deploy-all.sh
Rama main · réplica de lectura del repositorio original.
#!/usr/bin/env bash
set -euo pipefail
umask 077
SOURCE_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
ROOT_DIR="${QQ_AGENT_STACK_DIR:-/mnt/data/qq-agent}"
AGENT_PORT="3210"
SNOWLUMA_PORT="5099"
NOVNC_PORT="6081"
ONEBOT_HTTP_PORT="3000"
ONEBOT_WS_PORT="3001"
# 控制台 / SnowLuma WebUI / noVNC 的宿主监听地址。
# 默认只绑回环：远程访问走 SSH 隧道；只有显式 --publish 才对外开放（安全组仍需自行收紧）。
PUBLISH_HOST="127.0.0.1"
PUBLISH_EXPLICIT=false
AGENT_PORT_SET=false
SNOWLUMA_PORT_SET=false
NOVNC_PORT_SET=false
ONEBOT_HTTP_PORT_SET=false
ONEBOT_WS_PORT_SET=false
SERVICE="qq-agent-linux"
SERVICE_SET=false
IMAGE="${SNOWLUMA_IMAGE:-motricseven7/snowluma:v1.14.22}"
IMAGE_SET=false
IMAGE_MIRROR_ARG=""
# 这两个是用户会按机器情况调的旋钮（显存紧张时改 SNOWLUMA_SCREEN、排查时改日志级别），
# 重跑时从 .env 回读，避免手工改动被默认值覆盖。
SNOWLUMA_SCREEN="1920x1080x24"
SNOWLUMA_LOG_LEVEL="info"
ASSUME_YES=false
CHECK_ONLY=false
ROTATE_CREDENTIALS=false
INSTALL_DOCKER=true
AGENT_TOKEN=""
ONEBOT_TOKEN=""
SNOWLUMA_PASSWORD=""
VNC_PASSWORD=""
SNOWLUMA_CURRENT_PASSWORD=""
SNOWLUMA_TOTP=""
MODEL_BASE_URL="${QQ_AGENT_MODEL_BASE_URL:-}"
MODEL_API_KEY="${QQ_AGENT_MODEL_API_KEY:-}"
MODEL_NAME="${QQ_AGENT_MODEL:-}"
ALLOW_GROUPS="${QQ_AGENT_ALLOW_GROUPS:-}"
ALLOW_PRIVATE="${QQ_AGENT_ALLOW_PRIVATE:-}"
SKIP_MODEL_CONFIG=false
# 网页终端（宝塔等面板的终端）、su、sudo -u 这类非登录会话不设置 XDG_RUNTIME_DIR：
# systemctl --user 会直接报 "Failed to connect to bus ... $XDG_RUNTIME_DIR not defined"，
# 即使用户管理器好好地在跑（2026-10-12 报道复现：同一台机器只差这一个环境变量）。
# 目录存在就按 systemd 的口径补上；用户自己设过的值不动。
if [[ -z "${XDG_RUNTIME_DIR:-}" && -d "/run/user/$(id -u)" ]]; then
export XDG_RUNTIME_DIR="/run/user/$(id -u)"
fi
usage() {
cat <<'EOF'
Usage: bash deploy-all.sh [options]
Interactive full-stack installer for QQ Agent + SnowLuma/OneBot.
Options:
--root-dir PATH Stack root (default: /mnt/data/qq-agent)
--agent-port PORT QQ Agent console port (default: 3210)
--snowluma-port PORT SnowLuma WebUI port (default: 5099)
--novnc-port PORT QQ login/noVNC port (default: 6081)
--onebot-http-port PORT Local-only OneBot HTTP port (default: 3000)
--onebot-ws-port PORT Local-only OneBot WebSocket port (default: 3001)
--service NAME systemd user service (default: qq-agent-linux)
--image IMAGE SnowLuma image (default: tested v1.14.22)
--image-mirror HOST Try this registry mirror (yours first) when Docker Hub
is unreachable (mainland China), e.g.
--image-mirror docker.m.daocloud.io
(also: QQ_AGENT_IMAGE_MIRROR, comma-separated);
built-in public mirrors are tried after yours
--agent-token TOKEN Set the QQ Agent console token
--onebot-token TOKEN Set the shared OneBot HTTP/WS token
--snowluma-password VALUE Set the initial SnowLuma WebUI password
--snowluma-current-password VALUE
Current WebUI password when rotating it
--snowluma-totp CODE Current SnowLuma 2FA code when enabled
--vnc-password VALUE Set the noVNC password (8 characters recommended)
--model-base-url URL OpenAI-compatible Chat Completions base URL
--model-api-key KEY Model provider API key
--model NAME Model identifier
--allow-groups IDS Comma-separated QQ group allowlist
--allow-private IDS Comma-separated QQ private-chat allowlist
--skip-model-config Leave model settings for the management console
--rotate-credentials Replace stored credentials during an update
--no-install-docker Fail instead of installing Docker when missing
--check-only Inspect ownership and ports without changing anything
--publish Bind console / SnowLuma WebUI / noVNC to 0.0.0.0
(default is 127.0.0.1; requires a tightened security group)
--loopback Explicitly bind them to 127.0.0.1 (default for new installs)
-y, --yes Accept defaults; suitable for non-interactive use
-h, --help Show this help
The installer never asks for a LAN IP. By default the console, SnowLuma WebUI
and noVNC bind to 127.0.0.1 only; use an SSH tunnel (console-tunnel.bat or
`ops console`) or pass --publish to expose them. OneBot ports always bind to
127.0.0.1. Existing installations keep their current bind address unless
--publish/--loopback is passed explicitly.
Existing installations not owned by this installer are never adopted.
Use deploy.sh with the existing data directory and endpoints to update Agent only.
EOF
}
require_value() {
(($# >= 2)) || { printf 'Missing value for %s\n' "$1" >&2; exit 2; }
}
while (($#)); do
case "$1" in
--root-dir) require_value "$@"; ROOT_DIR="$2"; shift 2 ;;
--root-dir=*) ROOT_DIR="${1#*=}"; shift ;;
--agent-port) require_value "$@"; AGENT_PORT="$2"; AGENT_PORT_SET=true; shift 2 ;;
--snowluma-port) require_value "$@"; SNOWLUMA_PORT="$2"; SNOWLUMA_PORT_SET=true; shift 2 ;;
--novnc-port) require_value "$@"; NOVNC_PORT="$2"; NOVNC_PORT_SET=true; shift 2 ;;
--onebot-http-port) require_value "$@"; ONEBOT_HTTP_PORT="$2"; ONEBOT_HTTP_PORT_SET=true; shift 2 ;;
--onebot-ws-port) require_value "$@"; ONEBOT_WS_PORT="$2"; ONEBOT_WS_PORT_SET=true; shift 2 ;;
--service) require_value "$@"; SERVICE="$2"; SERVICE_SET=true; shift 2 ;;
--image) require_value "$@"; IMAGE="$2"; IMAGE_SET=true; shift 2 ;;
--image-mirror) require_value "$@"; IMAGE_MIRROR_ARG="$2"; shift 2 ;;
--agent-token) require_value "$@"; AGENT_TOKEN="$2"; shift 2 ;;
--onebot-token) require_value "$@"; ONEBOT_TOKEN="$2"; shift 2 ;;
--snowluma-password) require_value "$@"; SNOWLUMA_PASSWORD="$2"; shift 2 ;;
--snowluma-current-password) require_value "$@"; SNOWLUMA_CURRENT_PASSWORD="$2"; shift 2 ;;
--snowluma-totp) require_value "$@"; SNOWLUMA_TOTP="$2"; shift 2 ;;
--vnc-password) require_value "$@"; VNC_PASSWORD="$2"; shift 2 ;;
--model-base-url) require_value "$@"; MODEL_BASE_URL="$2"; shift 2 ;;
--model-api-key) require_value "$@"; MODEL_API_KEY="$2"; shift 2 ;;
--model) require_value "$@"; MODEL_NAME="$2"; shift 2 ;;
--allow-groups) require_value "$@"; ALLOW_GROUPS="$2"; shift 2 ;;
--allow-private) require_value "$@"; ALLOW_PRIVATE="$2"; shift 2 ;;
--skip-model-config) SKIP_MODEL_CONFIG=true; shift ;;
--rotate-credentials) ROTATE_CREDENTIALS=true; shift ;;
--no-install-docker) INSTALL_DOCKER=false; shift ;;
--check-only) CHECK_ONLY=true; ASSUME_YES=true; shift ;;
--publish) PUBLISH_HOST="0.0.0.0"; PUBLISH_EXPLICIT=true; shift ;;
--loopback) PUBLISH_HOST="127.0.0.1"; PUBLISH_EXPLICIT=true; shift ;;
-y|--yes) ASSUME_YES=true; shift ;;
-h|--help) usage; exit 0 ;;
*) printf 'Unknown option: %s\n\n' "$1" >&2; usage >&2; exit 2 ;;
esac
done
# 凭据的环境变量回退：命令行参数会出现在 /proc/<pid>/cmdline（对本机所有用户
# 可读），无人值守/CI 场景请优先用环境变量传凭据。命令行显式传值时优先于环境变量。
AGENT_TOKEN="${AGENT_TOKEN:-${QQ_AGENT_AGENT_TOKEN:-}}"
ONEBOT_TOKEN="${ONEBOT_TOKEN:-${QQ_AGENT_ONEBOT_TOKEN:-}}"
SNOWLUMA_PASSWORD="${SNOWLUMA_PASSWORD:-${QQ_AGENT_SNOWLUMA_PASSWORD:-}}"
SNOWLUMA_TOTP="${SNOWLUMA_TOTP:-${QQ_AGENT_SNOWLUMA_TOTP:-}}"
# ops deploy 用 0600 临时文件传模型 Key，不走子进程环境；这里要认这个入口。
if [[ -z "$MODEL_API_KEY" && -n "${QQ_AGENT_MODEL_KEY_FILE:-}" ]]; then
[[ -r "$QQ_AGENT_MODEL_KEY_FILE" ]] || {
printf 'Error: QQ_AGENT_MODEL_KEY_FILE 不存在或不可读：%s\n' "$QQ_AGENT_MODEL_KEY_FILE" >&2
exit 1
}
MODEL_API_KEY="$(tr -d '\r\n' < "$QQ_AGENT_MODEL_KEY_FILE")"
fi
VNC_PASSWORD="${VNC_PASSWORD:-${QQ_AGENT_VNC_PASSWORD:-}}"
die() {
printf 'Error: %s\n' "$*" >&2
exit 1
}
# 全新安装中途失败时清掉本次写下的 .env / compose 与空目录：否则重跑会被
# check_local_ownership 判成"不完整的受管安装"而拒绝 —— 而拉镜像失败的提示恰恰让操作者重跑。
# 容器可能已经写过东西，所以目录只用 rmdir：非空会失败，正好保留现场。
FRESH_STACK_CLEANUP=false
STACK_LOCK_DIR=""
STACK_LOCK_OWNED=false
cleanup_fresh_stack() {
[[ "$FRESH_STACK_CLEANUP" == true ]] || return 0
printf '安装未完成：已清理本次写入的栈文件与空目录，可以直接重跑 deploy-all.sh。\n' >&2
rm -f "$ENV_FILE" "$ENV_FILE.tmp" "$COMPOSE_FILE" "$COMPOSE_FILE.tmp"
rmdir "$SNOWLUMA_DATA_DIR/config" "$SNOWLUMA_DIR/client-config" "$SNOWLUMA_DIR/client-data" \
"$SNOWLUMA_DATA_DIR" "$SNOWLUMA_DIR" "$AGENT_DATA_DIR" 2>/dev/null || true
}
# 2026-10-06 复审 P2/P3：统一的退出钩子（bash 只有一个 EXIT trap，原先分散的
# `trap cleanup_fresh_stack EXIT` 与 `trap 'rm …' EXIT` 互相覆盖，谁后挂谁生效）。
# - fresh：清掉半成品栈文件与空目录。
# - existing + 轮换凭据：.env 在部署成功前就已重写成新凭据，而 config.json 还是旧令牌
# （deploy.sh 的回滚只管 config.json）—— 此后 check-stack-update 比对必然 refuse_existing，
# 脚本自提示的"重跑带 --rotate-credentials"也无效（预检在写凭据之前跑）。失败退出回拷
# 部署前的 .env，让重跑路径保持可用。
# - 模型 Key 临时文件兜底删除（原先只在设置了 MODEL_API_KEY 时才挂 trap，且会顶掉清理钩子）。
deploy_all_exit() {
local status=$?
[[ -n "${MODEL_KEY_FILE:-}" ]] && rm -f "$MODEL_KEY_FILE"
if [[ "${ENV_REWRITTEN:-false}" == true && "${DEPLOY_COMPLETED:-false}" != true && "${KEEP_ENV_ON_ROTATE_FAILURE:-false}" != true && -f "$ENV_FILE.pre-deploy" ]]; then
cp -p "$ENV_FILE.pre-deploy" "$ENV_FILE"
printf '部署未完成：.env 已回滚为部署前内容（备份保留在 %s.pre-deploy），可直接重跑 deploy-all.sh。\n' "$ENV_FILE" >&2
fi
# 清理必须在仍持锁时做：先放锁再删 .env，新的赢家可能已经写好 .env 又被这里删掉。
cleanup_fresh_stack
if [[ "${STACK_LOCK_OWNED:-false}" == true && -n "${STACK_LOCK_DIR:-}" ]]; then
rm -rf -- "$STACK_LOCK_DIR"
STACK_LOCK_OWNED=false
fi
exit "$status"
}
# 栈级互斥：两个 deploy-all 同时跑时，.env/compose 会在 deploy.sh 的锁之前互相覆盖。
# 锁放在部署根目录，覆盖从 .env 写入到 deploy.sh 收尾的全程。
acquire_stack_lock() {
local attempt=0 pid="" stale="" takeover="$STACK_LOCK_DIR.takeover"
while (( attempt < 3 )); do
if mkdir -- "$STACK_LOCK_DIR" 2>/dev/null; then
STACK_LOCK_OWNED=true
printf '%s\n' "$$" >"$STACK_LOCK_DIR/pid" 2>/dev/null || true
date -Is >"$STACK_LOCK_DIR/started" 2>/dev/null || true
return 0
fi
pid="$(cat "$STACK_LOCK_DIR/pid" 2>/dev/null | tr -d '\r\n' || true)"
if [[ -n "$pid" ]] && kill -0 "$pid" 2>/dev/null; then
die "另一个 deploy-all.sh 正在运行（pid $pid，锁 $STACK_LOCK_DIR）"
fi
stale="$(find "$STACK_LOCK_DIR" -maxdepth 0 -mmin +5 2>/dev/null || true)"
if [[ -n "$stale" || -n "$pid" ]]; then
# 陈旧锁的接管要互斥：两个实例都判定"陈旧"时，不能都 rm -rf 再 mkdir——
# 后者的 rm 会把前者刚建好的新锁删掉，两个进程同时往下走。
if ! mkdir -- "$takeover" 2>/dev/null; then
if [[ -n "$(find "$takeover" -maxdepth 0 -mmin +5 2>/dev/null || true)" ]]; then
rm -rf -- "$takeover"
mkdir -- "$takeover" 2>/dev/null \
|| die "另一个 deploy-all.sh 正在接管陈旧锁，请稍后重试"
else
die "另一个 deploy-all.sh 正在接管陈旧锁，请稍后重试"
fi
fi
# 二次判定：拿到接管权后锁可能已被别人重建
pid="$(cat "$STACK_LOCK_DIR/pid" 2>/dev/null | tr -d '\r\n' || true)"
if [[ -n "$pid" ]] && kill -0 "$pid" 2>/dev/null; then
rmdir -- "$takeover" 2>/dev/null || true
die "另一个 deploy-all.sh 正在运行（pid $pid，锁 $STACK_LOCK_DIR）"
fi
# 原子移走再删：只有真正搬走旧锁的实例才能继续，搬不动的说明已被别人接管。
if mv -- "$STACK_LOCK_DIR" "$takeover/stale" 2>/dev/null; then
rm -rf -- "$takeover/stale"
fi
rmdir -- "$takeover" 2>/dev/null || true
attempt=$((attempt + 1))
continue
fi
die "另一个 deploy-all.sh 正在运行（锁 $STACK_LOCK_DIR）"
done
die "无法获取部署锁：$STACK_LOCK_DIR"
}
step() {
printf '\n==> %s\n' "$*"
}
prompt_value() {
local label="$1" default="$2" answer=""
if [[ "$ASSUME_YES" == true ]]; then
printf '%s' "$default"
return
fi
[[ -r /dev/tty ]] || die 'Interactive input is unavailable; use --yes and explicit options'
printf '%s [%s]: ' "$label" "$default" >/dev/tty
IFS= read -r answer </dev/tty || true
printf '%s' "${answer:-$default}"
}
confirm() {
local label="$1" default_yes="${2:-false}" answer=""
if [[ "$ASSUME_YES" == true ]]; then
[[ "$default_yes" == true ]]
return
fi
local suffix='[y/N]'
[[ "$default_yes" == true ]] && suffix='[Y/n]'
printf '%s %s ' "$label" "$suffix" >/dev/tty
IFS= read -r answer </dev/tty || true
if [[ -z "$answer" ]]; then
[[ "$default_yes" == true ]]
else
[[ "$answer" =~ ^([yY]|yes|YES|是)$ ]]
fi
}
prompt_secret() {
local label="$1" answer=""
printf '%s: ' "$label" >/dev/tty
IFS= read -r -s answer </dev/tty || true
printf '\n' >/dev/tty
printf '%s' "$answer"
}
random_hex() {
od -An -N"$1" -tx1 /dev/urandom | tr -d ' \n'
}
env_value() {
local file="$1" key="$2"
[[ -f "$file" ]] || return 0
sed -n "s/^${key}=//p" "$file" | tail -n 1 | tr -d '\r'
}
validate_port() {
[[ "$2" =~ ^[0-9]+$ ]] && ((10#$2 >= 1 && 10#$2 <= 65535)) \
|| die "$1 must be an integer from 1 to 65535"
}
validate_secret() {
local label="$1" value="$2" minimum="$3"
((${#value} >= minimum)) || die "$label must contain at least $minimum characters"
[[ "$value" =~ ^[A-Za-z0-9._!@%+=:-]+$ ]] \
|| die "$label may only contain letters, numbers, and ._!@%+=:-"
}
run_root() {
if ((EUID == 0)); then
"$@"
elif command -v sudo >/dev/null 2>&1; then
sudo "$@"
else
die "Root permission is required for: $*"
fi
}
docker_ready() {
command -v docker >/dev/null 2>&1 && docker info >/dev/null 2>&1
}
sudo_docker_ready() {
((EUID != 0)) && command -v sudo >/dev/null 2>&1 \
&& command -v docker >/dev/null 2>&1 && sudo docker info >/dev/null 2>&1
}
install_docker() {
[[ "$INSTALL_DOCKER" == true ]] || die 'Docker is unavailable and automatic installation is disabled'
confirm 'Docker is missing. Install Docker and Compose now?' true \
|| die 'Docker is required by SnowLuma'
step 'Installing Docker Engine'
if command -v apt-get >/dev/null 2>&1; then
run_root apt-get update
run_root apt-get install -y docker.io || die 'Docker Engine installation failed'
elif command -v dnf >/dev/null 2>&1; then
run_root dnf install -y docker || run_root dnf install -y moby-engine \
|| die 'Docker Engine installation failed'
elif command -v yum >/dev/null 2>&1; then
run_root yum install -y docker || run_root yum install -y moby-engine \
|| die 'Docker Engine installation failed'
elif command -v zypper >/dev/null 2>&1; then
run_root zypper --non-interactive install -y docker || die 'Docker Engine installation failed'
elif command -v pacman >/dev/null 2>&1; then
run_root pacman -Sy --noconfirm docker || die 'Docker Engine installation failed'
else
die 'No supported package manager found; install Docker Engine and Compose manually'
fi
run_root systemctl enable --now docker
install_compose
}
# Compose 单独装/单独检查：Debian 12 官方仓库没有 docker-compose-v2，
# 引擎已存在但 Compose 缺失时也不能因为“docker_ready”跳过。
install_compose() {
[[ "$INSTALL_DOCKER" == true ]] \
|| die 'Docker Compose v2 is missing and automatic installation is disabled'
step 'Installing Docker Compose v2'
if command -v apt-get >/dev/null 2>&1; then
run_root apt-get install -y docker-compose-v2 \
|| run_root apt-get install -y docker-compose-plugin \
|| true
elif command -v dnf >/dev/null 2>&1; then
# Fedora 的 Compose 包名是 docker-compose；Rocky/Alma 9 stock 仓库通常两者都没有。
run_root dnf install -y docker-compose-plugin \
|| run_root dnf install -y docker-compose \
|| true
elif command -v yum >/dev/null 2>&1; then
run_root yum install -y docker-compose-plugin \
|| run_root yum install -y docker-compose \
|| true
elif command -v zypper >/dev/null 2>&1; then
run_root zypper --non-interactive install -y docker-compose || true
elif command -v pacman >/dev/null 2>&1; then
run_root pacman -Sy --noconfirm docker-compose || true
fi
docker_call compose version >/dev/null 2>&1 \
|| die 'Docker Engine is installed but Docker Compose v2 is unavailable. Debian 12 / Rocky / Alma 9 stock repos do not provide it; configure the Docker official repository (docs/DOCKER.md) or install docker-compose-plugin manually. Fedora uses the docker-compose package.'
}
docker_call() {
if docker_ready; then
docker "$@"
elif sudo_docker_ready; then
sudo docker "$@"
else
return 1
fi
}
wait_http() {
local url="$1" attempts="${2:-60}"
for ((i = 0; i < attempts; i++)); do
if curl -fsS --max-time 2 "$url" >/dev/null 2>&1; then return 0; fi
sleep 1
done
return 1
}
onebot_ready() {
# Token 经 stdin 喂给 curl（-H @-），不出现在 /proc/<pid>/cmdline——
# 对本机所有用户可读（凭据退出命令行参数原则）。
printf 'authorization: Bearer %s\n' "$ONEBOT_TOKEN" | \
curl -fsS --max-time 3 -H @- \
-H 'content-type: application/json' \
-d '{}' "http://127.0.0.1:$ONEBOT_HTTP_PORT/get_login_info" \
| grep -Eq '"retcode"[[:space:]]*:[[:space:]]*0'
}
refuse_existing() {
printf 'Existing or incomplete installation detected: %s\n' "$1" >&2
die 'No deployment changes made. Use deploy.sh for the existing Agent; preserve its data directory, bind address and OneBot settings. Automatic takeover is not supported.'
}
check_local_ownership() {
local file directory contents
if [[ -e "$ENV_FILE" ]]; then
for file in "$ENV_FILE" "$COMPOSE_FILE" "$APP_DIR/.deployment.json" \
"$APP_DIR/.deployment-node" "$AGENT_DATA_DIR/config.json"; do
[[ -f "$file" && -r "$file" && ! -L "$file" ]] \
|| refuse_existing "incomplete managed stack ($file)"
done
EXISTING_STACK=true
IFS= read -r PREFLIGHT_NODE <"$APP_DIR/.deployment-node" || true
[[ -n "$PREFLIGHT_NODE" && -x "$PREFLIGHT_NODE" ]] \
|| refuse_existing 'the recorded Node runtime is unavailable'
else
for file in "$APP_DIR/.deployment.json" "$APP_DIR/.deployment-node" \
"$APP_DIR/config.json" "$ACCESS_FILE"; do
[[ ! -e "$file" && ! -L "$file" ]] \
|| refuse_existing "$file exists without managed stack metadata"
done
for directory in "$AGENT_DATA_DIR" "$APP_DIR/data" "$SNOWLUMA_DIR"; do
[[ ! -L "$directory" ]] || refuse_existing "unmanaged data symlink $directory"
[[ -e "$directory" ]] || continue
[[ -d "$directory" && -r "$directory" && -x "$directory" ]] \
|| refuse_existing "cannot inspect $directory"
contents="$(find "$directory" -mindepth 1 -maxdepth 1 -print -quit)" \
|| refuse_existing "cannot inspect $directory"
[[ -z "$contents" ]] || refuse_existing "$directory contains data without managed stack metadata"
done
fi
}
check_host_ownership() {
local load_state working_dir inventory id name image own_id="" docker_ports=""
local listeners port agent_running=false old_agent_port=""
local docker_command=()
command -v systemctl >/dev/null || die 'systemctl is required'
systemctl --user show-environment >/dev/null \
|| die "Cannot reach the systemd user manager from this shell; no deployment changes made. A web terminal (panel console) or other non-login shell does not set XDG_RUNTIME_DIR even when the manager is running: run 'export XDG_RUNTIME_DIR=/run/user/\$(id -u)' and retry; if that directory does not exist, run 'sudo loginctl enable-linger $(id -un)' first, then retry."
if ! load_state="$(systemctl --user show "$SERVICE.service" --property=LoadState --value)"; then
[[ "$load_state" == not-found ]] \
|| die 'Cannot inspect the selected systemd service; no deployment changes made'
fi
case "$load_state" in
not-found) ;;
loaded)
[[ "$EXISTING_STACK" == true ]] || refuse_existing "$SERVICE.service already exists"
working_dir="$(systemctl --user show "$SERVICE.service" --property=WorkingDirectory --value)" \
|| refuse_existing "cannot inspect $SERVICE.service"
[[ -n "$working_dir" && "$(realpath -m -- "$working_dir")" == "$APP_DIR" ]] \
|| refuse_existing "$SERVICE.service belongs to another application directory"
if systemctl --user is-active --quiet "$SERVICE.service"; then agent_running=true; fi
;;
*) refuse_existing "cannot establish ownership of $SERVICE.service" ;;
esac
if [[ "$EXISTING_STACK" == true ]]; then
"$PREFLIGHT_NODE" "$SOURCE_DIR/scripts/check-stack-update.mjs" \
--root-dir "$ROOT_DIR" --service "$SERVICE" \
|| refuse_existing 'managed Agent configuration does not match the saved stack'
old_agent_port="$(env_value "$ENV_FILE" AGENT_PORT)"
fi
if command -v docker >/dev/null 2>&1; then
if docker_ready; then
docker_command=(docker)
elif command -v sudo >/dev/null 2>&1; then
if sudo -n docker info >/dev/null 2>&1; then
docker_command=(sudo -n docker)
elif [[ "$CHECK_ONLY" != true && "$ASSUME_YES" != true ]] \
&& sudo docker info >/dev/null; then
docker_command=(sudo docker)
fi
fi
((${#docker_command[@]} > 0)) \
|| refuse_existing 'Docker exists but its containers cannot be inspected (check daemon access or sudo)'
inventory="$("${docker_command[@]}" ps -a --format '{{.ID}}|{{.Names}}|{{.Image}}')" \
|| refuse_existing 'Docker container inventory is unavailable'
while IFS='|' read -r id name image; do
[[ -n "$id" ]] || continue
image="$(printf '%s' "$image" | tr '[:upper:]' '[:lower:]')"
case "$name:$image" in
qq-agent-snowluma:*|*[Ss][Nn][Oo][Ww][Ll][Uu][Mm][Aa]*|*[Nn][Aa][Pp][Cc][Aa][Tt]*|*[Ll][Aa][Gg][Rr][Aa][Nn][Gg][Ee]*)
[[ "$EXISTING_STACK" == true && "$name" == qq-agent-snowluma ]] \
|| refuse_existing "external QQ gateway container $name"
own_id="$id"
"${docker_command[@]}" inspect "$id" \
| "$PREFLIGHT_NODE" "$SOURCE_DIR/scripts/check-stack-update.mjs" \
--root-dir "$ROOT_DIR" --service "$SERVICE" --input container \
|| refuse_existing "container $name does not belong to this stack"
;;
esac
done <<<"$inventory"
if [[ "$EXISTING_STACK" == true ]]; then
"${docker_command[@]}" compose --project-directory "$SNOWLUMA_DIR" \
--env-file "$ENV_FILE" -f "$COMPOSE_FILE" config --format json \
| "$PREFLIGHT_NODE" "$SOURCE_DIR/scripts/check-stack-update.mjs" \
--root-dir "$ROOT_DIR" --service "$SERVICE" --input compose \
|| refuse_existing 'Compose configuration does not match this stack'
fi
if [[ -n "$own_id" ]]; then
docker_ports="$("${docker_command[@]}" inspect --format \
'{{if .State.Running}}{{range .NetworkSettings.Ports}}{{range .}}{{.HostPort}}{{"\n"}}{{end}}{{end}}{{end}}' "$own_id")" \
|| refuse_existing 'cannot inspect managed container ports'
fi
elif [[ "$EXISTING_STACK" == true ]]; then
refuse_existing 'Docker is missing for the existing managed stack'
fi
command -v ss >/dev/null || die 'ss (iproute2) is required for port checks'
listeners="$(ss -H -ltn)" || die 'Cannot inspect listening ports; no deployment changes made'
listeners="$(printf '%s\n' "$listeners" | awk '{n=split($4,a,":"); print a[n]}')"
for port in "${ports[@]}"; do
if printf '%s\n' "$listeners" | grep -Fxq "$port"; then
if [[ "$port" == "$AGENT_PORT" && "$port" == "$old_agent_port" && "$agent_running" == true ]]; then
continue
fi
if [[ "$port" != "$AGENT_PORT" ]] && printf '%s\n' "$docker_ports" | grep -Fxq "$port"; then
continue
fi
refuse_existing "selected port $port is already in use outside the managed services"
fi
done
}
[[ "$(uname -s)" == Linux ]] || die 'Full-stack deployment is supported on Linux only'
((EUID != 0)) || die 'Run as the service user, not root; sudo is used only for host dependencies'
if [[ "${QQ_AGENT_PLATFORM_CHECKED:-}" != "1" ]]; then
bash "$SOURCE_DIR/scripts/check-platform.sh" --strict \
|| die '当前系统不受支持（原因见上）。推荐 Ubuntu 22.04/24.04、Debian 12、Rocky/Alma 9；openSUSE 等 dnf/zypper 系属于预期可用、未实测。'
export QQ_AGENT_PLATFORM_CHECKED=1
fi
command -v curl >/dev/null 2>&1 || die 'curl is required'
[[ "$SERVICE" =~ ^[A-Za-z0-9_-]+$ ]] || die 'Invalid service name'
[[ "$IMAGE" =~ ^[A-Za-z0-9._/:@-]+$ ]] || die 'Invalid SnowLuma image reference'
if [[ "$ASSUME_YES" != true ]]; then
ROOT_DIR="$(prompt_value 'Deployment root' "$ROOT_DIR")"
fi
[[ "$ROOT_DIR" = /* ]] || die '--root-dir must be an absolute path'
[[ "$ROOT_DIR" != *[[:space:]%\"]* ]] || die 'Deployment root contains unsupported characters'
command -v realpath >/dev/null || die 'realpath is required'
ROOT_DIR="$(realpath -m -- "$ROOT_DIR")"
[[ "$ROOT_DIR" != / ]] || die 'The filesystem root cannot be used as the deployment root'
APP_DIR="$ROOT_DIR/app"
AGENT_DATA_DIR="$ROOT_DIR/data"
SNOWLUMA_DIR="$ROOT_DIR/snowluma"
SNOWLUMA_DATA_DIR="$SNOWLUMA_DIR/data"
ENV_FILE="$SNOWLUMA_DIR/.env"
COMPOSE_FILE="$SNOWLUMA_DIR/docker-compose.yml"
ACCESS_FILE="$ROOT_DIR/deployment-access.txt"
EXISTING_STACK=false
PREFLIGHT_NODE=""
# 栈级锁必须在“归属判定/凭据读回”之前拿到：两个实例交错时，后启动的那个不能先按
# 全新安装预检、等前一个结束后再拿锁继续（会把受管栈的凭据轮换掉，2026-10 审查 P2）。
# 锁放在临时目录而不是部署根：预检拒绝时不能留下任何部署目录（fresh preflight 的契约）。
STACK_LOCK_DIR="${TMPDIR:-/tmp}/qq-agent-deploy-$(id -u)-$(printf '%s' "$ROOT_DIR" | sha256sum | cut -c1-12).lock"
trap deploy_all_exit EXIT
acquire_stack_lock
check_local_ownership
# 存量安装：没有显式 --publish/--loopback 时沿用现有绑定，避免一次更新把远程访问改没。
# 先读 .env 的 PUBLISH_HOST；老版本没有这个键，就从 compose 的 0.0.0.0 绑定反推。
if [[ "$EXISTING_STACK" == true && "$PUBLISH_EXPLICIT" != true ]]; then
if [[ -f "$ENV_FILE" ]] && grep -q '^PUBLISH_HOST=' "$ENV_FILE"; then
PUBLISH_HOST="$(sed -n 's/^PUBLISH_HOST=//p' "$ENV_FILE" | head -n 1)"
elif [[ -f "$COMPOSE_FILE" ]] && grep -q '"0\.0\.0\.0:' "$COMPOSE_FILE"; then
PUBLISH_HOST="0.0.0.0"
fi
[[ "$PUBLISH_HOST" == "0.0.0.0" ]] || PUBLISH_HOST="127.0.0.1"
fi
if [[ "$EXISTING_STACK" == true ]]; then
if [[ "$SERVICE_SET" != true ]]; then
SERVICE="$(env_value "$ENV_FILE" QQ_AGENT_SERVICE)"; SERVICE="${SERVICE:-qq-agent-linux}"
fi
if [[ "$IMAGE_SET" != true ]]; then
IMAGE="$(env_value "$ENV_FILE" SNOWLUMA_IMAGE)"; IMAGE="${IMAGE:-motricseven7/snowluma:v1.14.22}"
fi
if [[ "$AGENT_PORT_SET" != true ]]; then
AGENT_PORT="$(env_value "$ENV_FILE" AGENT_PORT)"; AGENT_PORT="${AGENT_PORT:-3210}"
fi
if [[ "$SNOWLUMA_PORT_SET" != true ]]; then
SNOWLUMA_PORT="$(env_value "$ENV_FILE" SNOWLUMA_WEBUI_HOST_PORT)"; SNOWLUMA_PORT="${SNOWLUMA_PORT:-5099}"
fi
if [[ "$NOVNC_PORT_SET" != true ]]; then
NOVNC_PORT="$(env_value "$ENV_FILE" NOVNC_PORT)"; NOVNC_PORT="${NOVNC_PORT:-6081}"
fi
if [[ "$ONEBOT_HTTP_PORT_SET" != true ]]; then
ONEBOT_HTTP_PORT="$(env_value "$ENV_FILE" ONEBOT_HTTP_PORT)"; ONEBOT_HTTP_PORT="${ONEBOT_HTTP_PORT:-3000}"
fi
if [[ "$ONEBOT_WS_PORT_SET" != true ]]; then
ONEBOT_WS_PORT="$(env_value "$ENV_FILE" ONEBOT_WS_PORT)"; ONEBOT_WS_PORT="${ONEBOT_WS_PORT:-3001}"
fi
SNOWLUMA_SCREEN="$(env_value "$ENV_FILE" SNOWLUMA_SCREEN)"; SNOWLUMA_SCREEN="${SNOWLUMA_SCREEN:-1920x1080x24}"
SNOWLUMA_LOG_LEVEL="$(env_value "$ENV_FILE" SNOWLUMA_LOG_LEVEL)"; SNOWLUMA_LOG_LEVEL="${SNOWLUMA_LOG_LEVEL:-info}"
fi
[[ "$SERVICE" =~ ^[A-Za-z0-9_-]+$ ]] || die 'Invalid service name'
[[ "$IMAGE" =~ ^[A-Za-z0-9._/:@-]+$ ]] || die 'Invalid SnowLuma image reference'
[[ "$SNOWLUMA_SCREEN" =~ ^[0-9]+x[0-9]+x[0-9]+$ ]] \
|| die "Invalid SNOWLUMA_SCREEN, expected WIDTHxHEIGHTxDEPTH: $SNOWLUMA_SCREEN"
[[ "$SNOWLUMA_LOG_LEVEL" =~ ^[A-Za-z]+$ ]] || die "Invalid SNOWLUMA_LOG_LEVEL: $SNOWLUMA_LOG_LEVEL"
# 镜像站列表 = 用户指定的（QQ_AGENT_IMAGE_MIRROR 逗号分隔 + --image-mirror）在前，
# 内置公共加速站兜底在后。直连 Docker Hub 能通时这些一个都用不到。
# 为什么留内置兜底：国内/受限网络直连 registry-1.docker.io 必失败，兜底之前每个新部署
# 都要先撞一次"拉取镜像失败"再手改参数重跑（2026-10-12 群友实测）。内置站是第三方、
# 随时可能失效：要换成或补充自己的，用参数放在前面即可（重复的会去掉）。
DEFAULT_IMAGE_MIRRORS=(docker.1panel.live docker.m.daocloud.io)
IMAGE_MIRRORS=()
if [[ -n "${QQ_AGENT_IMAGE_MIRROR:-}" ]]; then
IFS=',' read -r -a IMAGE_MIRRORS <<<"$QQ_AGENT_IMAGE_MIRROR"
fi
[[ -z "$IMAGE_MIRROR_ARG" ]] || IMAGE_MIRRORS+=("$IMAGE_MIRROR_ARG")
for mirror in "${DEFAULT_IMAGE_MIRRORS[@]}"; do
duplicate=false
# 空数组展开用 + guard：bash 4.3 及更老（CentOS 7 / Amazon Linux 2）在 set -u 下
# `"${arr[@]}"` 展开空数组会直接 "unbound variable" 退出（2026-10-13 审查）。
for existing in ${IMAGE_MIRRORS[@]+"${IMAGE_MIRRORS[@]}"}; do
[[ "$existing" == "$mirror" ]] && { duplicate=true; break; }
done
[[ "$duplicate" == true ]] || IMAGE_MIRRORS+=("$mirror")
done
for mirror in ${IMAGE_MIRRORS[@]+"${IMAGE_MIRRORS[@]}"}; do
[[ "$mirror" =~ ^[A-Za-z0-9.-]+(:[0-9]+)?$ ]] || die "Invalid image mirror host: $mirror"
done
if [[ "$ASSUME_YES" != true ]]; then
AGENT_PORT="$(prompt_value 'QQ Agent console port' "$AGENT_PORT")"
SNOWLUMA_PORT="$(prompt_value 'SnowLuma WebUI port' "$SNOWLUMA_PORT")"
NOVNC_PORT="$(prompt_value 'QQ login/noVNC port' "$NOVNC_PORT")"
ONEBOT_HTTP_PORT="$(prompt_value 'OneBot HTTP port (localhost only)' "$ONEBOT_HTTP_PORT")"
ONEBOT_WS_PORT="$(prompt_value 'OneBot WebSocket port (localhost only)' "$ONEBOT_WS_PORT")"
fi
for item in \
"agent:$AGENT_PORT" "SnowLuma:$SNOWLUMA_PORT" "noVNC:$NOVNC_PORT" \
"OneBot HTTP:$ONEBOT_HTTP_PORT" "OneBot WebSocket:$ONEBOT_WS_PORT"; do
validate_port "${item%%:*} port" "${item##*:}"
done
ports=("$AGENT_PORT" "$SNOWLUMA_PORT" "$NOVNC_PORT" "$ONEBOT_HTTP_PORT" "$ONEBOT_WS_PORT")
[[ "$(printf '%s\n' "${ports[@]}" | sort -u | wc -l | tr -d ' ')" == 5 ]] \
|| die 'All five host ports must be different'
if [[ "$SOURCE_DIR" != "$APP_DIR" && ( "$APP_DIR" == "$SOURCE_DIR/"* || "$SOURCE_DIR" == "$APP_DIR/"* ) ]]; then
die 'Source and application directories cannot contain each other; choose another --root-dir'
fi
# 显式轮换凭据时，预检不能拿“新 .env 里的令牌必须等于旧 config.json”来拒绝。
if [[ "$ROTATE_CREDENTIALS" == true ]]; then
export QQ_AGENT_ALLOW_CREDENTIAL_ROTATION=1
fi
check_host_ownership
if [[ "$CHECK_ONLY" == true ]]; then
if [[ "$EXISTING_STACK" == true ]]; then
printf 'Environment: managed stack. Ownership and port checks passed; no deployment changes made.\n'
else
printf 'Environment: fresh installation. Ownership and port checks passed; no deployment changes made.\n'
fi
exit 0
fi
# 旧值用到时现读，不把凭据长期留在变量里（少一份密钥驻留在进程环境与内存中）
stored_value() { env_value "$ENV_FILE" "$1"; }
if [[ "$EXISTING_STACK" == true && "$ROTATE_CREDENTIALS" != true && "$ASSUME_YES" != true ]]; then
if confirm 'Rotate Agent, OneBot, SnowLuma and noVNC credentials?' false; then
ROTATE_CREDENTIALS=true
fi
fi
if [[ "$EXISTING_STACK" == true && "$ROTATE_CREDENTIALS" != true ]]; then
AGENT_TOKEN="${AGENT_TOKEN:-$(stored_value QQ_AGENT_CONSOLE_TOKEN)}"
ONEBOT_TOKEN="${ONEBOT_TOKEN:-$(stored_value ONEBOT_TOKEN)}"
SNOWLUMA_PASSWORD="${SNOWLUMA_PASSWORD:-$(stored_value SNOWLUMA_WEBUI_BOOTSTRAP_PASSWORD)}"
VNC_PASSWORD="${VNC_PASSWORD:-$(stored_value VNC_PASSWD)}"
fi
AGENT_TOKEN="${AGENT_TOKEN:-$(random_hex 24)}"
ONEBOT_TOKEN="${ONEBOT_TOKEN:-$(random_hex 32)}"
SNOWLUMA_PASSWORD="${SNOWLUMA_PASSWORD:-Sl-$(random_hex 12)!Aa}"
VNC_PASSWORD="${VNC_PASSWORD:-$(random_hex 4)}"
if [[ "$ASSUME_YES" != true ]] && [[ "$EXISTING_STACK" != true || "$ROTATE_CREDENTIALS" == true ]]; then
if confirm 'Use custom credentials instead of the generated values?' false; then
AGENT_TOKEN="$(prompt_secret 'QQ Agent console token')"
ONEBOT_TOKEN="$(prompt_secret 'Shared OneBot token')"
SNOWLUMA_PASSWORD="$(prompt_secret 'SnowLuma WebUI password')"
VNC_PASSWORD="$(prompt_secret 'noVNC password (8 characters recommended)')"
fi
fi
if [[ "$EXISTING_STACK" == true && "$SNOWLUMA_PASSWORD" != "$(stored_value SNOWLUMA_WEBUI_BOOTSTRAP_PASSWORD)" ]]; then
SNOWLUMA_CURRENT_PASSWORD="${SNOWLUMA_CURRENT_PASSWORD:-$(stored_value SNOWLUMA_WEBUI_BOOTSTRAP_PASSWORD)}"
if [[ -z "$SNOWLUMA_CURRENT_PASSWORD" && "$ASSUME_YES" != true ]]; then
SNOWLUMA_CURRENT_PASSWORD="$(prompt_secret 'Current SnowLuma WebUI password')"
fi
[[ -n "$SNOWLUMA_CURRENT_PASSWORD" ]] \
|| die 'The current SnowLuma password is required to rotate existing credentials'
fi
if [[ "$EXISTING_STACK" != true && "$SKIP_MODEL_CONFIG" != true ]]; then
if [[ "$ASSUME_YES" != true ]]; then
# 模型这一步做成"可以整段跳过"：Base URL / 模型名都回车即默认，Key 留空＝装完在网页
# 控制台里配（那边有服务预设与连通性测试，对新人反而更好填）。以前 Key 没默认值，
# 答不上来直接 die —— 这是小白卡得最多的一步（2026-10-12）。
printf 'Model setup (press Enter everywhere to skip; configure it later in the web console).\n' >/dev/tty
MODEL_BASE_URL="$(prompt_value 'Model API base URL' "${MODEL_BASE_URL:-https://api.deepseek.com}")"
MODEL_NAME="$(prompt_value 'Model name' "${MODEL_NAME:-deepseek-chat}")"
if [[ -z "$MODEL_API_KEY" ]]; then
MODEL_API_KEY="$(prompt_secret 'Model API key (blank = configure in the console after install)')"
fi
ALLOW_GROUPS="$(prompt_value 'Allowed group IDs, comma-separated (blank to configure later)' "$ALLOW_GROUPS")"
ALLOW_PRIVATE="$(prompt_value 'Allowed private QQ IDs, comma-separated (blank to configure later)' "$ALLOW_PRIVATE")"
# Key 留空 = 跳过模型配置（保留已填的 base URL/模型名，别把显式传来的值抹掉）：
# 走 SKIP_MODEL_CONFIG 会把"还缺模型"写进结尾清单，控制台里补 Key 即可。
[[ -n "$MODEL_API_KEY" ]] || SKIP_MODEL_CONFIG=true
fi
[[ "$SKIP_MODEL_CONFIG" == true || ( -n "$MODEL_BASE_URL" && -n "$MODEL_API_KEY" && -n "$MODEL_NAME" ) ]] \
|| die 'Fresh non-interactive deployment requires --model-base-url, --model-api-key and --model, or --skip-model-config'
fi
if [[ -n "$MODEL_BASE_URL" && ! "$MODEL_BASE_URL" =~ ^https?:// ]] ; then
die 'Model API base URL must use http:// or https://'
fi
for list in "$ALLOW_GROUPS" "$ALLOW_PRIVATE"; do
[[ -z "$list" || "$list" =~ ^[0-9]+(,[0-9]+)*$ ]] \
|| die 'Allowlists must contain comma-separated numeric QQ IDs without spaces'
done
validate_secret 'QQ Agent console token' "$AGENT_TOKEN" 16
validate_secret 'OneBot token' "$ONEBOT_TOKEN" 16
validate_secret 'SnowLuma WebUI password' "$SNOWLUMA_PASSWORD" 10
[[ "$SNOWLUMA_PASSWORD" =~ [a-z] && "$SNOWLUMA_PASSWORD" =~ [A-Z] \
&& "$SNOWLUMA_PASSWORD" =~ [^A-Za-z0-9] ]] \
|| die 'SnowLuma WebUI password must contain lowercase, uppercase, and a special character'
validate_secret 'noVNC password' "$VNC_PASSWORD" 8
step 'Preparing directories'
ROOT_CREATED=false
if [[ ! -d "$ROOT_DIR" ]]; then
run_root mkdir -p "$ROOT_DIR"
run_root chown "$(id -u):$(id -g)" "$ROOT_DIR"
ROOT_CREATED=true
fi
[[ -w "$ROOT_DIR" ]] || die "Deployment root is not writable by $(id -un): $ROOT_DIR"
mkdir -p "$APP_DIR" "$AGENT_DATA_DIR" \
"$SNOWLUMA_DATA_DIR/config" "$SNOWLUMA_DIR/client-config" "$SNOWLUMA_DIR/client-data"
# 只收紧本次创建的根目录；已存在的父目录可能是共享目录（/opt、/mnt/data），
# 不能因为一次部署把别人的目录改成 0700。
[[ "$ROOT_CREATED" != true ]] || chmod 700 "$ROOT_DIR"
chmod 700 "$AGENT_DATA_DIR" "$SNOWLUMA_DIR" "$SNOWLUMA_DATA_DIR" \
"$SNOWLUMA_DIR/client-config" "$SNOWLUMA_DIR/client-data"
# 退出钩子与栈级锁已在归属判定之前挂好（见上方 EXISTING_STACK 初始化处）。
# 只有拿到锁且确认是 fresh 的实例才允许做清理；抢锁失败的实例退出时不能删赢家的 .env/compose。
if [[ "$EXISTING_STACK" != true ]]; then
FRESH_STACK_CLEANUP=true
fi
# 只比较摘要/长度，不把旧令牌留在变量里（与“现读现用凭据”的纪律一致）。
OLD_ONEBOT_LEN="$(env_value "$ENV_FILE" ONEBOT_TOKEN | wc -c | tr -d ' ')"
OLD_ONEBOT_DIGEST="$(env_value "$ENV_FILE" ONEBOT_TOKEN | sha256sum | awk '{print $1}')"
NEW_ONEBOT_DIGEST="$(printf '%s' "$ONEBOT_TOKEN" | sha256sum | awk '{print $1}')"
if (( OLD_ONEBOT_LEN > 0 )) && [[ "$OLD_ONEBOT_DIGEST" != "$NEW_ONEBOT_DIGEST" ]]; then
# compose up 看到配置没变不会重建容器；令牌改了但 SnowLuma 仍读旧 onebot.json
# 会一直 401，所以这里显式强制重建。
RECREATE_SNOWLUMA=true
else
RECREATE_SNOWLUMA=false
fi
if [[ -f "$ENV_FILE" ]]; then
cp -p "$ENV_FILE" "$ENV_FILE.pre-deploy"
fi
cat >"$ENV_FILE.tmp" <<EOF
SNOWLUMA_IMAGE=$IMAGE
SNOWLUMA_CONTAINER=qq-agent-snowluma
PUBLISH_HOST=$PUBLISH_HOST
AGENT_PORT=$AGENT_PORT
QQ_AGENT_SERVICE=$SERVICE
SNOWLUMA_UID=$(id -u)
SNOWLUMA_GID=$(id -g)
SNOWLUMA_WEBUI_HOST=0.0.0.0
SNOWLUMA_WEBUI_PORT=5099
SNOWLUMA_WEBUI_HOST_PORT=$SNOWLUMA_PORT
SNOWLUMA_WEBUI_BOOTSTRAP_PASSWORD=$SNOWLUMA_PASSWORD
SNOWLUMA_LOG_LEVEL=$SNOWLUMA_LOG_LEVEL
SNOWLUMA_SCREEN=$SNOWLUMA_SCREEN
SNOWLUMA_HOOK_AUTOLOAD=1
SNOWLUMA_ONEBOT_HOST=0.0.0.0
SNOWLUMA_TELEMETRY=0
VNC_PASSWD=$VNC_PASSWORD
NOVNC_PORT=$NOVNC_PORT
ONEBOT_HTTP_PORT=$ONEBOT_HTTP_PORT
ONEBOT_WS_PORT=$ONEBOT_WS_PORT
ONEBOT_TOKEN=$ONEBOT_TOKEN
QQ_AGENT_CONSOLE_TOKEN=$AGENT_TOKEN
EOF
mv "$ENV_FILE.tmp" "$ENV_FILE"
# .env 已重写（可能带新凭据）：先置位，再做 chmod；chmod 失败时失败退出仍能回拷 .pre-deploy。
ENV_REWRITTEN=true
chmod 600 "$ENV_FILE"
cat >"$COMPOSE_FILE.tmp" <<'EOF'
services:
snowluma:
image: "${SNOWLUMA_IMAGE}"
container_name: "${SNOWLUMA_CONTAINER}"
restart: unless-stopped
logging:
driver: json-file
options:
max-size: "10m"
max-file: "3"
shm_size: 1gb
ulimits:
nofile:
soft: 65536
hard: 1048576
cap_add:
- SYS_PTRACE
security_opt:
- seccomp=unconfined
environment:
VNC_PASSWD: "${VNC_PASSWD}"
SNOWLUMA_ONEBOT_HOST: "${SNOWLUMA_ONEBOT_HOST}"
SNOWLUMA_UID: "${SNOWLUMA_UID}"
SNOWLUMA_GID: "${SNOWLUMA_GID}"
SNOWLUMA_WEBUI_HOST: "${SNOWLUMA_WEBUI_HOST}"
SNOWLUMA_WEBUI_PORT: "${SNOWLUMA_WEBUI_PORT}"
SNOWLUMA_WEBUI_BOOTSTRAP_PASSWORD: "${SNOWLUMA_WEBUI_BOOTSTRAP_PASSWORD}"
SNOWLUMA_LOG_LEVEL: "${SNOWLUMA_LOG_LEVEL}"
SNOWLUMA_SCREEN: "${SNOWLUMA_SCREEN}"
SNOWLUMA_HOOK_AUTOLOAD: "${SNOWLUMA_HOOK_AUTOLOAD}"
SNOWLUMA_QQ_FLAGS: --disable-gpu --disable-software-rasterizer --disable-gpu-compositing
SNOWLUMA_TELEMETRY: "${SNOWLUMA_TELEMETRY}"
ports:
- "${PUBLISH_HOST}:${NOVNC_PORT}:6081"
- "${PUBLISH_HOST}:${SNOWLUMA_WEBUI_HOST_PORT}:5099"
- "127.0.0.1:${ONEBOT_HTTP_PORT}:3000"
- "127.0.0.1:${ONEBOT_WS_PORT}:3001"
volumes:
- ./data:/app/data
- ./client-config:/app/.config
- ./client-data:/app/.local/share
EOF
mv "$COMPOSE_FILE.tmp" "$COMPOSE_FILE"
chmod 600 "$COMPOSE_FILE"
# 清理钩子已提前到 .env 写盘之前挂载（deploy_all_exit，见上）；Agent 装好后在下方撤销标志。
if ! docker_ready && ! sudo_docker_ready; then install_docker; fi
docker_ready || sudo_docker_ready || die 'Docker installation completed but the daemon is unavailable'
docker_call compose version >/dev/null 2>&1 || install_compose
docker_call compose version >/dev/null 2>&1 || die 'Docker Compose v2 is required'
# 拉一个引用：每个地址最多 3 次，退避 3 / 6 秒
pull_with_retry() {
local ref="$1" attempt
for attempt in 1 2 3; do
if docker_call pull "$ref"; then return 0; fi
((attempt < 3)) || return 1
sleep $((attempt * 3))
done
return 1
}
# 换成镜像站之后同步 .env：compose 走 --env-file，里面也得是同一个引用；权限保持不变
update_env_image() {
local tmp="$ENV_FILE.tmp.$$"
awk -v image="$IMAGE" -F= 'BEGIN { OFS="=" } $1 == "SNOWLUMA_IMAGE" { print "SNOWLUMA_IMAGE=" image; next } { print }' \
"$ENV_FILE" >"$tmp" || return 1
chmod --reference="$ENV_FILE" "$tmp" 2>/dev/null || chmod 600 "$tmp"
mv "$tmp" "$ENV_FILE"
}
# 连不上 Docker Hub 时的落地方案（国内服务器常见；内置站已在上面自动试过一轮）
image_pull_hint() {
cat >&2 <<'HINT'
拉取 SnowLuma 镜像失败。国内/受限网络连不上 Docker Hub（registry-1.docker.io）很常见；
内置的公共加速站已经自动试过一轮（docker.1panel.live、docker.m.daocloud.io），都没拉下来。
下面三种办法任选一种，然后重跑 deploy-all.sh：
1) 换成你信得过的加速器地址重跑（云厂商给的那个通常最稳）：
QQ_AGENT_IMAGE_MIRROR=<mirror> bash deploy-all.sh
可以给多个、逗号分隔；你自己的排在前面，内置的仍在其后兜底。
或直接给完整地址：
bash deploy-all.sh --image <mirror>/motricseven7/snowluma:v1.14.22
2) 给 Docker 配全局加速器（配一次，之后所有拉取都走它）：
sudo tee /etc/docker/daemon.json <<'JSON'
{ "registry-mirrors": ["https://<你的加速器地址>"] }
JSON
sudo systemctl restart docker
3) 在能联网的机器上拉好再带过来：
docker pull motricseven7/snowluma:v1.14.22
docker save motricseven7/snowluma:v1.14.22 | gzip > snowluma.tgz
gunzip -c snowluma.tgz | docker load # 在目标机上执行
镜像站由第三方提供：内置的两家只是兜底，不放心就用 --image-mirror 换成你自己的。
HINT
}
step "Downloading SnowLuma image $IMAGE"
PULLED=false
if docker_call image inspect "$IMAGE" >/dev/null 2>&1; then
# 离线/内网按文档 docker load 过的镜像：本地已有就不要强制访问 registry。
info "Using locally loaded image: $IMAGE"
PULLED=true
elif pull_with_retry "$IMAGE"; then
PULLED=true
else
# .env 里存的可能是"上次走通的镜像站前缀 + 基础引用"——默认走内置兜底之后，这是国内新装的
# 常态。不先把认得的前缀剥掉，换站重跑会把旧前缀原样拼给每个镜像站：旧站一挂就永远换不到
# 新站（2026-10-12 审查：hint 首推的 QQ_AGENT_IMAGE_MIRROR=<mirror> 同样会失效）。
# 只剥"当前列表里认得的"前缀——真正的自定义 registry 引用不猜、照旧原样重试。
BASE_IMAGE="$IMAGE"
for known in "${IMAGE_MIRRORS[@]}"; do
case "$BASE_IMAGE" in
"$known"/*) BASE_IMAGE="${BASE_IMAGE#"$known"/}"; break ;;
esac
done
for mirror in "${IMAGE_MIRRORS[@]}"; do
# 只在基础引用还没有 registry host 时加前缀：≥2 个斜杠 = 真正的自定义 registry
#（或没剥掉的前缀），保持原样，不能拿第三方前缀去套别人的命名空间。
case "$BASE_IMAGE" in
*/*/*) candidate="$BASE_IMAGE" ;;
*) candidate="${mirror%/}/$BASE_IMAGE" ;;
esac
# 直连那一步已经试过这个引用（剥离后重拼可能等于原值）就别再试一遍
[[ "$candidate" == "$IMAGE" ]] && continue
# 本地已有镜像站前缀的同一镜像时别访问那个可能已下线的站
if docker_call image inspect "$candidate" >/dev/null 2>&1; then
info "Using locally loaded image: $candidate"
IMAGE="$candidate"
update_env_image || true
PULLED=true
break
fi
step "Retrying through image mirror $mirror"
if pull_with_retry "$candidate"; then
IMAGE="$candidate"
update_env_image || true
PULLED=true
break
fi
done
fi
if [[ "$PULLED" != true ]]; then
image_pull_hint
die "Failed to download SnowLuma image ($IMAGE); see the hint above"
fi
step 'Installing QQ Agent'
export QQ_AGENT_CONSOLE_TOKEN="$AGENT_TOKEN"
export QQ_AGENT_ONEBOT_TOKEN="$ONEBOT_TOKEN"
export QQ_AGENT_ONEBOT_HTTP_TOKEN="$ONEBOT_TOKEN"
export QQ_AGENT_ONEBOT_HTTP_URL="http://127.0.0.1:$ONEBOT_HTTP_PORT"
export QQ_AGENT_ONEBOT_WS_URL="ws://127.0.0.1:$ONEBOT_WS_PORT"
export QQ_SNOWLUMA_WEBUI_URL="http://127.0.0.1:$SNOWLUMA_PORT"
# 协议端更新器用这个端口做就绪探测；只在 URL 里带端口不够（自定义 --snowluma-port 时
# 会一直探默认 5099 → 超时回滚，2026-10 审查 P2）。
export QQ_AGENT_WEBUI_PORT="$SNOWLUMA_PORT"
[[ -z "$MODEL_BASE_URL" ]] || export QQ_AGENT_MODEL_BASE_URL="$MODEL_BASE_URL"
# 模型 Key 不走子进程环境（/proc/<pid>/environ 里读得到）：写 0600 临时文件，
# 部署脚本按 QQ_AGENT_MODEL_KEY_FILE 读，脚本退出时删掉。
if [[ -n "$MODEL_API_KEY" ]]; then
MODEL_KEY_FILE="$(mktemp "${TMPDIR:-/tmp}/qq-agent-model-key.XXXXXX")"
printf '%s' "$MODEL_API_KEY" >"$MODEL_KEY_FILE"
chmod 600 "$MODEL_KEY_FILE"
export QQ_AGENT_MODEL_KEY_FILE="$MODEL_KEY_FILE"
fi
[[ -z "$MODEL_NAME" ]] || export QQ_AGENT_MODEL="$MODEL_NAME"
[[ -z "$ALLOW_GROUPS" ]] || export QQ_AGENT_ALLOW_GROUPS="$ALLOW_GROUPS"
[[ -z "$ALLOW_PRIVATE" ]] || export QQ_AGENT_ALLOW_PRIVATE="$ALLOW_PRIVATE"
# 端口每一轮都显式传给 deploy.sh：.env 在重跑时已经写成了新端口，如果 deploy.sh 仍沿用
# config.json 的旧端口，部署会"成功"但随后按新端口做健康检查必然超时，.env 与 config.json
# 从此不一致，后续所有预检都会拒绝（2026-10 审查 P1）。
DEPLOY_ARGS=(--install-dir "$APP_DIR" --data-dir "$AGENT_DATA_DIR" --service "$SERVICE" --port "$AGENT_PORT")
if [[ "$EXISTING_STACK" != true || "$PUBLISH_EXPLICIT" == true ]]; then
# 新装按 --publish/--loopback 落 host；已有安装只有显式传了 --publish/--loopback 才改，
# 否则沿用 config.json 里的 host（避免一次普通重跑把用户收紧过的绑定改回去）。
DEPLOY_ARGS+=(--host "$PUBLISH_HOST")
fi
bash "$SOURCE_DIR/deploy.sh" "${DEPLOY_ARGS[@]}"
# Agent 已装好，栈不再是"半成品"：撤销失败清理，保留 .env / compose。
FRESH_STACK_CLEANUP=false
# .env 的新凭据自此生效（deploy.sh 已完成、config.json 已含配套令牌）：此后失败不再回拷。
DEPLOY_COMPLETED=true
NODE_BIN="$(tr -d '\r\n' <"$APP_DIR/.deployment-node")"
if [[ "$EXISTING_STACK" != true ]]; then
"$APP_DIR/manage.sh" observe
fi
"$NODE_BIN" "$SOURCE_DIR/scripts/configure-snowluma.mjs" \
--data-dir "$SNOWLUMA_DATA_DIR" \
--http-port 3000 \
--ws-port 3001
step 'Starting SnowLuma and OneBot'
COMPOSE_UP=(--env-file .env up -d)
if [[ "$RECREATE_SNOWLUMA" == true ]]; then
COMPOSE_UP+=(--force-recreate snowluma)
fi
(cd "$SNOWLUMA_DIR" && docker_call compose "${COMPOSE_UP[@]}")
wait_http "http://127.0.0.1:$SNOWLUMA_PORT/api/ui/public" 90 \
|| die "SnowLuma WebUI did not become ready; run: cd $SNOWLUMA_DIR && docker compose logs"
wait_http "http://127.0.0.1:$NOVNC_PORT/" 30 \
|| die "noVNC did not become ready; run: cd $SNOWLUMA_DIR && docker compose logs"
# 2026-10-06 复审 P3：原判据用 stored_value 读 SNOWLUMA_WEBUI_BOOTSTRAP_PASSWORD，但 .env
# 已在 613-636 行把该键改写成新密码，于是「新密码 != stored_value」恒为假，整个轮换分支
# （含 rotate-snowluma-password.mjs）永不执行：容器里还是旧密码，而 .env 与
# deployment-access.txt 记的是新密码，凭据静默失配且无任何报错。这里改用 553-556 行
# 在改写 .env 之前捕获的旧密码 SNOWLUMA_CURRENT_PASSWORD 来比较。
# 另加 -n 守卫：密码未变时 553 行分支不进入，该变量为空，若不判空则空串 != 新密码 会误触发
# 轮换（重跑脚本是常态，不能每次都轮换）；真正需要轮换却取不到旧密码时，558 行已提前 die。
if [[ "$EXISTING_STACK" == true && -n "$SNOWLUMA_CURRENT_PASSWORD" \
&& "$SNOWLUMA_CURRENT_PASSWORD" != "$SNOWLUMA_PASSWORD" ]]; then
# 密码走环境变量而不是命令行参数：/proc/<pid>/cmdline 对本机所有用户可读。
export QQ_AGENT_SNOWLUMA_CURRENT_PASSWORD="$SNOWLUMA_CURRENT_PASSWORD"
export QQ_AGENT_SNOWLUMA_PASSWORD="$SNOWLUMA_PASSWORD"
rotate_args=(--url "http://127.0.0.1:$SNOWLUMA_PORT")
[[ -z "$SNOWLUMA_TOTP" ]] || rotate_args+=(--totp "$SNOWLUMA_TOTP")
if ! "$NODE_BIN" "$SOURCE_DIR/scripts/rotate-snowluma-password.mjs" "${rotate_args[@]}"; then
# 2026-10-09 审查：原先这里回拷 .env 是**假回滚** —— 此刻 config.json / compose / 容器
# 都已是新凭据，只退回 .env 会让下次部署被自家预检拒（"凭据被外部改过"），而新的控制台
# 令牌又只留在 config.json 里、access 文件还没生成。保持三方一致（都用新凭据）才是可恢复
# 状态：WebUI 密码维持旧值，带上**实际在用**的旧密码重跑即可完成轮换。
KEEP_ENV_ON_ROTATE_FAILURE=true
printf '控制台令牌已更新；新令牌见 %s/config.json 的 server.token（或 %s/console-access.txt）。SnowLuma WebUI 密码仍是旧值。\n' \
"$AGENT_DATA_DIR" "$AGENT_DATA_DIR" >&2
die 'SnowLuma password rotation failed. Every other credential was left in place and stays consistent; the WebUI password is unchanged. Retry with --snowluma-current-password set to the password the WebUI actually uses.'
fi
fi
systemctl --user restart "$SERVICE.service"
wait_http "http://127.0.0.1:$AGENT_PORT/healthz" 30 \
|| die "QQ Agent did not become ready; run: $APP_DIR/manage.sh logs"
# 优先 IPv4：IPv6 直接拼 http://240e:... 是非法 URL，install.sh 的端口正则也匹配不到。
HOST_IP="$(hostname -I 2>/dev/null | tr ' ' '\n' | grep -E '^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$' | head -n 1 || true)"
HOST_IP="${HOST_IP:-$(hostname -I 2>/dev/null | awk '{print $1}' || true)}"
HOST_IP="${HOST_IP:-127.0.0.1}"
if [[ "$PUBLISH_HOST" == "127.0.0.1" ]]; then
HOST_IP="127.0.0.1"
PUBLISH_NOTE="bound to 127.0.0.1 only — use an SSH tunnel (console-tunnel.bat / ops console) or re-run with --publish"
else
PUBLISH_NOTE="bound to 0.0.0.0 — restrict the cloud security group / firewall to trusted sources"
fi
MODE="$("$NODE_BIN" -e 'const c=require(process.argv[1]);process.stdout.write(c.runtime.mode)' \
"$AGENT_DATA_DIR/config.json")"
cat >"$ACCESS_FILE.tmp" <<EOF
QQ Agent full-stack access
Publish host: $PUBLISH_HOST
Agent console: http://$HOST_IP:$AGENT_PORT
Agent token: $AGENT_TOKEN
SnowLuma WebUI: http://$HOST_IP:$SNOWLUMA_PORT
SnowLuma password: $SNOWLUMA_PASSWORD
QQ login/noVNC: http://$HOST_IP:$NOVNC_PORT
noVNC password: $VNC_PASSWORD
OneBot HTTP: http://127.0.0.1:$ONEBOT_HTTP_PORT
OneBot WebSocket: ws://127.0.0.1:$ONEBOT_WS_PORT
OneBot token: $ONEBOT_TOKEN
Mode: $MODE
EOF
mv "$ACCESS_FILE.tmp" "$ACCESS_FILE"
chmod 600 "$ACCESS_FILE"
# 成功收尾：.env 已是当前凭据，旧 .pre-deploy 里还有上一版令牌/密码，不应长期留在栈目录。
rm -f "$ENV_FILE.pre-deploy"
printf '\nDeployment complete. Agent mode: %s.\n' "$MODE"
printf 'Bind: %s\n' "$PUBLISH_NOTE"
printf '1. Open QQ login: http://%s:%s\n' "$HOST_IP" "$NOVNC_PORT"
printf '2. Scan the QR code and finish QQ login.\n'
printf '3. Open Agent console: http://%s:%s\n' "$HOST_IP" "$AGENT_PORT"
printf '4. Verify OneBot is connected in the Agent console.\n'
if [[ "$SKIP_MODEL_CONFIG" == true || -z "$ALLOW_GROUPS$ALLOW_PRIVATE" ]]; then
printf '5. Complete the model/allowlist fields that were intentionally left blank.\n'
fi
printf '6. Activate only after excluding the old bot: %s/manage.sh activate --confirm-exclusive\n' "$APP_DIR"
printf 'Credentials: %s\n' "$ACCESS_FILE"
if [[ "$ASSUME_YES" != true ]]; then
printf '\nComplete QQ login in noVNC, then press Enter to verify the OneBot connection: ' >/dev/tty
IFS= read -r _ </dev/tty || true
CONNECTED=false
for _ in {1..30}; do
if onebot_ready; then CONNECTED=true; break; fi
sleep 1
done
if [[ "$CONNECTED" == true ]]; then
printf 'OneBot login verified.\n'
if [[ "$MODE" != active && "$SKIP_MODEL_CONFIG" != true && -n "$ALLOW_GROUPS$ALLOW_PRIVATE" ]] \
&& confirm 'Activate QQ Agent now? Confirm the old bot no longer handles these chats.' false; then
"$APP_DIR/manage.sh" activate --confirm-exclusive
fi
else
printf 'OneBot is not logged in yet. The services remain installed in observe mode.\n' >&2
fi
fi