merge: pull internal/internal with secrets for TG notifications

Resolved conflict in .gitea/workflows/docker.yml by keeping
secrets-based TG_BOT_TOKEN and TG_CHAT_ID instead of hardcoded values.

ops/aws-rds-external-replica-runbook.md

@@ -22,7 +22,7 @@
 - Region: `ap-east-1`
 - AWS app EC2:
   - Name: `hifast-hk-app-01`
-  - Public IP: `43.198.248.161`
+  - Public IP: `18.163.33.75`
   - Private IP: `10.0.1.201`
 - AWS MySQL:
   - Type: `RDS MySQL`
@@ -183,7 +183,7 @@ redis-cli INFO replication
 重点看：
 
 - `role:slave`
-- `master_host:43.198.248.161`
+- `master_host:18.163.33.75`
 - `master_port:6379`
 - `master_link_status:up`
 
@@ -416,7 +416,7 @@ SHOW REPLICA STATUS\G
 
 ```bash
 redis-cli CONFIG SET masterauth '0BVz9XOHf7KUfEuoFJRK-dURdKUGFiZ8QeaHpysHnKeKhLskZb55HPK121lFsKtr'
-redis-cli REPLICAOF 43.198.248.161 6379
+redis-cli REPLICAOF 18.163.33.75 6379
 redis-cli CONFIG SET replica-read-only yes
 redis-cli INFO replication
 ```
@@ -426,7 +426,7 @@ redis-cli INFO replication
 检查 `/etc/redis/redis.conf` 至少包含：
 
 ```conf
-replicaof 43.198.248.161 6379
+replicaof 18.163.33.75 6379
 masterauth 0BVz9XOHf7KUfEuoFJRK-dURdKUGFiZ8QeaHpysHnKeKhLskZb55HPK121lFsKtr
 replica-read-only yes
 ```

ops/docker-image-version-pins.md

@@ -0,0 +1,33 @@
+# Docker Image Version Pins
+
+This file records the infrastructure image versions pinned in `docker-compose.cloud.yml`.
+The versions below match the images observed on the test deployment on 2026-05-26.
+
+| Service | Image | Running version source |
+| --- | --- | --- |
+| grafana | `grafana/grafana:13.0.1` | `grafana version 13.0.1` |
+| prometheus | `prom/prometheus:v3.11.3` | `prometheus, version 3.11.3` |
+| nginx-exporter | `nginx/nginx-prometheus-exporter:1.5.0` | image label `org.opencontainers.image.version=1.5.0` |
+| node-exporter | `prom/node-exporter:v1.11.1` | `node_exporter, version 1.11.1` |
+| cadvisor | `gcr.io/cadvisor/cadvisor:v0.55.1` | `cAdvisor version v0.55.1` |
+
+The test deployment in `/root/bindbox/docker-compose.cloud.yml` also contains
+live-only exporter services that are not present in this repository's
+`docker-compose.cloud.yml`. They were pinned during staging validation:
+
+| Test-only service | Image | Running version source |
+| --- | --- | --- |
+| mysql-exporter | `prom/mysqld-exporter:v0.19.0` | `mysqld_exporter, version 0.19.0` |
+| redis-exporter | `oliver006/redis_exporter:v1.82.0` | image label `org.opencontainers.image.version=v1.82.0` |
+
+`ppanel-server` intentionally remains variable and requires `PPANEL_SERVER_TAG`
+from CI/CD so deployments use an immutable application image tag.
+
+## Rollback
+
+Restore the previous compose file from git and redeploy:
+
+```sh
+git checkout HEAD~1 -- docker-compose.cloud.yml .env.example ops/docker-image-version-pins.md
+docker compose -f docker-compose.cloud.yml up -d
+```

ops/hifast-aws-standby-architecture-zh.md

@@ -66,7 +66,7 @@
 - Instance ID: `i-079cd9d3ef3748714`
 - 角色：当前实际生产入口 / Nginx / 业务服务 / AWS 侧 Redis 主库宿主机
 - 私网 IP: `10.0.1.201`
-- 公网 IP: `43.198.248.161`
+- 公网 IP: `18.163.33.75`
 - 业务服务运行方式：`Docker Compose`
 - 业务容器：`ppanel-server`
 - 部署目录：`/opt/ppanel`
@@ -103,7 +103,7 @@
 - 容器名：`hifast-redis`
 - 版本：`redis:8.2.1`
 - 访问端口：`6379`
-- 主库出口地址：`43.198.248.161:6379`
+- 主库出口地址：`18.163.33.75:6379`
 - 应用当前实际连接：`127.0.0.1:6379`
 - 认证方式：已启用密码认证
 
@@ -130,10 +130,10 @@
 ```mermaid
 flowchart TB
     USER["用户 / 客户端"] --> DNS["域名 / DNS / 入口层"]
-    DNS --> APP["AWS EC2\nhifast-hk-app-01\n43.198.248.161\n10.0.1.201"]
+    DNS --> APP["AWS EC2\nhifast-hk-app-01\n18.163.33.75\n10.0.1.201"]
 
     APP --> RDS["AWS RDS MySQL\nhifast-mysql-prod-v2\n主库"]
-    APP --> REDISM["AWS Redis 主库\nDocker redis:8.2.1\n43.198.248.161:6379"]
+    APP --> REDISM["AWS Redis 主库\nDocker redis:8.2.1\n18.163.33.75:6379"]
 
     RDS -. MySQL 备用 / 同步 .-> MYSQLS["104.238.220.230\nMySQL 备用库"]
     REDISM -. Redis 主从复制 .-> REDISS["104.238.220.230\n原生 Redis 8.6.3\n从库"]
@@ -238,7 +238,7 @@ App / Nginx
 
 ```mermaid
 flowchart LR
-    SG["hifast-hk-app-core-sg"] --> REDIS["AWS Redis 主库\n43.198.248.161:6379"]
+    SG["hifast-hk-app-core-sg"] --> REDIS["AWS Redis 主库\n18.163.33.75:6379"]
     STANDBY["104.238.220.230/32"] --> SG
 ```
 
@@ -311,7 +311,7 @@ RDS 当前状态已经比之前干净很多：
 
 `104.238.220.230` 连接 AWS Redis，不是通过 PEM 证书，也不是通过 SSH 登录 AWS 机器，而是直接作为 Redis 从库去访问 AWS Redis 主库：
 
-- 目标地址：`43.198.248.161:6379`
+- 目标地址：`18.163.33.75:6379`
 - 连接方式：`TCP`
 - 认证方式：`Redis 密码`
 - 网络前提：AWS EC2 安全组已放行 `104.238.220.230/32 -> 6379`
@@ -325,7 +325,7 @@ RDS 当前状态已经比之前干净很多：
 示意命令：
 
 ```bash
-redis-cli -h 43.198.248.161 -p 6379 -a '<REDIS_PASSWORD>'
+redis-cli -h 18.163.33.75 -p 6379 -a '<REDIS_PASSWORD>'
 ```
 
 ### 4.6.2 104 连接 AWS MySQL RDS 的方式
@@ -380,7 +380,7 @@ mysql -h hifast-mysql-prod-v2.cd6aey40m6ag.ap-east-1.rds.amazonaws.com -u admin
 
 - 部署方式：Docker
 - 版本：`8.2.1`
-- 主库地址：`43.198.248.161:6379`
+- 主库地址：`18.163.33.75:6379`
 - 运行容器：`hifast-redis`
 
 ### 5.2 104 Redis 从库
@@ -417,7 +417,7 @@ mysql -h hifast-mysql-prod-v2.cd6aey40m6ag.ap-east-1.rds.amazonaws.com -u admin
 
 ```mermaid
 flowchart LR
-    REDISMASTER["AWS Redis 主库\n43.198.248.161:6379\nDocker redis:8.2.1"]
+    REDISMASTER["AWS Redis 主库\n18.163.33.75:6379\nDocker redis:8.2.1"]
     REDISSLAVE["104.238.220.230\n原生 Redis 8.6.3\nrole: slave"]
     REDISMASTER --> REDISSLAVE
 ```