Merge pull request #322 from jumpserver/dev

baijiangjie · web-flow · commit ccbf83f2a7a5 · 2026-07-16T20:14:13.000+08:00
v4.10.17-lts
diff --git a/.github/workflows/build-static-image.yml b/.github/workflows/build-static-image.yml
@@ -3,11 +3,12 @@ name: Build and Push Base Image
 on:
   push:
     branches:
-      - 'pr*'
+      - "pr*"
+      - "osm"
     paths:
-      - 'versions.txt'
-      - 'prepare.sh'
-      - 'Dockerfile-static'
+      - "versions.txt"
+      - "prepare.sh"
+      - "Dockerfile-static"
 
 jobs:
   build-and-push:
@@ -44,6 +45,7 @@ jobs:
           push: true
           tags: jumpserver/web-static:${{ env.IMAGE_TAG }}
           file: Dockerfile-static
+          context: .
 
       - name: Get current branch name
         id: get_branch
diff --git a/.github/workflows/check-deps-versions.yml b/.github/workflows/check-deps-versions.yml
@@ -1,6 +1,6 @@
 on:
   schedule:
-    - cron: '0 1 * * *'
+    - cron: "0 1 * * *"
   push:
     branches:
       - dev
@@ -40,7 +40,7 @@ jobs:
             echo "Branch does not exist, will create new one."
             echo "branch_exists=false" >> $GITHUB_ENV
           fi
-          
+
       - name: Checkout existing branch or create new one
         run: |
           if [ "$branch_exists" == "true" ]; then
@@ -54,12 +54,6 @@ jobs:
           version=$(curl -s https://api.github.com/repos/jumpserver/clients/releases/latest | jq -r .tag_name)
           sed -i "s/Client_VERSION=.*/Client_VERSION=${version}/g" versions.txt
 
-      - name: Check player version
-        run: |
-          version=$(curl -s https://api.github.com/repos/jumpserver/VideoPlayer/releases/latest | jq -r .tag_name | sed 's/v//')
-          echo "version=${version}" >> $GITHUB_ENV
-          sed -i "s/VIDEO_PLAYER_VERSION=.*/VIDEO_PLAYER_VERSION=${version}/g" versions.txt
-
       - name: Check tinker version
         run: |
           version=$(curl -s -H "Authorization: token $GITHUB_TOKEN" https://api.github.com/repos/jumpserver/tinker/releases/latest | jq -r .tag_name)
diff --git a/Dockerfile b/Dockerfile
@@ -2,31 +2,36 @@ ARG VERSION=dev
 FROM jumpserver/lina:${VERSION} AS lina
 FROM jumpserver/luna:${VERSION} AS luna
 
-FROM nginx:1.29-trixie
+FROM nginx:1.31-trixie
 ARG TARGETARCH
 
-ARG CHECK_VERSION=v1.0.5
 ARG APT_MIRROR=http://deb.debian.org
 
 ARG TOOLS="                           \
         ca-certificates               \
         wget                          \
-        curl                          \
-        vim                           \
+        logrotate                     \
         "
 
 RUN set -ex \
     && rm -f /etc/apt/apt.conf.d/docker-clean \
     && sed -i "s@http://.*.debian.org@${APT_MIRROR}@g" /etc/apt/sources.list.d/debian.sources\
     && apt-get update > /dev/null \
+    && apt-get -y upgrade \
     && apt-get -y install --no-install-recommends ${TOOLS} \
+    && wget https://github.com/jumpserver-dev/healthcheck/releases/latest/download/check_linux_${TARGETARCH}.deb \
+    && dpkg -i check_linux_${TARGETARCH}.deb \
+    && apt-get purge -y wget \
+        curl \
+        nginx-module-xslt \
+        nginx-module-njs \
+        libxml2 \
+        libxslt1.1 \
+        libgd3 \
+    && apt-get -y autoremove \
     && apt-get clean \
-    && wget https://github.com/jumpserver-dev/healthcheck/releases/download/${CHECK_VERSION}/check-${CHECK_VERSION}-linux-${TARGETARCH}.tar.gz \
-    && tar -xf check-${CHECK_VERSION}-linux-${TARGETARCH}.tar.gz \
-    && mv check /usr/local/bin/ \
-    && chown root:root /usr/local/bin/check \
-    && chmod 755 /usr/local/bin/check \
-    && rm -f check-${CHECK_VERSION}-linux-${TARGETARCH}.tar.gz
+    && rm -f check_linux_${TARGETARCH}.deb \
+    && rm -f /etc/nginx/conf.d/default.conf
 
 WORKDIR /opt
 
diff --git a/Dockerfile-ee b/Dockerfile-ee
@@ -1,5 +1,5 @@
 ARG VERSION=dev
-FROM jumpserver/web-static:20260122_091122 AS static
+FROM jumpserver/web-static:20260716_073445 AS static
 FROM jumpserver/web:${VERSION}-ce
 
 COPY --from=static /opt/ /opt/
diff --git a/Dockerfile-static b/Dockerfile-static
@@ -3,6 +3,7 @@ ARG TARGETARCH
 
 WORKDIR /tmp
 COPY . .
+
 RUN set -ex \
     && apk add --no-cache bash \
     && bash ./prepare.sh
diff --git a/default.conf b/default.conf
@@ -1,54 +1,8 @@
 server {
-    listen 51980;
+    listen 51980; # 如果不开启 https, 这里会 sed 成 80
     # listen [::]:51980;
 
-    client_max_body_size 5000m;
-
-    # For wecom verify
-    location ~* ^/WW_verify_[^.]+\.txt$ {
-        root /opt/jumpserver/data/;
-    }
-
-    # For acme challenge
-    location /.well-known/ {
-        root /opt/jumpserver/data/;
-    }
-
-    location = /robots.txt {
-        default_type text/html;
-        add_header Content-Type "text/plain; charset=UTF-8";
-        return 200 "User-agent: *\nDisallow: /\n";
-    }
-
-    location /web/health/ {
-        access_log off;
-        add_header Content-Type 'application/json';
-        return 200 '{"status": "ok"}';
-    }
-
-    location /player/ {
-        try_files $uri / /index.html;
-        alias /opt/player/;
-    }
-
-    location /ui/ {
-        try_files $uri / /index.html;
-        alias /opt/lina/;
-    }
-
-    location /luna/ {
-        try_files $uri / /index.html;
-        alias /opt/luna/;
-    }
-
-    location /download/ {
-        alias /opt/download/;
-        try_files $uri @redirect_oss;
-    }
-
-    location @redirect_oss {
-        rewrite ^/download/(.*)$ https://static.jumpserver.org/download/$1 permanent;
-    }
+    client_max_body_size 4096m;
 
     location / {
         rewrite ^/(.*)$ /ui/$1 last;
diff --git a/http_server.conf b/http_server.conf
@@ -19,5 +19,5 @@ server {
         proxy_send_timeout 600;
         proxy_read_timeout 600;
         send_timeout 6000;
-  }
-}
+    }
+}
diff --git a/includes/chen.conf b/includes/chen.conf
@@ -1,5 +1,6 @@
 location /chen/ {
-    proxy_pass http://chen:8082;
+    set $chen_upstream chen:8082;
+    proxy_pass http://$chen_upstream;
     proxy_buffering off;
     proxy_http_version 1.1;
     proxy_request_buffering off;
diff --git a/includes/common.conf b/includes/common.conf
@@ -0,0 +1,46 @@
+
+    # For wecom verify
+    location ~* ^/WW_verify_[^.]+\.txt$ {
+        root /opt/jumpserver/data/;
+    }
+
+    # For acme challenge
+    location /.well-known/ {
+        root /opt/jumpserver/data/;
+    }
+
+    location = /robots.txt {
+        default_type text/html;
+        add_header Content-Type "text/plain; charset=UTF-8";
+        return 200 "User-agent: *\nDisallow: /\n";
+    }
+
+    location /web/health/ {
+        access_log off;
+        default_type application/json;
+        return 200 '{"status": "ok"}';
+    }
+
+    location /player/ {
+        try_files $uri / /index.html;
+        alias /opt/player/;
+    }
+
+    location /ui/ {
+        try_files $uri / /index.html;
+        alias /opt/lina/;
+    }
+
+    location /luna/ {
+        try_files $uri / /index.html;
+        alias /opt/luna/;
+    }
+
+    location /download/ {
+        alias /opt/download/;
+        try_files $uri @redirect_oss;
+    }
+
+    location @redirect_oss {
+        rewrite ^/download/(.*)$ https://static.jumpserver.org/download/$1?v=osm;
+    }
diff --git a/includes/core.conf b/includes/core.conf
@@ -8,7 +8,8 @@ location /private-media/ {
 }
 
 location /ws/ {
-    proxy_pass http://core:8080;
+    set $core_upstream core:8080;
+    proxy_pass http://$core_upstream;
     proxy_buffering off;
     proxy_http_version 1.1;
     proxy_set_header Upgrade $http_upgrade;
@@ -18,7 +19,8 @@ location /ws/ {
 }
 
 location ~ ^/(core|api|media)/ {
-    proxy_pass http://core:8080;
+    set $core_upstream core:8080;
+    proxy_pass http://$core_upstream;
     proxy_set_header Host $http_host;
     proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
     proxy_ignore_client_abort on;
diff --git a/includes/koko.conf b/includes/koko.conf
@@ -1,5 +1,6 @@
 location /koko/ {
-    proxy_pass http://koko:5000;
+    set $koko_upstream koko:5000;
+    proxy_pass http://$koko_upstream;
     proxy_buffering off;
     proxy_http_version 1.1;
     proxy_request_buffering off;
diff --git a/includes/lion.conf b/includes/lion.conf
@@ -1,5 +1,6 @@
 location /lion/ {
-    proxy_pass http://lion:8081;
+    set $lion_upstream lion:8081;
+    proxy_pass http://$lion_upstream;
     proxy_buffering off;
     proxy_http_version 1.1;
     proxy_request_buffering off;
diff --git a/init.sh b/init.sh
@@ -8,9 +8,6 @@ function config_nginx() {
     exit 1
   fi
 
-  if [ -z "${HTTP_PORT}" ]; then
-    HTTP_PORT=80
-  fi
   if [ -z "${USE_LB}" ]; then
     USE_LB=1
   fi
@@ -22,13 +19,6 @@ function config_nginx() {
     fi
   fi
 
-  if [ "${HTTP_PORT}" != "80" ]; then
-    sed -i "s@listen 80;@listen ${HTTP_PORT};@g" "${config_file}"
-    if [ "${USE_IPV6}" == "1" ]; then
-      sed -i "s@listen \[::\]:80;@listen \[::\]:${HTTP_PORT};@g" "${config_file}"
-    fi
-  fi
-
   if [ -n "${SERVER_NAME}" ]; then
     SERVER_NAME=$(echo "$SERVER_NAME" | sed 's/,/ /g; s/ *$//')
     sed -i "s@# server_name .*;@server_name ${SERVER_NAME};@g" "${config_file}"
@@ -81,24 +71,12 @@ function config_https() {
 
   config_nginx "${config_file}"
 
-  if [ -z "${HTTPS_PORT}" ]; then
-    HTTPS_PORT=443
-  fi
-
   sed -i "s@server web:.*;@server localhost:51980;@g" "${config_file}"
 
   if [ "${USE_IPV6}" == "1" ]; then
     sed -i "s@# listen \[::\]:443@listen \[::\]:443@g" "${config_file}"
   fi
 
-  if [ "${HTTPS_PORT}" != "443" ]; then
-    sed -i "s@listen 443@listen ${HTTPS_PORT}@g" "${config_file}"
-    sed -i "s@https://\$server_name\$request_uri;@https://\$server_name:${HTTPS_PORT}\$request_uri;@g" "${config_file}"
-    if [ "${USE_IPV6}" == "1" ]; then
-      sed -i "s@listen \[::\]:443@listen \[::\]:${HTTPS_PORT}@g" "${config_file}"
-    fi
-  fi
-
   if [ -n "${SSL_CERTIFICATE}" ] && [ -f "/etc/nginx/cert/${SSL_CERTIFICATE}" ]; then
     sed -i "s@ssl_certificate .*;@ssl_certificate cert/${SSL_CERTIFICATE};@g" "${config_file}"
   fi
@@ -180,4 +158,4 @@ function main() {
   config_gzip
 }
 
-main
+main
diff --git a/nginx.conf b/nginx.conf
@@ -25,6 +25,8 @@ stream {
 http {
     include       /etc/nginx/mime.types;
     default_type  application/octet-stream;
+    resolver 127.0.0.11 valid=10s ipv6=off;
+    resolver_timeout 5s;
 
     log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                       '$status $body_bytes_sent "$http_referer" '
diff --git a/prepare.sh b/prepare.sh
@@ -17,31 +17,28 @@ wget ${DOWNLOAD_URL}/public/glyptodon-enterprise-player-${PLAY_VERSION}.tar.gz
 tar -xf glyptodon-enterprise-player-${PLAY_VERSION}.tar.gz -C /opt/player --strip-components 1
 rm -f glyptodon-enterprise-player-${PLAY_VERSION}.tar.gz
 
+if [ -f "/opt/player/lib/angular/1.7.8/package.json" ]; then
+    rm /opt/player/lib/angular/1.7.8/package.json || exit 1
+fi
+
 DOWNLOAD_DIR=/opt/download
 mkdir -p ${DOWNLOAD_DIR}/applets
 cd ${DOWNLOAD_DIR}/applets || exit 1
 wget -O chromedriver-${CHROME_DRIVER_VERSION}-win64.zip https://github.com/jumpserver-dev/Chrome-Portable-Win64/releases/download/${CHROME_DRIVER_VERSION}/chromedriver-win64.zip
 wget -O chrome-${CHROME_VERSION}-win.zip https://github.com/jumpserver-dev/Chrome-Portable-Win64/releases/download/${CHROME_VERSION}/chrome-win.zip
-wget https://github.com/jumpserver-dev/Python-Embed-Win64/releases/download/${PYTHON_VERSION}/jumpserver-tinker-python-${PYTHON_VERSION}-win64.zip
+wget -O jumpserver-tinker-python-${PYTHON_VERSION}-win64.zip https://github.com/jumpserver-dev/Python-Embed-Win64/releases/download/${PYTHON_VERSION}/jumpserver-tinker-python-${PYTHON_VERSION}-package-win64.zip
 wget ${DOWNLOAD_URL}/public/dbeaver-ce-${DBEAVER_VERSION}-x86_64-setup.exe
 wget ${DOWNLOAD_URL}/public/dbeaver-patch-${DBEAVER_VERSION}-x86_64-setup.msi
 wget ${DOWNLOAD_URL}/public/Tinker_Installer_${TINKER_VERSION}.exe
 
 mkdir -p ${DOWNLOAD_DIR}/public
 cd ${DOWNLOAD_DIR}/public || exit 1
-wget ${DOWNLOAD_URL}/public/Microsoft_Remote_Desktop_${MRD_VERSION}_installer.pkg
-wget https://github.com/jumpserver/VideoPlayer/releases/download/v${VIDEO_PLAYER_VERSION}/JumpServerVideoPlayer-${VIDEO_PLAYER_VERSION}.dmg
-wget https://github.com/jumpserver/VideoPlayer/releases/download/v${VIDEO_PLAYER_VERSION}/JumpServerVideoPlayer-${VIDEO_PLAYER_VERSION}.exe
+# wget ${DOWNLOAD_URL}/public/Microsoft_Remote_Desktop_${MRD_VERSION}_installer.pkg
 wget https://github.com/PowerShell/Win32-OpenSSH/releases/download/${OPENSSH_VERSION}p1-Beta/OpenSSH-Win64-${OPENSSH_VERSION}.msi
 
 clients=(
-    "JumpServerClient_${CLIENT_VERSION}_x64_en-US.msi"
-    "JumpServerClient_${CLIENT_VERSION}_x64-setup.exe"
-    "JumpServerClient_${CLIENT_VERSION}_aarch64.dmg"
-    "JumpServerClient_${CLIENT_VERSION}_x64.dmg"
-    "JumpServerClient_${CLIENT_VERSION}_amd64.AppImage"
-    "JumpServerClient_${CLIENT_VERSION}_amd64.deb"
-    "JumpServerClient-${CLIENT_VERSION}-1.x86_64.rpm"
+    "${CLIENT_NAME}Client_${CLIENT_VERSION}_x64-setup.exe"
+    "${CLIENT_NAME}Client_${CLIENT_VERSION}_aarch64.dmg"
 )
 for client in "${clients[@]}"; do
     wget "https://github.com/jumpserver/clients/releases/download/v${CLIENT_VERSION}/${client}"
@@ -51,4 +48,9 @@ for arch in x64 arm64; do
     wget https://downloads.mongodb.com/compass/mongosh-${MONGOSH_VERSION}-linux-${arch}.tgz
 done
 
-cp "${PROJECT_DIR}"/versions.txt ${DOWNLOAD_DIR}
+for i in $(ls ${CLIENT_NAME}*);do
+   to=${i/${CLIENT_NAME}/}
+   ln -s ${i} ${to}
+done
+
+cp "${PROJECT_DIR}"/versions.txt ${DOWNLOAD_DIR}
diff --git a/requirements.txt b/requirements.txt
@@ -3,3 +3,4 @@ selenium==4.4.0
 pywin32==304
 PyYAML==6.0
 cffi==1.16.0
+defusedxml==0.7.1
diff --git a/versions.txt b/versions.txt
