-cache bash \ diff --git a/README.md b/README.md index 3649462..9694b28 100644 --- a/README.md +++ b/README.md @@ -2,6 +2,11 @@ JumpServer 的 LB Nginx Build 项目，其中包含 Lina, Luna 和一些静态安装包文件 +桌面客户端由 Luna 独立发布，不包含在 `web-static` 镜像中。现有 +`/download/public/Client__...` 下载地址保持不变；本地文件不存在时，Nginx +会回源到公共静态文件服务。客户端版本单独记录在 `client-version.txt` +中，更新该文件不会触发 `web-static` 重建。 + ## Docker 构建 ```bash diff --git a/client-version.txt b/client-version.txt new file mode 100644 index 0000000..5cc5bab --- /dev/null +++ b/client-version.txt @@ -0,0 +1,3 @@ +# Client installers are released independently and are not bundled in web-static. +CLIENT_VERSION=5.0.0-beta4 +CLIENT_NAME=JumpServer diff --git a/init.sh b/init.sh index 5a5d6ca..cf1a11d 100755 --- a/init.sh +++ b/init.sh @@ -154,6 +154,9 @@ function config_components() { function copy_versions_to_core() { if [[ -f "/opt/download/versions.txt" && -d "/opt/jumpserver/data/" ]]; then cp -f /opt/download/versions.txt /opt/jumpserver/data/version.txt + if [[ -f "/opt/download/client-version.txt" ]]; then + cat /opt/download/client-version.txt >> /opt/jumpserver/data/version.txt + fi fi } diff --git a/prepare.sh b/prepare.sh index 767fb1f..edf482d 100755 --- a/prepare.sh +++ b/prepare.sh @@ -36,21 +36,8 @@ cd ${DOWNLOAD_DIR}/public || exit 1 # wget ${DOWNLOAD_URL}/public/Microsoft_Remote_Desktop_${MRD_VERSION}_installer.pkg wget https://github.com/PowerShell/Win32-OpenSSH/releases/download/${OPENSSH_VERSION}p1-Beta/OpenSSH-Win64-${OPENSSH_VERSION}.msi -clients=( - "${CLIENT_NAME}Client_${CLIENT_VERSION}_x64-setup.exe" - "${CLIENT_NAME}Client_${CLIENT_VERSION}_aarch64.dmg" -) -for client in "${clients[@]}"; do - wget "https://github.com/jumpserver/clients/releases/download/v${CLIENT_VERSION}/${client}" -done - for arch in x64 arm64; do wget https://downloads.mongodb.com/compass/mongosh-${MONGOSH_VERSION}-linux-${arch}.tgz done -for i in $(ls ${CLIENT_NAME}*);do - to=${i/${CLIENT_NAME}/} - ln -s ${i} ${to} -done - -cp "${PROJECT_DIR}"/versions.txt ${DOWNLOAD_DIR} \ No newline at end of file +cp "${PROJECT_DIR}"/versions.txt ${DOWNLOAD_DIR} diff --git a/versions.txt b/versions.txt index 380b796..6eec5d4 100644 --- a/versions.txt +++ b/versions.txt @@ -10,5 +10,3 @@ MRD_VERSION=10.6.7 OPENSSH_VERSION=v9.4.0.0 MONGOSH_VERSION=2.2.12 TINKER_VERSION=v0.2.3 -CLIENT_VERSION=4.1.6 -CLIENT_NAME=JumpServer From 4ba3f8ee5de9225e048d9f383d115d66b6e30721 Mon Sep 17 00:00:00 2001 From: Eric Date: Fri, 4 Sep 2026 13:33:11 +0800 Subject: [PATCH 09/18] feat: replace chat ai route with kael --- includes/{chat_ai.conf.disabled => kael.conf.disabled} | 4 ++-- init.sh | 6 +++--- 2 files changed, 5 insertions(+), 5 deletions(-) rename includes/{chat_ai.conf.disabled => kael.conf.disabled} (85%) diff --git a/includes/chat_ai.conf.disabled b/includes/kael.conf.disabled similarity index 85% rename from includes/chat_ai.conf.disabled rename to includes/kael.conf.disabled index 57b39f6..b30aeac 100644 --- a/includes/chat_ai.conf.disabled +++ b/includes/kael.conf.disabled @@ -1,5 +1,5 @@ -location ^~ /api/v1/chat-ai/ { - proxy_pass http://ai:8088; +location ^~ /kael/ { + proxy_pass http://kael:8083; proxy_buffering off; proxy_cache off; proxy_request_buffering off; diff --git a/init.sh b/init.sh index cf1a11d..7debed4 100755 --- a/init.sh +++ b/init.sh @@ -126,10 +126,10 @@ function config_components() { safe_move /etc/nginx/includes/core.conf /etc/nginx/includes/core.conf.disabled fi - if [ "${CHAT_AI_SERVICE_ENABLED}" == "1" ]; then - safe_move /etc/nginx/includes/chat_ai.conf.disabled /etc/nginx/includes/chat_ai.conf + if [ "${KAEL_ENABLED}" == "0" ]; then + safe_move /etc/nginx/includes/kael.conf /etc/nginx/includes/kael.conf.disabled else - safe_move /etc/nginx/includes/chat_ai.conf /etc/nginx/includes/chat_ai.conf.disabled + safe_move /etc/nginx/includes/kael.conf.disabled /etc/nginx/includes/kael.conf fi if [ "${KOKO_ENABLED}" == "0" ]; then From 52b1f9a9ef33b09e96e6c8ed1c5381d6456913f9 Mon Sep 17 00:00:00 2001 From: ibuler Date: Fri, 4 Sep 2026 15:52:24 +0800 Subject: [PATCH 10/18] perf: update client download --- .github/workflows/build-static-image.yml | 2 +- .github/workflows/check-deps-versions.yml | 15 ++++++++++-- Dockerfile | 3 +-- Dockerfile-ee | 5 ++++ Dockerfile-static | 4 ++-- README.md | 9 ++++---- client-version.txt | 2 +- client.sh | 28 +++++++++++++++++++++++ prepare.sh => static.sh | 0 9 files changed, 56 insertions(+), 12 deletions(-) create mode 100755 client.sh rename prepare.sh => static.sh (100%) diff --git a/.github/workflows/build-static-image.yml b/.github/workflows/build-static-image.yml index e1853c0..33b8d40 100644 --- a/.github/workflows/build-static-image.yml +++ b/.github/workflows/build-static-image.yml @@ -7,7 +7,7 @@ on: - "osm" paths: - "versions.txt" - - "prepare.sh" + - "static.sh" - "Dockerfile-static" jobs: diff --git a/.github/workflows/check-deps-versions.yml b/.github/workflows/check-deps-versions.yml index c5a909f..3832a01 100644 --- a/.github/workflows/check-deps-versions.yml +++ b/.github/workflows/check-deps-versions.yml @@ -58,9 +58,20 @@ jobs: if [ -n "$RELEASED_CLIENT_VERSION" ]; then version="$RELEASED_CLIENT_VERSION" else - version=$(curl --fail --silent --show-error 'https://api.github.com/repos/jumpserver/luna/releases?per_page=1' | jq -er '.[0].tag_name | ltrimstr("v")') + version=$(curl --fail --silent --show-error 'https://api.github.com/repos/jumpserver/luna/releases?per_page=100' | jq -r ' + first( + .[] + | select(any(.assets[]?; .name | test(" Setup\\.exe$|-(arm64|x64)\\.dmg$"))) + | .tag_name + ) // empty + ') + fi + version="${version#v}" + if [ -n "$version" ]; then + sed -i "s/CLIENT_VERSION=.*/CLIENT_VERSION=${version}/g" client-version.txt + else + echo "No published Luna release with desktop client assets found" fi - sed -i "s/CLIENT_VERSION=.*/CLIENT_VERSION=${version}/g" client-version.txt - name: Check tinker version run: | diff --git a/Dockerfile b/Dockerfile index 68e7d82..e0d050b 100644 --- a/Dockerfile +++ b/Dockerfile @@ -21,8 +21,7 @@ RUN set -ex \ && apt-get -y install --no-install-recommends ${TOOLS} \ && wget https://github.com/jumpserver-dev/healthcheck/releases/latest/download/check_linux_${TARGETARCH}.deb \ && dpkg -i check_linux_${TARGETARCH}.deb \ - && apt-get purge -y wget \ - curl \ + && apt-get purge -y curl \ nginx-module-xslt \ nginx-module-njs \ libxml2 \ diff --git a/Dockerfile-ee b/Dockerfile-ee index 0a3cfed..8ccdbe4 100644 --- a/Dockerfile-ee +++ b/Dockerfile-ee @@ -3,3 +3,8 @@ FROM jumpserver/web-static:20260819_065947 AS static FROM jumpserver/web:${VERSION}-ce COPY --from=static /opt/ /opt/ +COPY client.sh client-version.txt /tmp/ + +RUN set -ex \ + && /tmp/client.sh \ + && rm -f /tmp/client.sh /tmp/client-version.txt diff --git a/Dockerfile-static b/Dockerfile-static index 2225348..30f4997 100644 --- a/Dockerfile-static +++ b/Dockerfile-static @@ -2,8 +2,8 @@ FROM alpine:3.20 ARG TARGETARCH WORKDIR /tmp -COPY prepare.sh versions.txt ./ +COPY static.sh versions.txt ./ RUN set -ex \ && apk add --no-cache bash \ - && bash ./prepare.sh + && bash ./static.sh diff --git a/README.md b/README.md index 9694b28..6ec59e9 100644 --- a/README.md +++ b/README.md @@ -2,10 +2,11 @@ JumpServer 的 LB Nginx Build 项目，其中包含 Lina, Luna 和一些静态安装包文件 -桌面客户端由 Luna 独立发布，不包含在 `web-static` 镜像中。现有 -`/download/public/Client__...` 下载地址保持不变；本地文件不存在时，Nginx -会回源到公共静态文件服务。客户端版本单独记录在 `client-version.txt` -中，更新该文件不会触发 `web-static` 重建。 +桌面客户端由 Luna 独立发布，不包含在 `web-static` 和 CE 镜像中。 +`Dockerfile-ee` 构建时通过 `client.sh` 下载客户端并写入 `/opt/download/public/`。 +现有 `/download/public/Client__...` 下载地址保持不变；CE 镜像中本地文件不存在时， +Nginx 会回源到公共静态文件服务。客户端版本单独记录在 `client-version.txt` 中， +更新该文件不会触发 `web-static` 重建。 ## Docker 构建 diff --git a/client-version.txt b/client-version.txt index 5cc5bab..8f2f0fb 100644 --- a/client-version.txt +++ b/client-version.txt @@ -1,3 +1,3 @@ -# Client installers are released independently and are not bundled in web-static. +# Client installers are downloaded only while building Dockerfile-ee. CLIENT_VERSION=5.0.0-beta4 CLIENT_NAME=JumpServer diff --git a/client.sh b/client.sh new file mode 100755 index 0000000..502e728 --- /dev/null +++ b/client.sh @@ -0,0 +1,28 @@ +#!/bin/sh +set -eu + +PROJECT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd) + +. "${PROJECT_DIR}/client-version.txt" + +: "${CLIENT_VERSION:?CLIENT_VERSION is required}" +: "${CLIENT_NAME:?CLIENT_NAME is required}" + +RELEASE_URL=${CLIENT_RELEASE_URL:-https://github.com/jumpserver/luna/releases/download/v${CLIENT_VERSION}} +DOWNLOAD_DIR=${CLIENT_DOWNLOAD_DIR:-/opt/download/public} + +mkdir -p "${DOWNLOAD_DIR}" +cd "${DOWNLOAD_DIR}" + +windows_file="${CLIENT_NAME}Client_${CLIENT_VERSION}_x64-setup.exe" +macos_arm64_file="${CLIENT_NAME}Client_${CLIENT_VERSION}_aarch64.dmg" + +wget --https-only \ + --output-document="${windows_file}" \ + "${RELEASE_URL}/${CLIENT_NAME}-${CLIENT_VERSION}%20Setup.exe" +wget --https-only \ + --output-document="${macos_arm64_file}" \ + "${RELEASE_URL}/${CLIENT_NAME}-${CLIENT_VERSION}-arm64.dmg" + +ln -s "${windows_file}" "Client_${CLIENT_VERSION}_x64-setup.exe" +ln -s "${macos_arm64_file}" "Client_${CLIENT_VERSION}_aarch64.dmg" diff --git a/prepare.sh b/static.sh similarity index 100% rename from prepare.sh rename to static.sh From 5a41b8032aab027080aadbeb0909f055e6c6e3b1 Mon Sep 17 00:00:00 2001 From: feng <1304903146@qq.com> Date: Sat, 5 Sep 2026 08:04:45 +0800 Subject: [PATCH 11/18] perf: rename --- client.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/client.sh b/client.sh index 502e728..5f66532 100755 --- a/client.sh +++ b/client.sh @@ -19,7 +19,7 @@ macos_arm64_file="${CLIENT_NAME}Client_${CLIENT_VERSION}_aarch64.dmg" wget --https-only \ --output-document="${windows_file}" \ - "${RELEASE_URL}/${CLIENT_NAME}-${CLIENT_VERSION}%20Setup.exe" + "${RELEASE_URL}/${CLIENT_NAME}-${CLIENT_VERSION}.Setup.exe" wget --https-only \ --output-document="${macos_arm64_file}" \ "${RELEASE_URL}/${CLIENT_NAME}-${CLIENT_VERSION}-arm64.dmg" From c8aab7cd1f5360a21b749d3ce2a3060d320057a5 Mon Sep 17 00:00:00 2001 From: ibuler Date: Wed, 9 Sep 2026 15:10:09 +0800 Subject: [PATCH 12/18] perf: update docker web build --- .github/workflows/check-deps-versions.yml | 21 ++++++++++++++++++--- README.md | 7 ++++--- client-version.txt | 2 +- client.sh | 9 +++++++-- 4 files changed, 30 insertions(+), 9 deletions(-) diff --git a/.github/workflows/check-deps-versions.yml b/.github/workflows/check-deps-versions.yml index 3832a01..d4d2ede 100644 --- a/.github/workflows/check-deps-versions.yml +++ b/.github/workflows/check-deps-versions.yml @@ -51,7 +51,7 @@ jobs: git checkout -b pr@${{ matrix.branch }}@upgrade_client fi - - name: Check client version + - name: Check Luna release version env: RELEASED_CLIENT_VERSION: ${{ github.event.client_payload.version }} run: | @@ -61,7 +61,22 @@ jobs: version=$(curl --fail --silent --show-error 'https://api.github.com/repos/jumpserver/luna/releases?per_page=100' | jq -r ' first( .[] - | select(any(.assets[]?; .name | test(" Setup\\.exe$|-(arm64|x64)\\.dmg$"))) + | . as $release + | (.tag_name | ltrimstr("v")) as $version + | select( + any( + .assets[]?; + .name == "JumpServer-\($version).exe" + ) + and any( + .assets[]?; + .name == "JumpServer-\($version)-arm64.dmg" + ) + and any( + .assets[]?; + .name == "JumpServer-WebLite-\($version)-x64.msi" + ) + ) | .tag_name ) // empty ') @@ -70,7 +85,7 @@ jobs: if [ -n "$version" ]; then sed -i "s/CLIENT_VERSION=.*/CLIENT_VERSION=${version}/g" client-version.txt else - echo "No published Luna release with desktop client assets found" + echo "No published Luna release with desktop client and WebLite assets found" fi - name: Check tinker version diff --git a/README.md b/README.md index 6ec59e9..bff1495 100644 --- a/README.md +++ b/README.md @@ -2,10 +2,11 @@ JumpServer 的 LB Nginx Build 项目，其中包含 Lina, Luna 和一些静态安装包文件 -桌面客户端由 Luna 独立发布，不包含在 `web-static` 和 CE 镜像中。 -`Dockerfile-ee` 构建时通过 `client.sh` 下载客户端并写入 `/opt/download/public/`。 +桌面客户端和 WebLite 由 Luna 独立发布，不包含在 `web-static` 和 CE 镜像中。 +`Dockerfile-ee` 构建时通过 `client.sh` 下载客户端到 `/opt/download/public/`，并将 +WebLite MSI 下载到 `/opt/download/applets/`。 现有 `/download/public/Client__...` 下载地址保持不变；CE 镜像中本地文件不存在时， -Nginx 会回源到公共静态文件服务。客户端版本单独记录在 `client-version.txt` 中， +Nginx 会回源到公共静态文件服务。客户端和 WebLite 共用 `client-version.txt` 中的 Luna 版本， 更新该文件不会触发 `web-static` 重建。 ## Docker 构建 diff --git a/client-version.txt b/client-version.txt index 8f2f0fb..ee05705 100644 --- a/client-version.txt +++ b/client-version.txt @@ -1,3 +1,3 @@ -# Client installers are downloaded only while building Dockerfile-ee. +# Client and WebLite installers are downloaded only while building Dockerfile-ee. CLIENT_VERSION=5.0.0-beta4 CLIENT_NAME=JumpServer diff --git a/client.sh b/client.sh index 5f66532..6a3421b 100755 --- a/client.sh +++ b/client.sh @@ -10,19 +10,24 @@ PROJECT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd) RELEASE_URL=${CLIENT_RELEASE_URL:-https://github.com/jumpserver/luna/releases/download/v${CLIENT_VERSION}} DOWNLOAD_DIR=${CLIENT_DOWNLOAD_DIR:-/opt/download/public} +WEBLITE_DOWNLOAD_DIR=${WEBLITE_DOWNLOAD_DIR:-/opt/download/applets} -mkdir -p "${DOWNLOAD_DIR}" +mkdir -p "${DOWNLOAD_DIR}" "${WEBLITE_DOWNLOAD_DIR}" cd "${DOWNLOAD_DIR}" windows_file="${CLIENT_NAME}Client_${CLIENT_VERSION}_x64-setup.exe" macos_arm64_file="${CLIENT_NAME}Client_${CLIENT_VERSION}_aarch64.dmg" +weblite_file="JumpServer-WebLite-${CLIENT_VERSION}-x64.msi" wget --https-only \ --output-document="${windows_file}" \ - "${RELEASE_URL}/${CLIENT_NAME}-${CLIENT_VERSION}.Setup.exe" + "${RELEASE_URL}/${CLIENT_NAME}-${CLIENT_VERSION}.exe" wget --https-only \ --output-document="${macos_arm64_file}" \ "${RELEASE_URL}/${CLIENT_NAME}-${CLIENT_VERSION}-arm64.dmg" +wget --https-only \ + --output-document="${WEBLITE_DOWNLOAD_DIR}/${weblite_file}" \ + "${RELEASE_URL}/${weblite_file}" ln -s "${windows_file}" "Client_${CLIENT_VERSION}_x64-setup.exe" ln -s "${macos_arm64_file}" "Client_${CLIENT_VERSION}_aarch64.dmg" From 5b2a163ec070f4e00e6ff90ecbb32b951fe82c62 Mon Sep 17 00:00:00 2001 From: ibuler Date: Wed, 9 Sep 2026 16:06:05 +0800 Subject: [PATCH 13/18] perf: udpate base version --- client-version.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/client-version.txt b/client-version.txt index ee05705..a215d67 100644 --- a/client-version.txt +++ b/client-version.txt @@ -1,3 +1,3 @@ # Client and WebLite installers are downloaded only while building Dockerfile-ee. -CLIENT_VERSION=5.0.0-beta4 +CLIENT_VERSION=5.0.0-beta9 CLIENT_NAME=JumpServer From efed60f53641fafa9dd2e2bcd0d28824b97751a2 Mon Sep 17 00:00:00 2001 From: ibuler Date: Mon, 14 Sep 2026 16:13:03 +0800 Subject: [PATCH 14/18] fix: update client and WebLite to 5.0.0-beta18 --- .github/workflows/check-deps-versions.yml | 2 +- client-version.txt | 2 +- client.sh | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/check-deps-versions.yml b/.github/workflows/check-deps-versions.yml index d4d2ede..763a07f 100644 --- a/.github/workflows/check-deps-versions.yml +++ b/.github/workflows/check-deps-versions.yml @@ -66,7 +66,7 @@ jobs: | select( any( .assets[]?; - .name == "JumpServer-\($version).exe" + .name == "JumpServer-\($version)-Setup.exe" ) and any( .assets[]?; diff --git a/client-version.txt b/client-version.txt index a215d67..ba87813 100644 --- a/client-version.txt +++ b/client-version.txt @@ -1,3 +1,3 @@ # Client and WebLite installers are downloaded only while building Dockerfile-ee. -CLIENT_VERSION=5.0.0-beta9 +CLIENT_VERSION=5.0.0-beta18 CLIENT_NAME=JumpServer diff --git a/client.sh b/client.sh index 6a3421b..20b598d 100755 --- a/client.sh +++ b/client.sh @@ -21,7 +21,7 @@ weblite_file="JumpServer-WebLite-${CLIENT_VERSION}-x64.msi" wget --https-only \ --output-document="${windows_file}" \ - "${RELEASE_URL}/${CLIENT_NAME}-${CLIENT_VERSION}.exe" + "${RELEASE_URL}/${CLIENT_NAME}-${CLIENT_VERSION}-Setup.exe" wget --https-only \ --output-document="${macos_arm64_file}" \ "${RELEASE_URL}/${CLIENT_NAME}-${CLIENT_VERSION}-arm64.dmg" From ea3628a44f5df0d776a70233e52c5eac0f3ec6e2 Mon Sep 17 00:00:00 2001 From: ibuler Date: Tue, 15 Sep 2026 17:55:48 +0800 Subject: [PATCH 15/18] fix: update client and WebLite to 5.0.0-beta21 --- client-version.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/client-version.txt b/client-version.txt index ba87813..04bbbb1 100644 --- a/client-version.txt +++ b/client-version.txt @@ -1,3 +1,3 @@ # Client and WebLite installers are downloaded only while building Dockerfile-ee. -CLIENT_VERSION=5.0.0-beta18 +CLIENT_VERSION=5.0.0-beta21 CLIENT_NAME=JumpServer From 3b3022ffa60b89dffbaa0b70e47c597f3b4eff6d Mon Sep 17 00:00:00 2001 From: EricGuang Date: Wed, 16 Sep 2026 13:39:44 +0800 Subject: [PATCH 16/18] perf: update tinker v0.3.0 (#336) * perf: update tinker v0.3.0 * perf: Update web static version --------- Co-authored-by: Eric Co-authored-by: github-actions[bot] --- Dockerfile-ee | 2 +- versions.txt | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/Dockerfile-ee b/Dockerfile-ee index 8ccdbe4..f3eea6f 100644 --- a/Dockerfile-ee +++ b/Dockerfile-ee @@ -1,5 +1,5 @@ ARG VERSION=dev -FROM jumpserver/web-static:20260819_065947 AS static +FROM jumpserver/web-static:20260916_053751 AS static FROM jumpserver/web:${VERSION}-ce COPY --from=static /opt/ /opt/ diff --git a/versions.txt b/versions.txt index 6eec5d4..8627055 100644 --- a/versions.txt +++ b/versions.txt @@ -9,4 +9,4 @@ DBEAVER_VERSION=22.3.4 MRD_VERSION=10.6.7 OPENSSH_VERSION=v9.4.0.0 MONGOSH_VERSION=2.2.12 -TINKER_VERSION=v0.2.3 +TINKER_VERSION=v0.3.0 From f971a73693030276090fa6cef2d76937eddc795d Mon Sep 17 00:00:00 2001 From: ibuler Date: Wed, 16 Sep 2026 18:09:23 +0800 Subject: [PATCH 17/18] chore: update client to v5.0.0-build1 and tinker to v0.3.0 --- client-version.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/client-version.txt b/client-version.txt index 04bbbb1..5717b3f 100644 --- a/client-version.txt +++ b/client-version.txt @@ -1,3 +1,3 @@ # Client and WebLite installers are downloaded only while building Dockerfile-ee. -CLIENT_VERSION=5.0.0-beta21 +CLIENT_VERSION=5.0.0-build1 CLIENT_NAME=JumpServer From 002cab324127c7f4481f6a1128933e70ecad2602 Mon Sep 17 00:00:00 2001 From: ibuler Date: Thu, 17 Sep 2026 13:52:15 +0800 Subject: [PATCH 18/18] fix: update client and WebLite installers to v5.0.0 --- client-version.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/client-version.txt b/client-version.txt index 5717b3f..9a2b652 100644 --- a/client-version.txt +++ b/client-version.txt @@ -1,3 +1,3 @@ # Client and WebLite installers are downloaded only while building Dockerfile-ee. -CLIENT_VERSION=5.0.0-build1 +CLIENT_VERSION=5.0.0 CLIENT_NAME=JumpServer