接入Gitea Actions蓝绿发布：API_KEY构建时注入、新增Dockerfile

- src/config.js 的 API_KEY 改为从构建时环境变量 TINODE_API_KEY 注入，
  不再依赖官方demo默认值；未设置时保留原demo key作为本地快速测试的兜底
- webpack.config.js 新增 DefinePlugin 完成注入，并自动加载(gitignored的)
  .env.local，开发者本地调试不需要每次手动export
- 新增 Dockerfile(node构建+nginx serve) 和 docker/nginx.conf
- 新增 .gitea/workflows/deploy.yml：手动触发的蓝绿发布流程

.gitea/workflows/deploy.yml

@@ -0,0 +1,30 @@
+name: Deploy Webapp (Blue-Green)
+
+on:
+  workflow_dispatch:
+    inputs:
+      image_tag:
+        description: '镜像tag，留空则使用commit短哈希'
+        required: false
+
+jobs:
+  deploy:
+    runs-on: deploy-host
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: 确定镜像tag
+        id: vars
+        run: |
+          TAG="${{ github.event.inputs.image_tag }}"
+          [ -z "$TAG" ] && TAG=$(git rev-parse --short HEAD)
+          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
+
+      - name: 构建镜像
+        run: |
+          docker build -t im-webapp:${{ steps.vars.outputs.tag }} \
+            --build-arg TINODE_API_KEY="${{ secrets.TINODE_API_KEY }}" .
+
+      - name: 蓝绿部署
+        run: |
+          IMAGE=im-webapp:${{ steps.vars.outputs.tag }} /opt/apps/im-webapp/deploy.sh

.gitignore

@@ -2,3 +2,6 @@
 node_modules
 src/i18n/srci/
 webapp.code-workspace.code-workspace
+
+# Local developer overrides — never commit real keys.
+.env.local

Dockerfile

@@ -0,0 +1,37 @@
+# ---- Stage 1: build static assets ----
+FROM node:22-alpine AS build
+
+WORKDIR /app
+COPY package.json package-lock.json ./
+RUN npm ci
+COPY . .
+
+# TINODE_API_KEY is read by webpack.config.js (via DefinePlugin) at build time.
+ARG TINODE_API_KEY=
+ENV TINODE_API_KEY=$TINODE_API_KEY
+
+RUN npm run build
+
+# ---- Stage 2: serve with nginx ----
+FROM nginx:alpine
+
+COPY docker/nginx.conf /etc/nginx/conf.d/default.conf
+
+WORKDIR /usr/share/nginx/html
+
+COPY --from=build /app/umd ./umd
+COPY --from=build /app/css/base.min.css ./css/base.min.css
+COPY --from=build /app/index.html ./index.html
+COPY --from=build /app/index-dev.html ./index-dev.html
+COPY --from=build /app/manifest.json ./manifest.json
+COPY --from=build /app/service-worker.js ./service-worker.js
+COPY --from=build /app/version.js ./version.js
+COPY --from=build /app/img ./img
+COPY --from=build /app/audio ./audio
+# Push notifications are not configured for this deployment yet.
+RUN echo "" > ./firebase-init.js
+
+HEALTHCHECK --interval=1m --timeout=3s --start-period=10s \
+  CMD wget -q -O /dev/null http://localhost/ || exit 1
+
+EXPOSE 80

docker/nginx.conf

@@ -0,0 +1,20 @@
+server {
+    listen 80;
+    server_name _;
+    root /usr/share/nginx/html;
+    index index.html;
+
+    # Tinode webapp uses hash-based client-side routing, so any unknown path
+    # can safely fall back to index.html.
+    location / {
+        try_files $uri $uri/ /index.html;
+    }
+
+    location /umd/ {
+        add_header Cache-Control "public, max-age=31536000, immutable";
+    }
+
+    location /img/ {
+        add_header Cache-Control "public, max-age=86400";
+    }
+}

src/config.js

@@ -5,8 +5,11 @@ export const BASE_APP_NAME = 'TinodeWeb';
 // Name of this application, used in the User-Agent.
 export const APP_NAME = BASE_APP_NAME + '/' + (PACKAGE_VERSION || '0.25');
 
-// API key. Use https://github.com/tinode/chat/tree/master/keygen to generate your own
-export const API_KEY = 'AQEAAAABAAD_rAp4DJh05a1HAwFT3A6K';
+// API key. Use https://github.com/tinode/chat/tree/master/keygen to generate your own.
+// Injected at build time via webpack DefinePlugin from the TINODE_API_KEY env var
+// (see webpack.config.js and .env.local). Falls back to the public sample key when unset,
+// which only works against a backend still using the matching sample API_KEY_SALT.
+export const API_KEY = process.env.TINODE_API_KEY || 'AQEAAAABAAD_rAp4DJh05a1HAwFT3A6K';
 
 // The array of possible hosts to connect to.
 export const KNOWN_HOSTS = {hosted: 'web.tinode.co', local: 'localhost:6060'};

webpack.config.js

@@ -1,6 +1,20 @@
 const CopyPlugin = require('copy-webpack-plugin');
+const webpack = require('webpack');
+const fs = require('fs');
 const path = require('path');
 
+// Load developer-local overrides (gitignored) so `npm run build` picks up
+// TINODE_API_KEY etc. without having to export them by hand every time.
+const envLocalPath = path.resolve(__dirname, '.env.local');
+if (fs.existsSync(envLocalPath)) {
+  for (const line of fs.readFileSync(envLocalPath, 'utf8').split('\n')) {
+    const match = line.match(/^\s*([A-Z_][A-Z0-9_]*)\s*=\s*(.*)\s*$/);
+    if (match) {
+      process.env[match[1]] = process.env[match[1]] || match[2];
+    }
+  }
+}
+
 module.exports = (env, argv) => {
   const mode = argv.mode === 'production' ? 'prod' : 'dev';
   const maxAssetSize = mode === 'prod' ? 360000 : 1512000;
@@ -52,6 +66,11 @@ module.exports = (env, argv) => {
           { from: `node_modules/tinode-sdk/umd/tinode.${mode}.js.map`, to: `tinode.${mode}.js.map` },
         ],
       }),
+      // Bakes TINODE_API_KEY (from the environment or .env.local) into the bundle at build
+      // time. See src/config.js for the fallback used when it's not set.
+      new webpack.DefinePlugin({
+        'process.env.TINODE_API_KEY': JSON.stringify(process.env.TINODE_API_KEY || ''),
+      }),
     ],
     externals: {
       'livekit-client': 'LivekitClient',