From 63443ea854ed645bf9f74b6cc4c6d4ab2d364526 Mon Sep 17 00:00:00 2001
From: eric <xiaoshuang.eric@gmail.com>
Date: Sun, 29 Mar 2026 04:08:02 -0500
Subject: [PATCH] 's'

---
 docs/install-profiles.md           | 10 +++++
 probe-live.sh                      |  4 ++
 scripts/linux/probe_live_access.sh | 66 ++++++++++++++++++++++++++++++
 3 files changed, 80 insertions(+)
 create mode 100644 probe-live.sh
 create mode 100644 scripts/linux/probe_live_access.sh

diff --git a/docs/install-profiles.md b/docs/install-profiles.md
index 1ed7d7b..8bded5e 100644
--- a/docs/install-profiles.md
+++ b/docs/install-profiles.md
@@ -56,6 +56,16 @@ Use this when the device should only run the Douyin or YouTube business stack.
 
 **Older business installs** (before `install_live_edge_proxy` was included) never installed Caddy; if you still see 502 on port 80, you likely had a prior hub/edge install—run `sudo bash scripts/linux/reinstall_live_edge.sh` after pulling the latest repo.
 
+### Browser: `live.local` — **refused to connect** (not 502)
+
+That means the TCP connection was **rejected or nothing listens** on the address you used (often **port 80** on the box’s IP).
+
+1. On the **device**, run: `sudo bash probe-live.sh` (or `scripts/linux/probe_live_access.sh`) and read the `:80` / `:8001` lines.
+2. If **`:8001` works** but **`:80` fails**: `live-edge` (Caddy) is down — `sudo systemctl restart live-edge.service` or `sudo bash scripts/linux/reinstall_live_edge.sh`.
+3. If **both fail**: `live-console` is down — `sudo systemctl restart live-console.service` and `journalctl -u live-console.service -n 80`.
+4. From a **laptop/phone**, open **`http://<device-LAN-IP>:8001/`** first (same Wi‑Fi). If that works but `http://live.local` does not, the problem is **mDNS** (Windows often needs Bonjour) or you’re not on the same LAN — use the IP bookmark.
+5. **Firewall** (nftables/ufw) blocking **80/8001** from Wi‑Fi will also show as “refused” from other hosts while loopback still works.
+
 ### PM2：单频道与多频道 Pro（Linux ARM / x86_64）
 
 - **单频道**：在项目根启用一个业务进程即可，例如取消注释 `ecosystem.config.cjs` 里的 `youtube` 或 `tiktok`，执行 `pm2 start ecosystem.config.cjs && pm2 save`。
diff --git a/probe-live.sh b/probe-live.sh
new file mode 100644
index 0000000..b5e285c
--- /dev/null
+++ b/probe-live.sh
@@ -0,0 +1,4 @@
+#!/usr/bin/env bash
+set -euo pipefail
+ROOT_DIR="$(cd "$(dirname "$0")" && pwd)"
+exec bash "$ROOT_DIR/scripts/linux/probe_live_access.sh" "$@"
diff --git a/scripts/linux/probe_live_access.sh b/scripts/linux/probe_live_access.sh
new file mode 100644
index 0000000..bbaffe1
--- /dev/null
+++ b/scripts/linux/probe_live_access.sh
@@ -0,0 +1,66 @@
+#!/usr/bin/env bash
+# 排查「live.local refused to connect」：多为 :80 无进程、服务未起、或跨机 mDNS/防火墙。
+# 在设备本机执行: sudo bash scripts/linux/probe_live_access.sh
+set +euo pipefail
+
+SELF_DIR="$(cd "$(dirname "$0")" && pwd)"
+INSTALL_TAG="probe"
+# shellcheck source=scripts/linux/lib/common.sh
+. "$SELF_DIR/lib/common.sh"
+
+load_env
+
+echo "=== Probe: refused to connect (no listener / firewall / wrong host) ==="
+echo "Note: 502 = reverse proxy up but upstream dead; refused = nothing accepting TCP."
+echo ""
+
+echo "--- Host / IP ---"
+echo "hostname: $(hostname 2>/dev/null)"
+LAN_IP=""
+LAN_IP="$(ip -4 route get 8.8.8.8 2>/dev/null | awk '{for (i=1;i<=NF;i++) if ($i=="src") {print $(i+1); exit}}')"
+[ -n "$LAN_IP" ] || LAN_IP="$(hostname -I 2>/dev/null | awk '{print $1}')"
+echo "guess LAN IP: ${LAN_IP:-unknown}"
+echo ""
+
+echo "--- systemd (need root for full status) ---"
+for u in live-console live-edge; do
+  if systemctl is-active "$u.service" >/dev/null 2>&1; then
+    echo "$u.service: active"
+  else
+    echo "$u.service: INACTIVE — run: sudo systemctl status $u.service"
+  fi
+done
+echo ""
+
+echo "--- TCP listeners :80 and :${PORT} ---"
+if command -v ss >/dev/null 2>&1; then
+  ss -tlnp 2>/dev/null | grep -E ":80\\b|:${PORT}\\b" || echo "(no LISTEN on :80 or :${PORT})"
+else
+  netstat -tlnp 2>/dev/null | grep -E ":80\\b|:${PORT}\\b" || true
+fi
+echo ""
+
+echo "--- Loopback checks ---"
+if curl -sf -m 5 "http://127.0.0.1:${PORT}/health" >/dev/null; then
+  echo "OK  http://127.0.0.1:${PORT}/health"
+else
+  echo "FAIL http://127.0.0.1:${PORT}/health  → fix live-console first: journalctl -u live-console.service -n 60"
+fi
+
+code="$(curl -sS -m 5 -o /dev/null -w '%{http_code}' "http://127.0.0.1/" 2>/dev/null)"
+if [ "$code" = "000" ] || [ -z "$code" ]; then
+  echo "FAIL http://127.0.0.1/ (port 80) — live-edge/Caddy not listening or connection refused"
+  echo "     Try: sudo bash scripts/linux/reinstall_live_edge.sh && sudo systemctl restart live-edge.service"
+elif [ "$code" = "502" ]; then
+  echo "WARN http://127.0.0.1/ → 502 — Caddy up but upstream :${PORT} down; restart live-console"
+else
+  echo "OK   http://127.0.0.1/ → HTTP $code"
+fi
+echo ""
+
+echo "--- From your phone/PC browser ---"
+echo "1) Same Wi‑Fi/LAN as this box."
+echo "2) Try:  http://${LAN_IP}:${PORT}/   (direct control plane, bypasses :80 and mDNS)"
+echo "3) live.local needs mDNS (Android often OK; Windows may need Bonjour or use IP)."
+echo "4) If OK on IP but not live.local: Avahi on this host — systemctl status avahi-daemon"
+echo ""