ci: 归档 ECS 专用工作流；新增 NAS 自动部署流水线

ci/archive/ecs-workflows/set-admin-pass.yml

@@ -0,0 +1,30 @@
+name: set admin password (manual)
+
+# 已于 2026-08-02 执行一次:把生产超管口令从默认 admin123 改成强口令(堵公网默认口令洞)。
+# ★口令已抹除、只保留手动触发(不再随推送自动跑,避免误改回)。要再改口令:
+#   把下面 PW='...' 填成新口令,在 Actions 页手动 Run 一次,跑完再抹掉。
+on:
+  workflow_dispatch: {}
+
+jobs:
+  setpw:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Write ADMIN_PASS/ADMIN_USER to prod .env + restart
+        uses: appleboy/ssh-action@v1
+        with:
+          host: ${{ secrets.ECS_HOST }}
+          username: ${{ secrets.ECS_USER }}
+          password: ${{ secrets.ECS_PASSWORD }}
+          command_timeout: 5m
+          script: |
+            set -e
+            cd /var/www/digitalme-api.invoratec.cn
+            [ -f .env ] || { echo "❌ 生产 .env 缺失"; exit 1; }
+            PW='__FILL_NEW_PASSWORD__'
+            [ "$PW" = '__FILL_NEW_PASSWORD__' ] && { echo "未填新口令,退出(避免误改)"; exit 0; }
+            if grep -q '^ADMIN_PASS=' .env; then sed -i "s#^ADMIN_PASS=.*#ADMIN_PASS=$PW#" .env; else echo "ADMIN_PASS=$PW" >> .env; fi
+            grep -q '^ADMIN_USER=' .env || echo "ADMIN_USER=admin" >> .env
+            pm2 restart digitalme-api --update-env
+            sleep 5
+            H=$(curl -sf http://localhost:3603/health || true); echo "$H" | grep -q '"ok":true' && echo "✓ 已带新口令重启" || { echo "❌ 后端没起来"; exit 1; }