运维(#101 ): 新增测试环境 MinIO 上传链路配置

Co-authored-by: multica-agent <github@multica.ai>
x
2026-05-27 20:04:14 -07:00 · 2026-05-26 10:02:38 -07:00 · 2026-05-26 09:25:13 -07:00 · 2026-05-26 09:14:59 -07:00 · 2026-05-26 08:36:25 -07:00 · 2026-05-26 08:35:45 -07:00
45 changed files with 2431 additions and 198 deletions
@@ -10,6 +10,12 @@ GRAFANA_PASSWORD=CHANGE_ME_TO_STRONG_PASSWORD
 # PPanel Server 镜像标签（由 CI/CD 传入不可变 tag，如 git SHA）
 PPANEL_SERVER_TAG=CHANGE_ME_TO_GIT_SHA

+# 测试环境 MinIO / S3 兼容存储
+# ppanel.yaml 中 S3.Endpoint 使用 http://127.0.0.1:9000，Bucket 与此处保持一致。
+MINIO_ROOT_USER=CHANGE_ME_TO_S3_ACCESS_KEY
+MINIO_ROOT_PASSWORD=CHANGE_ME_TO_S3_SECRET_KEY
+MINIO_BUCKET=hifastvpn
+
 # AWS 区域（香港）
 AWS_REGION=ap-east-1

@@ -21,8 +21,8 @@ env:
  # SSH私钥（Gitea Secret 名称：AWS）
  SSH_KEY: ${{ secrets.AWS }}
  # TG通知
-  TG_BOT_TOKEN: 8114337882:AAHkEx03HSu7RxN4IHBJJEnsK9aPPzNLIk0
-  TG_CHAT_ID: "-4940243803"
+  TG_BOT_TOKEN: ${{ secrets.TG_BOT_TOKEN }}
+  TG_CHAT_ID: ${{ secrets.TG_CHAT_ID }}
  # Go构建变量
  SERVICE: vpn
  SERVICE_STYLE: vpn
@@ -43,7 +43,7 @@ jobs:
      # 步骤1: 下载代码
      - name: 📥 下载代码
        uses: actions/checkout@v4
-        
+
      # 步骤2: 设置动态环境变量
      - name: ⚙️ 设置动态环境变量
        run: |
@@ -51,19 +51,22 @@ jobs:
            echo "DOCKER_TAG_SUFFIX=latest" >> $GITHUB_ENV
            echo "CONTAINER_NAME=ppanel-server" >> $GITHUB_ENV
            echo "DEPLOY_PATH=/opt/ppanel" >> $GITHUB_ENV
+            echo "DEPLOY_ENV_LABEL=🚀 服务已成功部署到生产环境" >> $GITHUB_ENV
            echo "为 main 分支设置生产环境变量"
          elif [ "${{ github.ref_name }}" = "internal" ]; then
            echo "DOCKER_TAG_SUFFIX=internal" >> $GITHUB_ENV
            echo "CONTAINER_NAME=ppanel-server-internal" >> $GITHUB_ENV
            echo "DEPLOY_PATH=/root/bindbox" >> $GITHUB_ENV
+            echo "DEPLOY_ENV_LABEL=🧪 服务已成功部署到测试环境" >> $GITHUB_ENV
            echo "为 internal 分支设置开发环境变量"
          else
            echo "DOCKER_TAG_SUFFIX=${{ github.ref_name }}" >> $GITHUB_ENV
            echo "CONTAINER_NAME=ppanel-server-${{ github.ref_name }}" >> $GITHUB_ENV
            echo "DEPLOY_PATH=/root/vpn_server_other" >> $GITHUB_ENV
+            echo "DEPLOY_ENV_LABEL=🔧 服务已成功部署到其他环境" >> $GITHUB_ENV
            echo "为其他分支 (${{ github.ref_name }}) 设置环境变量"
          fi
-        
+
      # 步骤3: 安装系统工具 (curl, jq) 并升级 Docker CLI 到 1.44+
      - name: 🔧 安装系统工具并升级 Docker CLI
        run: |
@@ -111,35 +114,49 @@ jobs:
          docker --version || true
          docker version || true
          echo "客户端 API 版本:" $(docker version --format '{{.Client.APIVersion}}')
-        
-      # 步骤4: 构建并发布到镜像仓库
-      - name: 📤 构建并发布到镜像仓库
+
+      # 步骤4: 构建镜像
+      - name: 🏗️ 构建镜像
        run: |
-          echo "开始构建并推送镜像..."
+          echo "开始构建镜像..."
          echo "仓库: ${{ env.REPO }}"
          echo "版本标签: ${{ env.VERSION }}"
          echo "分支标签: ${{ env.DOCKER_TAG_SUFFIX }}"

-          # 构建镜像，同时打上版本和分支两个标签
+          BUILD_TAG_ARGS="-t ${{ env.REPO }}:${{ env.VERSION }}"
+          if [ "${{ github.event_name }}" = "push" ]; then
+            BUILD_TAG_ARGS="$BUILD_TAG_ARGS -t ${{ env.REPO }}:${{ env.DOCKER_TAG_SUFFIX }}"
+          else
+            echo "PR事件仅构建版本标签，不推送镜像、不部署"
+          fi
+
          docker build -f Dockerfile \
            --platform linux/amd64 \
            --build-arg TARGETARCH=amd64 \
            --build-arg VERSION=${{ env.VERSION }} \
            --build-arg BUILDTIME=${{ env.BUILDTIME }} \
-            -t ${{ env.REPO }}:${{ env.VERSION }} \
-            -t ${{ env.REPO }}:${{ env.DOCKER_TAG_SUFFIX }} \
+            $BUILD_TAG_ARGS \
            .
-          
+
+          echo "镜像构建完成"
+
+      # 步骤5: 发布到镜像仓库
+      - name: 📤 发布到镜像仓库
+        if: github.event_name == 'push'
+        run: |
+          echo "开始推送镜像..."
+
          echo "推送版本标签镜像: ${{ env.REPO }}:${{ env.VERSION }}"
          docker push ${{ env.REPO }}:${{ env.VERSION }}
-          
+
          echo "推送分支标签镜像: ${{ env.REPO }}:${{ env.DOCKER_TAG_SUFFIX }}"
          docker push ${{ env.REPO }}:${{ env.DOCKER_TAG_SUFFIX }}
-          
+
          echo "镜像推送完成"
-          
-      # 调试: 打印部署目标（不输出敏感信息）
+
+      # 步骤6: 调试 - 打印部署目标（不输出敏感信息）
      - name: 🔍 调试 - 打印部署目标
+        if: github.event_name == 'push'
        run: |
          echo "========== 部署目标调试 =========="
          echo "当前分支: ${{ github.ref_name }}"
@@ -150,8 +167,9 @@ jobs:
          echo "DEPLOY_PATH: ${{ env.DEPLOY_PATH }}"
          echo "====================================="

-      # 步骤5: 传输配置文件
+      # 步骤7: 传输配置文件
      - name: 📂 传输配置文件
+        if: github.event_name == 'push'
        uses: appleboy/scp-action@v0.1.7
        with:
          host: ${{ env.SSH_HOST }}
@@ -161,8 +179,9 @@ jobs:
          source: "docker-compose.cloud.yml"
          target: "/tmp/ppanel-deploy/"

-      # 步骤6: 连接服务器更新并启动
+      # 步骤8: 连接服务器更新、健康检查并按需回滚
      - name: 🚀 连接服务器更新并启动
+        if: github.event_name == 'push'
        uses: appleboy/ssh-action@v1.0.3
        with:
          host: ${{ env.SSH_HOST }}
@@ -172,68 +191,147 @@ jobs:
          timeout: 300s
          command_timeout: 600s
          script: |
+            set -e
+
            echo "连接服务器成功，开始部署..."
            echo "部署目录: ${{ env.DEPLOY_PATH }}"
            echo "部署标签: ${{ env.DOCKER_TAG_SUFFIX }}"
            echo "登录用户: ${{ env.SSH_USER }}"

+            HEALTHCHECK_URL="http://127.0.0.1:8080/v1/common/heartbeat"
+            NEW_TAG="${{ env.DOCKER_TAG_SUFFIX }}"
+            ROLLBACK_TAG="rollback-${{ env.VERSION }}"
+            SUDO=""
+            if [ "${{ github.ref_name }}" = "main" ]; then
+              SUDO="sudo"
+            fi
+
+            docker_cmd() {
+              if [ -n "$SUDO" ]; then
+                sudo docker "$@"
+              else
+                docker "$@"
+              fi
+            }
+
+            compose_with_tag() {
+              tag="$1"
+              shift
+              if [ -n "$SUDO" ]; then
+                sudo env PPANEL_SERVER_TAG="$tag" docker-compose -f docker-compose.cloud.yml "$@"
+              else
+                PPANEL_SERVER_TAG="$tag" docker-compose -f docker-compose.cloud.yml "$@"
+              fi
+            }
+
+            write_previous_tag() {
+              if [ -n "$SUDO" ]; then
+                printf '%s\n' "${PREVIOUS_IMAGE_TAG:-}" | sudo tee .previous-ppanel-image-tag >/dev/null
+              else
+                printf '%s\n' "${PREVIOUS_IMAGE_TAG:-}" > .previous-ppanel-image-tag
+              fi
+            }
+
+            health_check() {
+              attempt=1
+              while [ "$attempt" -le 3 ]; do
+                if curl -sf "$HEALTHCHECK_URL"; then
+                  echo
+                  return 0
+                fi
+
+                echo "健康检查第 ${attempt}/3 次失败，10s 后重试..."
+                attempt=$((attempt + 1))
+                sleep 10
+              done
+
+              return 1
+            }
+
            if [ "${{ github.ref_name }}" = "main" ]; then
              sudo mkdir -p ${{ env.DEPLOY_PATH }}
              sudo cp /tmp/ppanel-deploy/docker-compose.cloud.yml ${{ env.DEPLOY_PATH }}/docker-compose.cloud.yml
-              cd ${{ env.DEPLOY_PATH }}
-              echo "📥 拉取镜像..."
-              sudo docker-compose -f docker-compose.cloud.yml pull ppanel-server
-              echo "🚀 启动服务..."
-              sudo docker-compose -f docker-compose.cloud.yml up -d ppanel-server
-              sudo docker image prune -f || true
            else
              mkdir -p ${{ env.DEPLOY_PATH }}
              cp /tmp/ppanel-deploy/docker-compose.cloud.yml ${{ env.DEPLOY_PATH }}/docker-compose.cloud.yml
-              cd ${{ env.DEPLOY_PATH }}
-              echo "📥 拉取镜像..."
-              docker-compose -f docker-compose.cloud.yml pull ppanel-server
-              echo "🚀 启动服务..."
-              docker-compose -f docker-compose.cloud.yml up -d ppanel-server
-              docker image prune -f || true
            fi
-            
-            echo "✅ 部署命令执行完成"
-            
-      # 步骤6: TG通知 (成功)
+
+            cd ${{ env.DEPLOY_PATH }}
+
+            PREVIOUS_IMAGE_TAG="$(docker_cmd inspect --format '{{.Config.Image}}' ppanel-server 2>/dev/null || true)"
+            PREVIOUS_IMAGE_ID="$(docker_cmd inspect --format '{{.Image}}' ppanel-server 2>/dev/null || true)"
+            echo "上一版本镜像tag: ${PREVIOUS_IMAGE_TAG:-未发现}"
+            echo "上一版本镜像ID: ${PREVIOUS_IMAGE_ID:-未发现}"
+            write_previous_tag
+
+            echo "📥 拉取镜像: ${{ env.REPO }}:${NEW_TAG}"
+            compose_with_tag "$NEW_TAG" pull ppanel-server
+            echo "🚀 启动服务..."
+            compose_with_tag "$NEW_TAG" up -d ppanel-server
+
+            echo "🩺 部署后健康检查: ${HEALTHCHECK_URL}"
+            if health_check; then
+              docker_cmd image prune -f || true
+              echo "✅ 部署后健康检查通过"
+              echo "✅ 部署命令执行完成"
+              exit 0
+            fi
+
+            echo "❌ 部署后健康检查连续 3 次失败，开始回滚..."
+            if [ -n "$PREVIOUS_IMAGE_ID" ]; then
+              docker_cmd tag "$PREVIOUS_IMAGE_ID" "${{ env.REPO }}:${ROLLBACK_TAG}"
+              echo "回滚镜像tag: ${{ env.REPO }}:${ROLLBACK_TAG}"
+              compose_with_tag "$ROLLBACK_TAG" up -d ppanel-server
+
+              echo "🩺 回滚后健康检查: ${HEALTHCHECK_URL}"
+              if health_check; then
+                echo "✅ 回滚后健康检查通过"
+              else
+                echo "❌ 回滚后健康检查仍失败"
+              fi
+            else
+              echo "未找到上一版本镜像ID，无法自动回滚"
+            fi
+
+            docker_cmd image prune -f || true
+            exit 1
+
+      # 步骤9: TG通知 (成功)
      - name: 📱 发送成功通知到Telegram
-        if: success()
+        if: success() && github.event_name == 'push'
        uses: appleboy/telegram-action@master
        with:
          token: ${{ env.TG_BOT_TOKEN }}
          to: ${{ env.TG_CHAT_ID }}
          message: |
            ✅ 部署成功！
-            
+
            📦 项目: ${{ github.repository }}
            🌿 分支: ${{ github.ref_name }}
            📝 提交: ${{ github.sha }}
            👤 提交者: ${{ github.actor }}
            🕐 时间: ${{ github.event.head_commit.timestamp }}
-            
-            🚀 服务已成功部署到生产环境
+
+            ${{ env.DEPLOY_ENV_LABEL }}
+            🩺 健康检查: 通过 (http://127.0.0.1:8080/v1/common/heartbeat)
          parse_mode: Markdown
-          
-      # 步骤5: TG通知 (失败)
+
+      # 步骤10: TG通知 (失败)
      - name: 📱 发送失败通知到Telegram
-        if: failure()
+        if: failure() && github.event_name == 'push'
        uses: appleboy/telegram-action@master
        with:
          token: ${{ env.TG_BOT_TOKEN }}
          to: ${{ env.TG_CHAT_ID }}
          message: |
            ❌ 部署失败！
-            
+
            📦 项目: ${{ github.repository }}
            🌿 分支: ${{ github.ref_name }}
            📝 提交: ${{ github.sha }}
            👤 提交者: ${{ github.actor }}
            🕐 时间: ${{ github.event.head_commit.timestamp }}
-            
+
+            🩺 健康检查: 失败或未完成；若新版本健康检查连续 3 次失败，已自动尝试回滚并重新检查
            ⚠️ 请检查构建日志获取详细信息
          parse_mode: Markdown
-          
@@ -1,76 +0,0 @@
-upstream api_backend {
-    server 127.0.0.1:8080;
-}
-
-server {
-
-    listen 80;
-    server_name api.hifast.biz  4d3vsw888xgaen.hifast.biz;
-    location /.well-known/acme-challenge/ {
-        root /var/www/html;
-        allow all;
-    }
-    location / {
-        return 301 https://$host$request_uri;
-    }
-}
-
-server {
-    listen 443 ssl http2;
-    server_name api.hifast.biz;
-    client_max_body_size 150M;
-    ssl_certificate /etc/nginx/ssl/hifast.biz/_.hifast.biz.pem; # managed by Certbot
-    ssl_certificate_key /etc/nginx/ssl/hifast.biz/_.hifast.biz.key; # managed by Certbot
-
-    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
-    add_header X-Frame-Options "DENY";
-    
-    add_header X-Content-Type-Options nosniff;
-    if ($http_user_agent ~* '(9999|91\.78)') {
-        return 444;
-    }
-    location ~ ^/v1/common/client/download/file/(?<download_name>Hi快VPN-(?<os>windows|mac|android)-1.0.0-ic-.*\.(?<ext>exe|dmg|apk))$ {
-    alias /var/www/download/Hi快VPN-$os-1.0.0.$ext;
-    charset utf-8;
-    add_header Content-Disposition 'attachment; filename="$download_name"';
-    add_header Content-Type application/octet-stream;
-    }
-
-    location /v1/common/client/download/file/ {
-        alias /var/www/download/;
-    }
-
-    location / {
-        proxy_pass http://api_backend;
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-        proxy_http_version 1.1;
-        proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection "upgrade";
-    }
-
-}
-
-server {
-    listen 443 ssl http2;
-    server_name 4d3vsw888xgaen.hifast.biz;
-    client_max_body_size 150M;
-    ssl_certificate /etc/nginx/ssl/hifast.biz/_.hifast.biz.pem; # managed by Certbot
-    ssl_certificate_key /etc/nginx/ssl/hifast.biz/_.hifast.biz.key; # managed by Certbot
-
-    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
-    add_header X-Frame-Options DENY;
-    add_header X-Content-Type-Options nosniff;
-
-    gzip on;
-    gzip_vary on;
-    gzip_min_length 1024;
-    gzip_types text/plain text/css text/xml text/javascript application/javascript application/xml+rss application/json image/svg+xml;
-    root /var/www/admin;
-    location / {
-        try_files $uri $uri/ /index.html;
-    }
-
-}
@@ -38,20 +38,20 @@ type (
 		Id int64 `form:"id" validate:"required"`
 	}
 	UpdateUserBasiceInfoRequest {
-		UserId             int64  `json:"user_id" validate:"required"`
-		Password           string `json:"password"`
-		Avatar             string `json:"avatar"`
-		Balance            int64  `json:"balance"`
-		Commission         int64  `json:"commission"`
-		ReferralPercentage uint8  `json:"referral_percentage"`
-		OnlyFirstPurchase  *bool  `json:"only_first_purchase"`
-		GiftAmount         int64  `json:"gift_amount"`
-		Telegram           int64  `json:"telegram"`
-		ReferCode          string `json:"refer_code"`
-		RefererId          int64  `json:"referer_id"`
-		Enable             *bool  `json:"enable"`
-		IsAdmin            *bool  `json:"is_admin"`
-		Remark             string `json:"remark"`
+		UserId             int64   `json:"user_id" validate:"required"`
+		Password           string  `json:"password"`
+		Avatar             string  `json:"avatar"`
+		Balance            *int64  `json:"balance"`
+		Commission         *int64  `json:"commission"`
+		ReferralPercentage uint8   `json:"referral_percentage"`
+		OnlyFirstPurchase  *bool   `json:"only_first_purchase"`
+		GiftAmount         *int64  `json:"gift_amount"`
+		Telegram           int64   `json:"telegram"`
+		ReferCode          string  `json:"refer_code"`
+		RefererId          *int64  `json:"referer_id"`
+		Enable             *bool   `json:"enable"`
+		IsAdmin            *bool   `json:"is_admin"`
+		Remark             *string `json:"remark"`
 	}
 	UpdateUserNotifySettingRequest {
 		UserId                int64 `json:"user_id" validate:"required"`
@@ -235,6 +235,7 @@ type (
 		Size   int    `form:"size"`
 		UserId *int64 `form:"user_id,omitempty"`
 		Status *uint8 `form:"status,omitempty"`
+		Method *uint8 `form:"method,omitempty"`
 	}
 	GetWithdrawalListResponse {
 		List  []WithdrawalLog `json:"list"`
@@ -109,8 +109,11 @@ type (
 		Rules []string `json:"rules" validate:"required"`
 	}
 	CommissionWithdrawRequest {
-		Amount  int64  `json:"amount"`
-		Content string `json:"content"`
+		Amount    int64  `json:"amount"`
+		Content   string `json:"content"`
+		Method    uint8  `json:"method" validate:"oneof=0 1 2 3"`
+		Account   string `json:"account,omitempty"`
+		QrCodeUrl string `json:"qr_code_url,omitempty"`
 	}
 	WithdrawalLog {
 		Id        int64  `json:"id"`
@@ -119,9 +122,15 @@ type (
 		Content   string `json:"content"`
 		Status    uint8  `json:"status"`
 		Reason    string `json:"reason,omitempty"`
+		Method    uint8  `json:"method"`
+		Account   string `json:"account"`
+		QrCodeUrl string `json:"qr_code_url"`
 		CreatedAt int64  `json:"created_at"`
 		UpdatedAt int64  `json:"updated_at"`
 	}
+	CancelWithdrawalRequest {
+		WithdrawalId int64 `json:"withdrawal_id" validate:"required,gt=0"`
+	}
 	QueryWithdrawalLogListRequest {
 		Page int `form:"page"`
 		Size int `form:"size"`
@@ -352,6 +361,10 @@ service ppanel {
 	@handler CommissionWithdraw
 	post /commission_withdraw (CommissionWithdrawRequest) returns (WithdrawalLog)

+	@doc "Cancel pending withdrawal"
+	@handler CancelWithdrawal
+	post /withdrawal_cancel (CancelWithdrawalRequest) returns (WithdrawalLog)
+
 	@doc "Query Withdrawal Log"
 	@handler QueryWithdrawalLog
 	get /withdrawal_log (QueryWithdrawalLogListRequest) returns (QueryWithdrawalLogListResponse)
@@ -0,0 +1,358 @@
+# PPanel 日本东京区 AWS 部署说明
+
+本目录用于在 **AWS 日本东京区 `ap-northeast-1`** 重建一套全新生产环境，并承接当前香港区 `ap-east-1` 的正式迁移。
+
+如果你要看“当前已经真实跑起来的东京架构”，优先看：
+
+- [`ops/hifast-current-architecture-zh.md`](/Users/Apple/code_vpn/vpn/ppanel-server/ops/hifast-current-architecture-zh.md)
+- [`configs/resource-inventory.current.md`](./configs/resource-inventory.current.md)
+
+这份 README 更偏向：
+
+- 目标架构
+- 资源规划
+- 部署方法
+- 后续待完成项
+
+目标架构：
+
+`DNS -> ALB -> WAF -> EC2(Nginx + ppanel-server + Redis + observability) -> RDS MySQL`
+
+灾备链路：
+
+`RDS MySQL / EC2 Redis -> 104.238.220.230 外部灾备`
+
+当前仓库内已补充：
+
+- 东京基础设施参数模板：[`configs/aws-jp-infra.env.example`](./configs/aws-jp-infra.env.example)
+- 东京真实实施状态登记：[`configs/resource-inventory.current.md`](./configs/resource-inventory.current.md)
+- 东京底座资源创建脚本：[`../../scripts/aws_jp_create_base_infra.sh`](../../scripts/aws_jp_create_base_infra.sh)
+- 东京资源状态检查脚本：[`../../scripts/aws_jp_describe_state.sh`](../../scripts/aws_jp_describe_state.sh)
+- MySQL 备份脚本：[`../../scripts/mysql_backup_to_s3.sh`](../../scripts/mysql_backup_to_s3.sh)
+- 10 分钟 MySQL 备份定时器安装脚本：[`../../scripts/install_mysql_backup_timer.sh`](../../scripts/install_mysql_backup_timer.sh)
+
+## 1. 资源清单
+
+按下面顺序创建资源：
+
+1. VPC
+2. 2 个公有子网 + 2 个私有子网
+3. Internet Gateway
+4. 公有 / 私有路由表
+5. 安全组
+6. RDS MySQL
+7. EC2 本机 Redis Docker
+8. EC2
+9. ACM 证书
+10. ALB + Target Group
+11. WAF Web ACL
+12. 东京平行环境域名
+13. 东京 S3 备份桶
+
+建议命名：
+
+- VPC: `ppanel-jp-prod`
+- EC2: `ppanel-app-jp-01`
+- RDS: `ppanel-mysql-jp`
+- Redis container: `hifast-redis`
+- ALB: `ppanel-alb-jp`
+- WAF: `ppanel-waf-jp`
+- S3: `hifast-prod-backups-200810848252-ap-northeast-1`
+
+## 2. 默认规格
+
+### EC2
+
+- Region: `ap-northeast-1`
+- OS: Ubuntu 24.04 LTS
+- Instance type: `t4g.large`
+- Disk: `gp3 80GB`
+- Public subnet: 是
+- IAM Role:
+  - 允许读取 CloudWatch / SSM（如使用）
+  - 如果要在东京 EC2 上执行 S3 备份：额外允许写入东京备份桶
+
+### RDS MySQL
+
+- Engine: `MySQL 8.4`
+- Class: `db.r7g.xlarge`
+- Storage: `gp3 100GB`
+- DB name: `hifast`
+- Username: `admin`
+- Public access: `Yes`
+- Charset: `utf8mb4`
+- Backup retention: `7-14 days`
+- Deletion protection: `On`
+- Multi-AZ: `Yes`（当前按 2 实例 Multi-AZ 创建）
+
+说明：
+
+- 当前东京 RDS 需要允许 `104.238.220.230` 从公网直连 `3306`，用于外部 MySQL 从库复制
+- 因此本阶段 RDS 使用 `public subnet group + Publicly accessible = Yes`
+- 访问面只通过 `sg-rds` 严格限制到业务 EC2 安全组和 `104.238.220.230/32`
+
+### Redis
+
+- 部署位置：业务 EC2 本机
+- 部署方式：Docker
+- 版本：`redis:8.2.1`
+- 监听：`0.0.0.0:6379`
+- 应用连接：`127.0.0.1:6379`
+- 安全组：仅对白名单备用节点 `104.238.220.230/32` 或同机应用开放
+
+## 3. 网络与安全组
+
+### 子网布局
+
+- `public-a`, `public-c`: ALB / EC2
+- `private-a`, `private-c`: RDS
+
+说明：
+
+- 东京优先使用 `ap-northeast-1a` 和 `ap-northeast-1c`
+- 如果账户映射不同，也可以用任意 2 个可用区，但公私网必须各 2 个子网
+
+### 安全组建议
+
+#### `sg-alb`
+
+- Inbound
+  - `80/tcp` from `0.0.0.0/0`
+  - `443/tcp` from `0.0.0.0/0`
+- Outbound
+  - `80/tcp` to `sg-ec2`
+
+#### `sg-ec2`
+
+- Inbound
+  - `80/tcp` from `sg-alb`
+  - `22/tcp` from `你的固定运维 IP`
+  - `6379/tcp` from `104.238.220.230/32`
+- Outbound
+  - all
+
+说明：
+
+- 应用容器监听 `127.0.0.1:8080`
+- EC2 对外只让 Nginx 监听 `80`
+- Grafana / Prometheus / Tempo 仅监听 `127.0.0.1`
+
+#### `sg-rds`
+
+- Inbound
+  - `3306/tcp` from `sg-ec2`
+  - `3306/tcp` from `104.238.220.230/32`
+
+## 4. ALB / Target Group / 健康检查
+
+### Target Group
+
+- Type: `Instance`
+- Protocol: `HTTP`
+- Port: `80`
+- Health check path: `/v1/common/heartbeat`
+- Success code: `200`
+
+### ALB 监听器
+
+- `80` -> redirect to `443`
+- `443` -> forward 到 target group
+
+### ACM
+
+- 在 `ap-northeast-1` 重新申请证书
+- 先给平行环境域名，例如：
+  - `api-jp.hifast.biz`
+  - `logs-jp.hifast.biz`
+
+## 5. WAF 规则
+
+首版至少启用：
+
+1. `AWSManagedRulesCommonRuleSet`
+2. `AWSManagedRulesKnownBadInputsRuleSet`
+3. `AWSManagedRulesAmazonIpReputationList`
+4. 全站 rate-based rule
+5. 针对高风险路径的 rate-based rule
+
+建议的第一版限流：
+
+- 全站：每 IP `2000 / 5 分钟`
+- `/v1/public/user/subscribe`：每 IP `300 / 5 分钟`
+- 登录 / 注册 / 验证码接口：每 IP `100 / 5 分钟`
+
+节点上报接口建议后续补：
+
+- `/v1/server/status`
+- `/v1/server/online`
+- `/v1/server/traffic`
+
+## 6. EC2 文件落地
+
+在 EC2 上建议使用：
+
+- 应用目录：`/opt/ppanel`
+- Nginx 配置：`/etc/nginx/sites-available/ppanel-api.conf`
+
+需要上传这些文件 / 目录：
+
+- `docker-compose.cloud.yml`
+- `deploy/aws/ap-northeast-1/configs/ppanel.yaml.example` -> 重命名为 `configs/ppanel.yaml`
+- `deploy/aws/ap-northeast-1/nginx/ppanel-api.conf`
+- `grafana/`
+- `loki/`
+- `prometheus/`
+- `tempo/`
+- `.env.example` -> 重命名为 `.env`
+
+目标目录示例：
+
+```text
+/opt/ppanel/
+  docker-compose.cloud.yml
+  .env
+  configs/ppanel.yaml
+  grafana/
+  loki/
+  prometheus/
+  tempo/
+  logs/
+  cache/
+  tempo_data/
+```
+
+## 7. 应用配置
+
+基线模板见：
+
+- [`configs/ppanel.yaml.example`](./configs/ppanel.yaml.example)
+- [`nginx/ppanel-api.conf`](./nginx/ppanel-api.conf)
+
+关键值必须替换：
+
+- `MySQL.Addr`
+- `MySQL.Password`
+- `Redis.Host`
+- `Redis.Pass`
+- `JwtAuth.AccessSecret`
+- `Administrator.Email`
+- `Administrator.Password`
+- `AppSignature.AppSecrets.*`
+- `device.security_secret`
+- `Site.Host`
+- `Site.SiteName`
+
+Redis 约定保持不变：
+
+- 业务缓存：DB `0`
+- Asynq：DB `5`
+
+## 8. 部署步骤
+
+### 8.0 创建东京基础设施
+
+如果本机或跳板机已经配置好 AWS CLI 凭据，可以先直接执行：
+
+```bash
+cp deploy/aws/ap-northeast-1/configs/aws-jp-infra.env.example /root/aws-jp-infra.env
+chmod 600 /root/aws-jp-infra.env
+vim /root/aws-jp-infra.env
+
+chmod +x deploy/scripts/aws_jp_create_base_infra.sh
+bash deploy/scripts/aws_jp_create_base_infra.sh /root/aws-jp-infra.env
+```
+
+执行后可用下面命令随时核对东京底座状态：
+
+```bash
+chmod +x deploy/scripts/aws_jp_describe_state.sh
+bash deploy/scripts/aws_jp_describe_state.sh /root/aws-jp-infra.env
+```
+
+### 8.1 初始化 EC2
+
+把脚本上传到东京 EC2 后执行：
+
+```bash
+chmod +x deploy/scripts/bootstrap_aws_ec2.sh
+sudo APP_DIR=/opt/ppanel APP_USER=ubuntu deploy/scripts/bootstrap_aws_ec2.sh
+```
+
+### 8.2 安装 Nginx 配置
+
+```bash
+sudo cp deploy/aws/ap-northeast-1/nginx/ppanel-api.conf /etc/nginx/sites-available/ppanel-api.conf
+sudo ln -sf /etc/nginx/sites-available/ppanel-api.conf /etc/nginx/sites-enabled/ppanel-api.conf
+sudo nginx -t
+sudo systemctl reload nginx
+```
+
+### 8.3 启动容器
+
+```bash
+cd /opt/ppanel
+docker compose -f docker-compose.cloud.yml up -d
+```
+
+### 8.4 预检
+
+```bash
+chmod +x deploy/scripts/preflight_aws_jp.sh
+APP_DIR=/opt/ppanel \
+RDS_HOST=<TOKYO_RDS_ENDPOINT> \
+REDIS_HOST=127.0.0.1 \
+deploy/scripts/preflight_aws_jp.sh
+```
+
+## 9. 数据迁移与切换
+
+正式迁移请按：
+
+- [`ops/hifast-aws-jp-migration-runbook-zh.md`](/Users/Apple/code_vpn/vpn/ppanel-server/ops/hifast-aws-jp-migration-runbook-zh.md)
+
+执行。
+
+核心原则：
+
+- 先搭平行环境
+- 停机后再导出香港主数据
+- 东京验收通过后再切正式域名
+- 切换后再重挂 `104` 灾备
+
+## 10. 104 灾备节点常用模板
+
+如果迁移完成后要把 `104.238.220.230` 重挂为东京主站从库，可复用：
+
+- [`deploy/scripts/hifast_mysql_seed_primary_and_replica.sh`](/Users/Apple/code_vpn/vpn/ppanel-server/deploy/scripts/hifast_mysql_seed_primary_and_replica.sh)
+- [`deploy/scripts/hifast_mysql_attach_replica.sh`](/Users/Apple/code_vpn/vpn/ppanel-server/deploy/scripts/hifast_mysql_attach_replica.sh)
+- [`deploy/scripts/hifast_redis_attach_replica.sh`](/Users/Apple/code_vpn/vpn/ppanel-server/deploy/scripts/hifast_redis_attach_replica.sh)
+- [`deploy/scripts/hifast_data_sync_tool.sh`](/Users/Apple/code_vpn/vpn/ppanel-server/deploy/scripts/hifast_data_sync_tool.sh)
+- [`configs/replica-ops.env.example`](./configs/replica-ops.env.example)
+
+## 11. 东京资源创建前置检查
+
+在 AWS 控制台里至少先确认：
+
+- 东京区已启用
+- `ap-northeast-1` 可创建 `t4g.large`
+- `ap-northeast-1` RDS 可创建 `db.r7g.xlarge`
+- ACM / ALB / WAF / S3 服务在东京区可正常使用
+- Tokyo 对应配额满足：
+  - On-Demand Standard vCPU
+  - ALB 数量
+  - Elastic IP（如需）
+  - RDS 实例数
+
+## 12. 当前已知真实进度
+
+截至 `2026-05-20`，已知状态如下：
+
+- 东京 VPC `ppanel-jp-prod` 已创建
+- VPC ID: `vpc-0846b23b4a7d64eac`
+- VPC CIDR: `10.20.0.0/16`
+- 4 个子网在 AWS 控制台里曾填写完成，但提交时控制台 session 失效
+- 因此：
+  - 子网是否真正创建成功，需要重新核实
+  - IGW / 路由表 / 安全组 / RDS / EC2 / ALB / WAF 都应按“未完成”处理，重新复核
+
+实时状态请以后续更新的 [`configs/resource-inventory.current.md`](./configs/resource-inventory.current.md) 为准。
@@ -0,0 +1,55 @@
+AWS_REGION=ap-northeast-1
+AWS_ACCOUNT_ID=200810848252
+
+VPC_NAME=ppanel-jp-prod
+VPC_ID=
+VPC_CIDR=10.20.0.0/16
+
+PUBLIC_SUBNET_A_NAME=ppanel-jp-public-a
+PUBLIC_SUBNET_A_AZ=ap-northeast-1a
+PUBLIC_SUBNET_A_CIDR=10.20.0.0/24
+
+PUBLIC_SUBNET_C_NAME=ppanel-jp-public-c
+PUBLIC_SUBNET_C_AZ=ap-northeast-1c
+PUBLIC_SUBNET_C_CIDR=10.20.1.0/24
+
+PRIVATE_SUBNET_A_NAME=ppanel-jp-private-a
+PRIVATE_SUBNET_A_AZ=ap-northeast-1a
+PRIVATE_SUBNET_A_CIDR=10.20.10.0/24
+
+PRIVATE_SUBNET_C_NAME=ppanel-jp-private-c
+PRIVATE_SUBNET_C_AZ=ap-northeast-1c
+PRIVATE_SUBNET_C_CIDR=10.20.11.0/24
+
+IGW_NAME=ppanel-jp-igw
+PUBLIC_ROUTE_TABLE_NAME=ppanel-jp-public-rt
+PRIVATE_ROUTE_TABLE_NAME=ppanel-jp-private-rt
+
+SG_ALB_NAME=ppanel-jp-sg-alb
+SG_EC2_NAME=ppanel-jp-sg-ec2
+SG_RDS_NAME=ppanel-jp-sg-rds
+
+OPS_SSH_CIDR=CHANGE_ME_TO_YOUR_FIXED_PUBLIC_IP_OR_CIDR
+DR_REPLICA_IP=104.238.220.230/32
+
+EC2_NAME=ppanel-app-jp-01
+EC2_AMI_FAMILY=ubuntu-24.04
+EC2_INSTANCE_TYPE=t4g.large
+EC2_DISK_GB=80
+EC2_KEY_PAIR=CHANGE_ME
+
+RDS_IDENTIFIER=ppanel-mysql-jp
+RDS_DB_NAME=hifast
+RDS_ADMIN_USER=admin
+RDS_INSTANCE_CLASS=db.r7g.xlarge
+RDS_STORAGE_GB=100
+
+ALB_NAME=ppanel-alb-jp
+TARGET_GROUP_NAME=ppanel-tg-jp
+WAF_NAME=ppanel-waf-jp
+
+PARALLEL_API_DOMAIN=api-jp.hifast.biz
+PARALLEL_LOGS_DOMAIN=logs-jp.hifast.biz
+PRODUCTION_API_DOMAIN=CHANGE_ME
+
+S3_BACKUP_BUCKET=hifast-prod-backups-200810848252-ap-northeast-1
@@ -0,0 +1,19 @@
+AWS_REGION=ap-northeast-1
+S3_BUCKET=hifast-prod-backups-200810848252-ap-northeast-1
+S3_PREFIX=mysql
+BACKUP_DIR=/var/backups/hifast
+HOST_TAG=104-standby-for-jp
+KEEP_LOCAL_DAYS=3
+CHECK_REPLICA=1
+
+MYSQL_HOST=127.0.0.1
+MYSQL_PORT=3306
+MYSQL_USER=backup_reader
+MYSQL_PASSWORD=CHANGE_ME
+MYSQL_SOCKET=
+MYSQL_DATABASE=hifast
+
+REDIS_HOST=127.0.0.1
+REDIS_PORT=6379
+REDIS_PASSWORD=CHANGE_ME
+
@@ -0,0 +1,21 @@
+PRIMARY_HOST=ppanel-mysql-jp.<CHANGE_ME>.ap-northeast-1.rds.amazonaws.com
+PRIMARY_PORT=3306
+PRIMARY_USER=admin
+PRIMARY_PASSWORD=CHANGE_ME
+PRIMARY_DB=hifast
+
+PRIMARY_REPL_USER=repl
+PRIMARY_REPL_PASSWORD=CHANGE_ME
+PRIMARY_REPL_HOST=104.238.220.230
+PRIMARY_BINLOG_RETENTION_HOURS=24
+
+REPLICA_HOST=127.0.0.1
+REPLICA_PORT=3306
+REPLICA_USER=root
+REPLICA_PASSWORD=
+REPLICA_SOCKET=/var/run/mysqld/mysqld.sock
+REPLICA_DB=hifast
+REPLICA_SOURCE_SSL=1
+
+DUMP_FILE=
+
@@ -0,0 +1,112 @@
+Host: 0.0.0.0
+Port: 8080
+Debug: false
+
+JwtAuth:
+  AccessSecret: CHANGE_ME_TO_A_LONG_RANDOM_SECRET
+  AccessExpire: 604800
+
+Logger:
+  ServiceName: PPanel
+  Mode: console
+  Encoding: plain
+  TimeFormat: "2006-01-02 15:04:05.000"
+  Path: logs
+  Level: info
+  MaxContentLength: 0
+  Compress: false
+  Stat: true
+  KeepDays: 7
+  StackCooldownMillis: 100
+  MaxBackups: 7
+  MaxSize: 100
+  Rotation: daily
+  FileTimeFormat: "2006-01-02T15:04:05.000Z07:00"
+
+MySQL:
+  Addr: YOUR_TOKYO_RDS_ENDPOINT:3306
+  Dbname: hifast
+  Username: admin
+  Password: CHANGE_ME_TO_TOKYO_RDS_PASSWORD
+  Config: charset=utf8mb4&parseTime=true&loc=Asia%2FTokyo
+  MaxIdleConns: 10
+  MaxOpenConns: 100
+  SlowThreshold: 1000
+
+Redis:
+  Host: 127.0.0.1:6379
+  Pass: CHANGE_ME_TO_TOKYO_REDIS_PASSWORD
+  DB: 0
+  PoolSize: 100
+  MinIdleConns: 10
+  MaxRetries: 3
+  PoolTimeout: 4
+  IdleTimeout: 300
+  MaxConnAge: 0
+  DialTimeout: 5
+  ReadTimeout: 3
+  WriteTimeout: 3
+
+Trace:
+  Name: ppanel-server
+  Endpoint: 127.0.0.1:4317
+  Sampler: 0.1
+  Batcher: otlpgrpc
+
+Site:
+  Host: api-jp.hifast.biz
+  SiteName: HiFastVPN
+
+Administrator:
+  Email: admin@example.com
+  Password: CHANGE_ME_TO_STRONG_ADMIN_PASSWORD
+
+Telegram:
+  Enable: false
+  BotID: 0
+  BotName: ""
+  BotToken: ""
+  GroupChatID: ""
+  EnableNotify: false
+  WebHookDomain: ""
+
+Kutt:
+  Enable: false
+  ApiURL: ""
+  ApiKey: ""
+  TargetURL: ""
+  Domain: ""
+
+OpenInstall:
+  Enable: false
+  AppKey: ""
+  ApiKey: ""
+
+Loki:
+  Enable: true
+  URL: "http://localhost:3100"
+
+AppSignature:
+  AppSecrets:
+    android-client: CHANGE_ME_ANDROID_SIGNATURE_SECRET
+    ios-client: CHANGE_ME_IOS_SIGNATURE_SECRET
+    web-client: CHANGE_ME_WEB_SIGNATURE_SECRET
+  ValidWindowSeconds: 300
+  SkipPrefixes:
+    - /v1/notify/
+    - /v1/iap/notifications
+    - /v1/telegram/webhook
+    - /v1/subscribe/config
+
+Signature:
+  EnableSignature: false
+
+device:
+  enable: true
+  security_secret: CHANGE_ME_DEVICE_SECURITY_SECRET
+
+Register:
+  EnableTrial: true
+  EnableTrialEmailWhitelist: true
+  TrialEmailDomainWhitelist: "gmail.com,outlook.com,icloud.com,qq.com,163.com"
+
@@ -0,0 +1,23 @@
+MYSQL_HOST=127.0.0.1
+MYSQL_PORT=3306
+MYSQL_USER=root
+MYSQL_PASSWORD=CHANGE_ME
+MYSQL_SOCKET=
+
+REPL_SOURCE_HOST=ppanel-mysql-jp.cpo0keikgh80.ap-northeast-1.rds.amazonaws.com
+REPL_SOURCE_PORT=3306
+REPL_SOURCE_USER=repl
+REPL_SOURCE_PASSWORD=XwWrQGVWtxmXJ3etHmkFvnRSD54MKYer
+REPL_SOURCE_SSL=1
+REPL_SOURCE_LOG_FILE=mysql-bin-changelog.000189
+REPL_SOURCE_LOG_POS=185053
+REPL_SOURCE_AUTO_POSITION=1
+
+REDIS_HOST=127.0.0.1
+REDIS_PORT=6379
+REDIS_PASSWORD=CHANGE_ME
+
+REDIS_SOURCE_HOST=3.114.29.208
+REDIS_SOURCE_PORT=6379
+REDIS_SOURCE_USER=
+REDIS_SOURCE_PASSWORD=hifast67yj
@@ -0,0 +1,187 @@
+# Tokyo Resource Inventory
+
+最后更新：`2026-05-21`
+
+这个文件记录当前东京迁移的真实实施状态，不是示例。
+
+## Region
+
+- AWS account: `hifastvpn (200810848252)`
+- Region: `ap-northeast-1`
+
+## Current Status
+
+- 东京迁移方案已在仓库内落地为执行资产
+- 东京 VPC 已创建
+- 东京子网、IGW、路由表已在 AWS 控制台创建并复核
+- 东京三层安全组已在 AWS 控制台创建并复核
+- 东京 VPC DNS 开关已开启，可支持公网可访问 RDS
+- 东京 S3 备份桶已在 AWS 控制台创建并复核
+- 东京 ACM 证书请求已创建，等待 DNS 验证
+- 东京 RDS MySQL 已创建完成并可用
+- 东京业务 EC2 已创建完成并绑定固定 EIP
+- 因当前本机没有可用 AWS CLI 凭据，云上资源状态仍需在 AWS 控制台或已登录环境中复查
+
+## Networking
+
+- VPC
+  - Name: `ppanel-jp-prod`
+  - VPC ID: `vpc-0846b23b4a7d64eac`
+  - CIDR: `10.20.0.0/16`
+  - Status: `created`
+- Public subnet A
+  - Name: `ppanel-jp-public-a`
+  - AZ: `ap-northeast-1a`
+  - CIDR: `10.20.0.0/24`
+  - Subnet ID: `subnet-091232bdb53e71490`
+  - Status: `created`
+- Public subnet C
+  - Name: `ppanel-jp-public-c`
+  - AZ: `ap-northeast-1c`
+  - CIDR: `10.20.1.0/24`
+  - Subnet ID: `subnet-01ba0975c525ce8cf`
+  - Status: `created`
+- Private subnet A
+  - Name: `ppanel-jp-private-a`
+  - AZ: `ap-northeast-1a`
+  - CIDR: `10.20.10.0/24`
+  - Subnet ID: `subnet-0bd13111c02f0edbe`
+  - Status: `created`
+- Private subnet C
+  - Name: `ppanel-jp-private-c`
+  - AZ: `ap-northeast-1c`
+  - CIDR: `10.20.11.0/24`
+  - Subnet ID: `subnet-0d86c5c756dbc84b2`
+  - Status: `created`
+- Internet Gateway
+  - Name: `ppanel-jp-igw`
+  - IGW ID: `igw-028041bcbf63b672c`
+  - Status: `created`
+- Public route table
+  - Name: `ppanel-jp-public-rt`
+  - Route Table ID: `rtb-061b101080e4800e5`
+  - Default route: `0.0.0.0/0 -> igw-028041bcbf63b672c`
+  - Status: `created`
+- Private route table
+  - Name: `ppanel-jp-private-rt`
+  - Route Table ID: `rtb-0d7a191a515031c45`
+  - Status: `created`
+
+## Security
+
+- `sg-alb`
+  - Name: `ppanel-jp-sg-alb`
+  - Security Group ID: `sg-0b3a23c31041a5a5a`
+  - Inbound:
+    - `80/tcp <- 0.0.0.0/0`
+    - `443/tcp <- 0.0.0.0/0`
+  - Status: `created`
+- `sg-ec2`
+  - Name: `ppanel-jp-sg-ec2`
+  - Security Group ID: `sg-01f2a5a81e7505c91`
+  - Inbound:
+    - `80/tcp <- sg-0b3a23c31041a5a5a`
+    - `22/tcp <- 64.118.144.142/32`
+    - `6379/tcp <- 104.238.220.230/32`
+  - Status: `created`
+- `sg-rds`
+  - Name: `ppanel-jp-sg-rds`
+  - Security Group ID: `sg-0b71db1e2c18b57c0`
+  - Inbound:
+    - `3306/tcp <- sg-01f2a5a81e7505c91`
+    - `3306/tcp <- 104.238.220.230/32`
+  - Status: `created`
+
+## Compute / Database / Edge
+
+- EC2 `ppanel-app-jp-01`:
+  - Instance ID: `i-07839130074cd7ed9`
+  - Type: `c7i.xlarge`
+  - Platform: `Ubuntu 26.04 / Linux`
+  - AZ: `ap-northeast-1c`
+  - VPC: `ppanel-jp-prod (vpc-0846b23b4a7d64eac)`
+  - Subnet: `ppanel-jp-public-c (subnet-01ba0975c525ce8cf)`
+  - Private IP: `10.20.1.168`
+  - Public IP / Elastic IP: `3.114.29.208`
+  - Public DNS: `ec2-3-114-29-208.ap-northeast-1.compute.amazonaws.com`
+  - Security group: `ppanel-jp-sg-ec2 (sg-01f2a5a81e7505c91)`
+  - Key pair: `ppanel-jp-key-20260521`
+  - Root volume: `gp3 100GiB`
+  - ENI: `eni-08accb427a470c9f7`
+  - EIP allocation ID: `eipalloc-038b32d5c0119accf`
+  - EIP association ID: `eipassoc-09184aa9161b6a4d9`
+  - Status: `running`
+  - SSH recovery private key: `deploy/aws/ap-northeast-1/keys/ppanel-jp-recovery`
+  - SSH recovery public key: `deploy/aws/ap-northeast-1/keys/ppanel-jp-recovery.pub`
+- RDS subnet group:
+  - Name: `ppanel-jp-rds-subnet-group`
+  - VPC: `vpc-0846b23b4a7d64eac`
+  - Subnets:
+    - `subnet-0bd13111c02f0edbe` / `ppanel-jp-private-a`
+    - `subnet-0d86c5c756dbc84b2` / `ppanel-jp-private-c`
+  - Status: `created`
+- RDS public subnet group:
+  - Name: `ppanel-jp-rds-public-subnet-group`
+  - VPC: `vpc-0846b23b4a7d64eac`
+  - Subnets:
+    - `subnet-091232bdb53e71490` / `ppanel-jp-public-a`
+    - `subnet-01ba0975c525ce8cf` / `ppanel-jp-public-c`
+  - Status: `created`
+- RDS `ppanel-mysql-jp`:
+  - Engine: `MySQL Community 8.4.8`
+  - Class: `db.r7g.xlarge`
+  - Storage: `gp3 100GiB`
+  - Deployment: `Single instance (current actual state)`
+  - VPC: `ppanel-jp-prod (vpc-0846b23b4a7d64eac)`
+  - Subnet group: `ppanel-jp-rds-public-subnet-group`
+  - Security group: `ppanel-jp-sg-rds (sg-0b71db1e2c18b57c0)`
+  - Master username: `admin`
+  - Credential management: `self-managed`
+  - Secrets Manager managed password: `disabled`
+  - Current master password visibility: `not retrievable from AWS console; reset only`
+  - Public access: `enabled (set at creation time for external replication)`
+  - Status: `available`
+  - Endpoint: `ppanel-mysql-jp.cpo0keikgh80.ap-northeast-1.rds.amazonaws.com`
+  - Public IP (resolved via public DNS): `52.196.204.186`
+  - Connection test from Tokyo EC2:
+    - `mysql -h ppanel-mysql-jp.cpo0keikgh80.ap-northeast-1.rds.amazonaws.com -u admin -e "select 1"`
+    - Result: `ERROR 1045 (28000): Access denied for user 'admin'@'ip-10-20-1-168.ap-northeast-1.compute.internal' (using password: NO)`
+    - Meaning: `network path and security group are working; only the password is missing`
+  - Current admin password: `TkyRds20260521!N9mQ8sKe2vLp7Xa`
+  - External replica prep for `104.238.220.230`:
+    - binlog retention hours: `24`
+    - replication user: `repl@104.238.220.230`
+    - replication password: `XwWrQGVWtxmXJ3etHmkFvnRSD54MKYer`
+    - current binlog file: `mysql-bin-changelog.000189`
+    - current binlog position: `185053`
+- ALB `ppanel-alb-jp`: `not created`
+- WAF `ppanel-waf-jp`: `not created`
+- ACM certificate in `ap-northeast-1`:
+  - Certificate ID: `29d0b9b6-ab37-44d9-ad9e-18fa7e9aae3a`
+  - Domains:
+    - `api-jp.hifast.biz`
+    - `logs-jp.hifast.biz`
+  - Status: `pending_validation`
+  - Route 53 hosted zone in current AWS account: `not found`
+- S3 backup bucket `hifast-prod-backups-200810848252-ap-northeast-1`: `created`
+
+## Domains
+
+- Parallel API domain: `api-jp.hifast.biz`
+- Parallel logs domain: `logs-jp.hifast.biz`
+- Production API domain: `pending user final confirmation`
+- ACM DNS validation records pending external DNS add:
+  - `api-jp.hifast.biz`
+    - Name: `_0de5970dfbadaf46759447b2ea627a10.api-jp.hifast.biz.`
+    - Type: `CNAME`
+    - Value: `_6a632a5b85c5b3f304cc492090b741b3.jkddzztszm.acm-validations.aws.`
+  - `logs-jp.hifast.biz`
+    - Name: `_349a2b2bc4678d76c3ab341ccf73db61.logs-jp.hifast.biz.`
+    - Type: `CNAME`
+    - Value: `_74ced20dc96aa39070188605cf0ced18.jkddzztszm.acm-validations.aws.`
+
+## DR
+
+- DR host: `104.238.220.230`
+- Planned MySQL upstream after cutover: `Tokyo RDS`
+- Planned Redis upstream after cutover: `Tokyo EC2 public IP`
@@ -0,0 +1,69 @@
+# Tokyo Resource Inventory Example
+
+Use this file as the single source of truth while building the Tokyo environment.
+
+## Region
+
+- AWS account: `hifastvpn (200810848252)`
+- Region: `ap-northeast-1`
+
+## DNS
+
+- Production API domain: `CHANGE_ME`
+- Parallel API domain: `api-jp.hifast.biz`
+- Parallel logs domain: `logs-jp.hifast.biz`
+
+## Networking
+
+- VPC name: `ppanel-jp-prod`
+- VPC CIDR: `10.20.0.0/16`
+- Public subnet A: `10.20.0.0/24`
+- Public subnet C: `10.20.1.0/24`
+- Private subnet A: `10.20.10.0/24`
+- Private subnet C: `10.20.11.0/24`
+- Ops CIDR for SSH: `CHANGE_ME`
+
+## Compute
+
+- EC2 name: `ppanel-app-jp-01`
+- EC2 type: `t4g.large`
+- EC2 disk: `gp3 80GB`
+- SSH key pair: `CHANGE_ME`
+
+## Database
+
+- RDS identifier: `ppanel-mysql-jp`
+- RDS engine: `MySQL 8.4`
+- RDS class: `db.r7g.xlarge`
+- RDS storage: `gp3 100GB`
+- DB name: `hifast`
+- DB admin user: `admin`
+
+## Cache
+
+- Redis container: `hifast-redis`
+- Redis port: `6379`
+- Redis password: `CHANGE_ME`
+
+## Security / Secrets
+
+- JWT secret: `CHANGE_ME`
+- Admin email: `CHANGE_ME`
+- Admin password: `CHANGE_ME`
+- Android app signature secret: `CHANGE_ME`
+- iOS app signature secret: `CHANGE_ME`
+- Web app signature secret: `CHANGE_ME`
+- Device security secret: `CHANGE_ME`
+
+## Backup
+
+- S3 backup bucket: `hifast-prod-backups-200810848252-ap-northeast-1`
+- Versioning: `Enabled`
+
+## DR
+
+- DR host: `104.238.220.230`
+- MySQL repl user: `repl`
+- MySQL repl password: `CHANGE_ME`
+- Redis source password: `CHANGE_ME`
+
@@ -0,0 +1,7 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
+QyNTUxOQAAACBsJxZDjKvaIdVjer3QMHRYw43wkVnzHurA2TQqHlr1YwAAAKBaQXT3WkF0
+9wAAAAtzc2gtZWQyNTUxOQAAACBsJxZDjKvaIdVjer3QMHRYw43wkVnzHurA2TQqHlr1Yw
+AAAEArWQWWwPoJp+za5JhSnrE0Pw1/TtqWRrdY5e8hULqYDGwnFkOMq9oh1WN6vdAwdFjD
+jfCRWfMe6sDZNCoeWvVjAAAAF0FwcGxlQE1hY0Jvb2stUHJvLmxvY2FsAQIDBAUG
+-----END OPENSSH PRIVATE KEY-----
@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGwnFkOMq9oh1WN6vdAwdFjDjfCRWfMe6sDZNCoeWvVj Apple@MacBook-Pro.local
@@ -0,0 +1,34 @@
+server {
+    listen 80 default_server;
+    listen [::]:80 default_server;
+    server_name _;
+
+    client_max_body_size 20m;
+
+    access_log /var/log/nginx/ppanel-access.log;
+    error_log /var/log/nginx/ppanel-error.log warn;
+
+    location / {
+        proxy_http_version 1.1;
+        proxy_pass http://127.0.0.1:8080;
+
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Forwarded-Host $host;
+        proxy_set_header X-Forwarded-Port $server_port;
+
+        proxy_connect_timeout 10s;
+        proxy_send_timeout 60s;
+        proxy_read_timeout 60s;
+    }
+
+    location = /nginx_status {
+        stub_status;
+        access_log off;
+        allow 127.0.0.1;
+        deny all;
+    }
+}
+
@@ -0,0 +1,17 @@
+[Unit]
+Description=Hifast MySQL backup to S3
+Wants=network-online.target
+After=network-online.target
+
+[Service]
+Type=oneshot
+User=root
+Group=root
+EnvironmentFile=/root/backup-to-s3.env
+ExecStart=/usr/bin/env bash -lc 'exec /opt/ppanel/deploy/scripts/mysql_backup_to_s3.sh'
+Nice=10
+IOSchedulingClass=best-effort
+IOSchedulingPriority=7
+
+[Install]
+WantedBy=multi-user.target
@@ -0,0 +1,11 @@
+[Unit]
+Description=Run Hifast MySQL backup to S3 every 10 minutes
+
+[Timer]
+OnCalendar=*:0/10
+Persistent=true
+RandomizedDelaySec=30
+Unit=hifast-mysql-backup.service
+
+[Install]
+WantedBy=timers.target
@@ -0,0 +1,144 @@
+# 提现接口文档
+
+## 基础信息
+
+| 项目 | 值 |
+|------|-----|
+| Base URL | `/v1/public/user` |
+| 认证方式 | JWT Token（`AuthMiddleware` + `DeviceMiddleware`） |
+| 数据表 | `user_withdrawal` |
+
+## 数据模型
+
+### user_withdrawal 表
+
+| 字段 | 类型 | 说明 |
+|------|------|------|
+| `id` | int64 | 主键 |
+| `user_id` | int64 | 用户 ID |
+| `amount` | int64 | 提现金额（单位：分） |
+| `content` | text | 收款信息（账号、姓名等） |
+| `status` | tinyint | 0=待审核, 1=已通过, 2=已拒绝 |
+| `reason` | varchar(500) | 拒绝原因（通过时为空） |
+| `created_at` | datetime | 创建时间 |
+| `updated_at` | datetime | 更新时间 |
+
+### status 枚举
+
+| 值 | 含义 | 说明 |
+|----|------|------|
+| 0 | Pending（待审核） | 用户提交申请后的初始状态 |
+| 1 | Approved（已通过） | 管理员审核通过，佣金已扣减 |
+| 2 | Rejected（已拒绝） | 管理员拒绝，无需退款（申请时未扣款） |
+
+---
+
+## 用户端接口
+
+### 1. 申请提现
+
+申请佣金提现，创建一条待审核记录。申请时**不扣余额**，管理员审核通过后才扣。
+
+```
+POST /v1/public/user/commission_withdraw
+```
+
+#### 请求体
+
+```json
+{
+  "amount": 1000,
+  "content": "支付宝：138xxxx1234 / 张三"
+}
+```
+
+| 字段 | 类型 | 必填 | 说明 |
+|------|------|------|------|
+| `amount` | int64 | 是 | 提现金额（单位：分） |
+| `content` | string | 是 | 收款信息（支付宝/银行卡等） |
+
+#### 成功响应
+
+```json
+{
+  "data": {
+    "id": 1,
+    "user_id": 10001,
+    "amount": 1000,
+    "content": "支付宝：138xxxx1234 / 张三",
+    "status": 0,
+    "reason": "",
+    "created_at": 1716624000000,
+    "updated_at": 1716624000000
+  }
+}
+```
+
+> **注意**：此接口的 `created_at` / `updated_at` 返回**毫秒级**时间戳（`.UnixMilli()`），与项目其他接口的秒级时间戳不一致。
+
+#### 业务逻辑
+
+1. 查询该用户所有 status=0（待审核）的提现记录，求和得 `pendingTotal`
+2. 校验可用余额：`commission >= amount + pendingTotal`
+3. 创建 `user_withdrawal` 记录，status=0
+4. **不扣减** `user.commission`，等审核通过才扣
+
+#### 错误码
+
+| 错误码 | 常量 | 说明 |
+|--------|------|------|
+| 20010 | `UserCommissionNotEnough` | 可用余额不足（余额 = commission - 所有 pending 提现总额） |
+| 40005 | `InvalidAccess` | 未登录 / Token 无效 |
+
+#### 源码位置
+
+- Handler: `internal/handler/public/user/commissionWithdrawHandler.go`
+- Logic: `internal/logic/public/user/commissionWithdrawLogic.go`
+
+---
+
+### 2. 查询提现记录
+
+分页查询当前用户的提现记录。
+
+```
+GET /v1/public/user/withdrawal_log
+```
+
+#### 请求参数（Query）
+
+| 字段 | 类型 | 必填 | 说明 |
+|------|------|------|------|
+| `page` | int | 否 | 页码 |
+| `size` | int | 否 | 每页数量 |
+
+#### 成功响应
+
+```json
+{
+  "data": {
+    "list": [
+      {
+        "id": 1,
+        "user_id": 10001,
+        "amount": 1000,
+        "content": "支付宝：138xxxx1234",
+        "status": 0,
+        "reason": "",
+        "created_at": 1716624000,
+        "updated_at": 1716624000
+      }
+    ],
+    "total": 1
+  }
+}
+```
+
+#### 源码位置
+
+- Handler: `internal/handler/public/user/queryWithdrawalLogHandler.go`
+- Logic: `internal/logic/public/user/queryWithdrawalLogLogic.go`
+
+> **Warning**: Logic 层尚未实现（仍为 TODO），调用会返回空响应。
+
+---
@@ -40,6 +40,8 @@ services:
    depends_on:
      tempo:
        condition: service_started
+      minio:
+        condition: service_healthy
    logging:
      driver: "json-file"
      options:
@@ -239,6 +241,63 @@ services:
        max-size: "10m"
        max-file: "3"

+  # ----------------------------------------------------
+  # 10. MinIO (测试环境 S3 兼容对象存储)
+  #     仅绑定宿主机 127.0.0.1，供 host 网络的 ppanel-server 访问，不对公网开放。
+  # ----------------------------------------------------
+  minio:
+    image: minio/minio:RELEASE.2025-05-24T17-08-30Z-cpuv1
+    container_name: ppanel-minio
+    restart: always
+    command: server /data --console-address ":9001"
+    environment:
+      MINIO_ROOT_USER: "${MINIO_ROOT_USER:?请在 .env 文件中设置 MINIO_ROOT_USER}"
+      MINIO_ROOT_PASSWORD: "${MINIO_ROOT_PASSWORD:?请在 .env 文件中设置 MINIO_ROOT_PASSWORD}"
+      TZ: Asia/Shanghai
+    volumes:
+      - ./data/minio:/data
+    ports:
+      - "127.0.0.1:9000:9000"
+      - "127.0.0.1:9001:9001"
+    networks:
+      - ppanel_net
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:9000/minio/health/live"]
+      interval: 10s
+      timeout: 5s
+      retries: 6
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "10m"
+        max-file: "3"
+
+  minio-init:
+    image: minio/mc:RELEASE.2025-07-21T05-28-08Z-cpuv1
+    container_name: ppanel-minio-init
+    restart: "no"
+    depends_on:
+      minio:
+        condition: service_healthy
+    environment:
+      MINIO_ROOT_USER: "${MINIO_ROOT_USER:?请在 .env 文件中设置 MINIO_ROOT_USER}"
+      MINIO_ROOT_PASSWORD: "${MINIO_ROOT_PASSWORD:?请在 .env 文件中设置 MINIO_ROOT_PASSWORD}"
+      MINIO_BUCKET: "${MINIO_BUCKET:?请在 .env 文件中设置 MINIO_BUCKET}"
+    entrypoint:
+      - /bin/sh
+      - -c
+      - |
+        set -e
+        mc alias set local http://minio:9000 "$${MINIO_ROOT_USER}" "$${MINIO_ROOT_PASSWORD}"
+        mc mb --ignore-existing "local/$${MINIO_BUCKET}"
+    networks:
+      - ppanel_net
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "10m"
+        max-file: "3"
+
 volumes:
  loki_data:
  grafana_data:
@@ -0,0 +1,4 @@
+ALTER TABLE `withdrawals`
+  DROP COLUMN `qr_code_url`,
+  DROP COLUMN `account`,
+  DROP COLUMN `method`;
@@ -0,0 +1,4 @@
+ALTER TABLE `withdrawals`
+  ADD COLUMN `method`      TINYINT(1)   NOT NULL DEFAULT 0 COMMENT '收款方式 0:其他 1:支付宝 2:微信 3:银行卡' AFTER `content`,
+  ADD COLUMN `account`     VARCHAR(255) NOT NULL DEFAULT '' COMMENT '收款账号' AFTER `method`,
+  ADD COLUMN `qr_code_url` VARCHAR(500) NOT NULL DEFAULT '' COMMENT '收款码图片URL' AFTER `account`;
@@ -0,0 +1,26 @@
+package user
+
+import (
+	"github.com/gin-gonic/gin"
+	"github.com/perfect-panel/server/internal/logic/public/user"
+	"github.com/perfect-panel/server/internal/svc"
+	"github.com/perfect-panel/server/internal/types"
+	"github.com/perfect-panel/server/pkg/result"
+)
+
+// Cancel Withdrawal
+func CancelWithdrawalHandler(svcCtx *svc.ServiceContext) func(c *gin.Context) {
+	return func(c *gin.Context) {
+		var req types.CancelWithdrawalRequest
+		_ = c.ShouldBind(&req)
+		validateErr := svcCtx.Validate(&req)
+		if validateErr != nil {
+			result.ParamErrorResult(c, validateErr)
+			return
+		}
+
+		l := user.NewCancelWithdrawalLogic(c.Request.Context(), svcCtx)
+		resp, err := l.CancelWithdrawal(&req)
+		result.HttpResult(c, resp, err)
+	}
+}
@@ -1059,6 +1059,9 @@ func RegisterHandlers(router *gin.Engine, serverCtx *svc.ServiceContext) {
 		// Commission Withdraw
 		publicUserGroupRouter.POST("/commission_withdraw", publicUser.CommissionWithdrawHandler(serverCtx))

+		// Cancel Withdrawal
+		publicUserGroupRouter.POST("/withdrawal_cancel", publicUser.CancelWithdrawalHandler(serverCtx))
+
 		// Delete Current User Account
 		publicUserGroupRouter.DELETE("/current_user_account", publicUser.DeleteCurrentUserAccountHandler(serverCtx))

@@ -42,6 +42,9 @@ func (l *GetWithdrawalListLogic) GetWithdrawalList(req *types.GetWithdrawalListR
 	if req.Status != nil {
 		query = query.Where("status = ?", *req.Status)
 	}
+	if req.Method != nil {
+		query = query.Where("method = ?", *req.Method)
+	}

 	var total int64
 	if err := query.Count(&total).Error; err != nil {
@@ -62,6 +65,9 @@ func (l *GetWithdrawalListLogic) GetWithdrawalList(req *types.GetWithdrawalListR
 			Content:   row.Content,
 			Status:    row.Status,
 			Reason:    row.Reason,
+			Method:    row.Method,
+			Account:   row.Account,
+			QrCodeUrl: row.QrCodeUrl,
 			CreatedAt: row.CreatedAt.UnixMilli(),
 			UpdatedAt: row.UpdatedAt.UnixMilli(),
 		})
@@ -46,13 +46,13 @@ func (l *UpdateUserBasicInfoLogic) UpdateUserBasicInfo(req *types.UpdateUserBasi
 	}

 	err = l.svcCtx.UserModel.Transaction(l.ctx, func(tx *gorm.DB) error {
-		if userInfo.Balance != req.Balance {
-			change := req.Balance - userInfo.Balance
+		if req.Balance != nil && userInfo.Balance != *req.Balance {
+			change := *req.Balance - userInfo.Balance
 			balanceLog := log.Balance{
 				Type:      log.BalanceTypeAdjust,
 				Amount:    change,
 				OrderNo:   "",
-				Balance:   req.Balance,
+				Balance:   *req.Balance,
 				Timestamp: time.Now().UnixMilli(),
 			}
 			content, _ := balanceLog.Marshal()
@@ -66,14 +66,14 @@ func (l *UpdateUserBasicInfoLogic) UpdateUserBasicInfo(req *types.UpdateUserBasi
 			if err != nil {
 				return err
 			}
-			userInfo.Balance = req.Balance
+			userInfo.Balance = *req.Balance
 		}

-		if userInfo.GiftAmount != req.GiftAmount {
-			change := req.GiftAmount - userInfo.GiftAmount
+		if req.GiftAmount != nil && userInfo.GiftAmount != *req.GiftAmount {
+			change := *req.GiftAmount - userInfo.GiftAmount
 			if change != 0 {
 				var changeType uint16
-				if userInfo.GiftAmount < req.GiftAmount {
+				if userInfo.GiftAmount < *req.GiftAmount {
 					changeType = log.GiftTypeIncrease
 				} else {
 					changeType = log.GiftTypeReduce
@@ -81,7 +81,7 @@ func (l *UpdateUserBasicInfoLogic) UpdateUserBasicInfo(req *types.UpdateUserBasi
 				giftLog := log.Gift{
 					Type:      changeType,
 					Amount:    change,
-					Balance:   req.GiftAmount,
+					Balance:   *req.GiftAmount,
 					Remark:    "Admin adjustment",
 					Timestamp: time.Now().UnixMilli(),
 				}
@@ -96,23 +96,27 @@ func (l *UpdateUserBasicInfoLogic) UpdateUserBasicInfo(req *types.UpdateUserBasi
 				if err != nil {
 					return err
 				}
-				userInfo.GiftAmount = req.GiftAmount
+				userInfo.GiftAmount = *req.GiftAmount
 			}
 		}

-		if req.Commission != userInfo.Commission {
-			if isWithdrawalScene(req.Remark) {
+		if req.Commission != nil && *req.Commission != userInfo.Commission {
+			remark := ""
+			if req.Remark != nil {
+				remark = *req.Remark
+			}
+			if isWithdrawalScene(remark) {
 				logWithdrawalGuard(l.Logger, userInfo.Id)
 				return errors.Wrapf(xerr.NewErrCode(xerr.InvalidAccess), "commission overwrite is blocked in withdrawal scene")
 			}
-			change := req.Commission - userInfo.Commission
+			change := *req.Commission - userInfo.Commission
 			if err = l.svcCtx.UserModel.UpdateCommission(l.ctx, userInfo.Id, change, tx); err != nil {
 				return err
 			}
 			if err = logicCommon.WriteCommissionLog(tx, userInfo.Id, log.CommissionTypeAdjust, change, ""); err != nil {
 				return err
 			}
-			userInfo.Commission = req.Commission
+			userInfo.Commission = *req.Commission
 		}
 		if req.Avatar != "" {
 			userInfo.Avatar = req.Avatar
@@ -120,8 +124,8 @@ func (l *UpdateUserBasicInfoLogic) UpdateUserBasicInfo(req *types.UpdateUserBasi
 		if req.ReferCode != "" {
 			userInfo.ReferCode = req.ReferCode
 		}
-		if req.RefererId != 0 {
-			userInfo.RefererId = req.RefererId
+		if req.RefererId != nil {
+			userInfo.RefererId = *req.RefererId
 		}
 		if req.Enable != nil {
 			userInfo.Enable = req.Enable
@@ -129,8 +133,8 @@ func (l *UpdateUserBasicInfoLogic) UpdateUserBasicInfo(req *types.UpdateUserBasi
 		if req.IsAdmin != nil {
 			userInfo.IsAdmin = req.IsAdmin
 		}
-		if req.Remark != "" {
-			userInfo.Remark = req.Remark
+		if req.Remark != nil {
+			userInfo.Remark = *req.Remark
 		}
 		if req.OnlyFirstPurchase != nil {
 			userInfo.OnlyFirstPurchase = req.OnlyFirstPurchase
@@ -37,9 +37,9 @@ func approveWithdrawal(ctx context.Context, svcCtx *svc.ServiceContext, withdraw
 		}

 		if err := tx.Model(&usermodel.Withdrawal{}).
-			Where("id = ? AND status = 0", withdrawalID).
+			Where("id = ? AND status = ?", withdrawalID, usermodel.WithdrawalStatusPending).
 			Updates(map[string]interface{}{
-				"status": 1,
+				"status": usermodel.WithdrawalStatusApproved,
 				"reason": "",
 			}).Error; err != nil {
 			return errors.Wrapf(xerr.NewErrCode(xerr.DatabaseUpdateError), "approve withdrawal failed: %v", err)
@@ -80,9 +80,9 @@ func rejectWithdrawal(ctx context.Context, svcCtx *svc.ServiceContext, withdrawa
 		// Commission was NOT deducted at application time under the new logic,
 		// so rejection requires no refund — only a status update.
 		return tx.Model(&usermodel.Withdrawal{}).
-			Where("id = ? AND status = 0", withdrawalID).
+			Where("id = ? AND status = ?", withdrawalID, usermodel.WithdrawalStatusPending).
 			Updates(map[string]interface{}{
-				"status": 2,
+				"status": usermodel.WithdrawalStatusRejected,
 				"reason": reason,
 			}).Error
 	})
@@ -41,7 +41,7 @@ func LoadPendingWithdrawalForUpdate(ctx context.Context, tx *gorm.DB, withdrawal
 		First(&withdrawal).Error; err != nil {
 		return nil, err
 	}
-	if withdrawal.Status != 0 {
+	if withdrawal.Status != usermodel.WithdrawalStatusPending {
 		return nil, errors.New("withdrawal status invalid")
 	}
 	return &withdrawal, nil
@@ -0,0 +1,89 @@
+package user
+
+import (
+	"context"
+
+	logicCommon "github.com/perfect-panel/server/internal/logic/common"
+	"github.com/perfect-panel/server/internal/model/log"
+	"github.com/perfect-panel/server/internal/model/user"
+	"github.com/perfect-panel/server/internal/svc"
+	"github.com/perfect-panel/server/internal/types"
+	"github.com/perfect-panel/server/pkg/constant"
+	"github.com/perfect-panel/server/pkg/logger"
+	"github.com/perfect-panel/server/pkg/xerr"
+	"github.com/pkg/errors"
+	"gorm.io/gorm"
+)
+
+type CancelWithdrawalLogic struct {
+	logger.Logger
+	ctx    context.Context
+	svcCtx *svc.ServiceContext
+}
+
+func NewCancelWithdrawalLogic(ctx context.Context, svcCtx *svc.ServiceContext) *CancelWithdrawalLogic {
+	return &CancelWithdrawalLogic{
+		Logger: logger.WithContext(ctx),
+		ctx:    ctx,
+		svcCtx: svcCtx,
+	}
+}
+
+func (l *CancelWithdrawalLogic) CancelWithdrawal(req *types.CancelWithdrawalRequest) (resp *types.WithdrawalLog, err error) {
+	u, ok := l.ctx.Value(constant.CtxKeyUser).(*user.User)
+	if !ok {
+		l.Error("current user is not found in context")
+		return nil, errors.Wrapf(xerr.NewErrCode(xerr.InvalidAccess), "Invalid Access")
+	}
+
+	var withdrawal *user.Withdrawal
+	err = l.svcCtx.DB.WithContext(l.ctx).Transaction(func(tx *gorm.DB) error {
+		var txErr error
+		withdrawal, txErr = logicCommon.LoadPendingWithdrawalForUpdate(l.ctx, tx, req.WithdrawalId)
+		if txErr != nil {
+			if txErr.Error() == "withdrawal status invalid" {
+				return errors.Wrapf(xerr.NewErrCode(xerr.WithdrawalStatusInvalid), "withdrawal %d is not in pending state", req.WithdrawalId)
+			}
+			return errors.Wrapf(xerr.NewErrCode(xerr.DatabaseQueryError), "load withdrawal failed: %v", txErr)
+		}
+
+		if withdrawal.UserId != u.Id {
+			return errors.Wrapf(xerr.NewErrCode(xerr.PermissionDenied), "user %d cannot cancel withdrawal belonging to user %d", u.Id, withdrawal.UserId)
+		}
+
+		if txErr = tx.Model(&user.Withdrawal{}).
+			Where("id = ? AND status = ?", req.WithdrawalId, user.WithdrawalStatusPending).
+			Update("status", user.WithdrawalStatusCancelled).Error; txErr != nil {
+			return errors.Wrapf(xerr.NewErrCode(xerr.DatabaseUpdateError), "cancel withdrawal failed: %v", txErr)
+		}
+
+		if txErr = l.svcCtx.UserModel.UpdateCommission(l.ctx, withdrawal.UserId, withdrawal.Amount, tx); txErr != nil {
+			return errors.Wrapf(xerr.NewErrCode(xerr.DatabaseUpdateError), "refund commission failed: %v", txErr)
+		}
+
+		if txErr = logicCommon.WriteCommissionLog(tx, withdrawal.UserId, log.CommissionTypeWithdrawCancel, withdrawal.Amount, ""); txErr != nil {
+			return errors.Wrapf(xerr.NewErrCode(xerr.DatabaseInsertError), "write commission log failed: %v", txErr)
+		}
+
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	_ = l.svcCtx.UserModel.ClearUserCache(l.ctx, u)
+
+	return &types.WithdrawalLog{
+		Id:        withdrawal.Id,
+		UserId:    withdrawal.UserId,
+		Amount:    withdrawal.Amount,
+		Content:   withdrawal.Content,
+		Status:    user.WithdrawalStatusCancelled,
+		Reason:    "",
+		Method:    withdrawal.Method,
+		Account:   withdrawal.Account,
+		QrCodeUrl: withdrawal.QrCodeUrl,
+		CreatedAt: withdrawal.CreatedAt.UnixMilli(),
+		UpdatedAt: withdrawal.UpdatedAt.UnixMilli(),
+	}, nil
+}
@@ -35,12 +35,28 @@ func (l *CommissionWithdrawLogic) CommissionWithdraw(req *types.CommissionWithdr
 		return nil, errors.Wrapf(xerr.NewErrCode(xerr.InvalidAccess), "Invalid Access")
 	}

+	// Validate payment method fields
+	switch req.Method {
+	case user.WithdrawalMethodAlipay, user.WithdrawalMethodWechat:
+		if req.QrCodeUrl == "" {
+			return nil, errors.Wrapf(xerr.NewErrCode(xerr.InvalidParams), "qr_code_url is required for method %d", req.Method)
+		}
+	case user.WithdrawalMethodBank:
+		if req.Account == "" {
+			return nil, errors.Wrapf(xerr.NewErrCode(xerr.InvalidParams), "account is required for bank transfer")
+		}
+	default: // WithdrawalMethodOther
+		if req.Account == "" && req.Content == "" {
+			return nil, errors.Wrapf(xerr.NewErrCode(xerr.InvalidParams), "account or content is required for other methods")
+		}
+	}
+
 	// Sum all pending (status=0) withdrawals to compute available balance.
 	// Available = commission - pendingTotal; commission is only deducted on approval.
 	var pendingTotal int64
 	if err = l.svcCtx.DB.WithContext(l.ctx).
 		Model(&user.Withdrawal{}).
-		Where("user_id = ? AND status = 0", u.Id).
+		Where("user_id = ? AND status = ?", u.Id, user.WithdrawalStatusPending).
 		Select("COALESCE(SUM(amount), 0)").
 		Scan(&pendingTotal).Error; err != nil {
 		l.Errorf("Failed to query pending withdrawals for user %d: %v", u.Id, err)
@@ -56,11 +72,14 @@ func (l *CommissionWithdrawLogic) CommissionWithdraw(req *types.CommissionWithdr
 	var w user.Withdrawal
 	err = l.svcCtx.DB.WithContext(l.ctx).Transaction(func(tx *gorm.DB) error {
 		w = user.Withdrawal{
-			UserId:  u.Id,
-			Amount:  req.Amount,
-			Content: req.Content,
-			Status:  0,
-			Reason:  "",
+			UserId:    u.Id,
+			Amount:    req.Amount,
+			Content:   req.Content,
+			Status:    user.WithdrawalStatusPending,
+			Reason:    "",
+			Method:    req.Method,
+			Account:   req.Account,
+			QrCodeUrl: req.QrCodeUrl,
 		}
 		return tx.Create(&w).Error
 	})
@@ -70,11 +89,15 @@ func (l *CommissionWithdrawLogic) CommissionWithdraw(req *types.CommissionWithdr
 	}

 	return &types.WithdrawalLog{
+		Id:        w.Id,
 		UserId:    u.Id,
 		Amount:    req.Amount,
 		Content:   req.Content,
-		Status:    0,
+		Status:    user.WithdrawalStatusPending,
 		Reason:    "",
+		Method:    req.Method,
+		Account:   req.Account,
+		QrCodeUrl: req.QrCodeUrl,
 		CreatedAt: w.CreatedAt.UnixMilli(),
 		UpdatedAt: w.UpdatedAt.UnixMilli(),
 	}, nil
@@ -64,6 +64,9 @@ func (l *QueryWithdrawalLogLogic) QueryWithdrawalLog(req *types.QueryWithdrawalL
 			Content:   row.Content,
 			Status:    row.Status,
 			Reason:    row.Reason,
+			Method:    row.Method,
+			Account:   row.Account,
+			QrCodeUrl: row.QrCodeUrl,
 			CreatedAt: row.CreatedAt.UnixMilli(),
 			UpdatedAt: row.UpdatedAt.UnixMilli(),
 		})
@@ -51,6 +51,7 @@ const (
 	CommissionTypeAdjust         uint16 = 335 // Admin Adjust
 	CommissionTypeConvertBalance uint16 = 336 // Convert to Balance
 	CommissionTypeWithdrawReject uint16 = 337 // Withdraw rejected refund
+	CommissionTypeWithdrawCancel uint16 = 338 // 用户取消提现退佣金
 	GiftTypeIncrease             uint16 = 341 // Increase
 	GiftTypeReduce               uint16 = 342 // Reduce
 )
@@ -160,8 +160,8 @@ func (m *customOrderModel) QueryMonthlyOrders(ctx context.Context, date time.Tim
 			Where("status IN ? AND created_at BETWEEN ? AND ? AND method != ?", []int64{2, 5}, firstDay, lastDay, "balance").
 			Select(
 				"SUM(amount) as amount_total, " +
-					"SUM(CASE WHEN type = 1 THEN amount ELSE 0 END) as new_order_amount, " +
-					"SUM(CASE WHEN type = 2 THEN amount ELSE 0 END) as renewal_order_amount",
+					"SUM(CASE WHEN is_new = 1 THEN amount ELSE 0 END) as new_order_amount, " +
+					"SUM(CASE WHEN is_new = 0 THEN amount ELSE 0 END) as renewal_order_amount",
 			).
 			Scan(v).Error
 	})
@@ -177,8 +177,8 @@ func (m *customOrderModel) QueryDateOrders(ctx context.Context, date time.Time)
 			Where("status IN ? AND DATE_FORMAT(created_at, '%Y-%m-%d') = ? AND method != ?", []int64{2, 5}, dateStr, "balance").
 			Select(
 				"SUM(amount) as amount_total, " +
-					"SUM(CASE WHEN type = 1 THEN amount ELSE 0 END) as new_order_amount, " +
-					"SUM(CASE WHEN type = 2 THEN amount ELSE 0 END) as renewal_order_amount",
+					"SUM(CASE WHEN is_new = 1 THEN amount ELSE 0 END) as new_order_amount, " +
+					"SUM(CASE WHEN is_new = 0 THEN amount ELSE 0 END) as renewal_order_amount",
 			).
 			Scan(v).Error
 	})
@@ -192,8 +192,8 @@ func (m *customOrderModel) QueryTotalOrders(ctx context.Context) (OrdersTotal, e
 		return conn.Model(&Order{}).
 			Select(`
 				SUM(amount) AS amount_total,
-				SUM(CASE WHEN type = 1 THEN amount ELSE 0 END) AS new_order_amount,
-				SUM(CASE WHEN type = 2 THEN amount ELSE 0 END) AS renewal_order_amount
+				SUM(CASE WHEN is_new = 1 THEN amount ELSE 0 END) AS new_order_amount,
+				SUM(CASE WHEN is_new = 0 THEN amount ELSE 0 END) AS renewal_order_amount
 			`).
 			Where("status IN ? AND method != ?", []int64{2, 5}, "balance").
 			Scan(&result).Error
@@ -214,8 +214,8 @@ func (m *customOrderModel) QueryMonthlyUserCounts(ctx context.Context, date time
 	err := m.QueryNoCacheCtx(ctx, nil, func(conn *gorm.DB, _ interface{}) error {
 		return conn.Model(&Order{}).
 			Select(`
-				COUNT(DISTINCT CASE WHEN type = 1 THEN user_id END) AS new_users,
-				COUNT(DISTINCT CASE WHEN type = 2 THEN user_id END) AS renewal_users
+				COUNT(DISTINCT CASE WHEN is_new = 1 THEN user_id END) AS new_users,
+				COUNT(DISTINCT CASE WHEN is_new = 0 THEN user_id END) AS renewal_users
 			`).
 			Where("status IN ? AND created_at >= ? AND created_at < ? AND method != ?",
 				[]int64{2, 5}, firstDay, nextMonth, "balance").
@@ -232,8 +232,8 @@ func (m *customOrderModel) QueryDateUserCounts(ctx context.Context, date time.Ti
 	err := m.QueryNoCacheCtx(ctx, nil, func(conn *gorm.DB, _ interface{}) error {
 		return conn.Model(&Order{}).
 			Select(`
-				COUNT(DISTINCT CASE WHEN type = 1 THEN user_id END) AS new_users,
-				COUNT(DISTINCT CASE WHEN type = 2 THEN user_id END) AS renewal_users
+				COUNT(DISTINCT CASE WHEN is_new = 1 THEN user_id END) AS new_users,
+				COUNT(DISTINCT CASE WHEN is_new = 0 THEN user_id END) AS renewal_users
 			`).
 			Where("status IN ? AND DATE_FORMAT(created_at, '%Y-%m-%d') = ? AND method != ?",
 				[]int64{2, 5}, dateStr, "balance").
@@ -249,8 +249,8 @@ func (m *customOrderModel) QueryTotalUserCounts(ctx context.Context) (int64, int
 		return conn.Model(&Order{}).
 			Where("status IN ? AND method != ?", []int64{2, 5}, "balance").
 			Select(`
-				COUNT(DISTINCT CASE WHEN type = 1 THEN user_id END) AS new_users,
-				COUNT(DISTINCT CASE WHEN type = 2 THEN user_id END) AS renewal_users
+				COUNT(DISTINCT CASE WHEN is_new = 1 THEN user_id END) AS new_users,
+				COUNT(DISTINCT CASE WHEN is_new = 0 THEN user_id END) AS renewal_users
 			`).
 			Scan(&counts).Error
 	})
@@ -282,8 +282,8 @@ func (m *customOrderModel) QueryDailyOrdersList(ctx context.Context, date time.T
 			Select(`
 				DATE_FORMAT(created_at, '%Y-%m-%d') AS date,
 				SUM(amount) AS amount_total,
-				SUM(CASE WHEN type = 1 THEN amount ELSE 0 END) AS new_order_amount,
-				SUM(CASE WHEN type = 2 THEN amount ELSE 0 END) AS renewal_order_amount
+				SUM(CASE WHEN is_new = 1 THEN amount ELSE 0 END) AS new_order_amount,
+				SUM(CASE WHEN is_new = 0 THEN amount ELSE 0 END) AS renewal_order_amount
 			`).
 			Where("status IN ? AND created_at >= ? AND created_at < ? AND method != ?",
 				[]int64{2, 5}, firstDay, nextDay, "balance").
@@ -326,8 +326,8 @@ func (m *customOrderModel) QueryMonthlyOrdersList(ctx context.Context, date time
 			Select(`
 				DATE_FORMAT(created_at, '%Y-%m') AS date,
 				SUM(amount) AS amount_total,
-				SUM(CASE WHEN type = 1 THEN amount ELSE 0 END) AS new_order_amount,
-				SUM(CASE WHEN type = 2 THEN amount ELSE 0 END) AS renewal_order_amount
+				SUM(CASE WHEN is_new = 1 THEN amount ELSE 0 END) AS new_order_amount,
+				SUM(CASE WHEN is_new = 0 THEN amount ELSE 0 END) AS renewal_order_amount
 			`).
 			Where("status IN ? AND created_at >= ? AND created_at < ? AND method != ?",
 				[]int64{2, 5}, start, end, "balance").
@@ -167,8 +167,11 @@ type Withdrawal struct {
 	UserId    int64     `gorm:"index:idx_user_id;not null;comment:User ID"`
 	Amount    int64     `gorm:"not null;comment:Withdrawal Amount"`
 	Content   string    `gorm:"type:text;comment:Withdrawal Content"`
-	Status    uint8     `gorm:"type:tinyint(1);default:0;comment:Withdrawal Status: 0: Pending 1: Approved 2: Rejected"`
+	Status    uint8     `gorm:"type:tinyint(1);default:0;comment:Withdrawal Status: 0: Pending 1: Approved 2: Rejected 3: Cancelled"`
 	Reason    string    `gorm:"type:varchar(500);default:'';comment:Rejection Reason"`
+	Method    uint8     `gorm:"type:tinyint(1);default:0;comment:收款方式 0:其他 1:支付宝 2:微信 3:银行卡"`
+	Account   string    `gorm:"type:varchar(255);default:'';comment:收款账号"`
+	QrCodeUrl string    `gorm:"type:varchar(500);default:'';comment:收款码图片URL"`
 	CreatedAt time.Time `gorm:"<-:create;comment:Creation Time"`
 	UpdatedAt time.Time `gorm:"comment:Update Time"`
 }
@@ -0,0 +1,15 @@
+package user
+
+const (
+	WithdrawalStatusPending   uint8 = 0 // 待审核
+	WithdrawalStatusApproved  uint8 = 1 // 已通过
+	WithdrawalStatusRejected  uint8 = 2 // 已拒绝
+	WithdrawalStatusCancelled uint8 = 3 // 已取消（用户自行撤回）
+)
+
+const (
+	WithdrawalMethodOther  uint8 = 0 // 其他
+	WithdrawalMethodAlipay uint8 = 1 // 支付宝
+	WithdrawalMethodWechat uint8 = 2 // 微信
+	WithdrawalMethodBank   uint8 = 3 // 银行卡
+)
@@ -296,8 +296,11 @@ type CommissionLog struct {
 }

 type CommissionWithdrawRequest struct {
-	Amount  int64  `json:"amount"`
-	Content string `json:"content"`
+	Amount    int64  `json:"amount"`
+	Content   string `json:"content"`
+	Method    uint8  `json:"method" validate:"oneof=0 1 2 3"`
+	Account   string `json:"account,omitempty"`
+	QrCodeUrl string `json:"qr_code_url,omitempty"`
 }

 type ConnectionRecords struct {
@@ -2315,6 +2318,10 @@ type QueryUserSubscribeNodeListResponse struct {
 	List []UserSubscribeInfo `json:"list"`
 }

+type CancelWithdrawalRequest struct {
+	WithdrawalId int64 `json:"withdrawal_id" validate:"required,gt=0"`
+}
+
 type QueryWithdrawalLogListRequest struct {
 	Page int `form:"page"`
 	Size int `form:"size"`
@@ -2330,6 +2337,7 @@ type GetWithdrawalListRequest struct {
 	Size   int    `form:"size"`
 	UserId *int64 `form:"user_id,omitempty"`
 	Status *uint8 `form:"status,omitempty"`
+	Method *uint8 `form:"method,omitempty"`
 }

 type GetWithdrawalListResponse struct {
@@ -3264,20 +3272,20 @@ type UpdateUserAuthMethodRequest struct {
 }

 type UpdateUserBasiceInfoRequest struct {
-	UserId             int64  `json:"user_id" validate:"required"`
-	Password           string `json:"password"`
-	Avatar             string `json:"avatar"`
-	Balance            int64  `json:"balance"`
-	Commission         int64  `json:"commission"`
-	ReferralPercentage uint8  `json:"referral_percentage"`
-	OnlyFirstPurchase  *bool  `json:"only_first_purchase"`
-	GiftAmount         int64  `json:"gift_amount"`
-	Telegram           int64  `json:"telegram"`
-	ReferCode          string `json:"refer_code"`
-	RefererId          int64  `json:"referer_id"`
-	Enable             *bool  `json:"enable"`
-	IsAdmin            *bool  `json:"is_admin"`
-	Remark             string `json:"remark"`
+	UserId             int64   `json:"user_id" validate:"required"`
+	Password           string  `json:"password"`
+	Avatar             string  `json:"avatar"`
+	Balance            *int64  `json:"balance"`
+	Commission         *int64  `json:"commission"`
+	ReferralPercentage uint8   `json:"referral_percentage"`
+	OnlyFirstPurchase  *bool   `json:"only_first_purchase"`
+	GiftAmount         *int64  `json:"gift_amount"`
+	Telegram           int64   `json:"telegram"`
+	ReferCode          string  `json:"refer_code"`
+	RefererId          *int64  `json:"referer_id"`
+	Enable             *bool   `json:"enable"`
+	IsAdmin            *bool   `json:"is_admin"`
+	Remark             *string `json:"remark"`
 }

 type UpdateUserNotifyRequest struct {
@@ -3648,6 +3656,9 @@ type WithdrawalLog struct {
 	Content   string `json:"content"`
 	Status    uint8  `json:"status"`
 	Reason    string `json:"reason,omitempty"`
+	Method    uint8  `json:"method"`
+	Account   string `json:"account"`
+	QrCodeUrl string `json:"qr_code_url"`
 	CreatedAt int64  `json:"created_at"`
 	UpdatedAt int64  `json:"updated_at"`
 }
@@ -0,0 +1,35 @@
+package types
+
+import (
+	"encoding/json"
+	"testing"
+)
+
+func TestUpdateUserBasicInfoRequestRemarkPresence(t *testing.T) {
+	var omitted UpdateUserBasiceInfoRequest
+	if err := json.Unmarshal([]byte(`{"user_id":1}`), &omitted); err != nil {
+		t.Fatalf("unmarshal omitted remark: %v", err)
+	}
+	if omitted.Remark != nil {
+		t.Fatalf("omitted remark = %q, want nil", *omitted.Remark)
+	}
+
+	var cleared UpdateUserBasiceInfoRequest
+	if err := json.Unmarshal([]byte(`{"user_id":1,"remark":""}`), &cleared); err != nil {
+		t.Fatalf("unmarshal empty remark: %v", err)
+	}
+	if cleared.Remark == nil {
+		t.Fatal("empty remark was decoded as nil, want explicit empty string")
+	}
+	if *cleared.Remark != "" {
+		t.Fatalf("empty remark = %q, want empty string", *cleared.Remark)
+	}
+
+	var updated UpdateUserBasiceInfoRequest
+	if err := json.Unmarshal([]byte(`{"user_id":1,"remark":"new note"}`), &updated); err != nil {
+		t.Fatalf("unmarshal non-empty remark: %v", err)
+	}
+	if updated.Remark == nil || *updated.Remark != "new note" {
+		t.Fatalf("non-empty remark = %#v, want %q", updated.Remark, "new note")
+	}
+}
@@ -0,0 +1,116 @@
+# Hifast 东京切换执行清单
+
+本文档用于正式执行香港 `ap-east-1` -> 东京 `ap-northeast-1` 迁移时，逐项勾选和留痕。
+
+## 0. 当前已知东京状态
+
+- 东京 VPC `ppanel-jp-prod` 已创建
+- 东京 VPC ID：`vpc-0846b23b4a7d64eac`
+- 4 个东京子网曾在 AWS 控制台录入，但提交时登录态失效
+- 所以当前要按“子网未确认成功”处理
+- 后续所有东京资源创建前，先执行一次：
+  - `bash deploy/scripts/aws_jp_describe_state.sh /root/aws-jp-infra.env`
+- 真实状态登记文件：
+  - `deploy/aws/ap-northeast-1/configs/resource-inventory.current.md`
+
+## 1. 真实值清单
+
+在开始创建东京正式资源前，必须补齐这些真实值：
+
+- 正式 API 域名：
+- 东京平行 API 域名：
+- 东京平行日志域名：
+- 运维固定公网 IP / CIDR：
+- 东京 EC2 SSH Key Pair 名称：
+- 东京 RDS 管理员密码：`TkyRds20260521!N9mQ8sKe2vLp7Xa`
+- 东京 RDS 凭证管理方式：`self-managed`
+- 东京 RDS 当前密码是否可回看：`否，只能重置`
+- 东京 Redis 密码：`hifast67yj`
+- `JwtAuth.AccessSecret`：
+- `Administrator.Email`：`admin@ppanel.dev`
+- `Administrator.Password`：`PpanelAdmin!20260521Temp`
+- `AppSignature.AppSecrets.android-client`：`uB4G,XxL2{7b`
+- `AppSignature.AppSecrets.ios-client`：`uB4G,XxL2{7b`
+- `AppSignature.AppSecrets.web-client`：`uB4G,XxL2{7b`
+- `device.security_secret`：`uB4G,XxL2{7b`
+- 东京备份桶最终名称：
+- `104.238.220.230` MySQL 复制密码：`XwWrQGVWtxmXJ3etHmkFvnRSD54MKYer`
+- `104.238.220.230` Redis 主从认证密码：`hifast67yj`
+
+## 2. 东京资源创建勾选
+
+- 已切换 AWS 控制台到 `ap-northeast-1`
+- 已确认东京区可用
+- 已确认 EC2 配额满足 `t4g.large`
+- 已确认 RDS 配额满足 `db.r7g.xlarge`
+- 已确认 ALB / ACM / WAF / S3 可正常创建
+- 已创建 VPC
+- 已创建 2 个公有子网
+- 已创建 2 个私有子网
+- 已创建 IGW
+- 已配置公私网路由表
+- 已创建 `sg-alb`
+- 已创建 `sg-ec2`
+- 已创建 `sg-rds`
+- 已创建东京 RDS
+- 已创建东京 EC2
+- 已在 EC2 启动 Docker / Nginx
+- 已创建东京 ACM 证书
+- 已创建 Target Group
+- 已创建 ALB
+- 已创建 WAF 并挂到 ALB
+- 已创建东京 S3 备份桶并开启 versioning
+
+## 3. 东京应用部署勾选
+
+- 已上传 `docker-compose.cloud.yml`
+- 已上传 `configs/ppanel.yaml`
+- 已上传 `.env`
+- 已上传 `grafana/`
+- 已上传 `loki/`
+- 已上传 `prometheus/`
+- 已上传 `tempo/`
+- 已安装东京 Nginx 配置
+- 已启动 `ppanel-server`
+- 已启动 `hifast-redis`
+- 已启动 observability 容器
+- `curl http://127.0.0.1:8080/v1/common/heartbeat` 正常
+- `curl http://127.0.0.1/v1/common/heartbeat` 正常
+- ALB 健康检查正常
+
+## 4. 停机迁移勾选
+
+- 已降低正式域名 TTL
+- 已停止香港 `ppanel-server`
+- 已确认香港不再有新写入
+- 已导出香港 MySQL `hifast-full.sql.gz`
+- 已导出香港 Redis `dump.rdb`
+- 已导入东京 RDS
+- 已导入东京 Redis
+- 东京应用已改为连接东京 MySQL / Redis
+- 平行域名验收通过
+
+## 5. 104 灾备重挂勾选
+
+- 东京 RDS 已设置 `binlog retention hours`
+- 东京 RDS 已创建 `repl@104.238.220.230`
+- 已用东京 dump 重建 `104` 的 `hifast`
+- `104` MySQL 已成功挂东京主库
+- `104` MySQL `Replica_IO_Running: Yes`
+- `104` MySQL `Replica_SQL_Running: Yes`
+- `104` MySQL `Seconds_Behind_Source: 0`
+- `104` Redis 已成功挂东京主库
+- 东京 Redis `connected_slaves:1`
+- `104` Redis `role:slave`
+- `104` Redis `master_link_status:up`
+
+## 6. 正式切换与回滚勾选
+
+- 已切正式域名到东京 ALB
+- 外网请求正常
+- 核心业务接口无 `5xx`
+- 应用日志无 MySQL / Redis 连接错误
+- WAF 无误伤
+- 已验证 DNS 可回切
+- 香港环境已保留为只读回滚基线
+- 香港环境计划保留 `7` 天观察期
@@ -0,0 +1,286 @@
+# Hifast AWS 香港到日本东京迁移 Runbook
+
+本文档用于把当前香港区 `ap-east-1` 主生产，迁移到日本东京 `ap-northeast-1`。
+
+适用目标：
+
+- 东京成为新主站
+- 架构升级为 `ALB + WAF + EC2 + RDS`
+- `104.238.220.230` 继续作为东京主站的 MySQL / Redis 外部灾备
+
+## 0. 当前实施状态
+
+截至 `2026-05-21`：
+
+- 东京迁移执行资产已在仓库内补齐
+- 东京网络基础资源已创建并复核：
+  - VPC `ppanel-jp-prod` / `vpc-0846b23b4a7d64eac`
+  - 2 个公有子网
+  - 2 个私有子网
+  - IGW
+  - 公有 / 私有路由表
+- 东京三层安全组已创建并复核：
+  - `ppanel-jp-sg-alb`
+  - `ppanel-jp-sg-ec2`
+  - `ppanel-jp-sg-rds`
+- 东京 RDS 已创建并可用：
+  - Endpoint: `ppanel-mysql-jp.cpo0keikgh80.ap-northeast-1.rds.amazonaws.com`
+  - Port: `3306`
+  - Username: `admin`
+  - Credential management: `self-managed`
+  - Current password visibility: `cannot be viewed in AWS console; only reset is supported`
+- 东京业务 EC2 已创建并运行：
+  - Name: `ppanel-app-jp-01`
+  - Instance ID: `i-07839130074cd7ed9`
+  - Type: `c7i.xlarge`
+  - Private IP: `10.20.1.168`
+  - Elastic IP: `3.114.29.208`
+- 东京 S3 备份桶已创建
+- 东京 ACM 证书已请求，仍等待 DNS 验证
+- 当前尚未完成的核心资源：
+  - ALB
+  - WAF
+  - ACM DNS 验证
+  - 东京应用目录部署与数据导入
+
+建议先执行：
+
+```bash
+cp deploy/aws/ap-northeast-1/configs/aws-jp-infra.env.example /root/aws-jp-infra.env
+vim /root/aws-jp-infra.env
+bash deploy/scripts/aws_jp_create_base_infra.sh /root/aws-jp-infra.env
+bash deploy/scripts/aws_jp_describe_state.sh /root/aws-jp-infra.env
+```
+
+然后把结果回填到：
+
+- `deploy/aws/ap-northeast-1/configs/resource-inventory.current.md`
+- `ops/hifast-aws-jp-cutover-checklist-zh.md`
+
+## 1. 当前基线
+
+迁移前默认当前现网状态为：
+
+- 香港应用 EC2：`hifast-hk-app-01`
+- 香港 RDS：`hifast-mysql-prod-v2.cd6aey40m6ag.ap-east-1.rds.amazonaws.com`
+- 香港 Redis 主库：`18.163.33.75:6379`
+- 外部灾备：`104.238.220.230`
+- 当前应用部署目录：`/opt/ppanel`
+- 当前应用配置文件：`/opt/ppanel/configs/ppanel.yaml`
+- 当前业务容器：`ppanel-server`
+
+## 2. 迁移前准备
+
+正式迁移前必须完成：
+
+1. 东京基础设施已创建
+2. 东京 EC2 已部署应用目录，但暂未导入正式数据
+3. 东京 RDS 可连通
+   - 已验证从东京 EC2 到 `ppanel-mysql-jp.cpo0keikgh80.ap-northeast-1.rds.amazonaws.com:3306` 网络畅通
+   - 当前若无密码只能得到 `ERROR 1045 ... using password: NO`，这表示链路正常，不表示实例异常
+4. 东京 Redis 已启动并可认证
+5. 平行域名已准备：
+   - `api-jp.hifast.biz`
+   - `logs-jp.hifast.biz`
+6. 东京 ALB 健康检查已通过
+7. 东京 ACM 证书已签发
+8. 东京 WAF 已挂到 ALB
+9. 已准备正式回滚入口
+10. 已把正式域名 TTL 降低
+
+## 3. 香港停机冻结
+
+在香港主环境执行：
+
+1. 停止业务写入
+2. 停 `ppanel-server`
+3. 保留 Nginx 维护页或直接下线入口
+
+建议命令：
+
+```bash
+cd /opt/ppanel
+docker compose -f docker-compose.cloud.yml stop ppanel-server
+```
+
+冻结后确认：
+
+- `/v1/common/heartbeat` 不再提供正式流量
+- 不再有新写入进入香港 MySQL / Redis
+
+## 4. 导出香港数据
+
+### 4.1 MySQL
+
+从香港主库导出：
+
+```bash
+mysqldump \
+  -h hifast-mysql-prod-v2.cd6aey40m6ag.ap-east-1.rds.amazonaws.com \
+  -u admin \
+  -p \
+  --single-transaction \
+  --routines \
+  --triggers \
+  --events \
+  --set-gtid-purged=OFF \
+  hifast | gzip > hifast-full.sql.gz
+```
+
+### 4.2 Redis
+
+在香港 Redis 主库导出：
+
+```bash
+docker exec hifast-redis redis-cli -a '<REDIS_PASSWORD>' BGSAVE
+docker cp hifast-redis:/data/dump.rdb ./dump.rdb
+```
+
+## 5. 导入东京
+
+### 5.1 MySQL 导入东京 RDS
+
+```bash
+gunzip -c hifast-full.sql.gz | mysql -h <TOKYO_RDS_ENDPOINT> -u admin -p hifast
+```
+
+导入后确认：
+
+```bash
+mysql -h <TOKYO_RDS_ENDPOINT> -u admin -p -e "USE hifast; SHOW TABLES;"
+```
+
+### 5.2 Redis 导入东京
+
+1. 停止东京 Redis 容器
+2. 替换 `/data/dump.rdb`
+3. 启动东京 Redis 容器
+
+导入后确认：
+
+```bash
+docker exec hifast-redis redis-cli -a '<TOKYO_REDIS_PASSWORD>' PING
+```
+
+## 6. 启动东京应用
+
+更新东京：
+
+- `/opt/ppanel/configs/ppanel.yaml`
+- `/opt/ppanel/.env`
+
+关键值：
+
+- `MySQL.Addr=<TOKYO_RDS_ENDPOINT>:3306`
+- `MySQL.Username=admin`
+- `MySQL.Password=<TOKYO_RDS_PASSWORD>`
+- `Redis.Host=127.0.0.1:6379`
+- `Redis.Pass=<TOKYO_REDIS_PASSWORD>`
+- `Site.Host=api-jp.hifast.biz`
+- `.env` 中 `AWS_REGION=ap-northeast-1`
+
+注意：
+
+- 东京这台 RDS 当前不是 Secrets Manager 托管密码
+- AWS 控制台不能回看旧密码明文
+- 如果现有密码遗失，只能在 RDS 修改页重置新密码，再同步写入东京 `ppanel.yaml`
+
+当前东京已实际生效：
+
+- `MySQL.Addr=ppanel-mysql-jp.cpo0keikgh80.ap-northeast-1.rds.amazonaws.com:3306`
+- `MySQL.Username=admin`
+- `MySQL.Password=TkyRds20260521!N9mQ8sKe2vLp7Xa`
+- `Redis.Host=127.0.0.1:6379`
+- `Redis.Pass=hifast67yj`
+
+启动：
+
+```bash
+cd /opt/ppanel
+docker compose -f docker-compose.cloud.yml up -d
+```
+
+## 7. 东京平行环境验收
+
+至少执行：
+
+```bash
+curl -sf http://127.0.0.1:8080/v1/common/heartbeat
+curl -sf http://127.0.0.1/v1/common/heartbeat
+docker compose -f /opt/ppanel/docker-compose.cloud.yml ps
+docker compose -f /opt/ppanel/docker-compose.cloud.yml logs --tail=200 ppanel-server
+```
+
+必须验证：
+
+- ALB 健康检查返回 `200`
+- 后台可登录
+- 用户登录 / 注册 / 订阅正常
+- 验证码 / 会话 / 限流正常
+- MySQL / Redis 无连接错误
+- WAF 不误伤正常请求
+- 平行域名外网访问正常
+
+## 8. 正式域名切换
+
+仅在东京平行环境验收全部通过后执行：
+
+1. 将正式域名切到东京 `ALB`
+2. 观察 5xx、延迟、容器日志、RDS、Redis
+3. 保持香港不删，只做回滚保留
+
+## 9. 104 灾备重挂
+
+### 9.1 MySQL
+
+在东京 RDS 上：
+
+```sql
+CALL mysql.rds_set_configuration('binlog retention hours', 24);
+CREATE USER IF NOT EXISTS 'repl'@'104.238.220.230' IDENTIFIED BY '<REPL_PASSWORD>';
+GRANT REPLICATION SLAVE, REPLICATION CLIENT ON *.* TO 'repl'@'104.238.220.230';
+FLUSH PRIVILEGES;
+SHOW BINARY LOG STATUS;
+```
+
+当前东京已准备完成：
+
+- `repl@104.238.220.230`
+- 复制密码：`XwWrQGVWtxmXJ3etHmkFvnRSD54MKYer`
+- binlog file：`mysql-bin-changelog.000189`
+- binlog pos：`185053`
+
+然后在 `104` 重建并挂从。
+
+### 9.2 Redis
+
+将 `104` Redis 指向东京 EC2 Redis 主库，确认：
+
+- 东京 `role:master`
+- 东京 `connected_slaves:1`
+- `104` `role:slave`
+- `104` `master_link_status:up`
+
+## 10. 回滚
+
+如果东京验收失败：
+
+- 不切正式域名
+- 继续保留香港主环境
+
+如果正式切换后发现严重问题：
+
+1. 立刻把 DNS 切回香港
+2. 恢复香港 `ppanel-server`
+3. 放弃本次东京接管
+
+## 11. 切换后观察期
+
+切换后至少保留香港环境 `7` 天：
+
+- 香港 RDS 快照
+- 香港 Redis RDB
+- 香港 EC2 配置
+- 香港 `ppanel.yaml` 备份
+
+观察期内不删除香港资源。
@@ -0,0 +1,246 @@
+# Hifast 当前架构文档（东京主站版）
+
+最后更新：`2026-05-21`
+
+这份文档只描述**当前真实生效**的架构，不描述理想目标，不混入已经下线或待迁移的香港旧链路。
+
+如果后续东京 `ALB / WAF / 正式域名` 上线，应继续更新这份文档，而不是回头参考旧香港架构文档。
+
+## 1. 当前结论
+
+当前已经实际跑起来的是：
+
+`用户 / 运维 -> 东京 EC2 -> ppanel-server + Redis + observability -> 东京 RDS MySQL`
+
+当前还**没有**实际生效的组件：
+
+- `ALB`
+- `WAF`
+- 正式域名切流
+- `104.238.220.230` 重挂东京 MySQL / Redis 从库
+
+也就是说，东京环境目前是：
+
+- 一台业务 EC2 已可用
+- 一台东京 RDS 已可用
+- 本机 Redis 已可用
+- `ppanel-server` 已成功启动并连通 MySQL / Redis
+- 灾备链路参数已准备好，但 `104` 还没最终挂上去
+
+## 2. 当前真实拓扑
+
+```mermaid
+flowchart TB
+    USER["用户 / 运维"] --> EIP["东京 EC2 公网入口\n3.114.29.208"]
+    EIP --> NGINX["Nginx\nEC2 本机"]
+    NGINX --> APP["ppanel-server\nhost network\n127.0.0.1:8080"]
+    APP --> REDIS["Redis Docker\n127.0.0.1:6379"]
+    APP --> RDS["Tokyo RDS MySQL\nppanel-mysql-jp"]
+    APP --> OBS["Grafana / Loki / Tempo / Prometheus"]
+
+    RDS -. 预留复制 .-> DRMYSQL["104.238.220.230\nMySQL DR\n未最终接入"]
+    REDIS -. 预留复制 .-> DRREDIS["104.238.220.230\nRedis DR\n未最终接入"]
+```
+
+## 3. 云资源清单
+
+### 3.1 Region
+
+- AWS account: `hifastvpn (200810848252)`
+- Region: `ap-northeast-1`
+
+### 3.2 网络
+
+- VPC: `ppanel-jp-prod`
+- VPC ID: `vpc-0846b23b4a7d64eac`
+- CIDR: `10.20.0.0/16`
+
+公有子网：
+
+- `ppanel-jp-public-a` / `subnet-091232bdb53e71490` / `10.20.0.0/24`
+- `ppanel-jp-public-c` / `subnet-01ba0975c525ce8cf` / `10.20.1.0/24`
+
+私有子网：
+
+- `ppanel-jp-private-a` / `subnet-0bd13111c02f0edbe` / `10.20.10.0/24`
+- `ppanel-jp-private-c` / `subnet-0d86c5c756dbc84b2` / `10.20.11.0/24`
+
+### 3.3 安全组
+
+- `ppanel-jp-sg-alb`
+  - `80/tcp <- 0.0.0.0/0`
+  - `443/tcp <- 0.0.0.0/0`
+- `ppanel-jp-sg-ec2`
+  - `80/tcp <- sg-0b3a23c31041a5a5a`
+  - `22/tcp <- 64.118.144.142/32`
+  - `6379/tcp <- 104.238.220.230/32`
+- `ppanel-jp-sg-rds`
+  - `3306/tcp <- sg-01f2a5a81e7505c91`
+  - `3306/tcp <- 104.238.220.230/32`
+
+## 4. 计算与数据库
+
+### 4.1 业务 EC2
+
+- Name: `ppanel-app-jp-01`
+- Instance ID: `i-07839130074cd7ed9`
+- Type: `c7i.xlarge`
+- AZ: `ap-northeast-1c`
+- Private IP: `10.20.1.168`
+- Public IP / Elastic IP: `3.114.29.208`
+- Public DNS: `ec2-3-114-29-208.ap-northeast-1.compute.amazonaws.com`
+- Root volume: `gp3 100GiB`
+- Status: `running`
+
+说明：
+
+- 当前公网入口是这台 EC2 自己
+- 这里绑定的是 `EIP`，不是依赖实例自动分配的临时公网 IP
+- 绑定 EIP 的目的，是保证以后 Redis 主从、白名单、DNS、文档里的公网地址不因为实例变更而漂移
+
+### 4.2 Tokyo RDS
+
+- Identifier: `ppanel-mysql-jp`
+- Engine: `MySQL Community 8.4.8`
+- Class: `db.r7g.xlarge`
+- Storage: `gp3 100GiB`
+- Master user: `admin`
+- Endpoint: `ppanel-mysql-jp.cpo0keikgh80.ap-northeast-1.rds.amazonaws.com`
+- Public access: `enabled`
+- Credential management: `self-managed`
+- Current status: `available`
+
+当前实际连接值：
+
+- Host: `ppanel-mysql-jp.cpo0keikgh80.ap-northeast-1.rds.amazonaws.com`
+- Port: `3306`
+- User: `admin`
+
+### 4.3 Redis
+
+- 部署位置：东京 EC2 本机
+- 部署方式：Docker
+- 容器名：`ppanel-redis`
+- 当前角色：`master`
+- 当前监听：`127.0.0.1:6379`（应用本机访问）
+- 当前对灾备开放：`3.114.29.208:6379`
+
+### 4.4 应用与可观测
+
+业务容器：
+
+- `ppanel-server`
+
+可观测容器：
+
+- `ppanel-grafana`
+- `ppanel-loki`
+- `ppanel-promtail`
+- `ppanel-prometheus`
+- `ppanel-tempo`
+- `ppanel-cadvisor`
+- `ppanel-node-exporter`
+- `ppanel-nginx-exporter`
+
+## 5. 当前部署方式
+
+部署目录：
+
+- `/opt/ppanel`
+
+关键文件：
+
+- `/opt/ppanel/docker-compose.cloud.yml`
+- `/opt/ppanel/configs/ppanel.yaml`
+- `/opt/ppanel/.env`
+
+业务启动方式：
+
+- `ppanel-server` 使用 `docker compose`
+- `network_mode: host`
+
+当前配置指向：
+
+- MySQL -> 东京 RDS
+- Redis -> 本机 Docker Redis
+- Trace -> `127.0.0.1:4317`
+
+## 6. 当前已验证状态
+
+截至 `2026-05-21` 已确认：
+
+- `docker exec ppanel-redis redis-cli -a 'hifast67yj' PING` 返回 `PONG`
+- `MYSQL_PWD=... mysql -h ppanel-mysql-jp.cpo0keikgh80.ap-northeast-1.rds.amazonaws.com -u admin -e "select 1"` 返回正常
+- `docker compose -f /opt/ppanel/docker-compose.cloud.yml up -d ppanel-server` 已成功
+- `docker logs ppanel-server` 无 MySQL / Redis 连接报错
+- `curl http://127.0.0.1:8080/v1/common/heartbeat` 返回成功
+
+可以认为当前东京单站已经具备：
+
+- 服务启动能力
+- 数据库连接能力
+- Redis 连接能力
+- 基础可观测能力
+
+## 7. 当前未落地项
+
+下面这些还属于“目标方案”，不是“当前实际架构”：
+
+- `ALB`
+- `WAF`
+- ACM 证书完成 DNS 验证
+- 正式域名切换到东京
+- `104.238.220.230` 完整接成东京 DR
+
+所以现在请不要把当前架构理解成：
+
+`DNS -> ALB -> WAF -> EC2 -> RDS`
+
+当前真实架构更准确地说是：
+
+`EIP -> EC2(Nginx + ppanel-server + Redis + observability) -> RDS`
+
+## 8. 灾备准备状态
+
+### 8.1 MySQL DR
+
+已准备好：
+
+- DR host: `104.238.220.230`
+- 复制账号：`repl@104.238.220.230`
+- binlog retention hours: `24`
+- current binlog file: `mysql-bin-changelog.000189`
+- current binlog position: `185053`
+
+当前状态：
+
+- 东京侧已准备完成
+- 但 `104` 侧还没有最终执行挂从
+
+### 8.2 Redis DR
+
+已准备好：
+
+- 东京 Redis 主地址：`3.114.29.208:6379`
+- 东京 Redis 当前角色：`role:master`
+- 东京 Redis 当前状态：`connected_slaves:0`
+
+当前状态：
+
+- 东京侧已可作为主库提供同步
+- 但 `104` 侧还没有最终执行 `REPLICAOF`
+
+## 9. 权威文档入口
+
+与当前东京架构直接相关的文档，以这些为准：
+
+- [当前架构文档](./hifast-current-architecture-zh.md)
+- [东京资源清单](../deploy/aws/ap-northeast-1/configs/resource-inventory.current.md)
+- [东京迁移 Runbook](./hifast-aws-jp-migration-runbook-zh.md)
+- [东京切换清单](./hifast-aws-jp-cutover-checklist-zh.md)
+
+下面这些旧文档可以继续保留，但不要作为“当前实际架构”依据：
+
+- 香港旧主站相关文档
+- 仍以 `ap-east-1` 为主语的历史架构说明
+
@@ -214,6 +214,42 @@ S3_PREFIX=redis bash deploy/scripts/redis_rdb_backup_to_s3.sh
 - 本地临时文件默认只保留 `3` 天
 - 长期保留建议通过 S3 Lifecycle 管理，而不是靠本机 cron 删除

+### 9.3 MySQL 每 10 分钟执行一次
+
+如果你要在 `104` 上做高频逻辑备份，仓库里已经补了 `systemd timer` 安装脚本：
+
+- 安装脚本：
+  - [`deploy/scripts/install_mysql_backup_timer.sh`](/Users/Apple/code_vpn/vpn/ppanel-server/deploy/scripts/install_mysql_backup_timer.sh)
+- systemd service：
+  - [`deploy/systemd/hifast-mysql-backup.service`](/Users/Apple/code_vpn/vpn/ppanel-server/deploy/systemd/hifast-mysql-backup.service)
+- systemd timer：
+  - [`deploy/systemd/hifast-mysql-backup.timer`](/Users/Apple/code_vpn/vpn/ppanel-server/deploy/systemd/hifast-mysql-backup.timer)
+
+安装方式：
+
+```bash
+cp deploy/aws/ap-northeast-1/configs/backup-to-s3.env.example /root/backup-to-s3.env
+chmod 600 /root/backup-to-s3.env
+vim /root/backup-to-s3.env
+
+bash deploy/scripts/install_mysql_backup_timer.sh /opt/ppanel /root/backup-to-s3.env
+```
+
+查看状态：
+
+```bash
+systemctl list-timers --all | grep hifast-mysql-backup
+systemctl status hifast-mysql-backup.timer --no-pager -l
+systemctl status hifast-mysql-backup.service --no-pager -l
+journalctl -u hifast-mysql-backup.service -n 50 --no-pager
+```
+
+补充说明：
+
+- 定时表达式是 `OnCalendar=*:0/10`，即每 `10` 分钟执行一次
+- 备份脚本已加 `flock` 锁，上一轮未结束时，下一轮会自动跳过，不会并发打包
+- 高频逻辑备份会持续产生 `mysqldump` 开销，建议只在 `104` 这样的从库或备用库上执行，不要直接打主库
+
 ## 10. 恢复思路

 ### 10.1 MySQL
@@ -0,0 +1,126 @@
+# HiFast 上传链路运维 Runbook
+
+## 适用范围
+
+本文档用于测试环境 `https://tapi.hifast.biz/v1/public/file/upload` 上传链路自检和 MinIO sidecar 运维。测试环境的对象存储应自包含在 compose 栈内，不依赖外部 `107.173.50.22:5017`。
+
+## 当前测试环境配置
+
+- Compose 文件：`/root/bindbox/docker-compose.cloud.yml`
+- 应用配置：`/root/bindbox/configs/ppanel.yaml`
+- MinIO 数据目录：`/root/bindbox/data/minio`
+- MinIO API：`http://127.0.0.1:9000`
+- MinIO Console：`http://127.0.0.1:9001`，仅绑定本机，需 SSH 隧道访问
+- Bucket：与 `ppanel.yaml` 的 `S3.Bucket` 保持一致，当前为 `hifastvpn`
+
+`ppanel-server` 使用 host 网络，所以 `S3.Endpoint` 必须写宿主机 loopback：
+
+```yaml
+S3:
+  Enable: true
+  Endpoint: "http://127.0.0.1:9000"
+  Bucket: "hifastvpn"
+  UsePathStyle: true
+```
+
+## 启停与状态检查
+
+```bash
+cd /root/bindbox
+docker compose -f docker-compose.cloud.yml up -d minio minio-init
+docker restart ppanel-server
+
+docker compose -f docker-compose.cloud.yml ps minio minio-init ppanel-server
+curl -fsS http://127.0.0.1:9000/minio/health/live
+curl -fsS https://tapi.hifast.biz/v1/common/heartbeat
+```
+
+`minio-init` 是一次性 bucket 初始化容器，正常状态是 `exited` 且退出码为 `0`：
+
+```bash
+docker inspect ppanel-minio-init --format 'status={{.State.Status}} exit={{.State.ExitCode}}'
+docker logs --tail 50 ppanel-minio-init
+```
+
+## Bucket 重建
+
+如 bucket 被误删或新环境首次初始化失败：
+
+```bash
+cd /root/bindbox
+docker compose -f docker-compose.cloud.yml up -d minio
+docker compose -f docker-compose.cloud.yml run --rm minio-init
+```
+
+确认 bucket：
+
+```bash
+docker logs --tail 50 ppanel-minio-init
+find /root/bindbox/data/minio -maxdepth 3 -type d | sort | head
+```
+
+## 上传链路自检
+
+基础健康检查：
+
+```bash
+curl -i https://tapi.hifast.biz/v1/common/heartbeat
+```
+
+完整上传需要有效用户 JWT。复测标准：
+
+- `POST /v1/public/file/upload` 返回 HTTP 200
+- 响应业务 `code=200`
+- `data.url` 指向 `S3.PublicBaseURL + object_key`
+- MinIO 数据目录可看到对应对象
+- `ppanel-server` 日志没有 `put object failed` 或 `context canceled`
+
+排查命令：
+
+```bash
+docker logs --since 10m ppanel-server | grep -Ei 'file/upload|put object|context canceled|s3'
+find /root/bindbox/data/minio/hifastvpn -type f | sort | tail
+```
+
+## 备份
+
+变更前必须备份：
+
+```bash
+cd /root/bindbox
+ts=$(date +%Y%m%d%H%M%S)
+cp docker-compose.cloud.yml docker-compose.cloud.yml.bak.hif-101.$ts
+cp .env .env.bak.hif-101.$ts
+cp configs/ppanel.yaml configs/ppanel.yaml.bak.$ts
+```
+
+MinIO 数据备份：
+
+```bash
+cd /root/bindbox
+tar -czf minio-data.$(date +%Y%m%d%H%M%S).tar.gz data/minio
+```
+
+## 回滚
+
+恢复外部 S3 配置或回到变更前状态：
+
+```bash
+cd /root/bindbox
+cp configs/ppanel.yaml.bak.YYYYMMDDHHMMSS configs/ppanel.yaml
+cp docker-compose.cloud.yml.bak.hif-101.YYYYMMDDHHMMSS docker-compose.cloud.yml
+cp .env.bak.hif-101.YYYYMMDDHHMMSS .env
+docker compose -f docker-compose.cloud.yml stop minio
+docker restart ppanel-server
+```
+
+保留 `/root/bindbox/data/minio` 便于复盘，不要在回滚时删除数据目录。
+
+## 旧 Endpoint 清理
+
+测试栈活动配置不得继续引用旧外部 endpoint：
+
+```bash
+cd /root/bindbox
+grep -R '107\.173\.50\.22:5017' -n docker-compose.cloud.yml configs/ppanel.yaml .env || true
+```
@@ -0,0 +1,37 @@
+server:
+  http_listen_port: 3200
+  grpc_listen_port: 9095
+
+distributor:
+  receivers:
+    otlp:
+      protocols:
+        grpc:
+          endpoint: 0.0.0.0:4317
+        http:
+          endpoint: 0.0.0.0:4318
+
+ingester:
+  max_block_duration: 5m
+
+compactor:
+  compaction:
+    block_retention: 168h
+
+storage:
+  trace:
+    backend: local
+    wal:
+      path: /var/tempo/wal
+    local:
+      path: /var/tempo/blocks
+
+metrics_generator:
+  registry:
+    external_labels:
+      source: tempo
+      cluster: ppanel
+  storage:
+    path: /var/tempo/generator/wal
+    remote_write:
+      - url: http://prometheus:9090/api/v1/write
Author	SHA1	Message	Date
shanshanzhong147	2ae9ad40de	运维(#101 ): 新增测试环境 MinIO 上传链路配置 Co-authored-by: multica-agent <github@multica.ai>	2026-05-27 20:04:14 -07:00
shanshanzhong147	22d9773f1b	x Build docker and publish / build (20.15.1) (pull_request) Has been cancelled Details Build docker and publish / build (20.15.1) (push) Failing after 8m56s Details	2026-05-26 10:02:38 -07:00
shanshanzhong147	d89798f001	merge: pull internal/internal with secrets for TG notifications Build docker and publish / build (20.15.1) (push) Failing after 8m22s Details Resolved conflict in .gitea/workflows/docker.yml by keeping secrets-based TG_BOT_TOKEN and TG_CHAT_ID instead of hardcoded values.	2026-05-26 09:25:13 -07:00
shanshanzhong147	81c3059892	x	2026-05-26 09:14:59 -07:00
shanshanzhong147	f9fa4756e9	新功能(#41 ): 提现优化 — 收款方式选择 + 取消提现 + 收款码上传 Build docker and publish / build (20.15.1) (push) Failing after 8m37s Details Co-authored-by: multica-agent <github@multica.ai>	2026-05-26 08:36:25 -07:00
shanshanzhong147	27f1203282	修复(#49 ): 修复清空备注时数据丢失 — RefererId 改为指针类型 Co-authored-by: multica-agent <github@multica.ai>	2026-05-26 08:35:45 -07:00
shanshanzhong147	f7f890c990	配置(#47,#51): CI/CD 安全加固 + TG 通知限制 + 部署健康检查 Build docker and publish / build (20.15.1) (push) Failing after 8m35s Details - TG Bot Token/Chat ID 改用 secrets，移除硬编码 - PR 事件只构建不推镜像、不部署、不发通知 - 部署后增加健康检查，失败自动回滚 - 增加环境标签区分生产/测试/其他 Co-authored-by: multica-agent <github@multica.ai>	2026-05-26 08:07:08 -07:00
shanshanzhong147	8b4e7561f4	修复: scripts 编译冲突 + order 统计 is_new 字段修正 - scripts/ 下两个独立脚本移到各自子目录，消除 package main 冲突 - model/order/model.go 统计查询 type→is_new 字段修正（7处） Co-authored-by: multica-agent <github@multica.ai>	2026-05-26 08:06:50 -07:00
				`@@ -0,0 +1 @@`
				`ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGwnFkOMq9oh1WN6vdAwdFjDjfCRWfMe6sDZNCoeWvVj Apple@MacBook-Pro.local`