用腾讯云 COS 部署 wiki + Let's Encrypt 自动续期 SSL

site_name: liuhetian's wiki
site_url: https://wiki.liuhetian.work/

theme:
  name: material
  language: zh
  features:
    - navigation.tabs
    - navigation.indexes
    - content.code.copy
    - content.code.annotate

markdown_extensions:
  - admonition
  - attr_list
  - footnotes
  - md_in_html
  - pymdownx.details
  - pymdownx.highlight:
      anchor_linenums: true
  - pymdownx.inlinehilite
  - pymdownx.snippets
  - pymdownx.superfences:
      custom_fences:
        - name: mermaid
          class: mermaid
          format: !!python/name:pymdownx.superfences.fence_code_format
  - pymdownx.tabbed:
      alternate_style: true

nav:
  - 首页: index.md
  - 文章:
      - 用腾讯云 COS 部署 wiki: posts/cos-wiki-deploy.md
  - 工具:
      - 语法速查: syntax.md

# ----- 腾讯云 COS：部署 wiki 内容 + 给证书 hook 用 -----
COS_BUCKET=wiki-1307341066
COS_APPID=1307341066
COS_REGION=ap-chengdu
COS_SECRET_ID=AKID...你的 SecretId
COS_SECRET_KEY=你的 SecretKey
COS_DOMAIN=wiki.liuhetian.work

# ----- acme.sh：自动 SSL 证书 -----
ACME_EMAIL=you@example.com

# DNSPod API Token：去 https://console.dnspod.cn/account/token 创建后填
DP_Id=634183
DP_Key=你的 DNSPod Token

# Python
__pycache__/
*.py[oc]

# uv
.venv

# 构建产物
site/

# 凭证（务必排除！）
.env
.env.*

#!/usr/bin/env bash
# 构建 + 同步到腾讯云 COS
set -euo pipefail

PROJECT_DIR="$(cd "$(dirname "$0")" && pwd)"
cd "$PROJECT_DIR"

# 1. 读凭证
set -a
source .env
set +a

COSCMD="$PROJECT_DIR/.venv/bin/coscmd"

# 2. 写 coscmd 配置
"$COSCMD" config \
  -a "$COS_SECRET_ID" \
  -s "$COS_SECRET_KEY" \
  -b "$COS_BUCKET" \
  -r "$COS_REGION"

# 3. 构建静态站点
uv run zensical build

# 4. 同步 site/ 到 bucket 根
#    注意：必须 cd 到 site/ 后直接用绝对路径的 coscmd，
#    不能用 `uv run --directory` —— 它会把 CWD 切回 project root，
#    导致 coscmd 把整个项目（含 .venv、.env！）都往 COS 传。
cd "$PROJECT_DIR/site"
"$COSCMD" upload -rs ./ /

echo
echo "✅ 部署完成"
echo "访问: https://${COS_DOMAIN}/"

#!/usr/bin/env bash
# 首次配置：装 acme.sh、申请证书、注册自动续期 hook
# 之后续期由 acme.sh 内置 cron 触发，无需再跑此脚本
set -euo pipefail

PROJECT_DIR="$(cd "$(dirname "$0")/.." && pwd)"
cd "$PROJECT_DIR"

set -a
source .env
set +a

# 必填项校验
need() {
    if [ -z "${!1:-}" ]; then
        echo "ERROR: .env 缺少 $1" >&2
        exit 1
    fi
}
need DP_Id
need DP_Key
need ACME_EMAIL
need COS_SECRET_ID
need COS_SECRET_KEY
need COS_BUCKET
need COS_REGION
need COS_DOMAIN

ACME="$HOME/.acme.sh/acme.sh"
PYTHON="$PROJECT_DIR/.venv/bin/python"
DEPLOY_SCRIPT="$PROJECT_DIR/deploy-cert/deploy_cert_to_cos.py"

# 1. 装 acme.sh
if [ ! -x "$ACME" ]; then
    echo ">>> 安装 acme.sh ..."
    curl -fsSL https://get.acme.sh | sh -s email="$ACME_EMAIL"
fi

# 2. 切到 Let's Encrypt
"$ACME" --set-default-ca --server letsencrypt

# 3. DNS-01 申请证书
echo ">>> 申请证书 for $COS_DOMAIN ..."
"$ACME" --issue --dns dns_dp -d "$COS_DOMAIN" --keylength ec-256

# 4. 注册 reloadcmd（续期成功后自动推到 COS）
RELOADCMD="set -a; . '$PROJECT_DIR/.env'; set +a; \
export TENCENT_SECRET_ID=\"\$COS_SECRET_ID\" TENCENT_SECRET_KEY=\"\$COS_SECRET_KEY\"; \
'$PYTHON' '$DEPLOY_SCRIPT'"

"$ACME" --install-cert -d "$COS_DOMAIN" --ecc --reloadcmd "$RELOADCMD"

# 5. 首次强制跑一遍 reloadcmd
echo ">>> 首次部署证书到 COS ..."
"$ACME" --renew -d "$COS_DOMAIN" --ecc --force

echo
echo "✅ 完成"
crontab -l 2>/dev/null | grep -i acme || true

#!/usr/bin/env python3
"""
acme.sh 续期后调用此脚本，把新证书绑定到 COS 自定义域名。

acme.sh 通过 reloadcmd 调用时会注入：
  CERT_FULLCHAIN_PATH / CERT_KEY_PATH / Le_Domain 等

本脚本额外要求的环境变量（由 .env 提供）：
  TENCENT_SECRET_ID / TENCENT_SECRET_KEY
  COS_REGION / COS_BUCKET / COS_DOMAIN
"""
import os
import sys
from pathlib import Path

from qcloud_cos import CosConfig, CosS3Client


def must_env(name: str) -> str:
    v = os.environ.get(name)
    if not v:
        sys.exit(f"ERROR: missing required env var: {name}")
    return v


def main() -> None:
    secret_id = must_env("TENCENT_SECRET_ID")
    secret_key = must_env("TENCENT_SECRET_KEY")
    region = must_env("COS_REGION")
    bucket = must_env("COS_BUCKET")
    domain = must_env("COS_DOMAIN")

    cert_path = os.environ.get("CERT_FULLCHAIN_PATH") or os.environ.get("CERT_PATH")
    key_path = os.environ.get("CERT_KEY_PATH")
    if not cert_path or not key_path:
        sys.exit(
            "ERROR: CERT_FULLCHAIN_PATH and CERT_KEY_PATH must be set "
            "(acme.sh injects them automatically via --reloadcmd)"
        )

    cert = Path(cert_path).read_text()
    key = Path(key_path).read_text()

    client = CosS3Client(CosConfig(
        Region=region,
        SecretId=secret_id,
        SecretKey=secret_key,
        Scheme="https",
    ))

    client.put_bucket_domain_certificate(
        Bucket=bucket,
        DomainCertificateConfiguration={
            "CertificateInfo": {
                "CertType": "CustomCert",
                "CustomCert": {"Cert": cert, "PrivateKey": key},
            },
            "DomainList": [{"DomainName": domain}],
        },
    )
    print(f"OK: bound new cert to {domain} on bucket {bucket}")


if __name__ == "__main__":
    main()

[project]
name = "zensical-wiki"
version = "0.1.0"
requires-python = ">=3.13"
dependencies = [
    "zensical>=0.0.46",
]

[dependency-groups]
dev = [
    "coscmd>=1.9",
]