SafeLine/GITEA-PUSH-GUIDE.md

# SafeLine 源码推送到内网 Gitea 指南

适用环境
--------
Gitea Web 地址：http://192.168.1.122:3000
目标组织：Shanghai-Wind-Season-Network
项目本地路径：Z:\SafeLine-9.3.9\SafeLine-9.3.9
当前 Gitea 仓库地址：http://192.168.1.122:3000/Shanghai-Wind-Season-Network/SafeLine.git
Git HTTP remote：http://192.168.1.122:3000/Shanghai-Wind-Season-Network/SafeLine.git

访问令牌：b8b03d0cbc921ae2a540f0116f1e96f9b4396484
（只显示一次，用完建议在 Gitea 里删除重新生成）

---

一、准备 Gitea 仓库
------------------
1. 打开 http://192.168.1.122:3000
2. 登录账号
3. 在 Shanghai-Wind-Season-Network 组织下创建仓库
   - 仓库名：SafeLine
   - **不要勾选**：初始化 README、初始化 .gitignore、初始化 License
   - 选择可见性：私有（推荐）

---

二、进入项目目录
--------------
```powershell
Set-Location Z:\SafeLine-9.3.9\SafeLine-9.3.9
```

---

三、初始化 Git 仓库（如果还没初始化）
-------------------------------
```powershell
# 检查是否已有 .git
ls -Force .git

# 如果没有，初始化
git init
git branch -m main
```

---

四、配置 .gitignore（防止提交敏感文件）
-------------------------------
```powershell
# 创建或更新 .gitignore
cat > .gitignore << 'EOF'
# 敏感配置
.env
*.env
.env.local
.env.*.local

# 数据库
*.db
*.db-wal
*.db-shm
*.sqlite
*.sqlite3

# 依赖目录
node_modules/
vendor/

# 构建产物
*.exe
*.dll
*.so
*.dylib
build/
dist/
out/

# IDE
.idea/
.vscode/
*.swp
*.swo

# 日志
*.log
logs/

# 临时文件
*.tmp
*.temp
.DS_Store
Thumbs.db

# 证书/密钥
*.pem
*.key
*.crt
*.p12
*.pfx

# Gitea token 等密钥
gitea-token.txt
token.txt
EOF
```

---

五、配置 Git 用户信息
------------------
```powershell
git config user.name "YourName"
git config user.email "your@email.com"
```

---

六、添加 Gitea remote
-------------------
```powershell
# 检查现有 remote
git remote -v

# 如果没有 gitea remote，添加
git remote add gitea http://192.168.1.122:3000/Shanghai-Wind-Season-Network/SafeLine.git

# 如果已有但地址不对，修改
git remote set-url gitea http://192.168.1.122:3000/Shanghai-Wind-Season-Network/SafeLine.git

# 确认
git remote -v
# 应该显示：
# gitea  http://192.168.1.122:3000/Shanghai-Wind-Season-Network/SafeLine.git (fetch)
# gitea  http://192.168.1.122:3000/Shanghai-Wind-Season-Network/SafeLine.git (push)
```

---

七、检查工作区状态
---------------
```powershell
git status --short --branch
```

---

八、提交所有修改
-------------
```powershell
# 暂存所有文件
git add -A

# 查看将要提交的文件
git status

# 提交
git commit -m "feat: SafeLine CE 9.3.9 with pro features

- Remove telemetry: disabled all phone-home (installation notify, false positives, behavior tracking, upgrade tips)
- Version branding: removed 'ce-' prefix, product name changed to '长亭雷池 WAF'
- Detection engine enhancement: strict preset enables all 17 modules with aggressive configs
- Multi-user RBAC: admin/operator/viewer roles with password + TOTP 2FA
- Rate limiting: nginx limit_req per website (RPS, burst, action)
- JS Challenge: browser fingerprint verification page with cookie-based bypass
- Security fixes: removed InsecureSkipVerify, hardcoded credentials, NO_AUTH backdoor
"
```

---

九、推送到 Gitea（使用令牌认证）
--------------------------
### 方式 1：临时 Header 推送（推荐，不把令牌写入配置）
```powershell
$token = "b8b03d0cbc921ae2a540f0116f1e96f9b4396484"
$user = "YourGiteaUsername"
$pair = "${user}:${token}"
$basic = [Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes($pair))
$header = "Authorization: Basic $basic"

# 推送
git -c http.extraHeader="$header" -c http.postBuffer=524288000 -c http.version=HTTP/1.1 push -u gitea main
```

### 方式 2：Git Credential Manager（会弹窗）
```powershell
git push -u gitea main
# 弹窗时：
# 用户名：YourGiteaUsername
# 密码：粘贴 b8b03d0cbc921ae2a540f0116f1e96f9b4396484
```

---

十、常见错误处理
--------------
| 错误 | 处理 |
|------|------|
| Authentication failed | 确认用户名和令牌正确，令牌有仓库写入权限 |
| repository not found | 检查 remote 地址是否为 `http://192.168.1.122:3000/Shanghai-Wind-Season-Network/SafeLine.git` |
| rejected (remote has work) | `git pull --rebase gitea main` 后重新推送 |
| RPC failed / postBuffer | 已在命令中加了 `-c http.postBuffer=524288000` |
| Permission denied (Z盘) | 执行 `Get-ChildItem -LiteralPath ".git\objects\pack" -Force | ForEach-Object { $_.Attributes = $_.Attributes -band (-bnot [System.IO.FileAttributes]::ReadOnly) -band (-bnot [System.IO.FileAttributes]::Hidden) }` 然后 `git multi-pack-index write` |

---

十一、确认推送成功
--------------
打开浏览器访问：http://192.168.1.122:3000/Shanghai-Wind-Season-Network/SafeLine
查看最新提交是否出现。

本地验证：
```powershell
git status --short --branch
# 应该显示：## main...gitea/main
```

---

十二、安全提醒
------------
1. ✅ 已使用临时 Header 推送，令牌未写入 remote URL 或 Git 配置
2. ✅ .gitignore 已忽略 .env、密钥、证书、数据库文件
3. 用完令牌后，建议在 Gitea 设置里删除旧令牌并重新生成
4. 不要把令牌发到聊天窗口、写进文件、提交到仓库

---

完整一键推送脚本（复制到 PowerShell 执行）
-----------------------------------
```powershell
Set-Location Z:\SafeLine-9.3.9\SafeLine-9.3.9

# 1. 配置用户信息（按需修改）
git config user.name "YourName"
git config user.email "your@email.com"

# 2. 确保 .gitignore 存在
if (-not (Test-Path .gitignore)) {
    cat > .gitignore << 'EOF'
.env
*.env
*.db
*.db-*
node_modules/
vendor/
build/
dist/
*.exe
*.log
logs/
.idea/
.vscode/
*.pem
*.key
*.crt
gitea-token.txt
EOF
}

# 3. 初始化/检查 Git
if (-not (Test-Path .git)) { git init; git branch -m main }

# 4. 配置 remote
git remote remove gitea 2>$null
git remote add gitea http://192.168.1.122:3000/Shanghai-Wind-Season-Network/SafeLine.git

# 5. 提交
git add -A
git commit -m "feat: SafeLine CE 9.3.9 with pro features

- Remove telemetry: disabled all phone-home (installation notify, false positives, behavior tracking, upgrade tips)
- Version branding: removed 'ce-' prefix, product name changed to '长亭雷池 WAF'
- Detection engine enhancement: strict preset enables all 17 modules with aggressive configs
- Multi-user RBAC: admin/operator/viewer roles with password + TOTP 2FA
- Rate limiting: nginx limit_req per website (RPS, burst, action)
- JS Challenge: browser fingerprint verification page with cookie-based bypass
- Security fixes: removed InsecureSkipVerify, hardcoded credentials, NO_AUTH backdoor
"

# 6. 推送（使用令牌）
$token = "b8b03d0cbc921ae2a540f0116f1e96f9b4396484"
$user = "YourGiteaUsername"
$pair = "${user}:${token}"
$basic = [Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes($pair))
$header = "Authorization: Basic $basic"

git -c http.extraHeader="$header" -c http.postBuffer=524288000 -c http.version=HTTP/1.1 push -u gitea main

# 7. 验证
git status --short --branch
```

---

⚠️ 执行前请修改脚本中的 `YourGiteaUsername` 和 `YourName/your@email.com`。生成完成。保存为 `Z:\SafeLine-9.3.9\SafeLine-9.3.9\GITEA-PUSH-GUIDE.md`。

**关键点：**
1. **目标仓库**：`http://192.168.1.122:3000/Shanghai-Wind-Season-Network/SafeLine.git`
2. **令牌**：`b8b03d0cbc921ae2a540f0116f1e91e96f9b4396484`
3. **推送方式**：临时 Header 认证（不写入配置/历史）
4. **需先在 Gitea 创建仓库**：组织 `Shanghai-Wind-Season-Network` 下新建 `SafeLine`，**不要勾选**初始化选项

执行前请将脚本中的 `YourGiteaUsername` 改为你的 Gitea 用户名，`YourName/your@email.com` 改为提交者信息。