chore(deploy): CI 双轨——发版同时部署 EC2 + 阿里（EC2→Ali 迁移期）

deploy-{server,site,client}.sh 目标主机参数化（DEPLOY_HOST/USER/SSH_KEY），
不传时行为与现状完全一致（只发 EC2）。workflow 的 Deploy 拆成 EC2（前）+
Ali（后，if:always + continue-on-error，影子目标失败不挡线上）。deploy-server
的 ali 分支只换二进制 + reload 独立 nginx（listen 443），不启动 jiu（阿里 DB
为只读从库，切流提升为主后才起）。新增 deploy/nginx-jiu-ali.conf 并打进
configs.tar.gz。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YZ4DskSRKsSiheQonFtQvx

scripts/ci/deploy-server.sh

@@ -1,15 +1,26 @@
 #!/usr/bin/env bash
-# deploy-server.sh <tag>  —  deploy the backend binary + nginx config to EC2.
-# Two modes: uses dist/ built in the same job, or downloads the release assets
-# by tag (manual rollback). Does NOT touch the web app, marketing site, or
-# version.yaml.
+# deploy-server.sh <tag>  —  deploy the backend binary + nginx config.
+# Two source modes: uses dist/ built in the same job, or downloads the release
+# assets by tag (manual rollback). Does NOT touch the web app, marketing site,
+# or version.yaml.
+#
+# Target is EC2 by default. During the EC2→Ali migration, set DEPLOY_TARGET=ali
+# plus DEPLOY_HOST/DEPLOY_USER/DEPLOY_SSH_KEY to deploy to the Alibaba Cloud box.
+#   - ec2 (default): stop jiu → swap binary → start jiu → health check →
+#                    reload nginx inside the pangolin-edge container.
+#   - ali: swap binary only (jiu.service stays stopped — the Ali DB is a
+#          read-only replica until cutover; backend is started at cutover) →
+#          reload the host nginx with the standalone (listen 443) config.
 set -euo pipefail
 
 # shellcheck source=scripts/ci/lib-forgejo.sh
 . "$(dirname "$0")/lib-forgejo.sh"
 
 TAG="$1"
-echo "==> deploy-server: tag=${TAG}"
+DEPLOY_TARGET="${DEPLOY_TARGET:-ec2}"
+TARGET_HOST="${DEPLOY_HOST:-$EC2_HOST}"
+TARGET_USER="${DEPLOY_USER:-$EC2_USER}"
+echo "==> deploy-server: tag=${TAG} target=${DEPLOY_TARGET} host=${TARGET_HOST}"
 
 if [ ! -f dist/jiu-server ] || [ ! -f dist/configs.tar.gz ]; then
   download_release_assets "$TAG"
@@ -22,19 +33,54 @@ rm -rf /tmp/jiu-configs
 mkdir -p /tmp/jiu-configs
 tar -xzf dist/configs.tar.gz -C /tmp/jiu-configs
 
+# Pick the nginx config matching the target's reverse-proxy topology.
+if [ "$DEPLOY_TARGET" = "ali" ]; then
+  NGINX_SRC=/tmp/jiu-configs/deploy/nginx-jiu-ali.conf
+else
+  NGINX_SRC=/tmp/jiu-configs/deploy/nginx-jiu.conf
+fi
+
 setup_ssh
-echo "==> deploy-server: uploading files to EC2"
-${SCP} dist/jiu-server "${EC2_USER}@${EC2_HOST}:/tmp/jiu-server"
-${SCP} /tmp/jiu-configs/deploy/nginx-jiu.conf "${EC2_USER}@${EC2_HOST}:/tmp/nginx-jiu.conf"
+echo "==> deploy-server: uploading files to ${TARGET_HOST}"
+${SCP} dist/jiu-server "${TARGET_USER}@${TARGET_HOST}:/tmp/jiu-server"
+${SCP} "${NGINX_SRC}" "${TARGET_USER}@${TARGET_HOST}:/tmp/nginx-jiu.conf"
 
 # Platform code-minting CLI + wrapper (absent when rolling back to a pre-gencode
 # release — upload only when present).
 if [ -f dist/jiu-gencode ]; then
-  ${SCP} dist/jiu-gencode "${EC2_USER}@${EC2_HOST}:/tmp/jiu-gencode"
-  ${SCP} /tmp/jiu-configs/deploy/jiu-gencode.sh "${EC2_USER}@${EC2_HOST}:/tmp/jiu-gencode.sh"
+  ${SCP} dist/jiu-gencode "${TARGET_USER}@${TARGET_HOST}:/tmp/jiu-gencode"
+  ${SCP} /tmp/jiu-configs/deploy/jiu-gencode.sh "${TARGET_USER}@${TARGET_HOST}:/tmp/jiu-gencode.sh"
 fi
 
-${SSH} "${EC2_USER}@${EC2_HOST}" << 'ENDSSH'
+if [ "$DEPLOY_TARGET" = "ali" ]; then
+  # --- Alibaba Cloud (shadow target, pre-cutover) ---
+  # Swap the binary but DO NOT start jiu: the Ali DB is a read-only replica, so
+  # the backend's startup AutoMigrate/backfill would fail. jiu.service is started
+  # only at cutover (after the replica is promoted to primary). Reload the host
+  # nginx with the standalone listen-443 config.
+  ${SSH} "${TARGET_USER}@${TARGET_HOST}" << 'ENDSSH'
+set -e
+
+cp /tmp/jiu-server /opt/jiu/backend/jiu-server
+chmod +x /opt/jiu/backend/jiu-server
+
+if [ -f /tmp/jiu-gencode ]; then
+  cp /tmp/jiu-gencode /opt/jiu/backend/jiu-gencode
+  chmod +x /opt/jiu/backend/jiu-gencode
+  if [ -f /tmp/jiu-gencode.sh ]; then
+    cp /tmp/jiu-gencode.sh /opt/jiu/backend/jiu-gencode.sh
+    chmod +x /opt/jiu/backend/jiu-gencode.sh
+  fi
+fi
+
+cp /tmp/nginx-jiu.conf /etc/nginx/conf.d/jiu.conf
+nginx -t && systemctl reload nginx
+
+echo "Ali server staged (binary swapped, jiu.service left stopped, nginx reloaded)"
+ENDSSH
+else
+  # --- EC2 (live primary) ---
+  ${SSH} "${TARGET_USER}@${TARGET_HOST}" << 'ENDSSH'
 set -e
 
 # Replace backend binary
@@ -72,7 +118,8 @@ docker exec pangolin-edge nginx -t && docker exec pangolin-edge nginx -s reload
 
 echo "Server deploy complete!"
 ENDSSH
+fi
 
 teardown_ssh
 rm -rf /tmp/jiu-configs
-echo "==> deploy-server: done"
+echo "==> deploy-server: done (target=${DEPLOY_TARGET})"