x

2026-05-26 09:14:59 -07:00
parent 72f2b94263
commit 81c3059892
21 changed files with 1780 additions and 77 deletions
@@ -22,7 +22,7 @@ env:
  SSH_KEY: ${{ secrets.AWS }}
  # TG通知
  TG_BOT_TOKEN: 8114337882:AAHkEx03HSu7RxN4IHBJJEnsK9aPPzNLIk0
-  TG_CHAT_ID: "-4940243803"
+  TG_CHAT_ID: "-494024380311"
  # Go构建变量
  SERVICE: vpn
  SERVICE_STYLE: vpn
@@ -1,76 +0,0 @@
 upstream api_backend {
    server 127.0.0.1:8080;
 }
 server {
    listen 80;
    server_name api.hifast.biz  4d3vsw888xgaen.hifast.biz;
    location /.well-known/acme-challenge/ {
        root /var/www/html;
        allow all;
    }
    location / {
        return 301 https://$host$request_uri;
    }
 }
 server {
    listen 443 ssl http2;
    server_name api.hifast.biz;
    client_max_body_size 150M;
    ssl_certificate /etc/nginx/ssl/hifast.biz/_.hifast.biz.pem; # managed by Certbot
    ssl_certificate_key /etc/nginx/ssl/hifast.biz/_.hifast.biz.key; # managed by Certbot
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    add_header X-Frame-Options "DENY";
    add_header X-Content-Type-Options nosniff;
    if ($http_user_agent ~* '(9999|91\.78)') {
        return 444;
    }
    location ~ ^/v1/common/client/download/file/(?<download_name>Hi快VPN-(?<os>windows|mac|android)-1.0.0-ic-.*\.(?<ext>exe|dmg|apk))$ {
    alias /var/www/download/Hi快VPN-$os-1.0.0.$ext;
    charset utf-8;
    add_header Content-Disposition 'attachment; filename="$download_name"';
    add_header Content-Type application/octet-stream;
    }
    location /v1/common/client/download/file/ {
        alias /var/www/download/;
    }
    location / {
        proxy_pass http://api_backend;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }
 }
 server {
    listen 443 ssl http2;
    server_name 4d3vsw888xgaen.hifast.biz;
    client_max_body_size 150M;
    ssl_certificate /etc/nginx/ssl/hifast.biz/_.hifast.biz.pem; # managed by Certbot
    ssl_certificate_key /etc/nginx/ssl/hifast.biz/_.hifast.biz.key; # managed by Certbot
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    add_header X-Frame-Options DENY;
    add_header X-Content-Type-Options nosniff;
    gzip on;
    gzip_vary on;
    gzip_min_length 1024;
    gzip_types text/plain text/css text/xml text/javascript application/javascript application/xml+rss application/json image/svg+xml;
    root /var/www/admin;
    location / {
        try_files $uri $uri/ /index.html;
    }
 }
@@ -0,0 +1,358 @@
 # PPanel 日本东京区 AWS 部署说明
 本目录用于在 **AWS 日本东京区 `ap-northeast-1`** 重建一套全新生产环境，并承接当前香港区 `ap-east-1` 的正式迁移。
 如果你要看“当前已经真实跑起来的东京架构”，优先看：
 - [`ops/hifast-current-architecture-zh.md`](/Users/Apple/code_vpn/vpn/ppanel-server/ops/hifast-current-architecture-zh.md)
 - [`configs/resource-inventory.current.md`](./configs/resource-inventory.current.md)
 这份 README 更偏向：
 - 目标架构
 - 资源规划
 - 部署方法
 - 后续待完成项
 目标架构：
 `DNS -> ALB -> WAF -> EC2(Nginx + ppanel-server + Redis + observability) -> RDS MySQL`
 灾备链路：
 `RDS MySQL / EC2 Redis -> 104.238.220.230 外部灾备`
 当前仓库内已补充：
 - 东京基础设施参数模板：[`configs/aws-jp-infra.env.example`](./configs/aws-jp-infra.env.example)
 - 东京真实实施状态登记：[`configs/resource-inventory.current.md`](./configs/resource-inventory.current.md)
 - 东京底座资源创建脚本：[`../../scripts/aws_jp_create_base_infra.sh`](../../scripts/aws_jp_create_base_infra.sh)
 - 东京资源状态检查脚本：[`../../scripts/aws_jp_describe_state.sh`](../../scripts/aws_jp_describe_state.sh)
 - MySQL 备份脚本：[`../../scripts/mysql_backup_to_s3.sh`](../../scripts/mysql_backup_to_s3.sh)
 - 10 分钟 MySQL 备份定时器安装脚本：[`../../scripts/install_mysql_backup_timer.sh`](../../scripts/install_mysql_backup_timer.sh)
 ## 1. 资源清单
 按下面顺序创建资源：
 1. VPC
 2. 2 个公有子网 + 2 个私有子网
 3. Internet Gateway
 4. 公有 / 私有路由表
 5. 安全组
 6. RDS MySQL
 7. EC2 本机 Redis Docker
 8. EC2
 9. ACM 证书
 10. ALB + Target Group
 11. WAF Web ACL
 12. 东京平行环境域名
 13. 东京 S3 备份桶
 建议命名：
 - VPC: `ppanel-jp-prod`
 - EC2: `ppanel-app-jp-01`
 - RDS: `ppanel-mysql-jp`
 - Redis container: `hifast-redis`
 - ALB: `ppanel-alb-jp`
 - WAF: `ppanel-waf-jp`
 - S3: `hifast-prod-backups-200810848252-ap-northeast-1`
 ## 2. 默认规格
 ### EC2
 - Region: `ap-northeast-1`
 - OS: Ubuntu 24.04 LTS
 - Instance type: `t4g.large`
 - Disk: `gp3 80GB`
 - Public subnet: 是
 - IAM Role:
  - 允许读取 CloudWatch / SSM（如使用）
  - 如果要在东京 EC2 上执行 S3 备份：额外允许写入东京备份桶
 ### RDS MySQL
 - Engine: `MySQL 8.4`
 - Class: `db.r7g.xlarge`
 - Storage: `gp3 100GB`
 - DB name: `hifast`
 - Username: `admin`
 - Public access: `Yes`
 - Charset: `utf8mb4`
 - Backup retention: `7-14 days`
 - Deletion protection: `On`
 - Multi-AZ: `Yes`（当前按 2 实例 Multi-AZ 创建）
 说明：
 - 当前东京 RDS 需要允许 `104.238.220.230` 从公网直连 `3306`，用于外部 MySQL 从库复制
 - 因此本阶段 RDS 使用 `public subnet group + Publicly accessible = Yes`
 - 访问面只通过 `sg-rds` 严格限制到业务 EC2 安全组和 `104.238.220.230/32`
 ### Redis
 - 部署位置：业务 EC2 本机
 - 部署方式：Docker
 - 版本：`redis:8.2.1`
 - 监听：`0.0.0.0:6379`
 - 应用连接：`127.0.0.1:6379`
 - 安全组：仅对白名单备用节点 `104.238.220.230/32` 或同机应用开放
 ## 3. 网络与安全组
 ### 子网布局
 - `public-a`, `public-c`: ALB / EC2
 - `private-a`, `private-c`: RDS
 说明：
 - 东京优先使用 `ap-northeast-1a` 和 `ap-northeast-1c`
 - 如果账户映射不同，也可以用任意 2 个可用区，但公私网必须各 2 个子网
 ### 安全组建议
 #### `sg-alb`
 - Inbound
  - `80/tcp` from `0.0.0.0/0`
  - `443/tcp` from `0.0.0.0/0`
 - Outbound
  - `80/tcp` to `sg-ec2`
 #### `sg-ec2`
 - Inbound
  - `80/tcp` from `sg-alb`
  - `22/tcp` from `你的固定运维 IP`
  - `6379/tcp` from `104.238.220.230/32`
 - Outbound
  - all
 说明：
 - 应用容器监听 `127.0.0.1:8080`
 - EC2 对外只让 Nginx 监听 `80`
 - Grafana / Prometheus / Tempo 仅监听 `127.0.0.1`
 #### `sg-rds`
 - Inbound
  - `3306/tcp` from `sg-ec2`
  - `3306/tcp` from `104.238.220.230/32`
 ## 4. ALB / Target Group / 健康检查
 ### Target Group
 - Type: `Instance`
 - Protocol: `HTTP`
 - Port: `80`
 - Health check path: `/v1/common/heartbeat`
 - Success code: `200`
 ### ALB 监听器
 - `80` -> redirect to `443`
 - `443` -> forward 到 target group
 ### ACM
 - 在 `ap-northeast-1` 重新申请证书
 - 先给平行环境域名，例如：
  - `api-jp.hifast.biz`
  - `logs-jp.hifast.biz`
 ## 5. WAF 规则
 首版至少启用：
 1. `AWSManagedRulesCommonRuleSet`
 2. `AWSManagedRulesKnownBadInputsRuleSet`
 3. `AWSManagedRulesAmazonIpReputationList`
 4. 全站 rate-based rule
 5. 针对高风险路径的 rate-based rule
 建议的第一版限流：
 - 全站：每 IP `2000 / 5 分钟`
 - `/v1/public/user/subscribe`：每 IP `300 / 5 分钟`
 - 登录 / 注册 / 验证码接口：每 IP `100 / 5 分钟`
 节点上报接口建议后续补：
 - `/v1/server/status`
 - `/v1/server/online`
 - `/v1/server/traffic`
 ## 6. EC2 文件落地
 在 EC2 上建议使用：
 - 应用目录：`/opt/ppanel`
 - Nginx 配置：`/etc/nginx/sites-available/ppanel-api.conf`
 需要上传这些文件 / 目录：
 - `docker-compose.cloud.yml`
 - `deploy/aws/ap-northeast-1/configs/ppanel.yaml.example` -> 重命名为 `configs/ppanel.yaml`
 - `deploy/aws/ap-northeast-1/nginx/ppanel-api.conf`
 - `grafana/`
 - `loki/`
 - `prometheus/`
 - `tempo/`
 - `.env.example` -> 重命名为 `.env`
 目标目录示例：
 ```text
 /opt/ppanel/
  docker-compose.cloud.yml
  .env
  configs/ppanel.yaml
  grafana/
  loki/
  prometheus/
  tempo/
  logs/
  cache/
  tempo_data/
 ```
 ## 7. 应用配置
 基线模板见：
 - [`configs/ppanel.yaml.example`](./configs/ppanel.yaml.example)
 - [`nginx/ppanel-api.conf`](./nginx/ppanel-api.conf)
 关键值必须替换：
 - `MySQL.Addr`
 - `MySQL.Password`
 - `Redis.Host`
 - `Redis.Pass`
 - `JwtAuth.AccessSecret`
 - `Administrator.Email`
 - `Administrator.Password`
 - `AppSignature.AppSecrets.*`
 - `device.security_secret`
 - `Site.Host`
 - `Site.SiteName`
 Redis 约定保持不变：
 - 业务缓存：DB `0`
 - Asynq：DB `5`
 ## 8. 部署步骤
 ### 8.0 创建东京基础设施
 如果本机或跳板机已经配置好 AWS CLI 凭据，可以先直接执行：
 ```bash
 cp deploy/aws/ap-northeast-1/configs/aws-jp-infra.env.example /root/aws-jp-infra.env
 chmod 600 /root/aws-jp-infra.env
 vim /root/aws-jp-infra.env
 chmod +x deploy/scripts/aws_jp_create_base_infra.sh
 bash deploy/scripts/aws_jp_create_base_infra.sh /root/aws-jp-infra.env
 ```
 执行后可用下面命令随时核对东京底座状态：
 ```bash
 chmod +x deploy/scripts/aws_jp_describe_state.sh
 bash deploy/scripts/aws_jp_describe_state.sh /root/aws-jp-infra.env
 ```
 ### 8.1 初始化 EC2
 把脚本上传到东京 EC2 后执行：
 ```bash
 chmod +x deploy/scripts/bootstrap_aws_ec2.sh
 sudo APP_DIR=/opt/ppanel APP_USER=ubuntu deploy/scripts/bootstrap_aws_ec2.sh
 ```
 ### 8.2 安装 Nginx 配置
 ```bash
 sudo cp deploy/aws/ap-northeast-1/nginx/ppanel-api.conf /etc/nginx/sites-available/ppanel-api.conf
 sudo ln -sf /etc/nginx/sites-available/ppanel-api.conf /etc/nginx/sites-enabled/ppanel-api.conf
 sudo nginx -t
 sudo systemctl reload nginx
 ```
 ### 8.3 启动容器
 ```bash
 cd /opt/ppanel
 docker compose -f docker-compose.cloud.yml up -d
 ```
 ### 8.4 预检
 ```bash
 chmod +x deploy/scripts/preflight_aws_jp.sh
 APP_DIR=/opt/ppanel \
 RDS_HOST=<TOKYO_RDS_ENDPOINT> \
 REDIS_HOST=127.0.0.1 \
 deploy/scripts/preflight_aws_jp.sh
 ```
 ## 9. 数据迁移与切换
 正式迁移请按：
 - [`ops/hifast-aws-jp-migration-runbook-zh.md`](/Users/Apple/code_vpn/vpn/ppanel-server/ops/hifast-aws-jp-migration-runbook-zh.md)
 执行。
 核心原则：
 - 先搭平行环境
 - 停机后再导出香港主数据
 - 东京验收通过后再切正式域名
 - 切换后再重挂 `104` 灾备
 ## 10. 104 灾备节点常用模板
 如果迁移完成后要把 `104.238.220.230` 重挂为东京主站从库，可复用：
 - [`deploy/scripts/hifast_mysql_seed_primary_and_replica.sh`](/Users/Apple/code_vpn/vpn/ppanel-server/deploy/scripts/hifast_mysql_seed_primary_and_replica.sh)
 - [`deploy/scripts/hifast_mysql_attach_replica.sh`](/Users/Apple/code_vpn/vpn/ppanel-server/deploy/scripts/hifast_mysql_attach_replica.sh)
 - [`deploy/scripts/hifast_redis_attach_replica.sh`](/Users/Apple/code_vpn/vpn/ppanel-server/deploy/scripts/hifast_redis_attach_replica.sh)
 - [`deploy/scripts/hifast_data_sync_tool.sh`](/Users/Apple/code_vpn/vpn/ppanel-server/deploy/scripts/hifast_data_sync_tool.sh)
 - [`configs/replica-ops.env.example`](./configs/replica-ops.env.example)
 ## 11. 东京资源创建前置检查
 在 AWS 控制台里至少先确认：
 - 东京区已启用
 - `ap-northeast-1` 可创建 `t4g.large`
 - `ap-northeast-1` RDS 可创建 `db.r7g.xlarge`
 - ACM / ALB / WAF / S3 服务在东京区可正常使用
 - Tokyo 对应配额满足：
  - On-Demand Standard vCPU
  - ALB 数量
  - Elastic IP（如需）
  - RDS 实例数
 ## 12. 当前已知真实进度
 截至 `2026-05-20`，已知状态如下：
 - 东京 VPC `ppanel-jp-prod` 已创建
 - VPC ID: `vpc-0846b23b4a7d64eac`
 - VPC CIDR: `10.20.0.0/16`
 - 4 个子网在 AWS 控制台里曾填写完成，但提交时控制台 session 失效
 - 因此：
  - 子网是否真正创建成功，需要重新核实
  - IGW / 路由表 / 安全组 / RDS / EC2 / ALB / WAF 都应按“未完成”处理，重新复核
 实时状态请以后续更新的 [`configs/resource-inventory.current.md`](./configs/resource-inventory.current.md) 为准。
@@ -0,0 +1,55 @@
 AWS_REGION=ap-northeast-1
 AWS_ACCOUNT_ID=200810848252
 VPC_NAME=ppanel-jp-prod
 VPC_ID=
 VPC_CIDR=10.20.0.0/16
 PUBLIC_SUBNET_A_NAME=ppanel-jp-public-a
 PUBLIC_SUBNET_A_AZ=ap-northeast-1a
 PUBLIC_SUBNET_A_CIDR=10.20.0.0/24
 PUBLIC_SUBNET_C_NAME=ppanel-jp-public-c
 PUBLIC_SUBNET_C_AZ=ap-northeast-1c
 PUBLIC_SUBNET_C_CIDR=10.20.1.0/24
 PRIVATE_SUBNET_A_NAME=ppanel-jp-private-a
 PRIVATE_SUBNET_A_AZ=ap-northeast-1a
 PRIVATE_SUBNET_A_CIDR=10.20.10.0/24
 PRIVATE_SUBNET_C_NAME=ppanel-jp-private-c
 PRIVATE_SUBNET_C_AZ=ap-northeast-1c
 PRIVATE_SUBNET_C_CIDR=10.20.11.0/24
 IGW_NAME=ppanel-jp-igw
 PUBLIC_ROUTE_TABLE_NAME=ppanel-jp-public-rt
 PRIVATE_ROUTE_TABLE_NAME=ppanel-jp-private-rt
 SG_ALB_NAME=ppanel-jp-sg-alb
 SG_EC2_NAME=ppanel-jp-sg-ec2
 SG_RDS_NAME=ppanel-jp-sg-rds
 OPS_SSH_CIDR=CHANGE_ME_TO_YOUR_FIXED_PUBLIC_IP_OR_CIDR
 DR_REPLICA_IP=104.238.220.230/32
 EC2_NAME=ppanel-app-jp-01
 EC2_AMI_FAMILY=ubuntu-24.04
 EC2_INSTANCE_TYPE=t4g.large
 EC2_DISK_GB=80
 EC2_KEY_PAIR=CHANGE_ME
 RDS_IDENTIFIER=ppanel-mysql-jp
 RDS_DB_NAME=hifast
 RDS_ADMIN_USER=admin
 RDS_INSTANCE_CLASS=db.r7g.xlarge
 RDS_STORAGE_GB=100
 ALB_NAME=ppanel-alb-jp
 TARGET_GROUP_NAME=ppanel-tg-jp
 WAF_NAME=ppanel-waf-jp
 PARALLEL_API_DOMAIN=api-jp.hifast.biz
 PARALLEL_LOGS_DOMAIN=logs-jp.hifast.biz
 PRODUCTION_API_DOMAIN=CHANGE_ME
 S3_BACKUP_BUCKET=hifast-prod-backups-200810848252-ap-northeast-1
@@ -0,0 +1,19 @@
 AWS_REGION=ap-northeast-1
 S3_BUCKET=hifast-prod-backups-200810848252-ap-northeast-1
 S3_PREFIX=mysql
 BACKUP_DIR=/var/backups/hifast
 HOST_TAG=104-standby-for-jp
 KEEP_LOCAL_DAYS=3
 CHECK_REPLICA=1
 MYSQL_HOST=127.0.0.1
 MYSQL_PORT=3306
 MYSQL_USER=backup_reader
 MYSQL_PASSWORD=CHANGE_ME
 MYSQL_SOCKET=
 MYSQL_DATABASE=hifast
 REDIS_HOST=127.0.0.1
 REDIS_PORT=6379
 REDIS_PASSWORD=CHANGE_ME
@@ -0,0 +1,21 @@
 PRIMARY_HOST=ppanel-mysql-jp.<CHANGE_ME>.ap-northeast-1.rds.amazonaws.com
 PRIMARY_PORT=3306
 PRIMARY_USER=admin
 PRIMARY_PASSWORD=CHANGE_ME
 PRIMARY_DB=hifast
 PRIMARY_REPL_USER=repl
 PRIMARY_REPL_PASSWORD=CHANGE_ME
 PRIMARY_REPL_HOST=104.238.220.230
 PRIMARY_BINLOG_RETENTION_HOURS=24
 REPLICA_HOST=127.0.0.1
 REPLICA_PORT=3306
 REPLICA_USER=root
 REPLICA_PASSWORD=
 REPLICA_SOCKET=/var/run/mysqld/mysqld.sock
 REPLICA_DB=hifast
 REPLICA_SOURCE_SSL=1
 DUMP_FILE=
@@ -0,0 +1,112 @@
 Host: 0.0.0.0
 Port: 8080
 Debug: false
 JwtAuth:
  AccessSecret: CHANGE_ME_TO_A_LONG_RANDOM_SECRET
  AccessExpire: 604800
 Logger:
  ServiceName: PPanel
  Mode: console
  Encoding: plain
  TimeFormat: "2006-01-02 15:04:05.000"
  Path: logs
  Level: info
  MaxContentLength: 0
  Compress: false
  Stat: true
  KeepDays: 7
  StackCooldownMillis: 100
  MaxBackups: 7
  MaxSize: 100
  Rotation: daily
  FileTimeFormat: "2006-01-02T15:04:05.000Z07:00"
 MySQL:
  Addr: YOUR_TOKYO_RDS_ENDPOINT:3306
  Dbname: hifast
  Username: admin
  Password: CHANGE_ME_TO_TOKYO_RDS_PASSWORD
  Config: charset=utf8mb4&parseTime=true&loc=Asia%2FTokyo
  MaxIdleConns: 10
  MaxOpenConns: 100
  SlowThreshold: 1000
 Redis:
  Host: 127.0.0.1:6379
  Pass: CHANGE_ME_TO_TOKYO_REDIS_PASSWORD
  DB: 0
  PoolSize: 100
  MinIdleConns: 10
  MaxRetries: 3
  PoolTimeout: 4
  IdleTimeout: 300
  MaxConnAge: 0
  DialTimeout: 5
  ReadTimeout: 3
  WriteTimeout: 3
 Trace:
  Name: ppanel-server
  Endpoint: 127.0.0.1:4317
  Sampler: 0.1
  Batcher: otlpgrpc
 Site:
  Host: api-jp.hifast.biz
  SiteName: HiFastVPN
 Administrator:
  Email: admin@example.com
  Password: CHANGE_ME_TO_STRONG_ADMIN_PASSWORD
 Telegram:
  Enable: false
  BotID: 0
  BotName: ""
  BotToken: ""
  GroupChatID: ""
  EnableNotify: false
  WebHookDomain: ""
 Kutt:
  Enable: false
  ApiURL: ""
  ApiKey: ""
  TargetURL: ""
  Domain: ""
 OpenInstall:
  Enable: false
  AppKey: ""
  ApiKey: ""
 Loki:
  Enable: true
  URL: "http://localhost:3100"
 AppSignature:
  AppSecrets:
    android-client: CHANGE_ME_ANDROID_SIGNATURE_SECRET
    ios-client: CHANGE_ME_IOS_SIGNATURE_SECRET
    web-client: CHANGE_ME_WEB_SIGNATURE_SECRET
  ValidWindowSeconds: 300
  SkipPrefixes:
    - /v1/notify/
    - /v1/iap/notifications
    - /v1/telegram/webhook
    - /v1/subscribe/config
 Signature:
  EnableSignature: false
 device:
  enable: true
  security_secret: CHANGE_ME_DEVICE_SECURITY_SECRET
 Register:
  EnableTrial: true
  EnableTrialEmailWhitelist: true
  TrialEmailDomainWhitelist: "gmail.com,outlook.com,icloud.com,qq.com,163.com"
@@ -0,0 +1,23 @@
 MYSQL_HOST=127.0.0.1
 MYSQL_PORT=3306
 MYSQL_USER=root
 MYSQL_PASSWORD=CHANGE_ME
 MYSQL_SOCKET=
 REPL_SOURCE_HOST=ppanel-mysql-jp.cpo0keikgh80.ap-northeast-1.rds.amazonaws.com
 REPL_SOURCE_PORT=3306
 REPL_SOURCE_USER=repl
 REPL_SOURCE_PASSWORD=XwWrQGVWtxmXJ3etHmkFvnRSD54MKYer
 REPL_SOURCE_SSL=1
 REPL_SOURCE_LOG_FILE=mysql-bin-changelog.000189
 REPL_SOURCE_LOG_POS=185053
 REPL_SOURCE_AUTO_POSITION=1
 REDIS_HOST=127.0.0.1
 REDIS_PORT=6379
 REDIS_PASSWORD=CHANGE_ME
 REDIS_SOURCE_HOST=3.114.29.208
 REDIS_SOURCE_PORT=6379
 REDIS_SOURCE_USER=
 REDIS_SOURCE_PASSWORD=hifast67yj
@@ -0,0 +1,187 @@
 # Tokyo Resource Inventory
 最后更新：`2026-05-21`
 这个文件记录当前东京迁移的真实实施状态，不是示例。
 ## Region
 - AWS account: `hifastvpn (200810848252)`
 - Region: `ap-northeast-1`
 ## Current Status
 - 东京迁移方案已在仓库内落地为执行资产
 - 东京 VPC 已创建
 - 东京子网、IGW、路由表已在 AWS 控制台创建并复核
 - 东京三层安全组已在 AWS 控制台创建并复核
 - 东京 VPC DNS 开关已开启，可支持公网可访问 RDS
 - 东京 S3 备份桶已在 AWS 控制台创建并复核
 - 东京 ACM 证书请求已创建，等待 DNS 验证
 - 东京 RDS MySQL 已创建完成并可用
 - 东京业务 EC2 已创建完成并绑定固定 EIP
 - 因当前本机没有可用 AWS CLI 凭据，云上资源状态仍需在 AWS 控制台或已登录环境中复查
 ## Networking
 - VPC
  - Name: `ppanel-jp-prod`
  - VPC ID: `vpc-0846b23b4a7d64eac`
  - CIDR: `10.20.0.0/16`
  - Status: `created`
 - Public subnet A
  - Name: `ppanel-jp-public-a`
  - AZ: `ap-northeast-1a`
  - CIDR: `10.20.0.0/24`
  - Subnet ID: `subnet-091232bdb53e71490`
  - Status: `created`
 - Public subnet C
  - Name: `ppanel-jp-public-c`
  - AZ: `ap-northeast-1c`
  - CIDR: `10.20.1.0/24`
  - Subnet ID: `subnet-01ba0975c525ce8cf`
  - Status: `created`
 - Private subnet A
  - Name: `ppanel-jp-private-a`
  - AZ: `ap-northeast-1a`
  - CIDR: `10.20.10.0/24`
  - Subnet ID: `subnet-0bd13111c02f0edbe`
  - Status: `created`
 - Private subnet C
  - Name: `ppanel-jp-private-c`
  - AZ: `ap-northeast-1c`
  - CIDR: `10.20.11.0/24`
  - Subnet ID: `subnet-0d86c5c756dbc84b2`
  - Status: `created`
 - Internet Gateway
  - Name: `ppanel-jp-igw`
  - IGW ID: `igw-028041bcbf63b672c`
  - Status: `created`
 - Public route table
  - Name: `ppanel-jp-public-rt`
  - Route Table ID: `rtb-061b101080e4800e5`
  - Default route: `0.0.0.0/0 -> igw-028041bcbf63b672c`
  - Status: `created`
 - Private route table
  - Name: `ppanel-jp-private-rt`
  - Route Table ID: `rtb-0d7a191a515031c45`
  - Status: `created`
 ## Security
 - `sg-alb`
  - Name: `ppanel-jp-sg-alb`
  - Security Group ID: `sg-0b3a23c31041a5a5a`
  - Inbound:
    - `80/tcp <- 0.0.0.0/0`
    - `443/tcp <- 0.0.0.0/0`
  - Status: `created`
 - `sg-ec2`
  - Name: `ppanel-jp-sg-ec2`
  - Security Group ID: `sg-01f2a5a81e7505c91`
  - Inbound:
    - `80/tcp <- sg-0b3a23c31041a5a5a`
    - `22/tcp <- 64.118.144.142/32`
    - `6379/tcp <- 104.238.220.230/32`
  - Status: `created`
 - `sg-rds`
  - Name: `ppanel-jp-sg-rds`
  - Security Group ID: `sg-0b71db1e2c18b57c0`
  - Inbound:
    - `3306/tcp <- sg-01f2a5a81e7505c91`
    - `3306/tcp <- 104.238.220.230/32`
  - Status: `created`
 ## Compute / Database / Edge
 - EC2 `ppanel-app-jp-01`:
  - Instance ID: `i-07839130074cd7ed9`
  - Type: `c7i.xlarge`
  - Platform: `Ubuntu 26.04 / Linux`
  - AZ: `ap-northeast-1c`
  - VPC: `ppanel-jp-prod (vpc-0846b23b4a7d64eac)`
  - Subnet: `ppanel-jp-public-c (subnet-01ba0975c525ce8cf)`
  - Private IP: `10.20.1.168`
  - Public IP / Elastic IP: `3.114.29.208`
  - Public DNS: `ec2-3-114-29-208.ap-northeast-1.compute.amazonaws.com`
  - Security group: `ppanel-jp-sg-ec2 (sg-01f2a5a81e7505c91)`
  - Key pair: `ppanel-jp-key-20260521`
  - Root volume: `gp3 100GiB`
  - ENI: `eni-08accb427a470c9f7`
  - EIP allocation ID: `eipalloc-038b32d5c0119accf`
  - EIP association ID: `eipassoc-09184aa9161b6a4d9`
  - Status: `running`
  - SSH recovery private key: `deploy/aws/ap-northeast-1/keys/ppanel-jp-recovery`
  - SSH recovery public key: `deploy/aws/ap-northeast-1/keys/ppanel-jp-recovery.pub`
 - RDS subnet group:
  - Name: `ppanel-jp-rds-subnet-group`
  - VPC: `vpc-0846b23b4a7d64eac`
  - Subnets:
    - `subnet-0bd13111c02f0edbe` / `ppanel-jp-private-a`
    - `subnet-0d86c5c756dbc84b2` / `ppanel-jp-private-c`
  - Status: `created`
 - RDS public subnet group:
  - Name: `ppanel-jp-rds-public-subnet-group`
  - VPC: `vpc-0846b23b4a7d64eac`
  - Subnets:
    - `subnet-091232bdb53e71490` / `ppanel-jp-public-a`
    - `subnet-01ba0975c525ce8cf` / `ppanel-jp-public-c`
  - Status: `created`
 - RDS `ppanel-mysql-jp`:
  - Engine: `MySQL Community 8.4.8`
  - Class: `db.r7g.xlarge`
  - Storage: `gp3 100GiB`
  - Deployment: `Single instance (current actual state)`
  - VPC: `ppanel-jp-prod (vpc-0846b23b4a7d64eac)`
  - Subnet group: `ppanel-jp-rds-public-subnet-group`
  - Security group: `ppanel-jp-sg-rds (sg-0b71db1e2c18b57c0)`
  - Master username: `admin`
  - Credential management: `self-managed`
  - Secrets Manager managed password: `disabled`
  - Current master password visibility: `not retrievable from AWS console; reset only`
  - Public access: `enabled (set at creation time for external replication)`
  - Status: `available`
  - Endpoint: `ppanel-mysql-jp.cpo0keikgh80.ap-northeast-1.rds.amazonaws.com`
  - Public IP (resolved via public DNS): `52.196.204.186`
  - Connection test from Tokyo EC2:
    - `mysql -h ppanel-mysql-jp.cpo0keikgh80.ap-northeast-1.rds.amazonaws.com -u admin -e "select 1"`
    - Result: `ERROR 1045 (28000): Access denied for user 'admin'@'ip-10-20-1-168.ap-northeast-1.compute.internal' (using password: NO)`
    - Meaning: `network path and security group are working; only the password is missing`
  - Current admin password: `TkyRds20260521!N9mQ8sKe2vLp7Xa`
  - External replica prep for `104.238.220.230`:
    - binlog retention hours: `24`
    - replication user: `repl@104.238.220.230`
    - replication password: `XwWrQGVWtxmXJ3etHmkFvnRSD54MKYer`
    - current binlog file: `mysql-bin-changelog.000189`
    - current binlog position: `185053`
 - ALB `ppanel-alb-jp`: `not created`
 - WAF `ppanel-waf-jp`: `not created`
 - ACM certificate in `ap-northeast-1`:
  - Certificate ID: `29d0b9b6-ab37-44d9-ad9e-18fa7e9aae3a`
  - Domains:
    - `api-jp.hifast.biz`
    - `logs-jp.hifast.biz`
  - Status: `pending_validation`
  - Route 53 hosted zone in current AWS account: `not found`
 - S3 backup bucket `hifast-prod-backups-200810848252-ap-northeast-1`: `created`
 ## Domains
 - Parallel API domain: `api-jp.hifast.biz`
 - Parallel logs domain: `logs-jp.hifast.biz`
 - Production API domain: `pending user final confirmation`
 - ACM DNS validation records pending external DNS add:
  - `api-jp.hifast.biz`
    - Name: `_0de5970dfbadaf46759447b2ea627a10.api-jp.hifast.biz.`
    - Type: `CNAME`
    - Value: `_6a632a5b85c5b3f304cc492090b741b3.jkddzztszm.acm-validations.aws.`
  - `logs-jp.hifast.biz`
    - Name: `_349a2b2bc4678d76c3ab341ccf73db61.logs-jp.hifast.biz.`
    - Type: `CNAME`
    - Value: `_74ced20dc96aa39070188605cf0ced18.jkddzztszm.acm-validations.aws.`
 ## DR
 - DR host: `104.238.220.230`
 - Planned MySQL upstream after cutover: `Tokyo RDS`
 - Planned Redis upstream after cutover: `Tokyo EC2 public IP`
@@ -0,0 +1,69 @@
 # Tokyo Resource Inventory Example
 Use this file as the single source of truth while building the Tokyo environment.
 ## Region
 - AWS account: `hifastvpn (200810848252)`
 - Region: `ap-northeast-1`
 ## DNS
 - Production API domain: `CHANGE_ME`
 - Parallel API domain: `api-jp.hifast.biz`
 - Parallel logs domain: `logs-jp.hifast.biz`
 ## Networking
 - VPC name: `ppanel-jp-prod`
 - VPC CIDR: `10.20.0.0/16`
 - Public subnet A: `10.20.0.0/24`
 - Public subnet C: `10.20.1.0/24`
 - Private subnet A: `10.20.10.0/24`
 - Private subnet C: `10.20.11.0/24`
 - Ops CIDR for SSH: `CHANGE_ME`
 ## Compute
 - EC2 name: `ppanel-app-jp-01`
 - EC2 type: `t4g.large`
 - EC2 disk: `gp3 80GB`
 - SSH key pair: `CHANGE_ME`
 ## Database
 - RDS identifier: `ppanel-mysql-jp`
 - RDS engine: `MySQL 8.4`
 - RDS class: `db.r7g.xlarge`
 - RDS storage: `gp3 100GB`
 - DB name: `hifast`
 - DB admin user: `admin`
 ## Cache
 - Redis container: `hifast-redis`
 - Redis port: `6379`
 - Redis password: `CHANGE_ME`
 ## Security / Secrets
 - JWT secret: `CHANGE_ME`
 - Admin email: `CHANGE_ME`
 - Admin password: `CHANGE_ME`
 - Android app signature secret: `CHANGE_ME`
 - iOS app signature secret: `CHANGE_ME`
 - Web app signature secret: `CHANGE_ME`
 - Device security secret: `CHANGE_ME`
 ## Backup
 - S3 backup bucket: `hifast-prod-backups-200810848252-ap-northeast-1`
 - Versioning: `Enabled`
 ## DR
 - DR host: `104.238.220.230`
 - MySQL repl user: `repl`
 - MySQL repl password: `CHANGE_ME`
 - Redis source password: `CHANGE_ME`
@@ -0,0 +1,7 @@
 -----BEGIN OPENSSH PRIVATE KEY-----
 b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
 QyNTUxOQAAACBsJxZDjKvaIdVjer3QMHRYw43wkVnzHurA2TQqHlr1YwAAAKBaQXT3WkF0
 9wAAAAtzc2gtZWQyNTUxOQAAACBsJxZDjKvaIdVjer3QMHRYw43wkVnzHurA2TQqHlr1Yw
 AAAEArWQWWwPoJp+za5JhSnrE0Pw1/TtqWRrdY5e8hULqYDGwnFkOMq9oh1WN6vdAwdFjD
 jfCRWfMe6sDZNCoeWvVjAAAAF0FwcGxlQE1hY0Jvb2stUHJvLmxvY2FsAQIDBAUG
 -----END OPENSSH PRIVATE KEY-----
@@ -0,0 +1 @@
 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGwnFkOMq9oh1WN6vdAwdFjDjfCRWfMe6sDZNCoeWvVj Apple@MacBook-Pro.local
@@ -0,0 +1,34 @@
 server {
    listen 80 default_server;
    listen [::]:80 default_server;
    server_name _;
    client_max_body_size 20m;
    access_log /var/log/nginx/ppanel-access.log;
    error_log /var/log/nginx/ppanel-error.log warn;
    location / {
        proxy_http_version 1.1;
        proxy_pass http://127.0.0.1:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header X-Forwarded-Port $server_port;
        proxy_connect_timeout 10s;
        proxy_send_timeout 60s;
        proxy_read_timeout 60s;
    }
    location = /nginx_status {
        stub_status;
        access_log off;
        allow 127.0.0.1;
        deny all;
    }
 }
@@ -0,0 +1,17 @@
 [Unit]
 Description=Hifast MySQL backup to S3
 Wants=network-online.target
 After=network-online.target
 [Service]
 Type=oneshot
 User=root
 Group=root
 EnvironmentFile=/root/backup-to-s3.env
 ExecStart=/usr/bin/env bash -lc 'exec /opt/ppanel/deploy/scripts/mysql_backup_to_s3.sh'
 Nice=10
 IOSchedulingClass=best-effort
 IOSchedulingPriority=7
 [Install]
 WantedBy=multi-user.target
@@ -0,0 +1,11 @@
 [Unit]
 Description=Run Hifast MySQL backup to S3 every 10 minutes
 [Timer]
 OnCalendar=*:0/10
 Persistent=true
 RandomizedDelaySec=30
 Unit=hifast-mysql-backup.service
 [Install]
 WantedBy=timers.target
@@ -0,0 +1,144 @@
 # 提现接口文档
 ## 基础信息
 | 项目 | 值 |
 |------|-----|
 | Base URL | `/v1/public/user` |
 | 认证方式 | JWT Token（`AuthMiddleware` + `DeviceMiddleware`） |
 | 数据表 | `user_withdrawal` |
 ## 数据模型
 ### user_withdrawal 表
 | 字段 | 类型 | 说明 |
 |------|------|------|
 | `id` | int64 | 主键 |
 | `user_id` | int64 | 用户 ID |
 | `amount` | int64 | 提现金额（单位：分） |
 | `content` | text | 收款信息（账号、姓名等） |
 | `status` | tinyint | 0=待审核, 1=已通过, 2=已拒绝 |
 | `reason` | varchar(500) | 拒绝原因（通过时为空） |
 | `created_at` | datetime | 创建时间 |
 | `updated_at` | datetime | 更新时间 |
 ### status 枚举
 | 值 | 含义 | 说明 |
 |----|------|------|
 | 0 | Pending（待审核） | 用户提交申请后的初始状态 |
 | 1 | Approved（已通过） | 管理员审核通过，佣金已扣减 |
 | 2 | Rejected（已拒绝） | 管理员拒绝，无需退款（申请时未扣款） |
 ---
 ## 用户端接口
 ### 1. 申请提现
 申请佣金提现，创建一条待审核记录。申请时**不扣余额**，管理员审核通过后才扣。
 ```
 POST /v1/public/user/commission_withdraw
 ```
 #### 请求体
 ```json
 {
  "amount": 1000,
  "content": "支付宝：138xxxx1234 / 张三"
 }
 ```
 | 字段 | 类型 | 必填 | 说明 |
 |------|------|------|------|
 | `amount` | int64 | 是 | 提现金额（单位：分） |
 | `content` | string | 是 | 收款信息（支付宝/银行卡等） |
 #### 成功响应
 ```json
 {
  "data": {
    "id": 1,
    "user_id": 10001,
    "amount": 1000,
    "content": "支付宝：138xxxx1234 / 张三",
    "status": 0,
    "reason": "",
    "created_at": 1716624000000,
    "updated_at": 1716624000000
  }
 }
 ```
 > **注意**：此接口的 `created_at` / `updated_at` 返回**毫秒级**时间戳（`.UnixMilli()`），与项目其他接口的秒级时间戳不一致。
 #### 业务逻辑
 1. 查询该用户所有 status=0（待审核）的提现记录，求和得 `pendingTotal`
 2. 校验可用余额：`commission >= amount + pendingTotal`
 3. 创建 `user_withdrawal` 记录，status=0
 4. **不扣减** `user.commission`，等审核通过才扣
 #### 错误码
 | 错误码 | 常量 | 说明 |
 |--------|------|------|
 | 20010 | `UserCommissionNotEnough` | 可用余额不足（余额 = commission - 所有 pending 提现总额） |
 | 40005 | `InvalidAccess` | 未登录 / Token 无效 |
 #### 源码位置
 - Handler: `internal/handler/public/user/commissionWithdrawHandler.go`
 - Logic: `internal/logic/public/user/commissionWithdrawLogic.go`
 ---
 ### 2. 查询提现记录
 分页查询当前用户的提现记录。
 ```
 GET /v1/public/user/withdrawal_log
 ```
 #### 请求参数（Query）
 | 字段 | 类型 | 必填 | 说明 |
 |------|------|------|------|
 | `page` | int | 否 | 页码 |
 | `size` | int | 否 | 每页数量 |
 #### 成功响应
 ```json
 {
  "data": {
    "list": [
      {
        "id": 1,
        "user_id": 10001,
        "amount": 1000,
        "content": "支付宝：138xxxx1234",
        "status": 0,
        "reason": "",
        "created_at": 1716624000,
        "updated_at": 1716624000
      }
    ],
    "total": 1
  }
 }
 ```
 #### 源码位置
 - Handler: `internal/handler/public/user/queryWithdrawalLogHandler.go`
 - Logic: `internal/logic/public/user/queryWithdrawalLogLogic.go`
 > **Warning**: Logic 层尚未实现（仍为 TODO），调用会返回空响应。
 ---
@@ -0,0 +1,116 @@
 # Hifast 东京切换执行清单
 本文档用于正式执行香港 `ap-east-1` -> 东京 `ap-northeast-1` 迁移时，逐项勾选和留痕。
 ## 0. 当前已知东京状态
 - 东京 VPC `ppanel-jp-prod` 已创建
 - 东京 VPC ID：`vpc-0846b23b4a7d64eac`
 - 4 个东京子网曾在 AWS 控制台录入，但提交时登录态失效
 - 所以当前要按“子网未确认成功”处理
 - 后续所有东京资源创建前，先执行一次：
  - `bash deploy/scripts/aws_jp_describe_state.sh /root/aws-jp-infra.env`
 - 真实状态登记文件：
  - `deploy/aws/ap-northeast-1/configs/resource-inventory.current.md`
 ## 1. 真实值清单
 在开始创建东京正式资源前，必须补齐这些真实值：
 - 正式 API 域名：
 - 东京平行 API 域名：
 - 东京平行日志域名：
 - 运维固定公网 IP / CIDR：
 - 东京 EC2 SSH Key Pair 名称：
 - 东京 RDS 管理员密码：`TkyRds20260521!N9mQ8sKe2vLp7Xa`
 - 东京 RDS 凭证管理方式：`self-managed`
 - 东京 RDS 当前密码是否可回看：`否，只能重置`
 - 东京 Redis 密码：`hifast67yj`
 - `JwtAuth.AccessSecret`：
 - `Administrator.Email`：`admin@ppanel.dev`
 - `Administrator.Password`：`PpanelAdmin!20260521Temp`
 - `AppSignature.AppSecrets.android-client`：`uB4G,XxL2{7b`
 - `AppSignature.AppSecrets.ios-client`：`uB4G,XxL2{7b`
 - `AppSignature.AppSecrets.web-client`：`uB4G,XxL2{7b`
 - `device.security_secret`：`uB4G,XxL2{7b`
 - 东京备份桶最终名称：
 - `104.238.220.230` MySQL 复制密码：`XwWrQGVWtxmXJ3etHmkFvnRSD54MKYer`
 - `104.238.220.230` Redis 主从认证密码：`hifast67yj`
 ## 2. 东京资源创建勾选
 - 已切换 AWS 控制台到 `ap-northeast-1`
 - 已确认东京区可用
 - 已确认 EC2 配额满足 `t4g.large`
 - 已确认 RDS 配额满足 `db.r7g.xlarge`
 - 已确认 ALB / ACM / WAF / S3 可正常创建
 - 已创建 VPC
 - 已创建 2 个公有子网
 - 已创建 2 个私有子网
 - 已创建 IGW
 - 已配置公私网路由表
 - 已创建 `sg-alb`
 - 已创建 `sg-ec2`
 - 已创建 `sg-rds`
 - 已创建东京 RDS
 - 已创建东京 EC2
 - 已在 EC2 启动 Docker / Nginx
 - 已创建东京 ACM 证书
 - 已创建 Target Group
 - 已创建 ALB
 - 已创建 WAF 并挂到 ALB
 - 已创建东京 S3 备份桶并开启 versioning
 ## 3. 东京应用部署勾选
 - 已上传 `docker-compose.cloud.yml`
 - 已上传 `configs/ppanel.yaml`
 - 已上传 `.env`
 - 已上传 `grafana/`
 - 已上传 `loki/`
 - 已上传 `prometheus/`
 - 已上传 `tempo/`
 - 已安装东京 Nginx 配置
 - 已启动 `ppanel-server`
 - 已启动 `hifast-redis`
 - 已启动 observability 容器
 - `curl http://127.0.0.1:8080/v1/common/heartbeat` 正常
 - `curl http://127.0.0.1/v1/common/heartbeat` 正常
 - ALB 健康检查正常
 ## 4. 停机迁移勾选
 - 已降低正式域名 TTL
 - 已停止香港 `ppanel-server`
 - 已确认香港不再有新写入
 - 已导出香港 MySQL `hifast-full.sql.gz`
 - 已导出香港 Redis `dump.rdb`
 - 已导入东京 RDS
 - 已导入东京 Redis
 - 东京应用已改为连接东京 MySQL / Redis
 - 平行域名验收通过
 ## 5. 104 灾备重挂勾选
 - 东京 RDS 已设置 `binlog retention hours`
 - 东京 RDS 已创建 `repl@104.238.220.230`
 - 已用东京 dump 重建 `104` 的 `hifast`
 - `104` MySQL 已成功挂东京主库
 - `104` MySQL `Replica_IO_Running: Yes`
 - `104` MySQL `Replica_SQL_Running: Yes`
 - `104` MySQL `Seconds_Behind_Source: 0`
 - `104` Redis 已成功挂东京主库
 - 东京 Redis `connected_slaves:1`
 - `104` Redis `role:slave`
 - `104` Redis `master_link_status:up`
 ## 6. 正式切换与回滚勾选
 - 已切正式域名到东京 ALB
 - 外网请求正常
 - 核心业务接口无 `5xx`
 - 应用日志无 MySQL / Redis 连接错误
 - WAF 无误伤
 - 已验证 DNS 可回切
 - 香港环境已保留为只读回滚基线
 - 香港环境计划保留 `7` 天观察期
@@ -0,0 +1,286 @@
 # Hifast AWS 香港到日本东京迁移 Runbook
 本文档用于把当前香港区 `ap-east-1` 主生产，迁移到日本东京 `ap-northeast-1`。
 适用目标：
 - 东京成为新主站
 - 架构升级为 `ALB + WAF + EC2 + RDS`
 - `104.238.220.230` 继续作为东京主站的 MySQL / Redis 外部灾备
 ## 0. 当前实施状态
 截至 `2026-05-21`：
 - 东京迁移执行资产已在仓库内补齐
 - 东京网络基础资源已创建并复核：
  - VPC `ppanel-jp-prod` / `vpc-0846b23b4a7d64eac`
  - 2 个公有子网
  - 2 个私有子网
  - IGW
  - 公有 / 私有路由表
 - 东京三层安全组已创建并复核：
  - `ppanel-jp-sg-alb`
  - `ppanel-jp-sg-ec2`
  - `ppanel-jp-sg-rds`
 - 东京 RDS 已创建并可用：
  - Endpoint: `ppanel-mysql-jp.cpo0keikgh80.ap-northeast-1.rds.amazonaws.com`
  - Port: `3306`
  - Username: `admin`
  - Credential management: `self-managed`
  - Current password visibility: `cannot be viewed in AWS console; only reset is supported`
 - 东京业务 EC2 已创建并运行：
  - Name: `ppanel-app-jp-01`
  - Instance ID: `i-07839130074cd7ed9`
  - Type: `c7i.xlarge`
  - Private IP: `10.20.1.168`
  - Elastic IP: `3.114.29.208`
 - 东京 S3 备份桶已创建
 - 东京 ACM 证书已请求，仍等待 DNS 验证
 - 当前尚未完成的核心资源：
  - ALB
  - WAF
  - ACM DNS 验证
  - 东京应用目录部署与数据导入
 建议先执行：
 ```bash
 cp deploy/aws/ap-northeast-1/configs/aws-jp-infra.env.example /root/aws-jp-infra.env
 vim /root/aws-jp-infra.env
 bash deploy/scripts/aws_jp_create_base_infra.sh /root/aws-jp-infra.env
 bash deploy/scripts/aws_jp_describe_state.sh /root/aws-jp-infra.env
 ```
 然后把结果回填到：
 - `deploy/aws/ap-northeast-1/configs/resource-inventory.current.md`
 - `ops/hifast-aws-jp-cutover-checklist-zh.md`
 ## 1. 当前基线
 迁移前默认当前现网状态为：
 - 香港应用 EC2：`hifast-hk-app-01`
 - 香港 RDS：`hifast-mysql-prod-v2.cd6aey40m6ag.ap-east-1.rds.amazonaws.com`
 - 香港 Redis 主库：`18.163.33.75:6379`
 - 外部灾备：`104.238.220.230`
 - 当前应用部署目录：`/opt/ppanel`
 - 当前应用配置文件：`/opt/ppanel/configs/ppanel.yaml`
 - 当前业务容器：`ppanel-server`
 ## 2. 迁移前准备
 正式迁移前必须完成：
 1. 东京基础设施已创建
 2. 东京 EC2 已部署应用目录，但暂未导入正式数据
 3. 东京 RDS 可连通
   - 已验证从东京 EC2 到 `ppanel-mysql-jp.cpo0keikgh80.ap-northeast-1.rds.amazonaws.com:3306` 网络畅通
   - 当前若无密码只能得到 `ERROR 1045 ... using password: NO`，这表示链路正常，不表示实例异常
 4. 东京 Redis 已启动并可认证
 5. 平行域名已准备：
   - `api-jp.hifast.biz`
   - `logs-jp.hifast.biz`
 6. 东京 ALB 健康检查已通过
 7. 东京 ACM 证书已签发
 8. 东京 WAF 已挂到 ALB
 9. 已准备正式回滚入口
 10. 已把正式域名 TTL 降低
 ## 3. 香港停机冻结
 在香港主环境执行：
 1. 停止业务写入
 2. 停 `ppanel-server`
 3. 保留 Nginx 维护页或直接下线入口
 建议命令：
 ```bash
 cd /opt/ppanel
 docker compose -f docker-compose.cloud.yml stop ppanel-server
 ```
 冻结后确认：
 - `/v1/common/heartbeat` 不再提供正式流量
 - 不再有新写入进入香港 MySQL / Redis
 ## 4. 导出香港数据
 ### 4.1 MySQL
 从香港主库导出：
 ```bash
 mysqldump \
  -h hifast-mysql-prod-v2.cd6aey40m6ag.ap-east-1.rds.amazonaws.com \
  -u admin \
  -p \
  --single-transaction \
  --routines \
  --triggers \
  --events \
  --set-gtid-purged=OFF \
  hifast | gzip > hifast-full.sql.gz
 ```
 ### 4.2 Redis
 在香港 Redis 主库导出：
 ```bash
 docker exec hifast-redis redis-cli -a '<REDIS_PASSWORD>' BGSAVE
 docker cp hifast-redis:/data/dump.rdb ./dump.rdb
 ```
 ## 5. 导入东京
 ### 5.1 MySQL 导入东京 RDS
 ```bash
 gunzip -c hifast-full.sql.gz | mysql -h <TOKYO_RDS_ENDPOINT> -u admin -p hifast
 ```
 导入后确认：
 ```bash
 mysql -h <TOKYO_RDS_ENDPOINT> -u admin -p -e "USE hifast; SHOW TABLES;"
 ```
 ### 5.2 Redis 导入东京
 1. 停止东京 Redis 容器
 2. 替换 `/data/dump.rdb`
 3. 启动东京 Redis 容器
 导入后确认：
 ```bash
 docker exec hifast-redis redis-cli -a '<TOKYO_REDIS_PASSWORD>' PING
 ```
 ## 6. 启动东京应用
 更新东京：
 - `/opt/ppanel/configs/ppanel.yaml`
 - `/opt/ppanel/.env`
 关键值：
 - `MySQL.Addr=<TOKYO_RDS_ENDPOINT>:3306`
 - `MySQL.Username=admin`
 - `MySQL.Password=<TOKYO_RDS_PASSWORD>`
 - `Redis.Host=127.0.0.1:6379`
 - `Redis.Pass=<TOKYO_REDIS_PASSWORD>`
 - `Site.Host=api-jp.hifast.biz`
 - `.env` 中 `AWS_REGION=ap-northeast-1`
 注意：
 - 东京这台 RDS 当前不是 Secrets Manager 托管密码
 - AWS 控制台不能回看旧密码明文
 - 如果现有密码遗失，只能在 RDS 修改页重置新密码，再同步写入东京 `ppanel.yaml`
 当前东京已实际生效：
 - `MySQL.Addr=ppanel-mysql-jp.cpo0keikgh80.ap-northeast-1.rds.amazonaws.com:3306`
 - `MySQL.Username=admin`
 - `MySQL.Password=TkyRds20260521!N9mQ8sKe2vLp7Xa`
 - `Redis.Host=127.0.0.1:6379`
 - `Redis.Pass=hifast67yj`
 启动：
 ```bash
 cd /opt/ppanel
 docker compose -f docker-compose.cloud.yml up -d
 ```
 ## 7. 东京平行环境验收
 至少执行：
 ```bash
 curl -sf http://127.0.0.1:8080/v1/common/heartbeat
 curl -sf http://127.0.0.1/v1/common/heartbeat
 docker compose -f /opt/ppanel/docker-compose.cloud.yml ps
 docker compose -f /opt/ppanel/docker-compose.cloud.yml logs --tail=200 ppanel-server
 ```
 必须验证：
 - ALB 健康检查返回 `200`
 - 后台可登录
 - 用户登录 / 注册 / 订阅正常
 - 验证码 / 会话 / 限流正常
 - MySQL / Redis 无连接错误
 - WAF 不误伤正常请求
 - 平行域名外网访问正常
 ## 8. 正式域名切换
 仅在东京平行环境验收全部通过后执行：
 1. 将正式域名切到东京 `ALB`
 2. 观察 5xx、延迟、容器日志、RDS、Redis
 3. 保持香港不删，只做回滚保留
 ## 9. 104 灾备重挂
 ### 9.1 MySQL
 在东京 RDS 上：
 ```sql
 CALL mysql.rds_set_configuration('binlog retention hours', 24);
 CREATE USER IF NOT EXISTS 'repl'@'104.238.220.230' IDENTIFIED BY '<REPL_PASSWORD>';
 GRANT REPLICATION SLAVE, REPLICATION CLIENT ON *.* TO 'repl'@'104.238.220.230';
 FLUSH PRIVILEGES;
 SHOW BINARY LOG STATUS;
 ```
 当前东京已准备完成：
 - `repl@104.238.220.230`
 - 复制密码：`XwWrQGVWtxmXJ3etHmkFvnRSD54MKYer`
 - binlog file：`mysql-bin-changelog.000189`
 - binlog pos：`185053`
 然后在 `104` 重建并挂从。
 ### 9.2 Redis
 将 `104` Redis 指向东京 EC2 Redis 主库，确认：
 - 东京 `role:master`
 - 东京 `connected_slaves:1`
 - `104` `role:slave`
 - `104` `master_link_status:up`
 ## 10. 回滚
 如果东京验收失败：
 - 不切正式域名
 - 继续保留香港主环境
 如果正式切换后发现严重问题：
 1. 立刻把 DNS 切回香港
 2. 恢复香港 `ppanel-server`
 3. 放弃本次东京接管
 ## 11. 切换后观察期
 切换后至少保留香港环境 `7` 天：
 - 香港 RDS 快照
 - 香港 Redis RDB
 - 香港 EC2 配置
 - 香港 `ppanel.yaml` 备份
 观察期内不删除香港资源。
@@ -0,0 +1,246 @@
 # Hifast 当前架构文档（东京主站版）
 最后更新：`2026-05-21`
 这份文档只描述**当前真实生效**的架构，不描述理想目标，不混入已经下线或待迁移的香港旧链路。
 如果后续东京 `ALB / WAF / 正式域名` 上线，应继续更新这份文档，而不是回头参考旧香港架构文档。
 ## 1. 当前结论
 当前已经实际跑起来的是：
 `用户 / 运维 -> 东京 EC2 -> ppanel-server + Redis + observability -> 东京 RDS MySQL`
 当前还**没有**实际生效的组件：
 - `ALB`
 - `WAF`
 - 正式域名切流
 - `104.238.220.230` 重挂东京 MySQL / Redis 从库
 也就是说，东京环境目前是：
 - 一台业务 EC2 已可用
 - 一台东京 RDS 已可用
 - 本机 Redis 已可用
 - `ppanel-server` 已成功启动并连通 MySQL / Redis
 - 灾备链路参数已准备好，但 `104` 还没最终挂上去
 ## 2. 当前真实拓扑
 ```mermaid
 flowchart TB
    USER["用户 / 运维"] --> EIP["东京 EC2 公网入口\n3.114.29.208"]
    EIP --> NGINX["Nginx\nEC2 本机"]
    NGINX --> APP["ppanel-server\nhost network\n127.0.0.1:8080"]
    APP --> REDIS["Redis Docker\n127.0.0.1:6379"]
    APP --> RDS["Tokyo RDS MySQL\nppanel-mysql-jp"]
    APP --> OBS["Grafana / Loki / Tempo / Prometheus"]
    RDS -. 预留复制 .-> DRMYSQL["104.238.220.230\nMySQL DR\n未最终接入"]
    REDIS -. 预留复制 .-> DRREDIS["104.238.220.230\nRedis DR\n未最终接入"]
 ```
 ## 3. 云资源清单
 ### 3.1 Region
 - AWS account: `hifastvpn (200810848252)`
 - Region: `ap-northeast-1`
 ### 3.2 网络
 - VPC: `ppanel-jp-prod`
 - VPC ID: `vpc-0846b23b4a7d64eac`
 - CIDR: `10.20.0.0/16`
 公有子网：
 - `ppanel-jp-public-a` / `subnet-091232bdb53e71490` / `10.20.0.0/24`
 - `ppanel-jp-public-c` / `subnet-01ba0975c525ce8cf` / `10.20.1.0/24`
 私有子网：
 - `ppanel-jp-private-a` / `subnet-0bd13111c02f0edbe` / `10.20.10.0/24`
 - `ppanel-jp-private-c` / `subnet-0d86c5c756dbc84b2` / `10.20.11.0/24`
 ### 3.3 安全组
 - `ppanel-jp-sg-alb`
  - `80/tcp <- 0.0.0.0/0`
  - `443/tcp <- 0.0.0.0/0`
 - `ppanel-jp-sg-ec2`
  - `80/tcp <- sg-0b3a23c31041a5a5a`
  - `22/tcp <- 64.118.144.142/32`
  - `6379/tcp <- 104.238.220.230/32`
 - `ppanel-jp-sg-rds`
  - `3306/tcp <- sg-01f2a5a81e7505c91`
  - `3306/tcp <- 104.238.220.230/32`
 ## 4. 计算与数据库
 ### 4.1 业务 EC2
 - Name: `ppanel-app-jp-01`
 - Instance ID: `i-07839130074cd7ed9`
 - Type: `c7i.xlarge`
 - AZ: `ap-northeast-1c`
 - Private IP: `10.20.1.168`
 - Public IP / Elastic IP: `3.114.29.208`
 - Public DNS: `ec2-3-114-29-208.ap-northeast-1.compute.amazonaws.com`
 - Root volume: `gp3 100GiB`
 - Status: `running`
 说明：
 - 当前公网入口是这台 EC2 自己
 - 这里绑定的是 `EIP`，不是依赖实例自动分配的临时公网 IP
 - 绑定 EIP 的目的，是保证以后 Redis 主从、白名单、DNS、文档里的公网地址不因为实例变更而漂移
 ### 4.2 Tokyo RDS
 - Identifier: `ppanel-mysql-jp`
 - Engine: `MySQL Community 8.4.8`
 - Class: `db.r7g.xlarge`
 - Storage: `gp3 100GiB`
 - Master user: `admin`
 - Endpoint: `ppanel-mysql-jp.cpo0keikgh80.ap-northeast-1.rds.amazonaws.com`
 - Public access: `enabled`
 - Credential management: `self-managed`
 - Current status: `available`
 当前实际连接值：
 - Host: `ppanel-mysql-jp.cpo0keikgh80.ap-northeast-1.rds.amazonaws.com`
 - Port: `3306`
 - User: `admin`
 ### 4.3 Redis
 - 部署位置：东京 EC2 本机
 - 部署方式：Docker
 - 容器名：`ppanel-redis`
 - 当前角色：`master`
 - 当前监听：`127.0.0.1:6379`（应用本机访问）
 - 当前对灾备开放：`3.114.29.208:6379`
 ### 4.4 应用与可观测
 业务容器：
 - `ppanel-server`
 可观测容器：
 - `ppanel-grafana`
 - `ppanel-loki`
 - `ppanel-promtail`
 - `ppanel-prometheus`
 - `ppanel-tempo`
 - `ppanel-cadvisor`
 - `ppanel-node-exporter`
 - `ppanel-nginx-exporter`
 ## 5. 当前部署方式
 部署目录：
 - `/opt/ppanel`
 关键文件：
 - `/opt/ppanel/docker-compose.cloud.yml`
 - `/opt/ppanel/configs/ppanel.yaml`
 - `/opt/ppanel/.env`
 业务启动方式：
 - `ppanel-server` 使用 `docker compose`
 - `network_mode: host`
 当前配置指向：
 - MySQL -> 东京 RDS
 - Redis -> 本机 Docker Redis
 - Trace -> `127.0.0.1:4317`
 ## 6. 当前已验证状态
 截至 `2026-05-21` 已确认：
 - `docker exec ppanel-redis redis-cli -a 'hifast67yj' PING` 返回 `PONG`
 - `MYSQL_PWD=... mysql -h ppanel-mysql-jp.cpo0keikgh80.ap-northeast-1.rds.amazonaws.com -u admin -e "select 1"` 返回正常
 - `docker compose -f /opt/ppanel/docker-compose.cloud.yml up -d ppanel-server` 已成功
 - `docker logs ppanel-server` 无 MySQL / Redis 连接报错
 - `curl http://127.0.0.1:8080/v1/common/heartbeat` 返回成功
 可以认为当前东京单站已经具备：
 - 服务启动能力
 - 数据库连接能力
 - Redis 连接能力
 - 基础可观测能力
 ## 7. 当前未落地项
 下面这些还属于“目标方案”，不是“当前实际架构”：
 - `ALB`
 - `WAF`
 - ACM 证书完成 DNS 验证
 - 正式域名切换到东京
 - `104.238.220.230` 完整接成东京 DR
 所以现在请不要把当前架构理解成：
 `DNS -> ALB -> WAF -> EC2 -> RDS`
 当前真实架构更准确地说是：
 `EIP -> EC2(Nginx + ppanel-server + Redis + observability) -> RDS`
 ## 8. 灾备准备状态
 ### 8.1 MySQL DR
 已准备好：
 - DR host: `104.238.220.230`
 - 复制账号：`repl@104.238.220.230`
 - binlog retention hours: `24`
 - current binlog file: `mysql-bin-changelog.000189`
 - current binlog position: `185053`
 当前状态：
 - 东京侧已准备完成
 - 但 `104` 侧还没有最终执行挂从
 ### 8.2 Redis DR
 已准备好：
 - 东京 Redis 主地址：`3.114.29.208:6379`
 - 东京 Redis 当前角色：`role:master`
 - 东京 Redis 当前状态：`connected_slaves:0`
 当前状态：
 - 东京侧已可作为主库提供同步
 - 但 `104` 侧还没有最终执行 `REPLICAOF`
 ## 9. 权威文档入口
 与当前东京架构直接相关的文档，以这些为准：
 - [当前架构文档](./hifast-current-architecture-zh.md)
 - [东京资源清单](../deploy/aws/ap-northeast-1/configs/resource-inventory.current.md)
 - [东京迁移 Runbook](./hifast-aws-jp-migration-runbook-zh.md)
 - [东京切换清单](./hifast-aws-jp-cutover-checklist-zh.md)
 下面这些旧文档可以继续保留，但不要作为“当前实际架构”依据：
 - 香港旧主站相关文档
 - 仍以 `ap-east-1` 为主语的历史架构说明
@@ -214,6 +214,42 @@ S3_PREFIX=redis bash deploy/scripts/redis_rdb_backup_to_s3.sh
 - 本地临时文件默认只保留 `3` 天
 - 长期保留建议通过 S3 Lifecycle 管理，而不是靠本机 cron 删除
 ### 9.3 MySQL 每 10 分钟执行一次
 如果你要在 `104` 上做高频逻辑备份，仓库里已经补了 `systemd timer` 安装脚本：
 - 安装脚本：
  - [`deploy/scripts/install_mysql_backup_timer.sh`](/Users/Apple/code_vpn/vpn/ppanel-server/deploy/scripts/install_mysql_backup_timer.sh)
 - systemd service：
  - [`deploy/systemd/hifast-mysql-backup.service`](/Users/Apple/code_vpn/vpn/ppanel-server/deploy/systemd/hifast-mysql-backup.service)
 - systemd timer：
  - [`deploy/systemd/hifast-mysql-backup.timer`](/Users/Apple/code_vpn/vpn/ppanel-server/deploy/systemd/hifast-mysql-backup.timer)
 安装方式：
 ```bash
 cp deploy/aws/ap-northeast-1/configs/backup-to-s3.env.example /root/backup-to-s3.env
 chmod 600 /root/backup-to-s3.env
 vim /root/backup-to-s3.env
 bash deploy/scripts/install_mysql_backup_timer.sh /opt/ppanel /root/backup-to-s3.env
 ```
 查看状态：
 ```bash
 systemctl list-timers --all | grep hifast-mysql-backup
 systemctl status hifast-mysql-backup.timer --no-pager -l
 systemctl status hifast-mysql-backup.service --no-pager -l
 journalctl -u hifast-mysql-backup.service -n 50 --no-pager
 ```
 补充说明：
 - 定时表达式是 `OnCalendar=*:0/10`，即每 `10` 分钟执行一次
 - 备份脚本已加 `flock` 锁，上一轮未结束时，下一轮会自动跳过，不会并发打包
 - 高频逻辑备份会持续产生 `mysqldump` 开销，建议只在 `104` 这样的从库或备用库上执行，不要直接打主库
 ## 10. 恢复思路
 ### 10.1 MySQL
@@ -0,0 +1,37 @@
 server:
  http_listen_port: 3200
  grpc_listen_port: 9095
 distributor:
  receivers:
    otlp:
      protocols:
        grpc:
          endpoint: 0.0.0.0:4317
        http:
          endpoint: 0.0.0.0:4318
 ingester:
  max_block_duration: 5m
 compactor:
  compaction:
    block_retention: 168h
 storage:
  trace:
    backend: local
    wal:
      path: /var/tempo/wal
    local:
      path: /var/tempo/blocks
 metrics_generator:
  registry:
    external_labels:
      source: tempo
      cluster: ppanel
  storage:
    path: /var/tempo/generator/wal
    remote_write:
      - url: http://prometheus:9090/api/v1/write
		`@@ -0,0 +1 @@`
							`ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGwnFkOMq9oh1WN6vdAwdFjDjfCRWfMe6sDZNCoeWvVj Apple@MacBook-Pro.local`