#!/bin/bash
# daily-check.sh - 每日巡检脚本

set -euo pipefail

REPORT_FILE="/var/log/git-daily-check-$(date +%Y%m%d).txt"
WEBHOOK_URL="${WEBHOOK_URL:-}"
WARNINGS=0

report() {
    echo "$1" | tee -a "$REPORT_FILE"
}

warn() {
    echo "⚠️  $1" | tee -a "$REPORT_FILE"
    WARNINGS=$((WARNINGS + 1))
}

fail() {
    echo "❌ $1" | tee -a "$REPORT_FILE"
    WARNINGS=$((WARNINGS + 1))
}

report "========================================"
report "Git 服务每日巡检报告"
report "时间: $(date '+%Y-%m-%d %H:%M:%S')"
report "========================================"
report ""

# === 服务状态 ===
report "--- 服务状态 ---"
services=("gitea" "nginx" "postgresql" "redis")
for svc in "${services[@]}"; do
    if systemctl is-active --quiet "$svc" 2>/dev/null; then
        report "✅ $svc: running"
    elif docker compose ps --services --filter "status=running" 2>/dev/null | grep -q "$svc"; then
        report "✅ $svc: running (docker)"
    else
        fail "$svc: not running"
    fi
done
report ""

# === 磁盘空间 ===
report "--- 磁盘空间 ---"
disk_usage=$(df /opt/git 2>/dev/null | tail -1 | awk '{print $5}' | sed 's/%//')
if [ "$disk_usage" -lt 85 ]; then
    report "✅ 磁盘使用率: ${disk_usage}%"
elif [ "$disk_usage" -lt 95 ]; then
    warn "磁盘使用率偏高: ${disk_usage}%"
else
    fail "磁盘即将满: ${disk_usage}%"
fi
report ""

# === 内存 ===
report "--- 内存使用 ---"
mem_available=$(free -m | awk '/^Mem:/ {print $7}')
if [ "$mem_available" -gt 1024 ]; then
    report "✅ 可用内存: ${mem_available}MB"
elif [ "$mem_available" -gt 512 ]; then
    warn "可用内存偏低: ${mem_available}MB"
else
    fail "可用内存不足: ${mem_available}MB"
fi
report ""

# === 备份检查 ===
report "--- 备份状态 ---"
BACKUP_DIR="/var/backups/git"
latest_backup=$(find "$BACKUP_DIR" -name "*.tar.gz" -o -name "*.zip" 2>/dev/null | sort -r | head -1)
if [ -n "$latest_backup" ]; then
    backup_age=$(( ($(date +%s) - $(stat -c %Y "$latest_backup")) / 3600 ))
    backup_size=$(du -sh "$latest_backup" | cut -f1)
    if [ "$backup_age" -lt 25 ]; then
        report "✅ 最新备份: $(basename $latest_backup) (${backup_size}, ${backup_age}h ago)"
    else
        warn "备份可能过期: ${backup_age}h ago"
    fi
else
    fail "未找到备份文件"
fi
report ""

# === SSL 证书 ===
report "--- SSL 证书 ---"
cert_expiry=$(echo | openssl s_client -connect git.example.com:443 2>/dev/null | \
    openssl x509 -noout -enddate 2>/dev/null | cut -d= -f2)
if [ -n "$cert_expiry" ]; then
    days_left=$(( ($(date -d "$cert_expiry" +%s) - $(date +%s)) / 86400 ))
    if [ "$days_left" -gt 30 ]; then
        report "✅ SSL 证书: ${days_left} 天后过期"
    else
        warn "SSL 证书即将过期: ${days_left} 天"
    fi
else
    report "ℹ️  SSL 证书: 无法检查"
fi
report ""

# === 最近错误日志 ===
report "--- 最近错误 ---"
error_count=$(journalctl --since "1 day ago" -p err --no-pager 2>/dev/null | wc -l)
if [ "$error_count" -lt 10 ]; then
    report "✅ 错误日志: ${error_count} 条"
else
    warn "错误日志偏多: ${error_count} 条"
    report "最近错误:"
    journalctl --since "1 day ago" -p err --no-pager | tail -5 | while read line; do
        report "  $line"
    done
fi
report ""

# === 汇总 ===
report "========================================"
if [ "$WARNINGS" -eq 0 ]; then
    report "✅ 巡检完成，所有项目正常"
else
    report "⚠️  巡检完成，发现 $WARNINGS 个问题"
fi
report "========================================"

# 发送通知
if [ "$WARNINGS" -gt 0 ] && [ -n "$WEBHOOK_URL" ]; then
    curl -sf -X POST "$WEBHOOK_URL" \
        -H "Content-Type: application/json" \
        -d "{\"text\":\"Git 服务巡检: 发现 $WARNINGS 个问题\n详见: $REPORT_FILE\"}" > /dev/null &
fi

# Cron 配置：每天上午 9 点执行
# crontab -e
0 9 * * * /opt/scripts/daily-check.sh

#!/bin/bash
# comprehensive-backup.sh

set -euo pipefail

# 配置
GIT_ROOT="/opt/git"
BACKUP_BASE="/var/backups/git"
NAS_MOUNT="/mnt/nas-backup"
S3_BUCKET="s3://git-backups-bucket"
DATE=$(date +%Y%m%d)
DAY_OF_WEEK=$(date +%u)
DAY_OF_MONTH=$(date +%d)

mkdir -p "$BACKUP_BASE/daily" "$BACKUP_BASE/weekly" "$BACKUP_BASE/monthly"

log() {
    echo "[$(date '+%Y-%m-%d %H:%M:%S')] $1"
}

# === 每日增量备份 ===
log "Starting daily backup..."
DAILY_FILE="$BACKUP_BASE/daily/git_backup_${DATE}.tar.gz"

# 使用 rsync 增量备份
rsync -a --delete --link-dest="$BACKUP_BASE/daily/latest" \
    "$GIT_ROOT/" "$BACKUP_BASE/daily/${DATE}/"
ln -sfn "$BACKUP_BASE/daily/${DATE}" "$BACKUP_BASE/daily/latest"

# 创建 tar 归档
tar czf "$DAILY_FILE" -C "$BACKUP_BASE/daily" "${DATE}/"
log "Daily backup: $DAILY_FILE ($(du -sh "$DAILY_FILE" | cut -f1))"

# 清理 30 天前的每日备份
find "$BACKUP_BASE/daily" -maxdepth 1 -name "git_backup_*" -mtime +30 -delete

# === 每周全量备份 ===
if [ "$DAY_OF_WEEK" = "7" ]; then
    log "Starting weekly backup..."
    WEEKLY_FILE="$BACKUP_BASE/weekly/git_backup_week_${DATE}.tar.gz"
    cp "$DAILY_FILE" "$WEEKLY_FILE"
    
    # 同步到 NAS
    if mountpoint -q "$NAS_MOUNT"; then
        cp "$WEEKLY_FILE" "$NAS_MOUNT/"
        log "Weekly backup synced to NAS"
    fi
    
    # 清理 12 周前的每周备份
    find "$BACKUP_BASE/weekly" -name "*.tar.gz" -mtime +84 -delete
fi

# === 每月归档 ===
if [ "$DAY_OF_MONTH" = "01" ]; then
    log "Starting monthly archive..."
    MONTHLY_FILE="$BACKUP_BASE/monthly/git_archive_$(date +%Y%m).tar.gz"
    cp "$DAILY_FILE" "$MONTHLY_FILE"
    
    # 上传到 S3
    if command -v aws &>/dev/null; then
        aws s3 cp "$MONTHLY_FILE" "$S3_BUCKET/monthly/"
        log "Monthly archive uploaded to S3"
    fi
    
    # 清理 12 个月前的每月备份
    find "$BACKUP_BASE/monthly" -name "*.tar.gz" -mtime +365 -delete
fi

log "Backup completed"

#!/bin/bash
# restore-drill.sh - 备份恢复演练

set -euo pipefail

DRILL_DIR="/tmp/restore-drill-$(date +%Y%m%d)"
BACKUP_FILE="$1"

echo "=== 备份恢复演练 ==="
echo "备份文件: $BACKUP_FILE"
echo "恢复目录: $DRILL_DIR"
echo ""

mkdir -p "$DRILL_DIR"

# 恢复备份
echo "1. 恢复备份..."
tar xzf "$BACKUP_FILE" -C "$DRILL_DIR"

# 验证仓库完整性
echo "2. 验证仓库..."
errors=0
for repo in $(find "$DRILL_DIR" -name "*.git" -type d); do
    repo_name=$(basename "$repo")
    
    if git --git-dir="$repo" fsck --no-dangling 2>/dev/null; then
        echo "   ✅ $repo_name"
    else
        echo "   ❌ $repo_name"
        errors=$((errors + 1))
    fi
done

# 尝试克隆验证
echo ""
echo "3. 测试克隆..."
test_repo=$(find "$DRILL_DIR" -name "*.git" -type d | head -1)
if [ -n "$test_repo" ]; then
    if git clone "$test_repo" "$DRILL_DIR/test-clone" 2>/dev/null; then
        echo "   ✅ 克隆成功"
        rm -rf "$DRILL_DIR/test-clone"
    else
        echo "   ❌ 克隆失败"
        errors=$((errors + 1))
    fi
fi

# 汇总
echo ""
echo "=== 演练结果 ==="
echo "仓库总数: $(find "$DRILL_DIR" -name "*.git" -type d | wc -l)"
echo "错误数量: $errors"

if [ "$errors" -eq 0 ]; then
    echo "✅ 备份恢复演练通过"
else
    echo "❌ 发现问题，请检查"
fi

# 清理
rm -rf "$DRILL_DIR"

# /etc/ssh/sshd_config

# 禁用密码认证
PasswordAuthentication no
PermitRootLogin no

# 仅允许指定用户
AllowUsers git deploy admin

# 使用强加密算法
KexAlgorithms curve25519-sha256,[email protected]
Ciphers [email protected],[email protected]
MACs [email protected],[email protected]

# 限制登录尝试
MaxAuthTries 3
MaxSessions 5
LoginGraceTime 30

# 超时设置
ClientAliveInterval 300
ClientAliveCountMax 2

# 使用非默认端口
Port 2222

# 应用配置
sudo sshd -t  # 测试配置
sudo systemctl restart sshd

#!/bin/bash
# setup-firewall.sh

# 重置规则
sudo ufw --force reset

# 默认策略
sudo ufw default deny incoming
sudo ufw default allow outgoing

# SSH（自定义端口）
sudo ufw allow 2222/tcp comment "SSH"

# HTTP/HTTPS
sudo ufw allow 80/tcp comment "HTTP"
sudo ufw allow 443/tcp comment "HTTPS"

# Git SSH（如果使用单独端口）
sudo ufw allow 2222/tcp comment "Git SSH"

# 内网访问（管理端口）
sudo ufw allow from 192.168.1.0/24 to any port 3000 comment "Gitea Internal"
sudo ufw allow from 10.0.0.0/8 to any port 9090 comment "Monitoring Internal"

# 启用防火墙
sudo ufw enable
sudo ufw status verbose

#!/bin/bash
# scan-secrets.sh - 扫描仓库中的敏感信息

REPO_PATH="$1"
PATTERNS=(
    'AKIA[0-9A-Z]{16}'                      # AWS Access Key
    'ghp_[a-zA-Z0-9]{36}'                   # GitHub Token
    'glpat-[a-zA-Z0-9\-]{20}'               # GitLab Token
    '-----BEGIN (RSA |EC |DSA )?PRIVATE KEY' # 私钥
    'password\s*[:=]\s*.+'                   # 密码
    'secret\s*[:=]\s*.+'                     # Secret
    'api[_-]?key\s*[:=]\s*.+'               # API Key
)

echo "扫描仓库: $REPO_PATH"
echo ""

cd "$REPO_PATH"

for pattern in "${PATTERNS[@]}"; do
    results=$(git log -p --all -S "$pattern" -- . 2>/dev/null | grep -E "$pattern" | head -5)
    if [ -n "$results" ]; then
        echo "⚠️  发现模式匹配: $pattern"
        echo "$results" | head -3
        echo ""
    fi
done

echo "扫描完成"

# /etc/gitea/app.ini

[security]
INSTALL_LOCK     = true
SECRET_KEY       = <随机生成 40+ 字符>
INTERNAL_TOKEN   = <随机生成 40+ 字符>
PASSWORD_COMPLEX = spec
MIN_PASSWORD_LENGTH = 12

[service]
REQUIRE_SIGNIN_VIEW               = true
ENABLE_NOTIFY_MAIL                = true
ENABLE_REVERSE_PROXY_AUTHENTICATION = false
DISABLE_REGISTRATION              = true  # 禁止公开注册
REGISTRATION_CONFIRM              = true  # 需要邮箱确认

[webhook]
ALLOWED_HOST_LIST = *.example.com  # 限制 Webhook 目标

[openid]
ENABLE_OPENID_SIGNIN = false

<type>(<scope>): <description>

[optional body]

[optional footer]

## Code Review 检查清单

### 功能
- [ ] 代码实现符合需求描述
- [ ] 边界情况已处理
- [ ] 错误处理完善

### 代码质量
- [ ] 命名清晰、有意义
- [ ] 函数职责单一
- [ ] 无重复代码（DRY）
- [ ] 注释充分但不过度

### 安全
- [ ] 无硬编码凭据
- [ ] 输入已验证和清理
- [ ] SQL 查询使用参数化
- [ ] 权限检查完整

### 测试
- [ ] 有单元测试
- [ ] 测试覆盖率合理
- [ ] 测试用例包含边界情况

### 文档
- [ ] API 变更有文档更新
- [ ] README 已更新（如需要）
- [ ] 变更日志已更新

<!-- .gitea/ISSUE_TEMPLATE/bug_report.md -->
---
name: Bug 报告
about: 报告一个问题
labels: bug
assignees: ''
---

## 描述
<!-- 清晰描述问题 -->

## 复现步骤
1. 步骤一
2. 步骤二
3. ...

## 预期行为
<!-- 描述你期望的正确行为 -->

## 实际行为
<!-- 描述实际发生的情况 -->

## 环境
- OS: [如 Ubuntu 22.04]
- 浏览器: [如 Chrome 120]
- 版本: [如 v1.2.3]

## 日志/截图
<!-- 如适用，粘贴相关日志或截图 -->

<!-- .gitea/PULL_REQUEST_TEMPLATE.md -->
## 变更说明
<!-- 简要描述此 PR 的变更内容 -->

## 关联 Issue
<!-- 关联的 Issue 编号，如 #123 -->

## 变更类型
- [ ] 新功能
- [ ] Bug 修复
- [ ] 重构
- [ ] 文档更新
- [ ] 测试
- [ ] 其他

## 测试说明
<!-- 描述如何测试这些变更 -->

## 截图/录屏
<!-- 如适用 -->

## Checklist
- [ ] 代码符合团队编码规范
- [ ] 已添加/更新单元测试
- [ ] 已更新相关文档
- [ ] CI 流水线通过

#!/bin/bash
# disk-growth-monitor.sh

GIT_ROOT="/opt/git"
LOG_FILE="/var/log/disk-growth.log"

current_usage=$(du -sb "$GIT_ROOT" | cut -f1)
current_date=$(date +%Y%m%d)

# 记录到日志
echo "$current_date $current_usage" >> "$LOG_FILE"

# 计算增长率（与 30 天前对比）
old_date=$(date -d "30 days ago" +%Y%m%d)
old_usage=$(grep "^$old_date" "$LOG_FILE" | awk '{print $2}')

if [ -n "$old_usage" ]; then
    growth_mb=$(( (current_usage - old_usage) / 1024 / 1024 ))
    echo "30 天增长: ${growth_mb}MB"
    
    # 预警阈值
    if [ "$growth_mb" -gt 10240 ]; then  # > 10GB/月
        echo "⚠️  磁盘增长过快: ${growth_mb}MB/月"
        # 发送告警...
    fi
fi

## 事故记录: INC-20260510-001

**日期**: 2026-05-10
**严重程度**: P2 - 高
**影响范围**: Git 服务不可用，影响全部用户
**持续时间**: 14:00 - 15:30 (90 分钟)

### 事件时间线
- 14:00 监控告警: Gitea 服务无响应
- 14:05 运维人员确认: 服务器内存耗尽
- 14:10 重启 Gitea 服务，问题未解决
- 14:20 发现: 某 CI Job 内存泄漏导致 OOM
- 14:30 终止异常 CI Job，重启服务
- 14:45 服务恢复，功能验证通过
- 15:30 确认稳定，关闭事件

### 根因分析
CI Runner 执行某任务时发生内存泄漏，耗尽服务器内存。

### 修复措施
1. 为 CI Runner 设置内存限制
2. 添加 OOM Killer 配置
3. 增加服务器内存监控告警

### 经验教训
- CI Runner 需要资源限制
- 监控告警需要覆盖内存使用

## 技术债务记录

### TD-001: GitLab 内存优化
- **发现日期**: 2026-03-15
- **影响**: 服务器频繁 OOM
- **优先级**: 高
- **解决方案**: 升级内存到 32GB 或迁移到 Gitea
- **状态**: 进行中

### TD-002: 备份自动化
- **发现日期**: 2026-04-01
- **影响**: 手动备份易出错
- **优先级**: 中
- **解决方案**: 实施 cron 自动备份 + 验证
- **状态**: 已完成