wangbo
971540a2a4
新增 WireGuard 全互联、三 server embedded-etcd K3s、CloudNativePG 双实例、Barman OSS 备份、双 NGINX、Kubernetes Secret/RBAC 与本地旧文件按严格 24 小时清理。 新增维护窗口数据迁移、digest 固定滚动发布、应用回滚、跨节点文件 E2E、节点和数据库故障演练、CNPG 恢复与 etcd 快照验收脚本；洛杉矶仅作为带 NoSchedule 污点的仲裁节点。 所有生产 Secret 只在执行时从 0600 本地环境和旧生产容器导入，仓库不保存凭据；公网入口保持人工 DNS 故障切换边界。 验证：bash -n、ShellCheck、kubectl kustomize、Node 语法检查、Secret 扫描、OSS put/head/delete 实测。
29 lines
1004 B
Plaintext
29 lines
1004 B
Plaintext
server {
|
||
listen 80;
|
||
listen [::]:80;
|
||
server_name ai.51easyai.com;
|
||
return 301 https://$host$request_uri;
|
||
}
|
||
|
||
server {
|
||
listen 443 ssl http2;
|
||
listen [::]:443 ssl http2;
|
||
server_name ai.51easyai.com;
|
||
|
||
ssl_certificate /etc/nginx/tls/ai.51easyai.com/fullchain.pem;
|
||
ssl_certificate_key /etc/nginx/tls/ai.51easyai.com/privkey.pem;
|
||
ssl_protocols TLSv1.2 TLSv1.3;
|
||
|
||
location ^~ /api/ {
|
||
default_type application/json;
|
||
add_header Retry-After 600 always;
|
||
return 503 '{"error":{"message":"Gateway database maintenance is in progress","type":"service_unavailable"}}';
|
||
}
|
||
|
||
location / {
|
||
default_type text/html;
|
||
add_header Retry-After 600 always;
|
||
return 503 '<!doctype html><html lang="zh-CN"><meta charset="utf-8"><title>系统维护</title><style>body{font-family:sans-serif;max-width:40rem;margin:15vh auto;padding:2rem;color:#1f2937}h1{font-size:1.8rem}</style><h1>系统正在进行高可用升级</h1><p>预计 5–10 分钟恢复，请稍后重试。</p></html>';
|
||
}
|
||
}
|