devops: 备案通过回切 https 域名 + 流水线 Ali 单轨

- nginx-jiu-ali.conf：443 ssl+http2 正式入口（HSTS/XFO/nosniff 安全头、 ACME webroot 续期通道、80→443 跳转）；8443 明文过渡口拆除 - 客户端构建 URL 全量回切 https://jiu.51yanmei.com（compile×5/local_test/ release-client/notify） - 流水线去 EC2：deploy-client/site 单轨 Ali、manual 回滚与每日备份切 ali、 seed/reset/debug-db 改容器内取密码（SEC-003，退役 DB_PASSWORD secret） Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JJ1g8XV1YhhmHRzhwWEW7o
2026-07-03 09:58:30 +08:00
parent 6238b86dcb
commit 824992fe6e
13 changed files with 108 additions and 92 deletions
@@ -18,9 +18,10 @@ jobs:

      - name: Dump MySQL to local backup dir
        env:
-          EC2_SSH_KEY: ${{ secrets.EC2_SSH_KEY }}
-          EC2_HOST: ${{ secrets.EC2_HOST }}
-          EC2_USER: ${{ secrets.EC2_USER }}
+          # 2026-07-03 割接后备份源=阿里机主库
+          DEPLOY_SSH_KEY: ${{ secrets.ALI_SSH_KEY }}
+          DEPLOY_HOST: ${{ secrets.ALI_HOST }}
+          DEPLOY_USER: ${{ secrets.ALI_USER }}
        run: sh scripts/ci/backup-db.sh

      - name: Notify (Telegram)
@@ -10,15 +10,14 @@ jobs:
      - name: Setup SSH
        run: |
          mkdir -p ~/.ssh
-          printf '%s' "${{ secrets.EC2_SSH_KEY }}" > ~/.ssh/ec2_deploy.pem
+          printf '%s' "${{ secrets.ALI_SSH_KEY }}" > ~/.ssh/ec2_deploy.pem
          chmod 600 ~/.ssh/ec2_deploy.pem
-          ssh-keyscan -H ${{ secrets.EC2_HOST }} >> ~/.ssh/known_hosts
+          ssh-keyscan -H ${{ secrets.ALI_HOST }} >> ~/.ssh/known_hosts

      - name: Query DB
        env:
-          EC2_HOST: ${{ secrets.EC2_HOST }}
-          EC2_USER: ${{ secrets.EC2_USER }}
-          DB_PASSWORD: ${{ secrets.DB_PASSWORD }}
+          EC2_HOST: ${{ secrets.ALI_HOST }}
+          EC2_USER: ${{ secrets.ALI_USER }}
        run: |
          ssh -i ~/.ssh/ec2_deploy.pem ${EC2_USER}@${EC2_HOST} bash << EOF
            echo "=== Docker containers ==="
@@ -26,20 +25,20 @@ jobs:

            echo ""
            echo "=== Databases ==="
-            docker exec jiu_mysql mysql -uroot -p${DB_PASSWORD} -e "SHOW DATABASES;" 2>/dev/null \
-              || echo "jiu_mysql container not found or DB_PASSWORD wrong"
+            docker exec jiu_mysql sh -c 'exec mysql -uroot -p\$MYSQL_ROOT_PASSWORD -e "SHOW DATABASES;"' 2>/dev/null \
+              || echo "jiu_mysql container not found or MYSQL_ROOT_PASSWORD wrong"

            echo ""
            echo "=== Tables in jiu_db ==="
-            docker exec jiu_mysql mysql -uroot -p${DB_PASSWORD} jiu_db -e "SHOW TABLES;" 2>/dev/null
+            docker exec jiu_mysql sh -c 'exec mysql -uroot -p\$MYSQL_ROOT_PASSWORD jiu_db -e "SHOW TABLES;"' 2>/dev/null

            echo ""
            echo "=== shops ==="
-            docker exec jiu_mysql mysql -uroot -p${DB_PASSWORD} jiu_db -e "SELECT id, name, code FROM shops;" 2>/dev/null
+            docker exec jiu_mysql sh -c 'exec mysql -uroot -p\$MYSQL_ROOT_PASSWORD jiu_db -e "SELECT id, name, code FROM shops;"' 2>/dev/null

            echo ""
            echo "=== users ==="
-            docker exec jiu_mysql mysql -uroot -p${DB_PASSWORD} jiu_db -e "SELECT id, shop_id, username, role, is_active FROM users;" 2>/dev/null
+            docker exec jiu_mysql sh -c 'exec mysql -uroot -p\$MYSQL_ROOT_PASSWORD jiu_db -e "SELECT id, shop_id, username, role, is_active FROM users;"' 2>/dev/null
          EOF

      - name: Cleanup SSH key
@@ -180,20 +180,9 @@ jobs:
          GITEA_REPOSITORY: ${{ gitea.repository }}
        run: sh scripts/ci/release-client.sh "${{ gitea.ref_name }}"

-      - name: Deploy → EC2
-        env:
-          FORGEJO_TOKEN: ${{ secrets.FORGEJO_TOKEN }}
-          FORGEJO_URL: ${{ secrets.FORGEJO_URL }}
-          GITEA_REPOSITORY: ${{ gitea.repository }}
-          EC2_SSH_KEY: ${{ secrets.EC2_SSH_KEY }}
-          EC2_HOST: ${{ secrets.EC2_HOST }}
-          EC2_USER: ${{ secrets.EC2_USER }}
-        run: sh scripts/ci/deploy-client.sh "${{ gitea.ref_name }}"
-
-      # 迁移期影子目标：同步 Flutter web + version.yaml + 安装包到阿里机。失败不挡 EC2。
-      - name: Deploy → Ali (migration shadow)
-        if: always()
-        continue-on-error: true
+      # 2026-07-03 割接后阿里机即唯一发布目标（EC2 轨移除；EC2 仅保留
+      # jiu.51yanmei.com 反代桥接到 ali，见 baize 台账）。
+      - name: Deploy → Ali
        env:
          FORGEJO_TOKEN: ${{ secrets.FORGEJO_TOKEN }}
          FORGEJO_URL: ${{ secrets.FORGEJO_URL }}
@@ -32,20 +32,9 @@ jobs:
          GITEA_REPOSITORY: ${{ gitea.repository }}
        run: sh scripts/ci/release-site.sh "${{ gitea.ref_name }}"

-      - name: Deploy → EC2
-        env:
-          FORGEJO_TOKEN: ${{ secrets.FORGEJO_TOKEN }}
-          FORGEJO_URL: ${{ secrets.FORGEJO_URL }}
-          GITEA_REPOSITORY: ${{ gitea.repository }}
-          EC2_SSH_KEY: ${{ secrets.EC2_SSH_KEY }}
-          EC2_HOST: ${{ secrets.EC2_HOST }}
-          EC2_USER: ${{ secrets.EC2_USER }}
-        run: sh scripts/ci/deploy-site.sh "${{ gitea.ref_name }}"
-
-      # 迁移期影子目标：同步官网到阿里机。失败不挡 EC2。
-      - name: Deploy → Ali (migration shadow)
-        if: always()
-        continue-on-error: true
+      # 2026-07-03 割接后阿里机即唯一发布目标（EC2 轨移除；EC2 仅保留
+      # jiu.51yanmei.com 反代桥接到 ali，见 baize 台账）。
+      - name: Deploy → Ali
        env:
          FORGEJO_TOKEN: ${{ secrets.FORGEJO_TOKEN }}
          FORGEJO_URL: ${{ secrets.FORGEJO_URL }}
@@ -28,9 +28,16 @@ jobs:
          FORGEJO_TOKEN: ${{ secrets.FORGEJO_TOKEN }}
          FORGEJO_URL: ${{ secrets.FORGEJO_URL }}
          GITEA_REPOSITORY: ${{ gitea.repository }}
-          EC2_SSH_KEY: ${{ secrets.EC2_SSH_KEY }}
-          EC2_HOST: ${{ secrets.EC2_HOST }}
-          EC2_USER: ${{ secrets.EC2_USER }}
+          # 2026-07-03 割接后回滚目标统一为阿里机
+          DEPLOY_TARGET: ali
+          DEPLOY_SSH_KEY: ${{ secrets.ALI_SSH_KEY }}
+          DEPLOY_HOST: ${{ secrets.ALI_HOST }}
+          DEPLOY_USER: ${{ secrets.ALI_USER }}
+          # 兼容：回滚割接前旧 tag 时，旧脚本直接引用 EC2_*（set -u 下缺失即炸）——
+          # 同值指向阿里，旧脚本也会部署到阿里而不是复活 EC2
+          EC2_SSH_KEY: ${{ secrets.ALI_SSH_KEY }}
+          EC2_HOST: ${{ secrets.ALI_HOST }}
+          EC2_USER: ${{ secrets.ALI_USER }}
        run: |
          TAG="${{ inputs.version }}"
          case "$TAG" in
@@ -17,20 +17,19 @@ jobs:
      - name: Setup SSH
        run: |
          mkdir -p ~/.ssh
-          printf '%s' "${{ secrets.EC2_SSH_KEY }}" > ~/.ssh/ec2_deploy.pem
+          printf '%s' "${{ secrets.ALI_SSH_KEY }}" > ~/.ssh/ec2_deploy.pem
          chmod 600 ~/.ssh/ec2_deploy.pem
-          ssh-keyscan -H ${{ secrets.EC2_HOST }} >> ~/.ssh/known_hosts
+          ssh-keyscan -H ${{ secrets.ALI_HOST }} >> ~/.ssh/known_hosts

      - name: Reset database & reseed
        env:
-          EC2_HOST: ${{ secrets.EC2_HOST }}
-          EC2_USER: ${{ secrets.EC2_USER }}
-          DB_PASSWORD: ${{ secrets.DB_PASSWORD }}
+          EC2_HOST: ${{ secrets.ALI_HOST }}
+          EC2_USER: ${{ secrets.ALI_USER }}
          SHOPS: ${{ github.event.inputs.shops }}
        run: |
          # 1. 清库重建
          ssh -i ~/.ssh/ec2_deploy.pem ${EC2_USER}@${EC2_HOST} \
-            "docker exec jiu_mysql mysql -uroot -p${DB_PASSWORD} -e 'DROP DATABASE IF EXISTS jiu_db; CREATE DATABASE jiu_db CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;'"
+            "docker exec jiu_mysql sh -c 'exec mysql -uroot -p\$MYSQL_ROOT_PASSWORD -e \"DROP DATABASE IF EXISTS jiu_db; CREATE DATABASE jiu_db CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;\"'"
          echo "✓ Database reset"

          # 2. 重启 jiu-server，AutoMigrate 重建表结构
@@ -57,13 +56,13 @@ jobs:
            echo "→ Seeding $SHOP ..."
            if [ "$FIRST" = "true" ]; then
              ssh -i ~/.ssh/ec2_deploy.pem ${EC2_USER}@${EC2_HOST} \
-                "docker exec -i jiu_mysql mysql -uroot -p${DB_PASSWORD} --default-character-set=utf8mb4 jiu_db" \
+                "docker exec -i jiu_mysql sh -c 'exec mysql -uroot -p\$MYSQL_ROOT_PASSWORD --default-character-set=utf8mb4 jiu_db'" \
                < "$FILE"
              FIRST=false
            else
              grep -v "^TRUNCATE" "$FILE" | \
                ssh -i ~/.ssh/ec2_deploy.pem ${EC2_USER}@${EC2_HOST} \
-                "docker exec -i jiu_mysql mysql -uroot -p${DB_PASSWORD} --default-character-set=utf8mb4 jiu_db"
+                "docker exec -i jiu_mysql sh -c 'exec mysql -uroot -p\$MYSQL_ROOT_PASSWORD --default-character-set=utf8mb4 jiu_db'"
            fi
            echo "✓ $SHOP done"
          done
@@ -21,15 +21,14 @@ jobs:
      - name: Setup SSH
        run: |
          mkdir -p ~/.ssh
-          printf '%s' "${{ secrets.EC2_SSH_KEY }}" > ~/.ssh/ec2_deploy.pem
+          printf '%s' "${{ secrets.ALI_SSH_KEY }}" > ~/.ssh/ec2_deploy.pem
          chmod 600 ~/.ssh/ec2_deploy.pem
-          ssh-keyscan -H ${{ secrets.EC2_HOST }} >> ~/.ssh/known_hosts
+          ssh-keyscan -H ${{ secrets.ALI_HOST }} >> ~/.ssh/known_hosts

      - name: Seed databases
        env:
-          EC2_HOST: ${{ secrets.EC2_HOST }}
-          EC2_USER: ${{ secrets.EC2_USER }}
-          DB_PASSWORD: ${{ secrets.DB_PASSWORD }}
+          EC2_HOST: ${{ secrets.ALI_HOST }}
+          EC2_USER: ${{ secrets.ALI_USER }}
          SHOPS: ${{ github.event.inputs.shops }}
          CLEAR: ${{ github.event.inputs.clear }}
        run: |
@@ -41,7 +40,7 @@ jobs:
              echo "  清空 ${SHOP}..."
              printf "SET @shop_code='%s';\n" "$SHOP" | cat - backend/seeds/clear_shop.sql | \
                ssh -i ~/.ssh/ec2_deploy.pem ${EC2_USER}@${EC2_HOST} \
-                  "docker exec -i jiu_mysql mysql -uroot -p${DB_PASSWORD} --default-character-set=utf8mb4 jiu_db"
+                  "docker exec -i jiu_mysql sh -c 'exec mysql -uroot -p\$MYSQL_ROOT_PASSWORD --default-character-set=utf8mb4 jiu_db'"
            done
            echo "✓ 清空完成"
          fi
@@ -56,7 +55,7 @@ jobs:
            fi
            echo "→ Seeding $SHOP ..."
            ssh -i ~/.ssh/ec2_deploy.pem ${EC2_USER}@${EC2_HOST} \
-              "docker exec -i jiu_mysql mysql -uroot -p${DB_PASSWORD} --default-character-set=utf8mb4 jiu_db" \
+              "docker exec -i jiu_mysql sh -c 'exec mysql -uroot -p\$MYSQL_ROOT_PASSWORD --default-character-set=utf8mb4 jiu_db'" \
              < "$FILE"
            echo "✓ $SHOP done"
          done