Update Dockerfile

Dockerfile

@@ -1,80 +1,40 @@
 FROM node:22-alpine
 
-# 运行时需要 sqlite CLI 做一致性备份；不安装 sqlite-dev（构建依赖，生产不需要）
 RUN apk add --no-cache sqlite
 
 WORKDIR /app
 RUN npm install -g omniroute
 
-# 基础网络与环境配置
 ENV PORT=7860
-ENV OMNIROUTE_PORT=7860
 ENV HOST=0.0.0.0
 ENV NODE_ENV=production
 
-# ⚠️ 不要在 Dockerfile 里写密码/令牌。
-# 在 HF Space → Settings → Variables and secrets 中设置：
-#   INITIAL_PASSWORD  (Secret)
-#   DOWNLOAD_TOKEN    (Secret)
-# 未设置 DOWNLOAD_TOKEN 时下载服务会拒绝启动（见 download_server.js）。
-
 EXPOSE 7860
 
-# 写入下载服务脚本（纯 Node.js，无需额外依赖）
+# 下载 + 反向代理服务（监听 7860）
 RUN cat > /app/download_server.js << 'EOF'
-const http   = require('http');
-const fs     = require('fs');
-const path   = require('path');
-const crypto = require('crypto');
-
-const PORT  = 7861;
-const TOKEN = process.env.DOWNLOAD_TOKEN;
-
-// 强制要求设置令牌，否则拒绝启动，避免使用默认值导致数据泄露
-//if (!TOKEN || TOKEN.length < 16) {
-//  console.error('[download-server] 致命错误: 必须设置 DOWNLOAD_TOKEN 且长度 >= 16。已退出。');
-//  process.exit(1);
-//}
-
-// 允许下载的安全目录白名单
-const ALLOWED_DIRS = ['/data', '/root/.omniroute'];
-
-// 恒定时间比较，防止时序攻击且不泄露长度
-function tokenValid(provided) {
-  const a = Buffer.from(String(provided));
-  const b = Buffer.from(TOKEN);
-  // 先对两个 buffer 做固定开销的 hash，再比较，规避长度差异
-  const ha = crypto.createHash('sha256').update(a).digest();
-  const hb = crypto.createHash('sha256').update(b).digest();
-  return crypto.timingSafeEqual(ha, hb);
-}
+const http = require('http');
+const fs   = require('fs');
+const path = require('path');
+
+const PORT          = 7860;          // HF 唯一暴露端口
+const UPSTREAM_PORT = 8860;          // omniroute 内部端口
+const ALLOWED_DIRS  = ['/data', '/root/.omniroute'];
 
 function safeResolvePath(filename) {
-  // 只允许纯文件名，拒绝任何路径分隔符（防路径穿越）
-  if (!filename || filename.includes('/') || filename.includes('\\') || filename.includes('..')) {
-    return null;
-  }
+  if (!filename || filename.includes('/') || filename.includes('\\') || filename.includes('..')) return null;
   for (const dir of ALLOWED_DIRS) {
     const fullPath = path.join(dir, filename);
-    if (fs.existsSync(fullPath) && fs.statSync(fullPath).isFile()) {
-      return fullPath;
-    }
+    if (fs.existsSync(fullPath) && fs.statSync(fullPath).isFile()) return fullPath;
   }
   return null;
 }
 
 const server = http.createServer((req, res) => {
   const url   = new URL(req.url, `http://localhost:${PORT}`);
-  const token = url.searchParams.get('token') || '';
   const route = url.pathname;
 
-  if (!tokenValid(token)) {
-    res.writeHead(403, { 'Content-Type': 'application/json' });
-    res.end(JSON.stringify({ error: 'Forbidden: invalid token' }));
-    return;
-  }
-
-  // ── GET /list ─────────────────────────────────────────────
+  // ── 列出可下载文件 ──
   if (route === '/list') {
     const result = {};
     for (const dir of ALLOWED_DIRS) {
@@ -83,26 +43,22 @@ const server = http.createServer((req, res) => {
           const stat = fs.statSync(path.join(dir, name));
           return { name, size: stat.size, mtime: stat.mtime };
         });
-      } catch (_) {
-        result[dir] = 'directory not found';
-      }
+      } catch (_) { result[dir] = 'directory not found'; }
     }
     res.writeHead(200, { 'Content-Type': 'application/json' });
     res.end(JSON.stringify(result, null, 2));
     return;
   }
 
-  // ── GET /download?token=...&file=omni_storage.sqlite ──────
+  // ── 下载文件（无 token）──
   if (route === '/download') {
     const filename = url.searchParams.get('file') || '';
     const fullPath = safeResolvePath(filename);
-
     if (!fullPath) {
       res.writeHead(404, { 'Content-Type': 'application/json' });
-      res.end(JSON.stringify({ error: 'File not found' }));   // 不回显用户输入
+      res.end(JSON.stringify({ error: 'File not found' }));
       return;
     }
-
     const stat = fs.statSync(fullPath);
     res.writeHead(200, {
       'Content-Type':        'application/octet-stream',
@@ -114,67 +70,64 @@ const server = http.createServer((req, res) => {
     return;
   }
 
-  // ── 404 ───────────────────────────────────────────────────
-  res.writeHead(404, { 'Content-Type': 'application/json' });
-  res.end(JSON.stringify({ error: 'Unknown route', routes: ['/list', '/download'] }));
+  // ── 其余请求反向代理给 omniroute (8860) ──
+  const proxyReq = http.request(
+    { hostname: '127.0.0.1', port: UPSTREAM_PORT, path: req.url, method: req.method, headers: req.headers },
+    proxyRes => { res.writeHead(proxyRes.statusCode, proxyRes.headers); proxyRes.pipe(res); }
+  );
+  proxyReq.on('error', () => {
+    res.writeHead(502, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ error: 'upstream not ready' }));
+  });
+  req.pipe(proxyReq);
 });
 
-// 只监听回环地址更安全；若需外部访问下载，再改为 0.0.0.0 并务必用强 TOKEN
 server.listen(PORT, '0.0.0.0', () => {
-  console.log(`[download-server] listening on ${PORT}, routes: /list /download?file=<name>`);
+  console.log(`[server] listening ${PORT}; routes /list /download, proxy -> ${UPSTREAM_PORT}`);
 });
 EOF
 
-# 写入启动脚本，避免把复杂逻辑塞进 CMD
+# 启动脚本
 RUN cat > /app/entrypoint.sh << 'EOF'
 #!/bin/sh
 set -u
 
-echo "=== 存储诊断开始 ==="
-ls -lah /data 2>&1 || echo "/data 目录不存在"
-ls -lah /root/.omniroute 2>&1 || echo "OmniRoute 目录不存在"
-df -h
-echo "=== 存储诊断结束 ==="
-
 mkdir -p /root/.omniroute /data
 
-# ── 开机从持久化存储恢复数据 ──
+# ── 开机从 /data 恢复 ──
 if [ -f /data/omni_storage.sqlite ]; then
-  cp /data/omni_storage.sqlite /root/.omniroute/storage.sqlite && echo "✅ 恢复 storage.sqlite 成功"
+  cp /data/omni_storage.sqlite /root/.omniroute/storage.sqlite && echo "✅ 恢复 storage.sqlite"
 else
   echo "⚠️  /data/omni_storage.sqlite 不存在，跳过恢复"
 fi
 if [ -f /data/omni_settings.json ]; then
-  cp /data/omni_settings.json /root/.omniroute/settings.json && echo "✅ 恢复 settings.json 成功"
+  cp /data/omni_settings.json /root/.omniroute/settings.json && echo "✅ 恢复 settings.json"
 else
   echo "⚠️  /data/omni_settings.json 不存在，跳过恢复"
 fi
 
-# ── 后台：每 60 秒一致性备份到 /data ──
+# ── 每 60 秒备份到 /data ──
 (while true; do
   sleep 60
   if [ -f /root/.omniroute/storage.sqlite ]; then
-    # 用 sqlite3 .backup 做一致性快照，避免拷到写入中途的损坏状态
     if sqlite3 /root/.omniroute/storage.sqlite ".backup '/data/omni_storage.sqlite.tmp'" 2>/dev/null; then
       mv -f /data/omni_storage.sqlite.tmp /data/omni_storage.sqlite
-      echo "💾 [backup] storage.sqlite → /data"
-    else
-      echo "⚠️ [backup] sqlite 备份失败"
+      echo "💾 [backup] storage.sqlite"
     fi
   fi
   if [ -f /root/.omniroute/settings.json ]; then
     cp /root/.omniroute/settings.json /data/omni_settings.json.tmp &&
       mv -f /data/omni_settings.json.tmp /data/omni_settings.json &&
-      echo "💾 [backup] settings.json → /data"
+      echo "💾 [backup] settings.json"
   fi
 done) &
 
-# ── 后台：启动下载服务（7861 端口）──
+# ── 启动下载+代理服务（7860）──
 node /app/download_server.js &
 
-# ── 前台：启动主程序 ──
-exec env PORT=7860 omniroute
+# ── 前台启动 omniroute（内部 8860）──
+exec env PORT=8860 omniroute
 EOF
 RUN chmod +x /app/entrypoint.sh
 
-CMD ["/app/entrypoint.sh"]
+CMD ["/app/entrypoint.sh"]