优化日志记录并改用非 root 运行

scripts/deploy-prod.sh

@@ -146,7 +146,7 @@ validate_env() {
     exit 1
   fi
 
-  local app_env caddy_domain caddy_email mysql_dsn redis_addr storage_endpoint
+  local app_env caddy_domain caddy_email mysql_dsn redis_addr storage_endpoint backend_uid backend_gid
   local minio_root_user minio_root_password storage_access_key_id storage_secret_access_key
   app_env="$(require_env APP_ENV)"
   caddy_domain="$(require_env CADDY_DOMAIN)"
@@ -163,6 +163,13 @@ validate_env() {
   minio_root_password="$(require_env MINIO_ROOT_PASSWORD)"
   storage_access_key_id="$(require_env STORAGE_ACCESS_KEY_ID)"
   storage_secret_access_key="$(require_env STORAGE_SECRET_ACCESS_KEY)"
+  backend_uid="$(require_env BACKEND_UID)"
+  backend_gid="$(require_env BACKEND_GID)"
+
+  if [[ ! "${backend_uid}" =~ ^[1-9][0-9]*$ || ! "${backend_gid}" =~ ^[1-9][0-9]*$ ]]; then
+    log_error "BACKEND_UID 和 BACKEND_GID 必须是大于 0 的数字，禁止后端容器使用 root"
+    exit 1
+  fi
 
   if [[ "${app_env}" != "production" ]]; then
     log_warn "APP_ENV 当前是 ${app_env}，生产部署建议改为 production"
@@ -353,7 +360,21 @@ health_url() {
 }
 
 prepare_log_dir() {
+  local backend_uid backend_gid owner_mismatch
+  backend_uid="$(require_env BACKEND_UID)"
+  backend_gid="$(require_env BACKEND_GID)"
   mkdir -p "${BACKEND_LOG_DIR}"
+  owner_mismatch="$(find "${BACKEND_LOG_DIR}" \( ! -uid "${backend_uid}" -o ! -gid "${backend_gid}" \) -print -quit)"
+  if [[ -n "${owner_mismatch}" ]]; then
+    if [[ "${EUID}" -ne 0 ]]; then
+      log_error "日志目录存在属主不匹配的文件：${owner_mismatch}"
+      log_error "请先执行：sudo chown -R ${backend_uid}:${backend_gid} ${BACKEND_LOG_DIR}"
+      exit 1
+    fi
+    log "修正日志目录属主为 ${backend_uid}:${backend_gid}..."
+    chown -R "${backend_uid}:${backend_gid}" "${BACKEND_LOG_DIR}"
+  fi
+  chmod 700 "${BACKEND_LOG_DIR}"
 }
 
 wait_service_healthy() {