我第一次把网站部署上线，卡在了四道坎上

cd ~/projects/my-app
git remote add origin git@github.com:coyafky/my-app.git
git remote -v                 # 确认 origin 指向对的地址
git push -u origin main

git remote add origin    git@github.com:coyafky/some-project.git     # 我的 fork，能 push
git remote add upstream  git@github.com:original/some-project.git    # 上游，只能 pull

ssh-keygen -t ed25519 -C "your_email@example.com"
cat ~/.ssh/id_ed25519.pub    # 整段贴进 GitHub Settings → SSH and GPG keys
ssh -T git@github.com        # 看到 Hi <你的用户名>! 就通了

eval "$(ssh-agent -s)"
ssh-add --apple-use-keychain ~/.ssh/id_ed25519
 
cat >> ~/.ssh/config <<EOF
Host github.com
  AddKeysToAgent yes
  UseKeychain yes
  IdentityFile ~/.ssh/id_ed25519
EOF

ssh-keygen -t ed25519 -C "server-deploy-key"
cat ~/.ssh/id_ed25519.pub

gh repo create my-app --public --source=. --remote=origin --push

chown -R www-data:www-data /var/www/my-app/

chmod 755 /var/www/my-app
chmod 644 /var/www/my-app/index.html
chmod 600 /var/www/my-app/.env

worker_processes  auto;        # 全局层：Nginx 进程本身
 
events {
    worker_connections  1024;
}
 
http {                         # HTTP 层：所有 HTTP 配置的容器
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;
 
    server {                   # Server 层：一个域名 / 一个网站
        listen       80;
        server_name  example.com;
 
        location / {           # Location 层：某个路径的规则
            root   /var/www/html;
            index  index.html;
        }
 
        location /api/ {
            proxy_pass http://127.0.0.1:3000;
        }
    }
}

server {
    listen       80;
    server_name  localhost;
 
    root   /var/www/my-site;
    index  index.html;
 
    location / {
        try_files $uri $uri/ =404;
    }
}

server {
    listen       80;
    server_name  api.example.com;
 
    location /static/ {
        root   /var/www/app/public;
        expires 30d;
    }
 
    location / {
        proxy_pass http://127.0.0.1:3000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

server {
    listen       80;
    server_name  spa.example.com;
 
    root   /var/www/spa/dist;
    index  index.html;
 
    location / {
        try_files $uri $uri/ /index.html;
    }
 
    location /assets/ {
        expires 1y;
        add_header Cache-Control "public, immutable";
    }
}

sudo nginx -t         # 先查语法，输出 test is successful 才继续
sudo nginx -s reload  # 热重载，不断已有连接

location = /api/health { return 200 "精确匹配"; }
location ^~ /static/   { return 200 "前缀优先"; }
location ~ \.php$      { return 200 "正则"; }
location /api/         { return 200 "普通前缀"; }
location /             { return 200 "兜底"; }

curl http://127.0.0.1:3000     # 应用活着吗
lsof -i :3000                  # 端口被谁占着

sudo tail -f /var/log/nginx/error.log
sudo tail -f /var/log/nginx/access.log

sudo apt install certbot python3-certbot-nginx -y
sudo certbot --nginx -d example.com -d www.example.com

server {
    listen 443 ssl;
    server_name example.com www.example.com;
 
    ssl_certificate     /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
 
    include /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
}
 
server {
    listen 80;
    server_name example.com www.example.com;
    return 301 https://$host$request_uri;
}

sudo certbot renew --dry-run

#!/bin/bash
# deploy.sh
set -e
 
cd /var/www/my-app
 
echo "→ 拉取最新代码"
git pull origin main
 
echo "→ 安装依赖"
npm ci          # 按 lockfile 装，比 npm install 严格
 
echo "→ 构建"
npm run build
 
echo "→ 重启应用"
pm2 reload my-app
 
echo "✓ 部署完成 $(date)"

name: Deploy to Production
 
on:
  push:
    branches: [main]
 
jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
 
      - name: Deploy via SSH
        uses: appleboy/ssh-action@v1
        with:
          host: ${{ secrets.SERVER_HOST }}
          username: ${{ secrets.SERVER_USER }}
          key: ${{ secrets.SSH_PRIVATE_KEY }}
          script: |
            cd /var/www/my-app
            ./deploy.sh

upstream my_app {
    server 127.0.0.1:3000;
    # server 127.0.0.1:3001;   # 下一版起在这个端口，验证通过后切过来
}

http {
    limit_req_zone $binary_remote_addr zone=api_limit:10m rate=10r/s;
 
    server {
        location /api/ {
            limit_req zone=api_limit burst=20 nodelay;
            proxy_pass http://127.0.0.1:3000;
        }
    }
}

http {
    gzip on;
    gzip_types text/plain text/css application/json application/javascript text/xml;
    gzip_min_length 1000;
    gzip_comp_level 5;
    gzip_vary on;
}

location /ws/ {
    proxy_pass http://127.0.0.1:3000;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
    proxy_set_header Host $host;
    proxy_read_timeout 86400s;
}

upstream app_servers {
    server 127.0.0.1:3000;
    server 127.0.0.1:3001;
    server 127.0.0.1:3002;
}
 
server {
    location / {
        proxy_pass http://app_servers;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
}

{
  "mcpServers": {
    "github": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-github"],
      "env": {
        "GITHUB_PERSONAL_ACCESS_TOKEN": "<your_pat>"
      }
    }
  }
}