存储抽象(internal/storage,新包)
- BlobStore 接口(Put / Open / Delete)+ 两个实现:R2(aws-sdk-go-v2 走
R2 的 S3 兼容 API,path-style、region auto)与本地磁盘(DataDir/uploads,
零配置兜底)。选择:Endpoint / S3Api / Bucket / AccessKey / SecretAccessKey
齐全 → R2,缺任一项回落本地并在启动日志提示缺失的字段名(只报名字不报值)
- 端点 URL 里的路径段不交给 SDK:path-style 下它会被折进对象 key,
导致「数据库 key」和「实际对象 key」对不上(直链 404,实测复现)。
EndpointKeyPrefix 提取路径段给上传 handler 拼进 key,StripEndpointPath
只取 scheme://host 给 SDK——数据库 / 存储端 / 直链三方一致
数据与 API
- files 表:id / key(唯一) / name / mime / size / sha256 / store(r2|local) /
created_at;URL 不入库,按「store 来源 + PublicBase」响应时解析,
切存储端不破坏存量链接
- POST /api/admin/files:multipart 多文件,单文件 ≤50MB(MaxBytesReader 64MB);
类型白名单 = 图片(jpg/png/webp/gif/avif)+ 附件(pdf/zip/txt),
扩展名 + http.DetectContentType 双重校验(实测拦截随机字节改名 .png),
SVG 拒绝(同源脚本);内容 sha256 做 key(2026/09/{哈希前12位}{扩展名}),
同内容重复上传自动去重复用
- GET /api/admin/files(分页 + 文件名搜索)、DELETE /{id}(先删对象再删行,
存储端失败保留行可重试)
- 公开路由 GET /uploads/{key}(main.go 挂载):按 key 查行、存储层流式返回,
Cache-Control immutable + ETag 304;R2 + PublicBase 时 302 直链(后端不出流量)
- URL 解析:FileURL(store, key, PublicBase)——R2 且配了公开域名走直链,
否则 /uploads/ 流式
后台文件管理页(FilesView,「工作台 → 文件」)
- 点击 / 拖拽多选上传(uploadFiles 走 FormData 裸 fetch,401 广播与
request() 一致);缩略图卡片网格(图片出图、其他出类型占位);
复制链接(clipboard,非 https 回落 prompt)/ 打开 / 删除(确认提示);
分页、loading/empty 沿用既有模式
编辑器联动(EditorView)
- 封面:URL 输入框旁「上传」按钮,选图自动填 cover_url
- wysiwyg:Crepe ImageBlock 官方 onUpload 钩子——粘贴 / 拖拽 / 插图
全部走上传,返回 URL 后由 Crepe 插节点
- Markdown 模式:插图弹层加「上传」按钮 + 编辑器粘贴 / 拖拽图片,
上传后在原光标处插入 (异步上传先记光标位,逐张追踪偏移)
.env.example
- 模板入库(无敏感值):Endpoint = 公开访问域名(直链)、S3Api = 上传端点、
Bucket / AccessKey / SecretAccessKey
验证
- 本地兜底全流程:上传 201、同内容去重复用、随机字节改名 .png 被
内容嗅探拒绝、.svg 拒绝、公开路由 immutable 缓存头 + 内容一致、
删除后存储与公开路由双清 404
- R2 真实链路(站主 .env):上传 store=r2、直链 200(过程中定位并修复
S3Api 路径段折进 key 导致的直链 404,见 EndpointKeyPrefix)
- 后端 go build/test/vet 全绿;前端构建通过
133 lines
3.7 KiB
Go
133 lines
3.7 KiB
Go
package config
|
||
|
||
import (
|
||
"crypto/rand"
|
||
"encoding/hex"
|
||
"log"
|
||
"os"
|
||
"path/filepath"
|
||
"strings"
|
||
)
|
||
|
||
type Config struct {
|
||
Addr string
|
||
Driver string // sqlite | postgres
|
||
DSN string
|
||
AdminUser string
|
||
AdminPass string
|
||
SessionSec string
|
||
WebDist string
|
||
DataDir string
|
||
SiteURL string
|
||
InsecureDev bool
|
||
|
||
// 对象存储(文件上传)。变量名与站主 .env 里的写法一致(站主已整理):
|
||
// S3Api = R2 的 S3 API 端点(https://<账户ID>.r2.cloudflarestorage.com,
|
||
// 控制台 R2 概览可复制),上传走它 —— 公开域名收不了上传请求
|
||
// PublicURL = 公开访问域名(r2.dev / 绑定的自定义域名),文件直链走它
|
||
// AccessKey / SecretAccessKey / Bucket = R2 凭据与桶名
|
||
// 五项齐全 → 上传走 R2、直链走 PublicURL;缺任一项回落本地磁盘
|
||
// (DataDir/uploads),并在启动日志提示一句。
|
||
StorageDriver string // r2 | local
|
||
S3Endpoint string // env: S3Api
|
||
R2Bucket string
|
||
R2AccessKey string
|
||
R2SecretKey string
|
||
UploadsPublicBase string // env: PublicURL
|
||
}
|
||
|
||
func getenv(k, def string) string {
|
||
if v := strings.TrimSpace(os.Getenv(k)); v != "" {
|
||
return v
|
||
}
|
||
return def
|
||
}
|
||
|
||
func Load() (*Config, error) {
|
||
root := getenv("ONE_ROOT", "")
|
||
if root == "" {
|
||
if wd, err := os.Getwd(); err == nil {
|
||
root = filepath.Dir(wd) // server/ -> repo root
|
||
} else {
|
||
root = "."
|
||
}
|
||
}
|
||
|
||
c := &Config{
|
||
Addr: getenv("ONE_ADDR", ":8080"),
|
||
Driver: strings.ToLower(getenv("ONE_DB_DRIVER", "sqlite")),
|
||
AdminUser: getenv("ONE_ADMIN_USER", "admin"),
|
||
AdminPass: getenv("ONE_ADMIN_PASSWORD", "admin"),
|
||
SessionSec: getenv("ONE_SECRET", ""),
|
||
WebDist: getenv("ONE_WEB_DIST", filepath.Join(root, "frontend", "dist")),
|
||
DataDir: getenv("ONE_DATA_DIR", filepath.Join(root, "data")),
|
||
SiteURL: getenv("ONE_SITE_URL", "http://localhost:8080"),
|
||
}
|
||
|
||
if c.Driver == "" {
|
||
c.Driver = "sqlite"
|
||
}
|
||
if c.Driver != "sqlite" && c.Driver != "postgres" && c.Driver != "postgresql" {
|
||
return nil, &badDriver{c.Driver}
|
||
}
|
||
if c.Driver == "postgresql" {
|
||
c.Driver = "postgres"
|
||
}
|
||
|
||
if c.DSN = getenv("ONE_DB_DSN", ""); c.DSN == "" {
|
||
if c.Driver == "sqlite" {
|
||
c.DSN = filepath.Join(c.DataDir, "one.db")
|
||
} else {
|
||
c.DSN = "postgres://localhost/one?sslmode=disable"
|
||
}
|
||
}
|
||
|
||
if c.SessionSec == "" {
|
||
b := make([]byte, 32)
|
||
if _, err := rand.Read(b); err != nil {
|
||
return nil, err
|
||
}
|
||
c.SessionSec = hex.EncodeToString(b)
|
||
}
|
||
|
||
c.InsecureDev = os.Getenv("ONE_ADMIN_PASSWORD") == ""
|
||
|
||
// 对象存储:变量名按站主 .env 里整理好的来(无 ONE_ 前缀)。
|
||
c.UploadsPublicBase = strings.TrimRight(getenv("PublicURL", ""), "/")
|
||
c.S3Endpoint = getenv("S3Api", "")
|
||
c.R2AccessKey = getenv("AccessKey", "")
|
||
c.R2SecretKey = getenv("SecretAccessKey", "")
|
||
c.R2Bucket = getenv("Bucket", "")
|
||
if c.S3Endpoint != "" && c.R2Bucket != "" && c.R2AccessKey != "" && c.R2SecretKey != "" {
|
||
c.StorageDriver = "r2"
|
||
} else {
|
||
c.StorageDriver = "local"
|
||
// 配了一半(有凭据没端点之类)时给一句启动日志,别让站主猜。
|
||
// 只报字段名,不报值。
|
||
var missing []string
|
||
if c.S3Endpoint == "" {
|
||
missing = append(missing, "S3Api")
|
||
}
|
||
if c.R2Bucket == "" {
|
||
missing = append(missing, "Bucket")
|
||
}
|
||
if c.R2AccessKey == "" {
|
||
missing = append(missing, "AccessKey")
|
||
}
|
||
if c.R2SecretKey == "" {
|
||
missing = append(missing, "SecretAccessKey")
|
||
}
|
||
if len(missing) > 0 {
|
||
log.Printf("storage: R2 配置缺 %s,上传回落本地磁盘", strings.Join(missing, "、"))
|
||
}
|
||
}
|
||
|
||
return c, nil
|
||
}
|
||
|
||
type badDriver struct{ d string }
|
||
|
||
func (e *badDriver) Error() string {
|
||
return "unsupported ONE_DB_DRIVER: " + e.d + " (use sqlite or postgres)"
|
||
}
|