ubuntu24.04版本

2026-06-26 14:56:23 +08:00 · 2026-06-26 14:56:23 +08:00 · 6759967ca5
parent 2492ee051a
commit 6759967ca5
29 changed files with 590 additions and 235 deletions
--- a/add_nginx_secure_conf.sh
+++ b/add_nginx_secure_conf.sh
@ -95,4 +95,4 @@ for nginx_conf_path in `find /etc/nginx/orbit_sites/ -type f`; do
 			done
 		fi
 	fi
-done
+done
--- a/close_site.sh
+++ b/close_site.sh
@ -1,2 +1,2 @@
 #!/bin/bash
-UNICORN_PID="$(fuser tmp/pids/unicorn.sock tmp/sockets/unicorn.sock tmp/unicorn.sock) $(cat tmp/pids/unicorn.pid)" && kill -s TERM $UNICORN_PID
+UNICORN_PID="$(fuser tmp/pids/unicorn.sock tmp/sockets/unicorn.sock tmp/unicorn.sock) $(cat tmp/pids/unicorn.pid)" && kill -s TERM $UNICORN_PID
--- a/configure_netplan.py
+++ b/configure_netplan.py
@ -163,4 +163,4 @@ def main():
            f.write(org_file_contents)
            print("Recover changed!")
 if __name__ == '__main__':
-    main()
+    main()
--- a/configure_netplan.sh
+++ b/configure_netplan.sh
@ -19,13 +19,10 @@ else
    netplan_config_file=""
    if [[ "$netplan_configs_count" == "0" ]]; then
        netplan_config_file="/etc/netplan/00-installer-config.yaml"
-        sudo wget http://orbitgit.cloud/erictyl/install_r45_on_ubuntu_1804lts_doc/-/raw/master/default_netplan-config.yaml -O $netplan_config_file
+        sudo cp "$(dirname "$0")/default_netplan-config.yaml" $netplan_config_file
    else
        netplan_config_file=`ls /etc/netplan/*.yaml|xargs|awk '{print $1}'`
    fi
-    configure_netplan_py=`curl -sS http://orbitgit.cloud/erictyl/install_r45_on_ubuntu_1804lts_doc/-/raw/master/configure_netplan.py`
-    if [[ ! -z "$configure_netplan_py" ]]; then
-        echo "$configure_netplan_py" > configure_netplan.py
-    fi
+    cp "$(dirname "$0")/configure_netplan.py" configure_netplan.py
    sudo python3 configure_netplan.py "$netplan_config_file"
-fi
+fi
--- a/default_netplan-config.yaml
+++ b/default_netplan-config.yaml
@ -1,3 +1,3 @@
 # This is the network config written by 'subiquity'
 network:
-  version: 2
+  version: 2
--- a/fgu_sync.rake
+++ b/fgu_sync.rake
@ -392,3 +392,4 @@ namespace :fgu_sync do
  end
 end

+
--- a/fix_logrotate.sh
+++ b/fix_logrotate.sh
@ -1,4 +1,4 @@
 sudo sed -i 's/-SIGUSR1/-USR1/g' /etc/logrotate.d/orbit
 line_num=`grep '/var/log/mongodb/\*.log' /etc/logrotate.d/orbit -n | cut -d : -f 1`
 end_num_plus=`cat /etc/logrotate.d/orbit | awk '{if (NR>='$line_num') print}'|grep '}' -n|cut -d : -f 1`
-sudo sed -i $line_num,+$((end_num_plus-1))'s/copytruncate/create 644 mongodb mongodb/g' /etc/logrotate.d/orbit
+sudo sed -i $line_num,+$((end_num_plus-1))'s/copytruncate/create 644 mongodb mongodb/g' /etc/logrotate.d/orbit
--- a/fix_orbit_files.sh
+++ b/fix_orbit_files.sh
@ -26,4 +26,4 @@ if [[ ! -z "$org_user" ]] && [[ ! -z "$current_user" ]] && [[ "$current_user" !=
    service orbit restart
  fi
  systemctl daemon-reload
-fi
+fi
--- a/fix_ruby.sh
+++ b/fix_ruby.sh
@ -0,0 +1,192 @@
+#!/bin/bash
+# =========================================================
+# 單獨修復：編譯 OpenSSL 1.1.1w + 安裝 Ruby 2.7.6
+# 在家目錄執行：bash -l fix_ruby.sh
+# =========================================================
+
+OPENSSL_DIR="/opt/openssl"
+CPU_CORES=$(nproc)
+LOG_FILE="$HOME/fix_ruby_$(date +%Y%m%d_%H%M%S).log"
+
+# 同時輸出到終端機和 log 檔
+exec > >(tee -a "$LOG_FILE") 2>&1
+
+echo "=========================================================="
+echo "  開始修復 OpenSSL + Ruby 2.7.6"
+echo "  Log 檔案：$LOG_FILE"
+echo "  時間：$(date)"
+echo "  CPU 核心數：$CPU_CORES"
+echo "  系統：$(uname -a)"
+echo "=========================================================="
+
+# --- 載入 RVM ---
+source "/etc/profile.d/rvm.sh"
+if ! command -v rvm &>/dev/null; then
+    echo "❌ RVM 載入失敗，請確認 RVM 已安裝"
+    exit 1
+fi
+echo "✅ RVM 載入成功：$(rvm --version | head -1)"
+
+# --- 編譯 OpenSSL 1.1.1w ---
+echo ""
+echo "--- [1/3] 編譯 OpenSSL 1.1.1w ---"
+echo "  時間：$(date)"
+
+if [[ -f "$OPENSSL_DIR/lib/libssl.so" ]] || [[ -f "$OPENSSL_DIR/lib/libssl.a" ]]; then
+    echo "  ✅ OpenSSL 已存在，跳過編譯"
+    echo "  現有版本：$(ls -la $OPENSSL_DIR/lib/libssl* 2>/dev/null)"
+else
+    echo "  > /opt/openssl 不存在，開始重新編譯"
+    sudo rm -rf "$OPENSSL_DIR"
+    cd /tmp
+    rm -rf openssl-1.1.1w.tar.gz openssl-1.1.1w
+
+    echo "  > 下載中..."
+    wget https://www.openssl.org/source/openssl-1.1.1w.tar.gz \
+        --no-check-certificate -q -O openssl-1.1.1w.tar.gz
+    if [[ $? -ne 0 ]]; then
+        echo "❌ 下載失敗"
+        exit 1
+    fi
+    echo "  ✅ 下載完成：$(ls -lh /tmp/openssl-1.1.1w.tar.gz)"
+
+    echo "  > 解壓縮..."
+    tar xzf openssl-1.1.1w.tar.gz
+    cd openssl-1.1.1w
+
+    echo "  > 設定..."
+    ./config no-ssl2 no-ssl3 zlib-dynamic -fPIC shared \
+        --prefix="$OPENSSL_DIR" 2>&1 | tail -5
+    if [[ $? -ne 0 ]]; then
+        echo "❌ config 失敗"
+        exit 1
+    fi
+
+    echo "  > make depend..."
+    make depend -j"$CPU_CORES"
+
+    echo "  > 編譯中（需要數分鐘）..."
+    make -j"$CPU_CORES"
+    MAKE_EXIT=$?
+    if [[ $MAKE_EXIT -ne 0 ]]; then
+        echo "⚠️  make 有部分錯誤（exit=$MAKE_EXIT），但可能只是 fuzz/apps，繼續嘗試安裝..."
+    fi
+
+    echo "  > 安裝..."
+    sudo make install_sw
+    sudo make install_ssldirs
+
+    # 建立憑證連結
+    sudo rm -rf "$OPENSSL_DIR/ssl/certs"
+    sudo ln -sf /etc/ssl/certs/ "$OPENSSL_DIR/ssl/."
+
+    # 驗證
+    echo "  > 驗證安裝結果："
+    ls -la "$OPENSSL_DIR/lib/" 2>/dev/null | grep -E "libssl|libcrypto"
+    if [[ ! -f "$OPENSSL_DIR/lib/libssl.so" ]] && [[ ! -f "$OPENSSL_DIR/lib/libssl.a" ]]; then
+        echo "❌ OpenSSL 編譯失敗！libssl 不存在"
+        exit 1
+    fi
+    echo "✅ OpenSSL 安裝成功"
+fi
+
+# --- 安裝 Ruby 2.7.6 ---
+echo ""
+echo "--- [2/3] 安裝 Ruby 2.7.6 ---"
+echo "  時間：$(date)"
+echo "  使用 OpenSSL：$OPENSSL_DIR"
+echo "  libssl.so：$(ls -la $OPENSSL_DIR/lib/libssl.so 2>/dev/null || echo '不存在')"
+echo "  libssl.a  ：$(ls -la $OPENSSL_DIR/lib/libssl.a 2>/dev/null || echo '不存在')"
+
+# 移除殘留
+if rvm list | grep -q "2.7.6"; then
+    echo "  > 移除舊版..."
+    rvm remove "2.7.6" --force 2>/dev/null || true
+fi
+
+# 設定編譯環境變數
+export LD_LIBRARY_PATH="$OPENSSL_DIR/lib"
+export CPPFLAGS="-I$OPENSSL_DIR/include"
+export LDFLAGS="-L$OPENSSL_DIR/lib"
+export CFLAGS="-Wno-error=incompatible-pointer-types -Wno-implicit-function-declaration -Wno-discarded-qualifiers"
+
+echo "  > 環境變數："
+echo "    LD_LIBRARY_PATH=$LD_LIBRARY_PATH"
+echo "    CPPFLAGS=$CPPFLAGS"
+echo "    LDFLAGS=$LDFLAGS"
+echo "    CFLAGS=$CFLAGS"
+echo "  > 開始編譯 Ruby 2.7.6（需要 10~20 分鐘）..."
+
+rvm install "2.7.6" \
+    --verify-downloads 1 \
+    --with-openssl-dir="$OPENSSL_DIR" \
+    --with-opt-dir="$OPENSSL_DIR" \
+    -- \
+    --with-jemalloc
+RVM_EXIT=$?
+
+echo "  > rvm install 結束，exit code：$RVM_EXIT"
+
+# 如果失敗，自動印出最後的 make log
+if [[ $RVM_EXIT -ne 0 ]]; then
+    MAKE_LOG=$(find ~/.rvm/log -name "make.log" 2>/dev/null | sort | tail -1)
+    if [[ -f "$MAKE_LOG" ]]; then
+        echo ""
+        echo "--- make.log 最後 40 行 ---"
+        tail -40 "$MAKE_LOG"
+        echo ""
+        echo "--- make.log 錯誤行 ---"
+        grep -i "error:" "$MAKE_LOG" | head -20
+    fi
+    CONF_LOG=$(find ~/.rvm/log -name "configure.log" 2>/dev/null | sort | tail -1)
+    if [[ -f "$CONF_LOG" ]]; then
+        echo ""
+        echo "--- configure.log 最後 20 行 ---"
+        tail -20 "$CONF_LOG"
+    fi
+    echo "❌ Ruby 安裝失敗"
+    exit 1
+fi
+
+# 清除編譯環境變數
+unset LD_LIBRARY_PATH CPPFLAGS LDFLAGS CFLAGS
+
+rvm --default use "2.7.6"
+
+# --- 安裝 Gems ---
+echo ""
+echo "--- [3/3] 安裝 Gems ---"
+echo "  時間：$(date)"
+gem install bundler -v 2.1.4
+gem install zip
+gem install nokogiri -v 1.8.5
+
+# --- 最終驗證 ---
+echo ""
+echo "=========================================================="
+echo "  最終驗證"
+echo "  時間：$(date)"
+echo "=========================================================="
+source "/etc/profile.d/rvm.sh"
+rvm use "2.7.6"
+
+RUBY_VER=$(ruby -v 2>/dev/null || echo "")
+OPENSSL_VER=$(ruby -ropenssl -e 'puts OpenSSL::OPENSSL_VERSION' 2>/dev/null || echo "")
+GEM_LIST=$(gem list | grep -E 'bundler|nokogiri|zip' | tr '\n' ' ')
+
+if [[ "$RUBY_VER" == *"2.7.6"* ]] && [[ -n "$OPENSSL_VER" ]]; then
+    echo "✅ Ruby    : $RUBY_VER"
+    echo "✅ OpenSSL : $OPENSSL_VER"
+    echo "✅ Gems    : $GEM_LIST"
+    echo "=========================================================="
+    echo "  全部安裝成功！"
+    echo "  Log 已儲存至：$LOG_FILE"
+    echo "=========================================================="
+else
+    echo "❌ Ruby    : ${RUBY_VER:-未安裝}"
+    echo "❌ OpenSSL : ${OPENSSL_VER:-無法載入}"
+    echo ""
+    echo "請檢查 log 檔案：$LOG_FILE"
+    echo "=========================================================="
+    exit 1
+fi
--- a/init_web.sh
+++ b/init_web.sh
@ -1 +1 @@
-sudo service nginx restart && sudo service mongod restart && ./start_site.sh "$1" "$2" "$3" "$4" && curl localhost
+sudo service nginx restart && sudo service mongod restart && ./start_site.sh "$1" "$2" "$3" "$4" && curl localhost
--- a/install_certbot.sh
+++ b/install_certbot.sh
@ -93,4 +93,4 @@ if [ ! -z $certbot_path ]; then
    CRON="$certbot_renew_command" && (sudo -p 'sudo password:' crontab -l; echo "$CRON" ) | sudo -p 'sudo password:' crontab -
  fi
  echo "Finish setting renew cronjob!"
-fi
+fi
--- a/install_nginx.sh
+++ b/install_nginx.sh
@ -28,7 +28,7 @@ vercomp () {
    return 0;
 }
 function escape_str(){
-    echo $1|sed -E 's/\\+//g' |sed -E 's/[\/\.\*]/\\\0/g'
+    echo $1|sed -E 's/\\+//g' |sed -E 's/[\/\.\*]/\\\\\\0/g'
 }
 ubuntu_ver="$(lsb_release -rs)"
 if [[ -e "/etc/needrestart/needrestart.conf" ]]; then
@ -39,7 +39,8 @@ sudo apt-get update
 if [[ -z "$(which git)" ]]; then
    sudo apt-get install -y git
 fi
-sudo apt-get install -y linux-kernel-headers software-properties-common build-essential
+# Ubuntu 24.04: linux-kernel-headers replaced by linux-libc-dev
+sudo apt-get install -y linux-libc-dev software-properties-common build-essential
 sudo apt-get install -y libxslt-dev libgd-dev 
 org_pwd="$(pwd)"
 cpu_cores="$(nproc --all)"
@ -89,25 +90,9 @@ fi
 if [ -z "$cpu_cores" ]; then
    cpu_cores="1";
 fi
-if [[ $(vercomp "$ubuntu_ver" "16") == "<" ]]; then #Need update ca-certificates manual
-    sudo apt-get install -y openssl libssl1.0 libssl-dev
-    sudo apt-get install -y apt-transport-https ca-certificates
-    sudo update-ca-certificates
-    sudo bash -l -c "
-        cd /root &&
-        wget https://launchpad.net/ubuntu/+archive/primary/+sourcefiles/ca-certificates/20210119~20.04.2/ca-certificates_20210119~20.04.2.tar.xz --no-check-certificate -O ca-certificates_20210119~20.04.2.tar.xz &&
-        tar -xJf ca-certificates_20210119~20.04.2.tar.xz &&
-        cd ca-certificates-20210119~20.04.1 &&
-        make -j$cpu_cores && make install &&
-        dpkg-reconfigure -fnoninteractive ca-certificates &&
-        if [ -e /etc/ca-certificates.conf ]; then sed -E 's/^!//g' -i /etc/ca-certificates.conf; sed -i 's/mozilla\/DST_Root_CA_X3.crt/!mozilla\/DST_Root_CA_X3.crt/' /etc/ca-certificates.conf; fi &&
-        dpkg-reconfigure -fnoninteractive ca-certificates &&
-        update-ca-certificates --fresh --verbose &&
-        /usr/bin/c_rehash /etc/ssl/certs"
-    cd "$org_pwd"
-else
-    sudo apt-get install --reinstall ca-certificates -y
-fi
+# Ubuntu 24.04 (noble): always reinstall ca-certificates (no need for old manual update path)
+sudo apt-get install --reinstall ca-certificates -y
+
 nginx_configure=""
 if [ -z $openssl_source_dir ]; then
    nginx_configure="./configure --prefix=/usr/share/nginx --conf-path=/etc/nginx/nginx.conf --http-log-path=/var/log/nginx/access.log --error-log-path=/var/log/nginx/error.log --lock-path=/var/lock/nginx.lock --pid-path=/run/nginx.pid --modules-path=/usr/lib/nginx/modules --http-client-body-temp-path=/var/lib/nginx/body --http-fastcgi-temp-path=/var/lib/nginx/fastcgi --http-proxy-temp-path=/var/lib/nginx/proxy --http-scgi-temp-path=/var/lib/nginx/scgi --http-uwsgi-temp-path=/var/lib/nginx/uwsgi --with-debug --with-compat --with-pcre-jit --with-http_ssl_module --with-http_stub_status_module --with-http_realip_module --with-http_auth_request_module --with-http_v2_module --with-http_dav_module --with-http_slice_module --with-threads --with-http_addition_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_image_filter_module=dynamic --with-http_sub_module --with-http_xslt_module=dynamic --with-stream --with-stream=dynamic --with-stream_ssl_module --with-stream_realip_module --with-mail=dynamic --with-mail_ssl_module --add-module=../headers-more-nginx-module"
@ -120,11 +105,7 @@ extra_remove_packages=""
 extra_build_nginx_cmd="true"
 if [[ "$@" == *"--install-modsecurity"* ]];then
    install_modsecurity="1"
-    if [[ $(vercomp "$ubuntu_ver" "16") == "<" ]]; then #use 3.0.6
-        modsecurity_branch="v3.0.6"
-    else
-        modsecurity_branch="v3/master"
-    fi
+    modsecurity_branch="v3/master"
    sudo bash -l -c "
        cd /root &&
        apt-get install -y apt-utils autoconf automake build-essential git libcurl4-openssl-dev libgeoip-dev liblmdb-dev libpcre++-dev libtool libxml2-dev libyajl-dev pkgconf wget zlib1g-dev &&
@ -194,20 +175,26 @@ if [[ ! -z "$(which nginx)" ]]; then
    nginx_ver="$(nginx -v 2>&1|xargs|awk '{print $3}'|cut -d '/' -f 2)"
 fi
 if [[ ! -f /etc/init.d/nginx ]]; then
-    sudo wget http://orbitgit.cloud/erictyl/install_r45_on_ubuntu_1804lts_doc/-/raw/master/nginx_service.sh -O /etc/init.d/nginx
+    # [TEST] 使用本地 nginx_service.sh，略過從 orbitgit.cloud 下載
+    sudo cp "$(dirname "$0")/nginx_service.sh" /etc/init.d/nginx
    sudo chmod 755 /etc/init.d/nginx
    sudo chown root:root /etc/init.d/nginx
-    if [[ $(vercomp "$ubuntu_ver" "16") == ">" ]]; then
-        sudo wget http://orbitgit.cloud/erictyl/install_r45_on_ubuntu_1804lts_doc/-/raw/master/nginx.service -O /lib/systemd/system/nginx.service
-        sudo chown root:root /lib/systemd/system/nginx.service
-        sudo chmod 644 /lib/systemd/system/nginx.service
-        sudo chmod -x /lib/systemd/system/nginx.service
-        sudo systemctl daemon-reload
-        sudo systemctl unmask nginx
-        sudo systemctl enable nginx
-    fi
+    # Ubuntu 24.04 always uses systemd
+    # [TEST] 使用本地 nginx.service，略過從 orbitgit.cloud 下載
+    sudo cp "$(dirname "$0")/nginx.service" /lib/systemd/system/nginx.service
+    sudo chown root:root /lib/systemd/system/nginx.service
+    sudo chmod 644 /lib/systemd/system/nginx.service
+    sudo chmod -x /lib/systemd/system/nginx.service
+    sudo systemctl daemon-reload
+    sudo systemctl unmask nginx
+    sudo systemctl enable nginx
 fi
-nginx_target_ver="1.23.4"
+# 自動抓 Nginx 官方最新穩定版
+nginx_target_ver=$(curl -s https://nginx.org/en/download.html | grep -oP 'nginx-\K[0-9]+\.[0-9]+\.[0-9]+(?=\.tar\.gz)' | head -1)
+if [ -z "$nginx_target_ver" ]; then
+    nginx_target_ver="1.28.2"  # 無法取得時使用此備用版本
+fi
+echo "Nginx 目標版本: $nginx_target_ver"
 if [[ $(vercomp "$nginx_ver" "$nginx_target_ver") ==  "<" ]] || [[ "$1" == '--force' ]] || [[ "$install_modsecurity" == "1" ]] || [[ "$install_passenger" == "1" ]]; then
    if [ -f "/etc/nginx/nginx.conf" ]; then
        nginx_conf_exist="1"
@ -250,7 +237,7 @@ if [[ $(vercomp "$nginx_ver" "$nginx_target_ver") ==  "<" ]] || [[ "$1" == '--fo
            sed -i 's/SecRuleEngine DetectionOnly/SecRuleEngine On/' /etc/nginx/modsec/modsecurity.conf && \
            sed -i 's/SecRequestBodyLimit 13107200/SecRequestBodyLimit 131072000/' /etc/nginx/modsec/modsecurity.conf && \
            sed -i 's/SecRequestBodyNoFilesLimit 131072/SecRequestBodyNoFilesLimit 1310720/' /etc/nginx/modsec/modsecurity.conf && \
-            wget http://orbitgit.cloud/erictyl/install_r45_on_ubuntu_1804lts_doc/-/raw/master/modsecurity_main.conf -O /etc/nginx/modsec/main.conf"
+            cp "$(dirname "$0")/modsecurity_main.conf" /etc/nginx/modsec/main.conf"
    fi
    if [[ $nginx_conf_exist == "0" ]]; then
        nginx_conf_path="/etc/nginx/nginx.conf"
@ -262,7 +249,7 @@ if [[ $(vercomp "$nginx_ver" "$nginx_target_ver") ==  "<" ]] || [[ "$1" == '--fo
        if [ -z "$server_block_start" ]; then
            if [[ ! -f /etc/nginx/sites-enabled/default ]]; then
                sudo mkdir -p /etc/nginx/sites-enabled
-                sudo wget http://orbitgit.cloud/erictyl/install_r45_on_ubuntu_1804lts_doc/-/raw/master/sites-enabled-default -O /etc/nginx/sites-enabled/default
+                sudo cp "$(dirname "$0")/sites-enabled-default" /etc/nginx/sites-enabled/default
            fi
        else
            server_block_contents=`cat $nginx_conf_path | awk '{if (NR>='$server_block_start' && NR <'$http_block_end') print}'`
@ -275,24 +262,74 @@ if [[ $(vercomp "$nginx_ver" "$nginx_target_ver") ==  "<" ]] || [[ "$1" == '--fo
        fi
        http_block_end_offset=`cat $nginx_conf_path | awk '{if (NR>='$http_block_start') print}'|grep  -E '^}' -n|cut -d : -f 1|xargs|awk '{print $1}'`
        http_block_end=$((http_block_end_offset + http_block_start - 1))
-        include_list='/etc/nginx/conf.d/\*.conf /etc/nginx/sites-enabled/\*'
-        if [ -z "$(grep 'Virtual Host Configs' $nginx_conf_path)" ]; then
-            virtual_host_configs_text=`echo '\n    ##\n    # Virtual Host Configs\n    ##'`
-            sudo sed -i "$((http_block_end-1)),+0s/.*/\0\\n    $(echo "$virtual_host_configs_text")/g" $nginx_conf_path
-            http_block_end_offset=`cat $nginx_conf_path | awk '{if (NR>='$http_block_start') print}'|grep  -E '^}' -n|cut -d : -f 1|xargs|awk '{print $1}'`
-            http_block_end=$((http_block_end_offset + http_block_start - 1))
-        fi
-        for file_list in $include_list; do
-            if [[ "$(cat $nginx_conf_path)" != *"$(echo $file_list|sed 's/\\//g')"* ]]; then
-                sudo sed -i $((http_block_end-1)),+0's/.*/\0\n    include '$(escape_str $file_list)';/g' $nginx_conf_path
-                http_block_end=$((http_block_end + 1))
-            fi
-        done
+        # Use Python to safely inject include directives before the closing } of http block
+        sudo python3 - "$nginx_conf_path" <<'PYEOF'
+import sys, re
+
+conf_path = sys.argv[1]
+with open(conf_path, 'r') as f:
+    content = f.read()
+
+includes_to_add = [
+    'include /etc/nginx/conf.d/*.conf;',
+    'include /etc/nginx/sites-enabled/*;',
+]
+
+# Find http block closing brace position
+http_match = re.search(r'\bhttp\s*\{', content)
+if http_match:
+    depth = 0
+    start = http_match.start()
+    http_end = None
+    for i, ch in enumerate(content[start:], start):
+        if ch == '{':
+            depth += 1
+        elif ch == '}':
+            depth -= 1
+            if depth == 0:
+                http_end = i
+                break
+
+    if http_end is not None:
+        # Add Virtual Host Configs comment if missing
+        http_body = content[start:http_end]
+        if 'Virtual Host Configs' not in http_body:
+            insert = '\n    ##\n    # Virtual Host Configs\n    ##\n'
+            content = content[:http_end] + insert + content[http_end:]
+            http_end += len(insert)
+
+        # Re-read http body after possible insert
+        http_body = content[start:http_end]
+        lines_to_add = []
+        for inc in includes_to_add:
+            # Check if this include pattern already exists (ignoring comments)
+            pattern = inc.replace('*', r'\*').replace('.', r'\.')
+            if not re.search(r'(?<!#)\s*' + re.escape(inc.split()[1]), http_body):
+                lines_to_add.append('    ' + inc)
+        if lines_to_add:
+            insert = '\n' + '\n'.join(lines_to_add) + '\n'
+            content = content[:http_end] + insert + content[http_end:]
+
+with open(conf_path, 'w') as f:
+    f.write(content)
+print("nginx.conf includes updated successfully.")
+PYEOF
    fi
-    if [[ -z "$(grep -E 'include\s+\/etc\/nginx\/modules-enabled\/\*\.conf;' /etc/nginx/nginx.conf)" ]]; then
+    if [[ -z "$(grep -E 'include\s+/etc/nginx/modules-enabled/\*\.conf;' /etc/nginx/nginx.conf)" ]]; then
        nginx_conf_path="/etc/nginx/nginx.conf"
-        nginx_conf_contents=`echo "$(echo 'include /etc/nginx/modules-enabled/*.conf;'; cat $nginx_conf_path)"`
-        sudo bash -l -c "echo '$nginx_conf_contents' > $nginx_conf_path"
+        # Safely prepend the modules include line using Python (avoids echo/heredoc corruption)
+        sudo python3 -c "
+import sys
+path = '$nginx_conf_path'
+line = 'include /etc/nginx/modules-enabled/*.conf;\n'
+with open(path, 'r') as f:
+    content = f.read()
+if line.strip() not in content:
+    content = line + content
+    with open(path, 'w') as f:
+        f.write(content)
+    print('modules-enabled include prepended.')
+"
        sudo service nginx restart
    fi
    if [[ "$install_modsecurity" == "1" ]]; then
@ -306,4 +343,4 @@ if [[ $(vercomp "$nginx_ver" "$nginx_target_ver") ==  "<" ]] || [[ "$1" == '--fo
        "
    fi
    cd "$org_pwd"
-fi
+fi
--- a/install_orbit_environment.log
+++ b/install_orbit_environment.log
@ -0,0 +1 @@
+(此 log 由上次執行產生，請重新執行 install_orbit_environment.sh 更新)
--- a/install_orbit_environment.sh
+++ b/install_orbit_environment.sh
@ -8,24 +8,32 @@ fi
 sudo apt update
 sudo apt install -y git psmisc #fuser
 org_pwd=$(pwd)
-if [[ "$ubuntu_version" > '22' ]]; then #In ubuntu 22, install linux-libc-dev instead of linux-kernel-headers
-	sudo apt install -y linux-libc-dev software-properties-common build-essential
-else
-	sudo apt install -y linux-kernel-headers software-properties-common build-essential
-fi
+# Ubuntu 24.04 uses linux-libc-dev (not linux-kernel-headers)
+sudo apt install -y linux-libc-dev software-properties-common build-essential
+
 if [[ ! -e "/usr/lib/x86_64-linux-gnu/librt.so" ]]; then
 	sudo apt install -y libc6 libc6-dev
-	sudo ln -s /usr/lib/x86_64-linux-gnu/librt.so.1 /usr/lib/x86_64-linux-gnu/librt.so
+	# Ubuntu 24.04: librt.so.1 merged into glibc, symlink may not exist
+	if [[ -e "/usr/lib/x86_64-linux-gnu/librt.so.1" ]]; then
+		sudo ln -s /usr/lib/x86_64-linux-gnu/librt.so.1 /usr/lib/x86_64-linux-gnu/librt.so
+	fi
 fi
 org_pwd=$(pwd)
 sudo apt install -y  libncurses5-dev libgmp-dev
+sudo apt install -y libsodium-dev
 sudo apt-get install libjemalloc-dev -y
 echo "postfix postfix/mailname string $USER" | sudo debconf-set-selections
 echo "postfix postfix/main_mailer_type string 'Local only'" | sudo debconf-set-selections
 sudo apt-get install -y postfix
 sudo service postfix start
-#install nginx 1.23.1
-wget http://orbitgit.cloud/erictyl/install_r45_on_ubuntu_1804lts_doc/-/raw/master/install_nginx.sh -O install_nginx.sh
+sudo sed -i 's/^inet_interfaces\s*=.*/inet_interfaces = loopback-only/' /etc/postfix/main.cf
+if [ -z "$(grep '^inet_interfaces' /etc/postfix/main.cf)" ]; then
+	echo "inet_interfaces = loopback-only" | sudo tee -a /etc/postfix/main.cf
+fi
+sudo systemctl restart postfix
+#install nginx 1.23.4
+# [TEST] 使用本地 install_nginx.sh，略過從 orbitgit.cloud 下載
+cp "$(dirname "$0")/install_nginx.sh" install_nginx.sh
 bash install_nginx.sh
 sudo nginx -t
 nginx_status="$(echo $?)"
@ -99,62 +107,49 @@ function fix_downgrade_mongod(){
 	mongod --version
 	mongod_code="$(echo $?)"
 }
+
+# Ubuntu 24.04: apt-key is deprecated; always use trusted.gpg.d + gpg dearmor
+function apt_add_key_func(){
+	url="$1"
+	base_name="$(basename $url)"
+	file_path="/etc/apt/trusted.gpg.d/$base_name"
+	sudo wget "$url" -q -O "$file_path"
+	if [[ -e "$file_path" ]]; then
+		mime_type=`file -b --mime-type "$file_path"`
+		if [[ $mime_type == "application/pgp-keys" ]]; then
+			new_file_path=`echo "$file_path"| sed -E 's/(\.[^.]+$|$)/\.gpg/g'`
+			cat $file_path|sudo gpg --batch --yes --dearmor -o $new_file_path
+			sudo rm -f $file_path
+			file_path="$new_file_path"
+		fi
+	fi
+}
+
 function install_mongodb(){
 	if [[ "$2" == "1" ]]; then #reinstall
 		sudo rm -f /etc/apt/sources.list.d/mongodb-org-*
 	fi
-	if [[ "$ubuntu_version" > '20' ]]; then
-		sudo wget -nc http://archive.ubuntu.com/ubuntu/pool/main/o/openssl/libssl1.1_1.1.1f-1ubuntu2_amd64.deb
-		sudo dpkg -i libssl1.1_1.1.1f-1ubuntu2_amd64.deb
-		sudo wget -nc http://archive.ubuntu.com/ubuntu/pool/main/o/openssl/libssl-dev_1.1.1f-1ubuntu2_amd64.deb
-		sudo dpkg -i libssl-dev_1.1.1f-1ubuntu2_amd64.deb
-	fi
+	# Ubuntu 24.04 (noble): libssl1.1 is not available; MongoDB 6.0+ supports OpenSSL 3.x natively
+	# For MongoDB versions < 6.0 that need libssl1.1, we install from focal's archive
 	case $1 in
-	3.2)
-		mongod_ver="3.2.22"
-		apt_add_key_func https://www.mongodb.org/static/pgp/server-3.2.asc
-		echo "deb http://repo.mongodb.org/apt/ubuntu trusty/mongodb-org/3.2 multiverse" | sudo tee /etc/apt/sources.list.d/mongodb-org-3.2.list
-		sudo apt-get update
-		sudo apt-get install -y mongodb-org=$mongod_ver mongodb-org-server=$mongod_ver mongodb-org-shell=$mongod_ver mongodb-org-mongos=$mongod_ver mongodb-org-tools=$mongod_ver
-		sudo service mongod stop
-		sudo rm -f /var/lib/mongodb/mongod.lock
-		sudo rm -f /tmp/mongodb-27017.sock
-		sudo chown mongodb:mongodb /var/lib/mongodb -R
-		sudo chown mongodb:mongodb /var/log/mongodb -R
-		sudo service mongod restart
-		sleep 10
-		fix_downgrade_mongod "$mongod_ver"
-		if [ $mongod_code != 0 ] && [ $mongod_code != 1 ]; then #mongo core dump
-			push_messages "Mongo 3.2 core dump!"
-			push_messages "Please install mongod by yourself!"
-		else
-			if [ -e /tmp/mongodb-27017.sock ]; then
-				push_messages "Mongo start success!"
-			else
-				push_messages "mongo not yet start!"
-				push_messages "Please check mongo status!"
-			fi
-			fix_mongod_and_logrotate
-		fi
-		;;
 	4.4)
 		mongod_ver="4.4.18"
 		apt_add_key_func https://www.mongodb.org/static/pgp/server-4.4.asc
-		if [[ "$ubuntu_version" > '20' ]]; then
-			echo "deb [ arch=amd64,arm64 ] https://repo.mongodb.org/apt/ubuntu focal/mongodb-org/4.4 multiverse" | sudo tee /etc/apt/sources.list.d/mongodb-org-4.4.list
-		elif [[ "$ubuntu_version" =~ '18' ]] || [[ "$ubuntu_version" =~ '19' ]]; then
-			echo "deb [ arch=amd64,arm64 ] https://repo.mongodb.org/apt/ubuntu bionic/mongodb-org/4.4 multiverse" | sudo tee /etc/apt/sources.list.d/mongodb-org-4.4.list
-		else
-			echo "deb [ arch=amd64,arm64 ] https://repo.mongodb.org/apt/ubuntu xenial/mongodb-org/4.4 multiverse" | sudo tee /etc/apt/sources.list.d/mongodb-org-4.4.list
+		# MongoDB 4.4 does not have a noble repo; use focal packages (compatible)
+		echo "deb [ arch=amd64,arm64 ] https://repo.mongodb.org/apt/ubuntu focal/mongodb-org/4.4 multiverse" | sudo tee /etc/apt/sources.list.d/mongodb-org-4.4.list
+		# Install libssl1.1 from focal for MongoDB 4.4 compatibility on Ubuntu 24.04
+		if ! dpkg -l libssl1.1 2>/dev/null | grep -q '^ii'; then
+			sudo wget -nc http://archive.ubuntu.com/ubuntu/pool/main/o/openssl/libssl1.1_1.1.1f-1ubuntu2_amd64.deb
+			sudo dpkg -i libssl1.1_1.1.1f-1ubuntu2_amd64.deb
 		fi
 		sudo apt-get update
 		sudo apt-get install -y mongodb-org=$mongod_ver mongodb-org-server=$mongod_ver mongodb-org-shell=$mongod_ver mongodb-org-mongos=$mongod_ver mongodb-org-tools=$mongod_ver --allow-downgrades
 		sudo service mongod restart
 		sleep 10
 		fix_downgrade_mongod "$mongod_ver"
-		#if mongo 4.4 core dump, then install mongo 3.2
 		if [ $mongod_code != 0 ] && [ $mongod_code != 1 ]; then
-			install_mongodb "3.2" "1"
+			push_messages "Mongo 4.4 failed to start!"
+			push_messages "Please install mongod by yourself!"
 		else
 			push_messages "mongo not yet start!"
 			push_messages "Please check mongo status!"
@ -163,13 +158,12 @@ function install_mongodb(){
 	5.0)
 		mongod_ver="5.0.14"
 		apt_add_key_func https://www.mongodb.org/static/pgp/server-5.0.asc
-		# install mongod 5.0
-		if [[ "$ubuntu_version" > '20' ]]; then
-			echo "deb [ arch=amd64,arm64 ] https://repo.mongodb.org/apt/ubuntu focal/mongodb-org/5.0 multiverse" | sudo tee /etc/apt/sources.list.d/mongodb-org-5.0.list
-		elif [[ "$ubuntu_version" =~ '18' ]] || [[ "$ubuntu_version" =~ '19' ]]; then
-			echo "deb [ arch=amd64,arm64 ] https://repo.mongodb.org/apt/ubuntu bionic/mongodb-org/5.0 multiverse" | sudo tee /etc/apt/sources.list.d/mongodb-org-5.0.list
-		else
-			echo "deb [ arch=amd64,arm64 ] https://repo.mongodb.org/apt/ubuntu xenial/mongodb-org/5.0 multiverse" | sudo tee /etc/apt/sources.list.d/mongodb-org-5.0.list
+		# MongoDB 5.0 does not have a noble repo; use focal packages
+		echo "deb [ arch=amd64,arm64 ] https://repo.mongodb.org/apt/ubuntu focal/mongodb-org/5.0 multiverse" | sudo tee /etc/apt/sources.list.d/mongodb-org-5.0.list
+		# Install libssl1.1 from focal for MongoDB 5.0 compatibility on Ubuntu 24.04
+		if ! dpkg -l libssl1.1 2>/dev/null | grep -q '^ii'; then
+			sudo wget -nc http://archive.ubuntu.com/ubuntu/pool/main/o/openssl/libssl1.1_1.1.1f-1ubuntu2_amd64.deb
+			sudo dpkg -i libssl1.1_1.1.1f-1ubuntu2_amd64.deb
 		fi
 		sudo apt-get update
 		sudo apt-get install -y mongodb-org=$mongod_ver mongodb-org-database=$mongod_ver mongodb-org-server=$mongod_ver mongodb-mongosh mongodb-org-shell=$mongod_ver mongodb-org-mongos=$mongod_ver mongodb-org-tools=$mongod_ver --allow-downgrades
@ -187,7 +181,6 @@ function install_mongodb(){
 			fix_mongod_and_logrotate
 		else
 			fix_downgrade_mongod "$mongod_ver"
-			#if mongo 5.0 core dump, then install mongo 4.4
 			if [ $mongod_code != 0 ] && [ $mongod_code != 1 ]; then
 				install_mongodb "4.4" "1"
 			else
@ -199,13 +192,8 @@ function install_mongodb(){
 	6.0)
 		mongod_ver="6.0.4"
 		apt_add_key_func https://www.mongodb.org/static/pgp/server-6.0.asc
-		if [[ "$ubuntu_version" > '20' ]]; then
-			echo "deb [ arch=amd64,arm64 ] https://repo.mongodb.org/apt/ubuntu focal/mongodb-org/6.0 multiverse" | sudo tee /etc/apt/sources.list.d/mongodb-org-6.0.list
-		elif [[ "$ubuntu_version" =~ '18' ]] || [[ "$ubuntu_version" =~ '19' ]]; then
-			echo "deb [ arch=amd64,arm64 ] https://repo.mongodb.org/apt/ubuntu bionic/mongodb-org/6.0 multiverse" | sudo tee /etc/apt/sources.list.d/mongodb-org-6.0.list
-		else
-			echo "deb [ arch=amd64,arm64 ] https://repo.mongodb.org/apt/ubuntu xenial/mongodb-org/6.0 multiverse" | sudo tee /etc/apt/sources.list.d/mongodb-org-6.0.list
-		fi
+		# MongoDB 6.0 does not have a noble repo; use focal packages
+		echo "deb [ arch=amd64,arm64 ] https://repo.mongodb.org/apt/ubuntu focal/mongodb-org/6.0 multiverse" | sudo tee /etc/apt/sources.list.d/mongodb-org-6.0.list
 		sudo apt-get update
 		sudo apt-get remove mongodb-clients --purge
 		sudo apt-get install -y mongodb-org=$mongod_ver mongodb-org-database=$mongod_ver mongodb-org-server=$mongod_ver mongodb-mongosh mongodb-org-mongos=$mongod_ver mongodb-org-tools=$mongod_ver --allow-downgrades
@ -224,7 +212,6 @@ function install_mongodb(){
 			fix_mongod_and_logrotate
 		else
 			fix_downgrade_mongod "$mongod_ver"
-			#if mongo 6.0 core dump, then install mongo 5.0
 			if [ $mongod_code != 0 ] && [ $mongod_code != 1 ]; then
 				install_mongodb "5.0" "1"
 			else
@ -233,65 +220,126 @@ function install_mongodb(){
 			fi
 		fi
 		;;
+	7.0)
+		mongod_ver="7.0.14"
+		apt_add_key_func https://www.mongodb.org/static/pgp/server-7.0.asc
+		# MongoDB 7.0 supports Ubuntu 22.04 (jammy); use jammy packages on Ubuntu 24.04
+		echo "deb [ arch=amd64,arm64 ] https://repo.mongodb.org/apt/ubuntu jammy/mongodb-org/7.0 multiverse" | sudo tee /etc/apt/sources.list.d/mongodb-org-7.0.list
+		sudo apt-get update
+		sudo apt-get remove mongodb-clients --purge -y 2>/dev/null || true
+		sudo apt-get install -y mongodb-org=$mongod_ver mongodb-org-database=$mongod_ver mongodb-org-server=$mongod_ver mongodb-mongosh mongodb-org-mongos=$mongod_ver mongodb-org-tools=$mongod_ver --allow-downgrades
+		sudo service mongod stop
+		sudo rm -f /var/lib/mongodb/mongod.lock
+		sudo rm -f /tmp/mongodb-27017.sock
+		sudo chown mongodb:mongodb /var/lib/mongodb -R
+		sudo chown mongodb:mongodb /var/log/mongodb -R
+		sudo service mongod restart
+		if [[ ! -e /usr/bin/mongo ]]; then
+			sudo ln -s /usr/bin/mongosh /usr/bin/mongo
+		fi
+		if [ -e /tmp/mongodb-27017.sock ]; then
+			fix_mongod_and_logrotate
+		else
+			fix_downgrade_mongod "$mongod_ver"
+			if [ $mongod_code != 0 ] && [ $mongod_code != 1 ]; then
+				install_mongodb "6.0" "1"
+			else
+				push_messages "mongo not yet start!"
+				push_messages "Please check mongo status!"
+			fi
+		fi
+		;;
 	*)
-		push_messages "Only support mongodb: 3.2, 4.4, 5.0, 6.0!"
+		push_messages "Only support mongodb: 4.4, 5.0, 6.0, 7.0 on Ubuntu 24.04!"
 		;;
 	esac
 }
-if [[ "$ubuntu_version" > '21' ]]; then
-	function apt_add_key_func(){
-		url="$1"
-		base_name="$(basename $url)"
-		file_path="/etc/apt/trusted.gpg.d/$base_name"
-		sudo wget "$url" -q -O "$file_path"
-		if [[ -e "$file_path" ]]; then
-			mime_type=`file -b --mime-type "$file_path"`
-			if [[ $mime_type == "application/pgp-keys" ]]; then
-				new_file_path=`echo "$file_path"| sed -E 's/(\.[^.]+$|$)/\.gpg/g'`
-				cat $file_path|sudo gpg --batch --yes --dearmor -o $new_file_path
-				sudo rm -f $file_path
-				file_path="$new_file_path"
-			fi
-		fi
-	}
-else
-	function apt_add_key_func(){
-		wget -qO - "$1" | sudo apt-key add -
-	}
-fi
 if [ $nginx_status != "0" ]; then
-	sudo sed -i 's/\([^#]include \/etc\/nginx\/sites-enabled\/*\)/\#\1/g' /etc/nginx/nginx.conf
+	sudo python3 -c "
+import re, sys
+path = '/etc/nginx/nginx.conf'
+with open(path, 'r') as f:
+    content = f.read()
+# Comment out any uncommented sites-enabled include
+content = re.sub(r'^(\s*)(include\s+/etc/nginx/sites-enabled/\*;)', r'\1#\2', content, flags=re.MULTILINE)
+with open(path, 'w') as f:
+    f.write(content)
+print('Commented out sites-enabled include.')
+"
 fi
 sudo service nginx restart
 openssl_dir=""
-need_export_apt_key="0"
-if [[ "$ubuntu_version" > '21' ]]; then # ruby must use openssl <= 1.1.1. Not support openssl 3.0 yet.
-	need_export_apt_key="1"
-	if [[ ! -d "/opt/openssl" ]]; then
-		target_openssl_ver="1.1.1w"
-		sudo bash -l -c "
-			cd /root &&
-			wget https://www.openssl.org/source/openssl-$target_openssl_ver.tar.gz --no-check-certificate -O openssl-$target_openssl_ver.tar.gz &&
-			tar xzvf openssl-$target_openssl_ver.tar.gz &&
-			cd openssl-$target_openssl_ver &&
-			./config no-ssl2 no-ssl3 zlib-dynamic -fPIC shared --prefix=/opt/openssl &&
-			make depend -j$cpu_cores && make install"
-		openssl_ver="$target_openssl_ver"
-		cd "$org_pwd"
-	fi
-	openssl_dir="/opt/openssl"
-	sudo rm -rf /opt/openssl/ssl/certs
-	sudo ln -s /etc/ssl/certs/ /opt/openssl/ssl/.
-	sudo mkdir -p /etc/apt/trusted.gpg.d/
+need_export_apt_key="1"
+# Ubuntu 24.04: always build OpenSSL 1.1.1w for Ruby 2.7.6 compatibility
+# 安裝在 rulingcom 的 home 目錄下
+OPENSSL_INSTALL_DIR="$HOME/openssl"
+if [[ ! -d "$OPENSSL_INSTALL_DIR" ]]; then
+	target_openssl_ver="1.1.1w"
+	cpu_cores="$(nproc --all)"
+	if [[ -z "$cpu_cores" ]]; then cpu_cores="1"; fi
+	cd /tmp
+	wget https://www.openssl.org/source/openssl-$target_openssl_ver.tar.gz --no-check-certificate -O openssl-$target_openssl_ver.tar.gz
+	tar xzvf openssl-$target_openssl_ver.tar.gz
+	cd openssl-$target_openssl_ver
+	./config no-ssl2 no-ssl3 zlib-dynamic -fPIC shared --prefix=$OPENSSL_INSTALL_DIR
+	make depend -j$cpu_cores
+	make -j$cpu_cores
+	touch apps/CA.pl
+	make install_sw
+	make install_ssldirs
+	chown -R $USER:$USER $OPENSSL_INSTALL_DIR 2>/dev/null || true
+	# 設定動態連結庫路徑，讓系統找得到 libssl.so.1.1
+	echo "$OPENSSL_INSTALL_DIR/lib" | sudo tee /etc/ld.so.conf.d/openssl-1.1.conf
+	sudo ldconfig
+	openssl_ver="$target_openssl_ver"
+	cd "$org_pwd"
 fi
+openssl_dir="$OPENSSL_INSTALL_DIR"
+rm -rf $OPENSSL_INSTALL_DIR/ssl/certs 2>/dev/null || true
+sudo ln -sf /etc/ssl/certs/ $OPENSSL_INSTALL_DIR/ssl/.
+sudo mkdir -p /etc/apt/trusted.gpg.d/
+
 sudo mkdir -p /etc/nginx/orbit_sites
 nginx_conf="/etc/nginx/nginx.conf"
-if [ -z "$(grep 'orbit_sites' $nginx_conf)" ]; then
-	sudo sed -i 's/\(include\ \/etc\/nginx\/sites-enabled\/\*\;\)/\1\n    include\ \/etc\/nginx\/orbit_sites\/*;/g' $nginx_conf
-fi
-if [[ "$ubuntu_version" > '22' ]]; then #Use root account prevent reading socket denied
-	sudo sed -E -i 's/^[# ]*user.*/user root;/g' /etc/nginx/nginx.conf
-fi
+# Use Python to safely inject orbit_sites include and set user root
+sudo python3 - "$nginx_conf" <<'PYEOF'
+import sys, re
+
+path = sys.argv[1]
+with open(path, 'r') as f:
+    content = f.read()
+
+# 1. Set/fix user directive to "user root;"
+content = re.sub(r'^[ \t]*#*[ \t]*user\b.*$', 'user root;', content, flags=re.MULTILINE)
+# If no user line exists at all, add it after the first comment block
+if not re.search(r'^user\s+root;', content, re.MULTILINE):
+    content = re.sub(r'(^include\s+/etc/nginx/modules-enabled)', r'user root;\n\1', content, flags=re.MULTILINE, count=1)
+
+# 2. Add orbit_sites include if missing
+if 'orbit_sites' not in content:
+    # Try inserting after sites-enabled include (commented or not)
+    # Find the http block closing brace
+    http_match = re.search(r'\bhttp\s*\{', content)
+    if http_match:
+        depth = 0
+        start = http_match.start()
+        http_end = None
+        for i, ch in enumerate(content[start:], start):
+            if ch == '{': depth += 1
+            elif ch == '}':
+                depth -= 1
+                if depth == 0:
+                    http_end = i
+                    break
+        if http_end is not None:
+            insert = '\n    include /etc/nginx/orbit_sites/*;\n'
+            content = content[:http_end] + insert + content[http_end:]
+
+with open(path, 'w') as f:
+    f.write(content)
+print("nginx.conf: user root and orbit_sites include updated.")
+PYEOF
+
 cd $org_pwd
 sudo apt-get install gnupg -y
 if [ -z "$(which mongod)" ]; then
@ -299,14 +347,11 @@ if [ -z "$(which mongod)" ]; then
 else
 	org_mongod_ver=`mongod --version|grep 'Build Info' -A 20|grep 'version'|sed -E 's/\s*"version"://g'|cut -d '"' -f 2`
 fi
-if [[ "$ubuntu_version" =~ '14' ]]; then
-	install_mongodb "3.2"
+# Ubuntu 24.04: 沒有 AVX 裝 4.4，有 AVX 裝 7.0
+if [ -z "$(lscpu |grep -w 'avx')" ]; then #Latest version not use avx instruction is 4.4.
+	install_mongodb "4.4"
 else
-	if [ -z "$(lscpu |grep -w 'avx')" ]; then #Latest version not use avx instruction is 4.4.
-		install_mongodb "4.4"
-	else
-		install_mongodb "6.0"
-	fi
+	install_mongodb "7.0"
 fi
 # build ImageMagick and install
 if [ -z $(which convert) ]; then
@ -316,7 +361,7 @@ if [ -z $(which convert) ]; then
 	fi
 	tmp_pwd="$(pwd)"
 	sudo bash -l -c "cd /root && \
-	apt-get install libjpeg62 -y && \
+	apt-get install -y libjpeg62 && \
 	wget -nc http://download.sourceforge.net/libpng/libpng-1.5.13.tar.gz && \
 	tar xvfz libpng-1.5.13.tar.gz && \
 	cd libpng-1.5.13/ && \
@ -339,42 +384,109 @@ if [ -z $(which convert) ]; then
 	if [[ "$remove_1_dir" == "1" ]]; then
 		rm -rf 1/
 	fi
+	# Ubuntu 24.04 fallback: if source build failed, install imagemagick via apt
+	if [ -z $(which convert) ]; then
+		echo "ImageMagick source build failed, falling back to apt install..."
+		sudo apt install -y imagemagick
+	fi
 fi
-## install rvm
+## install rvm（安裝在 $HOME/.rvm，user 層級）
 if [ -z $(which rvm) ]; then
-	sudo apt-get install --reinstall ca-certificates -y
-	sudo apt-add-repository -y ppa:rael-gc/rvm
-	sudo apt-get update
-	sudo apt-get install rvm -y
-	sudo usermod -a -G rvm $USER
-	echo 'source "/etc/profile.d/rvm.sh"' >> ~/.bashrc
-	source "/etc/profile.d/rvm.sh"
-	sudo chown $USER:$USER $HOME -R
-	rvm user gemsets
-	sudo chown $USER:$USER /usr/share/rvm -R
+	sudo apt-get install --reinstall ca-certificates curl gnupg2 -y
+	# 匯入 GPG key 到目前使用者的 keyring
+	curl -sSL https://rvm.io/mpapis.asc | gpg2 --import - 2>/dev/null || true
+	curl -sSL https://rvm.io/pkuczynski.asc | gpg2 --import - 2>/dev/null || true
+	# 安裝 RVM 到 user 層級（~/.rvm）
+	curl -sSL https://get.rvm.io | bash -s stable
+	# 載入 rvm
+	if [ -f "$HOME/.rvm/scripts/rvm" ]; then
+		source "$HOME/.rvm/scripts/rvm"
+		# 建立 profile.d 捷徑讓系統可以找到
+		sudo ln -sf "$HOME/.rvm/scripts/rvm" /etc/profile.d/rvm.sh 2>/dev/null || true
+	fi
+	echo 'source "$HOME/.rvm/scripts/rvm"' >> ~/.bashrc
+	rvm user gemsets 2>/dev/null || true
 fi

-if [ -z "$(grep rvm_max_time_flag ~/.rvmrc)" ]; then
-	echo "rvm_max_time_flag=200" >> ~/.rvmrc # timeout = 200 minutes
-fi
+# 修復 .rvmrc 路徑設定（確保 rvm_path 和 rvm_scripts_path 正確）
+cat > ~/.rvmrc << 'RVMRCEOF'
+export rvm_path="$HOME/.rvm"
+export rvm_scripts_path="$HOME/.rvm/scripts"
+rvm_max_time_flag=200
+RVMRCEOF
 source ~/.rvmrc

 source "/etc/profile.d/rvm.sh"
-# install ruby 2.7.6
-if [[ -z "$openssl_dir" ]]; then
-	rvm install 2.7.6  --with-jemalloc
+# =========================================================
+# 安裝 Ruby 2.7.6（整合自 install_ruby_2_7_6_fix.sh）
+# 修復：GCC 相容性 CFLAGS、變數傳遞問題、安裝前驗證
+# =========================================================
+
+# 驗證 OpenSSL 是否正確編譯
+if [[ ! -f "$openssl_dir/lib/libssl.so" ]] && [[ ! -f "$openssl_dir/lib/libssl.a" ]]; then
+	echo "ERROR: OpenSSL not found at $openssl_dir, cannot build Ruby with OpenSSL support!"
+	push_messages "ERROR: OpenSSL missing at $openssl_dir - Ruby install will fail!"
 else
-	export CPPFLAGS="-I$openssl_dir/include"
-	export LDFLAGS="-L$openssl_dir/lib"
-	rvm install 2.7.6 -- --with-openssl-dir="$openssl_dir"  --with-jemalloc
+	echo "OpenSSL found at $openssl_dir, proceeding with Ruby 2.7.6 install..."
 fi
-rvm --default use 2.7.6
+
+# 移除舊版（若存在），避免殘留檔案干擾
+if rvm list | grep -q "2.7.6"; then
+	echo "Removing existing ruby-2.7.6 before reinstall..."
+	rvm remove "2.7.6" --force 2>/dev/null || true
+fi
+
+# 設定編譯環境變數
+export LD_LIBRARY_PATH="$openssl_dir/lib"
+export CPPFLAGS="-I$openssl_dir/include"
+export LDFLAGS="-L$openssl_dir/lib"
+# 修復：Ubuntu 24.04 的 GCC 版本對舊版 Ruby C 原始碼有嚴格檢查，
+# 以下 flags 可忽略已知的不相容警告，防止編譯被 -Werror 中斷
+export CFLAGS="-Wno-error=incompatible-pointer-types -Wno-implicit-function-declaration -Wno-discarded-qualifiers"
+
+# 安裝 Ruby 2.7.6
+# 注意：版本號使用字串字面值，避免 subshell 變數遺失導致 'all' 錯誤
+# patch openssl_missing.c 修復 HMAC_CTX 編譯問題
+rvm fetch "2.7.6" 2>/dev/null || true
+RUBY_SRC="$HOME/.rvm/src/ruby-2.7.6"
+if [ -f "$RUBY_SRC/ext/openssl/openssl_missing.c" ]; then
+	sed -i 's/HMAC_CTX \*ctx = OPENSSL_malloc(sizeof(HMAC_CTX))/HMAC_CTX *ctx = HMAC_CTX_new()/g' "$RUBY_SRC/ext/openssl/openssl_missing.c"
+	echo "openssl_missing.c patched"
+fi
+
+rvm install "2.7.6" \
+	--verify-downloads 1 \
+	--with-openssl-dir="$openssl_dir" \
+	--with-opt-dir="$openssl_dir" \
+	-- \
+	--with-jemalloc
+
+# 清除臨時編譯環境變數
+unset LD_LIBRARY_PATH CPPFLAGS LDFLAGS CFLAGS
+
+# 設定為預設版本並驗證
+rvm --default use "2.7.6"
+
+# 驗證 Ruby + OpenSSL 是否正常運作
+if ruby -ropenssl -e 'puts OpenSSL::VERSION' &>/dev/null; then
+	echo "=========================================================="
+	echo "✅ Ruby 2.7.6 安裝成功"
+	echo "   Ruby 版本  : $(ruby -v)"
+	echo "   OpenSSL 版本: $(ruby -ropenssl -e 'puts OpenSSL::OPENSSL_VERSION')"
+	echo "=========================================================="
+else
+	echo "=========================================================="
+	echo "❌ Ruby 2.7.6 安裝失敗，請檢查 log："
+	ls ~/.rvm/log/*/ruby-2.7.6/make.log 2>/dev/null || echo "  找不到 make log"
+	echo "=========================================================="
+	push_messages "ERROR: Ruby 2.7.6 install failed! Check ~/.rvm/log/*/ruby-2.7.6/make.log"
+fi
+
 gem install bundler -v 2.1.4
 gem install zip
 gem install nokogiri -v 1.8.5 #for ruby 2.7.6
-#gem install nokogiri -v 1.7.0.1 #for ruby 2.1.10
 sudo apt-get install screen -y
-sudo sed -i 's/#cron\.\*/cron\.\*/g' /etc/rsyslog.d/50-default.conf
+sudo sed -i 's/#cron\.\*/cron\.*/g' /etc/rsyslog.d/50-default.conf
 sudo service rsyslog restart
 sudo mkdir /home/backup/db/ -p
 sudo mkdir /home/backup/orbit/ -p
@ -392,11 +504,13 @@ else
 		sudo sed -i "$(echo "s/[#\s\t]*backup\t$(echo $HOME|sed 's/\//\\\//g')\t\([^ \t]\+\).*/backup\t$(echo $HOME|sed 's/\//\\\//g')\t\1\texclude=.rvm/g")" /etc/rsnapshot.conf
 	fi
 fi
-sudo wget -nc http://orbitgit.cloud/erictyl/install_r45_on_ubuntu_1804lts_doc/-/raw/master/orbit_logrotate -O /etc/logrotate.d/orbit
+# [TEST] 使用本地 orbit_logrotate，略過從 orbitgit.cloud 下載
+sudo cp "$(dirname "$0")/orbit_logrotate" /etc/logrotate.d/orbit
 sudo sed -i "s/rulingcom/$USER/g" /etc/logrotate.d/orbit
 sudo logrotate -d /etc/logrotate.conf
 sudo /usr/sbin/logrotate -f /etc/logrotate.conf
-sudo wget -nc http://orbitgit.cloud/erictyl/install_r45_on_ubuntu_1804lts_doc/-/raw/master/orbit_service.sh -O /etc/init.d/orbit
+# [TEST] 使用本地 orbit_service.sh，略過從 orbitgit.cloud 下載
+sudo cp "$(dirname "$0")/orbit_service.sh" /etc/init.d/orbit
 sudo sed -i "s/ORBIT_USER=.*/ORBIT_USER=$USER/g" /etc/init.d/orbit
 sudo chmod 755 /etc/init.d/orbit
 sudo update-rc.d orbit defaults
@ -435,4 +549,13 @@ push_messages "You can use the following command to create web!"
 push_messages "$ sudo /etc/init.d/orbit create \$site_path"
 push_messages "Ex: sudo /etc/init.d/orbit create orbit_sites/orbit"
 push_messages "Ex: sudo /etc/init.d/orbit create /home/rulingcom/orbit_sites/orbit"
-write_messages
+write_messages
+
+# 自動執行 fix_ruby.sh
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+if [ -f "$SCRIPT_DIR/fix_ruby.sh" ]; then
+	chmod +x "$SCRIPT_DIR/fix_ruby.sh"
+	bash -l "$SCRIPT_DIR/fix_ruby.sh"
+fi
+
+# 清除工作由 orbit-install.service 的 ExecStartPost 以 root 身份執行
--- a/install_sync_fgu.rb
+++ b/install_sync_fgu.rb
@ -54,4 +54,4 @@ a.each do |d|
 			end
 		end
 	end
-end
+end
--- a/libssl1.1_1.1.1f-1ubuntu2_amd64.deb
+++ b/libssl1.1_1.1.1f-1ubuntu2_amd64.deb
--- a/modsecurity_main.conf
+++ b/modsecurity_main.conf
@ -5,4 +5,4 @@
 Include "/etc/nginx/modsec/modsecurity.conf"

 # Basic test rule
-SecRule ARGS:testparam "@contains test" "id:1234,deny,status:403"
+SecRule ARGS:testparam "@contains test" "id:1234,deny,status:403"
--- a/mongo_service.sh
+++ b/mongo_service.sh
@ -99,4 +99,4 @@ status)
 			echo "mongo is already running."
 		fi
 	fi
-esac
+esac
--- a/move_site.sh
+++ b/move_site.sh
@ -118,7 +118,7 @@ else
 		$scp_command$root_path/.[^.]* $local_store_path/. 2>>/dev/null
 		if [[ ! -z "$org_ssl_dir" ]]; then
 			if [ -z "$(which certbot)" ]; then
-				wget http://orbitgit.cloud/erictyl/install_r45_on_ubuntu_1804lts_doc/-/raw/master/install_certbot.sh
+				cp "$(dirname "$0")/install_certbot.sh" ./install_certbot.sh
 				sudo_command bash ./install_certbot.sh
 			fi
 		fi
@ -202,11 +202,11 @@ else
 		fi
 		bundle install
 		rm -f tmp/unicorn.sock tmp/pids/unicorn.pid
-		wget http://orbitgit.cloud/erictyl/install_r45_on_ubuntu_1804lts_doc/-/raw/master/start_site.sh -O start_site.sh
-		wget http://orbitgit.cloud/erictyl/install_r45_on_ubuntu_1804lts_doc/-/raw/master/close_site.sh -O close_site.sh
+		cp "$(dirname "$0")/start_site.sh" ./start_site.sh
+		cp "$(dirname "$0")/close_site.sh" ./close_site.sh
 		bash ./start_site.sh production
 		echo "Finish moving and installing site!"
 		echo "Site Path: $local_store_path"
 		exit_command 0;
 	fi
-fi
+fi
--- a/move_site_interactive.sh
+++ b/move_site_interactive.sh
@ -122,7 +122,7 @@ else
 		$scp_command$root_path/.[^.]* $local_store_path/. 2>>/dev/null
 		if [[ ! -z "$org_ssl_dir" ]]; then
 			if [ -z "$(which certbot)" ]; then
-				wget http://orbitgit.cloud/erictyl/install_r45_on_ubuntu_1804lts_doc/-/raw/master/install_certbot.sh
+				cp "$(dirname "$0")/install_certbot.sh" ./install_certbot.sh
 				sudo_command bash ./install_certbot.sh
 			fi
 		fi
@ -206,11 +206,11 @@ else
 		fi
 		bundle install
 		rm -f tmp/unicorn.sock tmp/pids/unicorn.pid
-		wget http://orbitgit.cloud/erictyl/install_r45_on_ubuntu_1804lts_doc/-/raw/master/start_site.sh -O start_site.sh
-		wget http://orbitgit.cloud/erictyl/install_r45_on_ubuntu_1804lts_doc/-/raw/master/close_site.sh -O close_site.sh
+		cp "$(dirname "$0")/start_site.sh" ./start_site.sh
+		cp "$(dirname "$0")/close_site.sh" ./close_site.sh
 		bash ./start_site.sh production
 		echo "Finish moving and installing site!"
 		echo "Site Path: $local_store_path"
 		exit_command 0;
 	fi
-fi
+fi
--- a/nginx.service
+++ b/nginx.service
@ -27,3 +27,4 @@ KillMode=mixed

 [Install]
 WantedBy=multi-user.target
+
--- a/nginx4-5.conf
+++ b/nginx4-5.conf
@ -20,4 +20,4 @@ server {
    proxy_connect_timeout   360;
    proxy_pass http://{{ORBIT}}_sock;
  }
-}
+}
--- a/nginx_service.sh
+++ b/nginx_service.sh
@ -194,3 +194,4 @@ case "$1" in
 		exit 3
 		;;
 esac
+
--- a/2
+++ b/2
@ -33,4 +33,4 @@
  postrotate
    [ ! -f /var/lib/mongodb/mongod.lock ] || kill -USR1 `cat /var/lib/mongodb/mongod.lock`
  endscript
-}
+}
--- a/2
+++ b/2
@ -27,4 +27,4 @@ server {
 #   proxy_pass http://xxx_sock;
    proxy_pass http://orbit_sock;
  }
-}
+}
--- a/orbit_service.sh
+++ b/orbit_service.sh
@ -282,7 +282,7 @@ create)
    done

    cd ~
-    sudo wget http://orbitgit.cloud/erictyl/install_r45_on_ubuntu_1804lts_doc/-/raw/master/nginx4-5.conf -O $NGINX_ORBIT_SITES/$site_name
+    sudo cp "$(dirname "$0")/nginx4-5.conf" $NGINX_ORBIT_SITES/$site_name
    sudo perl -pi -e "s/\{\{ORBIT\}\}/$site_name/g" $NGINX_ORBIT_SITES/$site_name
    sudo perl -pi -e "s#\{\{ORBIT_SITES\}\}#${ORBIT_SITES}#g" $NGINX_ORBIT_SITES/$site_name
    sudo perl -pi -e "s/\{\{PORT\}\}/$PORT/g" $NGINX_ORBIT_SITES/$site_name
@ -305,7 +305,7 @@ create)
    exit 0
    ;;
 setup)
-    wget http://orbitgit.cloud/erictyl/install_r45_on_ubuntu_1804lts_doc/-/raw/master/install_orbit_environment.sh -O install_orbit_environment.sh
+    cp "$(dirname "$0")/install_orbit_environment.sh" install_orbit_environment.sh
    source install_orbit_environment.sh
    echo ""
    echo "-----------------------------------------------------"
@ -320,3 +320,4 @@ setup)
    exit 1
    ;;
 esac
+
--- a/ruby_gc_malloc_trim.patch
+++ b/ruby_gc_malloc_trim.patch
@ -31,3 +31,4 @@ index 1331ef21dc..12caa162e7 100644
     }
     gc_prof_timer_stop(objspace);
 
+
--- a/2
+++ b/2
@ -78,4 +78,4 @@ server {
 #        root   html;
 #        index  index.html index.htm;
 #    }
-#}
+#}
--- a/start_site.sh
+++ b/start_site.sh
@ -11,4 +11,4 @@ if [ -z "$4" ]; then
 	bundle exec unicorn_rails -c config/unicorn.rb -E $rails_env $daemon_args $3
 else
 	bundle exec unicorn_rails -c config/unicorn.rb -E $rails_env $daemon_args $3  "$4"
-fi
+fi
				`@ -0,0 +1 @@`
				`(此 log 由上次執行產生，請重新執行 install_orbit_environment.sh 更新)`