NAS 网站搬到容器里，404/403 差点把全家首页干崩：这次我终于搞懂了 Synology ACL 的坑

param(
  [string]$SiteRoot = "",
  [string]$ConfigDir = "",
  [string]$Image = "nginx:alpine",
  [string]$StackName = "webstation-nginx",
  [string]$ContainerName = "webstation-nginx",
  [int]$TempPort = 18080,
  [switch]$AgentMode
)

function Log([string]$Message) {
  if (-not $AgentMode) { Write-Host $Message }
}

if ([string]::IsNullOrWhiteSpace($SiteRoot)) { throw "SiteRoot is required." }
if ([string]::IsNullOrWhiteSpace($ConfigDir)) { $ConfigDir = Join-Path $SiteRoot "..\webstation-nginx-config" }
if (-not (Test-Path $SiteRoot)) { throw "Site root not found: $SiteRoot" }
if (Get-NetTCPConnection -LocalPort $TempPort -ErrorAction SilentlyContinue) { throw "Port $TempPort is occupied." }

New-Item -ItemType Directory -Force -Path $ConfigDir | Out-Null
$defaultConf = Join-Path $ConfigDir "default.conf"
$compose = Join-Path $ConfigDir "compose.yml"

@'
server {
    listen 80 default_server;
    server_name _;
    root /usr/share/nginx/html;
    index index.html;
    autoindex off;

    location ~* \.(php[345]?|phtml)$ {
        return 500;
    }

    location / {
        try_files $uri $uri/ =404;
    }
}
'@ | Set-Content -Encoding UTF8 $defaultConf

@"
services:
  web:
    container_name: $ContainerName
    image: $Image
    restart: unless-stopped
    ports:
      - "$($TempPort):80"
    volumes:
      - "$SiteRoot:/usr/share/nginx/html:ro"
      - "$defaultConf:/etc/nginx/conf.d/default.conf:ro"
"@ | Set-Content -Encoding UTF8 $compose

Log "Config generated at $ConfigDir"
Log "Next steps:"
Log "1. Review compose.yml"
Log "2. Deploy with Docker or Portainer"
Log "3. Verify http://<nas-host>:$TempPort/"
Log "4. Only then update the original 80/443 reverse proxy target"
Log "Rollback: restore the previous reverse proxy config and reload nginx."

#!/usr/bin/env bash
set -euo pipefail

AGENT_MODE=0
if [[ "${1:-}" == "--agent" || "${1:-}" == "--json" ]]; then
  AGENT_MODE=1
fi

log() { if [[ $AGENT_MODE -eq 0 ]]; then echo "$1"; fi }
fail() { echo "$1" >&2; exit 1; }

SITE_ROOT="${SITE_ROOT:-}"
CONFIG_DIR="${CONFIG_DIR:-}"
IMAGE="${IMAGE:-nginx:alpine}"
STACK_NAME="${STACK_NAME:-webstation-nginx}"
CONTAINER_NAME="${CONTAINER_NAME:-webstation-nginx}"
TEMP_PORT="${TEMP_PORT:-18080}"

[[ -n "$SITE_ROOT" ]] || fail "SITE_ROOT is required."
[[ -d "$SITE_ROOT" ]] || fail "Site root not found: $SITE_ROOT"
CONFIG_DIR="${CONFIG_DIR:-$SITE_ROOT/../webstation-nginx-config}"
mkdir -p "$CONFIG_DIR"

if ss -lnt | awk '{print $4}' | grep -q ":${TEMP_PORT}$"; then
  fail "Port ${TEMP_PORT} is occupied."
fi

cat > "$CONFIG_DIR/default.conf" <<'EOF'
server {
    listen 80 default_server;
    server_name _;
    root /usr/share/nginx/html;
    index index.html;
    autoindex off;

    location ~* \.(php[345]?|phtml)$ {
        return 500;
    }

    location / {
        try_files $uri $uri/ =404;
    }
}
EOF

cat > "$CONFIG_DIR/compose.yml" <<EOF
services:
  web:
    container_name: ${CONTAINER_NAME}
    image: ${IMAGE}
    restart: unless-stopped
    ports:
      - "${TEMP_PORT}:80"
    volumes:
      - "${SITE_ROOT}:/usr/share/nginx/html:ro"
      - "${CONFIG_DIR}/default.conf:/etc/nginx/conf.d/default.conf:ro"
EOF

log "Config generated at $CONFIG_DIR"
log "Next steps:"
log "1. Review compose.yml"
log "2. Deploy with Docker or Portainer"
log "3. Verify http://<nas-host>:${TEMP_PORT}/"
log "4. Only then update the original 80/443 reverse proxy target"
log "Rollback: restore the previous reverse proxy config and reload nginx."

#!/usr/bin/env zsh
set -euo pipefail

AGENT_MODE=0
if [[ "${1:-}" == "--agent" || "${1:-}" == "--json" ]]; then
  AGENT_MODE=1
fi

log() { if [[ $AGENT_MODE -eq 0 ]]; then echo "$1"; fi }
fail() { echo "$1" >&2; exit 1; }

SITE_ROOT="${SITE_ROOT:-}"
CONFIG_DIR="${CONFIG_DIR:-}"
IMAGE="${IMAGE:-nginx:alpine}"
STACK_NAME="${STACK_NAME:-webstation-nginx}"
CONTAINER_NAME="${CONTAINER_NAME:-webstation-nginx}"
TEMP_PORT="${TEMP_PORT:-18080}"

[[ -n "$SITE_ROOT" ]] || fail "SITE_ROOT is required."
[[ -d "$SITE_ROOT" ]] || fail "Site root not found: $SITE_ROOT"
CONFIG_DIR="${CONFIG_DIR:-$SITE_ROOT/../webstation-nginx-config}"
mkdir -p "$CONFIG_DIR"

if lsof -nP -iTCP:${TEMP_PORT} -sTCP:LISTEN >/dev/null 2>&1; then
  fail "Port ${TEMP_PORT} is occupied."
fi

cat > "$CONFIG_DIR/default.conf" <<'EOF'
server {
    listen 80 default_server;
    server_name _;
    root /usr/share/nginx/html;
    index index.html;
    autoindex off;

    location ~* \.(php[345]?|phtml)$ {
        return 500;
    }

    location / {
        try_files $uri $uri/ =404;
    }
}
EOF

cat > "$CONFIG_DIR/compose.yml" <<EOF
services:
  web:
    container_name: ${CONTAINER_NAME}
    image: ${IMAGE}
    restart: unless-stopped
    ports:
      - "${TEMP_PORT}:80"
    volumes:
      - "${SITE_ROOT}:/usr/share/nginx/html:ro"
      - "${CONFIG_DIR}/default.conf:/etc/nginx/conf.d/default.conf:ro"
EOF

log "Config generated at $CONFIG_DIR"
log "Next steps:"
log "1. Review compose.yml"
log "2. Deploy with Docker or Portainer"
log "3. Verify http://<nas-host>:${TEMP_PORT}/"
log "4. Only then update the original 80/443 reverse proxy target"
log "Rollback: restore the previous reverse proxy config and reload nginx."