#!/usr/bin/env python3 # /// script # dependencies = [ # "cryptography", # "requests", # ] # /// """ Mac mini 家庭 All-in-One 微信双向控制与通知网关 (WeCom <-> Personal WeChat) 监听端口: 3005 (由 Azure https://wx.961504.xyz:443 通过 Tailscale 专线转发) """ import base64 import hashlib import json import os import socket import struct import subprocess import threading import time import urllib.parse import xml.etree.ElementTree as ET from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer from pathlib import Path import requests from cryptography.hazmat.backends import default_backend from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes BASE_DIR = Path(__file__).resolve().parent CONFIG_PATH = BASE_DIR / "config.env" def load_config() -> dict: cfg = { "WECOM_CORP_ID": "", "WECOM_AGENT_ID": "", "WECOM_SECRET": "", "WECOM_TOKEN": "", "WECOM_AES_KEY": "", "WECOM_TO_USER": "@all", } if CONFIG_PATH.exists(): for line in CONFIG_PATH.read_text(encoding="utf-8").splitlines(): line = line.strip() if not line or line.startswith("#") or "=" not in line: continue k, v = line.split("=", 1) cfg[k.strip()] = v.strip().strip('"').strip("'") return cfg class WXBizMsgCrypt: """企业微信官方消息加解密算法实现 (AES-256-CBC + PKCS#7 32字节填充)""" def __init__(self, token: str, encoding_aes_key: str, receive_id: str): self.token = token self.receive_id = receive_id self.key = base64.b64decode(encoding_aes_key + "=") def verify_signature(self, msg_signature: str, timestamp: str, nonce: str, encrypt_msg: str) -> bool: items = sorted([self.token, timestamp, nonce, encrypt_msg]) sha1 = hashlib.sha1("".join(items).encode("utf-8")).hexdigest() return sha1 == msg_signature def decrypt(self, encrypt_msg: str) -> str: cipher_bytes = base64.b64decode(encrypt_msg) cipher = Cipher(algorithms.AES(self.key), modes.CBC(self.key[:16]), backend=default_backend()) decryptor = cipher.decryptor() plain = decryptor.update(cipher_bytes) + decryptor.finalize() pad_len = plain[-1] content = plain[:-pad_len] msg_len = struct.unpack("!I", content[16:20])[0] raw_msg = content[20 : 20 + msg_len].decode("utf-8") return raw_msg TOKEN_CACHE = {"token": "", "expires_at": 0.0} def send_wecom_text(content: str, to_user: str = None) -> dict: cfg = load_config() corp_id = cfg["WECOM_CORP_ID"] secret = cfg["WECOM_SECRET"] agent_id = cfg["WECOM_AGENT_ID"] if not (corp_id and secret and agent_id): return {"errcode": -1, "errmsg": "WeCom credentials not configured yet"} now = time.time() if not TOKEN_CACHE["token"] or now >= TOKEN_CACHE["expires_at"]: resp = requests.get( "https://qyapi.weixin.qq.com/cgi-bin/gettoken", params={"corpid": corp_id, "corpsecret": secret}, timeout=10, ).json() if resp.get("errcode") != 0: return resp TOKEN_CACHE["token"] = resp["access_token"] TOKEN_CACHE["expires_at"] = now + resp.get("expires_in", 7200) - 200 # 企业微信单条文本上限 2048 字节，超长自动截断 if len(content.encode("utf-8")) > 1900: content = content[:600] + "\n...(内容已截断)" payload = { "touser": to_user or cfg.get("WECOM_TO_USER") or "@all", "msgtype": "text", "agentid": int(agent_id), "text": {"content": content}, } return requests.post( f"https://qyapi.weixin.qq.com/cgi-bin/message/send?access_token={TOKEN_CACHE['token']}", json=payload, timeout=10, ).json() def handle_user_command(user_id: str, text: str): text = text.strip() try: if text in ("状态", "/status", "status", "体检"): cmd = ( "export PATH=/opt/homebrew/bin:$PATH; " "echo '🖥️ Mac mini (M6) 状态报告'; " "echo \"⏱️ 运行时间: $(uptime | sed 's/.*up //; s/, [0-9]* users.*//')\"; " "echo \"💾 磁盘剩余: $(df -h / | awk 'NR==2{print $4 \" (已用 \" $5 \")\"}')\"; " "echo \"🌐 家里公网: $(cat ~/homelab/backups/last_wan_ip.txt 2>/dev/null || echo 未知)\"; " "echo \"🐳 运行容器: $(docker ps --format '{{.Names}}' | tr '\\n' ' ')\"" ) out = subprocess.check_output(cmd, shell=True, text=True, timeout=15) send_wecom_text(out.strip(), to_user=user_id) elif text.startswith("/sh "): shell_cmd = text[4:].strip() out = subprocess.check_output( f"export PATH=/opt/homebrew/bin:$HOME/.local/bin:$PATH; {shell_cmd}", shell=True, stderr=subprocess.STDOUT, text=True, timeout=60, ) send_wecom_text(f"✅ 执行完成:\n{out.strip() or '(无输出)'}", to_user=user_id) else: send_wecom_text( f"🤖 Mac mini 已收到指令：\n「{text}」\n\n" "可用快捷指令：\n" "• 发送「状态」：查看 Mac mini 实时健康度与公网 IP\n" "• 发送「/sh <命令>」：远程在 Mac mini 上执行终端命令", to_user=user_id, ) except Exception as e: send_wecom_text(f"⚠️ 执行异常: {e}", to_user=user_id) class GatewayHandler(BaseHTTPRequestHandler): def do_GET(self): parsed = urllib.parse.urlparse(self.path) if parsed.path == "/wechat/callback": qs = urllib.parse.parse_qs(parsed.query) msg_sig = qs.get("msg_signature", [""])[0] timestamp = qs.get("timestamp", [""])[0] nonce = qs.get("nonce", [""])[0] echostr = qs.get("echostr", [""])[0] cfg = load_config() if not (cfg["WECOM_TOKEN"] and cfg["WECOM_AES_KEY"] and cfg["WECOM_CORP_ID"]): self.send_response(400) self.end_headers() self.wfile.write(b"WeCom callback parameters not configured yet") return crypt = WXBizMsgCrypt(cfg["WECOM_TOKEN"], cfg["WECOM_AES_KEY"], cfg["WECOM_CORP_ID"]) if not crypt.verify_signature(msg_sig, timestamp, nonce, echostr): self.send_response(403) self.end_headers() self.wfile.write(b"Signature verification failed") return plain_echo = crypt.decrypt(echostr) self.send_response(200) self.send_header("Content-Type", "text/plain; charset=utf-8") self.end_headers() self.wfile.write(plain_echo.encode("utf-8")) return cfg = load_config() configured = bool(cfg["WECOM_CORP_ID"] and cfg["WECOM_SECRET"]) self.send_response(200) self.send_header("Content-Type", "application/json; charset=utf-8") self.end_headers() self.wfile.write( json.dumps( { "service": "macmini-wechat-gateway", "status": "ok", "wecom_configured": configured, "callback_url": "https://wx.961504.xyz/wechat/callback", "notify_webhook": "https://wx.961504.xyz/notify", }, ensure_ascii=False, ).encode("utf-8") ) def do_POST(self): parsed = urllib.parse.urlparse(self.path) length = int(self.headers.get("Content-Length", 0)) body = self.rfile.read(length).decode("utf-8") if parsed.path == "/wechat/callback": qs = urllib.parse.parse_qs(parsed.query) msg_sig = qs.get("msg_signature", [""])[0] timestamp = qs.get("timestamp", [""])[0] nonce = qs.get("nonce", [""])[0] cfg = load_config() crypt = WXBizMsgCrypt(cfg["WECOM_TOKEN"], cfg["WECOM_AES_KEY"], cfg["WECOM_CORP_ID"]) root = ET.fromstring(body) encrypt_node = root.find("Encrypt") if encrypt_node is not None and crypt.verify_signature(msg_sig, timestamp, nonce, encrypt_node.text): xml_plain = crypt.decrypt(encrypt_node.text) msg_root = ET.fromstring(xml_plain) msg_type = msg_root.findtext("MsgType", "") from_user = msg_root.findtext("FromUserName", "@all") if msg_type == "text": content = msg_root.findtext("Content", "") threading.Thread(target=handle_user_command, args=(from_user, content), daemon=True).start() self.send_response(200) self.end_headers() self.wfile.write(b"success") return if parsed.path == "/notify": try: data = json.loads(body) if body else {} msg = data.get("msg") or data.get("text") or body except Exception: msg = body res = send_wecom_text(f"🔔 【家庭服务器通知】\n{msg}") self.send_response(200) self.send_header("Content-Type", "application/json; charset=utf-8") self.end_headers() self.wfile.write(json.dumps(res, ensure_ascii=False).encode("utf-8")) return self.send_response(404) self.end_headers() if __name__ == "__main__": server = ThreadingHTTPServer(("0.0.0.0", 3005), GatewayHandler) print("WeChat Gateway listening on 0.0.0.0:3005...") server.serve_forever()