From 55c56da5f1a56f3ba4fa351f0ed87cf4f7265416 Mon Sep 17 00:00:00 2001
From: hypercross <helios.tnak@gmail.com>
Date: Mon, 24 Aug 2026 10:20:35 +0800
Subject: [PATCH] feat: add ssl cert update script and gitattributes

---
 .gitattributes |  2 ++
 AGENTS.md      | 16 ++++++++++
 update-ssl.sh  | 79 ++++++++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 97 insertions(+)
 create mode 100644 .gitattributes
 create mode 100644 AGENTS.md
 create mode 100755 update-ssl.sh

diff --git a/.gitattributes b/.gitattributes
new file mode 100644
index 0000000..97d156f
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1,2 @@
+# Ensure shell scripts always use LF line endings, even on Windows/Git Bash.
+*.sh text eol=lf
diff --git a/AGENTS.md b/AGENTS.md
new file mode 100644
index 0000000..90b4374
--- /dev/null
+++ b/AGENTS.md
@@ -0,0 +1,16 @@
+# SSL 自动管理脚本
+
+- 我们有一个服务器在腾讯云`lighthouse@ayi-games.online`
+- 本机环境`.ssh`已授权可以 ssh 直接登录
+- 登录后在`~/certs`目录下有 ssl 证书：
+  - ayi-games.online.csr|.key
+  - ayi-games.online_bundle.pem|.crt
+  - gitea.ayi-games.online.csr|.key
+  - gitea.ayi-games.online_bundle.pem|.crt
+- ssl 证书需人工从腾讯云后台下载nginx 配置，如 ayi-games.online_nginx.zip
+
+## 脚本
+
+现在需要脚本辅助自动更新ssl证书
+- 假设.zip 已经下载到本机（mac）的~/Downloads 目录
+- 上传到服务器，解压到 certs，覆盖原有文件，并执行`sudo nginx -s reload`
diff --git a/update-ssl.sh b/update-ssl.sh
new file mode 100755
index 0000000..2977ddc
--- /dev/null
+++ b/update-ssl.sh
@@ -0,0 +1,79 @@
+#!/usr/bin/env bash
+#
+# update-ssl.sh — Automatically update SSL certificates on the server.
+#
+# Assumes:
+#   - The nginx cert zips (e.g. ayi-games.online_nginx.zip) are downloaded to
+#     ~/Downloads on this machine (mac).
+#   - This machine can ssh/scp to the server without a password prompt.
+#
+# Flow (for each *_nginx.zip found in ~/Downloads):
+#   1. Upload it to the server.
+#   2. Unzip into ~/certs, overwriting existing cert files (flat, ignoring
+#      any subfolders inside the zip).
+#   3. Remove the uploaded zip from the server.
+#   4. Delete the source zip from ~/Downloads.
+#   5. Reload nginx once, after all zips are installed.
+
+set -euo pipefail
+
+SERVER="lighthouse@ayi-games.online"
+CERTS_DIR="~/certs"
+DOWNLOAD_DIR="${HOME}/Downloads"
+
+usage() {
+    cat <<EOF
+Usage: $0
+
+Finds every *_nginx.zip in ${DOWNLOAD_DIR}, uploads each to the server,
+installs it into ${CERTS_DIR}, reloads nginx, and deletes the source zips
+from ${DOWNLOAD_DIR}.
+EOF
+}
+
+# --- Find all zips --------------------------------------------------------
+ZIPS=()
+while IFS= read -r z; do
+    ZIPS+=("${z}")
+done < <(find "${DOWNLOAD_DIR}" -maxdepth 1 -name '*_nginx.zip' -type f -print 2>/dev/null | sort)
+
+if [[ ${#ZIPS[@]} -eq 0 ]]; then
+    echo "ERROR: no *_nginx.zip found in ${DOWNLOAD_DIR}" >&2
+    exit 1
+fi
+
+echo "Found ${#ZIPS[@]} zip(s) to process:"
+for z in "${ZIPS[@]}"; do
+    echo "  - ${z}"
+done
+
+# --- Upload & install each zip --------------------------------------------
+for ZIP_PATH in "${ZIPS[@]}"; do
+    ZIP_NAME="$(basename "${ZIP_PATH}")"
+    echo
+    echo ">>> Processing ${ZIP_NAME}"
+
+    # Upload
+    echo "Uploading to ${SERVER}..."
+    scp "${ZIP_PATH}" "${SERVER}:${ZIP_NAME}"
+
+    # Install on server (flat extract, overwrite), then remove from server
+    echo "Installing into ${CERTS_DIR}..."
+    ssh "${SERVER}" "set -e
+mkdir -p ${CERTS_DIR}
+unzip -oj ${ZIP_NAME} -d ${CERTS_DIR}
+rm -f ${ZIP_NAME}
+"
+
+    # Only delete the local source once the upload+install succeeded
+    rm -f "${ZIP_PATH}"
+    echo "Deleted local source: ${ZIP_PATH}"
+done
+
+# --- Reload nginx once ----------------------------------------------------
+echo
+echo "Reloading nginx..."
+ssh "${SERVER}" "sudo nginx -s reload && echo 'nginx reloaded OK'"
+
+echo
+echo "Done. All SSL certs updated and nginx reloaded."