fix: add X-Api-Key header for captcha OCR requests

The captcha OCR service now requires X-Api-Key authentication.
Add captcha.apiKey config option and pass it as header in all
OCR-related API calls (ocr, semiOcr, calc).

.woodpecker/build.yml

@@ -22,23 +22,109 @@ steps:
   deploy:
     image: docker
     commands: |
+      # ============================================================
+      # 蓝绿部署：零宕机切换 likedream-go 容器
+      # 判断当前代理使用的端口，另一个作为备用
+      # ============================================================
+
+      set -e
+
+      IMAGE_TAG="$CI_COMMIT_TAG"
+      if [ -z "$IMAGE_TAG" ]; then IMAGE_TAG="latest"; fi
+
       # 确保网络存在
       docker network create likedream-net 2>/dev/null || true
 
-      # 停止并删除旧容器
+      # 读取 1Panel 当前代理端口
+      CURRENT_PORT=$(docker exec 1Panel-openresty-ESmn \
+        grep -o 'proxy_pass http://10.10.10.128:[0-9]\+' \
+        /www/sites/tianshen/proxy/api.conf | grep -o '[0-9]\+$')
+      echo "=== 当前 1Panel 反代端口: $CURRENT_PORT ==="
+
+      if [ "$CURRENT_PORT" = "8091" ]; then
+        PORT_ACTIVE=8091
+        PORT_STANDBY=8092
+      elif [ "$CURRENT_PORT" = "8092" ]; then
+        PORT_ACTIVE=8092
+        PORT_STANDBY=8091
+      else
+        echo "未知当前端口 $CURRENT_PORT，默认使用 8091/8092"
+        PORT_ACTIVE=8091
+        PORT_STANDBY=8092
+      fi
+      echo "   活跃: $PORT_ACTIVE | 备用: $PORT_STANDBY"
+
+      # 清理之前可能残留的临时容器
+      docker rm -f likedream-go-new 2>/dev/null || true
+
+      echo "=== 蓝绿部署: 启动新容器 on :$PORT_STANDBY (image: $IMAGE_TAG) ==="
+
+      docker run -d --name likedream-go-new \
+        --restart unless-stopped \
+        --network likedream-net \
+        -p $PORT_STANDBY:8091 \
+        -v /opt/likedream-go/config.toml:/app/config.toml:ro \
+        likedream-go:$IMAGE_TAG
+
+      # 健康检查：等待新容器就绪
+      HEALTHY=false
+      for i in $(seq 1 15); do
+        if wget -q --timeout=3 -O /dev/null http://10.10.10.128:$PORT_STANDBY/health 2>/dev/null; then
+          HEALTHY=true
+          break
+        fi
+        echo "  等待新容器就绪... ($i/15)"
+        sleep 2
+      done
+
+      if [ "$HEALTHY" = false ]; then
+        echo "ERROR: 新容器未通过健康检查，回滚"
+        docker stop likedream-go-new
+        docker rm likedream-go-new
+        exit 1
+      fi
+      echo "   新容器已就绪 ✓"
+
+      # 切换 1Panel 代理到备用端口
+      echo "=== 切换 1Panel 反代 :$PORT_ACTIVE → :$PORT_STANDBY ==="
+      docker exec 1Panel-openresty-ESmn \
+        sed -i "s|:$PORT_ACTIVE|:$PORT_STANDBY|g" \
+        /www/sites/tianshen/proxy/api.conf
+      docker exec 1Panel-openresty-ESmn nginx -s reload
+      echo "   Nginx 热加载完成（零中断）✓"
+
+      # 停止旧容器
+      echo "=== 清理旧容器 ==="
       docker stop likedream-go 2>/dev/null || true
       docker rm likedream-go 2>/dev/null || true
 
-      # 启动新容器
-      docker run -d \
-        --name likedream-go \
+      # 在活跃端口启动正式容器
+      echo "=== 启动正式容器 on :$PORT_ACTIVE ==="
+      docker run -d --name likedream-go \
         --restart unless-stopped \
         --network likedream-net \
-        -p 8091:8091 \
+        -p $PORT_ACTIVE:8091 \
         -v /opt/likedream-go/config.toml:/app/config.toml:ro \
-        likedream-go:latest
+        likedream-go:$IMAGE_TAG
 
-      # 连接到 captcha 服务所在网络
+      # 连接到验证码服务网络
       docker network connect ocr-go_default likedream-go 2>/dev/null || true
+
+      # 切回 1Panel 代理到活跃端口
+      echo "=== 切回 1Panel 反代 :$PORT_STANDBY → :$PORT_ACTIVE ==="
+      docker exec 1Panel-openresty-ESmn \
+        sed -i "s|:$PORT_STANDBY|:$PORT_ACTIVE|g" \
+        /www/sites/tianshen/proxy/api.conf
+      docker exec 1Panel-openresty-ESmn nginx -s reload
+      echo "   Nginx 热加载完成（零中断）✓"
+
+      # 清理临时容器和旧镜像
+      echo "=== 清理 ==="
+      docker rm -f likedream-go-new 2>/dev/null || true
+      # 保留 latest 和最近 3 个 tag 镜像
+      docker images likedream-go --format '{{.Tag}}' | grep -v latest | head -n -3 | while read tag; do
+        docker rmi likedream-go:$tag 2>/dev/null || true
+      done
+      echo "=== 部署完成 ✓ ==="
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock

config.toml

@@ -20,8 +20,9 @@ key = "sk-acacac439b346036df45e90c85c177c375568ef72c469e49"
 [database]
 type = "mysql"
 dsn = "test_likedream_go:EpXckXmxawDEQGxJ@tcp(database.out:3306)/test_likedream_go?parseTime=true&loc=Asia%2FShanghai"
-dsn2 = "host=database.out user=dev password=JPmKjmpcaG3EYAJZ dbname=dev port=5432 sslmode=disable TimeZone=Asia/Shanghai"
-# host=localhost user=gorm password=gorm dbname=gorm port=9920 sslmode=disable TimeZone=Asia/Shanghai
+dsn2 = "host=pg.out user=dev password=JPmKjmpcaG3EYAJZ dbname=dev port=5432 sslmode=disable TimeZone=Asia/Shanghai"
+#type = "postgres"
+#dsn = "host=pg.out user=dev password=JPmKjmpcaG3EYAJZ dbname=dev port=5432 sslmode=disable TimeZone=Asia/Shanghai"
 [server]
 port = 8091
 url = "https://devocr.likedream.xyz"
@@ -35,8 +36,9 @@ balanceMigrateUrl = "http://localhost:3200/balance-migrate/"
 mode = "dev"
 
 [captcha]
-baseUrl = "http://captcha-resolver.out"
-#baseUrl = "http://localhost:8890"
+#baseUrl = "http://captcha-resolver.out"
+baseUrl = "http://likedream-go-captcha:8890"
+apiKey = "baca122..."
 [redis]
 url = "redis://:jhkdjhkjdhsIUTYURTU_pEGmFP@database.out:56379"
 

internal/application/captcha/captcha_func.go

@@ -16,13 +16,14 @@ func ApiSemiOCRVerification(bytes []byte, shape1, shape2 int64) string {
 	data := Bytes2Base64(bytes)
 	ctx := gctx.GetInitCtx()
 	baseUrl := g.Config().MustGetWithEnv(ctx, cst.ConfigCaptchaBaseUrl).String() + "/semiOcr"
+	apiKey := g.Config().MustGetWithEnv(ctx, cst.ConfigCaptchaApiKey).String()
 	client := httpclient.Cpdaily.Clone(ctx)
 	client.SetDoNotParseResponse(false)
 	post, err := client.R().SetBody(map[string]any{
 		"base64": data,
 		"shape1": shape1,
 		"shape2": shape2,
-	}).Post(baseUrl)
+	}).SetHeader("X-Api-Key", apiKey).Post(baseUrl)
 	utils.OkOrPanic(err, func(err error) error {
 		return oops.
 			With("SemiOCRVerification", baseUrl).
@@ -37,11 +38,12 @@ func ApiAutoOCRVerification(bytes []byte) string {
 	data := Bytes2Base64(bytes)
 	ctx := gctx.GetInitCtx()
 	baseUrl := g.Config().MustGetWithEnv(ctx, cst.ConfigCaptchaBaseUrl).String() + "/ocr"
+	apiKey := g.Config().MustGetWithEnv(ctx, cst.ConfigCaptchaApiKey).String()
 	client := httpclient.Cpdaily.Clone(ctx)
 	client.SetDoNotParseResponse(false)
 	post, err := client.R().SetBody(map[string]any{
 		"base64": data,
-	}).Post(baseUrl)
+	}).SetHeader("X-Api-Key", apiKey).Post(baseUrl)
 	utils.OkOrPanic(err, func(err error) error {
 		return oops.
 			With("AutoOCRVerification", baseUrl).
@@ -55,11 +57,12 @@ func ApiAutoOCRVerification(bytes []byte) string {
 func ApiAutoCalcVerification(b64 string) string {
 	ctx := gctx.GetInitCtx()
 	baseUrl := g.Config().MustGetWithEnv(ctx, cst.ConfigCaptchaBaseUrl).String() + "/calc"
+	apiKey := g.Config().MustGetWithEnv(ctx, cst.ConfigCaptchaApiKey).String()
 	client := httpclient.Cpdaily.Clone(ctx)
 	client.SetDoNotParseResponse(false)
 	post, err := client.R().SetBody(map[string]any{
 		"base64": b64,
-	}).Post(baseUrl)
+	}).SetHeader("X-Api-Key", apiKey).Post(baseUrl)
 	utils.OkOrPanic(err, func(err error) error {
 		return oops.
 			With("AutoOCRVerification", baseUrl).

internal/common/cst/config.go

@@ -15,6 +15,7 @@ const (
 	ConfigAuthorizationKey      = "server.authorization"
 	ConfigJwtKey                = "server.jwt"
 	ConfigCaptchaBaseUrl        = "captcha.baseUrl"
+	ConfigCaptchaApiKey         = "captcha.apiKey"
 	ConfigS3AccessKey           = "s3.accessKey"
 	ConfigS3SecretKey           = "s3.secretKey"
 	ConfigS3BaseUrl             = "s3.baseUrl"

internal/common/db/ent_db.go

@@ -33,18 +33,22 @@ func InitDB() {
 	Global = client
 	dbDsn2, err := g.Cfg().Get(gctx.New(), cst.ConfigDatabaseDsn2)
 	utils.OkOrPanic(err)
-	GlobalGorm, err = gorm.Open(postgres.Open(dbDsn2.String()), &gorm.Config{})
-	if err != nil {
-		logger.Logger.Fatal("连接pg数据库失败: %v", zap.Error(err))
+	// PG 数据库为可选配置，如果 dsn2 为空则跳过
+	if dbDsn2.String() != "" {
+		GlobalGorm, err = gorm.Open(postgres.Open(dbDsn2.String()), &gorm.Config{})
+		if err != nil {
+			logger.Logger.Warn("连接pg数据库失败, 跳过: %v", zap.Error(err))
+		} else {
+			// 可选：配置连接池
+			sqlDB, err := GlobalGorm.DB()
+			if err != nil {
+				logger.Logger.Warn("获取pg数据库实例失败, 跳过: %v", zap.Error(err))
+			} else {
+				// 设置连接池参数
+				sqlDB.SetMaxIdleConns(10)   // 设置空闲连接池中连接的最大数量
+				sqlDB.SetMaxOpenConns(100)  // 设置打开数据库连接的最大数量
+				sqlDB.SetConnMaxLifetime(0) // 设置连接可复用的最大时间（0表示永久）
+			}
+		}
 	}
-	// 可选：配置连接池
-	sqlDB, err := GlobalGorm.DB()
-	if err != nil {
-		logger.Logger.Fatal("获取数据库实例失败: %v", zap.Error(err))
-	}
-
-	// 设置连接池参数
-	sqlDB.SetMaxIdleConns(10)   // 设置空闲连接池中连接的最大数量
-	sqlDB.SetMaxOpenConns(100)  // 设置打开数据库连接的最大数量
-	sqlDB.SetConnMaxLifetime(0) // 设置连接可复用的最大时间（0表示永久）
 }

internal/service/user_login/user_info_service.go

@@ -270,6 +270,9 @@ func (s *UserInfoServiceV1) RequestBalanceMigrate(ctx context.Context, req *v1.R
 	}
 
 	// 查询旧系统数据库中是否存在该邮箱的用户
+	if db.GlobalGorm == nil {
+		return utils.SuccessWithMsg("如果该邮箱在旧系统中存在积分，转移链接已发送")
+	}
 	var oldUser AspNetUser
 	err := db.GlobalGorm.Table("AspNetUsers").Where("email = ?", oldSystemEmail).First(&oldUser).Error
 	if err != nil {
@@ -343,6 +346,9 @@ func (s *UserInfoServiceV1) BalanceMigrate(ctx context.Context, req *v1.BalanceM
 	}
 
 	// 查询旧系统用户
+	if db.GlobalGorm == nil {
+		return utils.FailParam("旧系统数据库未连接")
+	}
 	var oldUser AspNetUser
 	err := db.GlobalGorm.Table("AspNetUsers").Where("email = ?", oldSystemEmail).First(&oldUser).Error
 	if err != nil {