feat(cluster): 接入深圳专用 Worker 节点

新增深圳 K3s agent 与四节点 WireGuard 全互联接入脚本，将深圳归入香港逻辑 Worker 池并用污点限制为 Worker 专用。\n\n生产验收支持宁波 0、香港逻辑池 2 的双物理节点基线，补充副本拓扑分散、容量档位、链路巡检和零副本站点校验。\n\n已通过 Go 全量测试、go vet、govulncheck、迁移安全检查、ShellCheck、发布脚本测试、前后端 lint/test/build、Compose 与 Kubernetes 渲染校验。

scripts/cluster/bootstrap-wireguard.sh

@@ -11,6 +11,11 @@ require_commands ssh scp
 hosts=("$CLUSTER_NINGBO_HOST" "$CLUSTER_HONGKONG_HOST" "$CLUSTER_LOS_ANGELES_HOST")
 public_endpoints=("${CLUSTER_NINGBO_HOST#*@}" "${CLUSTER_HONGKONG_HOST#*@}" "${CLUSTER_LOS_ANGELES_HOST#*@}")
 wireguard_ips=(10.77.0.1 10.77.0.2 10.77.0.3)
+if [[ -n $CLUSTER_SHENZHEN_HOST ]]; then
+  hosts+=("$CLUSTER_SHENZHEN_HOST")
+  public_endpoints+=("${CLUSTER_SHENZHEN_HOST#*@}")
+  wireguard_ips+=(10.77.0.4)
+fi
 public_keys=()
 
 for host in "${hosts[@]}"; do
@@ -39,26 +44,24 @@ REMOTE
   public_keys+=("$public_key")
 done
 
-for local_index in 0 1 2; do
-  peer_indexes=()
-  for candidate in 0 1 2; do
-    [[ $candidate -eq $local_index ]] || peer_indexes+=("$candidate")
+for local_index in "${!hosts[@]}"; do
+  peer_arguments=()
+  for candidate in "${!hosts[@]}"; do
+    if [[ $candidate -ne $local_index ]]; then
+      peer_arguments+=(
+        "${public_keys[$candidate]}"
+        "${public_endpoints[$candidate]}"
+        "${wireguard_ips[$candidate]}"
+      )
+    fi
   done
-  first=${peer_indexes[0]}
-  second=${peer_indexes[1]}
   echo "[wireguard] configuring ${hosts[$local_index]} as ${wireguard_ips[$local_index]}"
   cluster_ssh "${hosts[$local_index]}" bash -s -- \
     "${wireguard_ips[$local_index]}" \
-    "${public_keys[$first]}" "${public_endpoints[$first]}" "${wireguard_ips[$first]}" \
-    "${public_keys[$second]}" "${public_endpoints[$second]}" "${wireguard_ips[$second]}" <<'REMOTE'
+    "${peer_arguments[@]}" <<'REMOTE'
 set -euo pipefail
 local_ip=$1
-peer_one_key=$2
-peer_one_endpoint=$3
-peer_one_ip=$4
-peer_two_key=$5
-peer_two_endpoint=$6
-peer_two_ip=$7
+shift
 private_key=$(cat /etc/wireguard/privatekey)
 umask 077
 temporary_config=$(mktemp /etc/wireguard/wg0.conf.XXXXXX)
@@ -67,19 +70,19 @@ cat >"$temporary_config" <<EOF
 Address = ${local_ip}/24
 ListenPort = 51820
 PrivateKey = ${private_key}
+EOF
+while (( $# >= 3 )); do
+  cat >>"$temporary_config" <<EOF
 
 [Peer]
-PublicKey = ${peer_one_key}
-Endpoint = ${peer_one_endpoint}:51820
-AllowedIPs = ${peer_one_ip}/32
-PersistentKeepalive = 25
-
-[Peer]
-PublicKey = ${peer_two_key}
-Endpoint = ${peer_two_endpoint}:51820
-AllowedIPs = ${peer_two_ip}/32
+PublicKey = $1
+Endpoint = $2:51820
+AllowedIPs = $3/32
 PersistentKeepalive = 25
 EOF
+  shift 3
+done
+(( $# == 0 ))
 chmod 0600 "$temporary_config"
 mv "$temporary_config" /etc/wireguard/wg0.conf
 systemctl enable wg-quick@wg0 >/dev/null
@@ -87,8 +90,8 @@ systemctl restart wg-quick@wg0
 REMOTE
 done
 
-for source_index in 0 1 2; do
-  for target_index in 0 1 2; do
+for source_index in "${!hosts[@]}"; do
+  for target_index in "${!hosts[@]}"; do
     [[ $source_index -eq $target_index ]] && continue
     cluster_ssh "${hosts[$source_index]}" \
       "ping -c 3 -W 2 ${wireguard_ips[$target_index]} >/dev/null"
@@ -98,10 +101,10 @@ done
 for host in "${hosts[@]}"; do
   latest_handshake=$(cluster_ssh "$host" \
     "wg show wg0 latest-handshakes | awk '\$2 > 0 { count++ } END { print count + 0 }'")
-  [[ $latest_handshake == 2 ]] || {
+  [[ $latest_handshake == $((${#hosts[@]} - 1)) ]] || {
     echo "WireGuard handshake verification failed on $host" >&2
     exit 1
   }
 done
 
-echo 'wireguard_bootstrap=PASS peers=3'
+echo "wireguard_bootstrap=PASS peers=${#hosts[@]}"