wangbo
971540a2a4
新增 WireGuard 全互联、三 server embedded-etcd K3s、CloudNativePG 双实例、Barman OSS 备份、双 NGINX、Kubernetes Secret/RBAC 与本地旧文件按严格 24 小时清理。 新增维护窗口数据迁移、digest 固定滚动发布、应用回滚、跨节点文件 E2E、节点和数据库故障演练、CNPG 恢复与 etcd 快照验收脚本；洛杉矶仅作为带 NoSchedule 污点的仲裁节点。 所有生产 Secret 只在执行时从 0600 本地环境和旧生产容器导入，仓库不保存凭据；公网入口保持人工 DNS 故障切换边界。 验证：bash -n、ShellCheck、kubectl kustomize、Node 语法检查、Secret 扫描、OSS put/head/delete 实测。
96 lines
3.5 KiB
Bash
Executable File
96 lines
3.5 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
script_dir=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
|
|
# shellcheck source=scripts/cluster/common.sh
|
|
source "$script_dir/common.sh"
|
|
|
|
mode=${1:-prepare}
|
|
[[ $mode == prepare || $mode == activate ]] || {
|
|
echo 'usage: install-nginx-edges.sh [prepare|activate]' >&2
|
|
exit 64
|
|
}
|
|
load_cluster_env
|
|
|
|
nginx_directory="$cluster_root/deploy/nginx"
|
|
for file in ai.51easyai.com-cluster.conf ai.51easyai.com-maintenance.conf \
|
|
cluster-acceptance-origin-ningbo.conf legacy-static-ningbo.inc \
|
|
legacy-static-hongkong.inc legacy-static-origin-ningbo.conf; do
|
|
[[ -f $nginx_directory/$file ]] || {
|
|
echo "missing NGINX file: $file" >&2
|
|
exit 1
|
|
}
|
|
done
|
|
|
|
cluster_ssh "$CLUSTER_NINGBO_HOST" 'bash -s' <<'REMOTE'
|
|
set -euo pipefail
|
|
install -d -m 0700 /etc/nginx/tls/ai.51easyai.com
|
|
install -m 0644 /etc/letsencrypt/live/ai.51easyai.com/fullchain.pem \
|
|
/etc/nginx/tls/ai.51easyai.com/fullchain.pem
|
|
install -m 0600 /etc/letsencrypt/live/ai.51easyai.com/privkey.pem \
|
|
/etc/nginx/tls/ai.51easyai.com/privkey.pem
|
|
REMOTE
|
|
cluster_scp \
|
|
"$CLUSTER_NINGBO_HOST:/etc/nginx/tls/ai.51easyai.com/fullchain.pem" \
|
|
"$cluster_root/.local-secrets/cluster/fullchain.pem"
|
|
cluster_scp \
|
|
"$CLUSTER_NINGBO_HOST:/etc/nginx/tls/ai.51easyai.com/privkey.pem" \
|
|
"$cluster_root/.local-secrets/cluster/privkey.pem"
|
|
chmod 0600 "$cluster_root/.local-secrets/cluster/privkey.pem"
|
|
|
|
for host in "$CLUSTER_NINGBO_HOST" "$CLUSTER_HONGKONG_HOST"; do
|
|
cluster_ssh "$host" 'bash -s' <<'REMOTE'
|
|
set -euo pipefail
|
|
export DEBIAN_FRONTEND=noninteractive
|
|
if ! command -v nginx >/dev/null 2>&1; then
|
|
apt-get update -qq
|
|
apt-get install -y -qq nginx
|
|
fi
|
|
install -d -m 0755 /etc/nginx/easyai-ai-gateway
|
|
install -d -m 0700 /etc/nginx/tls/ai.51easyai.com
|
|
REMOTE
|
|
cluster_scp "$cluster_root/.local-secrets/cluster/fullchain.pem" \
|
|
"$host:/etc/nginx/tls/ai.51easyai.com/fullchain.pem"
|
|
cluster_scp "$cluster_root/.local-secrets/cluster/privkey.pem" \
|
|
"$host:/etc/nginx/tls/ai.51easyai.com/privkey.pem"
|
|
cluster_scp "$nginx_directory/ai.51easyai.com-cluster.conf" \
|
|
"$host:/etc/nginx/sites-available/ai.51easyai.com-cluster"
|
|
cluster_scp "$nginx_directory/ai.51easyai.com-maintenance.conf" \
|
|
"$host:/etc/nginx/sites-available/ai.51easyai.com-maintenance"
|
|
done
|
|
|
|
cluster_scp "$nginx_directory/legacy-static-ningbo.inc" \
|
|
"$CLUSTER_NINGBO_HOST:/etc/nginx/easyai-ai-gateway/legacy-static.inc"
|
|
cluster_scp "$nginx_directory/legacy-static-origin-ningbo.conf" \
|
|
"$CLUSTER_NINGBO_HOST:/etc/nginx/conf.d/easyai-legacy-static-origin.conf"
|
|
cluster_scp "$nginx_directory/cluster-acceptance-origin-ningbo.conf" \
|
|
"$CLUSTER_NINGBO_HOST:/etc/nginx/conf.d/easyai-cluster-acceptance-origin.conf"
|
|
cluster_scp "$nginx_directory/legacy-static-hongkong.inc" \
|
|
"$CLUSTER_HONGKONG_HOST:/etc/nginx/easyai-ai-gateway/legacy-static.inc"
|
|
|
|
for host in "$CLUSTER_NINGBO_HOST" "$CLUSTER_HONGKONG_HOST"; do
|
|
cluster_ssh "$host" 'bash -s' <<'REMOTE'
|
|
set -euo pipefail
|
|
chmod 0600 /etc/nginx/tls/ai.51easyai.com/privkey.pem
|
|
chmod 0644 /etc/nginx/tls/ai.51easyai.com/fullchain.pem
|
|
nginx -t
|
|
REMOTE
|
|
done
|
|
|
|
if [[ $mode == activate ]]; then
|
|
for host in "$CLUSTER_NINGBO_HOST" "$CLUSTER_HONGKONG_HOST"; do
|
|
cluster_ssh "$host" 'bash -s' <<'REMOTE'
|
|
set -euo pipefail
|
|
ln -sfn /etc/nginx/sites-available/ai.51easyai.com-cluster \
|
|
/etc/nginx/sites-enabled/ai.51easyai.com-cluster
|
|
if [[ -L /etc/nginx/sites-enabled/ai.51easyai.com ]]; then
|
|
rm -f /etc/nginx/sites-enabled/ai.51easyai.com
|
|
fi
|
|
nginx -t
|
|
systemctl reload nginx
|
|
REMOTE
|
|
done
|
|
fi
|
|
|
|
echo "nginx_edges=PASS mode=$mode"
|