保存 NAS 健康系统 UI7 代码与本机维护基线

deploy/legacy-ui7/Dockerfile

@@ -0,0 +1,5 @@
+FROM local/mi-fitness-nas:20261017-audit3
+USER root
+COPY overlay/ /src/src/mi_fitness_mcp/
+RUN python -c "import shutil,sysconfig; shutil.copytree('/src/src/mi_fitness_mcp',sysconfig.get_paths()['purelib']+'/mi_fitness_mcp',dirs_exist_ok=True)"
+USER 1000:1001

deploy/legacy-ui7/check-web.py

@@ -0,0 +1,36 @@
+"""实际部署验证：从运行容器内部读取鉴权配置，不输出秘密。"""
+import base64
+import json
+import subprocess
+import time
+import urllib.error
+import urllib.request
+
+item=json.loads(subprocess.check_output(['docker','inspect','mi-fitness-health-web-1']))[0]
+assert item['Config']['Image']=='local/mi-fitness-nas:20261017-ui7','网页镜像版本不符'
+env=dict(line.split('=',1) for line in item['Config']['Env'])
+token=base64.b64encode(('admin:'+env['MI_FITNESS_WEB_PASSWORD']).encode('utf-8')).decode('ascii')
+opener=urllib.request.build_opener(urllib.request.ProxyHandler({}))
+def fetch(path,auth=True):
+    request=urllib.request.Request('http://127.0.0.1:18322'+path,headers={'Authorization':'Basic '+token} if auth else {})
+    with opener.open(request,timeout=5) as response:return response.status,response.read(2000000).decode('utf-8')
+for attempt in range(30):
+    try:
+        status,html=fetch('/')
+        assert status==200 and '20261017-ui7' in html
+        for path,marker in [('/static/js/health-views.js','HealthViews'),('/static/js/health-ui.js','loadHealthView'),('/static/css/health.css','health-cards')]:
+            assert marker in fetch(path)[1]
+        break
+    except (OSError,ValueError,AssertionError):
+        if attempt==29:raise RuntimeError('网页版本或资源就绪验证失败') from None
+        time.sleep(2)
+try:
+    fetch('/',False)
+except urllib.error.HTTPError as exc:
+    assert exc.code==401,'匿名访问权限异常'
+else:
+    raise RuntimeError('匿名访问未被拒绝')
+assert json.loads(fetch('/api/calendar?start=2026&end=2026')[1])['years']['2026']['days']
+assert env.get('MI_FITNESS_CALENDAR_DIR')=='/calendar'
+assert any(m['Destination']=='/calendar' and m['RW'] for m in item['Mounts'])
+print('新版网页与三项新增资源就绪；当前自设密码验证通过，匿名访问仍需认证。')

deploy/legacy-ui7/update-web.sh

@@ -0,0 +1,44 @@
+#!/bin/sh
+set -eu
+umask 077
+[ "$(id -u)" = 0 ] || { echo '请通过 sudo 执行。'; exit 1; }
+package=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd -P)
+target=/vol2/1000/Soft/mi-fitness-health
+cd "$package"
+sha256sum -c health-ui7.tar.sha256
+python3 - "$target/compose.override.yml" "$package/expected-current.sha256" <<'PY'
+import hashlib,sys
+from pathlib import Path
+assert hashlib.sha256(Path(sys.argv[1]).read_bytes()).hexdigest()==Path(sys.argv[2]).read_text().strip(), '现有配置已变化，停止避免覆盖'
+PY
+before=$(docker inspect --format '{{.Id}}' mi-fitness-health-backend-1 mi-fitness-health-worker-1)
+[ ! -L "$target/calendar" ] || { echo "日历目录不能是符号链接"; exit 1; }
+mkdir -p "$target/calendar"
+chown 1000:1001 "$target/calendar"
+chmod 700 "$target/calendar"
+docker load -i "$package/health-ui7.tar"
+cd "$target"
+docker compose --project-name mi-fitness-health --env-file .env -f compose.yml -f "$package/compose.override.yml" config --quiet
+old="$target/compose.override.pre-ui7-$(date +%Y%m%d-%H%M%S).yml"
+cp compose.override.yml "$old"
+complete=0
+recover() {
+  if [ "$complete" = 0 ]; then
+    cp "$old" "$target/compose.override.yml"
+    chown 1000:1001 "$target/compose.override.yml"
+    chmod 600 "$target/compose.override.yml"
+    docker compose --project-name mi-fitness-health up -d --no-deps --no-build --pull never web || true
+    echo '新版未通过验证，已恢复原网页配置并尝试回退。'
+  fi
+}
+trap recover EXIT
+cp "$package/compose.override.yml" compose.override.yml
+chown 1000:1001 compose.override.yml
+chmod 600 compose.override.yml
+docker compose --project-name mi-fitness-health up -d --no-deps --no-build --pull never --wait --wait-timeout 60 web
+python3 "$package/check-web.py"
+after=$(docker inspect --format '{{.Id}}' mi-fitness-health-backend-1 mi-fitness-health-worker-1)
+[ "$before" = "$after" ] || { echo '后端或同步容器标识发生变化，停止验收。'; exit 1; }
+complete=1
+trap - EXIT
+printf '\n网页更新完成。后端和 worker 未重建，登录密码及数据目录未修改。\n'