- Remove telemetry: disabled all phone-home (installation notify, false positives, behavior tracking, upgrade tips) - Version branding: removed 'ce-' prefix, product name changed to '长亭雷池 WAF' - Detection engine enhancement: strict preset enables all 17 modules with aggressive configs - Multi-user RBAC: admin/operator/viewer roles with password + TOTP 2FA - Rate limiting: nginx limit_req per website (RPS, burst, action) - JS Challenge: browser fingerprint verification page with cookie-based bypass - Security fixes: removed InsecureSkipVerify, hardcoded credentials, NO_AUTH backdoor
This commit is contained in:
@@ -0,0 +1,305 @@
|
||||
# SafeLine 源码推送到内网 Gitea 指南
|
||||
|
||||
适用环境
|
||||
--------
|
||||
Gitea Web 地址：http://192.168.1.122:3000
|
||||
目标组织：Shanghai-Wind-Season-Network
|
||||
项目本地路径：Z:\SafeLine-9.3.9\SafeLine-9.3.9
|
||||
当前 Gitea 仓库地址：http://192.168.1.122:3000/Shanghai-Wind-Season-Network/SafeLine.git
|
||||
Git HTTP remote：http://192.168.1.122:3000/Shanghai-Wind-Season-Network/SafeLine.git
|
||||
|
||||
访问令牌：b8b03d0cbc921ae2a540f0116f1e96f9b4396484
|
||||
（只显示一次，用完建议在 Gitea 里删除重新生成）
|
||||
|
||||
---
|
||||
|
||||
一、准备 Gitea 仓库
|
||||
------------------
|
||||
1. 打开 http://192.168.1.122:3000
|
||||
2. 登录账号
|
||||
3. 在 Shanghai-Wind-Season-Network 组织下创建仓库
|
||||
- 仓库名：SafeLine
|
||||
- **不要勾选**：初始化 README、初始化 .gitignore、初始化 License
|
||||
- 选择可见性：私有（推荐）
|
||||
|
||||
---
|
||||
|
||||
二、进入项目目录
|
||||
--------------
|
||||
```powershell
|
||||
Set-Location Z:\SafeLine-9.3.9\SafeLine-9.3.9
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
三、初始化 Git 仓库（如果还没初始化）
|
||||
-------------------------------
|
||||
```powershell
|
||||
# 检查是否已有 .git
|
||||
ls -Force .git
|
||||
|
||||
# 如果没有，初始化
|
||||
git init
|
||||
git branch -m main
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
四、配置 .gitignore（防止提交敏感文件）
|
||||
-------------------------------
|
||||
```powershell
|
||||
# 创建或更新 .gitignore
|
||||
cat > .gitignore << 'EOF'
|
||||
# 敏感配置
|
||||
.env
|
||||
*.env
|
||||
.env.local
|
||||
.env.*.local
|
||||
|
||||
# 数据库
|
||||
*.db
|
||||
*.db-wal
|
||||
*.db-shm
|
||||
*.sqlite
|
||||
*.sqlite3
|
||||
|
||||
# 依赖目录
|
||||
node_modules/
|
||||
vendor/
|
||||
|
||||
# 构建产物
|
||||
*.exe
|
||||
*.dll
|
||||
*.so
|
||||
*.dylib
|
||||
build/
|
||||
dist/
|
||||
out/
|
||||
|
||||
# IDE
|
||||
.idea/
|
||||
.vscode/
|
||||
*.swp
|
||||
*.swo
|
||||
|
||||
# 日志
|
||||
*.log
|
||||
logs/
|
||||
|
||||
# 临时文件
|
||||
*.tmp
|
||||
*.temp
|
||||
.DS_Store
|
||||
Thumbs.db
|
||||
|
||||
# 证书/密钥
|
||||
*.pem
|
||||
*.key
|
||||
*.crt
|
||||
*.p12
|
||||
*.pfx
|
||||
|
||||
# Gitea token 等密钥
|
||||
gitea-token.txt
|
||||
token.txt
|
||||
EOF
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
五、配置 Git 用户信息
|
||||
------------------
|
||||
```powershell
|
||||
git config user.name "YourName"
|
||||
git config user.email "your@email.com"
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
六、添加 Gitea remote
|
||||
-------------------
|
||||
```powershell
|
||||
# 检查现有 remote
|
||||
git remote -v
|
||||
|
||||
# 如果没有 gitea remote，添加
|
||||
git remote add gitea http://192.168.1.122:3000/Shanghai-Wind-Season-Network/SafeLine.git
|
||||
|
||||
# 如果已有但地址不对，修改
|
||||
git remote set-url gitea http://192.168.1.122:3000/Shanghai-Wind-Season-Network/SafeLine.git
|
||||
|
||||
# 确认
|
||||
git remote -v
|
||||
# 应该显示：
|
||||
# gitea http://192.168.1.122:3000/Shanghai-Wind-Season-Network/SafeLine.git (fetch)
|
||||
# gitea http://192.168.1.122:3000/Shanghai-Wind-Season-Network/SafeLine.git (push)
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
七、检查工作区状态
|
||||
---------------
|
||||
```powershell
|
||||
git status --short --branch
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
八、提交所有修改
|
||||
-------------
|
||||
```powershell
|
||||
# 暂存所有文件
|
||||
git add -A
|
||||
|
||||
# 查看将要提交的文件
|
||||
git status
|
||||
|
||||
# 提交
|
||||
git commit -m "feat: SafeLine CE 9.3.9 with pro features
|
||||
|
||||
- Remove telemetry: disabled all phone-home (installation notify, false positives, behavior tracking, upgrade tips)
|
||||
- Version branding: removed 'ce-' prefix, product name changed to '长亭雷池 WAF'
|
||||
- Detection engine enhancement: strict preset enables all 17 modules with aggressive configs
|
||||
- Multi-user RBAC: admin/operator/viewer roles with password + TOTP 2FA
|
||||
- Rate limiting: nginx limit_req per website (RPS, burst, action)
|
||||
- JS Challenge: browser fingerprint verification page with cookie-based bypass
|
||||
- Security fixes: removed InsecureSkipVerify, hardcoded credentials, NO_AUTH backdoor
|
||||
"
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
九、推送到 Gitea（使用令牌认证）
|
||||
--------------------------
|
||||
### 方式 1：临时 Header 推送（推荐，不把令牌写入配置）
|
||||
```powershell
|
||||
$token = "b8b03d0cbc921ae2a540f0116f1e96f9b4396484"
|
||||
$user = "YourGiteaUsername"
|
||||
$pair = "${user}:${token}"
|
||||
$basic = [Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes($pair))
|
||||
$header = "Authorization: Basic $basic"
|
||||
|
||||
# 推送
|
||||
git -c http.extraHeader="$header" -c http.postBuffer=524288000 -c http.version=HTTP/1.1 push -u gitea main
|
||||
```
|
||||
|
||||
### 方式 2：Git Credential Manager（会弹窗）
|
||||
```powershell
|
||||
git push -u gitea main
|
||||
# 弹窗时：
|
||||
# 用户名：YourGiteaUsername
|
||||
# 密码：粘贴 b8b03d0cbc921ae2a540f0116f1e96f9b4396484
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
十、常见错误处理
|
||||
--------------
|
||||
| 错误 | 处理 |
|
||||
|------|------|
|
||||
| Authentication failed | 确认用户名和令牌正确，令牌有仓库写入权限 |
|
||||
| repository not found | 检查 remote 地址是否为 `http://192.168.1.122:3000/Shanghai-Wind-Season-Network/SafeLine.git` |
|
||||
| rejected (remote has work) | `git pull --rebase gitea main` 后重新推送 |
|
||||
| RPC failed / postBuffer | 已在命令中加了 `-c http.postBuffer=524288000` |
|
||||
| Permission denied (Z盘) | 执行 `Get-ChildItem -LiteralPath ".git\objects\pack" -Force | ForEach-Object { $_.Attributes = $_.Attributes -band (-bnot [System.IO.FileAttributes]::ReadOnly) -band (-bnot [System.IO.FileAttributes]::Hidden) }` 然后 `git multi-pack-index write` |
|
||||
|
||||
---
|
||||
|
||||
十一、确认推送成功
|
||||
--------------
|
||||
打开浏览器访问：http://192.168.1.122:3000/Shanghai-Wind-Season-Network/SafeLine
|
||||
查看最新提交是否出现。
|
||||
|
||||
本地验证：
|
||||
```powershell
|
||||
git status --short --branch
|
||||
# 应该显示：## main...gitea/main
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
十二、安全提醒
|
||||
------------
|
||||
1. ✅ 已使用临时 Header 推送，令牌未写入 remote URL 或 Git 配置
|
||||
2. ✅ .gitignore 已忽略 .env、密钥、证书、数据库文件
|
||||
3. 用完令牌后，建议在 Gitea 设置里删除旧令牌并重新生成
|
||||
4. 不要把令牌发到聊天窗口、写进文件、提交到仓库
|
||||
|
||||
---
|
||||
|
||||
完整一键推送脚本（复制到 PowerShell 执行）
|
||||
-----------------------------------
|
||||
```powershell
|
||||
Set-Location Z:\SafeLine-9.3.9\SafeLine-9.3.9
|
||||
|
||||
# 1. 配置用户信息（按需修改）
|
||||
git config user.name "YourName"
|
||||
git config user.email "your@email.com"
|
||||
|
||||
# 2. 确保 .gitignore 存在
|
||||
if (-not (Test-Path .gitignore)) {
|
||||
cat > .gitignore << 'EOF'
|
||||
.env
|
||||
*.env
|
||||
*.db
|
||||
*.db-*
|
||||
node_modules/
|
||||
vendor/
|
||||
build/
|
||||
dist/
|
||||
*.exe
|
||||
*.log
|
||||
logs/
|
||||
.idea/
|
||||
.vscode/
|
||||
*.pem
|
||||
*.key
|
||||
*.crt
|
||||
gitea-token.txt
|
||||
EOF
|
||||
}
|
||||
|
||||
# 3. 初始化/检查 Git
|
||||
if (-not (Test-Path .git)) { git init; git branch -m main }
|
||||
|
||||
# 4. 配置 remote
|
||||
git remote remove gitea 2>$null
|
||||
git remote add gitea http://192.168.1.122:3000/Shanghai-Wind-Season-Network/SafeLine.git
|
||||
|
||||
# 5. 提交
|
||||
git add -A
|
||||
git commit -m "feat: SafeLine CE 9.3.9 with pro features
|
||||
|
||||
- Remove telemetry: disabled all phone-home (installation notify, false positives, behavior tracking, upgrade tips)
|
||||
- Version branding: removed 'ce-' prefix, product name changed to '长亭雷池 WAF'
|
||||
- Detection engine enhancement: strict preset enables all 17 modules with aggressive configs
|
||||
- Multi-user RBAC: admin/operator/viewer roles with password + TOTP 2FA
|
||||
- Rate limiting: nginx limit_req per website (RPS, burst, action)
|
||||
- JS Challenge: browser fingerprint verification page with cookie-based bypass
|
||||
- Security fixes: removed InsecureSkipVerify, hardcoded credentials, NO_AUTH backdoor
|
||||
"
|
||||
|
||||
# 6. 推送（使用令牌）
|
||||
$token = "b8b03d0cbc921ae2a540f0116f1e96f9b4396484"
|
||||
$user = "YourGiteaUsername"
|
||||
$pair = "${user}:${token}"
|
||||
$basic = [Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes($pair))
|
||||
$header = "Authorization: Basic $basic"
|
||||
|
||||
git -c http.extraHeader="$header" -c http.postBuffer=524288000 -c http.version=HTTP/1.1 push -u gitea main
|
||||
|
||||
# 7. 验证
|
||||
git status --short --branch
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
⚠️ 执行前请修改脚本中的 `YourGiteaUsername` 和 `YourName/your@email.com`。生成完成。保存为 `Z:\SafeLine-9.3.9\SafeLine-9.3.9\GITEA-PUSH-GUIDE.md`。
|
||||
|
||||
**关键点：**
|
||||
1. **目标仓库**：`http://192.168.1.122:3000/Shanghai-Wind-Season-Network/SafeLine.git`
|
||||
2. **令牌**：`b8b03d0cbc921ae2a540f0116f1e91e96f9b4396484`
|
||||
3. **推送方式**：临时 Header 认证（不写入配置/历史）
|
||||
4. **需先在 Gitea 创建仓库**：组织 `Shanghai-Wind-Season-Network` 下新建 `SafeLine`，**不要勾选**初始化选项
|
||||
|
||||
执行前请将脚本中的 `YourGiteaUsername` 改为你的 Gitea 用户名，`YourName/your@email.com` 改为提交者信息。
|
||||
Reference in New Issue
Block a user