chore(deploy): CI 双轨——发版同时部署 EC2 + 阿里（EC2→Ali 迁移期）

deploy-{server,site,client}.sh 目标主机参数化（DEPLOY_HOST/USER/SSH_KEY），
不传时行为与现状完全一致（只发 EC2）。workflow 的 Deploy 拆成 EC2（前）+
Ali（后，if:always + continue-on-error，影子目标失败不挡线上）。deploy-server
的 ali 分支只换二进制 + reload 独立 nginx（listen 443），不启动 jiu（阿里 DB
为只读从库，切流提升为主后才起）。新增 deploy/nginx-jiu-ali.conf 并打进
configs.tar.gz。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YZ4DskSRKsSiheQonFtQvx

.gitea/workflows/deploy-client.yml

@@ -180,7 +180,7 @@ jobs:
           GITEA_REPOSITORY: ${{ gitea.repository }}
         run: sh scripts/ci/release-client.sh "${{ gitea.ref_name }}"
 
-      - name: Deploy
+      - name: Deploy → EC2
         env:
           FORGEJO_TOKEN: ${{ secrets.FORGEJO_TOKEN }}
           FORGEJO_URL: ${{ secrets.FORGEJO_URL }}
@@ -190,6 +190,19 @@ jobs:
           EC2_USER: ${{ secrets.EC2_USER }}
         run: sh scripts/ci/deploy-client.sh "${{ gitea.ref_name }}"
 
+      # 迁移期影子目标：同步 Flutter web + version.yaml + 安装包到阿里机。失败不挡 EC2。
+      - name: Deploy → Ali (migration shadow)
+        if: always()
+        continue-on-error: true
+        env:
+          FORGEJO_TOKEN: ${{ secrets.FORGEJO_TOKEN }}
+          FORGEJO_URL: ${{ secrets.FORGEJO_URL }}
+          GITEA_REPOSITORY: ${{ gitea.repository }}
+          DEPLOY_SSH_KEY: ${{ secrets.ALI_SSH_KEY }}
+          DEPLOY_HOST: ${{ secrets.ALI_HOST }}
+          DEPLOY_USER: ${{ secrets.ALI_USER }}
+        run: sh scripts/ci/deploy-client.sh "${{ gitea.ref_name }}"
+
       - name: Notify
         if: always()
         env:

.gitea/workflows/deploy-server.yml

@@ -36,16 +36,32 @@ jobs:
           GITEA_REPOSITORY: ${{ gitea.repository }}
         run: sh scripts/ci/release-server.sh "${{ gitea.ref_name }}"
 
-      - name: Deploy
+      - name: Deploy → EC2
         env:
           FORGEJO_TOKEN: ${{ secrets.FORGEJO_TOKEN }}
           FORGEJO_URL: ${{ secrets.FORGEJO_URL }}
           GITEA_REPOSITORY: ${{ gitea.repository }}
+          DEPLOY_TARGET: ec2
           EC2_SSH_KEY: ${{ secrets.EC2_SSH_KEY }}
           EC2_HOST: ${{ secrets.EC2_HOST }}
           EC2_USER: ${{ secrets.EC2_USER }}
         run: sh scripts/ci/deploy-server.sh "${{ gitea.ref_name }}"
 
+      # 迁移期影子目标：部署到阿里机（只换二进制 + reload 独立 nginx，jiu 保持 stopped）。
+      # if: always() → EC2 失败也照样尝试；continue-on-error → 阿里失败不让流水线变红。
+      - name: Deploy → Ali (migration shadow)
+        if: always()
+        continue-on-error: true
+        env:
+          FORGEJO_TOKEN: ${{ secrets.FORGEJO_TOKEN }}
+          FORGEJO_URL: ${{ secrets.FORGEJO_URL }}
+          GITEA_REPOSITORY: ${{ gitea.repository }}
+          DEPLOY_TARGET: ali
+          DEPLOY_SSH_KEY: ${{ secrets.ALI_SSH_KEY }}
+          DEPLOY_HOST: ${{ secrets.ALI_HOST }}
+          DEPLOY_USER: ${{ secrets.ALI_USER }}
+        run: sh scripts/ci/deploy-server.sh "${{ gitea.ref_name }}"
+
       - name: Notify
         if: always()
         env:

.gitea/workflows/deploy-site.yml

@@ -32,7 +32,7 @@ jobs:
           GITEA_REPOSITORY: ${{ gitea.repository }}
         run: sh scripts/ci/release-site.sh "${{ gitea.ref_name }}"
 
-      - name: Deploy
+      - name: Deploy → EC2
         env:
           FORGEJO_TOKEN: ${{ secrets.FORGEJO_TOKEN }}
           FORGEJO_URL: ${{ secrets.FORGEJO_URL }}
@@ -42,6 +42,19 @@ jobs:
           EC2_USER: ${{ secrets.EC2_USER }}
         run: sh scripts/ci/deploy-site.sh "${{ gitea.ref_name }}"
 
+      # 迁移期影子目标：同步官网到阿里机。失败不挡 EC2。
+      - name: Deploy → Ali (migration shadow)
+        if: always()
+        continue-on-error: true
+        env:
+          FORGEJO_TOKEN: ${{ secrets.FORGEJO_TOKEN }}
+          FORGEJO_URL: ${{ secrets.FORGEJO_URL }}
+          GITEA_REPOSITORY: ${{ gitea.repository }}
+          DEPLOY_SSH_KEY: ${{ secrets.ALI_SSH_KEY }}
+          DEPLOY_HOST: ${{ secrets.ALI_HOST }}
+          DEPLOY_USER: ${{ secrets.ALI_USER }}
+        run: sh scripts/ci/deploy-site.sh "${{ gitea.ref_name }}"
+
       - name: Notify
         if: always()
         env:

deploy/nginx-jiu-ali.conf

@@ -0,0 +1,103 @@
+# 阿里云独立 nginx 版（宿主机直接终结 TLS，不经 pangolin）。
+# 与 nginx-jiu.conf（EC2 pangolin 容器版，listen 127.0.0.1:8445）等价，
+# 仅入口监听改为对公网 443 直连。CI deploy-server.sh 的 ali 分支落到
+# /etc/nginx/conf.d/jiu.conf。
+limit_req_zone $binary_remote_addr zone=jiu_pub:10m rate=10r/s;
+limit_req_status 429;
+
+server {
+    listen 443 ssl http2;
+    server_name jiu.51yanmei.com;
+
+    ssl_certificate     /etc/letsencrypt/live/jiu.51yanmei.com/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/jiu.51yanmei.com/privkey.pem;
+    ssl_protocols       TLSv1.2 TLSv1.3;
+    ssl_ciphers         HIGH:!aNULL:!MD5;
+
+    client_max_body_size 20m;
+
+    # 商品图片静态文件
+    location ^~ /images/ {
+        alias /opt/jiu/images/;
+        expires 30d;
+        add_header Cache-Control "public, immutable";
+    }
+
+    # 文件导入接口（超时更长）
+    location ~ ^/api/v1/import/ {
+        proxy_pass         http://127.0.0.1:8080;
+        proxy_set_header   Host $host;
+        proxy_set_header   X-Real-IP $remote_addr;
+        proxy_read_timeout 300s;
+    }
+
+    # 未鉴权公开/登录接口：加最外层 per-IP 限流
+    location ~ ^/api/v1/(public|auth)/ {
+        limit_req          zone=jiu_pub burst=20 nodelay;
+        proxy_pass         http://127.0.0.1:8080;
+        proxy_set_header   Host $host;
+        proxy_set_header   X-Real-IP $remote_addr;
+        proxy_read_timeout 30s;
+    }
+
+    # API 反向代理
+    location ~ ^/(api|health|version) {
+        proxy_pass         http://127.0.0.1:8080;
+        proxy_set_header   Host $host;
+        proxy_set_header   X-Real-IP $remote_addr;
+        proxy_read_timeout 30s;
+    }
+
+    # Flutter 管理端（仅 /app/ 前缀）
+    location /app/ {
+        alias /opt/jiu/web/;
+        index index.html;
+        try_files $uri $uri/ /app/index.html;
+    }
+
+    location = /app/index.html {
+        alias /opt/jiu/web/index.html;
+        add_header Cache-Control "no-cache, no-store, must-revalidate";
+        add_header Pragma "no-cache";
+        expires 0;
+    }
+
+    # 公开商品详情页（扫码跳转）→ 后端注入 OG 标签
+    location ~ ^/product/ {
+        limit_req          zone=jiu_pub burst=20 nodelay;
+        proxy_pass         http://127.0.0.1:8080;
+        proxy_set_header   Host $host;
+        proxy_set_header   X-Real-IP $remote_addr;
+        proxy_read_timeout 30s;
+    }
+
+    # Flutter base-href=/app/ 会把 /product/:id 重写为 /app/product/:id
+    location ~ ^/app/product/ {
+        limit_req          zone=jiu_pub burst=20 nodelay;
+        rewrite ^/app(/product/.+)$ $1 break;
+        proxy_pass         http://127.0.0.1:8080;
+        proxy_set_header   Host $host;
+        proxy_set_header   X-Real-IP $remote_addr;
+        proxy_read_timeout 30s;
+    }
+
+    # 桌面客户端安装包下载
+    location /downloads/ {
+        alias /opt/jiu/downloads/;
+        add_header Content-Disposition "attachment";
+        add_header Cache-Control "no-cache";
+        autoindex off;
+    }
+
+    # 营销站点兜底
+    location / {
+        root /opt/jiu/marketing;
+        try_files $uri $uri.html $uri/index.html /index.html;
+    }
+}
+
+server {
+    listen 80;
+    server_name jiu.51yanmei.com;
+    return 301 https://$host$request_uri;
+}

scripts/ci/compile-backend.sh

@@ -26,6 +26,7 @@ mv backend/jiu-gencode dist/jiu-gencode
 # it belongs to the client pipeline.
 tar -czf dist/configs.tar.gz \
   deploy/nginx-jiu.conf \
+  deploy/nginx-jiu-ali.conf \
   deploy/jiu.service \
   deploy/production.env.template \
   deploy/setup-ec2.sh \

scripts/ci/deploy-client.sh

@@ -1,14 +1,17 @@
 #!/usr/bin/env bash
 # deploy-client.sh <tag>  —  deploy the Flutter web app, desktop/mobile installers,
-# and version.yaml to EC2. Does NOT restart the backend (version.yaml is read
+# and version.yaml. Does NOT restart the backend (version.yaml is read
-# per-request) nor touch nginx / the marketing site.
+# per-request) nor touch nginx / the marketing site. Target is EC2 by default;
+# set DEPLOY_HOST/DEPLOY_USER/DEPLOY_SSH_KEY to retarget the Ali box (migration).
 set -euo pipefail
 
 # shellcheck source=scripts/ci/lib-forgejo.sh
 . "$(dirname "$0")/lib-forgejo.sh"
 
 TAG="$1"
-echo "==> deploy-client: tag=${TAG}"
+TARGET_HOST="${DEPLOY_HOST:-$EC2_HOST}"
+TARGET_USER="${DEPLOY_USER:-$EC2_USER}"
+echo "==> deploy-client: tag=${TAG} host=${TARGET_HOST}"
 
 if [ ! -f dist/web.tar.gz ] || [ ! -f dist/version.yaml ]; then
   download_release_assets "$TAG"
@@ -27,18 +30,18 @@ mkdir -p /tmp/jiu-web-new
 tar -xzf dist/web.tar.gz -C /tmp/jiu-web-new --strip-components=1
 
 setup_ssh
-echo "==> deploy-client: uploading files to EC2"
+echo "==> deploy-client: uploading files to ${TARGET_HOST}"
-${SCP} "$VERSION_YAML" "${EC2_USER}@${EC2_HOST}:/tmp/version.yaml"
+${SCP} "$VERSION_YAML" "${TARGET_USER}@${TARGET_HOST}:/tmp/version.yaml"
 rsync -avz --delete -e "ssh -i ~/.ssh/ec2_deploy.pem -o StrictHostKeyChecking=no" \
-  /tmp/jiu-web-new/ "${EC2_USER}@${EC2_HOST}:/tmp/jiu-web-new/"
+  /tmp/jiu-web-new/ "${TARGET_USER}@${TARGET_HOST}:/tmp/jiu-web-new/"
 
 # Desktop / mobile installers (served from /downloads/ by nginx). Guarded —
 # may be absent in a partial manual deploy.
-[ -f dist/jiu-windows-x64-setup.exe ] && ${SCP} dist/jiu-windows-x64-setup.exe "${EC2_USER}@${EC2_HOST}:/tmp/jiu-windows-x64-setup.exe" || true
+[ -f dist/jiu-windows-x64-setup.exe ] && ${SCP} dist/jiu-windows-x64-setup.exe "${TARGET_USER}@${TARGET_HOST}:/tmp/jiu-windows-x64-setup.exe" || true
-[ -f dist/jiu-macos-x64.zip ] && ${SCP} dist/jiu-macos-x64.zip "${EC2_USER}@${EC2_HOST}:/tmp/jiu-macos-x64.zip" || true
+[ -f dist/jiu-macos-x64.zip ] && ${SCP} dist/jiu-macos-x64.zip "${TARGET_USER}@${TARGET_HOST}:/tmp/jiu-macos-x64.zip" || true
-[ -f dist/jiu-android.apk ] && ${SCP} dist/jiu-android.apk "${EC2_USER}@${EC2_HOST}:/tmp/jiu-android.apk" || true
+[ -f dist/jiu-android.apk ] && ${SCP} dist/jiu-android.apk "${TARGET_USER}@${TARGET_HOST}:/tmp/jiu-android.apk" || true
 
-${SSH} "${EC2_USER}@${EC2_HOST}" << 'ENDSSH'
+${SSH} "${TARGET_USER}@${TARGET_HOST}" << 'ENDSSH'
 set -e
 
 # Update version config (WorkingDirectory=/opt/jiu reads config/version.yaml).

scripts/ci/deploy-server.sh

@@ -1,15 +1,26 @@
 #!/usr/bin/env bash
-# deploy-server.sh <tag>  —  deploy the backend binary + nginx config to EC2.
+# deploy-server.sh <tag>  —  deploy the backend binary + nginx config.
-# Two modes: uses dist/ built in the same job, or downloads the release assets
+# Two source modes: uses dist/ built in the same job, or downloads the release
-# by tag (manual rollback). Does NOT touch the web app, marketing site, or
+# assets by tag (manual rollback). Does NOT touch the web app, marketing site,
-# version.yaml.
+# or version.yaml.
+#
+# Target is EC2 by default. During the EC2→Ali migration, set DEPLOY_TARGET=ali
+# plus DEPLOY_HOST/DEPLOY_USER/DEPLOY_SSH_KEY to deploy to the Alibaba Cloud box.
+#   - ec2 (default): stop jiu → swap binary → start jiu → health check →
+#                    reload nginx inside the pangolin-edge container.
+#   - ali: swap binary only (jiu.service stays stopped — the Ali DB is a
+#          read-only replica until cutover; backend is started at cutover) →
+#          reload the host nginx with the standalone (listen 443) config.
 set -euo pipefail
 
 # shellcheck source=scripts/ci/lib-forgejo.sh
 . "$(dirname "$0")/lib-forgejo.sh"
 
 TAG="$1"
-echo "==> deploy-server: tag=${TAG}"
+DEPLOY_TARGET="${DEPLOY_TARGET:-ec2}"
+TARGET_HOST="${DEPLOY_HOST:-$EC2_HOST}"
+TARGET_USER="${DEPLOY_USER:-$EC2_USER}"
+echo "==> deploy-server: tag=${TAG} target=${DEPLOY_TARGET} host=${TARGET_HOST}"
 
 if [ ! -f dist/jiu-server ] || [ ! -f dist/configs.tar.gz ]; then
   download_release_assets "$TAG"
@@ -22,19 +33,54 @@ rm -rf /tmp/jiu-configs
 mkdir -p /tmp/jiu-configs
 tar -xzf dist/configs.tar.gz -C /tmp/jiu-configs
 
+# Pick the nginx config matching the target's reverse-proxy topology.
+if [ "$DEPLOY_TARGET" = "ali" ]; then
+  NGINX_SRC=/tmp/jiu-configs/deploy/nginx-jiu-ali.conf
+else
+  NGINX_SRC=/tmp/jiu-configs/deploy/nginx-jiu.conf
+fi
+
 setup_ssh
-echo "==> deploy-server: uploading files to EC2"
+echo "==> deploy-server: uploading files to ${TARGET_HOST}"
-${SCP} dist/jiu-server "${EC2_USER}@${EC2_HOST}:/tmp/jiu-server"
+${SCP} dist/jiu-server "${TARGET_USER}@${TARGET_HOST}:/tmp/jiu-server"
-${SCP} /tmp/jiu-configs/deploy/nginx-jiu.conf "${EC2_USER}@${EC2_HOST}:/tmp/nginx-jiu.conf"
+${SCP} "${NGINX_SRC}" "${TARGET_USER}@${TARGET_HOST}:/tmp/nginx-jiu.conf"
 
 # Platform code-minting CLI + wrapper (absent when rolling back to a pre-gencode
 # release — upload only when present).
 if [ -f dist/jiu-gencode ]; then
-  ${SCP} dist/jiu-gencode "${EC2_USER}@${EC2_HOST}:/tmp/jiu-gencode"
+  ${SCP} dist/jiu-gencode "${TARGET_USER}@${TARGET_HOST}:/tmp/jiu-gencode"
-  ${SCP} /tmp/jiu-configs/deploy/jiu-gencode.sh "${EC2_USER}@${EC2_HOST}:/tmp/jiu-gencode.sh"
+  ${SCP} /tmp/jiu-configs/deploy/jiu-gencode.sh "${TARGET_USER}@${TARGET_HOST}:/tmp/jiu-gencode.sh"
 fi
 
-${SSH} "${EC2_USER}@${EC2_HOST}" << 'ENDSSH'
+if [ "$DEPLOY_TARGET" = "ali" ]; then
+  # --- Alibaba Cloud (shadow target, pre-cutover) ---
+  # Swap the binary but DO NOT start jiu: the Ali DB is a read-only replica, so
+  # the backend's startup AutoMigrate/backfill would fail. jiu.service is started
+  # only at cutover (after the replica is promoted to primary). Reload the host
+  # nginx with the standalone listen-443 config.
+  ${SSH} "${TARGET_USER}@${TARGET_HOST}" << 'ENDSSH'
+set -e
+
+cp /tmp/jiu-server /opt/jiu/backend/jiu-server
+chmod +x /opt/jiu/backend/jiu-server
+
+if [ -f /tmp/jiu-gencode ]; then
+  cp /tmp/jiu-gencode /opt/jiu/backend/jiu-gencode
+  chmod +x /opt/jiu/backend/jiu-gencode
+  if [ -f /tmp/jiu-gencode.sh ]; then
+    cp /tmp/jiu-gencode.sh /opt/jiu/backend/jiu-gencode.sh
+    chmod +x /opt/jiu/backend/jiu-gencode.sh
+  fi
+fi
+
+cp /tmp/nginx-jiu.conf /etc/nginx/conf.d/jiu.conf
+nginx -t && systemctl reload nginx
+
+echo "Ali server staged (binary swapped, jiu.service left stopped, nginx reloaded)"
+ENDSSH
+else
+  # --- EC2 (live primary) ---
+  ${SSH} "${TARGET_USER}@${TARGET_HOST}" << 'ENDSSH'
 set -e
 
 # Replace backend binary
@@ -72,7 +118,8 @@ docker exec pangolin-edge nginx -t && docker exec pangolin-edge nginx -s reload
 
 echo "Server deploy complete!"
 ENDSSH
+fi
 
 teardown_ssh
 rm -rf /tmp/jiu-configs
-echo "==> deploy-server: done"
+echo "==> deploy-server: done (target=${DEPLOY_TARGET})"

scripts/ci/deploy-site.sh

@@ -1,13 +1,16 @@
 #!/usr/bin/env bash
-# deploy-site.sh <tag>  —  deploy the Eleventy marketing site to EC2
+# deploy-site.sh <tag>  —  deploy the Eleventy marketing site to /opt/jiu/marketing.
-# (/opt/jiu/marketing). Does NOT restart the backend or touch nginx.
+# Does NOT restart the backend or touch nginx. Target is EC2 by default; set
+# DEPLOY_HOST/DEPLOY_USER/DEPLOY_SSH_KEY to retarget the Ali box (migration).
 set -euo pipefail
 
 # shellcheck source=scripts/ci/lib-forgejo.sh
 . "$(dirname "$0")/lib-forgejo.sh"
 
 TAG="$1"
-echo "==> deploy-site: tag=${TAG}"
+TARGET_HOST="${DEPLOY_HOST:-$EC2_HOST}"
+TARGET_USER="${DEPLOY_USER:-$EC2_USER}"
+echo "==> deploy-site: tag=${TAG} host=${TARGET_HOST}"
 
 if [ ! -f dist/marketing.tar.gz ]; then
   download_release_assets "$TAG"
@@ -21,11 +24,11 @@ mkdir -p /tmp/jiu-marketing-new
 tar -xzf dist/marketing.tar.gz -C /tmp/jiu-marketing-new
 
 setup_ssh
-echo "==> deploy-site: uploading marketing site to EC2"
+echo "==> deploy-site: uploading marketing site to ${TARGET_HOST}"
 rsync -avz --delete -e "ssh -i ~/.ssh/ec2_deploy.pem -o StrictHostKeyChecking=no" \
-  /tmp/jiu-marketing-new/ "${EC2_USER}@${EC2_HOST}:/tmp/jiu-marketing-new/"
+  /tmp/jiu-marketing-new/ "${TARGET_USER}@${TARGET_HOST}:/tmp/jiu-marketing-new/"
 
-${SSH} "${EC2_USER}@${EC2_HOST}" << 'ENDSSH'
+${SSH} "${TARGET_USER}@${TARGET_HOST}" << 'ENDSSH'
 set -e
 mkdir -p /opt/jiu/marketing
 rsync -a --delete /tmp/jiu-marketing-new/ /opt/jiu/marketing/

scripts/ci/lib-forgejo.sh

@@ -106,12 +106,17 @@ for a in rel.get('assets', []):
 PYEOF
 }
 
-# setup_ssh — write the EC2 deploy key and export SSH / SCP commands.
+# setup_ssh — write the deploy key and export SSH / SCP commands.
+# Target is the EC2 host by default; set DEPLOY_HOST / DEPLOY_USER / DEPLOY_SSH_KEY
+# to retarget another host (e.g. the Alibaba Cloud box during the EC2→Ali migration).
+# Backward-compatible: with no DEPLOY_* set, behaves exactly as before (EC2).
 setup_ssh() {
+  local host="${DEPLOY_HOST:-$EC2_HOST}"
+  local key="${DEPLOY_SSH_KEY:-$EC2_SSH_KEY}"
   mkdir -p ~/.ssh
-  printf '%s' "${EC2_SSH_KEY}" > ~/.ssh/ec2_deploy.pem
+  printf '%s' "${key}" > ~/.ssh/ec2_deploy.pem
   chmod 600 ~/.ssh/ec2_deploy.pem
-  ssh-keyscan -H "${EC2_HOST}" >> ~/.ssh/known_hosts 2>/dev/null
+  ssh-keyscan -H "${host}" >> ~/.ssh/known_hosts 2>/dev/null
   SSH="ssh -i ~/.ssh/ec2_deploy.pem -o StrictHostKeyChecking=no"
   SCP="scp -O -i ~/.ssh/ec2_deploy.pem"
 }