v5.0.0

.github/workflows/build-static-image.yml

@@ -7,7 +7,7 @@ on:
       - "osm"
     paths:
       - "versions.txt"
-      - "prepare.sh"
+      - "static.sh"
       - "Dockerfile-static"
 
 jobs:

.github/workflows/check-deps-versions.yml

@@ -1,4 +1,6 @@
 on:
+  repository_dispatch:
+    types: [client-released]
   schedule:
     - cron: "0 1 * * *"
   push:
@@ -44,15 +46,47 @@ jobs:
       - name: Checkout existing branch or create new one
         run: |
           if [ "$branch_exists" == "true" ]; then
-            git checkout pr@${{ matrix.branch }}@upgrade_client
+            git checkout -B pr@${{ matrix.branch }}@upgrade_client origin/${{ matrix.branch }}
           else
             git checkout -b pr@${{ matrix.branch }}@upgrade_client
           fi
 
-      - name: Check client version
+      - name: Check Luna release version
+        env:
+          RELEASED_CLIENT_VERSION: ${{ github.event.client_payload.version }}
         run: |
-          version=$(curl -s https://api.github.com/repos/jumpserver/clients/releases/latest | jq -r .tag_name)
-          sed -i "s/Client_VERSION=.*/Client_VERSION=${version}/g" versions.txt
+          if [ -n "$RELEASED_CLIENT_VERSION" ]; then
+            version="$RELEASED_CLIENT_VERSION"
+          else
+            version=$(curl --fail --silent --show-error 'https://api.github.com/repos/jumpserver/luna/releases?per_page=100' | jq -r '
+              first(
+                .[]
+                | . as $release
+                | (.tag_name | ltrimstr("v")) as $version
+                | select(
+                    any(
+                      .assets[]?;
+                      .name == "JumpServer-\($version)-Setup.exe"
+                    )
+                    and any(
+                      .assets[]?;
+                      .name == "JumpServer-\($version)-arm64.dmg"
+                    )
+                    and any(
+                      .assets[]?;
+                      .name == "JumpServer-WebLite-\($version)-x64.msi"
+                    )
+                  )
+                | .tag_name
+              ) // empty
+            ')
+          fi
+          version="${version#v}"
+          if [ -n "$version" ]; then
+            sed -i "s/CLIENT_VERSION=.*/CLIENT_VERSION=${version}/g" client-version.txt
+          else
+            echo "No published Luna release with desktop client and WebLite assets found"
+          fi
 
       - name: Check tinker version
         run: |
@@ -72,4 +106,8 @@ jobs:
         run: |
           git add .
           git commit -m "Update pkg versions"
-          git push origin pr@${{ matrix.branch }}@upgrade_client
+          if [ "$branch_exists" == "true" ]; then
+            git push --force-with-lease origin pr@${{ matrix.branch }}@upgrade_client
+          else
+            git push origin pr@${{ matrix.branch }}@upgrade_client
+          fi

Dockerfile

@@ -21,8 +21,7 @@ RUN set -ex \
     && apt-get -y install --no-install-recommends ${TOOLS} \
     && wget https://github.com/jumpserver-dev/healthcheck/releases/latest/download/check_linux_${TARGETARCH}.deb \
     && dpkg -i check_linux_${TARGETARCH}.deb \
-    && apt-get purge -y wget \
-        curl \
+    && apt-get purge -y curl \
         nginx-module-xslt \
         nginx-module-njs \
         libxml2 \
@@ -38,8 +37,10 @@ WORKDIR /opt
 COPY --from=lina /opt/lina /opt/lina
 COPY --from=luna /opt/luna /opt/luna
 COPY versions.txt /opt/download/versions.txt
+COPY client-version.txt /opt/download/client-version.txt
 COPY nginx.conf /etc/nginx/nginx.conf
 COPY includes /etc/nginx/includes
+COPY example /etc/nginx/example
 COPY default.conf /etc/nginx/conf.d/default.conf
-COPY http_server.conf /etc/nginx/sites-enabled/http_server.conf
+COPY https_server.conf /etc/nginx/sites-enabled/https_server.conf
 COPY init.sh /docker-entrypoint.d/40-init-config.sh

Dockerfile-ee

@@ -1,5 +1,10 @@
 ARG VERSION=dev
-FROM jumpserver/web-static:20260819_065947 AS static
+FROM jumpserver/web-static:20260916_053751 AS static
 FROM jumpserver/web:${VERSION}-ce
 
 COPY --from=static /opt/ /opt/
+COPY client.sh client-version.txt /tmp/
+
+RUN set -ex \
+    && /tmp/client.sh \
+    && rm -f /tmp/client.sh /tmp/client-version.txt

Dockerfile-static

@@ -2,8 +2,8 @@ FROM alpine:3.20
 ARG TARGETARCH
 
 WORKDIR /tmp
-COPY . .
+COPY static.sh versions.txt ./
 
 RUN set -ex \
     && apk add --no-cache bash \
-    && bash ./prepare.sh
+    && bash ./static.sh

README.md

@@ -2,6 +2,13 @@
 
 JumpServer 的 LB Nginx Build 项目，其中包含 Lina, Luna 和一些静态安装包文件
 
+桌面客户端和 WebLite 由 Luna 独立发布，不包含在 `web-static` 和 CE 镜像中。
+`Dockerfile-ee` 构建时通过 `client.sh` 下载客户端到 `/opt/download/public/`，并将
+WebLite MSI 下载到 `/opt/download/applets/`。
+现有 `/download/public/Client_<version>_...` 下载地址保持不变；CE 镜像中本地文件不存在时，
+Nginx 会回源到公共静态文件服务。客户端和 WebLite 共用 `client-version.txt` 中的 Luna 版本，
+更新该文件不会触发 `web-static` 重建。
+
 ## Docker 构建
 
 ```bash

client-version.txt

@@ -0,0 +1,3 @@
+# Client and WebLite installers are downloaded only while building Dockerfile-ee.
+CLIENT_VERSION=5.0.0
+CLIENT_NAME=JumpServer

client.sh

@@ -0,0 +1,33 @@
+#!/bin/sh
+set -eu
+
+PROJECT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+
+. "${PROJECT_DIR}/client-version.txt"
+
+: "${CLIENT_VERSION:?CLIENT_VERSION is required}"
+: "${CLIENT_NAME:?CLIENT_NAME is required}"
+
+RELEASE_URL=${CLIENT_RELEASE_URL:-https://github.com/jumpserver/luna/releases/download/v${CLIENT_VERSION}}
+DOWNLOAD_DIR=${CLIENT_DOWNLOAD_DIR:-/opt/download/public}
+WEBLITE_DOWNLOAD_DIR=${WEBLITE_DOWNLOAD_DIR:-/opt/download/applets}
+
+mkdir -p "${DOWNLOAD_DIR}" "${WEBLITE_DOWNLOAD_DIR}"
+cd "${DOWNLOAD_DIR}"
+
+windows_file="${CLIENT_NAME}Client_${CLIENT_VERSION}_x64-setup.exe"
+macos_arm64_file="${CLIENT_NAME}Client_${CLIENT_VERSION}_aarch64.dmg"
+weblite_file="JumpServer-WebLite-${CLIENT_VERSION}-x64.msi"
+
+wget --https-only \
+    --output-document="${windows_file}" \
+    "${RELEASE_URL}/${CLIENT_NAME}-${CLIENT_VERSION}-Setup.exe"
+wget --https-only \
+    --output-document="${macos_arm64_file}" \
+    "${RELEASE_URL}/${CLIENT_NAME}-${CLIENT_VERSION}-arm64.dmg"
+wget --https-only \
+    --output-document="${WEBLITE_DOWNLOAD_DIR}/${weblite_file}" \
+    "${RELEASE_URL}/${weblite_file}"
+
+ln -s "${windows_file}" "Client_${CLIENT_VERSION}_x64-setup.exe"
+ln -s "${macos_arm64_file}" "Client_${CLIENT_VERSION}_aarch64.dmg"

default.conf

@@ -1,5 +1,5 @@
 server {
-    listen 51980; # 如果不开启 https, 这里会 sed 成 80
+    listen 51980; # 容器内部 Web 服务端口，不对外映射
     # listen [::]:51980;
 
     client_max_body_size 4096m;

example/example.crt

@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE-----
+MIIDCTCCAfGgAwIBAgIUDuZGvwzXjUIKAuB993+Z4RNZXoEwDQYJKoZIhvcNAQEL
+BQAwFDESMBAGA1UEAwwJbG9jYWxob3N0MB4XDTI2MDgyNjA1MjQxMFoXDTM2MDgy
+MzA1MjQxMVowFDESMBAGA1UEAwwJbG9jYWxob3N0MIIBIjANBgkqhkiG9w0BAQEF
+AAOCAQ8AMIIBCgKCAQEAwLeA47PjnHxFoJEQcAnphRoAz5WQ/IbEMFXRZUC/DH4G
+r8B25rOblfH7w5zdowgqM5LSzdMAEFTtJt9Z5IFmYgFwijxTE04NBSAo6JFXVQeW
+0MMzi/7Q/p4+6UMRmDTglkfiiRlBRIrx2rUdCezj1BntrdVZuvCS4JfJ19iW0dUR
+VqvuloUDmluhv18Nv7O/Sr7dedZWG3t1EuKrpc8HnWuCHwR3lm3V9jJxcJUBKTu6
+B+LM2JxHa7XjQlLIQNvFa6LB7zQ+DKr4TAuzuzfpZhysXAX/sVIwBiKKnQ+6Gcuj
+0CSuy8wiE0vEA8vbYWNqdAVski0Zoes88Cu5InPKhQIDAQABo1MwUTAdBgNVHQ4E
+FgQUPmhCIuDVL7+Eu86oCngoxnBkAYswHwYDVR0jBBgwFoAUPmhCIuDVL7+Eu86o
+CngoxnBkAYswDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAi9AF
+GeYJz+0DVRIlqwX7FcBbs2jQkLvGb1sxWUixCekBEWa3d4481Qb76MlUPvTQOqVE
+3i7Jf1kaJoEsRUVF8wjmCAe6cc2vinCzBn9Vz+f1H6yKdZNcH9yEUnaO8SyzKT7w
+ejMoT/C5/7kVGrPF9JH6j6o/UqASgJAzn7F5jhnMeySfR7h7qaaHOutrnUeDcxa6
+t0NfN5x8eT7ufza6+6gC98eayb0RqUrTaQ45HXa1mYwio4EJbzRjitDjaII2RxXm
+kdXagY3AGR6nkycOGhm1MBCsoM5xW7c+/qdCl9EryDWDf2mvI6Q9j0XsAhBkjveP
+DJ4A4buX9HRk6elihw==
+-----END CERTIFICATE-----

example/example.key

@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDAt4Djs+OcfEWg
+kRBwCemFGgDPlZD8hsQwVdFlQL8MfgavwHbms5uV8fvDnN2jCCozktLN0wAQVO0m
+31nkgWZiAXCKPFMTTg0FICjokVdVB5bQwzOL/tD+nj7pQxGYNOCWR+KJGUFEivHa
+tR0J7OPUGe2t1Vm68JLgl8nX2JbR1RFWq+6WhQOaW6G/Xw2/s79Kvt151lYbe3US
+4qulzweda4IfBHeWbdX2MnFwlQEpO7oH4szYnEdrteNCUshA28VrosHvND4MqvhM
+C7O7N+lmHKxcBf+xUjAGIoqdD7oZy6PQJK7LzCITS8QDy9thY2p0BWySLRmh6zzw
+K7kic8qFAgMBAAECggEAA4nn3vm1pNdcIlenkp1/LgeAZ+kAkYwaXCNA36tLSfwI
+1jKIvGTxGjuOrbsN3GmEK0N3hXoDY6/IVWqY6JFyHNVj7wkU79ZpQzFulUURJamP
+AzEiaC0UqPULUkmXloQaDG7J4efJ0AVkU+mRdlYx1McCtN3YpcGD7bkImfykwFOX
+p8ol3PgHQJkPxaHuGGk9yDaNUmPRz9JBAQz/fd3BLTX7ue9YtatS2gCSmaY4/kbX
+oI6VOavBwV5SRaeOgsfFi1IAsgPJ2dI9W/WCHRBqHM7Hgsi9f+gHrUEewXSC7Dh7
+2FHVrHxiHlCD1IQei+8nFjg3ZK218T52t3RAdJt5PQKBgQD248PnRjrWjHjIRJ6T
+cwMXtNa36xzfMd1R4nC0jmbpNJxeyUNnwg0twl9/scTtMULvpX7/w7hRNreeDQT/
+64Dy6TVKENPxzf7RT3s5Ly3g5owMRrue9sLLQImacVzkgoytgCIRpfYjROg9wi26
+FSzOaSkFSgwYCYXxu3qpGRVG9wKBgQDH0/7zHzbwzajoem6tSEdavFcJJiiYN60F
+8BKL53KIkb89OGykDpLV9I2CL0zFiPYhbxECl9nqT1sDI6Qdsb9VEF9st8Tc5kjw
+W441VJMJYxUA7QfyDm76IiLJE3m9/f5SFXMmVVkJVjs+usy/TXf0tuVAE5ralxNQ
+1uJZq94vYwKBgQDyXYXjdD4ugJfRggtqFG3kx9JBmr0tHnZ1/CVIGsNMDCm1oz5Y
+jVcCpN27LXh0oPdk6sJRsoEuuNhof794vGhKDkYR/5MQvXh5Yd1FtdsD/U9efdGR
+rAxuG1z6EG9wo/gWGsNXL+UBmpOijQz2r/Lcbr+mQZq9vhuPwswXVFhe4QKBgErX
+yeuBS3CRdqvr/zwDkEYZuHeCxT2NzM4mhqvDuhAQlpH1aitgEfr0p3OVB6oMjDMl
+iDdybHnn0uywEq3Ufxb7FOKBSch6r+LmR7MNxCyF4b4BCTLN2R7yXhj1pGlWkkRo
+KEK5QKnQlEwAZuNXvo/3WJHRRfSNFPz4Hrr7NjKFAoGAB3aDQUDGfWE1CdB0XDPL
++/IB/BRIuxjvwyg1eFHHSMc6C1FFmn3mG65oCC18DmZMPFag4lPuXW5ylR0LJkSz
+IchcUKO5dlr64cwBSmVAJKR8Gtj7kcp9hAhIMQKDNWE1h93RuSz2VFBd00n1fwlT
+/toLw7peVpKft+Y+k/SGhXo=
+-----END PRIVATE KEY-----

https_server.conf

@@ -0,0 +1,68 @@
+# Todo: May be can auto discovery
+upstream http_server {
+  ip_hash;
+  server web:8080;  # 这个是可以通过容器访问, 外部访问是 80端口
+}
+
+server {
+  listen 80;  # 容器内部固定端口，对外映射由 installer 控制
+  # listen [::]:80;
+  # server_name demo.jumpserver.org;  # 取消注释并自行修改成你自己的域名
+  # HTTPS_REDIRECT
+
+  client_max_body_size 5000m;
+
+  location / {
+    proxy_pass http://http_server;
+    proxy_buffering off;
+    proxy_request_buffering off;
+    proxy_http_version 1.1;
+    proxy_set_header Host $host;
+    proxy_set_header Upgrade $http_upgrade;
+    proxy_set_header Connection $http_connection;
+    # 默认作为第一层；仅显式 USE_LB=0 时由启动脚本改为信任上游代理头。
+    proxy_set_header X-Forwarded-For $remote_addr;
+
+    proxy_ignore_client_abort on;
+    proxy_connect_timeout 600;
+    proxy_send_timeout 600;
+    proxy_read_timeout 600;
+    send_timeout 6000;
+  }
+}
+
+server {
+  listen 443 ssl;  # 容器内部固定端口，对外映射由 installer 控制
+  http2 on;
+  # listen [::]:443 ssl;
+  # server_name demo.jumpserver.org;      # 取消注释并自行修改成你自己的域名
+  server_tokens off;
+  ssl_certificate cert/server.crt;        # 修改 server.crt 为你的证书, 不要改路径 cert/
+  ssl_certificate_key cert/server.key;    # 修改 server.key 为你的证书, 不要改路径 cert/
+  ssl_session_timeout 1d;
+  ssl_session_cache shared:MozSSL:10m;
+  ssl_session_tickets off;
+  ssl_protocols TLSv1.2 TLSv1.3;
+  ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
+  ssl_prefer_server_ciphers off;
+
+  client_max_body_size 5000m;
+
+  location / {
+    proxy_pass http://http_server;
+    proxy_buffering off;
+    proxy_request_buffering off;
+    proxy_http_version 1.1;
+    proxy_set_header Host $host;
+    proxy_set_header Upgrade $http_upgrade;
+    proxy_set_header Connection $http_connection;
+    # 默认作为第一层；仅显式 USE_LB=0 时由启动脚本改为信任上游代理头。
+    proxy_set_header X-Forwarded-For $remote_addr;
+
+    proxy_ignore_client_abort on;
+    proxy_connect_timeout 600;
+    proxy_send_timeout 600;
+    proxy_read_timeout 600;
+    send_timeout 6000;
+  }
+}

includes/kael.conf.disabled

@@ -0,0 +1,14 @@
+location ^~ /kael/ {
+    proxy_pass http://kael:8083;
+    proxy_buffering off;
+    proxy_cache off;
+    proxy_request_buffering off;
+    proxy_http_version 1.1;
+    proxy_set_header Host $http_host;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_connect_timeout 60;
+    proxy_send_timeout 600;
+    proxy_read_timeout 600;
+    send_timeout 600;
+}