Update start-space.sh

start-space.sh

@@ -12,11 +12,73 @@ else
 fi
 
 # ============================================================
-# 2. 数据库连接解析：优先使用 DATABASE_URL
+# 2. 自部署 PostgreSQL 初始化与启动（新增）
 # ============================================================
-if [ -n "${DATABASE_URL:-}" ]; then
-    echo "DATABASE_URL provided, parsing..."
-    # 使用 Python 解析标准 PostgreSQL URI
+init_postgres() {
+    echo "Initializing and starting self-deployed PostgreSQL..."
+
+    # 如果数据目录不存在，则执行初始化
+    if [ ! -d "$PGDATA" ]; then
+        echo "PostgreSQL data directory not found, initializing..."
+        mkdir -p "$PGDATA"
+        chown postgres:postgres "$PGDATA"
+        # 使用 initdb 初始化，设置密码认证方式为 scram-sha-256
+        su-exec postgres initdb -D "$PGDATA" --auth=scram-sha-256 --pwfile=<(echo "$POSTGRES_PASSWORD")
+    fi
+
+    # 修改 postgresql.conf：仅监听本地，使用默认端口 5432
+    echo "listen_addresses = 'localhost'" >> "$PGDATA/postgresql.conf"
+    echo "port = 5432" >> "$PGDATA/postgresql.conf"
+    # 允许本地 socket 连接
+    echo "unix_socket_directories = '/tmp'" >> "$PGDATA/postgresql.conf"
+
+    # 启动 PostgreSQL 服务
+    echo "Starting PostgreSQL daemon..."
+    su-exec postgres pg_ctl -D "$PGDATA" -o "-c unix_socket_directories=/tmp" start
+
+    # 等待 PostgreSQL 就绪
+    echo "Waiting for PostgreSQL to accept connections..."
+    for i in $(seq 1 30); do
+        if su-exec postgres pg_isready -U postgres -h localhost -p 5432 >/dev/null 2>&1; then
+            echo "PostgreSQL is ready."
+            break
+        fi
+        sleep 1
+    done
+
+    # 创建应用用户和数据库（如果不存在）
+    echo "Ensuring application user and database exist..."
+    su-exec postgres psql -v ON_ERROR_STOP=1 --username postgres <<-EOSQL
+        DO \$\$
+        BEGIN
+            IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = '$POSTGRES_USER') THEN
+                CREATE ROLE $POSTGRES_USER WITH LOGIN PASSWORD '$POSTGRES_PASSWORD';
+            END IF;
+        END
+        \$\$;
+        SELECT 'CREATE DATABASE $POSTGRES_DB OWNER $POSTGRES_USER'
+        WHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = '$POSTGRES_DB')\gexec
+EOSQL
+
+    # 设置 DATABASE_URL 及拆分变量，指向本地 PostgreSQL（不启用 SSL）
+    export DATABASE_URL="postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@localhost:5432/${POSTGRES_DB}?sslmode=disable"
+    export DATABASE_HOST=localhost
+    export DATABASE_PORT=5432
+    export DATABASE_USER=$POSTGRES_USER
+    export DATABASE_PASSWORD=$POSTGRES_PASSWORD
+    export DATABASE_DBNAME=$POSTGRES_DB
+    export DATABASE_SSLMODE=disable
+
+    echo "PostgreSQL self-deployment ready. DATABASE_URL set to local instance."
+}
+
+# ============================================================
+# 3. 原有数据库连接解析（若用户提供了外部 DATABASE_URL，则覆盖本地）
+# ============================================================
+if [ -n "${EXTERNAL_DATABASE_URL:-}" ]; then
+    echo "EXTERNAL_DATABASE_URL provided, using external database instead of self-deployed."
+    # 使用外部连接，覆盖本地设置
+    export DATABASE_URL="$EXTERNAL_DATABASE_URL"
     eval $(python3 -c "
 import os, urllib.parse
 url = os.environ['DATABASE_URL']
@@ -35,22 +97,27 @@ print(f'export DATABASE_PASSWORD={password}')
 print(f'export DATABASE_DBNAME={dbname}')
 print(f'export DATABASE_SSLMODE={sslmode}')
 ")
-    echo "Parsed: DATABASE_HOST=$DATABASE_HOST, DATABASE_DBNAME=$DATABASE_DBNAME"
+    echo "Parsed external database: DATABASE_HOST=$DATABASE_HOST, DATABASE_DBNAME=$DATABASE_DBNAME"
 else
-    echo "DATABASE_URL not set, expecting individual DATABASE_* variables."
+    # 否则使用自部署 PostgreSQL
+    init_postgres
 fi
 
-# 检查必需的数据库变量（无论从何处获得）
+# ============================================================
+# 4. 检查必需的数据库变量（无论来源）
+# ============================================================
 required_db_vars="DATABASE_HOST DATABASE_PORT DATABASE_USER DATABASE_DBNAME"
 for var in $required_db_vars; do
     eval "val=\${$var:-}"
     if [ -z "$val" ]; then
-        echo "Missing required database variable: $var. Please set DATABASE_URL or all individual DATABASE_* vars." >&2
+        echo "Missing required database variable: $var. Please set DATABASE_URL or EXTERNAL_DATABASE_URL." >&2
         exit 1
     fi
 done
 
-# 检查其他必需密钥
+# ============================================================
+# 5. 检查其他必需密钥
+# ============================================================
 required_vars="ADMIN_PASSWORD JWT_SECRET TOTP_ENCRYPTION_KEY"
 for var in $required_vars; do
     eval "val=\${$var:-}"
@@ -61,25 +128,28 @@ for var in $required_vars; do
 done
 
 # ============================================================
-# 3. 默认值设置
+# 6. 默认值设置
 # ============================================================
 ADMIN_EMAIL="${ADMIN_EMAIL:-2691539771@qq.com}"
 SERVER_PORT="${SERVER_PORT:-7860}"
 DATA_DIR="${DATA_DIR:-/tmp/gateway-data}"
-DATABASE_SSLMODE="${DATABASE_SSLMODE:-require}"   # Xata 强制 SSL
+# 如果使用自部署，SSL 模式已经设为 disable，此处作为后备
+DATABASE_SSLMODE="${DATABASE_SSLMODE:-require}"
 REDIS_HOST="${REDIS_HOST:-127.0.0.1}"
 REDIS_PORT="${REDIS_PORT:-6379}"
 REDIS_PASSWORD="${REDIS_PASSWORD:-}"
 REDIS_DB="${REDIS_DB:-0}"
 
 # ============================================================
-# 4. 创建目录（无需 postgres 用户）
+# 7. 创建目录（包括 PostgreSQL 数据目录的父目录）
 # ============================================================
 mkdir -p "$DATA_DIR" /tmp/gateway-redis
+# 如果 PGDATA 的父目录不存在，则创建（例如 /var/lib/postgresql）
+mkdir -p "$(dirname "$PGDATA")"
 chown -R sub2api:sub2api "$DATA_DIR" /tmp/gateway-redis
 
 # ============================================================
-# 5. 启动 Redis
+# 8. 启动 Redis（与之前相同）
 # ============================================================
 echo "Starting Redis on ${REDIS_HOST}:${REDIS_PORT}..."
 redis-server --daemonize yes \
@@ -90,7 +160,6 @@ redis-server --daemonize yes \
     --appendonly no \
     ${REDIS_PASSWORD:+--requirepass "$REDIS_PASSWORD"}
 
-# 等待 Redis 就绪
 echo "Waiting for Redis..."
 while ! redis-cli -h "$REDIS_HOST" -p "$REDIS_PORT" ${REDIS_PASSWORD:+-a "$REDIS_PASSWORD"} ping >/dev/null 2>&1; do
     sleep 1
@@ -98,7 +167,7 @@ done
 echo "Redis is ready."
 
 # ============================================================
-# 6. 导出环境变量供子进程使用
+# 9. 导出环境变量供子进程使用
 # ============================================================
 export AUTO_SETUP="${AUTO_SETUP:-true}"
 export ADMIN_EMAIL ADMIN_PASSWORD JWT_SECRET TOTP_ENCRYPTION_KEY
@@ -107,10 +176,11 @@ export DATABASE_HOST DATABASE_PORT DATABASE_USER DATABASE_PASSWORD DATABASE_DBNA
 export REDIS_HOST REDIS_PORT REDIS_PASSWORD REDIS_DB
 export SERVER_HOST="${SERVER_HOST:-0.0.0.0}" SERVER_PORT
 export SERVER_MODE="${SERVER_MODE:-release}"
-export PORT="${PORT:-$SERVER_PORT}" GIN_MODE="${GIN_MODE:-release}"
+export PORT="${PORT:-$SERVER_PORT}"
+GIN_MODE="${GIN_MODE:-release}"
 
 # ============================================================
-# 7. 辅助函数（完全保留原始逻辑，使用外部数据库）
+# 10. 辅助函数（完全保留原始逻辑）
 # ============================================================
 migration_count() {
     PGPASSWORD="${DATABASE_PASSWORD:-}" psql \
@@ -134,7 +204,10 @@ sync_balance_cache_once() {
 start_balance_cache_sync() {
     [ "${BALANCE_CACHE_SYNC_ENABLED:-true}" != "true" ] && return 0
     ( interval="${BALANCE_CACHE_SYNC_INTERVAL_SECONDS:-60}"
-      while :; do sync_balance_cache_once || true; sleep "$interval"; done ) &
+    while :; do
+        sync_balance_cache_once || true
+        sleep "$interval"
+    done ) &
     echo "Balance cache sync loop started."
 }
 
@@ -166,7 +239,7 @@ jwt:
   expire_hour: ${JWT_EXPIRE_HOUR:-24}
 totp:
   encryption_key: "${TOTP_ENCRYPTION_KEY}"
-timezone: "${TZ:-Asia/Shanghai}"
+  timezone: "${TZ:-Asia/Shanghai}"
 default:
   user_concurrency: 5
   user_balance: 0
@@ -194,12 +267,12 @@ gateway:
     max_idle_per_account: ${OPENAI_WS_MAX_IDLE_PER_ACCOUNT:-4}
     event_flush_batch_size: ${OPENAI_WS_EVENT_FLUSH_BATCH_SIZE:-1}
     event_flush_interval_ms: ${OPENAI_WS_EVENT_FLUSH_INTERVAL_MS:-5}
-  usage_record:
-    worker_count: ${USAGE_RECORD_WORKER_COUNT:-16}
-    queue_size: ${USAGE_RECORD_QUEUE_SIZE:-4096}
-    task_timeout_seconds: ${USAGE_RECORD_TASK_TIMEOUT_SECONDS:-15}
-    overflow_policy: "${USAGE_RECORD_OVERFLOW_POLICY:-sync}"
-    auto_scale_enabled: ${USAGE_RECORD_AUTO_SCALE_ENABLED:-false}
+usage_record:
+  worker_count: ${USAGE_RECORD_WORKER_COUNT:-16}
+  queue_size: ${USAGE_RECORD_QUEUE_SIZE:-4096}
+  task_timeout_seconds: ${USAGE_RECORD_TASK_TIMEOUT_SECONDS:-15}
+  overflow_policy: "${USAGE_RECORD_OVERFLOW_POLICY:-sync}"
+  auto_scale_enabled: ${USAGE_RECORD_AUTO_SCALE_ENABLED:-false}
 EOF
     printf 'installed_at=%s\n' "$(date -u +%Y-%m-%dT%H:%M:%SZ)" >"$DATA_DIR/.installed"
     chown sub2api:sub2api "$DATA_DIR/config.yaml" "$DATA_DIR/.installed"
@@ -208,7 +281,12 @@ EOF
 }
 
 maybe_skip_auto_setup() {
-    [ "${FORCE_RUNTIME_CONFIG:-false}" = "true" ] && { write_runtime_config; export AUTO_SETUP=false; echo "Runtime config forced; skipping auto setup."; return 0; }
+    [ "${FORCE_RUNTIME_CONFIG:-false}" = "true" ] && {
+        write_runtime_config
+        export AUTO_SETUP=false
+        echo "Runtime config forced; skipping auto setup."
+        return 0
+    }
     [ "${SKIP_AUTO_SETUP_WHEN_MIGRATED:-true}" != "true" ] && return 0
     applied_count="$(migration_count | tr -d '[:space:]')"
     case "$applied_count" in ''|*[!0-9]*) applied_count=0 ;; esac
@@ -229,13 +307,13 @@ sync_admin_password() {
 import bcrypt, os
 print(bcrypt.hashpw(os.environ["ADMIN_PASSWORD"].encode("utf-8"), bcrypt.gensalt()).decode("utf-8"))
 PY
-)"
+        )"
         table_exists="$(PGPASSWORD="${DATABASE_PASSWORD:-}" psql -h "$DATABASE_HOST" -p "$DATABASE_PORT" -U "$DATABASE_USER" -d "$DATABASE_DBNAME" -tAc "select to_regclass('public.users') is not null;" 2>/tmp/admin-user-check.err || true)"
         table_exists="$(printf '%s' "$table_exists" | tr -d '[:space:]')"
         if [ "$table_exists" = "t" ]; then
             PGPASSWORD="${DATABASE_PASSWORD:-}" psql -h "$DATABASE_HOST" -p "$DATABASE_PORT" -U "$DATABASE_USER" -d "$DATABASE_DBNAME" -v ON_ERROR_STOP=1 \
                 -c "update users set password_hash = '${password_hash}', role = 'admin', status = 'active', updated_at = now() where email = '${ADMIN_EMAIL}'; insert into users (email, password_hash, role, balance, concurrency, status, created_at, updated_at) select '${ADMIN_EMAIL}', '${password_hash}', 'admin', 0, 5, 'active', now(), now() where not exists (select 1 from users where email = '${ADMIN_EMAIL}');" >/tmp/admin-password-sync.out 2>/tmp/admin-password-sync.err
-            echo "Admin password synchronized from HF secret."
+            echo "Admin password synchronized from secret."
             return 0
         fi
         sleep 2
@@ -244,7 +322,7 @@ PY
 }
 
 # ============================================================
-# 8. 主流程
+# 11. 主流程
 # ============================================================
 maybe_skip_auto_setup
 start_balance_cache_sync
@@ -258,7 +336,6 @@ while :; do
     trap 'kill -TERM "$app_pid" 2>/dev/null || true' INT TERM
 
     sync_admin_password &
-
     set +e
     wait "$app_pid"
     app_status="$?"