chore(deploy): CI 双轨——发版同时部署 EC2 + 阿里（EC2→Ali 迁移期）

deploy-{server,site,client}.sh 目标主机参数化（DEPLOY_HOST/USER/SSH_KEY），不传时行为与现状完全一致（只发 EC2）。workflow 的 Deploy 拆成 EC2（前）+ Ali（后，if:always + continue-on-error，影子目标失败不挡线上）。deploy-server 的 ali 分支只换二进制 + reload 独立 nginx（listen 443），不启动 jiu（阿里 DB 为只读从库，切流提升为主后才起）。新增 deploy/nginx-jiu-ali.conf 并打进 configs.tar.gz。 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YZ4DskSRKsSiheQonFtQvx
2026-06-23 22:56:59 +08:00
parent 9139192097
commit 2eb4275e6f
9 changed files with 238 additions and 34 deletions
@@ -0,0 +1,103 @@
+# 阿里云独立 nginx 版（宿主机直接终结 TLS，不经 pangolin）。
+# 与 nginx-jiu.conf（EC2 pangolin 容器版，listen 127.0.0.1:8445）等价，
+# 仅入口监听改为对公网 443 直连。CI deploy-server.sh 的 ali 分支落到
+# /etc/nginx/conf.d/jiu.conf。
+limit_req_zone $binary_remote_addr zone=jiu_pub:10m rate=10r/s;
+limit_req_status 429;
+
+server {
+    listen 443 ssl http2;
+    server_name jiu.51yanmei.com;
+
+    ssl_certificate     /etc/letsencrypt/live/jiu.51yanmei.com/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/jiu.51yanmei.com/privkey.pem;
+    ssl_protocols       TLSv1.2 TLSv1.3;
+    ssl_ciphers         HIGH:!aNULL:!MD5;
+
+    client_max_body_size 20m;
+
+    # 商品图片静态文件
+    location ^~ /images/ {
+        alias /opt/jiu/images/;
+        expires 30d;
+        add_header Cache-Control "public, immutable";
+    }
+
+    # 文件导入接口（超时更长）
+    location ~ ^/api/v1/import/ {
+        proxy_pass         http://127.0.0.1:8080;
+        proxy_set_header   Host $host;
+        proxy_set_header   X-Real-IP $remote_addr;
+        proxy_read_timeout 300s;
+    }
+
+    # 未鉴权公开/登录接口：加最外层 per-IP 限流
+    location ~ ^/api/v1/(public|auth)/ {
+        limit_req          zone=jiu_pub burst=20 nodelay;
+        proxy_pass         http://127.0.0.1:8080;
+        proxy_set_header   Host $host;
+        proxy_set_header   X-Real-IP $remote_addr;
+        proxy_read_timeout 30s;
+    }
+
+    # API 反向代理
+    location ~ ^/(api|health|version) {
+        proxy_pass         http://127.0.0.1:8080;
+        proxy_set_header   Host $host;
+        proxy_set_header   X-Real-IP $remote_addr;
+        proxy_read_timeout 30s;
+    }
+
+    # Flutter 管理端（仅 /app/ 前缀）
+    location /app/ {
+        alias /opt/jiu/web/;
+        index index.html;
+        try_files $uri $uri/ /app/index.html;
+    }
+
+    location = /app/index.html {
+        alias /opt/jiu/web/index.html;
+        add_header Cache-Control "no-cache, no-store, must-revalidate";
+        add_header Pragma "no-cache";
+        expires 0;
+    }
+
+    # 公开商品详情页（扫码跳转）→ 后端注入 OG 标签
+    location ~ ^/product/ {
+        limit_req          zone=jiu_pub burst=20 nodelay;
+        proxy_pass         http://127.0.0.1:8080;
+        proxy_set_header   Host $host;
+        proxy_set_header   X-Real-IP $remote_addr;
+        proxy_read_timeout 30s;
+    }
+
+    # Flutter base-href=/app/ 会把 /product/:id 重写为 /app/product/:id
+    location ~ ^/app/product/ {
+        limit_req          zone=jiu_pub burst=20 nodelay;
+        rewrite ^/app(/product/.+)$ $1 break;
+        proxy_pass         http://127.0.0.1:8080;
+        proxy_set_header   Host $host;
+        proxy_set_header   X-Real-IP $remote_addr;
+        proxy_read_timeout 30s;
+    }
+
+    # 桌面客户端安装包下载
+    location /downloads/ {
+        alias /opt/jiu/downloads/;
+        add_header Content-Disposition "attachment";
+        add_header Cache-Control "no-cache";
+        autoindex off;
+    }
+
+    # 营销站点兜底
+    location / {
+        root /opt/jiu/marketing;
+        try_files $uri $uri.html $uri/index.html /index.html;
+    }
+}
+
+server {
+    listen 80;
+    server_name jiu.51yanmei.com;
+    return 301 https://$host$request_uri;
+}