wangbo
971540a2a4
新增 WireGuard 全互联、三 server embedded-etcd K3s、CloudNativePG 双实例、Barman OSS 备份、双 NGINX、Kubernetes Secret/RBAC 与本地旧文件按严格 24 小时清理。 新增维护窗口数据迁移、digest 固定滚动发布、应用回滚、跨节点文件 E2E、节点和数据库故障演练、CNPG 恢复与 etcd 快照验收脚本；洛杉矶仅作为带 NoSchedule 污点的仲裁节点。 所有生产 Secret 只在执行时从 0600 本地环境和旧生产容器导入，仓库不保存凭据；公网入口保持人工 DNS 故障切换边界。 验证：bash -n、ShellCheck、kubectl kustomize、Node 语法检查、Secret 扫描、OSS put/head/delete 实测。
107 lines
3.1 KiB
Plaintext
107 lines
3.1 KiB
Plaintext
upstream easyai_gateway_api {
|
|
least_conn;
|
|
keepalive 64;
|
|
server 10.77.0.1:30088 max_fails=2 fail_timeout=5s;
|
|
server 10.77.0.2:30088 max_fails=2 fail_timeout=5s;
|
|
}
|
|
|
|
upstream easyai_gateway_web {
|
|
least_conn;
|
|
keepalive 32;
|
|
server 10.77.0.1:30178 max_fails=2 fail_timeout=5s;
|
|
server 10.77.0.2:30178 max_fails=2 fail_timeout=5s;
|
|
}
|
|
|
|
server {
|
|
listen 80;
|
|
listen [::]:80;
|
|
server_name ai.51easyai.com;
|
|
return 301 https://$host$request_uri;
|
|
}
|
|
|
|
server {
|
|
listen 443 ssl http2;
|
|
listen [::]:443 ssl http2;
|
|
server_name ai.51easyai.com;
|
|
|
|
ssl_certificate /etc/nginx/tls/ai.51easyai.com/fullchain.pem;
|
|
ssl_certificate_key /etc/nginx/tls/ai.51easyai.com/privkey.pem;
|
|
ssl_session_cache shared:easyai_gateway_tls:10m;
|
|
ssl_session_timeout 1d;
|
|
ssl_protocols TLSv1.2 TLSv1.3;
|
|
|
|
client_max_body_size 200m;
|
|
client_body_timeout 300s;
|
|
|
|
include /etc/nginx/easyai-ai-gateway/legacy-static.inc;
|
|
|
|
location = /api/v1/metrics {
|
|
return 404;
|
|
}
|
|
|
|
location ^~ /api/v1/ {
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto https;
|
|
proxy_set_header Connection "";
|
|
proxy_connect_timeout 2s;
|
|
proxy_send_timeout 3600s;
|
|
proxy_read_timeout 3600s;
|
|
proxy_request_buffering off;
|
|
proxy_buffering off;
|
|
proxy_next_upstream error timeout http_502 http_503 http_504;
|
|
proxy_next_upstream_tries 2;
|
|
proxy_pass http://easyai_gateway_api;
|
|
}
|
|
|
|
location /gateway-api/ {
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto https;
|
|
proxy_set_header Connection "";
|
|
proxy_connect_timeout 2s;
|
|
proxy_send_timeout 3600s;
|
|
proxy_read_timeout 3600s;
|
|
proxy_request_buffering off;
|
|
proxy_buffering off;
|
|
proxy_next_upstream error timeout http_502 http_503 http_504;
|
|
proxy_next_upstream_tries 2;
|
|
proxy_pass http://easyai_gateway_api/;
|
|
}
|
|
|
|
location ^~ /static/ {
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto https;
|
|
proxy_set_header Connection "";
|
|
proxy_connect_timeout 2s;
|
|
proxy_send_timeout 300s;
|
|
proxy_read_timeout 300s;
|
|
proxy_buffering off;
|
|
proxy_next_upstream error timeout http_502 http_503 http_504;
|
|
proxy_next_upstream_tries 2;
|
|
proxy_pass http://easyai_gateway_api;
|
|
}
|
|
|
|
location / {
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto https;
|
|
proxy_set_header Connection "";
|
|
proxy_connect_timeout 2s;
|
|
proxy_send_timeout 300s;
|
|
proxy_read_timeout 300s;
|
|
proxy_next_upstream error timeout http_502 http_503 http_504;
|
|
proxy_next_upstream_tries 2;
|
|
proxy_pass http://easyai_gateway_web;
|
|
}
|
|
}
|