Update entrypoint.sh

entrypoint.sh

@@ -1,29 +1,44 @@
 #!/bin/sh
 set -eu
 
-echo "[entrypoint] start..." >&2
-
+# 1. 环境检查
 if [ -z "${APP_ARCHIVE_URL:-}" ]; then
-  echo "[entrypoint] ERROR: APP_ARCHIVE_URL is not set." >&2
-  sleep 30
+  echo "Error: APP_ARCHIVE_URL is not set." >&2
   exit 1
 fi
 
-APP_DIR="/opt/app"
-mkdir -p "$APP_DIR"
-cd "$APP_DIR"
-
+# 2. 准备目录
+mkdir -p /opt/app
+cd /opt/app
 ARCHIVE_FILE="app_archive"
 
-echo "[entrypoint] downloading..." >&2
-curl -fsSL "$APP_ARCHIVE_URL" -o "$ARCHIVE_FILE"
+# 3. 清洗 Cloudflare 变量 (核心修正：去除换行、空格、单双引号)
+CF_ID="$(printf '%s' "${CF_ACCESS_CLIENT_ID:-}" | tr -d '\r\n "\047')"
+CF_SECRET="$(printf '%s' "${CF_ACCESS_CLIENT_SECRET:-}" | tr -d '\r\n "\047')"
 
-echo "[entrypoint] extracting..." >&2
-# 强制解压到当前目录
-unzip -oq "$ARCHIVE_FILE" 2>/dev/null || tar -xzf "$ARCHIVE_FILE" 2>/dev/null
+# 4. 组装 Curl (含浏览器伪装，防止 WAF 拦截)
+# -f: 失败报错 -s: 静默 -S: 出错时显示 -L: 跟随重定向
+UA="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
+set -- -fsSL -A "$UA" "$APP_ARCHIVE_URL" -o "$ARCHIVE_FILE"
+
+if [ -n "$CF_ID" ] && [ -n "$CF_SECRET" ]; then
+  set -- -H "CF-Access-Client-Id: $CF_ID" \
+         -H "CF-Access-Client-Secret: $CF_SECRET" \
+         "$@"
+fi
 
-echo "[entrypoint] after extract:" >&2
-ls -R .
+# 5. 下载
+echo "[entrypoint] Downloading..." >&2
+if ! curl "$@"; then
+  echo "Error: Download failed." >&2
+  exit 1
+fi
+
+# 6. 解压
+echo "[entrypoint] Extracting..." >&2
+unzip -oq "$ARCHIVE_FILE" 2>/dev/null || tar -xzf "$ARCHIVE_FILE" 2>/dev/null
+rm -f "$ARCHIVE_FILE"
 
-echo "[entrypoint] launching app..." >&2
+# 7. 启动
+echo "[entrypoint] Starting app..." >&2
 exec uvicorn app:app --host 0.0.0.0 --port 7860