From dda40d89ec11b51691b01669aede9ee76936eeec Mon Sep 17 00:00:00 2001
From: "douboer@gmail.com" <gavin@gavinm4.local>
Date: Sun, 26 Jul 2026 10:52:38 +0800
Subject: [PATCH] update at 2026-07-26 10:52:38

---
 deploy.sh | 21 ++++++++++++++-------
 1 file changed, 14 insertions(+), 7 deletions(-)

diff --git a/deploy.sh b/deploy.sh
index 4658a70..8c0e76e 100755
--- a/deploy.sh
+++ b/deploy.sh
@@ -47,13 +47,19 @@ load_sudo_password() {
 
   local line secret='' plain_lines=()
   while IFS= read -r line || [[ -n "$line" ]]; do
-    case "$line" in
-      MYWEB_SUDO_PASSWORD=*|SUDO_PASSWORD=*) secret="${line#*=}" ;;
-      ''|'#'*) ;;
-      *) plain_lines+=("$line") ;;
-    esac
+    if [[ "$line" =~ ^[[:space:]]*(MYWEB_SUDO_PASSWORD|SUDO_PASSWORD|MYWEB_PASS)[[:space:]]*=[[:space:]]*(.*)$ ]]; then
+      secret="${BASH_REMATCH[2]}"
+    elif [[ -z "${line//[[:space:]]/}" || "$line" == \#* ]]; then
+      continue
+    else
+      plain_lines+=("$line")
+    fi
   done < .env
 
+  # 去除键值分隔符附近的空白，避免 `KEY = value` 将空格传给 sudo。
+  secret="${secret#"${secret%%[![:space:]]*}"}"
+  secret="${secret%"${secret##*[![:space:]]}"}"
+
   if [[ -z "$secret" && ${#plain_lines[@]} -eq 1 ]]; then
     secret="${plain_lines[0]}"
   fi
@@ -144,8 +150,9 @@ apply_nginx_and_restart() {
     return
   fi
   load_sudo_password
-  log_info '从 .env 读取 sudo 密码，用于安装配置、校验并重载 Nginx。'
-  printf '%s\n' "$MYWEB_SUDO_PASSWORD" | ssh -tt -o ConnectTimeout=12 "$SERVER_WEB" "sudo -S -p '' install -m 644 '$REMOTE_WORKDIR/fonts.conf' /etc/nginx/conf.d/fonts.conf && sudo -S -p '' nginx -t && sudo -S -p '' systemctl reload nginx && sudo -S -p '' systemctl restart font2svg-api"
+  log_info '使用 .env 中的凭据执行 Nginx 配置与服务重启。'
+  # 禁用伪终端，避免标准输入中的敏感内容被远端终端回显。
+  printf '%s\n' "$MYWEB_SUDO_PASSWORD" | ssh -T -o ConnectTimeout=12 "$SERVER_WEB" "sudo -S -p '' bash -lc 'install -m 644 \"$REMOTE_WORKDIR/fonts.conf\" /etc/nginx/conf.d/fonts.conf && nginx -t && systemctl reload nginx && systemctl restart font2svg-api'"
   log_ok 'Nginx 已重载，Font2SVG API 已重启'
 }