fix(admin): 后台后端改博客域同源反代——绕开 git 域 522

git.wait4x.online 公网 522（源站侧待查）卡死 Sveltia 登录。
config.yml backend 改 base_url=https://wait4x.online/gitea +
api_root=.../api/v1；新增运维脚本给博客 vhost 加 /gitea/ 反代
→127.0.0.1:13020（Host 伪 git 域、no-store、noindex；幂等+-t 门
禁+回滚+双口径终验）。同源后 CORS 问题一并消失。

验证: yaml 解析过；pnpm astro build；bash -n 过

Spec: none (后台可用性修复)

Co-authored-by: GLM-5.3

public/admin/config.yml

@@ -5,8 +5,10 @@ backend:
   name: gitea
   repo: wait4x/blog
   branch: main
-  base_url: https://git.wait4x.online
-  api_root: https://git.wait4x.online/api/v1
+  # 走博客域同源反代（nginx /gitea/ → 127.0.0.1:13020）：
+  # ①绕开 git.wait4x.online 的 ESA 522 ②同源无 CORS ③ESA 缓存规则已排除 /artalk/api
+  base_url: https://wait4x.online/gitea
+  api_root: https://wait4x.online/gitea/api/v1
 
 media_folder: content/photos
 site_url: https://wait4x.online

scripts/ops/add-gitea-proxy.sh

@@ -0,0 +1,60 @@
+#!/usr/bin/env bash
+# 给博客 vhost 加 /gitea/ 同源反代 → 127.0.0.1:13020（Sveltia 后台用）
+# 目的：绕开 git.wait4x.online 的 ESA 522、消 CORS；幂等 + -t 门禁 + 回滚
+set -euo pipefail
+DEFAULT=/etc/nginx/sites-enabled/default
+BAK=/tmp/add-gitea-proxy-bak-$(date +%s)
+BLOCK='    location /gitea/ {
+        proxy_pass http://127.0.0.1:13020/;
+        proxy_set_header Host git.wait4x.online;
+        proxy_set_header X-Forwarded-Proto https;
+        proxy_set_header X-Real-IP $remote_addr;
+        add_header Cache-Control "no-store" always;
+        add_header X-Robots-Tag noindex always;
+    }'
+
+echo "==== ① 现状 ===="
+grep -q "location /gitea/" "$DEFAULT" && echo "（已存在 /gitea/ 反代，将重写）" || echo "（未配置 /gitea/ 反代）"
+
+echo
+echo "==== ② 计划 ===="
+echo "  在博客 server 块（server_name wait4x.online;）内插入 /gitea/ 反代 → 127.0.0.1:13020"
+
+echo
+read -rp ">> 执行？(y/N) " ok; [ "$ok" = "y" ] || { echo "已取消"; exit 0; }
+
+cp "$DEFAULT" "$BAK"
+python3 - "$DEFAULT" <<'PY'
+import re, sys
+path = sys.argv[1]
+src = open(path, encoding='utf-8').read()
+block = '''    location /gitea/ {
+        proxy_pass http://127.0.0.1:13020/;
+        proxy_set_header Host git.wait4x.online;
+        proxy_set_header X-Forwarded-Proto https;
+        proxy_set_header X-Real-IP $remote_addr;
+        add_header Cache-Control "no-store" always;
+        add_header X-Robots-Tag noindex always;
+    }
+'''
+src = re.sub(r'[ \t]*location /gitea/ \{[^}]*\}\n', '', src)   # 幂等：先删旧块
+if 'server_name wait4x.online;' not in src:
+    sys.exit('未找到博客 server_name，中止')
+src = src.replace('server_name wait4x.online;', 'server_name wait4x.online;\n' + block, 1)
+open(path, 'w', encoding='utf-8').write(src)
+print('已插入 /gitea/ 反代')
+PY
+
+echo
+echo "==== ③ 门禁 ===="
+if ! nginx -t; then echo "!! 语法失败，回滚"; cp "$BAK" "$DEFAULT"; nginx -t && systemctl reload nginx; exit 1; fi
+systemctl reload nginx && echo "  nginx 已重载"
+
+echo
+echo "==== ④ 终验 ===="
+echo -n "  本地反代: "; curl -s -o /dev/null -w '%{http_code}\n' --noproxy '*' -m 6 -H "Host: wait4x.online" http://127.0.0.1/gitea/api/v1/version 2>/dev/null || echo "(80 未监听属正常，走 443)"
+echo -n "  公网反代: "; curl -s --compressed --noproxy '*' -m 10 -o /dev/null -w '%{http_code}\n' https://wait4x.online/gitea/api/v1/version
+echo -n "  版本响应: "; curl -s --compressed --noproxy '*' -m 10 https://wait4x.online/gitea/api/v1/version
+rm -f "$BAK"
+echo
+echo "  公网反代 200 即成功。随后打开 https://wait4x.online/admin/ 用 gitea 令牌登录。"