fix:main.py

Reviewed-on: #13

.gitea/workflows/README.md

@@ -0,0 +1,5 @@
+docker exec -it gitea-runner bash
+# 然后在容器里安装 Node.js
+curl -fsSL https://deb.nodesource.com/setup_20.x | bash -
+apt-get install -y nodejs
+node -v

.gitea/workflows/server-build.yml

@@ -0,0 +1,104 @@
+name: Build and Push Server Docker Image
+
+# 手动触发 workflow：从哪个分支运行，就打包哪个分支的代码
+on:
+  workflow_dispatch:
+
+jobs:
+  build-and-push:
+    runs-on: ubuntu-latest
+
+    steps:
+      # 1️⃣ Checkout 仓库代码
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          # 需要能 push tag（请在仓库 Secrets 配置 RUNNER_TOKEN）
+          token: ${{ secrets.RUNNER_TOKEN }}
+          persist-credentials: true
+
+      # 2️⃣ 自动递增 tag 并推送回 Gitea 仓库（默认按 vX.Y.Z 的 patch +1）
+      - name: Auto bump tag and push to repository
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          # 配置提交信息（用于创建注释 tag）
+          git config user.name "gitea-actions"
+          git config user.email "actions@local"
+
+          # 确保本地有最新 tags
+          git fetch --tags --force
+
+          # 取最新的 semver tag（vX.Y.Z），按版本号排序
+          LATEST_TAG="$(git tag --list 'v*' --sort=-v:refname | head -n 1 || true)"
+          echo "LATEST_TAG=${LATEST_TAG}"
+
+          if [[ -z "${LATEST_TAG}" ]]; then
+            NEXT_TAG="v1.0.0"
+          else
+            if [[ "${LATEST_TAG}" =~ ^v([0-9]+)\.([0-9]+)\.([0-9]+)$ ]]; then
+              MAJOR="${BASH_REMATCH[1]}"
+              MINOR="${BASH_REMATCH[2]}"
+              PATCH="${BASH_REMATCH[3]}"
+              NEXT_TAG="v${MAJOR}.${MINOR}.$((PATCH + 1))"
+            else
+              # 如果最新 tag 不符合 vX.Y.Z，回退到 v1.0.0，避免误解析
+              NEXT_TAG="v1.0.0"
+            fi
+          fi
+
+          echo "NEXT_TAG=${NEXT_TAG}"
+
+          # 如果 tag 已存在则直接复用（避免重复运行失败）
+          if git rev-parse -q --verify "refs/tags/${NEXT_TAG}" >/dev/null; then
+            echo "Tag ${NEXT_TAG} 已存在，跳过创建。"
+          else
+            git tag -a "${NEXT_TAG}" -m "Release ${NEXT_TAG}"
+            git push origin "${NEXT_TAG}"
+          fi
+
+          # 输出给后续步骤使用
+          if [[ -n "${GITHUB_ENV:-}" ]]; then
+            echo "IMAGE_TAG=${NEXT_TAG}" >> "$GITHUB_ENV"
+          fi
+          # 兼容部分 Gitea Runner 环境变量命名
+          if [[ -n "${GITEA_ENV:-}" ]]; then
+            echo "IMAGE_TAG=${NEXT_TAG}" >> "$GITEA_ENV"
+          fi
+
+      # 3️⃣ 设置镜像仓库与镜像名称（自建 Registry / Docker Hub 都可）
+      - name: Set image variables
+        shell: bash
+        run: |
+          # 直接写死：推送到自建仓库
+          IMAGE_NAME="docker.damer.fun/damer/mindfulness-server"
+
+          if [[ -n "${GITHUB_ENV:-}" ]]; then
+            echo "IMAGE_NAME=$IMAGE_NAME" >> "$GITHUB_ENV"
+          fi
+          if [[ -n "${GITEA_ENV:-}" ]]; then
+            echo "IMAGE_NAME=$IMAGE_NAME" >> "$GITEA_ENV"
+          fi
+
+      # 4️⃣ 登录镜像仓库（自建 Registry / Docker Hub）
+      - name: Login to Docker Registry
+        uses: docker/login-action@v3
+        with:
+          # 与 IMAGE_NAME 的 registry 保持一致
+          registry: docker.damer.fun
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_TOKEN }}
+
+      # 5️⃣ 构建 Docker 镜像（使用 server/ 作为构建上下文）
+      - name: Build Docker Image
+        shell: bash
+        run: |
+          docker build -f server/Dockerfile -t "$IMAGE_NAME:$IMAGE_TAG" server
+
+      # 6️⃣ 推送 Docker 镜像到镜像仓库
+      - name: Push Docker Image
+        shell: bash
+        run: |
+          docker push "$IMAGE_NAME:$IMAGE_TAG"

.gitea/workflows/server-deploy.yml

@@ -0,0 +1,431 @@
+name: Deploy Server (SSH + Nginx 蓝绿)
+
+# 手动触发：选择部署环境（dev/pro）并输入要部署的镜像 tag
+on:
+  workflow_dispatch:
+    inputs:
+      env:
+        description: '部署环境'
+        type: choice
+        required: true
+        options:
+          - dev
+          - pro
+      tag:
+        description: '要部署的镜像 Tag（例如：v1.2.7）'
+        required: true
+
+# 同一环境同一时间只允许一个部署在跑，避免互相覆盖
+concurrency:
+  group: deploy-server-${{ github.event.inputs.env }}
+  cancel-in-progress: false
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    env:
+      # 统一在 env 中注入变量，减少 runner 差异带来的兼容性问题
+      DEPLOY_ENV: ${{ github.event.inputs.env }}
+      DEPLOY_TAG: ${{ github.event.inputs.tag }}
+
+      # 镜像名（优先 vars.DOCKER_IMAGE；未配置则步骤里兜底）
+      DOCKER_IMAGE: ${{ vars.DOCKER_IMAGE }}
+
+      # 可选：明确 registry（私有仓库用）。未配置会从 DOCKER_IMAGE 推断
+      DOCKER_REGISTRY: ${{ vars.DOCKER_REGISTRY }}
+
+      # SSH：dev 用 secrets，pro 用 vars（按你现有用法）
+      SSH_HOST: ${{ github.event.inputs.env == 'dev' && secrets.DEV_SSH_HOST || vars.PRO_SSH_HOST }}
+      SSH_USER: ${{ github.event.inputs.env == 'dev' && secrets.DEV_SSH_USER || vars.PRO_SSH_USER }}
+      SSH_PORT: ${{ github.event.inputs.env == 'dev' && secrets.DEV_SSH_PORT || vars.PRO_SSH_PORT }}
+      SSH_KEY: ${{ github.event.inputs.env == 'dev' && secrets.DEV_SSH_KEY || secrets.PRO_SSH_KEY }}
+      # 推荐把私钥做成 base64（单行）存到 Secrets，避免多行变量丢换行
+      SSH_KEY_B64: ${{ github.event.inputs.env == 'dev' && secrets.DEV_SSH_KEY_B64 || secrets.PRO_SSH_KEY_B64 }}
+
+      # Nginx upstream 配置（建议放到 vars）
+      NGINX_UPSTREAM_FILE: ${{ vars.NGINX_UPSTREAM_FILE }}
+      NGINX_UPSTREAM_NAME: ${{ vars.NGINX_UPSTREAM_NAME }}
+
+      # 蓝绿端口（宿主机端口，建议放到 vars；未配置则脚本内有默认值）
+      BLUE_PORT: ${{ vars.BLUE_PORT }}
+      GREEN_PORT: ${{ vars.GREEN_PORT }}
+
+      # 容器内监听端口（FastAPI 常用 8000；未配置则默认 8000）
+      CONTAINER_PORT: ${{ vars.CONTAINER_PORT }}
+
+      # 健康检查路径（未配置则默认 /health；如果你没有 health 接口，可改为 /docs 或 /）
+      HEALTHCHECK_PATH: ${{ vars.HEALTHCHECK_PATH }}
+
+      # 可选：远端 env 文件路径（例如 /opt/mindfulness-server/.env.prod），存在则 docker run --env-file
+      REMOTE_ENV_FILE: ${{ vars.REMOTE_ENV_FILE }}
+
+    steps:
+      - name: 配置 SSH Key（密钥登陆）
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          # 镜像名兜底（与 .gitea/workflows/server-build.yml 的默认一致）
+          if [[ -z "${DOCKER_IMAGE:-}" ]]; then
+            DOCKER_IMAGE="docker.damer.fun/damer/mindfulness-server"
+          fi
+          if [[ -n "${GITHUB_ENV:-}" ]]; then
+            echo "DOCKER_IMAGE=${DOCKER_IMAGE}" >> "$GITHUB_ENV"
+          fi
+          if [[ -n "${GITEA_ENV:-}" ]]; then
+            echo "DOCKER_IMAGE=${DOCKER_IMAGE}" >> "$GITEA_ENV"
+          fi
+
+          mkdir -p ~/.ssh
+          chmod 700 ~/.ssh
+
+          # 从 Secrets 写入私钥（推荐使用 *_SSH_KEY_B64）
+          SSH_KEY_PATH="${HOME}/.ssh/id_rsa"
+          if [[ -n "${SSH_KEY_B64:-}" ]]; then
+            # 兼容两种常见误配置：
+            # 1) *_SSH_KEY_B64 里其实粘贴的是“原始私钥”（包含 -----BEGIN ... PRIVATE KEY-----）
+            # 2) base64 值在粘贴/保存过程中混入空白或其他无关字符
+            if printf '%s' "${SSH_KEY_B64}" | grep -qE 'BEGIN[[:space:]].*PRIVATE[[:space:]]KEY'; then
+              echo "提示：检测到 *_SSH_KEY_B64 看起来是原始私钥内容，将按原始私钥写入（建议你改用真正的 base64 单行值）。"
+              echo "SSH_KEY_B64 字符数（原始）：${#SSH_KEY_B64}"
+              printf '%s' "${SSH_KEY_B64}" | tr -d '\r' > "${SSH_KEY_PATH}"
+            else
+              CLEAN_B64="$(printf '%s' "${SSH_KEY_B64}" | tr -d '\r\n\t ')"
+              echo "SSH_KEY_B64 字符数（原始/清理后）：${#SSH_KEY_B64}/${#CLEAN_B64}"
+              if ! printf '%s' "${CLEAN_B64}" | base64 -d -i | tr -d '\r' > "${SSH_KEY_PATH}"; then
+                echo "私钥 base64 解码失败："
+                echo "- 请确认你在 Gitea Secrets 配置的 *_SSH_KEY_B64 是“单行 base64 字符串”，不要带引号/前后空格。"
+                echo "- 推荐用仓库里的脚本生成并复制：node scripts/ssh-key-to-b64.mjs ~/.ssh/你的私钥 --clipboard"
+                exit 1
+              fi
+            fi
+          else
+            echo "使用 SSH_KEY（原始私钥）写入。SSH_KEY 字符数：${#SSH_KEY}"
+            printf '%s' "${SSH_KEY}" | tr -d '\r' > "${SSH_KEY_PATH}"
+          fi
+          chmod 600 "${SSH_KEY_PATH}"
+
+          # 自检（不输出私钥内容，仅输出元信息，方便定位是否写入了错误文件/被截断）
+          echo "SSH_KEY_PATH=${SSH_KEY_PATH}"
+          KEY_BYTES="$(wc -c < "${SSH_KEY_PATH}" | tr -d ' ')"
+          KEY_LINES="$(wc -l < "${SSH_KEY_PATH}" | tr -d ' ')"
+          echo "SSH key 字节数：${KEY_BYTES}"
+          echo "SSH key 行数：${KEY_LINES}"
+          echo "SSH key 首行：$(head -n 1 "${SSH_KEY_PATH}" | tr -d '\r')"
+          echo "SSH key 末行：$(tail -n 1 "${SSH_KEY_PATH}" | tr -d '\r')"
+          if command -v stat >/dev/null 2>&1; then
+            # Ubuntu runner: stat -c；不同系统做兼容
+            if stat -c '%a %U %G %n' "${SSH_KEY_PATH}" >/dev/null 2>&1; then
+              echo "SSH key 权限：$(stat -c '%a %U %G %n' "${SSH_KEY_PATH}")"
+            else
+              echo "SSH key 权限：$(stat -f '%Lp %Su %Sg %N' "${SSH_KEY_PATH}" 2>/dev/null || true)"
+            fi
+          fi
+          if command -v file >/dev/null 2>&1; then
+            echo "file(1) 识别：$(file "${SSH_KEY_PATH}")"
+          fi
+          if command -v sha256sum >/dev/null 2>&1; then
+            echo "SSH key sha256(前12位)：$(sha256sum "${SSH_KEY_PATH}" | awk '{print substr($1,1,12)}')"
+          fi
+          echo "ssh 版本：$(ssh -V 2>&1 || true)"
+          echo "ssh-keygen 版本：$(ssh-keygen -V 2>&1 || true)"
+          echo "openssl 版本：$(openssl version 2>&1 || true)"
+
+          # 进一步校验：OpenSSH 私钥中间的 base64 块是否可解码（不输出内容）
+          if grep -q '^-----BEGIN OPENSSH PRIVATE KEY-----$' "${SSH_KEY_PATH}" && grep -q '^-----END OPENSSH PRIVATE KEY-----$' "${SSH_KEY_PATH}"; then
+            # 注意：不要用变量名 in（是 awk 关键字，部分实现会报语法错）
+            OPENSSH_B64_LEN="$(
+              awk '
+                BEGIN{in_block=0; n=0}
+                /^-----BEGIN OPENSSH PRIVATE KEY-----$/{in_block=1; next}
+                /^-----END OPENSSH PRIVATE KEY-----$/{in_block=0; exit}
+                in_block==1{gsub(/\r/,""); n+=length($0)}
+                END{print n}
+              ' "${SSH_KEY_PATH}" 2>/dev/null || true
+            )"
+            if [[ -n "${OPENSSH_B64_LEN:-}" ]]; then
+              echo "OpenSSH base64 块字符数（合计）：${OPENSSH_B64_LEN}"
+            fi
+
+            # 该校验仅用于提示，不应阻断部署流程
+            if ! awk '
+              BEGIN{in_block=0}
+              /^-----BEGIN OPENSSH PRIVATE KEY-----$/{in_block=1; next}
+              /^-----END OPENSSH PRIVATE KEY-----$/{in_block=0; exit}
+              in_block==1{gsub(/\r/,""); print}
+            ' "${SSH_KEY_PATH}" 2>/dev/null | tr -d '\n' | base64 -d >/dev/null 2>&1; then
+              echo "提示：OpenSSH 私钥的 base64 块无法解码（疑似内容被截断/损坏），将继续执行 ssh-keygen 校验定位。"
+            fi
+          fi
+
+          # 额外信息：ssh-keygen -lf 的报错（不输出私钥内容）
+          if ! ssh-keygen -lf "${SSH_KEY_PATH}" >/dev/null 2>~/.ssh/ssh_key_fingerprint.err; then
+            echo "ssh-keygen -lf 报错："
+            cat ~/.ssh/ssh_key_fingerprint.err || true
+          fi
+
+          # 快速校验私钥是否可解析（不会输出私钥内容）
+          if ! ssh-keygen -y -f "${SSH_KEY_PATH}" >/dev/null 2>~/.ssh/ssh_key_check.err; then
+            echo "SSH 私钥无法解析。下面是 ssh-keygen 的报错（不包含私钥内容）："
+            cat ~/.ssh/ssh_key_check.err || true
+            echo
+            echo "常见原因："
+            echo "- 你填的是公钥（.pub），不是私钥"
+            echo "- 私钥带口令（CI 无法交互输入 passphrase）"
+            echo "- 内容复制丢换行/被截断/不是正确的 base64"
+            echo
+            echo "推荐：生成一把“无口令”的部署专用私钥，并用 base64 存储到 Secrets（*_SSH_KEY_B64）。"
+            exit 1
+          fi
+
+          SSH_PORT="${SSH_PORT:-22}"
+          if [[ -n "${GITHUB_ENV:-}" ]]; then
+            echo "SSH_PORT=${SSH_PORT}" >> "$GITHUB_ENV"
+          fi
+          if [[ -n "${GITEA_ENV:-}" ]]; then
+            echo "SSH_PORT=${SSH_PORT}" >> "$GITEA_ENV"
+          fi
+
+          # 预写 known_hosts，避免交互
+          ssh-keyscan -p "${SSH_PORT}" -H "${SSH_HOST}" >> ~/.ssh/known_hosts 2>/dev/null
+
+      - name: 验证 SSH 连接（快速定位公钥/用户/端口问题）
+        shell: bash
+        run: |
+          set -euo pipefail
+          SSH_PORT="${SSH_PORT:-22}"
+          ssh -p "${SSH_PORT}" \
+            -i ~/.ssh/id_rsa \
+            -o StrictHostKeyChecking=yes \
+            -o BatchMode=yes \
+            -o IdentitiesOnly=yes \
+            "${SSH_USER}@${SSH_HOST}" 'echo "SSH_OK $(whoami)@$(hostname)"'
+
+      - name: 远程登录 Docker Registry（如需私有镜像）
+        shell: bash
+        env:
+          DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
+          DOCKER_TOKEN: ${{ secrets.DOCKER_TOKEN }}
+        run: |
+          set -euo pipefail
+
+          # 如果镜像是公开的，可不配 DOCKER_USERNAME/DOCKER_TOKEN；此步骤会自动跳过
+          if [[ -z "${DOCKER_USERNAME:-}" || -z "${DOCKER_TOKEN:-}" ]]; then
+            echo "未配置 DOCKER_USERNAME/DOCKER_TOKEN，跳过远程 docker login。"
+            exit 0
+          fi
+
+          SSH_PORT="${SSH_PORT:-22}"
+
+          # 推断 registry：优先使用 DOCKER_REGISTRY；否则从 DOCKER_IMAGE 的第一个段推断
+          REG="${DOCKER_REGISTRY:-}"
+          if [[ -z "${REG}" ]]; then
+            FIRST_SEG="${DOCKER_IMAGE%%/*}"
+            if [[ "${FIRST_SEG}" == *.* || "${FIRST_SEG}" == *:* || "${FIRST_SEG}" == "localhost" ]]; then
+              REG="${FIRST_SEG}"
+            fi
+          fi
+          if [[ -z "${REG}" ]]; then
+            echo "无法推断 registry（看起来像 Docker Hub 公有镜像），跳过 docker login。"
+            exit 0
+          fi
+
+          ssh -p "${SSH_PORT}" -i ~/.ssh/id_rsa -o StrictHostKeyChecking=yes -o IdentitiesOnly=yes \
+            "${SSH_USER}@${SSH_HOST}" bash -s -- "${DOCKER_TOKEN}" "${DOCKER_USERNAME}" "${REG}" <<'REMOTE'
+          set -euo pipefail
+
+          TOKEN="$1"
+          USERNAME="$2"
+          REGISTRY="$3"
+
+          SUDO=""
+          if [[ "$(id -u)" -ne 0 ]] && command -v sudo >/dev/null 2>&1; then
+            SUDO="sudo"
+          fi
+
+          printf '%s' "$TOKEN" | ${SUDO} docker login "${REGISTRY}" -u "$USERNAME" --password-stdin
+          REMOTE
+
+      - name: SSH 部署（Nginx 蓝绿切换）
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          SSH_PORT="${SSH_PORT:-22}"
+          NGINX_UPSTREAM_NAME="${NGINX_UPSTREAM_NAME:-mindfulness_backend}"
+          NGINX_UPSTREAM_FILE="${NGINX_UPSTREAM_FILE:-/etc/nginx/conf.d/api.damer.fun.conf}"
+          BLUE_PORT="${BLUE_PORT:-8001}"
+          GREEN_PORT="${GREEN_PORT:-8002}"
+          CONTAINER_PORT="${CONTAINER_PORT:-8000}"
+          HEALTHCHECK_PATH="${HEALTHCHECK_PATH:-/health}"
+
+          echo "准备部署：${DOCKER_IMAGE}:${DEPLOY_TAG} -> ${DEPLOY_ENV} (${SSH_USER}@${SSH_HOST}:${SSH_PORT})"
+
+          ssh -p "${SSH_PORT}" -i ~/.ssh/id_rsa -o StrictHostKeyChecking=yes -o IdentitiesOnly=yes "${SSH_USER}@${SSH_HOST}" bash -s -- \
+            "${DOCKER_IMAGE}" "${DEPLOY_TAG}" "${NGINX_UPSTREAM_FILE}" "${NGINX_UPSTREAM_NAME}" "${BLUE_PORT}" "${GREEN_PORT}" "${CONTAINER_PORT}" "${HEALTHCHECK_PATH}" "${REMOTE_ENV_FILE:-}" <<'REMOTE'
+          set -euo pipefail
+
+          IMAGE="$1"
+          TAG="$2"
+          UPSTREAM_FILE="$3"
+          UPSTREAM_NAME="$4"
+          BLUE_PORT="$5"
+          GREEN_PORT="$6"
+          CONTAINER_PORT="$7"
+          HEALTHCHECK_PATH="$8"
+          REMOTE_ENV_FILE="$9"
+
+          APP_DIR="/opt/mindfulness-server"
+          ACTIVE_FILE="${APP_DIR}/active_color"
+          mkdir -p "${APP_DIR}"
+
+          # 判断 sudo（如果非 root 且存在 sudo，则使用 sudo）
+          SUDO=""
+          if [[ "$(id -u)" -ne 0 ]] && command -v sudo >/dev/null 2>&1; then
+            SUDO="sudo"
+          fi
+
+          ACTIVE_COLOR="blue"
+          if [[ -f "${ACTIVE_FILE}" ]]; then
+            ACTIVE_COLOR="$(cat "${ACTIVE_FILE}" || echo blue)"
+          fi
+
+          if [[ "${ACTIVE_COLOR}" == "blue" ]]; then
+            NEW_COLOR="green"
+            NEW_PORT="${GREEN_PORT}"
+            OLD_COLOR="blue"
+            OLD_PORT="${BLUE_PORT}"
+          else
+            NEW_COLOR="blue"
+            NEW_PORT="${BLUE_PORT}"
+            OLD_COLOR="green"
+            OLD_PORT="${GREEN_PORT}"
+          fi
+
+          echo "当前在线：${ACTIVE_COLOR}（${OLD_PORT}），准备发布：${NEW_COLOR}（${NEW_PORT}）"
+
+          # 拉取镜像
+          ${SUDO} docker pull "${IMAGE}:${TAG}"
+
+          # 启动新颜色容器
+          ${SUDO} docker rm -f "mindfulness-server-${NEW_COLOR}" >/dev/null 2>&1 || true
+
+          ENV_FILE_ARGS=()
+          if [[ -n "${REMOTE_ENV_FILE}" && -f "${REMOTE_ENV_FILE}" ]]; then
+            ENV_FILE_ARGS=(--env-file "${REMOTE_ENV_FILE}")
+            echo "将使用远端 env 文件：${REMOTE_ENV_FILE}"
+          elif [[ -n "${REMOTE_ENV_FILE}" ]]; then
+            echo "提示：REMOTE_ENV_FILE 已配置但文件不存在：${REMOTE_ENV_FILE}（将忽略 env-file）"
+          fi
+
+          ${SUDO} docker run -d \
+            --name "mindfulness-server-${NEW_COLOR}" \
+            --restart=always \
+            -p "${NEW_PORT}:${CONTAINER_PORT}" \
+            "${ENV_FILE_ARGS[@]}" \
+            "${IMAGE}:${TAG}"
+
+          # 健康检查
+          if [[ "${HEALTHCHECK_PATH}" != /* ]]; then
+            HEALTHCHECK_PATH="/${HEALTHCHECK_PATH}"
+          fi
+          HEALTH_URL="http://127.0.0.1:${NEW_PORT}${HEALTHCHECK_PATH}"
+          echo "健康检查：${HEALTH_URL}"
+
+          for i in $(seq 1 30); do
+            if command -v curl >/dev/null 2>&1; then
+              if curl -fsS "${HEALTH_URL}" >/dev/null; then
+                echo "健康检查通过"
+                break
+              fi
+            elif command -v wget >/dev/null 2>&1; then
+              if wget -q -O /dev/null "${HEALTH_URL}"; then
+                echo "健康检查通过"
+                break
+              fi
+            else
+              echo "远端缺少 curl/wget，跳过 HTTP 健康检查"
+              break
+            fi
+
+            if [[ "$i" -eq 30 ]]; then
+              echo "健康检查失败：新版本未就绪，回滚并退出"
+              ${SUDO} docker logs --tail 200 "mindfulness-server-${NEW_COLOR}" || true
+              ${SUDO} docker rm -f "mindfulness-server-${NEW_COLOR}" || true
+              exit 1
+            fi
+            sleep 2
+          done
+
+          # 切换 Nginx upstream（在同一个 conf 文件中通过 backup 做主备切换）
+          if [[ ! -f "${UPSTREAM_FILE}" ]]; then
+            echo "未找到 Nginx upstream 配置文件：${UPSTREAM_FILE}"
+            ${SUDO} docker rm -f "mindfulness-server-${NEW_COLOR}" || true
+            exit 1
+          fi
+
+          if ! ${SUDO} grep -qE "upstream[[:space:]]+${UPSTREAM_NAME}[[:space:]]*\\{" "${UPSTREAM_FILE}"; then
+            echo "在 ${UPSTREAM_FILE} 中未找到 upstream：${UPSTREAM_NAME}"
+            ${SUDO} docker rm -f "mindfulness-server-${NEW_COLOR}" || true
+            exit 1
+          fi
+
+          if ! ${SUDO} grep -qE "server[[:space:]]+127\\.0\\.0\\.1:${BLUE_PORT}" "${UPSTREAM_FILE}"; then
+            echo "在 ${UPSTREAM_FILE} 中未找到 server 127.0.0.1:${BLUE_PORT}（请先按参考配置写入 upstream）"
+            ${SUDO} docker rm -f "mindfulness-server-${NEW_COLOR}" || true
+            exit 1
+          fi
+          if ! ${SUDO} grep -qE "server[[:space:]]+127\\.0\\.0\\.1:${GREEN_PORT}" "${UPSTREAM_FILE}"; then
+            echo "在 ${UPSTREAM_FILE} 中未找到 server 127.0.0.1:${GREEN_PORT}（请先按参考配置写入 upstream）"
+            ${SUDO} docker rm -f "mindfulness-server-${NEW_COLOR}" || true
+            exit 1
+          fi
+
+          # 备份（回滚用）
+          BACKUP_FILE="${UPSTREAM_FILE}.bak.$(date +%s)"
+          ${SUDO} cp -f "${UPSTREAM_FILE}" "${BACKUP_FILE}"
+
+          echo "切换 upstream：${UPSTREAM_NAME}（${OLD_PORT} -> ${NEW_PORT}）通过 backup 切换"
+
+          TMP_FILE="$(mktemp)"
+          ${SUDO} awk -v name="${UPSTREAM_NAME}" -v old="${OLD_PORT}" -v new="${NEW_PORT}" '
+            BEGIN { in_up = 0 }
+            $0 ~ ("^[[:space:]]*upstream[[:space:]]+" name "[[:space:]]*\\{[[:space:]]*$") { in_up = 1 }
+            in_up == 1 {
+              # 新端口：主（去掉 backup）
+              if ($0 ~ ("server[[:space:]]+127\\.0\\.0\\.1:" new)) {
+                gsub(/[[:space:]]+backup[[:space:]]*;/, ";")
+              }
+              # 旧端口：备（确保有 backup;）
+              if ($0 ~ ("server[[:space:]]+127\\.0\\.0\\.1:" old)) {
+                gsub(/[[:space:]]+backup[[:space:]]*;/, ";")
+                sub(/;[[:space:]]*$/, " backup;")
+              }
+            }
+            in_up == 1 && $0 ~ /^[[:space:]]*\}[[:space:]]*$/ { in_up = 0 }
+            { print }
+          ' "${UPSTREAM_FILE}" > "${TMP_FILE}"
+
+          ${SUDO} cp -f "${TMP_FILE}" "${UPSTREAM_FILE}"
+          rm -f "${TMP_FILE}"
+
+          # 校验并 reload nginx（失败则回滚并退出）
+          if ${SUDO} nginx -t; then
+            ${SUDO} nginx -s reload
+          else
+            echo "Nginx 配置校验失败，回滚 upstream 配置并退出"
+            ${SUDO} cp -f "${BACKUP_FILE}" "${UPSTREAM_FILE}" || true
+            ${SUDO} nginx -t && ${SUDO} nginx -s reload || true
+            ${SUDO} docker rm -f "mindfulness-server-${NEW_COLOR}" || true
+            exit 1
+          fi
+
+          # 记录当前在线颜色
+          echo "${NEW_COLOR}" | ${SUDO} tee "${ACTIVE_FILE}" >/dev/null
+
+          # 下线旧容器（切流后再停旧的）
+          ${SUDO} docker rm -f "mindfulness-server-${OLD_COLOR}" >/dev/null 2>&1 || true
+
+          echo "部署完成：${NEW_COLOR} 已上线"
+          REMOTE
+

README.md

@@ -13,7 +13,9 @@ git pull
 
 # 创建自己的分支
 git checkout -b 姓名拼写
+# 生产密钥
 
+ssh-keygen -t rsa -b 4096 -m PEM -N '' -f deploy_key_rsa
 # 目录结构
 
 /mindfulness

client/app.json

@@ -15,7 +15,7 @@
     },
     "ios": {
       "supportsTablet": true,
-      "bundleIdentifier": "com.anonymous.client"
+      "bundleIdentifier": "com.damer.mindfulness"
     },
     "android": {
       "adaptiveIcon": {

client/ios/Podfile

@@ -59,5 +59,13 @@ target 'client' do
       :mac_catalyst_enabled => false,
       :ccache_enabled => ccache_enabled?(podfile_properties),
     )
+
+    # 生成并随归档产物携带 dSYM（用于崩溃符号化与 Upload Symbols Failed 修复）
+    installer.pods_project.targets.each do |target|
+      target.build_configurations.each do |build_config|
+        build_config.build_settings['DEBUG_INFORMATION_FORMAT'] = 'dwarf-with-dsym'
+        build_config.build_settings['DWARF_DSYM_FILE_SHOULD_ACCOMPANY_PRODUCT'] = 'YES'
+      end
+    end
   end
 end

client/ios/Podfile.lock

@@ -2397,6 +2397,6 @@ SPEC CHECKSUMS:
   RNWorklets: 9ccdc8112b17af6eee2c85a233891cb80db150ad
   Yoga: 5934998fbeaef7845dbf698f698518695ab4cd1a
 
-PODFILE CHECKSUM: dfe3cc75dee014a0abd367bc9e1bdbab0ba64ee3
+PODFILE CHECKSUM: 4d5c52f9fa870c1d398cf59e37c149f66700c061
 
 COCOAPODS: 1.16.2

client/ios/client.xcodeproj/project.pbxproj

@@ -3,7 +3,7 @@
 	archiveVersion = 1;
 	classes = {
 	};
-	objectVersion = 56;
+	objectVersion = 70;
 	objects = {
 
 /* Begin PBXBuildFile section */
@@ -11,7 +11,7 @@
 		13B07FBF1A68108700A75B9A /* Images.xcassets in Resources */ = {isa = PBXBuildFile; fileRef = 13B07FB51A68108700A75B9A /* Images.xcassets */; };
 		1A1DE01D4133812B2E2BA692 /* libPods-client.a in Frameworks */ = {isa = PBXBuildFile; fileRef = E3328F0E595C1F4A244DF238 /* libPods-client.a */; };
 		3E461D99554A48A4959DE609 /* SplashScreen.storyboard in Resources */ = {isa = PBXBuildFile; fileRef = AA286B85B6C04FC6940260E9 /* SplashScreen.storyboard */; };
-		A1B2C3D4E5F60718293A4B5C /* EmotionWidget.swift in Sources */ = {isa = PBXBuildFile; fileRef = A1B2C3D4E5F60718293A4B5B /* EmotionWidget.swift */; };
+		A1B2C3D4E5F60718293A4B5C /* 情绪小组件/EmotionWidget.swift in Sources */ = {isa = PBXBuildFile; fileRef = A1B2C3D4E5F60718293A4B5B /* 情绪小组件/EmotionWidget.swift */; };
 		B5A7FE9A125F7C79753EC5BF /* ExpoModulesProvider.swift in Sources */ = {isa = PBXBuildFile; fileRef = C7DB40C26E3A46F6D06769EA /* ExpoModulesProvider.swift */; };
 		BB2F792D24A3F905000567C9 /* Expo.plist in Resources */ = {isa = PBXBuildFile; fileRef = BB2F792C24A3F905000567C9 /* Expo.plist */; };
 		EB3DAF812F2A4B8E00450593 /* WidgetKit.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = EB3DAF802F2A4B8D00450593 /* WidgetKit.framework */; };
@@ -50,7 +50,7 @@
 		13B07FB61A68108700A75B9A /* Info.plist */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.plist.xml; name = Info.plist; path = client/Info.plist; sourceTree = "<group>"; };
 		3C76CA16D0801CBF0D731C7C /* Pods-client.release.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; name = "Pods-client.release.xcconfig"; path = "Target Support Files/Pods-client/Pods-client.release.xcconfig"; sourceTree = "<group>"; };
 		75F52ADE07CAE9D9736D7671 /* PrivacyInfo.xcprivacy */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xml; name = PrivacyInfo.xcprivacy; path = client/PrivacyInfo.xcprivacy; sourceTree = "<group>"; };
-		A1B2C3D4E5F60718293A4B5B /* EmotionWidget.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = "情绪小组件/EmotionWidget.swift"; sourceTree = "<group>"; };
+		A1B2C3D4E5F60718293A4B5B /* 情绪小组件/EmotionWidget.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = "情绪小组件/EmotionWidget.swift"; sourceTree = "<group>"; };
 		AA286B85B6C04FC6940260E9 /* SplashScreen.storyboard */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = file.storyboard; name = SplashScreen.storyboard; path = client/SplashScreen.storyboard; sourceTree = "<group>"; };
 		BB2F792C24A3F905000567C9 /* Expo.plist */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.plist.xml; path = Expo.plist; sourceTree = "<group>"; };
 		C7DB40C26E3A46F6D06769EA /* ExpoModulesProvider.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = ExpoModulesProvider.swift; path = "Pods/Target Support Files/Pods-client/ExpoModulesProvider.swift"; sourceTree = "<group>"; };
@@ -66,7 +66,7 @@
 /* End PBXFileReference section */
 
 /* Begin PBXFileSystemSynchronizedBuildFileExceptionSet section */
-		EB3DAF952F2A4B8F00450593 /* Exceptions for "情绪小组件" folder in "情绪小组件Extension" target */ = {
+		EB3DAF952F2A4B8F00450593 /* PBXFileSystemSynchronizedBuildFileExceptionSet */ = {
 			isa = PBXFileSystemSynchronizedBuildFileExceptionSet;
 			membershipExceptions = (
 				EmotionWidget.swift,
@@ -77,18 +77,7 @@
 /* End PBXFileSystemSynchronizedBuildFileExceptionSet section */
 
 /* Begin PBXFileSystemSynchronizedRootGroup section */
-		EB3DAF842F2A4B8E00450593 /* 情绪小组件 */ = {
-			isa = PBXFileSystemSynchronizedRootGroup;
-			exceptions = (
-				EB3DAF952F2A4B8F00450593 /* Exceptions for "情绪小组件" folder in "情绪小组件Extension" target */,
-			);
-			explicitFileTypes = {
-			};
-			explicitFolders = (
-			);
-			path = "情绪小组件";
-			sourceTree = "<group>";
-		};
+		EB3DAF842F2A4B8E00450593 /* 情绪小组件 */ = {isa = PBXFileSystemSynchronizedRootGroup; exceptions = (EB3DAF952F2A4B8F00450593 /* PBXFileSystemSynchronizedBuildFileExceptionSet */, ); explicitFileTypes = {}; explicitFolders = (); path = "情绪小组件"; sourceTree = "<group>"; };
 /* End PBXFileSystemSynchronizedRootGroup section */
 
 /* Begin PBXFrameworksBuildPhase section */
@@ -200,7 +189,7 @@
 		EB3DAFD42F2A5FC100450593 /* Recovered References */ = {
 			isa = PBXGroup;
 			children = (
-				A1B2C3D4E5F60718293A4B5B /* EmotionWidget.swift */,
+				A1B2C3D4E5F60718293A4B5B /* 情绪小组件/EmotionWidget.swift */,
 			);
 			name = "Recovered References";
 			sourceTree = "<group>";
@@ -455,7 +444,7 @@
 			isa = PBXSourcesBuildPhase;
 			buildActionMask = 2147483647;
 			files = (
-				A1B2C3D4E5F60718293A4B5C /* EmotionWidget.swift in Sources */,
+				A1B2C3D4E5F60718293A4B5C /* 情绪小组件/EmotionWidget.swift in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -475,9 +464,11 @@
 			baseConfigurationReference = FFF632A94C7A551AAA096858 /* Pods-client.debug.xcconfig */;
 			buildSettings = {
 				ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
+				ASSETCATALOG_COMPILER_INCLUDE_ALL_APPICON_ASSETS = YES;
 				CLANG_ENABLE_MODULES = YES;
 				CODE_SIGN_ENTITLEMENTS = client/client.entitlements;
-				CURRENT_PROJECT_VERSION = 1;
+				CURRENT_PROJECT_VERSION = 2;
+				DEVELOPMENT_TEAM = WS92GPX9H2;
 				ENABLE_BITCODE = NO;
 				GCC_PREPROCESSOR_DEFINITIONS = (
 					"$(inherited)",
@@ -489,14 +480,14 @@
 					"$(inherited)",
 					"@executable_path/Frameworks",
 				);
-				MARKETING_VERSION = 1.0;
+				MARKETING_VERSION = 1.0.0;
 				OTHER_LDFLAGS = (
 					"$(inherited)",
 					"-ObjC",
 					"-lc++",
 				);
 				OTHER_SWIFT_FLAGS = "$(inherited) -D EXPO_CONFIGURATION_DEBUG";
-				PRODUCT_BUNDLE_IDENTIFIER = com.anonymous.client;
+				PRODUCT_BUNDLE_IDENTIFIER = com.damer.mindfulness;
 				PRODUCT_NAME = client;
 				SUPPORTED_PLATFORMS = "iphoneos iphonesimulator";
 				SUPPORTS_MACCATALYST = NO;
@@ -505,7 +496,7 @@
 				SWIFT_OBJC_BRIDGING_HEADER = "client/client-Bridging-Header.h";
 				SWIFT_OPTIMIZATION_LEVEL = "-Onone";
 				SWIFT_VERSION = 5.0;
-				TARGETED_DEVICE_FAMILY = "1,2";
+				TARGETED_DEVICE_FAMILY = 1;
 				VERSIONING_SYSTEM = "apple-generic";
 			};
 			name = Debug;
@@ -515,23 +506,27 @@
 			baseConfigurationReference = 3C76CA16D0801CBF0D731C7C /* Pods-client.release.xcconfig */;
 			buildSettings = {
 				ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
+				ASSETCATALOG_COMPILER_INCLUDE_ALL_APPICON_ASSETS = YES;
 				CLANG_ENABLE_MODULES = YES;
 				CODE_SIGN_ENTITLEMENTS = client/client.entitlements;
-				CURRENT_PROJECT_VERSION = 1;
+				CURRENT_PROJECT_VERSION = 2;
+				DEBUG_INFORMATION_FORMAT = "dwarf-with-dsym";
+				DEVELOPMENT_TEAM = WS92GPX9H2;
+				DWARF_DSYM_FILE_SHOULD_ACCOMPANY_PRODUCT = YES;
 				INFOPLIST_FILE = client/Info.plist;
 				IPHONEOS_DEPLOYMENT_TARGET = 15.1;
 				LD_RUNPATH_SEARCH_PATHS = (
 					"$(inherited)",
 					"@executable_path/Frameworks",
 				);
-				MARKETING_VERSION = 1.0;
+				MARKETING_VERSION = 1.0.0;
 				OTHER_LDFLAGS = (
 					"$(inherited)",
 					"-ObjC",
 					"-lc++",
 				);
 				OTHER_SWIFT_FLAGS = "$(inherited) -D EXPO_CONFIGURATION_RELEASE";
-				PRODUCT_BUNDLE_IDENTIFIER = com.anonymous.client;
+				PRODUCT_BUNDLE_IDENTIFIER = com.damer.mindfulness;
 				PRODUCT_NAME = client;
 				SUPPORTED_PLATFORMS = "iphoneos iphonesimulator";
 				SUPPORTS_MACCATALYST = NO;
@@ -539,7 +534,7 @@
 				SUPPORTS_XR_DESIGNED_FOR_IPHONE_IPAD = NO;
 				SWIFT_OBJC_BRIDGING_HEADER = "client/client-Bridging-Header.h";
 				SWIFT_VERSION = 5.0;
-				TARGETED_DEVICE_FAMILY = "1,2";
+				TARGETED_DEVICE_FAMILY = 1;
 				VERSIONING_SYSTEM = "apple-generic";
 			};
 			name = Release;
@@ -676,8 +671,9 @@
 				CLANG_WARN_QUOTED_INCLUDE_IN_FRAMEWORK_HEADER = YES;
 				CLANG_WARN_UNGUARDED_AVAILABILITY = YES_AGGRESSIVE;
 				CODE_SIGN_STYLE = Automatic;
-				CURRENT_PROJECT_VERSION = 1;
+				CURRENT_PROJECT_VERSION = 2;
 				DEBUG_INFORMATION_FORMAT = dwarf;
+				DEVELOPMENT_TEAM = WS92GPX9H2;
 				ENABLE_USER_SCRIPT_SANDBOXING = YES;
 				GCC_C_LANGUAGE_STANDARD = gnu17;
 				GENERATE_INFOPLIST_FILE = YES;
@@ -695,7 +691,7 @@
 				MTL_ENABLE_DEBUG_INFO = INCLUDE_SOURCE;
 				MTL_FAST_MATH = YES;
 				OTHER_SWIFT_FLAGS = "$(inherited) -D EXPO_CONFIGURATION_DEBUG";
-				PRODUCT_BUNDLE_IDENTIFIER = com.anonymous.client.emotionwidget;
+				PRODUCT_BUNDLE_IDENTIFIER = com.damer.mindfulness.emotionwidget;
 				PRODUCT_NAME = "$(TARGET_NAME)";
 				SKIP_INSTALL = YES;
 				STRING_CATALOG_GENERATE_SYMBOLS = YES;
@@ -709,7 +705,7 @@
 				SWIFT_OPTIMIZATION_LEVEL = "-Onone";
 				SWIFT_UPCOMING_FEATURE_MEMBER_IMPORT_VISIBILITY = YES;
 				SWIFT_VERSION = 5.0;
-				TARGETED_DEVICE_FAMILY = "1,2";
+				TARGETED_DEVICE_FAMILY = 1;
 			};
 			name = Debug;
 		};
@@ -728,8 +724,9 @@
 				CLANG_WARN_UNGUARDED_AVAILABILITY = YES_AGGRESSIVE;
 				CODE_SIGN_STYLE = Automatic;
 				COPY_PHASE_STRIP = NO;
-				CURRENT_PROJECT_VERSION = 1;
+				CURRENT_PROJECT_VERSION = 2;
 				DEBUG_INFORMATION_FORMAT = "dwarf-with-dsym";
+				DEVELOPMENT_TEAM = WS92GPX9H2;
 				ENABLE_USER_SCRIPT_SANDBOXING = YES;
 				GCC_C_LANGUAGE_STANDARD = gnu17;
 				GENERATE_INFOPLIST_FILE = YES;
@@ -746,7 +743,7 @@
 				MARKETING_VERSION = 1.0.0;
 				MTL_FAST_MATH = YES;
 				OTHER_SWIFT_FLAGS = "$(inherited) -D EXPO_CONFIGURATION_RELEASE";
-				PRODUCT_BUNDLE_IDENTIFIER = com.anonymous.client.emotionwidget;
+				PRODUCT_BUNDLE_IDENTIFIER = com.damer.mindfulness.emotionwidget;
 				PRODUCT_NAME = "$(TARGET_NAME)";
 				SKIP_INSTALL = YES;
 				STRING_CATALOG_GENERATE_SYMBOLS = YES;
@@ -759,7 +756,7 @@
 				SWIFT_EMIT_LOC_STRINGS = YES;
 				SWIFT_UPCOMING_FEATURE_MEMBER_IMPORT_VISIBILITY = YES;
 				SWIFT_VERSION = 5.0;
-				TARGETED_DEVICE_FAMILY = "1,2";
+				TARGETED_DEVICE_FAMILY = 1;
 			};
 			name = Release;
 		};

client/ios/client/Info.plist

@@ -1,81 +1,81 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
-  <dict>
-    <key>CADisableMinimumFrameDurationOnPhone</key>
-    <true/>
-    <key>CFBundleDevelopmentRegion</key>
-    <string>$(DEVELOPMENT_LANGUAGE)</string>
-    <key>CFBundleDisplayName</key>
-    <string>client</string>
-    <key>CFBundleExecutable</key>
-    <string>$(EXECUTABLE_NAME)</string>
-    <key>CFBundleIdentifier</key>
-    <string>$(PRODUCT_BUNDLE_IDENTIFIER)</string>
-    <key>CFBundleInfoDictionaryVersion</key>
-    <string>6.0</string>
-    <key>CFBundleName</key>
-    <string>$(PRODUCT_NAME)</string>
-    <key>CFBundlePackageType</key>
-    <string>$(PRODUCT_BUNDLE_PACKAGE_TYPE)</string>
-    <key>CFBundleShortVersionString</key>
-    <string>1.0.0</string>
-    <key>CFBundleSignature</key>
-    <string>????</string>
-    <key>CFBundleURLTypes</key>
-    <array>
-      <dict>
-        <key>CFBundleURLSchemes</key>
-        <array>
-          <string>client</string>
-          <string>com.anonymous.client</string>
-        </array>
-      </dict>
-    </array>
-    <key>CFBundleVersion</key>
-    <string>1</string>
-    <key>LSMinimumSystemVersion</key>
-    <string>12.0</string>
-    <key>LSRequiresIPhoneOS</key>
-    <true/>
-    <key>NSAppTransportSecurity</key>
-    <dict>
-      <key>NSAllowsArbitraryLoads</key>
-      <false/>
-      <key>NSAllowsLocalNetworking</key>
-      <true/>
-    </dict>
-    <key>NSUserActivityTypes</key>
-    <array>
-      <string>$(PRODUCT_BUNDLE_IDENTIFIER).expo.index_route</string>
-    </array>
-    <key>RCTNewArchEnabled</key>
-    <true/>
-    <key>UILaunchStoryboardName</key>
-    <string>SplashScreen</string>
-    <key>UIRequiredDeviceCapabilities</key>
-    <array>
-      <string>arm64</string>
-    </array>
-    <key>UIRequiresFullScreen</key>
-    <false/>
-    <key>UIStatusBarStyle</key>
-    <string>UIStatusBarStyleDefault</string>
-    <key>UISupportedInterfaceOrientations</key>
-    <array>
-      <string>UIInterfaceOrientationPortrait</string>
-      <string>UIInterfaceOrientationPortraitUpsideDown</string>
-    </array>
-    <key>UISupportedInterfaceOrientations~ipad</key>
-    <array>
-      <string>UIInterfaceOrientationPortrait</string>
-      <string>UIInterfaceOrientationPortraitUpsideDown</string>
-      <string>UIInterfaceOrientationLandscapeLeft</string>
-      <string>UIInterfaceOrientationLandscapeRight</string>
-    </array>
-    <key>UIUserInterfaceStyle</key>
-    <string>Automatic</string>
-    <key>UIViewControllerBasedStatusBarAppearance</key>
-    <false/>
-  </dict>
+<dict>
+	<key>CADisableMinimumFrameDurationOnPhone</key>
+	<true/>
+	<key>CFBundleDevelopmentRegion</key>
+	<string>$(DEVELOPMENT_LANGUAGE)</string>
+	<key>CFBundleDisplayName</key>
+	<string>client</string>
+	<key>CFBundleExecutable</key>
+	<string>$(EXECUTABLE_NAME)</string>
+	<key>CFBundleIdentifier</key>
+	<string>$(PRODUCT_BUNDLE_IDENTIFIER)</string>
+	<key>CFBundleInfoDictionaryVersion</key>
+	<string>6.0</string>
+	<key>CFBundleName</key>
+	<string>$(PRODUCT_NAME)</string>
+	<key>CFBundlePackageType</key>
+	<string>$(PRODUCT_BUNDLE_PACKAGE_TYPE)</string>
+	<key>CFBundleShortVersionString</key>
+	<string>$(MARKETING_VERSION)</string>
+	<key>CFBundleSignature</key>
+	<string>????</string>
+	<key>CFBundleURLTypes</key>
+	<array>
+		<dict>
+			<key>CFBundleURLSchemes</key>
+			<array>
+				<string>client</string>
+				<string>$(PRODUCT_BUNDLE_IDENTIFIER)</string>
+			</array>
+		</dict>
+	</array>
+	<key>CFBundleVersion</key>
+	<string>$(CURRENT_PROJECT_VERSION)</string>
+	<key>LSMinimumSystemVersion</key>
+	<string>12.0</string>
+	<key>LSRequiresIPhoneOS</key>
+	<true/>
+	<key>NSAppTransportSecurity</key>
+	<dict>
+		<key>NSAllowsArbitraryLoads</key>
+		<false/>
+		<key>NSAllowsLocalNetworking</key>
+		<true/>
+	</dict>
+	<key>NSUserActivityTypes</key>
+	<array>
+		<string>$(PRODUCT_BUNDLE_IDENTIFIER).expo.index_route</string>
+	</array>
+	<key>RCTNewArchEnabled</key>
+	<true/>
+	<key>UILaunchStoryboardName</key>
+	<string></string>
+	<key>UIRequiredDeviceCapabilities</key>
+	<array>
+		<string>arm64</string>
+	</array>
+	<key>UIRequiresFullScreen</key>
+	<false/>
+	<key>UIStatusBarStyle</key>
+	<string>UIStatusBarStyleDefault</string>
+	<key>UISupportedInterfaceOrientations</key>
+	<array>
+		<string>UIInterfaceOrientationPortrait</string>
+		<string>UIInterfaceOrientationPortraitUpsideDown</string>
+	</array>
+	<key>UISupportedInterfaceOrientations~ipad</key>
+	<array>
+		<string>UIInterfaceOrientationPortrait</string>
+		<string>UIInterfaceOrientationPortraitUpsideDown</string>
+		<string>UIInterfaceOrientationLandscapeLeft</string>
+		<string>UIInterfaceOrientationLandscapeRight</string>
+	</array>
+	<key>UIUserInterfaceStyle</key>
+	<string>Automatic</string>
+	<key>UIViewControllerBasedStatusBarAppearance</key>
+	<false/>
+</dict>
 </plist>

client/ios/client/client.entitlements

@@ -3,6 +3,6 @@
 <plist version="1.0">
   <dict>
     <key>aps-environment</key>
-    <string>development</string>
+    <string>production</string>
   </dict>
 </plist>

client/src/constants/env.ts

@@ -29,7 +29,7 @@ function getApiBaseUrl(env: AppRuntimeEnv): string {
   const direct = process.env.EXPO_PUBLIC_API_BASE_URL;
   if (direct && String(direct).trim()) return String(direct).trim();
 
-  // 约定：local/dev/prod 三套域名分别配置，便于后续直接切环境而不改代码
+  // 约定：local/dev/prod 三套域名分别配置， 便于后续直接切环境而不改代码
   if (env === 'local') {
     return getOptionalEnv('EXPO_PUBLIC_API_BASE_URL_LOCAL', 'http://localhost:8000');
   }

scripts/ssh-key-to-b64.mjs

@@ -0,0 +1,89 @@
+#!/usr/bin/env node
+/**
+ * 把 SSH 私钥转换为“单行 base64”，用于放入 Gitea Secrets（例如 DEV_SSH_KEY_B64）。
+ *
+ * 用法：
+ * 1) 从文件读取：
+ *    node scripts/ssh-key-to-b64.mjs ~/.ssh/deploy_key
+ *
+ * 2) 从 stdin 读取（直接粘贴私钥内容，结束后按 Ctrl+D）：
+ *    node scripts/ssh-key-to-b64.mjs -
+ *
+ * 3) 输出同时复制到剪贴板（仅 macOS，需系统自带 pbcopy）：
+ *    node scripts/ssh-key-to-b64.mjs ~/.ssh/deploy_key --clipboard
+ *
+ * 注意：
+ * - 请不要把输出写入仓库或提交到 git。
+ * - 工作流会优先使用 *_SSH_KEY_B64（更稳，避免多行换行丢失）。
+ */
+
+import fs from 'node:fs';
+import { spawnSync } from 'node:child_process';
+
+function printHelp() {
+  console.log(`用法：
+  node scripts/ssh-key-to-b64.mjs <私钥文件路径> [--clipboard] [--stdout]
+  node scripts/ssh-key-to-b64.mjs - [--clipboard] [--stdout]
+
+示例：
+  node scripts/ssh-key-to-b64.mjs ~/.ssh/deploy_key
+  node scripts/ssh-key-to-b64.mjs - --clipboard
+  node scripts/ssh-key-to-b64.mjs ~/.ssh/deploy_key --clipboard --stdout
+`);
+}
+
+const args = process.argv.slice(2);
+const clipboard = args.includes('--clipboard') || args.includes('-c');
+const forceStdout = args.includes('--stdout');
+const help = args.includes('--help') || args.includes('-h');
+const input = args.find((a) => !a.startsWith('-'));
+
+if (help || !input) {
+  printHelp();
+  process.exit(help ? 0 : 1);
+}
+
+function readAllStdin() {
+  return fs.readFileSync(0);
+}
+
+let buf;
+try {
+  if (input === '-') {
+    buf = readAllStdin();
+  } else {
+    buf = fs.readFileSync(input);
+  }
+} catch (e) {
+  console.error(`读取失败：${String(e?.message || e)}`);
+  process.exit(1);
+}
+
+// 重要：按“原始字节”做 base64，避免任何编码/换行处理导致私钥内容变化
+// 这样工作流解码后能 100% 还原原文件内容
+const asText = buf.toString('utf8');
+if (!asText.includes('BEGIN') || !asText.includes('PRIVATE KEY')) {
+  console.error('提示：输入内容看起来不像 SSH 私钥（未检测到 PRIVATE KEY 头部）。仍会继续转换，但请确认输入正确。');
+}
+
+const b64 = buf.toString('base64');
+
+if (clipboard) {
+  if (process.platform !== 'darwin') {
+    console.error('当前不是 macOS，无法使用 --clipboard（需要 pbcopy）。将仅输出到 stdout。');
+  } else {
+    const r = spawnSync('pbcopy', [], { input: b64, encoding: 'utf8' });
+    if (r.status !== 0) {
+      console.error(`复制到剪贴板失败：pbcopy 退出码=${r.status}`);
+    } else {
+      console.error('已复制到剪贴板：请粘贴到 Gitea Secrets（例如 DEV_SSH_KEY_B64）。');
+    }
+  }
+}
+
+// 默认：如果使用了 --clipboard，就不再把超长 base64 打到终端（避免影响后续命令输出）。
+// 如需同时打印，请加 --stdout。
+if (!clipboard || forceStdout || process.platform !== 'darwin') {
+  process.stdout.write(b64 + '\n');
+}
+

server/.dockerignore

@@ -0,0 +1,20 @@
+.venv
+__pycache__/
+*.pyc
+*.pyo
+*.pyd
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+
+# 本地/测试数据
+.test.db
+*.db
+
+# 测试与开发脚本（按需移除）
+tests/
+.env*
+
+# Git 元数据
+.git/
+.gitignore

server/Dockerfile

@@ -0,0 +1,32 @@
+FROM python:3.11-slim
+
+# 运行时基础环境
+ENV PYTHONDONTWRITEBYTECODE=1 \
+    PYTHONUNBUFFERED=1
+
+WORKDIR /app
+
+# 系统依赖（按需扩展；多数依赖为纯 Python）
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends build-essential curl \
+    && rm -rf /var/lib/apt/lists/*
+
+# 先复制依赖清单以利用 Docker layer cache
+COPY requirements.txt /app/requirements.txt
+RUN python -m pip install -U pip \
+    && pip install --no-cache-dir -r /app/requirements.txt
+
+# 复制后端代码与迁移配置
+COPY app /app/app
+COPY alembic /app/alembic
+COPY alembic.ini /app/alembic.ini
+
+EXPOSE 8000
+
+# 注意：
+# - 镜像内不会打包 `.env.dev/.env.prod`（避免把敏感信息烘焙进镜像）
+# - 运行容器时请通过 `--env-file` 或 `-e` 注入 DATABASE_URL / REDIS_URL / CELERY_BROKER_URL
+# - 参考文档：server/README.md
+
+# 生产镜像默认不开启 reload
+CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000"]

server/README.md

@@ -82,6 +82,11 @@ CELERY_BROKER_URL=redis://dev_user:devpassword@127.0.0.1:6379/0
 
 `.env.prod` 同理，替换为生产环境地址与密钥即可。
 
+补充：
+
+- 仓库内提供了一个不包含真实值的模板文件 `server/env.example`，可复制为 `.env.dev/.env.prod` 后再填写。
+- **Docker 不会自动读取 `.env.*`**，容器运行时需要通过 `--env-file` 或 `-e` 注入环境变量（见下方 Docker 运行）。
+
 ### 1.1 MySQL 命名与 dev/pro 区分（约定）
 
 - **生产库（prod）**：`mindfulness`
@@ -146,6 +151,38 @@ uvicorn app.main:app --host 0.0.0.0 --port 8000 --reload
 - OpenAPI 文档：`/docs`
 - ReDoc：`/redoc`
 
+## Docker 运行
+
+后端启动至少需要以下 3 个环境变量：
+
+- `DATABASE_URL`
+- `REDIS_URL`
+- `CELERY_BROKER_URL`
+
+### 方式 A：使用 env 文件（推荐）
+
+1) 在宿主机准备 `server/.env.prod`（或 `.env.dev`），内容为 `KEY=value`：
+
+- 可从 `server/env.example` 复制后填写
+
+2) 运行容器时通过 `--env-file` 注入：
+
+```bash
+docker run --rm -p 8000:8000 \
+  --env-file server/.env.prod \
+  mindfulness-server:latest
+```
+
+### 方式 B：直接用 -e 注入
+
+```bash
+docker run --rm -p 8000:8000 \
+  -e DATABASE_URL="mysql+aiomysql://用户名:密码@mysql:3306/mindfulness?charset=utf8mb4" \
+  -e REDIS_URL="redis://:密码@redis:6379/0" \
+  -e CELERY_BROKER_URL="redis://:密码@redis:6379/0" \
+  mindfulness-server:latest
+```
+
 ## 数据库迁移（Alembic）
 
 > 若你采用 Alembic：建议把迁移脚本放在 `server/alembic/`，并在 `alembic.ini` 中配置数据库连接（或从环境变量读取）。

server/app/core/config.py

@@ -4,6 +4,7 @@ from functools import lru_cache
 from pathlib import Path
 from typing import Literal, Optional
 
+from pydantic import ValidationError
 from pydantic_settings import BaseSettings, SettingsConfigDict
 
 
@@ -67,5 +68,41 @@ def get_settings() -> Settings:
     env = os.getenv("APP_ENV", "dev").strip() or "dev"
     env_file = _guess_env_file(env)
 
-    return Settings(_env_file=env_file)
+    try:
+        return Settings(_env_file=env_file)
+    except ValidationError as e:
+        # 给出更可执行的错误信息，避免只看到一串校验栈。
+        missing_fields: list[str] = []
+        for err in e.errors():
+            if err.get("type") == "missing":
+                loc = err.get("loc") or ()
+                if loc:
+                    missing_fields.append(str(loc[0]))
+
+        # 将字段名映射为常见的环境变量名（默认规则：字段名大写）
+        missing_env_keys = [f.upper() for f in missing_fields] if missing_fields else []
+
+        env_file_hint = env_file or f".env.{env}（未找到，已回退到系统环境变量）"
+        required_hint = (
+            "、".join(missing_env_keys)
+            if missing_env_keys
+            else "DATABASE_URL、REDIS_URL、CELERY_BROKER_URL"
+        )
+
+        msg = (
+            "应用启动失败：缺少必填配置。\n\n"
+            f"- 当前 APP_ENV：{env}\n"
+            f"- 期望读取的 env 文件：{env_file_hint}\n"
+            f"- 缺少的环境变量：{required_hint}\n\n"
+            "修复方式（任选其一）：\n"
+            "1) 直接注入环境变量（推荐）：\n"
+            "   - DATABASE_URL=...\n"
+            "   - REDIS_URL=...\n"
+            "   - CELERY_BROKER_URL=...\n"
+            "2) 使用 env 文件：在 `server/` 下准备 `.env.dev` 或 `.env.prod`（KEY=value 格式），\n"
+            "   本地可通过 `server/run.sh --env dev|prod` 自动加载；Docker 运行可用 `--env-file` 传入。\n"
+        )
+        # 不附带原始 ValidationError 的异常上下文，减少日志噪音；
+        # msg 已包含缺失项与修复方式，足够定位问题。
+        raise RuntimeError(msg) from None
 

server/app/main.py

@@ -9,7 +9,7 @@ def create_app() -> FastAPI:
     """
     创建 FastAPI 应用实例。
 
-    说明：目前仅提供最小可运行骨架（health check），后续逐步加入路由与中间件。
+    说明：目前仅提供最小可运行骨架（健康检查），后续逐步加入路由与中间件。
     """
 
     settings = get_settings()
@@ -20,6 +20,13 @@ def create_app() -> FastAPI:
     app.include_router(user_profile_router)
     app.include_router(reco_router)
 
+    @app.get("/health")
+    async def health() -> dict:
+        """
+        部署健康检查（兼容常见探针路径）。
+        """
+        return {"status": "ok", "env": settings.app_env}
+
     @app.get("/healthz")
     async def healthz() -> dict:
         return {"status": "ok", "env": settings.app_env}

server/env.example

@@ -1,3 +1,34 @@
+# 说明：
+# - 这是后端环境变量模板，请复制为 `.env.dev` 或 `.env.prod` 再填写真实值
+# - 请勿把包含真实账号密码/Token 的 `.env.*` 提交到仓库
+#
+# 用法示例：
+# - 本地：`./run.sh --env dev`
+# - Docker：`docker run --env-file server/.env.prod ...`
+
+# 运行环境
+APP_ENV=dev
+APP_NAME=mindfulness-server
+APP_HOST=0.0.0.0
+APP_PORT=8000
+
+# 数据库（SQLAlchemy 异步连接串）
+# MySQL 示例（aiomysql）：
+# DATABASE_URL=mysql+aiomysql://用户名:密码@127.0.0.1:3306/mindfulness_dev?charset=utf8mb4
+DATABASE_URL=
+
+# Redis（缓存/任务队列）
+# 示例：
+# REDIS_URL=redis://:密码@127.0.0.1:6379/0
+REDIS_URL=
+
+# Celery（建议先只配 broker；如需结果存储可另配 CELERY_RESULT_BACKEND）
+# 示例：
+# CELERY_BROKER_URL=redis://:密码@127.0.0.1:6379/0
+CELERY_BROKER_URL=
+
+# 可选：Celery 结果存储
+# CELERY_RESULT_BACKEND=redis://:密码@127.0.0.1:6379/0
 # 运行环境：dev 或 prod
 APP_ENV=dev
 

spec_kit/iOS Widget/plan.md

@@ -46,5 +46,5 @@
 ## 6. 风险与注意事项
 
 - **Expo Go 不支持**：必须用 Xcode 运行预构建后的 App（或后续 EAS Build）
-- **Bundle Identifier**：当前 `client/app.json` 使用 `com.anonymous.client`，仅适合本地验证；上线前需替换为真实 bundle id，并同步证书/签名
+- **Bundle Identifier**：当前工程已统一为主 App `com.damer.mindfulness`，Widget Extension `com.damer.mindfulness.emotionwidget`；上线前仍需在 Apple Developer / App Store Connect 侧确保 App ID、证书与签名匹配
 

spec_kit/iOS Widget/tasks.md

@@ -65,7 +65,7 @@ npx expo prebuild -p ios
   - **排查**：
     - 桌面搜索不到：通常是没有 Run 安装过主 App，或 Widget target 未加入编译
     - 点击不跳转：确认 Widget 里 `widgetURL` 为 `client:///(app)/home`，且 `app.json` 的 `scheme` 为 `client`
-    - 仍然搜不到：检查 Widget Extension 的 Bundle Identifier 是否有效（本仓库已修正为 `com.anonymous.client.emotionwidget`），然后 Clean + 重新安装 App
+    - 仍然搜不到：检查 Widget Extension 的 Bundle Identifier 是否有效（本仓库已修正为 `com.damer.mindfulness.emotionwidget`），然后 Clean + 重新安装 App
 
 ## 6. 文档补充（可选但建议）
 

spec_kit/overview.md

@@ -36,6 +36,11 @@
   - 安全：真实 IP/账号/密码/Token 不写入仓库，仅提供 `.env.example` 结构
 - **阶段产物**：
   - `spec_kit/Project Bootstrap/spec.md`
+- **近期变更**：
+  - 新增后端镜像构建基础：`server/Dockerfile`、`server/.dockerignore`
+  - 新增后端镜像打包与推送工作流：`.gitea/workflows/server-build.yml`（自动递增 semver tag 并推送到 Docker Hub）
+  - 新增后端蓝绿部署工作流：`.gitea/workflows/server-deploy.yml`（SSH 上机 + Docker 蓝绿启动 + Nginx upstream 切流 + 健康检查与失败回滚）
+  - 后端配置缺失时报错增强：`app/core/config.py` 将缺失的必填环境变量用中文提示并给出注入方式；补充 `server/env.example` 与 Docker 运行说明
 
 ## Onboarding App Shell
 
@@ -54,6 +59,10 @@
   - `spec_kit/iOS Widget/spec.md`
   - `spec_kit/iOS Widget/plan.md`
   - `spec_kit/iOS Widget/tasks.md`
+- **近期变更**：
+  - iOS 主 App Bundle ID 已统一为 `com.damer.mindfulness`，Widget Extension 为 `com.damer.mindfulness.emotionwidget`
+  - iOS 构建号已提升到 `2`，并将 `client/ios/client/Info.plist` 改为自动跟随 `MARKETING_VERSION` / `CURRENT_PROJECT_VERSION`
+  - 推送 entitlements 的 `aps-environment` 已切到 `production`（用于 TestFlight/线上包）
 
 ## Splash Consent