From fe5ddf274b46a93b963199ce05e0742508dc9bda Mon Sep 17 00:00:00 2001
From: HomeDash Bot <bot@example.com>
Date: Sat, 12 Sep 2026 09:45:13 +0800
Subject: [PATCH] =?UTF-8?q?feat(deploy):=20=E9=A6=96=E8=A3=85=E8=84=9A?=
 =?UTF-8?q?=E6=9C=AC=E8=A1=A5=20TLS=20=E8=87=AA=E6=A3=80=EF=BC=88=E8=B7=B3?=
 =?UTF-8?q?=E8=BD=AC=E7=AB=AF=E5=8F=A3=20302=20/=20HTTP2=20=E5=8D=8F?=
 =?UTF-8?q?=E5=95=86=20/=20=E8=AF=81=E4=B9=A6=E5=8F=AF=E8=AF=BB=EF=BC=89?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

TLS 是有证书用户的主路径，之前只在生产手工验过、脚本没覆盖。补上后
NAVI_TLS=1 的首装会自己验证：http 跳转端口是否 302 到 https、入口能否
协商 HTTP/2（对应曾踩过的 listen … ssl http2 写法）、证书是否能读出主题。
---
 deploy/install-host.sh | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/deploy/install-host.sh b/deploy/install-host.sh
index c8378eb..78429f2 100755
--- a/deploy/install-host.sh
+++ b/deploy/install-host.sh
@@ -175,6 +175,16 @@ check "未知域名 → 自定义 404" 404 "$(code_of -k --resolve nobody.invali
 if [ -n "$DOMAIN" ]; then
   check "门户 $DOMAIN" 200 "$(code_of -k --resolve "${DOMAIN}:${ENTRY_PORT}:127.0.0.1" "${SCHEME}://${DOMAIN}:${ENTRY_PORT}/")"
 fi
+if [ "$TLS" = "1" ]; then
+  # TLS 路径自检：跳转端口必须 302 到 https，且入口要能协商 HTTP/2
+  # （曾踩过：nginx 1.22 不认独立的 http2 on;，必须写成 listen … ssl http2;）
+  check "http→https 跳转" 302 "$(code_of --resolve "nobody.invalid:${REDIRECT_PORT}:127.0.0.1" "http://nobody.invalid:${REDIRECT_PORT}/")"
+  HV="$(curl -sk -o /dev/null -w '%{http_version}' -m 8 "${SCHEME}://127.0.0.1:${ENTRY_PORT}/" 2>/dev/null || echo '?')"
+  if [ "$HV" = "2" ] || [ "$HV" = "2.0" ]; then echo "  ✓ HTTP/2 协商 → $HV"; else echo "  ! HTTP 版本为 $HV（HTTP/2 与客户端支持有关，仅提示）"; fi
+  CERT_SUBJ="$(echo | openssl s_client -connect 127.0.0.1:${ENTRY_PORT} -servername "${DOMAIN:-localhost}" 2>/dev/null | openssl x509 -noout -subject 2>/dev/null || true)"
+  echo "  证书: ${CERT_SUBJ:-未能读取（仅提示）}"
+fi
+
 echo "  容器状态：$(docker inspect navi --format '{{.State.Status}} {{if .State.Health}}{{.State.Health.Status}}{{end}}')"
 
 [ "$fail" = 0 ] || die "自检未全绿，请按上面 ✗ 项排查（容器保留未删除，便于查看日志）"