wangjia/pangolin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 22 Wiki Activity
17 Commits 7 Branches 47 Tags
3f0f82eca08e1df3c736d64dbe95984681ba0970
Commit Graph

17 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
wangjia 3f0f82eca0 merge: maestro/tsk_L2k2VrEujof8 [tsk_L2k2VrEujof8] Go 模块骨架 + 工具链(go.mod/tools.go/Makefile) 2026-06-13 02:57:25 +08:00
wangjia 18869bc1fa merge: maestro/tsk_paiqu21eZIuw [tsk_paiqu21eZIuw] MySQL migration 7 文件 + plans seed 2026-06-13 02:57:25 +08:00
wangjia adfd8ce3f2 merge: maestro/tsk_bYv-CoKSwgAC [tsk_bYv-CoKSwgAC] 备份与灾备演练 2026-06-13 02:57:25 +08:00
wangjia 1629385c70 feat(server): Go 模块骨架 + 工具链 [tsk_L2k2VrEujof8] 
新建 server/ Go 模块：
- go.mod: module github.com/wangjia/pangolin/server, Go 1.22
  依赖: go-chi/chi/v5, google/uuid
- tools.go: //go:build tools 锁定 oapi-codegen / golang-migrate 版本
- cmd/server/main.go: chi router + GET /healthz → {"status":"ok"}，监听 :8080
- cmd/migrate/main.go: 占位入口（实逻辑归 1e）
- internal/{config,store,apierr,idgen,auth,codes,devices,nodes,usage,admin}/doc.go
  各包职责说明
- Makefile: build/test/vet/lint/generate/migrate-up/migrate-down
- .golangci.yml: govet/errcheck/staticcheck/revive/gofmt 基线
- README.md: 定位 + 目录树 + make 入口说明
- setup.sh: 首次 go mod tidy 引导脚本（go.sum 需运行后生成）

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-13 01:28:37 +08:00
wangjia b4114c93ee feat(db): add MySQL migrations 000001-000007 covering all 12 tables + seed [tsk_paiqu21eZIuw] 
- 000001: users + devices（账户 / 设备，含 argon2id pw_hash、dp_uuid）
- 000002: plans + subscriptions（套餐口径来自 design/CLAUDE.md §7）
- 000003: code_batches + codes（SHA-256 code_hash，明文不入库）
- 000004: usage_daily + audit_log（最小数据原则 + JSON meta）
- 000005: providers + nodes（providers 先建，nodes FK 引用）
- 000006: node_events（9 值 ENUM）+ directory_version（CHECK id=1，MySQL ≥ 8.0.16）
- 000007: plans 三行 seed + directory_version(1,1)，ON DUPLICATE KEY UPDATE 保可重入

所有表 ENGINE=InnoDB DEFAULT CHARSET=utf8mb4，时间列 DATETIME(6)，
主键 BIGINT UNSIGNED AUTO_INCREMENT + 对外 uuid CHAR(36) UNIQUE。
每对 down 文件逆序 DROP（子表先于父表）。

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-13 01:28:01 +08:00
wangjia 20dbb5f363 feat(backup): 备份与灾备演练系统 [tsk_bYv-CoKSwgAC] 
实现 xtrabackup + binlog 增量备份、age 加密异地存储与月度 DR 演练。

## 交付内容

### deploy/backup/ —— 备份容器
- Dockerfile：Ubuntu 22.04 + xtrabackup 8.0 + age v1.2.0 + AWS CLI v2 + pg_client
- entrypoint.sh：初始化 AWS 凭据 / age 公钥，启动 crond
- crontab.txt：全量 02:00 / 增量每 15min / DR 演练每月 1 日
- scripts/lib.sh：日志 / age 加密 / S3 上传 / 连接测试等共用函数
- scripts/backup-full.sh：MySQL xtrabackup 全量 + pg_dump 全量 + SQLite 备份
- scripts/backup-inc.sh：MySQL xtrabackup 增量 + binlog flush & 归档 + pg_dump 快照
- scripts/restore.sh：从 S3 下载、解密、prepare / pg_restore 完整恢复
- scripts/dr-drill.sh：月度演练 —— RPO 验证 / 备份完整性 / MySQL 临时容器恢复 / RTO 度量
- scripts/verify-rpo-rto.sh：实时 RPO/RTO 状态检查（S3 最新备份时间戳）
- backup.env.example：配置模板（MySQL / PG / S3 / age 公钥）

### 修改已有文件
- deploy/docker-compose.yml：新增 pangolin-backup 服务
- deploy/scripts/gen-secrets.sh：幂等生成 age 密钥对 + backup.env 模板
- .gitignore：排除 age 私钥 / backup.env
- deploy/README.md：容器一览 + 备份快速命令

### docs/备份与灾备.md
S3 初始化、IAM 权限设计、age 密钥管理、MySQL 权限、DR 恢复步骤、RTO 测量标准

## 设计要点
- RPO ≤ 15min：每 15min xtrabackup 增量 + binlog flush + pg_dump 快照
- RTO ≤ 4h：月度演练度量，估算恢复时长约 2h
- 独立身份账号：备份 IAM 仅有 s3:PutObject，与生产账号完全隔离
- age 加密：公钥存服务器，私钥离线保存，S3 中无明文
- 无 crontab：cron 在容器内运行，绕过 ec2-user crontab 限制
- 幂等部署：backup.env 存在则跳过，age 密钥对存在则跳过

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-13 01:09:18 +08:00
wangjia a642bf16a2 feat: 同步 design/ 设计系统(含 iPad tablet kit) + 架构任务拆分(todo/) 
design/ 同步自最新设计导出，新增 ui_kits/tablet/ 平板分栏布局；todo/ 录入 18 个并行实施任务。

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
 2026-06-11 23:57:57 +08:00
wangjia 3ae96ef229 docs: 新增整体架构设计文档(doc/，HTML 七章) 
覆盖前端五端/后端/MySQL/弹性节点拓扑/Web安全/安全总纲，遵循 design/ 设计系统视觉呈现。

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
 2026-06-11 23:57:49 +08:00
wangjia 4bff8593e7 docs: 新增 CLAUDE.md(部署架构与主机约束指引) 
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-05-30 23:30:08 +08:00
wangjia 73e026a4df edge 容器自带证书续期(certbot in nginx 镜像)
deploy-pangolin / deploy (push) Has been cancelled
Details 
- edge 改为自定义镜像:官方 nginx + certbot + dns-cloudflare 插件
- pangolin-entrypoint.sh:后台每12h certbot renew,续期后本容器内 nginx -s reload
- 不再需要宿主 cron / docker socket / 独立 certbot 服务做日常续期
- /etc/letsencrypt 改 rw 挂载,挂入 cloudflare.ini
- compose 去掉 build:(宿主 docker-compose 不支持 compose build),改脚本 docker build
- deploy.sh/cutover.sh: docker build -t pangolin-edge:local 后再 up

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-05-30 23:10:17 +08:00
wangjia 39e7f2fc11 回滚:rollback.sh + docs/回滚手册.md
deploy-pangolin / deploy (push) Has been cancelled
Details 
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-05-30 17:09:00 +08:00
wangjia 1bb3a26f0c cutover: 失败自动回滚到宿主 nginx
deploy-pangolin / deploy (push) Has been cancelled
Details 
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-05-30 16:52:05 +08:00
wangjia fa3954724c print-clients: 修正提示路径为 ~/pangolin
deploy-pangolin / deploy (push) Has been cancelled
Details 
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-05-30 16:45:15 +08:00
wangjia 1a346c32c1 方案C:分发层容器化(edge nginx)+ Hy2 + DNS-01 续期
deploy-pangolin / deploy (push) Has been cancelled
Details 
- edge: 容器化 nginx 接管 80/443,逐字移植现网 vhost(blog/jiu/marzban/pay)+ stream SNI 分流
- singbox: Hysteria2(host 网络,UDP 443)
- certbot: DNS-01(Cloudflare)续期,容器化
- xray: REALITY 仅 profile newnode(本台沿用 Marzban)
- deploy.sh 幂等且切换感知;cutover.sh 一次性停宿主 nginx 切容器(可秒级回滚)
- 弃用方案A 的 host nginx-apply/sudoers/root-setup
- 部署目录改 ~/pangolin(免 root);CI 注入 CF_API_TOKEN

EC2 实测:edge nginx -t 通过(真实证书)、compose 校验通过

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-05-30 16:42:30 +08:00
wangjia bc77e85b7d root-setup: 同时创建并授权 /opt/pangolin 部署目录
deploy-pangolin / deploy (push) Has been cancelled
Details 
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-05-30 11:52:32 +08:00
wangjia cf96989e01 Phase 0: 容器化数据面 + CI/CD 自动部署
deploy-pangolin / deploy (push) Has been cancelled
Details 
- deploy/: Xray VLESS+REALITY (11443, 经宿主 nginx SNI 分流) + sing-box Hysteria2 (UDP 443) docker-compose
- 幂等 deploy.sh / gen-secrets.sh / print-clients.sh;受限 nginx-apply 特权脚本 + 一次性 root-setup
- .gitea/workflows/deploy.yml: NAS runner 经 SSH 远程部署到 EC2
- docs/ plan/: 设计方案与实施计划

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-05-30 11:48:47 +08:00
wangjia 833b8365da Initial commit 2026-05-29 23:53:38 +00:00