[浏览器: editor.kylaan.cn]
        │ HTTPS + Basic Auth
        ▼
[宝塔 nginx 反代]
        │
        ▼ 127.0.0.1:3001
[Docker 容器: blog-editor]
        │
        ├── Hono 后端 (服务 API + 静态前端)
        ├── 挂载: /app/workspace = git clone of blog repo
        ├── 挂载: /app/drafts = 草稿暂存
        └── 挂载: /root/.ssh = GitHub push key (只读)
        │
        │ 容器内: git pull → 写文件 → spawn publish.mjs → git push
        ▼
[GitHub repo: Kylaan/blog-asrto]
        │
        │ push 触发 .github/workflows/deploy.yml
        ▼
[GitHub Actions runner]
        │ pnpm install + astro build + rsync
        ▼
[/www/wwwroot/kylaan.cn] ──nginx serve──► [访客看到新文章]

services:
  blog-editor:
    build: .
    image: blog-editor:latest
    container_name: blog-editor
    restart: unless-stopped
    ports:
      - "127.0.0.1:3001:3001"          # 只绑 loopback, 强制走 nginx
    volumes:
      - ./workspace:/app/workspace      # blog repo 工作区 (持久)
      - ./drafts:/app/drafts            # 草稿 (持久)
      - ./ssh:/root/.ssh:ro             # SSH key 只读挂载
    environment:
      TZ: 'Asia/Shanghai'
      NODE_ENV: production
      PORT: 3001
      WORKSPACE_PATH: /app/workspace
      GIT_REMOTE: 'git@github.com:Kylaan/blog-asrto.git'
      GIT_BRANCH: 'main'
      GIT_USER_NAME: 'Blog Editor (kylaan.cn)'
      GIT_USER_EMAIL: 'editor@kylaan.cn'
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://localhost:3001/api/health"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 60s

FROM node:20-alpine

# 装容器内要的工具: git + ssh + tini (PID 1 信号处理)
RUN apk add --no-cache git openssh-client tini

WORKDIR /app

# 先装后端依赖 (Hono + 一些 helpers)
COPY server/package.json ./server/package.json
RUN cd server && npm install --omit=dev

# 拷后端源码 + 前端静态文件
COPY server/ ./server/
COPY frontend/ ./frontend/

# entrypoint 处理首次 clone / git config / 启动
COPY entrypoint.sh /entrypoint.sh
RUN chmod +x /entrypoint.sh

# 预先把 github.com 的 host key 写好, 避免容器内 ssh 提示
RUN mkdir -p /root/.ssh && \
    ssh-keyscan github.com >> /root/.ssh/known_hosts && \
    chmod 644 /root/.ssh/known_hosts

ENTRYPOINT ["/sbin/tini", "--", "/entrypoint.sh"]

#!/bin/sh
set -e

echo "[entrypoint] starting blog-editor container..."

# 1. 配置 git 身份
git config --global user.name "${GIT_USER_NAME:-Blog Editor}"
git config --global user.email "${GIT_USER_EMAIL:-editor@kylaan.cn}"
git config --global core.sshCommand "ssh -i /root/.ssh/blog_webapp -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new"
git config --global pull.rebase true
git config --global init.defaultBranch main

# 2. 首次启动 clone repo
if [ ! -d "${WORKSPACE_PATH}/.git" ]; then
  echo "[entrypoint] cloning ${GIT_REMOTE} into ${WORKSPACE_PATH}..."
  rm -rf "${WORKSPACE_PATH:?}"/* 2>/dev/null || true
  git clone --depth=30 -b "${GIT_BRANCH:-main}" "${GIT_REMOTE}" "${WORKSPACE_PATH}"
else
  echo "[entrypoint] workspace already exists, pulling latest..."
  cd "${WORKSPACE_PATH}" && git pull --rebase --autostash || echo "[entrypoint] pull failed, will retry on first publish"
fi

# 3. 启动 server
cd /app/server
echo "[entrypoint] starting Hono server on :${PORT:-3001}"
exec node server.mjs

import { Hono } from 'hono'
import { serve } from '@hono/node-server'
import { serveStatic } from '@hono/node-server/serve-static'
import { exec as execCb, spawn } from 'node:child_process'
import { promisify } from 'node:util'
import fs from 'node:fs/promises'
import path from 'node:path'
import { Buffer } from 'node:buffer'

const exec = promisify(execCb)

const WORKSPACE = process.env.WORKSPACE_PATH || '/app/workspace'
const DRAFTS_DIR = '/app/drafts'
const BLOG_DIR = path.join(WORKSPACE, 'src/content/blog')
const PORT = parseInt(process.env.PORT || '3001', 10)
const REPO_URL = (process.env.GIT_REMOTE || '').replace(/^git@github\.com:/, 'https://github.com/').replace(/\.git$/, '')

const app = new Hono()

// ===== 0. 健康检查 =====
app.get('/api/health', (c) => c.json({ ok: true, time: new Date().toISOString() }))

// ===== 1. 列出所有文章 =====
app.get('/api/posts', async (c) => {
  try {
    const entries = await fs.readdir(BLOG_DIR, { withFileTypes: true })
    const posts = []
    for (const e of entries) {
      if (!e.isDirectory()) continue
      const idxPath = path.join(BLOG_DIR, e.name, 'index.mdx')
      try {
        const raw = await fs.readFile(idxPath, 'utf-8')
        const fm = parseFrontmatter(raw)
        posts.push({
          slug: e.name,
          title: fm.title || e.name,
          publishDate: fm.publishDate || '',
          draft: fm.draft === true || fm.draft === 'true',
          pinned: fm.pinned === true || fm.pinned === 'true'
        })
      } catch {}
    }
    posts.sort((a, b) => (b.publishDate || '').localeCompare(a.publishDate || ''))
    return c.json(posts)
  } catch (err) {
    return c.json({ error: err.message }, 500)
  }
})

// ===== 2. 取单篇文章 (用于编辑) =====
app.get('/api/posts/:slug', async (c) => {
  const slug = c.req.param('slug')
  if (!/^[a-z0-9-]+$/i.test(slug)) return c.json({ error: 'invalid slug' }, 400)
  const idxPath = path.join(BLOG_DIR, slug, 'index.mdx')
  try {
    const raw = await fs.readFile(idxPath, 'utf-8')
    const { fm, body } = splitFrontmatter(raw)
    return c.json({ slug, frontmatter: fm, body })
  } catch {
    return c.json({ error: 'not found' }, 404)
  }
})

// ===== 3. 发布 (新建或更新) =====
app.post('/api/publish', async (c) => {
  const body = await c.req.json().catch(() => ({}))
  const { slug, frontmatter, content, mode = 'create' } = body

  // 基本校验
  if (!slug) return c.json({ error: 'slug 必填' }, 400)
  if (!/^[a-z0-9-]+$/i.test(slug)) return c.json({ error: 'slug 只能字母/数字/-' }, 400)
  if (!frontmatter?.title) return c.json({ error: 'title 必填' }, 400)
  if (!frontmatter?.description) return c.json({ error: 'description 必填' }, 400)
  if (!frontmatter?.publishDate) return c.json({ error: 'publishDate 必填' }, 400)

  // 拉最新 (防本地端先 push 了)
  try {
    await exec('git pull --rebase --autostash', { cwd: WORKSPACE })
  } catch (err) {
    return c.json({ error: 'git pull 失败: ' + (err.stderr || err.message) }, 500)
  }

  // 写文件
  const dir = path.join(BLOG_DIR, slug)
  await fs.mkdir(dir, { recursive: true })
  const mdx = buildMdx(frontmatter, content || '')
  await fs.writeFile(path.join(dir, 'index.mdx'), mdx, 'utf-8')

  // 调 publish.mjs (复用本地一键发布脚本)
  const commitMsg = mode === 'create'
    ? `feat: 新文章《${frontmatter.title}》`
    : `docs: 更新《${frontmatter.title}》`

  return new Promise((resolve) => {
    const child = spawn('node', [
      path.join(WORKSPACE, 'scripts/publish.mjs'),
      '-m', commitMsg,
      '--no-check'
    ], {
      cwd: WORKSPACE,
      env: { ...process.env, PUBLISH_AUTO_YES: '1' }
    })
    let out = '', err = ''
    child.stdout.on('data', d => { out += d.toString() })
    child.stderr.on('data', d => { err += d.toString() })
    child.on('exit', (code) => {
      resolve(c.json({
        ok: code === 0,
        code,
        stdout: out,
        stderr: err,
        actionsUrl: REPO_URL ? REPO_URL + '/actions' : null
      }, code === 0 ? 200 : 500))
    })
    child.on('error', (e) => {
      resolve(c.json({ ok: false, error: 'spawn failed: ' + e.message }, 500))
    })
  })
})

// ===== 4. 图片上传 (Vditor 用) =====
app.post('/api/upload', async (c) => {
  const slug = c.req.query('slug')
  if (!slug || !/^[a-z0-9-]+$/i.test(slug)) {
    return c.json({ msg: '请先填 slug', code: -1, data: { errFiles: [], succMap: {} } }, 400)
  }
  const formData = await c.req.formData()
  const files = formData.getAll('file[]')
  const dir = path.join(BLOG_DIR, slug)
  await fs.mkdir(dir, { recursive: true })

  const succMap = {}
  const errFiles = []
  for (const f of files) {
    if (!(f instanceof File)) { errFiles.push('not-a-file'); continue }
    const safeName = f.name.replace(/[^a-zA-Z0-9._-]/g, '_')
    const buf = Buffer.from(await f.arrayBuffer())
    await fs.writeFile(path.join(dir, safeName), buf)
    succMap[f.name] = `./${safeName}`
  }
  return c.json({ msg: '', code: 0, data: { errFiles, succMap } })
})

// ===== 5. 手动同步 (从 GitHub pull) =====
app.post('/api/sync', async (c) => {
  try {
    const { stdout } = await exec('git pull --rebase --autostash', { cwd: WORKSPACE })
    return c.json({ ok: true, output: stdout })
  } catch (err) {
    return c.json({ ok: false, error: err.stderr || err.message }, 500)
  }
})

// ===== 6. 草稿 (本地暂存, 不进 git) =====
app.post('/api/drafts/:slug', async (c) => {
  const slug = c.req.param('slug') || 'untitled'
  const safe = slug.replace(/[^a-zA-Z0-9-]/g, '_')
  const data = await c.req.json()
  await fs.mkdir(DRAFTS_DIR, { recursive: true })
  await fs.writeFile(path.join(DRAFTS_DIR, safe + '.json'), JSON.stringify(data), 'utf-8')
  return c.json({ ok: true })
})

app.get('/api/drafts/:slug', async (c) => {
  const slug = c.req.param('slug')
  const safe = slug.replace(/[^a-zA-Z0-9-]/g, '_')
  try {
    const raw = await fs.readFile(path.join(DRAFTS_DIR, safe + '.json'), 'utf-8')
    return c.json(JSON.parse(raw))
  } catch {
    return c.json({ error: 'no draft' }, 404)
  }
})

// ===== 静态前端 =====
app.use('/*', serveStatic({ root: '../frontend' }))

serve({ fetch: app.fetch, port: PORT, hostname: '0.0.0.0' }, (info) => {
  console.log(`Blog Editor listening on http://0.0.0.0:${info.port}`)
})

// ===== helpers =====
function parseFrontmatter(raw) {
  const m = raw.match(/^---\s*\n([\s\S]*?)\n---/)
  if (!m) return {}
  const fm = {}
  for (const line of m[1].split('\n')) {
    const lm = line.match(/^([a-zA-Z]\w*):\s*(.*)$/)
    if (!lm) continue
    let val = lm[2].trim()
    if (val.startsWith("'") && val.endsWith("'")) val = val.slice(1, -1)
    else if (val.startsWith('"') && val.endsWith('"')) val = val.slice(1, -1)
    if (val === 'true') val = true
    else if (val === 'false') val = false
    fm[lm[1]] = val
  }
  return fm
}

function splitFrontmatter(raw) {
  const m = raw.match(/^---\s*\n([\s\S]*?)\n---\s*\n?([\s\S]*)/)
  if (!m) return { fm: {}, body: raw }
  return { fm: parseFrontmatter(raw), body: m[2] }
}

function buildMdx(fm, body) {
  const lines = ['---']
  for (const [k, v] of Object.entries(fm)) {
    if (v === undefined || v === null || v === '') continue
    if (Array.isArray(v)) {
      lines.push(`${k}: [${v.map(x => JSON.stringify(x)).join(', ')}]`)
    } else if (typeof v === 'boolean' || typeof v === 'number') {
      lines.push(`${k}: ${v}`)
    } else if (typeof v === 'object') {
      // heroImage 等嵌套
      lines.push(`${k}:`)
      for (const [k2, v2] of Object.entries(v)) {
        if (v2 === undefined || v2 === null || v2 === '') continue
        if (typeof v2 === 'boolean') lines.push(`  ${k2}: ${v2}`)
        else lines.push(`  ${k2}: '${String(v2).replace(/'/g, "''")}'`)
      }
    } else if (k === 'publishDate' || k === 'updatedDate') {
      lines.push(`${k}: ${v}`)  // date 不加引号
    } else {
      lines.push(`${k}: '${String(v).replace(/'/g, "''")}'`)
    }
  }
  lines.push('---')
  lines.push('')
  lines.push(body)
  return lines.join('\n')
}

<!DOCTYPE html>
<html lang="zh-CN">
<head>
  <meta charset="UTF-8">
  <meta name="viewport" content="width=device-width, initial-scale=1.0">
  <title>Blog Editor — kylaan.cn</title>
  <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/vditor@3.10.7/dist/index.css">
  <style>
    * { box-sizing: border-box; }
    body { font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif; margin: 0; padding: 16px; max-width: 1400px; margin: 0 auto; color: #222; }
    h1 { margin: 0 0 12px; font-size: 20px; }
    .layout { display: grid; grid-template-columns: 220px 1fr; gap: 16px; }
    @media (max-width: 768px) { .layout { grid-template-columns: 1fr; } }
    aside { border-right: 1px solid #eee; padding-right: 12px; }
    aside h3 { font-size: 14px; margin: 12px 0 6px; color: #555; }
    aside ul { list-style: none; padding: 0; margin: 0; }
    aside li { padding: 4px 0; font-size: 13px; cursor: pointer; }
    aside li:hover { background: #f5f5f5; }
    aside li.active { font-weight: bold; color: #0066cc; }
    aside small { color: #888; font-size: 11px; display: block; }
    .meta { display: grid; grid-template-columns: repeat(2, 1fr); gap: 8px 12px; padding: 10px; background: #fafafa; border: 1px solid #eee; border-radius: 4px; margin-bottom: 12px; }
    .meta label { display: flex; flex-direction: column; font-size: 12px; color: #555; gap: 2px; }
    .meta input, .meta select { padding: 6px 8px; border: 1px solid #ddd; border-radius: 3px; font: inherit; }
    .meta input:focus, .meta select:focus { outline: none; border-color: #0066cc; }
    .actions { display: flex; gap: 8px; margin-top: 12px; flex-wrap: wrap; }
    button { padding: 8px 14px; border: 0; border-radius: 4px; cursor: pointer; font-size: 13px; }
    .primary { background: #0066cc; color: #fff; }
    .primary:hover { background: #0052a3; }
    .secondary { background: #eee; color: #333; }
    .secondary:hover { background: #ddd; }
    #status { margin-top: 10px; padding: 8px 12px; border-radius: 4px; font-size: 13px; min-height: 30px; }
    #status.ok { background: #d4edda; color: #155724; border: 1px solid #c3e6cb; }
    #status.err { background: #f8d7da; color: #721c24; border: 1px solid #f5c6cb; }
    #status pre { font-size: 11px; max-height: 200px; overflow: auto; margin: 4px 0 0; white-space: pre-wrap; }
    #status a { color: inherit; text-decoration: underline; }
  </style>
</head>
<body>
  <h1>📝 Blog Editor <small style="font-size:12px;color:#888">kylaan.cn</small></h1>

  <div class="layout">
    <aside>
      <button class="primary" style="width:100%" onclick="newPost()">+ 新建文章</button>
      <h3>已发布</h3>
      <ul id="post-list"></ul>
    </aside>

    <main>
      <div class="meta">
        <label>slug (URL) <input id="f-slug" placeholder="random-walk"></label>
        <label>title (标题) <input id="f-title" placeholder="≤60 字"></label>
        <label style="grid-column:1/-1">description (摘要) <input id="f-description" placeholder="≤160 字"></label>
        <label>publishDate <input id="f-publishDate" type="date"></label>
        <label>tags (逗号分隔) <input id="f-tags" placeholder="数学,概率"></label>
        <label>heroImage.src <input id="f-heroSrc" placeholder="./cover.png"></label>
        <label>language <input id="f-language" value="zh-CN"></label>
        <label>draft
          <select id="f-draft"><option value="false">false (公开)</option><option value="true">true (草稿)</option></select>
        </label>
        <label>pinned
          <select id="f-pinned"><option value="false">false</option><option value="true">true (置顶)</option></select>
        </label>
      </div>

      <div id="editor"></div>

      <div class="actions">
        <button class="primary" onclick="publish()">🚀 发布 (push + 自动部署)</button>
        <button class="secondary" onclick="syncPull()">🔄 从 GitHub 同步</button>
        <button class="secondary" onclick="saveDraft()">💾 存草稿 (本地)</button>
      </div>

      <div id="status">就绪</div>
    </main>
  </div>

  <script src="https://cdn.jsdelivr.net/npm/vditor@3.10.7/dist/index.min.js"></script>
  <script>
    let vditor, currentSlug = null

    document.addEventListener('DOMContentLoaded', () => {
      vditor = new Vditor('editor', {
        height: 600,
        mode: 'sv',
        cache: { enable: false },
        toolbarConfig: { pin: true },
        placeholder: '开始写...',
        preview: {
          math: { engine: 'KaTeX', inlineDigit: true },
          markdown: { mark: true, footnotes: true, gfmAutoLink: true }
        },
        upload: {
          accept: 'image/*',
          fieldName: 'file[]',
          multiple: true,
          url: () => '/api/upload?slug=' + (document.getElementById('f-slug').value.trim() || 'tmp'),
          format(files, responseText) { return responseText }
        },
        toolbar: ['emoji', 'headings', 'bold', 'italic', 'strike', 'link', '|',
                  'list', 'ordered-list', 'check', 'outdent', 'indent', '|',
                  'quote', 'line', 'code', 'inline-code', 'insert-before', 'insert-after', '|',
                  'upload', 'table', '|',
                  'undo', 'redo', '|',
                  'fullscreen', 'edit-mode', { name: 'more', toolbar: ['both', 'code-theme', 'content-theme', 'export', 'outline', 'preview', 'devtools', 'info', 'help'] }]
      })
      loadList()
      setDefaultDate()
    })

    function setDefaultDate() {
      document.getElementById('f-publishDate').value = new Date().toISOString().slice(0, 10)
    }

    async function loadList() {
      try {
        const r = await fetch('/api/posts')
        const posts = await r.json()
        const ul = document.getElementById('post-list')
        ul.innerHTML = ''
        posts.forEach(p => {
          const li = document.createElement('li')
          li.className = currentSlug === p.slug ? 'active' : ''
          li.innerHTML = `${p.draft ? '📄' : (p.pinned ? '📌' : '📝')} ${escapeHtml(p.title)}<small>${p.publishDate || ''} · ${p.slug}</small>`
          li.onclick = () => loadPost(p.slug)
          ul.appendChild(li)
        })
      } catch (e) {
        setStatus('加载列表失败: ' + e.message, 'err')
      }
    }

    async function loadPost(slug) {
      try {
        const r = await fetch('/api/posts/' + slug)
        if (!r.ok) throw new Error(await r.text())
        const data = await r.json()
        currentSlug = slug
        document.getElementById('f-slug').value = slug
        const fm = data.frontmatter
        document.getElementById('f-title').value = fm.title || ''
        document.getElementById('f-description').value = fm.description || ''
        document.getElementById('f-publishDate').value = fm.publishDate || ''
        document.getElementById('f-tags').value = Array.isArray(fm.tags) ? fm.tags.join(', ') : (fm.tags || '')
        document.getElementById('f-heroSrc').value = (fm.heroImage && fm.heroImage.src) || ''
        document.getElementById('f-language').value = fm.language || 'zh-CN'
        document.getElementById('f-draft').value = String(fm.draft === true || fm.draft === 'true')
        document.getElementById('f-pinned').value = String(fm.pinned === true || fm.pinned === 'true')
        vditor.setValue(data.body || '')
        setStatus('已加载 ' + slug + ' (修改后点发布会覆盖)', 'ok')
        loadList()
      } catch (e) {
        setStatus('加载失败: ' + e.message, 'err')
      }
    }

    function newPost() {
      currentSlug = null
      ;['slug', 'title', 'description', 'tags', 'heroSrc'].forEach(k => document.getElementById('f-' + k).value = '')
      document.getElementById('f-language').value = 'zh-CN'
      document.getElementById('f-draft').value = 'false'
      document.getElementById('f-pinned').value = 'false'
      setDefaultDate()
      vditor.setValue('# 标题\n\n开始写...\n')
      setStatus('准备写新文章', 'ok')
      loadList()
    }

    function collectFrontmatter() {
      const get = id => document.getElementById('f-' + id).value.trim()
      const fm = {
        title: get('title'),
        description: get('description'),
        publishDate: get('publishDate'),
        language: get('language') || 'zh-CN',
        draft: get('draft') === 'true',
        pinned: get('pinned') === 'true'
      }
      const tags = get('tags').split(',').map(s => s.trim()).filter(Boolean)
      if (tags.length) fm.tags = tags
      const hero = get('heroSrc')
      if (hero) fm.heroImage = { src: hero, inferSize: hero.startsWith('http') }
      return fm
    }

    async function publish() {
      const slug = document.getElementById('f-slug').value.trim()
      if (!slug) return setStatus('slug 必填', 'err')
      if (!/^[a-z0-9-]+$/i.test(slug)) return setStatus('slug 只能字母/数字/-', 'err')

      const fm = collectFrontmatter()
      if (!fm.title) return setStatus('title 必填', 'err')
      if (!fm.description) return setStatus('description 必填', 'err')
      if (fm.title.length > 60) return setStatus('title ≤60 字', 'err')
      if (fm.description.length > 160) return setStatus('description ≤160 字', 'err')

      const content = vditor.getValue()
      setStatus('⏳ 发布中... (git push → GitHub Actions → rsync, 总共 1-2 分钟)', 'ok')

      try {
        const r = await fetch('/api/publish', {
          method: 'POST',
          headers: { 'Content-Type': 'application/json' },
          body: JSON.stringify({
            slug, frontmatter: fm, content,
            mode: currentSlug === slug ? 'update' : 'create'
          })
        })
        const data = await r.json()
        if (data.ok) {
          currentSlug = slug
          const link = data.actionsUrl ? `<a href="${data.actionsUrl}" target="_blank">查看 Actions 进度</a>` : ''
          setStatus(`✓ 已 push! ${link}<pre>${escapeHtml(data.stdout || '')}</pre>`, 'ok')
          loadList()
        } else {
          setStatus(`✗ 失败 (exit ${data.code})\n${data.stderr || data.error || ''}\n${data.stdout || ''}`, 'err')
        }
      } catch (e) {
        setStatus('网络错误: ' + e.message, 'err')
      }
    }

    async function syncPull() {
      setStatus('⏳ 从 GitHub pull...', 'ok')
      try {
        const r = await fetch('/api/sync', { method: 'POST' })
        const data = await r.json()
        if (data.ok) {
          setStatus(`✓ 已同步<pre>${escapeHtml(data.output || '')}</pre>`, 'ok')
          loadList()
        } else {
          setStatus('✗ ' + (data.error || ''), 'err')
        }
      } catch (e) {
        setStatus('网络错误: ' + e.message, 'err')
      }
    }

    async function saveDraft() {
      const slug = document.getElementById('f-slug').value.trim() || 'untitled'
      try {
        const r = await fetch('/api/drafts/' + slug, {
          method: 'POST',
          headers: { 'Content-Type': 'application/json' },
          body: JSON.stringify({
            frontmatter: collectFrontmatter(),
            body: vditor.getValue(),
            savedAt: new Date().toISOString()
          })
        })
        const data = await r.json()
        setStatus(data.ok ? '💾 草稿已存到 VPS (重启容器不丢)' : '✗ ' + data.error, data.ok ? 'ok' : 'err')
      } catch (e) {
        setStatus('草稿保存失败: ' + e.message, 'err')
      }
    }

    function setStatus(msg, kind) {
      const el = document.getElementById('status')
      el.innerHTML = msg
      el.className = kind || ''
    }

    function escapeHtml(s) {
      return String(s).replace(/[&<>"']/g, c => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' })[c])
    }
  </script>
</body>
</html>

location / {
    # Basic Auth: 输 kylaan + 你 Phase 2.3 设的密码
    auth_basic "Blog Editor (Kylaan only)";
    auth_basic_user_file /www/server/nginx/conf/.htpasswd_editor;

    # 反代到容器
    proxy_pass http://127.0.0.1:3001;
    proxy_http_version 1.1;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;

    # 编辑器粘贴图片可能大一些
    client_max_body_size 20M;

    # 长轮询/上传可能慢, 给充裕的超时
    proxy_read_timeout 300s;
    proxy_send_timeout 300s;
}

# 限流防暴力破解 Basic Auth
limit_req_zone $binary_remote_addr zone=editor_login:10m rate=5r/s;
location = / {
    limit_req zone=editor_login burst=10 nodelay;
}

cd /www/docker/blog-editor

# 看实时日志
docker logs -f blog-editor

# 重启容器 (改了 .env 或想强制重启)
docker compose restart

# 升级镜像 (改了 Dockerfile / server / frontend)
docker compose up -d --build

# 停掉
docker compose down

# 进容器 shell 排错
docker exec -it blog-editor sh
# 在容器里:
cd /app/workspace
git status
git log --oneline -5

# 查看 workspace 文件
ls workspace/src/content/blog/

# 查看草稿
ls drafts/

# 备份 (停容器后做)
docker compose down
tar -czf blog-editor-backup-$(date +%Y%m%d).tar.gz workspace drafts ssh docker-compose.yml Dockerfile entrypoint.sh server frontend
docker compose up -d

# 重置工作区 (假如同步混乱了)
docker compose down
rm -rf workspace/*
rm -rf workspace/.git
docker compose up -d        # entrypoint 会自动重新 clone

# 改密码
htpasswd /www/server/nginx/conf/.htpasswd_editor kylaan
# (不要带 -c, 否则会覆盖)
nginx -s reload