2025-10-29 10:04:29 +08:00
16 changed files with 225 additions and 79 deletions
--- a/src/metric/prometheus/build/Dockerfile
+++ b/src/metric/prometheus/build/Dockerfile
@ -11,13 +11,6 @@ RUN if [ "$USE_INTRANET" = "true" ]; then \
        echo "deb [trusted=yes] http://10.68.64.1/ubuntu2204/ jammy main" > /etc/apt/sources.list && \
        echo 'Acquire::https::Verify-Peer "false";' > /etc/apt/apt.conf.d/99disable-ssl-check && \
        echo 'Acquire::https::Verify-Host "false";' >> /etc/apt/apt.conf.d/99disable-ssl-check; \
-    else \
-        echo "Configuring fast apt sources for external network..." && \
-        find /etc/apt -name "sources.list*" -exec sed -i 's/archive.ubuntu.com/mirrors.aliyun.com/g' {} \; && \
-        find /etc/apt -name "sources.list*" -exec sed -i 's/security.ubuntu.com/mirrors.aliyun.com/g' {} \; && \
-        echo "deb http://mirrors.aliyun.com/ubuntu/ jammy main restricted universe multiverse" > /etc/apt/sources.list && \
-        echo "deb http://mirrors.aliyun.com/ubuntu/ jammy-updates main restricted universe multiverse" >> /etc/apt/sources.list && \
-        echo "deb http://mirrors.aliyun.com/ubuntu/ jammy-security main restricted universe multiverse" >> /etc/apt/sources.list; \
    fi

 # 验证源配置并安装常用工具
--- a/src/sys/tests/README.md
+++ b/src/sys/tests/README.md
@ -56,13 +56,14 @@
  - 自定义 bridge：`argus-sys-net`，子网 `172.31.0.0/16`
  - 固定地址：bind=`172.31.0.2`，master=`172.31.0.10`

- 服务与端口
+- 服务与端口（宿主机映射端口由 `01_bootstrap.sh` 自动分配并写入 `.env`）
+  - 关键变量：`MASTER_PORT`、`ES_HTTP_PORT`、`KIBANA_PORT`、`NODE_A_PORT`、`NODE_B_PORT`、`PROMETHEUS_PORT`、`GRAFANA_PORT`、`ALERTMANAGER_PORT`、`WEB_PROXY_PORT_8080..8085`、`FTP_PORT`、`FTP_DATA_PORT`、`FTP_PASSIVE_HOST_RANGE`
  - `bind`（`argus-bind9:latest`）：监听 53/tcp+udp；负责同步 `*.argus.com` 记录
-  - `master`（`argus-master:latest`）：对外 `32300→3000`；API `http://localhost:32300`
-  - `es`（`argus-elasticsearch:latest`）：`9200→9200`；单节点，无安全
-  - `kibana`（`argus-kibana:latest`）：`5601→5601`；通过 `ELASTICSEARCH_HOSTS=http://es:9200` 访问 ES
-  - `node-a`（`ubuntu:22.04`）：同时运行 Fluent Bit + argus-agent，`hostname=dev-yyrshare-nbnyx10-cp2f-pod-0`，`2020→2020`
-  - `node-b`（`ubuntu:22.04`）：同时运行 Fluent Bit + argus-agent，`hostname=dev-yyrshare-uuuu10-ep2f-pod-0`，`2021→2020`
+  - `master`（`argus-master:latest`）：对外 `${MASTER_PORT}→3000`；API `http://localhost:${MASTER_PORT}`
+  - `es`（`argus-elasticsearch:latest`）：`${ES_HTTP_PORT}→9200`；单节点，无安全
+  - `kibana`（`argus-kibana:latest`）：`${KIBANA_PORT}→5601`；通过 `ELASTICSEARCH_HOSTS=http://es:9200` 访问 ES
+  - `node-a`（`ubuntu:22.04`）：同时运行 Fluent Bit + argus-agent，`hostname=dev-yyrshare-nbnyx10-cp2f-pod-0`，`${NODE_A_PORT}→2020`
+  - `node-b`（`ubuntu:22.04`）：同时运行 Fluent Bit + argus-agent，`hostname=dev-yyrshare-uuuu10-ep2f-pod-0`，`${NODE_B_PORT}→2020`

 - 卷与目录
  - 核心服务（bind/master/es/kibana）共享宿主 `./private` 挂载到容器 `/private`
--- a/src/sys/tests/docker-compose.yml
+++ b/src/sys/tests/docker-compose.yml
@ -29,7 +29,7 @@ services:
      - ARGUS_BUILD_UID=${ARGUS_BUILD_UID:-2133}
      - ARGUS_BUILD_GID=${ARGUS_BUILD_GID:-2015}
    ports:
-      - "32300:3000"
+      - "${MASTER_PORT:-32300}:3000"
    volumes:
      - ./private/argus/master:/private/argus/master
      - ./private/argus/metric/prometheus:/private/argus/metric/prometheus
@ -52,7 +52,7 @@ services:
      - ./private/argus/log/elasticsearch:/private/argus/log/elasticsearch
      - ./private/argus/etc:/private/argus/etc
    ports:
-      - "9200:9200"
+      - "${ES_HTTP_PORT:-9200}:9200"
    restart: unless-stopped
    networks:
      sysnet:
@ -71,7 +71,7 @@ services:
    depends_on:
      - es
    ports:
-      - "5601:5601"
+      - "${KIBANA_PORT:-5601}:5601"
    restart: unless-stopped
    networks:
      sysnet:
@ -104,9 +104,10 @@ services:
    entrypoint:
      - /usr/local/bin/node-entrypoint.sh
    dns:
-      - 172.31.0.2
+      - 172.31.0.2   # internal bind for *.argus.com
+      - 8.8.8.8      # external fallback for apt/external domains
    ports:
-      - "2020:2020"
+      - "${NODE_A_PORT:-2020}:2020"
    restart: unless-stopped
    networks:
      - sysnet
@ -139,8 +140,9 @@ services:
      - /usr/local/bin/node-entrypoint.sh
    dns:
      - 172.31.0.2
+      - 8.8.8.8
    ports:
-      - "2021:2020"
+      - "${NODE_B_PORT:-2021}:2020"
    restart: unless-stopped
    networks:
      - sysnet
@ -159,7 +161,7 @@ services:
    ports:
      - "${FTP_PORT:-21}:21"
      - "${FTP_DATA_PORT:-20}:20"
-      - "21100-21110:21100-21110"
+      - "${FTP_PASSIVE_HOST_RANGE:-21100-21110}:21100-21110"
    volumes:
      - ./private/argus/metric/ftp:/private/argus/ftp
      - ./private/argus/etc:/private/argus/etc
@ -281,6 +283,9 @@ services:
    command:
      - sleep
      - infinity
+    dns:
+      - 172.31.0.2
+      - 8.8.8.8
    networks:
      sysnet:
        ipv4_address: 172.31.0.50
@ -328,6 +333,9 @@ services:
    command:
      - sleep
      - infinity
+    dns:
+      - 172.31.0.2
+      - 8.8.8.8
    networks:
      sysnet:
        ipv4_address: 172.31.0.51
@ -351,7 +359,7 @@ services:
      sysnet:
        ipv4_address: 172.31.0.82
    ports:
-      - "9093:9093"
+      - "${ALERTMANAGER_PORT:-9093}:9093"
    restart: unless-stopped
    logging:
      driver: "json-file"
@ -379,12 +387,12 @@ services:
      sysnet:
        ipv4_address: 172.31.0.81
    ports:
-      - "8080:8080"
-      - "8081:8081"
-      - "8082:8082"
-      - "8083:8083"
-      - "8084:8084"
-      - "8085:8085"
+      - "${WEB_PROXY_PORT_8080:-8080}:8080"
+      - "${WEB_PROXY_PORT_8081:-8081}:8081"
+      - "${WEB_PROXY_PORT_8082:-8082}:8082"
+      - "${WEB_PROXY_PORT_8083:-8083}:8083"
+      - "${WEB_PROXY_PORT_8084:-8084}:8084"
+      - "${WEB_PROXY_PORT_8085:-8085}:8085"
    restart: unless-stopped
    logging:
      driver: "json-file"
--- a/src/sys/tests/scripts/01_bootstrap.sh
+++ b/src/sys/tests/scripts/01_bootstrap.sh
@ -139,6 +139,77 @@ else
 fi

 echo "[INFO] Writing .env with UID/GID and metric configuration"
+#############################################
+# 动态分配宿主机端口并写入 .env
+#############################################
+
+# 读取现有 .env（若存在），用于保留密码/域名等
+EXIST_DOTENV="$TEST_ROOT/.env"
+if [[ -f "$EXIST_DOTENV" ]]; then
+  EXISTING_FTP_PASSWORD="$(grep -E '^FTP_PASSWORD=' "$EXIST_DOTENV" | tail -n1 | sed 's/^FTP_PASSWORD=//')"
+  EXISTING_FTP_DOMAIN="$(grep -E '^FTP_DOMAIN=' "$EXIST_DOTENV" | tail -n1 | sed 's/^FTP_DOMAIN=//')"
+  EXISTING_USE_INTRANET="$(grep -E '^USE_INTRANET=' "$EXIST_DOTENV" | tail -n1 | sed 's/^USE_INTRANET=//')"
+else
+  EXISTING_FTP_PASSWORD=""
+  EXISTING_FTP_DOMAIN=""
+  EXISTING_USE_INTRANET=""
+fi
+
+is_port_free() {
+  local p="$1"
+  ss -ltnH 2>/dev/null | awk -v pat=":${p}$" '$4 ~ pat{f=1} END{exit f?1:0}'
+}
+
+find_free_port() {
+  local prefer="$1"; local start_scan="${2:-20000}"; local max="${3:-65000}"
+  if is_port_free "$prefer"; then echo "$prefer"; return 0; fi
+  local p
+  for (( p=start_scan; p<=max; p++ )); do
+    if is_port_free "$p"; then echo "$p"; return 0; fi
+  done
+  return 1
+}
+
+find_free_range() {
+  local begin="$1"; local end="$2"; local need_count=$((end-begin+1))
+  local try_start="$begin"
+  while (( try_start + need_count - 1 <= 65000 )); do
+    local ok=1
+    for (( p=try_start; p<try_start+need_count; p++ )); do
+      if ! is_port_free "$p"; then ok=0; break; fi
+    done
+    if (( ok==1 )); then
+      echo "${try_start}-$((try_start+need_count-1))"; return 0
+    fi
+    ((try_start++))
+  done
+  return 1
+}
+
+# 优先端口（若占用则回退到 20000+ 的空闲）
+MASTER_PORT_VAL=$(find_free_port 32300)
+ES_HTTP_PORT_VAL=$(find_free_port 9200)
+KIBANA_PORT_VAL=$(find_free_port 5601)
+NODE_A_PORT_VAL=$(find_free_port 2020)
+NODE_B_PORT_VAL=$(find_free_port 2021)
+PROMETHEUS_PORT_VAL=$(find_free_port 9090)
+GRAFANA_PORT_VAL=$(find_free_port 3000)
+ALERTMANAGER_PORT_VAL=$(find_free_port 9093)
+WEB_PROXY_PORT_8080_VAL=$(find_free_port 8080 18080 65000)
+WEB_PROXY_PORT_8081_VAL=$(find_free_port 8081 18081 65000)
+WEB_PROXY_PORT_8082_VAL=$(find_free_port 8082 18082 65000)
+WEB_PROXY_PORT_8083_VAL=$(find_free_port 8083 18083 65000)
+WEB_PROXY_PORT_8084_VAL=$(find_free_port 8084 18084 65000)
+WEB_PROXY_PORT_8085_VAL=$(find_free_port 8085 18085 65000)
+
+# FTP 控制/数据端口：若 21/20 被占用则回退到空闲
+FTP_PORT_VAL=$(find_free_port 21 2121 65000)
+FTP_DATA_PORT_VAL=$(find_free_port 20 2120 65000)
+
+# FTP 被动端口范围：优先 21100-21110，若被占用则向后平移
+FTP_PASV_RANGE_VAL="$(find_free_range 21100 21110 || echo 22100-22110)"
+
+# 变量持久化到 .env
 cat > "$TEST_ROOT/.env" <<EOF
 ARGUS_BUILD_UID=$ARGUS_BUILD_UID
 ARGUS_BUILD_GID=$ARGUS_BUILD_GID
@ -146,20 +217,31 @@ ARGUS_BUILD_GID=$ARGUS_BUILD_GID
 # GPU 配置
 ENABLE_GPU=$GPU_AVAILABLE

-# FTP 配置
-FTP_PORT=21
-FTP_DATA_PORT=20
-FTP_PASSWORD=ZGClab1234!
-FTP_DOMAIN=ftp.metric.argus.com
+# Master/日志/监控等服务的宿主机端口（自动分配）
+MASTER_PORT=$MASTER_PORT_VAL
+ES_HTTP_PORT=$ES_HTTP_PORT_VAL
+KIBANA_PORT=$KIBANA_PORT_VAL
+NODE_A_PORT=$NODE_A_PORT_VAL
+NODE_B_PORT=$NODE_B_PORT_VAL
+PROMETHEUS_PORT=$PROMETHEUS_PORT_VAL
+GRAFANA_PORT=$GRAFANA_PORT_VAL
+ALERTMANAGER_PORT=$ALERTMANAGER_PORT_VAL
+WEB_PROXY_PORT_8080=$WEB_PROXY_PORT_8080_VAL
+WEB_PROXY_PORT_8081=$WEB_PROXY_PORT_8081_VAL
+WEB_PROXY_PORT_8082=$WEB_PROXY_PORT_8082_VAL
+WEB_PROXY_PORT_8083=$WEB_PROXY_PORT_8083_VAL
+WEB_PROXY_PORT_8084=$WEB_PROXY_PORT_8084_VAL
+WEB_PROXY_PORT_8085=$WEB_PROXY_PORT_8085_VAL

-# Prometheus 配置
-PROMETHEUS_PORT=9090
-
-# Grafana 配置
-GRAFANA_PORT=3000
+# FTP 配置（自动分配：若21/20占用则使用高位端口）
+FTP_PORT=$FTP_PORT_VAL
+FTP_DATA_PORT=$FTP_DATA_PORT_VAL
+FTP_PASSIVE_HOST_RANGE=$FTP_PASV_RANGE_VAL
+FTP_PASSWORD=${EXISTING_FTP_PASSWORD:-ZGClab1234!}
+FTP_DOMAIN=${EXISTING_FTP_DOMAIN:-ftp.metric.argus.com}

 # 网络配置
-USE_INTRANET=false
+USE_INTRANET=${EXISTING_USE_INTRANET:-false}
 EOF

-echo "[OK] Bootstrap completed"
+echo "[OK] Bootstrap completed. Ports written to $TEST_ROOT/.env"
--- a/src/sys/tests/scripts/02_up.sh
+++ b/src/sys/tests/scripts/02_up.sh
@ -15,6 +15,11 @@ compose() {

 echo "[INFO] Bringing up system stack..."

+# 加载 .env 以获取端口（由 01_bootstrap 生成）
+if [[ -f "$TEST_ROOT/.env" ]]; then
+  set -a; source "$TEST_ROOT/.env"; set +a
+fi
+
 REQUEST_GPU=${ARGUS_SYS_ENABLE_GPU:-false}
 GPU_AVAILABLE=false
 GPU_CHECK_SCRIPT="$REPO_ROOT/src/metric/tests/scripts/common/check-gpu.sh"
@ -58,7 +63,13 @@ check_port_free() {
  return 0
 }

-for port in 8080 8081 8082 8083 8084 8085; do
+for port in \
+  "${WEB_PROXY_PORT_8080:-8080}" \
+  "${WEB_PROXY_PORT_8081:-8081}" \
+  "${WEB_PROXY_PORT_8082:-8082}" \
+  "${WEB_PROXY_PORT_8083:-8083}" \
+  "${WEB_PROXY_PORT_8084:-8084}" \
+  "${WEB_PROXY_PORT_8085:-8085}"; do
  check_port_free "$port" || { echo "[ERR] Required port busy: $port"; exit 1; }
 done

@ -80,7 +91,7 @@ fi
 popd >/dev/null

 if [[ "$GPU_AVAILABLE" == true ]]; then
-  echo "[OK] Services started: master:32300 es:9200 kibana:5601 node-a:2020 node-b:2021 test-gpu-node:172.31.0.51"
+  echo "[OK] Services started: master:${MASTER_PORT:-32300} es:${ES_HTTP_PORT:-9200} kibana:${KIBANA_PORT:-5601} node-a:${NODE_A_PORT:-2020} node-b:${NODE_B_PORT:-2021} test-gpu-node:172.31.0.51"
 else
-  echo "[OK] Services started: master:32300 es:9200 kibana:5601 node-a:2020 node-b:2021 (gpu skipped)"
+  echo "[OK] Services started: master:${MASTER_PORT:-32300} es:${ES_HTTP_PORT:-9200} kibana:${KIBANA_PORT:-5601} node-a:${NODE_A_PORT:-2020} node-b:${NODE_B_PORT:-2021} (gpu skipped)"
 fi
--- a/src/sys/tests/scripts/03_wait_ready.sh
+++ b/src/sys/tests/scripts/03_wait_ready.sh
@ -27,11 +27,16 @@ wait_http() {

 echo "[INFO] Waiting for ES/Kibana/Master/Fluent Bit/Bind..."

+# 载入端口变量
+if [[ -f "$TEST_ROOT/.env" ]]; then
+  set -a; source "$TEST_ROOT/.env"; set +a
+fi
+
 # ES (>= yellow)
 attempt=1; max=120
 ES_T0=$(date +%s)
 while (( attempt <= max )); do
-  if curl -fsS "http://localhost:9200/_cluster/health?wait_for_status=yellow&timeout=1s" >/dev/null 2>&1; then
+  if curl -fsS "http://localhost:${ES_HTTP_PORT:-9200}/_cluster/health?wait_for_status=yellow&timeout=1s" >/dev/null 2>&1; then
    break
  fi
  echo "[..] waiting ES ($attempt/$max)"; sleep 5; ((attempt++))
@ -44,8 +49,8 @@ echo "[INFO] Waiting for Kibana to be available (HTTP 200)..."
 kb_attempt=1; kb_max=180
 KB_T0=$(date +%s)
 while (( kb_attempt <= kb_max )); do
-  body=$(curl -sS "http://localhost:5601/api/status" 2>/dev/null || true)
-  code=$(curl -s -o /dev/null -w "%{http_code}" "http://localhost:5601/api/status" || echo 000)
+  body=$(curl -sS "http://localhost:${KIBANA_PORT:-5601}/api/status" 2>/dev/null || true)
+  code=$(curl -s -o /dev/null -w "%{http_code}" "http://localhost:${KIBANA_PORT:-5601}/api/status" || echo 000)
  if [[ "$code" == "200" ]]; then
    if echo "$body" | grep -q '"level":"available"'; then
      KB_T1=$(date +%s)
@ -63,12 +68,12 @@ fi

 # Master
 MASTER_T0=$(date +%s)
-wait_http "http://localhost:32300/readyz" 120
+wait_http "http://localhost:${MASTER_PORT:-32300}/readyz" 120
 MASTER_T1=$(date +%s); echo "[TIME] Master readyz in $((MASTER_T1-MASTER_T0))s"

 # Fluent Bit (host metrics on host ports)
-FB1_T0=$(date +%s); wait_http "http://localhost:2020/api/v2/metrics" 120; FB1_T1=$(date +%s); echo "[TIME] FluentBit:2020 in $((FB1_T1-FB1_T0))s"
-FB2_T0=$(date +%s); wait_http "http://localhost:2021/api/v2/metrics" 120; FB2_T1=$(date +%s); echo "[TIME] FluentBit:2021 in $((FB2_T1-FB2_T0))s"
+FB1_T0=$(date +%s); wait_http "http://localhost:${NODE_A_PORT:-2020}/api/v2/metrics" 120; FB1_T1=$(date +%s); echo "[TIME] FluentBit:${NODE_A_PORT:-2020} in $((FB1_T1-FB1_T0))s"
+FB2_T0=$(date +%s); wait_http "http://localhost:${NODE_B_PORT:-2021}/api/v2/metrics" 120; FB2_T1=$(date +%s); echo "[TIME] FluentBit:${NODE_B_PORT:-2021} in $((FB2_T1-FB2_T0))s"

 # Bind config check
 BIND_ID="$(service_id bind)"
@ -81,14 +86,14 @@ fi
 # ========== Additional module readiness checks ==========

 # Prometheus
-PROM_T0=$(date +%s); wait_http "http://localhost:9090/-/ready" 120; PROM_T1=$(date +%s); echo "[TIME] Prometheus ready in $((PROM_T1-PROM_T0))s"
+PROM_T0=$(date +%s); wait_http "http://localhost:${PROMETHEUS_PORT:-9090}/-/ready" 120; PROM_T1=$(date +%s); echo "[TIME] Prometheus ready in $((PROM_T1-PROM_T0))s"

 # Grafana health (database: ok)
 echo "[INFO] Waiting for Grafana health..."
 gf_attempt=1; gf_max=120
 while (( gf_attempt <= gf_max )); do
-  gf_body=$(curl -sS "http://localhost:3000/api/health" 2>/dev/null || true)
-  gf_code=$(curl -s -o /dev/null -w "%{http_code}" "http://localhost:3000/api/health" || echo 000)
+  gf_body=$(curl -sS "http://localhost:${GRAFANA_PORT:-3000}/api/health" 2>/dev/null || true)
+  gf_code=$(curl -s -o /dev/null -w "%{http_code}" "http://localhost:${GRAFANA_PORT:-3000}/api/health" || echo 000)
  if [[ "$gf_code" == "200" ]] && echo "$gf_body" | grep -q '"database"\s*:\s*"ok"'; then
    echo "[OK] Grafana health database=ok"
    break
@ -101,7 +106,7 @@ if (( gf_attempt > gf_max )); then
 fi

 # Alertmanager
-wait_http "http://localhost:9093/api/v2/status" 120
+wait_http "http://localhost:${ALERTMANAGER_PORT:-9093}/api/v2/status" 120

 # Web proxy checks（按端口细化）
 code_for() { curl -s -o /dev/null -w "%{http_code}" "$1" || echo 000; }
@ -112,7 +117,7 @@ echo "[INFO] Checking web-proxy ports..."
 # 8080 首页必须 200
 tries=1; max=60; P8080_T0=$(date +%s)
 while (( tries <= max )); do
-  c=$(code_for "http://localhost:8080/")
+  c=$(code_for "http://localhost:${WEB_PROXY_PORT_8080:-8080}/")
  if [[ "$c" == "200" ]]; then P8080_T1=$(date +%s); echo "[OK] 8080 / ($c) in $((P8080_T1-P8080_T0))s"; break; fi
  echo "[..] waiting 8080/ ($tries/$max), code=$c"; sleep 3; ((tries++))
 done
@ -121,20 +126,20 @@ done
 # 8083 Kibana 允许 200/302（上面已就绪，端口侧再快速确认）
 tries=1; max=40; P8083_T0=$(date +%s)
 while (( tries <= max )); do
-  c=$(code_for "http://localhost:8083/")
+  c=$(code_for "http://localhost:${WEB_PROXY_PORT_8083:-8083}/")
  if [[ "$c" == "200" || "$c" == "302" ]]; then P8083_T1=$(date +%s); echo "[OK] 8083 / ($c) in $((P8083_T1-P8083_T0))s"; break; fi
  echo "[..] waiting 8083/ ($tries/$max), code=$c"; sleep 3; ((tries++))
 done
 (( tries <= max )) || { echo "[ERR] 8083/ not ready" >&2; exit 1; }

 # 8084 Alertmanager + CORS
-P8084_T0=$(date +%s); wait_http "http://localhost:8084/api/v2/status" 60; P8084_T1=$(date +%s)
-cors=$(header_val -H "Origin: http://localhost:8080" "http://localhost:8084/api/v2/status" || true)
+P8084_T0=$(date +%s); wait_http "http://localhost:${WEB_PROXY_PORT_8084:-8084}/api/v2/status" 60; P8084_T1=$(date +%s)
+cors=$(header_val -H "Origin: http://localhost:${WEB_PROXY_PORT_8080:-8080}" "http://localhost:${WEB_PROXY_PORT_8084:-8084}/api/v2/status" || true)
 if [[ -z "$cors" ]]; then echo "[ERR] 8084 CORS missing" >&2; exit 1; else echo "[OK] 8084 CORS: $cors in $((P8084_T1-P8084_T0))s"; fi

 # 8085 Master /readyz + CORS（API 走 8085 才需跨域）
-P8085_T0=$(date +%s); wait_http "http://localhost:8085/readyz" 60; P8085_T1=$(date +%s)
-cors=$(header_val -H "Origin: http://localhost:8080" "http://localhost:8085/api/v1/master/nodes" || true)
+P8085_T0=$(date +%s); wait_http "http://localhost:${WEB_PROXY_PORT_8085:-8085}/readyz" 60; P8085_T1=$(date +%s)
+cors=$(header_val -H "Origin: http://localhost:${WEB_PROXY_PORT_8080:-8080}" "http://localhost:${WEB_PROXY_PORT_8085:-8085}/api/v1/master/nodes" || true)
 if [[ -z "$cors" ]]; then echo "[ERR] 8085 CORS missing" >&2; exit 1; else echo "[OK] 8085 CORS: $cors in $((P8085_T1-P8085_T0))s"; fi

 echo "[OK] All services are ready"
--- a/src/sys/tests/scripts/05_agent_register.sh
+++ b/src/sys/tests/scripts/05_agent_register.sh
@ -5,7 +5,12 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 TEST_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
 TMP_DIR="$TEST_ROOT/tmp"

-API_BASE="http://localhost:32300/api/v1/master"
+# 载入端口变量
+if [[ -f "$TEST_ROOT/.env" ]]; then
+  set -a; source "$TEST_ROOT/.env"; set +a
+fi
+
+API_BASE="http://localhost:${MASTER_PORT:-32300}/api/v1/master"

 HOST_A="dev-yyrshare-nbnyx10-cp2f-pod-0"
 HOST_B="dev-yyrshare-uuuu10-ep2f-pod-0"
--- a/src/sys/tests/scripts/06_write_health_and_assert.sh
+++ b/src/sys/tests/scripts/06_write_health_and_assert.sh
@ -5,7 +5,12 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 TEST_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
 TMP_DIR="$TEST_ROOT/tmp"

-API_BASE="http://localhost:32300/api/v1/master"
+# 载入端口变量
+if [[ -f "$TEST_ROOT/.env" ]]; then
+  set -a; source "$TEST_ROOT/.env"; set +a
+fi
+
+API_BASE="http://localhost:${MASTER_PORT:-32300}/api/v1/master"

 HOST_A="dev-yyrshare-nbnyx10-cp2f-pod-0"
 HOST_B="dev-yyrshare-uuuu10-ep2f-pod-0"
--- a/src/sys/tests/scripts/07_logs_send_and_assert.sh
+++ b/src/sys/tests/scripts/07_logs_send_and_assert.sh
@ -3,11 +3,17 @@ set -euo pipefail

 echo "[INFO] Sending logs via node-a/node-b and asserting ES counts..."

+# 载入端口变量
+TEST_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")"/.. && pwd)"
+if [[ -f "$TEST_ROOT/.env" ]]; then
+  set -a; source "$TEST_ROOT/.env"; set +a
+fi
+
 # Robust count helper: tolerates 404/503 and non-JSON responses, returns integer >=0
 get_count() {
  local idx="$1"; local tmp; tmp=$(mktemp)
  local code
-  code=$(curl -s -o "$tmp" -w "%{http_code}" "http://localhost:9200/${idx}/_count?ignore_unavailable=true&allow_no_indices=true" || true)
+  code=$(curl -s -o "$tmp" -w "%{http_code}" "http://localhost:${ES_HTTP_PORT:-9200}/${idx}/_count?ignore_unavailable=true&allow_no_indices=true" || true)
  if [[ "$code" == "200" ]]; then
    local val
    val=$(jq -r '(.count // 0) | tonumber? // 0' "$tmp" 2>/dev/null || echo 0)
@ -43,8 +49,8 @@ send_logs "$node_b" "host02"

 echo "[INFO] Waiting for ES to ingest..."
 # Proactively refresh indices (ignore errors if not created yet)
-curl -s -X POST "http://localhost:9200/train-*/_refresh" >/dev/null 2>&1 || true
-curl -s -X POST "http://localhost:9200/infer-*/_refresh" >/dev/null 2>&1 || true
+curl -s -X POST "http://localhost:${ES_HTTP_PORT:-9200}/train-*/_refresh" >/dev/null 2>&1 || true
+curl -s -X POST "http://localhost:${ES_HTTP_PORT:-9200}/infer-*/_refresh" >/dev/null 2>&1 || true

 # Retry up to 120s for counts to increase and reach threshold (>=4)
 final=0
@ -58,8 +64,8 @@ for attempt in {1..60}; do
  fi
  echo "[..] waiting ES counts increase to >=${threshold} ($attempt/60) current=${final} base=${base}"
  # refresh indices again to speed up visibility
-  curl -s -X POST "http://localhost:9200/train-*/_refresh" >/dev/null 2>&1 || true
-  curl -s -X POST "http://localhost:9200/infer-*/_refresh" >/dev/null 2>&1 || true
+  curl -s -X POST "http://localhost:${ES_HTTP_PORT:-9200}/train-*/_refresh" >/dev/null 2>&1 || true
+  curl -s -X POST "http://localhost:${ES_HTTP_PORT:-9200}/infer-*/_refresh" >/dev/null 2>&1 || true
  sleep 2
 done
 echo "[INFO] final counts: train=${train1} infer=${infer1} total=${final}"
@ -76,13 +82,13 @@ if (( final < 4 )); then
 fi

 # Health endpoints
-es_health=$(curl -s "http://localhost:9200/_cluster/health" | grep -o '"status":"[^"]*"' | cut -d'"' -f4)
+es_health=$(curl -s "http://localhost:${ES_HTTP_PORT:-9200}/_cluster/health" | grep -o '"status":"[^"]*"' | cut -d'"' -f4)
 if [[ "$es_health" != "green" && "$es_health" != "yellow" ]]; then
  echo "[ERR] ES health not green/yellow: $es_health" >&2
  exit 1
 fi

-if ! curl -fs "http://localhost:5601/api/status" >/dev/null 2>&1; then
+if ! curl -fs "http://localhost:${KIBANA_PORT:-5601}/api/status" >/dev/null 2>&1; then
  echo "[WARN] Kibana status endpoint not available"
 fi

--- a/src/sys/tests/scripts/08_restart_agent_reregister.sh
+++ b/src/sys/tests/scripts/08_restart_agent_reregister.sh
@ -6,7 +6,12 @@ TEST_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
 TMP_DIR="$TEST_ROOT/tmp"
 REPO_ROOT="$(cd "$TEST_ROOT/../../.." && pwd)"

-API_BASE="http://localhost:32300/api/v1/master"
+# 载入端口变量
+if [[ -f "$TEST_ROOT/.env" ]]; then
+  set -a; source "$TEST_ROOT/.env"; set +a
+fi
+
+API_BASE="http://localhost:${MASTER_PORT:-32300}/api/v1/master"

 if [[ -f "$TEST_ROOT/.env" ]]; then
  set -a
@ -85,7 +90,7 @@ docker run -d \
  -e ARGUS_BUILD_GID=${ARGUS_BUILD_GID:-2015} \
  -e ES_HOST=es \
  -e ES_PORT=9200 \
-  -p 2021:2020 \
+  -p ${NODE_B_PORT:-2021}:2020 \
  -v "$TEST_ROOT/private-nodeb/argus/agent/dev-yyrshare-uuuu10-ep2f-pod-0:/private/argus/agent/dev-yyrshare-uuuu10-ep2f-pod-0" \
  -v "$AGENT_BIN_PATH:/usr/local/bin/argus-agent:ro" \
  -v "$SCRIPT_DIR/node_entrypoint.sh:/usr/local/bin/node-entrypoint.sh:ro" \
--- a/src/sys/tests/scripts/13_metric_verify_dataplane.sh
+++ b/src/sys/tests/scripts/13_metric_verify_dataplane.sh
@ -4,7 +4,13 @@ set -euo pipefail
 TMP_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")"/.. && pwd)/tmp/metric-verify"
 mkdir -p "$TMP_DIR"

-PROM_BASE="http://localhost:9090/api/v1"
+# 载入端口变量（由 .env 提供）
+TEST_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")"/.. && pwd)"
+if [[ -f "$TEST_ROOT/.env" ]]; then
+  set -a; source "$TEST_ROOT/.env"; set +a
+fi
+
+PROM_BASE="http://localhost:${PROMETHEUS_PORT:-9090}/api/v1"
 INSTANCE="${METRIC_TEST_INSTANCE:-172.31.0.50:9100}"
 IP_ONLY="${INSTANCE%%:*}"

--- a/src/sys/tests/scripts/13_metric_verify_grafana.sh
+++ b/src/sys/tests/scripts/13_metric_verify_grafana.sh
@ -1,8 +1,13 @@
 #!/usr/bin/env bash
 set -euo pipefail

-PROM_DOMAIN="prom.metric.argus.com:9090"
-GRAF="http://localhost:3000"
+TEST_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")"/.. && pwd)"
+if [[ -f "$TEST_ROOT/.env" ]]; then
+  set -a; source "$TEST_ROOT/.env"; set +a
+fi
+
+PROM_DOMAIN="prom.metric.argus.com:${PROMETHEUS_PORT:-9090}"
+GRAF="http://localhost:${GRAFANA_PORT:-3000}"

 echo "[VERIFY:GRAFANA] /api/health"
 TMP_FILE="$(cd "$(dirname "$0")"/.. && pwd)/tmp/metric-verify/graf_health.json"
--- a/src/sys/tests/scripts/13_metric_verify_grafana_panels.sh
+++ b/src/sys/tests/scripts/13_metric_verify_grafana_panels.sh
@ -6,7 +6,12 @@ TEST_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
 TMP_DIR="$TEST_ROOT/tmp/metric-verify"
 mkdir -p "$TMP_DIR"

-GRAF="http://localhost:3000"
+# 载入端口变量
+if [[ -f "$TEST_ROOT/.env" ]]; then
+  set -a; source "$TEST_ROOT/.env"; set +a
+fi
+
+GRAF="http://localhost:${GRAFANA_PORT:-3000}"
 HOSTNAME="${METRIC_TEST_HOSTNAME:-test-metric-node-001}"

 echo "[VERIFY:GRAF-PANELS] resolve Prometheus datasource UID via Grafana"
@ -67,4 +72,3 @@ PY
 echo "[OK] cluster node online count >= 1 via Grafana proxy"

 echo "[DONE] grafana panels verify"
-
--- a/src/sys/tests/scripts/13_metric_verify_master.sh
+++ b/src/sys/tests/scripts/13_metric_verify_master.sh
@ -6,7 +6,12 @@ TEST_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
 TMP_DIR="$TEST_ROOT/tmp/metric-verify"
 mkdir -p "$TMP_DIR"

-MASTER_BASE="http://localhost:32300/api/v1/master"
+# 载入端口变量
+if [[ -f "$TEST_ROOT/.env" ]]; then
+  set -a; source "$TEST_ROOT/.env"; set +a
+fi
+
+MASTER_BASE="http://localhost:${MASTER_PORT:-32300}/api/v1/master"
 HOSTNAME="${METRIC_TEST_HOSTNAME:-test-metric-node-001}"

 curl_json() { curl -fsS --max-time 5 "$1"; }
--- a/src/sys/tests/scripts/13_metric_verify_prometheus.sh
+++ b/src/sys/tests/scripts/13_metric_verify_prometheus.sh
@ -6,7 +6,12 @@ TEST_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
 TMP_DIR="$TEST_ROOT/tmp/metric-verify"
 mkdir -p "$TMP_DIR"

-PROM_BASE="http://localhost:9090/api/v1"
+# 载入端口变量
+if [[ -f "$TEST_ROOT/.env" ]]; then
+  set -a; source "$TEST_ROOT/.env"; set +a
+fi
+
+PROM_BASE="http://localhost:${PROMETHEUS_PORT:-9090}/api/v1"
 HOSTNAME="${METRIC_TEST_HOSTNAME:-test-metric-node-001}"

 nodes_json="$TEST_ROOT/private/argus/metric/prometheus/nodes.json"
--- a/src/web/build_tools/proxy/conf.d/ports.conf
+++ b/src/web/build_tools/proxy/conf.d/ports.conf
@ -1,10 +1,10 @@
 map $http_upgrade $connection_upgrade { default upgrade; "" close; }

 # 允许的跨域来源（仅用于 8084/8085）
+# 放开为任意来源：将来端口/域名变更均无需调整。
+# 注意：若前端需要携带凭证（cookies/Authorization），这种“回显 Origin”的方式比 "*" 更通用。
 map $http_origin $cors_allow {
-    default "";
-    "http://localhost:8080" "http://localhost:8080";
-    "http://127.0.0.1:8080" "http://127.0.0.1:8080";
+    default $http_origin;
 }

 # 8080 - Portal