wangbo
971540a2a4
新增 WireGuard 全互联、三 server embedded-etcd K3s、CloudNativePG 双实例、Barman OSS 备份、双 NGINX、Kubernetes Secret/RBAC 与本地旧文件按严格 24 小时清理。 新增维护窗口数据迁移、digest 固定滚动发布、应用回滚、跨节点文件 E2E、节点和数据库故障演练、CNPG 恢复与 etcd 快照验收脚本；洛杉矶仅作为带 NoSchedule 污点的仲裁节点。 所有生产 Secret 只在执行时从 0600 本地环境和旧生产容器导入，仓库不保存凭据；公网入口保持人工 DNS 故障切换边界。 验证：bash -n、ShellCheck、kubectl kustomize、Node 语法检查、Secret 扫描、OSS put/head/delete 实测。
42 lines
1.4 KiB
Bash
Executable File
42 lines
1.4 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
script_dir=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
|
|
# shellcheck source=scripts/cluster/common.sh
|
|
source "$script_dir/common.sh"
|
|
load_cluster_env
|
|
|
|
public_key=$(cluster_ssh "$CLUSTER_NINGBO_HOST" 'bash -s' <<'REMOTE'
|
|
set -euo pipefail
|
|
install -d -m 0700 /root/.ssh
|
|
if [[ ! -f /root/.ssh/id_ed25519_easyai_cert_sync ]]; then
|
|
ssh-keygen -q -t ed25519 -N '' -f /root/.ssh/id_ed25519_easyai_cert_sync
|
|
fi
|
|
cat /root/.ssh/id_ed25519_easyai_cert_sync.pub
|
|
REMOTE
|
|
)
|
|
[[ $public_key == ssh-ed25519\ * ]] || {
|
|
echo 'invalid certificate sync public key' >&2
|
|
exit 1
|
|
}
|
|
cluster_ssh "$CLUSTER_HONGKONG_HOST" bash -s -- "$public_key" <<'REMOTE'
|
|
set -euo pipefail
|
|
public_key=$1
|
|
install -d -m 0700 /root/.ssh
|
|
touch /root/.ssh/authorized_keys
|
|
chmod 0600 /root/.ssh/authorized_keys
|
|
grep -Fqx "$public_key" /root/.ssh/authorized_keys || printf '%s\n' "$public_key" >>/root/.ssh/authorized_keys
|
|
REMOTE
|
|
|
|
cluster_scp "$script_dir/sync-nginx-certificate.sh" \
|
|
"$CLUSTER_NINGBO_HOST:/usr/local/sbin/easyai-sync-nginx-certificate"
|
|
cluster_ssh "$CLUSTER_NINGBO_HOST" 'bash -s' <<'REMOTE'
|
|
set -euo pipefail
|
|
chmod 0750 /usr/local/sbin/easyai-sync-nginx-certificate
|
|
install -d -m 0755 /etc/letsencrypt/renewal-hooks/deploy
|
|
ln -sfn /usr/local/sbin/easyai-sync-nginx-certificate \
|
|
/etc/letsencrypt/renewal-hooks/deploy/easyai-sync-nginx-certificate
|
|
/usr/local/sbin/easyai-sync-nginx-certificate
|
|
REMOTE
|
|
echo 'certificate_sync_install=PASS'
|