fix: remove conflicting production IM CORS header

.gitea/workflows/deploy.yml

@@ -68,14 +68,14 @@ jobs:
           ssh "${SSH_ARGS[@]}" "$DEPLOY_USER@$DEPLOY_HOST" \
             "cd /opt/olns && docker compose pull im-server && docker compose up -d --no-deps --wait im-server"
 
-      - name: Inspect production IM CORS routing
+      - name: Ensure production IM CORS routing
         env:
           DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
           DEPLOY_KNOWN_HOSTS: ${{ secrets.DEPLOY_KNOWN_HOSTS }}
         run: |
           set -euo pipefail
           install -d -m 700 "$HOME/.ssh"
-          KEY_FILE="$(mktemp "$HOME/.ssh/olns-diagnose.XXXXXX")"
+          KEY_FILE="$(mktemp "$HOME/.ssh/olns-cors.XXXXXX")"
           cleanup() {
             shred -u "$KEY_FILE" 2>/dev/null || true
           }
@@ -86,21 +86,12 @@ jobs:
           chmod 600 "$HOME/.ssh/known_hosts"
           SSH_ARGS=(-i "$KEY_FILE" -o BatchMode=yes -o StrictHostKeyChecking=yes)
           ssh "${SSH_ARGS[@]}" "$DEPLOY_USER@$DEPLOY_HOST" '
-            set -e
+            set -euo pipefail
-            echo "Production compose services:"
             cd /opt/olns
-            docker compose config --services
+            cp Caddyfile "config-backups/Caddyfile.$(date -u +%Y%m%dT%H%M%SZ).before-im-cors"
-            echo "IM API and CORS routing references:"
+            perl -0pi -e '"'"'s/\n[ \t]*header \{\n[ \t]*Access-Control-Allow-Origin "https:\/\/im\.yuexuan\.shop"\n[ \t]*Vary "Origin"\n[ \t]*\}\n/\n/'"'"' Caddyfile
-            grep -RIn \
+            count="$(grep -A20 -F "im-api.yuexuan.shop {" Caddyfile | grep -Fc '"'"'Access-Control-Allow-Origin "https://im.yuexuan.shop"'"'"' || true)"
-              --include="Caddyfile" \
+            test "$count" -eq 1
-              --include="*.caddy" \
+            docker compose exec -T caddy caddy validate --config /etc/caddy/Caddyfile --adapter caddyfile
-              --include="*.conf" \
+            docker compose exec -T caddy caddy reload --config /etc/caddy/Caddyfile --adapter caddyfile
-              --include="*.yml" \
-              --include="*.yaml" \
-              -E "im-api\.yuexuan\.shop|Access-Control-Allow-Origin" \
-              /opt/olns 2>/dev/null || true
-            echo "IM API Caddy route:"
-            nl -ba /opt/olns/Caddyfile | sed -n "1,45p"
-            echo "Running reverse-proxy containers:"
-            docker ps --format "{{.Names}} {{.Image}}" | grep -Ei "caddy|nginx|traefik|proxy" || true
           '