wangbo
971540a2a4
新增 WireGuard 全互联、三 server embedded-etcd K3s、CloudNativePG 双实例、Barman OSS 备份、双 NGINX、Kubernetes Secret/RBAC 与本地旧文件按严格 24 小时清理。 新增维护窗口数据迁移、digest 固定滚动发布、应用回滚、跨节点文件 E2E、节点和数据库故障演练、CNPG 恢复与 etcd 快照验收脚本；洛杉矶仅作为带 NoSchedule 污点的仲裁节点。 所有生产 Secret 只在执行时从 0600 本地环境和旧生产容器导入，仓库不保存凭据；公网入口保持人工 DNS 故障切换边界。 验证：bash -n、ShellCheck、kubectl kustomize、Node 语法检查、Secret 扫描、OSS put/head/delete 实测。
35 lines
1.3 KiB
Bash
Executable File
35 lines
1.3 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
domain=ai.51easyai.com
|
|
hongkong_host=${AI_GATEWAY_CERT_SYNC_HOST:-root@10.77.0.2}
|
|
identity_file=${AI_GATEWAY_CERT_SYNC_KEY:-/root/.ssh/id_ed25519_easyai_cert_sync}
|
|
|
|
[[ $(hostname -I) == *10.77.0.1* ]] || {
|
|
echo 'certificate sync must run on the Ningbo node' >&2
|
|
exit 1
|
|
}
|
|
[[ -f $identity_file && ! -L $identity_file ]] || {
|
|
echo 'certificate sync SSH identity is unavailable' >&2
|
|
exit 1
|
|
}
|
|
|
|
install -d -m 0700 "/etc/nginx/tls/$domain"
|
|
install -m 0644 "/etc/letsencrypt/live/$domain/fullchain.pem" \
|
|
"/etc/nginx/tls/$domain/fullchain.pem"
|
|
install -m 0600 "/etc/letsencrypt/live/$domain/privkey.pem" \
|
|
"/etc/nginx/tls/$domain/privkey.pem"
|
|
ssh -i "$identity_file" -o BatchMode=yes "$hongkong_host" \
|
|
"install -d -m 0700 /etc/nginx/tls/$domain"
|
|
scp -q -i "$identity_file" -o BatchMode=yes \
|
|
"/etc/nginx/tls/$domain/fullchain.pem" \
|
|
"$hongkong_host:/etc/nginx/tls/$domain/fullchain.pem"
|
|
scp -q -i "$identity_file" -o BatchMode=yes \
|
|
"/etc/nginx/tls/$domain/privkey.pem" \
|
|
"$hongkong_host:/etc/nginx/tls/$domain/privkey.pem"
|
|
ssh -i "$identity_file" -o BatchMode=yes "$hongkong_host" \
|
|
"chmod 0600 /etc/nginx/tls/$domain/privkey.pem && nginx -t && systemctl reload nginx"
|
|
nginx -t
|
|
systemctl reload nginx
|
|
echo 'certificate_sync=PASS'
|