From a5ecda3ef130c3d8ee775d6742b8f0cc626c8d07 Mon Sep 17 00:00:00 2001
From: lookt <lookt@local>
Date: Tue, 15 Sep 2026 20:20:45 +0800
Subject: [PATCH] =?UTF-8?q?service:=20=E8=BF=90=E8=A1=8C=E7=94=A8=E6=88=B7?=
 =?UTF-8?q?=E8=B0=83=E6=95=B4=20+=20=E9=83=A8=E7=BD=B2=E6=8E=A2=E6=B5=8B?=
 =?UTF-8?q?=E8=84=9A=E6=9C=AC?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 deploy/a-stock-timeline.service |  3 ++-
 deploy/probe_server.py          | 28 ++++++++++++++++++++++++++++
 2 files changed, 30 insertions(+), 1 deletion(-)
 create mode 100644 deploy/probe_server.py

diff --git a/deploy/a-stock-timeline.service b/deploy/a-stock-timeline.service
index b50f2d8..0d67a48 100644
--- a/deploy/a-stock-timeline.service
+++ b/deploy/a-stock-timeline.service
@@ -10,7 +10,8 @@ WorkingDirectory=/opt/a_stock_timeline
 ExecStart=/opt/a_stock_timeline/venv/bin/python -m src.web.server
 Restart=always
 RestartSec=5
-User=www-data
+# 内部单机部署以 root 运行；生产建议改为专用低权限用户并收紧数据目录权限
+User=root
 Environment=PORT=8100
 # 日志进 journald：journalctl -u a-stock-timeline -f
 
diff --git a/deploy/probe_server.py b/deploy/probe_server.py
new file mode 100644
index 0000000..0b0e0d5
--- /dev/null
+++ b/deploy/probe_server.py
@@ -0,0 +1,28 @@
+# -*- coding: utf-8 -*-
+"""探测目标服务器环境（SSH 只读探测，不做变更）"""
+import paramiko
+
+HOST, USER, PWD = '10.20.226.110', 'root', 'tzt123@123'
+
+cli = paramiko.SSHClient()
+cli.set_missing_host_key_policy(paramiko.AutoAddPolicy())
+cli.connect(HOST, username=USER, password=PWD, timeout=10)
+
+CMDS = [
+    ('系统', 'cat /etc/os-release 2>/dev/null | head -2 || uname -a'),
+    ('内核', 'uname -r'),
+    ('python3', 'python3 --version 2>&1; which python3'),
+    ('git', 'git --version 2>&1'),
+    ('venv模块', 'python3 -m venv --help >/dev/null 2>&1 && echo venv-ok || echo venv-missing'),
+    ('防火墙', 'systemctl is-active firewalld 2>/dev/null; systemctl is-active ufw 2>/dev/null; iptables -L INPUT -n 2>/dev/null | head -3'),
+    ('8100占用', 'ss -tlnp 2>/dev/null | grep 8100 || echo 空闲'),
+    ('/opt可写', 'test -d /opt && echo opt-exists; touch /opt/.wtest 2>/dev/null && rm /opt/.wtest && echo opt-writable'),
+    ('外网(pypi)', 'curl -s -o /dev/null -w "%{http_code}" --max-time 8 https://pypi.tuna.tsinghua.edu.cn/simple/ || echo unreachable'),
+]
+for label, cmd in CMDS:
+    _, out, err = cli.exec_command(cmd, timeout=20)
+    o = out.read().decode('utf-8', 'ignore').strip()
+    e = err.read().decode('utf-8', 'ignore').strip()
+    print('【{}】{}'.format(label, o or e or '(空)'))
+
+cli.close()