Dockerfile

FROM node:22-alpine
RUN apk add --no-cache sqlite sqlite-dev
WORKDIR /app
RUN npm install -g omniroute

# 基础网络与环境配置
ENV PORT=7860
ENV OMNIROUTE_PORT=7860
ENV HOST=0.0.0.0
ENV NODE_ENV=production

# 🔑 设置新密码
ENV INITIAL_PASSWORD=Amd3dnow!

# 🔑 下载接口的访问令牌（在 HF Space Settings → Variables 里覆盖这个值！）
ENV DOWNLOAD_TOKEN=change_me_please

EXPOSE 7860

# 写入下载服务脚本（纯 Node.js，无需额外依赖）
RUN cat > /app/download_server.js << 'EOF'
const http = require('http');
const fs   = require('fs');
const path = require('path');
const { execSync } = require('child_process');

const PORT  = 7861;
const TOKEN = process.env.DOWNLOAD_TOKEN || 'change_me_please';

// 允许下载的安全目录白名单
const ALLOWED_DIRS = ['/data', '/root/.omniroute'];

function safeResolvePath(filename) {
  // 只允许纯文件名，拒绝任何路径分隔符（防路径穿越）
  if (!filename || filename.includes('/') || filename.includes('\\') || filename.includes('..')) {
    return null;
  }
  // 依次在白名单目录中查找文件
  for (const dir of ALLOWED_DIRS) {
    const fullPath = path.join(dir, filename);
    if (fs.existsSync(fullPath) && fs.statSync(fullPath).isFile()) {
      return fullPath;
    }
  }
  return null;
}

const server = http.createServer((req, res) => {
  const url    = new URL(req.url, `http://localhost:${PORT}`);
  const token  = url.searchParams.get('token') || '';
  const route  = url.pathname;

  // ── 统一鉴权 ──────────────────────────────────────────────
  // 使用逐字符比较防止时序攻击
  const tokenValid =
    token.length === TOKEN.length &&
    token.split('').every((c, i) => c === TOKEN[i]);

  if (!tokenValid) {
    res.writeHead(403, { 'Content-Type': 'application/json' });
    res.end(JSON.stringify({ error: 'Forbidden: invalid token' }));
    return;
  }

  // ── GET /list ─────────────────────────────────────────────
  if (route === '/list') {
    const result = {};
    for (const dir of ALLOWED_DIRS) {
      try {
        result[dir] = fs.readdirSync(dir).map(name => {
          const stat = fs.statSync(path.join(dir, name));
          return { name, size: stat.size, mtime: stat.mtime };
        });
      } catch (_) {
        result[dir] = `directory not found`;
      }
    }
    res.writeHead(200, { 'Content-Type': 'application/json' });
    res.end(JSON.stringify(result, null, 2));
    return;
  }

  // ── GET /download?token=...&file=omni_storage.sqlite ──────
  if (route === '/download') {
    const filename = url.searchParams.get('file') || '';
    const fullPath = safeResolvePath(filename);

    if (!fullPath) {
      res.writeHead(404, { 'Content-Type': 'application/json' });
      res.end(JSON.stringify({ error: `File not found: ${filename}` }));
      return;
    }

    const stat = fs.statSync(fullPath);
    res.writeHead(200, {
      'Content-Type':        'application/octet-stream',
      'Content-Disposition': `attachment; filename="${filename}"`,
      'Content-Length':      stat.size,
    });
    fs.createReadStream(fullPath).pipe(res);
    console.log(`[download] ${fullPath} (${stat.size} bytes)`);
    return;
  }

  // ── 404 ───────────────────────────────────────────────────
  res.writeHead(404, { 'Content-Type': 'application/json' });
  res.end(JSON.stringify({ error: 'Unknown route', routes: ['/list', '/download'] }));
});

server.listen(PORT, '0.0.0.0', () => {
  console.log(`[download-server] listening on port ${PORT}`);
  console.log(`[download-server] routes: /list  /download?file=<filename>`);
});
EOF

CMD \
  # ── 1. 启动诊断日志 ─────────────────────────────────────── \
  echo "=== 存储诊断开始 ===" && \
  echo "--- /data 目录 ---" && \
  ls -lah /data 2>&1 || echo "/data 目录不存在" && \
  echo "--- /root/.omniroute 目录 ---" && \
  ls -lah /root/.omniroute 2>&1 || echo "OmniRoute 目录不存在" && \
  echo "--- 磁盘挂载情况 ---" && \
  df -h && \
  echo "=== 存储诊断结束 ===" && \
  \
  # ── 2. 开机从持久化存储恢复数据 ─────────────────────────── \
  if [ -f /data/omni_storage.sqlite ]; then \
    mkdir -p /root/.omniroute && \
    cp /data/omni_storage.sqlite /root/.omniroute/storage.sqlite && \
    echo "✅ 恢复 storage.sqlite 成功"; \
  else \
    echo "⚠️  /data/omni_storage.sqlite 不存在，跳过恢复"; \
  fi && \
  if [ -f /data/omni_settings.json ]; then \
    mkdir -p /root/.omniroute && \
    cp /data/omni_settings.json /root/.omniroute/settings.json && \
    echo "✅ 恢复 settings.json 成功"; \
  else \
    echo "⚠️  /data/omni_settings.json 不存在，跳过恢复"; \
  fi && \
  \
  # ── 3. 后台：每 60 秒把数据备份到 /data ─────────────────── \
  (while true; do \
    sleep 60; \
    mkdir -p /data; \
    [ -f /root/.omniroute/storage.sqlite ] && \
      cp /root/.omniroute/storage.sqlite /data/omni_storage.sqlite && \
      echo "💾 [backup] storage.sqlite → /data"; \
    [ -f /root/.omniroute/settings.json  ] && \
      cp /root/.omniroute/settings.json  /data/omni_settings.json  && \
      echo "💾 [backup] settings.json  → /data"; \
  done) & \
  \
  # ── 4. 后台：启动下载服务（7861 端口）─────────────────────  \
  node /app/download_server.js & \
  \
  # ── 5. 前台：启动主程序 ──────────────────────────────────── \
  PORT=7860 omniroute