Upload Dockerfile

Dockerfile

@@ -904,34 +904,48 @@ for i in $(seq 1 60); do
   sleep 2
 done
 
-# ── 3. code-server 不再預先啟動，改為按需啟動（由 watchdog 管理）────────────
-# watchdog 會監聽 nginx access log，首次請求 /ide/ 時才啟動 code-server，
-# 超過 IDE_IDLE_MINUTES 分鐘無請求則自動關閉以釋放資源
-mkdir -p /root/.openclaw/logs /root/.code-server /root/.config/code-server
-
-IDE_IDLE_MINUTES="${IDE_IDLE_MINUTES:-10}"
-
-# 預先寫入 config.yaml，確保啟動時端口正確（防止 code-server 讀 $PORT=7860）
+# ── 3. 啟動 code-server（後台，僅本機監聽）──────────────────────────────────
+# 注意：code-server 已移除 --base-path 參數，subpath 由 nginx 的 proxy_pass 末尾 / 處理
+mkdir -p /root/.openclaw/logs /root/.code-server
+
+# 強制寫入 config.yaml，確保 bind-addr 正確。
+# code-server 會讀取 $PORT 環境變量作為端口（HF 注入 PORT=7860），
+# 無論 --bind-addr 還是 config.yaml，$PORT 都可能覆蓋端口設置。
+# 解決方案：先寫入 config.yaml 指定正確端口，再 unset PORT 後啟動。
+mkdir -p /root/.config/code-server
 cat > /root/.config/code-server/config.yaml <<CODESERVERCFG
 bind-addr: 127.0.0.1:${CODE_SERVER_PORT}
 auth: password
 password: ${CODE_SERVER_PASSWORD:-changeme123!}
 cert: false
 CODESERVERCFG
-echo "code-server config.yaml pre-written (bind-addr: 127.0.0.1:${CODE_SERVER_PORT})"
+echo "code-server config.yaml written (bind-addr: 127.0.0.1:${CODE_SERVER_PORT})"
+
+# unset PORT：防止 code-server 讀取 $PORT=7860 覆蓋我們設定的端口
+( unset PORT; code-server \
+    --disable-telemetry \
+    --disable-update-check \
+    --user-data-dir /root/.code-server \
+    --extensions-dir /root/.code-server/extensions \
+    /root/.openclaw \
+    2>&1 | tee /root/.openclaw/logs/code-server.log ) &
+echo "code-server launched (port=${CODE_SERVER_PORT})"
+
+# 等待 code-server 端口就緒（最多 60 秒）
+echo "Waiting for code-server on port ${CODE_SERVER_PORT}..."
+for i in $(seq 1 30); do
+  if curl -fsS http://127.0.0.1:${CODE_SERVER_PORT}/ >/dev/null 2>&1; then
+    echo "code-server is up after $((i * 2))s."
+    break
+  fi
+  sleep 2
+done
 
 # ── 4. 生成 nginx 配置並啟動 ────────────────────────────────────────────────
+# nginx 不支持 bash 變量語法，所有動態值通過 sed 替換佔位符寫入
 rm -f /etc/nginx/sites-enabled/default /etc/nginx/conf.d/default.conf
 
-# 使用命名管道（fifo）讓 nginx 把 /ide/ 的訪問日誌寫給 watchdog
-IDE_PIPE=/tmp/nginx-ide-access.pipe
-rm -f "${IDE_PIPE}"
-mkfifo "${IDE_PIPE}"
-
 cat > /etc/nginx/conf.d/openclaw-ide.conf <<'NGINX'
-# 專用日誌格式：只記錄時間戳
-log_format ide_hit '$time_iso8601';
-
 server {
     listen PLACEHOLDER_LISTEN_PORT;
     server_name _;
@@ -940,12 +954,19 @@ server {
     access_log /dev/stdout;
     error_log  /dev/stderr warn;
 
+    # 關鍵：Cloudflare 做 SSL 終結，nginx 只收到 http 請求。
+    # 若 nginx 生成絕對 URL（如 301/302 Location），會帶上 http://host:PORT，
+    # 導致瀏覽器被重定向到帶明確端口的 http URL，被 Cloudflare 拒絕（400 Bad Request）。
+    # absolute_redirect off  → 所有 nginx 內部重定向（含 proxy_redirect）輸出相對路徑
+    # port_in_redirect off   → 禁止 nginx 在重定向 URL 中附加監聽端口
     absolute_redirect off;
     port_in_redirect off;
 
-    # IDE：代理到 code-server，同時把訪問記錄寫到命名管道供 watchdog 讀取
+    # IDE（code-server）：nginx 剝離 /ide/ 前綴後轉發到 code-server 根路徑
+    # proxy_pass 末尾帶 / 是關鍵：nginx 自動將 /ide/xxx 重寫為 /xxx 再轉發
+    # proxy_redirect：code-server 登錄後發 302 跳轉到 /，需重寫回 /ide/
+    # 由於 absolute_redirect off，這裡輸出的是相對路徑，不帶 scheme/host/port
     location /ide/ {
-        access_log PLACEHOLDER_IDE_PIPE ide_hit;
         proxy_pass http://127.0.0.1:PLACEHOLDER_CODE_SERVER_PORT/;
         proxy_http_version 1.1;
         proxy_set_header Host $host;
@@ -972,80 +993,17 @@ server {
 NGINX
 
 sed -i \
-  "s|PLACEHOLDER_LISTEN_PORT|${LISTEN_PORT}|g;
-   s|PLACEHOLDER_CODE_SERVER_PORT|${CODE_SERVER_PORT}|g;
-   s|PLACEHOLDER_GATEWAY_PORT|${GATEWAY_PORT}|g;
-   s|PLACEHOLDER_IDE_PIPE|${IDE_PIPE}|g" \
+  "s/PLACEHOLDER_LISTEN_PORT/${LISTEN_PORT}/g;
+   s/PLACEHOLDER_CODE_SERVER_PORT/${CODE_SERVER_PORT}/g;
+   s/PLACEHOLDER_GATEWAY_PORT/${GATEWAY_PORT}/g" \
   /etc/nginx/conf.d/openclaw-ide.conf
 
 echo "nginx config:"
 cat /etc/nginx/conf.d/openclaw-ide.conf
 
 nginx -t
-nginx -g 'daemon off; error_log /dev/stderr warn;' &
-NGINX_PID=$!
-echo "nginx started (PID=${NGINX_PID})"
-
-# ── 5. code-server watchdog（按需啟動/自動關閉）────────────────────────────
-(
-  CS_PID=""
-  LAST_ACCESS=0
-  IDLE_SECONDS=$((IDE_IDLE_MINUTES * 60))
-
-  # 後台超時檢查循環（每 30 秒一次）
-  (
-    while true; do
-      sleep 30
-      if [ -n "${CS_PID}" ] && kill -0 "${CS_PID}" 2>/dev/null; then
-        NOW=$(date +%s)
-        IDLE=$((NOW - LAST_ACCESS))
-        if [ ${IDLE} -ge ${IDLE_SECONDS} ]; then
-          echo "[ide-watchdog] Idle ${IDLE}s >= ${IDLE_SECONDS}s, stopping code-server (PID=${CS_PID})"
-          kill "${CS_PID}" 2>/dev/null || true
-          CS_PID=""
-        fi
-      fi
-    done
-  ) &
-
-  echo "[ide-watchdog] Watching ${IDE_PIPE} (idle timeout: ${IDE_IDLE_MINUTES}min)"
-
-  while true; do
-    if read -r _line < "${IDE_PIPE}"; then
-      LAST_ACCESS=$(date +%s)
-      if [ -z "${CS_PID}" ] || ! kill -0 "${CS_PID}" 2>/dev/null; then
-        echo "[ide-watchdog] First request, starting code-server..."
-        # 重新寫入 config.yaml 防止被其他進程覆蓋
-        cat > /root/.config/code-server/config.yaml <<CODESERVERCFG2
-bind-addr: 127.0.0.1:${CODE_SERVER_PORT}
-auth: password
-password: ${CODE_SERVER_PASSWORD:-changeme123!}
-cert: false
-CODESERVERCFG2
-        ( unset PORT; code-server \
-            --disable-telemetry \
-            --disable-update-check \
-            --user-data-dir /root/.code-server \
-            --extensions-dir /root/.code-server/extensions \
-            /root/.openclaw \
-            >> /root/.openclaw/logs/code-server.log 2>&1 ) &
-        CS_PID=$!
-        echo "[ide-watchdog] code-server started (PID=${CS_PID})"
-        # 等待 code-server 端口就緒（最多 10 秒），避免首個請求 502
-        for _w in $(seq 1 10); do
-          sleep 1
-          curl -fsS http://127.0.0.1:${CODE_SERVER_PORT}/ >/dev/null 2>&1 && break
-        done
-      fi
-    fi
-  done
-) &
-
-echo "code-server watchdog started (idle timeout: ${IDE_IDLE_MINUTES} minutes)"
-echo "code-server will start on first /ide/ request and stop after ${IDE_IDLE_MINUTES}min idle"
-
-# nginx 前台持續運行
-wait ${NGINX_PID}
+echo "Starting nginx (foreground)..."
+exec nginx -g 'daemon off; error_log /dev/stderr warn;'
 EOF
 
 RUN chmod +x /usr/local/bin/start-openclaw-code-server