Compare commits
6 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 shanshanzhong147
|
18c667bf21 | ||
|
shanshanzhong147
|
22d9773f1b | ||
|
shanshanzhong147
|
d89798f001 | ||
|
shanshanzhong147
|
81c3059892 | ||
|
shanshanzhong147
|
f9fa4756e9 | ||
|
shanshanzhong147
|
27f1203282 |
@@ -1,76 +0,0 @@
|
|||||||
upstream api_backend {
|
|
||||||
server 127.0.0.1:8080;
|
|
||||||
}
|
|
||||||
|
|
||||||
server {
|
|
||||||
|
|
||||||
listen 80;
|
|
||||||
server_name api.hifast.biz 4d3vsw888xgaen.hifast.biz;
|
|
||||||
location /.well-known/acme-challenge/ {
|
|
||||||
root /var/www/html;
|
|
||||||
allow all;
|
|
||||||
}
|
|
||||||
location / {
|
|
||||||
return 301 https://$host$request_uri;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
server {
|
|
||||||
listen 443 ssl http2;
|
|
||||||
server_name api.hifast.biz;
|
|
||||||
client_max_body_size 150M;
|
|
||||||
ssl_certificate /etc/nginx/ssl/hifast.biz/_.hifast.biz.pem; # managed by Certbot
|
|
||||||
ssl_certificate_key /etc/nginx/ssl/hifast.biz/_.hifast.biz.key; # managed by Certbot
|
|
||||||
|
|
||||||
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
|
|
||||||
add_header X-Frame-Options "DENY";
|
|
||||||
|
|
||||||
add_header X-Content-Type-Options nosniff;
|
|
||||||
if ($http_user_agent ~* '(9999|91\.78)') {
|
|
||||||
return 444;
|
|
||||||
}
|
|
||||||
location ~ ^/v1/common/client/download/file/(?<download_name>Hi快VPN-(?<os>windows|mac|android)-1.0.0-ic-.*\.(?<ext>exe|dmg|apk))$ {
|
|
||||||
alias /var/www/download/Hi快VPN-$os-1.0.0.$ext;
|
|
||||||
charset utf-8;
|
|
||||||
add_header Content-Disposition 'attachment; filename="$download_name"';
|
|
||||||
add_header Content-Type application/octet-stream;
|
|
||||||
}
|
|
||||||
|
|
||||||
location /v1/common/client/download/file/ {
|
|
||||||
alias /var/www/download/;
|
|
||||||
}
|
|
||||||
|
|
||||||
location / {
|
|
||||||
proxy_pass http://api_backend;
|
|
||||||
proxy_set_header Host $host;
|
|
||||||
proxy_set_header X-Real-IP $remote_addr;
|
|
||||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
||||||
proxy_set_header X-Forwarded-Proto $scheme;
|
|
||||||
proxy_http_version 1.1;
|
|
||||||
proxy_set_header Upgrade $http_upgrade;
|
|
||||||
proxy_set_header Connection "upgrade";
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
server {
|
|
||||||
listen 443 ssl http2;
|
|
||||||
server_name 4d3vsw888xgaen.hifast.biz;
|
|
||||||
client_max_body_size 150M;
|
|
||||||
ssl_certificate /etc/nginx/ssl/hifast.biz/_.hifast.biz.pem; # managed by Certbot
|
|
||||||
ssl_certificate_key /etc/nginx/ssl/hifast.biz/_.hifast.biz.key; # managed by Certbot
|
|
||||||
|
|
||||||
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
|
|
||||||
add_header X-Frame-Options DENY;
|
|
||||||
add_header X-Content-Type-Options nosniff;
|
|
||||||
|
|
||||||
gzip on;
|
|
||||||
gzip_vary on;
|
|
||||||
gzip_min_length 1024;
|
|
||||||
gzip_types text/plain text/css text/xml text/javascript application/javascript application/xml+rss application/json image/svg+xml;
|
|
||||||
root /var/www/admin;
|
|
||||||
location / {
|
|
||||||
try_files $uri $uri/ /index.html;
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
+15
-14
@@ -38,20 +38,20 @@ type (
|
|||||||
Id int64 `form:"id" validate:"required"`
|
Id int64 `form:"id" validate:"required"`
|
||||||
}
|
}
|
||||||
UpdateUserBasiceInfoRequest {
|
UpdateUserBasiceInfoRequest {
|
||||||
UserId int64 `json:"user_id" validate:"required"`
|
UserId int64 `json:"user_id" validate:"required"`
|
||||||
Password string `json:"password"`
|
Password string `json:"password"`
|
||||||
Avatar string `json:"avatar"`
|
Avatar string `json:"avatar"`
|
||||||
Balance int64 `json:"balance"`
|
Balance *int64 `json:"balance"`
|
||||||
Commission int64 `json:"commission"`
|
Commission *int64 `json:"commission"`
|
||||||
ReferralPercentage uint8 `json:"referral_percentage"`
|
ReferralPercentage uint8 `json:"referral_percentage"`
|
||||||
OnlyFirstPurchase *bool `json:"only_first_purchase"`
|
OnlyFirstPurchase *bool `json:"only_first_purchase"`
|
||||||
GiftAmount int64 `json:"gift_amount"`
|
GiftAmount *int64 `json:"gift_amount"`
|
||||||
Telegram int64 `json:"telegram"`
|
Telegram int64 `json:"telegram"`
|
||||||
ReferCode string `json:"refer_code"`
|
ReferCode string `json:"refer_code"`
|
||||||
RefererId int64 `json:"referer_id"`
|
RefererId *int64 `json:"referer_id"`
|
||||||
Enable *bool `json:"enable"`
|
Enable *bool `json:"enable"`
|
||||||
IsAdmin *bool `json:"is_admin"`
|
IsAdmin *bool `json:"is_admin"`
|
||||||
Remark string `json:"remark"`
|
Remark *string `json:"remark"`
|
||||||
}
|
}
|
||||||
UpdateUserNotifySettingRequest {
|
UpdateUserNotifySettingRequest {
|
||||||
UserId int64 `json:"user_id" validate:"required"`
|
UserId int64 `json:"user_id" validate:"required"`
|
||||||
@@ -235,6 +235,7 @@ type (
|
|||||||
Size int `form:"size"`
|
Size int `form:"size"`
|
||||||
UserId *int64 `form:"user_id,omitempty"`
|
UserId *int64 `form:"user_id,omitempty"`
|
||||||
Status *uint8 `form:"status,omitempty"`
|
Status *uint8 `form:"status,omitempty"`
|
||||||
|
Method *uint8 `form:"method,omitempty"`
|
||||||
}
|
}
|
||||||
GetWithdrawalListResponse {
|
GetWithdrawalListResponse {
|
||||||
List []WithdrawalLog `json:"list"`
|
List []WithdrawalLog `json:"list"`
|
||||||
|
|||||||
+15
-2
@@ -109,8 +109,11 @@ type (
|
|||||||
Rules []string `json:"rules" validate:"required"`
|
Rules []string `json:"rules" validate:"required"`
|
||||||
}
|
}
|
||||||
CommissionWithdrawRequest {
|
CommissionWithdrawRequest {
|
||||||
Amount int64 `json:"amount"`
|
Amount int64 `json:"amount"`
|
||||||
Content string `json:"content"`
|
Content string `json:"content"`
|
||||||
|
Method uint8 `json:"method" validate:"oneof=0 1 2 3"`
|
||||||
|
Account string `json:"account,omitempty"`
|
||||||
|
QrCodeUrl string `json:"qr_code_url,omitempty"`
|
||||||
}
|
}
|
||||||
WithdrawalLog {
|
WithdrawalLog {
|
||||||
Id int64 `json:"id"`
|
Id int64 `json:"id"`
|
||||||
@@ -119,9 +122,15 @@ type (
|
|||||||
Content string `json:"content"`
|
Content string `json:"content"`
|
||||||
Status uint8 `json:"status"`
|
Status uint8 `json:"status"`
|
||||||
Reason string `json:"reason,omitempty"`
|
Reason string `json:"reason,omitempty"`
|
||||||
|
Method uint8 `json:"method"`
|
||||||
|
Account string `json:"account"`
|
||||||
|
QrCodeUrl string `json:"qr_code_url"`
|
||||||
CreatedAt int64 `json:"created_at"`
|
CreatedAt int64 `json:"created_at"`
|
||||||
UpdatedAt int64 `json:"updated_at"`
|
UpdatedAt int64 `json:"updated_at"`
|
||||||
}
|
}
|
||||||
|
CancelWithdrawalRequest {
|
||||||
|
WithdrawalId int64 `json:"withdrawal_id" validate:"required,gt=0"`
|
||||||
|
}
|
||||||
QueryWithdrawalLogListRequest {
|
QueryWithdrawalLogListRequest {
|
||||||
Page int `form:"page"`
|
Page int `form:"page"`
|
||||||
Size int `form:"size"`
|
Size int `form:"size"`
|
||||||
@@ -352,6 +361,10 @@ service ppanel {
|
|||||||
@handler CommissionWithdraw
|
@handler CommissionWithdraw
|
||||||
post /commission_withdraw (CommissionWithdrawRequest) returns (WithdrawalLog)
|
post /commission_withdraw (CommissionWithdrawRequest) returns (WithdrawalLog)
|
||||||
|
|
||||||
|
@doc "Cancel pending withdrawal"
|
||||||
|
@handler CancelWithdrawal
|
||||||
|
post /withdrawal_cancel (CancelWithdrawalRequest) returns (WithdrawalLog)
|
||||||
|
|
||||||
@doc "Query Withdrawal Log"
|
@doc "Query Withdrawal Log"
|
||||||
@handler QueryWithdrawalLog
|
@handler QueryWithdrawalLog
|
||||||
get /withdrawal_log (QueryWithdrawalLogListRequest) returns (QueryWithdrawalLogListResponse)
|
get /withdrawal_log (QueryWithdrawalLogListRequest) returns (QueryWithdrawalLogListResponse)
|
||||||
|
|||||||
@@ -0,0 +1,358 @@
|
|||||||
|
# PPanel 日本东京区 AWS 部署说明
|
||||||
|
|
||||||
|
本目录用于在 **AWS 日本东京区 `ap-northeast-1`** 重建一套全新生产环境，并承接当前香港区 `ap-east-1` 的正式迁移。
|
||||||
|
|
||||||
|
如果你要看“当前已经真实跑起来的东京架构”，优先看：
|
||||||
|
|
||||||
|
- [`ops/hifast-current-architecture-zh.md`](/Users/Apple/code_vpn/vpn/ppanel-server/ops/hifast-current-architecture-zh.md)
|
||||||
|
- [`configs/resource-inventory.current.md`](./configs/resource-inventory.current.md)
|
||||||
|
|
||||||
|
这份 README 更偏向：
|
||||||
|
|
||||||
|
- 目标架构
|
||||||
|
- 资源规划
|
||||||
|
- 部署方法
|
||||||
|
- 后续待完成项
|
||||||
|
|
||||||
|
目标架构：
|
||||||
|
|
||||||
|
`DNS -> ALB -> WAF -> EC2(Nginx + ppanel-server + Redis + observability) -> RDS MySQL`
|
||||||
|
|
||||||
|
灾备链路：
|
||||||
|
|
||||||
|
`RDS MySQL / EC2 Redis -> 104.238.220.230 外部灾备`
|
||||||
|
|
||||||
|
当前仓库内已补充：
|
||||||
|
|
||||||
|
- 东京基础设施参数模板：[`configs/aws-jp-infra.env.example`](./configs/aws-jp-infra.env.example)
|
||||||
|
- 东京真实实施状态登记：[`configs/resource-inventory.current.md`](./configs/resource-inventory.current.md)
|
||||||
|
- 东京底座资源创建脚本：[`../../scripts/aws_jp_create_base_infra.sh`](../../scripts/aws_jp_create_base_infra.sh)
|
||||||
|
- 东京资源状态检查脚本：[`../../scripts/aws_jp_describe_state.sh`](../../scripts/aws_jp_describe_state.sh)
|
||||||
|
- MySQL 备份脚本：[`../../scripts/mysql_backup_to_s3.sh`](../../scripts/mysql_backup_to_s3.sh)
|
||||||
|
- 10 分钟 MySQL 备份定时器安装脚本：[`../../scripts/install_mysql_backup_timer.sh`](../../scripts/install_mysql_backup_timer.sh)
|
||||||
|
|
||||||
|
## 1. 资源清单
|
||||||
|
|
||||||
|
按下面顺序创建资源：
|
||||||
|
|
||||||
|
1. VPC
|
||||||
|
2. 2 个公有子网 + 2 个私有子网
|
||||||
|
3. Internet Gateway
|
||||||
|
4. 公有 / 私有路由表
|
||||||
|
5. 安全组
|
||||||
|
6. RDS MySQL
|
||||||
|
7. EC2 本机 Redis Docker
|
||||||
|
8. EC2
|
||||||
|
9. ACM 证书
|
||||||
|
10. ALB + Target Group
|
||||||
|
11. WAF Web ACL
|
||||||
|
12. 东京平行环境域名
|
||||||
|
13. 东京 S3 备份桶
|
||||||
|
|
||||||
|
建议命名：
|
||||||
|
|
||||||
|
- VPC: `ppanel-jp-prod`
|
||||||
|
- EC2: `ppanel-app-jp-01`
|
||||||
|
- RDS: `ppanel-mysql-jp`
|
||||||
|
- Redis container: `hifast-redis`
|
||||||
|
- ALB: `ppanel-alb-jp`
|
||||||
|
- WAF: `ppanel-waf-jp`
|
||||||
|
- S3: `hifast-prod-backups-200810848252-ap-northeast-1`
|
||||||
|
|
||||||
|
## 2. 默认规格
|
||||||
|
|
||||||
|
### EC2
|
||||||
|
|
||||||
|
- Region: `ap-northeast-1`
|
||||||
|
- OS: Ubuntu 24.04 LTS
|
||||||
|
- Instance type: `t4g.large`
|
||||||
|
- Disk: `gp3 80GB`
|
||||||
|
- Public subnet: 是
|
||||||
|
- IAM Role:
|
||||||
|
- 允许读取 CloudWatch / SSM（如使用）
|
||||||
|
- 如果要在东京 EC2 上执行 S3 备份：额外允许写入东京备份桶
|
||||||
|
|
||||||
|
### RDS MySQL
|
||||||
|
|
||||||
|
- Engine: `MySQL 8.4`
|
||||||
|
- Class: `db.r7g.xlarge`
|
||||||
|
- Storage: `gp3 100GB`
|
||||||
|
- DB name: `hifast`
|
||||||
|
- Username: `admin`
|
||||||
|
- Public access: `Yes`
|
||||||
|
- Charset: `utf8mb4`
|
||||||
|
- Backup retention: `7-14 days`
|
||||||
|
- Deletion protection: `On`
|
||||||
|
- Multi-AZ: `Yes`（当前按 2 实例 Multi-AZ 创建）
|
||||||
|
|
||||||
|
说明：
|
||||||
|
|
||||||
|
- 当前东京 RDS 需要允许 `104.238.220.230` 从公网直连 `3306`，用于外部 MySQL 从库复制
|
||||||
|
- 因此本阶段 RDS 使用 `public subnet group + Publicly accessible = Yes`
|
||||||
|
- 访问面只通过 `sg-rds` 严格限制到业务 EC2 安全组和 `104.238.220.230/32`
|
||||||
|
|
||||||
|
### Redis
|
||||||
|
|
||||||
|
- 部署位置：业务 EC2 本机
|
||||||
|
- 部署方式：Docker
|
||||||
|
- 版本：`redis:8.2.1`
|
||||||
|
- 监听：`0.0.0.0:6379`
|
||||||
|
- 应用连接：`127.0.0.1:6379`
|
||||||
|
- 安全组：仅对白名单备用节点 `104.238.220.230/32` 或同机应用开放
|
||||||
|
|
||||||
|
## 3. 网络与安全组
|
||||||
|
|
||||||
|
### 子网布局
|
||||||
|
|
||||||
|
- `public-a`, `public-c`: ALB / EC2
|
||||||
|
- `private-a`, `private-c`: RDS
|
||||||
|
|
||||||
|
说明：
|
||||||
|
|
||||||
|
- 东京优先使用 `ap-northeast-1a` 和 `ap-northeast-1c`
|
||||||
|
- 如果账户映射不同，也可以用任意 2 个可用区，但公私网必须各 2 个子网
|
||||||
|
|
||||||
|
### 安全组建议
|
||||||
|
|
||||||
|
#### `sg-alb`
|
||||||
|
|
||||||
|
- Inbound
|
||||||
|
- `80/tcp` from `0.0.0.0/0`
|
||||||
|
- `443/tcp` from `0.0.0.0/0`
|
||||||
|
- Outbound
|
||||||
|
- `80/tcp` to `sg-ec2`
|
||||||
|
|
||||||
|
#### `sg-ec2`
|
||||||
|
|
||||||
|
- Inbound
|
||||||
|
- `80/tcp` from `sg-alb`
|
||||||
|
- `22/tcp` from `你的固定运维 IP`
|
||||||
|
- `6379/tcp` from `104.238.220.230/32`
|
||||||
|
- Outbound
|
||||||
|
- all
|
||||||
|
|
||||||
|
说明：
|
||||||
|
|
||||||
|
- 应用容器监听 `127.0.0.1:8080`
|
||||||
|
- EC2 对外只让 Nginx 监听 `80`
|
||||||
|
- Grafana / Prometheus / Tempo 仅监听 `127.0.0.1`
|
||||||
|
|
||||||
|
#### `sg-rds`
|
||||||
|
|
||||||
|
- Inbound
|
||||||
|
- `3306/tcp` from `sg-ec2`
|
||||||
|
- `3306/tcp` from `104.238.220.230/32`
|
||||||
|
|
||||||
|
## 4. ALB / Target Group / 健康检查
|
||||||
|
|
||||||
|
### Target Group
|
||||||
|
|
||||||
|
- Type: `Instance`
|
||||||
|
- Protocol: `HTTP`
|
||||||
|
- Port: `80`
|
||||||
|
- Health check path: `/v1/common/heartbeat`
|
||||||
|
- Success code: `200`
|
||||||
|
|
||||||
|
### ALB 监听器
|
||||||
|
|
||||||
|
- `80` -> redirect to `443`
|
||||||
|
- `443` -> forward 到 target group
|
||||||
|
|
||||||
|
### ACM
|
||||||
|
|
||||||
|
- 在 `ap-northeast-1` 重新申请证书
|
||||||
|
- 先给平行环境域名，例如：
|
||||||
|
- `api-jp.hifast.biz`
|
||||||
|
- `logs-jp.hifast.biz`
|
||||||
|
|
||||||
|
## 5. WAF 规则
|
||||||
|
|
||||||
|
首版至少启用：
|
||||||
|
|
||||||
|
1. `AWSManagedRulesCommonRuleSet`
|
||||||
|
2. `AWSManagedRulesKnownBadInputsRuleSet`
|
||||||
|
3. `AWSManagedRulesAmazonIpReputationList`
|
||||||
|
4. 全站 rate-based rule
|
||||||
|
5. 针对高风险路径的 rate-based rule
|
||||||
|
|
||||||
|
建议的第一版限流：
|
||||||
|
|
||||||
|
- 全站：每 IP `2000 / 5 分钟`
|
||||||
|
- `/v1/public/user/subscribe`：每 IP `300 / 5 分钟`
|
||||||
|
- 登录 / 注册 / 验证码接口：每 IP `100 / 5 分钟`
|
||||||
|
|
||||||
|
节点上报接口建议后续补：
|
||||||
|
|
||||||
|
- `/v1/server/status`
|
||||||
|
- `/v1/server/online`
|
||||||
|
- `/v1/server/traffic`
|
||||||
|
|
||||||
|
## 6. EC2 文件落地
|
||||||
|
|
||||||
|
在 EC2 上建议使用：
|
||||||
|
|
||||||
|
- 应用目录：`/opt/ppanel`
|
||||||
|
- Nginx 配置：`/etc/nginx/sites-available/ppanel-api.conf`
|
||||||
|
|
||||||
|
需要上传这些文件 / 目录：
|
||||||
|
|
||||||
|
- `docker-compose.cloud.yml`
|
||||||
|
- `deploy/aws/ap-northeast-1/configs/ppanel.yaml.example` -> 重命名为 `configs/ppanel.yaml`
|
||||||
|
- `deploy/aws/ap-northeast-1/nginx/ppanel-api.conf`
|
||||||
|
- `grafana/`
|
||||||
|
- `loki/`
|
||||||
|
- `prometheus/`
|
||||||
|
- `tempo/`
|
||||||
|
- `.env.example` -> 重命名为 `.env`
|
||||||
|
|
||||||
|
目标目录示例：
|
||||||
|
|
||||||
|
```text
|
||||||
|
/opt/ppanel/
|
||||||
|
docker-compose.cloud.yml
|
||||||
|
.env
|
||||||
|
configs/ppanel.yaml
|
||||||
|
grafana/
|
||||||
|
loki/
|
||||||
|
prometheus/
|
||||||
|
tempo/
|
||||||
|
logs/
|
||||||
|
cache/
|
||||||
|
tempo_data/
|
||||||
|
```
|
||||||
|
|
||||||
|
## 7. 应用配置
|
||||||
|
|
||||||
|
基线模板见：
|
||||||
|
|
||||||
|
- [`configs/ppanel.yaml.example`](./configs/ppanel.yaml.example)
|
||||||
|
- [`nginx/ppanel-api.conf`](./nginx/ppanel-api.conf)
|
||||||
|
|
||||||
|
关键值必须替换：
|
||||||
|
|
||||||
|
- `MySQL.Addr`
|
||||||
|
- `MySQL.Password`
|
||||||
|
- `Redis.Host`
|
||||||
|
- `Redis.Pass`
|
||||||
|
- `JwtAuth.AccessSecret`
|
||||||
|
- `Administrator.Email`
|
||||||
|
- `Administrator.Password`
|
||||||
|
- `AppSignature.AppSecrets.*`
|
||||||
|
- `device.security_secret`
|
||||||
|
- `Site.Host`
|
||||||
|
- `Site.SiteName`
|
||||||
|
|
||||||
|
Redis 约定保持不变：
|
||||||
|
|
||||||
|
- 业务缓存：DB `0`
|
||||||
|
- Asynq：DB `5`
|
||||||
|
|
||||||
|
## 8. 部署步骤
|
||||||
|
|
||||||
|
### 8.0 创建东京基础设施
|
||||||
|
|
||||||
|
如果本机或跳板机已经配置好 AWS CLI 凭据，可以先直接执行：
|
||||||
|
|
||||||
|
```bash
|
||||||
|
cp deploy/aws/ap-northeast-1/configs/aws-jp-infra.env.example /root/aws-jp-infra.env
|
||||||
|
chmod 600 /root/aws-jp-infra.env
|
||||||
|
vim /root/aws-jp-infra.env
|
||||||
|
|
||||||
|
chmod +x deploy/scripts/aws_jp_create_base_infra.sh
|
||||||
|
bash deploy/scripts/aws_jp_create_base_infra.sh /root/aws-jp-infra.env
|
||||||
|
```
|
||||||
|
|
||||||
|
执行后可用下面命令随时核对东京底座状态：
|
||||||
|
|
||||||
|
```bash
|
||||||
|
chmod +x deploy/scripts/aws_jp_describe_state.sh
|
||||||
|
bash deploy/scripts/aws_jp_describe_state.sh /root/aws-jp-infra.env
|
||||||
|
```
|
||||||
|
|
||||||
|
### 8.1 初始化 EC2
|
||||||
|
|
||||||
|
把脚本上传到东京 EC2 后执行：
|
||||||
|
|
||||||
|
```bash
|
||||||
|
chmod +x deploy/scripts/bootstrap_aws_ec2.sh
|
||||||
|
sudo APP_DIR=/opt/ppanel APP_USER=ubuntu deploy/scripts/bootstrap_aws_ec2.sh
|
||||||
|
```
|
||||||
|
|
||||||
|
### 8.2 安装 Nginx 配置
|
||||||
|
|
||||||
|
```bash
|
||||||
|
sudo cp deploy/aws/ap-northeast-1/nginx/ppanel-api.conf /etc/nginx/sites-available/ppanel-api.conf
|
||||||
|
sudo ln -sf /etc/nginx/sites-available/ppanel-api.conf /etc/nginx/sites-enabled/ppanel-api.conf
|
||||||
|
sudo nginx -t
|
||||||
|
sudo systemctl reload nginx
|
||||||
|
```
|
||||||
|
|
||||||
|
### 8.3 启动容器
|
||||||
|
|
||||||
|
```bash
|
||||||
|
cd /opt/ppanel
|
||||||
|
docker compose -f docker-compose.cloud.yml up -d
|
||||||
|
```
|
||||||
|
|
||||||
|
### 8.4 预检
|
||||||
|
|
||||||
|
```bash
|
||||||
|
chmod +x deploy/scripts/preflight_aws_jp.sh
|
||||||
|
APP_DIR=/opt/ppanel \
|
||||||
|
RDS_HOST=<TOKYO_RDS_ENDPOINT> \
|
||||||
|
REDIS_HOST=127.0.0.1 \
|
||||||
|
deploy/scripts/preflight_aws_jp.sh
|
||||||
|
```
|
||||||
|
|
||||||
|
## 9. 数据迁移与切换
|
||||||
|
|
||||||
|
正式迁移请按：
|
||||||
|
|
||||||
|
- [`ops/hifast-aws-jp-migration-runbook-zh.md`](/Users/Apple/code_vpn/vpn/ppanel-server/ops/hifast-aws-jp-migration-runbook-zh.md)
|
||||||
|
|
||||||
|
执行。
|
||||||
|
|
||||||
|
核心原则：
|
||||||
|
|
||||||
|
- 先搭平行环境
|
||||||
|
- 停机后再导出香港主数据
|
||||||
|
- 东京验收通过后再切正式域名
|
||||||
|
- 切换后再重挂 `104` 灾备
|
||||||
|
|
||||||
|
## 10. 104 灾备节点常用模板
|
||||||
|
|
||||||
|
如果迁移完成后要把 `104.238.220.230` 重挂为东京主站从库，可复用：
|
||||||
|
|
||||||
|
- [`deploy/scripts/hifast_mysql_seed_primary_and_replica.sh`](/Users/Apple/code_vpn/vpn/ppanel-server/deploy/scripts/hifast_mysql_seed_primary_and_replica.sh)
|
||||||
|
- [`deploy/scripts/hifast_mysql_attach_replica.sh`](/Users/Apple/code_vpn/vpn/ppanel-server/deploy/scripts/hifast_mysql_attach_replica.sh)
|
||||||
|
- [`deploy/scripts/hifast_redis_attach_replica.sh`](/Users/Apple/code_vpn/vpn/ppanel-server/deploy/scripts/hifast_redis_attach_replica.sh)
|
||||||
|
- [`deploy/scripts/hifast_data_sync_tool.sh`](/Users/Apple/code_vpn/vpn/ppanel-server/deploy/scripts/hifast_data_sync_tool.sh)
|
||||||
|
- [`configs/replica-ops.env.example`](./configs/replica-ops.env.example)
|
||||||
|
|
||||||
|
## 11. 东京资源创建前置检查
|
||||||
|
|
||||||
|
在 AWS 控制台里至少先确认：
|
||||||
|
|
||||||
|
- 东京区已启用
|
||||||
|
- `ap-northeast-1` 可创建 `t4g.large`
|
||||||
|
- `ap-northeast-1` RDS 可创建 `db.r7g.xlarge`
|
||||||
|
- ACM / ALB / WAF / S3 服务在东京区可正常使用
|
||||||
|
- Tokyo 对应配额满足：
|
||||||
|
- On-Demand Standard vCPU
|
||||||
|
- ALB 数量
|
||||||
|
- Elastic IP（如需）
|
||||||
|
- RDS 实例数
|
||||||
|
|
||||||
|
## 12. 当前已知真实进度
|
||||||
|
|
||||||
|
截至 `2026-05-20`，已知状态如下：
|
||||||
|
|
||||||
|
- 东京 VPC `ppanel-jp-prod` 已创建
|
||||||
|
- VPC ID: `vpc-0846b23b4a7d64eac`
|
||||||
|
- VPC CIDR: `10.20.0.0/16`
|
||||||
|
- 4 个子网在 AWS 控制台里曾填写完成，但提交时控制台 session 失效
|
||||||
|
- 因此：
|
||||||
|
- 子网是否真正创建成功，需要重新核实
|
||||||
|
- IGW / 路由表 / 安全组 / RDS / EC2 / ALB / WAF 都应按“未完成”处理，重新复核
|
||||||
|
|
||||||
|
实时状态请以后续更新的 [`configs/resource-inventory.current.md`](./configs/resource-inventory.current.md) 为准。
|
||||||
@@ -0,0 +1,55 @@
|
|||||||
|
AWS_REGION=ap-northeast-1
|
||||||
|
AWS_ACCOUNT_ID=200810848252
|
||||||
|
|
||||||
|
VPC_NAME=ppanel-jp-prod
|
||||||
|
VPC_ID=
|
||||||
|
VPC_CIDR=10.20.0.0/16
|
||||||
|
|
||||||
|
PUBLIC_SUBNET_A_NAME=ppanel-jp-public-a
|
||||||
|
PUBLIC_SUBNET_A_AZ=ap-northeast-1a
|
||||||
|
PUBLIC_SUBNET_A_CIDR=10.20.0.0/24
|
||||||
|
|
||||||
|
PUBLIC_SUBNET_C_NAME=ppanel-jp-public-c
|
||||||
|
PUBLIC_SUBNET_C_AZ=ap-northeast-1c
|
||||||
|
PUBLIC_SUBNET_C_CIDR=10.20.1.0/24
|
||||||
|
|
||||||
|
PRIVATE_SUBNET_A_NAME=ppanel-jp-private-a
|
||||||
|
PRIVATE_SUBNET_A_AZ=ap-northeast-1a
|
||||||
|
PRIVATE_SUBNET_A_CIDR=10.20.10.0/24
|
||||||
|
|
||||||
|
PRIVATE_SUBNET_C_NAME=ppanel-jp-private-c
|
||||||
|
PRIVATE_SUBNET_C_AZ=ap-northeast-1c
|
||||||
|
PRIVATE_SUBNET_C_CIDR=10.20.11.0/24
|
||||||
|
|
||||||
|
IGW_NAME=ppanel-jp-igw
|
||||||
|
PUBLIC_ROUTE_TABLE_NAME=ppanel-jp-public-rt
|
||||||
|
PRIVATE_ROUTE_TABLE_NAME=ppanel-jp-private-rt
|
||||||
|
|
||||||
|
SG_ALB_NAME=ppanel-jp-sg-alb
|
||||||
|
SG_EC2_NAME=ppanel-jp-sg-ec2
|
||||||
|
SG_RDS_NAME=ppanel-jp-sg-rds
|
||||||
|
|
||||||
|
OPS_SSH_CIDR=CHANGE_ME_TO_YOUR_FIXED_PUBLIC_IP_OR_CIDR
|
||||||
|
DR_REPLICA_IP=104.238.220.230/32
|
||||||
|
|
||||||
|
EC2_NAME=ppanel-app-jp-01
|
||||||
|
EC2_AMI_FAMILY=ubuntu-24.04
|
||||||
|
EC2_INSTANCE_TYPE=t4g.large
|
||||||
|
EC2_DISK_GB=80
|
||||||
|
EC2_KEY_PAIR=CHANGE_ME
|
||||||
|
|
||||||
|
RDS_IDENTIFIER=ppanel-mysql-jp
|
||||||
|
RDS_DB_NAME=hifast
|
||||||
|
RDS_ADMIN_USER=admin
|
||||||
|
RDS_INSTANCE_CLASS=db.r7g.xlarge
|
||||||
|
RDS_STORAGE_GB=100
|
||||||
|
|
||||||
|
ALB_NAME=ppanel-alb-jp
|
||||||
|
TARGET_GROUP_NAME=ppanel-tg-jp
|
||||||
|
WAF_NAME=ppanel-waf-jp
|
||||||
|
|
||||||
|
PARALLEL_API_DOMAIN=api-jp.hifast.biz
|
||||||
|
PARALLEL_LOGS_DOMAIN=logs-jp.hifast.biz
|
||||||
|
PRODUCTION_API_DOMAIN=CHANGE_ME
|
||||||
|
|
||||||
|
S3_BACKUP_BUCKET=hifast-prod-backups-200810848252-ap-northeast-1
|
||||||
@@ -0,0 +1,19 @@
|
|||||||
|
AWS_REGION=ap-northeast-1
|
||||||
|
S3_BUCKET=hifast-prod-backups-200810848252-ap-northeast-1
|
||||||
|
S3_PREFIX=mysql
|
||||||
|
BACKUP_DIR=/var/backups/hifast
|
||||||
|
HOST_TAG=104-standby-for-jp
|
||||||
|
KEEP_LOCAL_DAYS=3
|
||||||
|
CHECK_REPLICA=1
|
||||||
|
|
||||||
|
MYSQL_HOST=127.0.0.1
|
||||||
|
MYSQL_PORT=3306
|
||||||
|
MYSQL_USER=backup_reader
|
||||||
|
MYSQL_PASSWORD=CHANGE_ME
|
||||||
|
MYSQL_SOCKET=
|
||||||
|
MYSQL_DATABASE=hifast
|
||||||
|
|
||||||
|
REDIS_HOST=127.0.0.1
|
||||||
|
REDIS_PORT=6379
|
||||||
|
REDIS_PASSWORD=CHANGE_ME
|
||||||
|
|
||||||
@@ -0,0 +1,21 @@
|
|||||||
|
PRIMARY_HOST=ppanel-mysql-jp.<CHANGE_ME>.ap-northeast-1.rds.amazonaws.com
|
||||||
|
PRIMARY_PORT=3306
|
||||||
|
PRIMARY_USER=admin
|
||||||
|
PRIMARY_PASSWORD=CHANGE_ME
|
||||||
|
PRIMARY_DB=hifast
|
||||||
|
|
||||||
|
PRIMARY_REPL_USER=repl
|
||||||
|
PRIMARY_REPL_PASSWORD=CHANGE_ME
|
||||||
|
PRIMARY_REPL_HOST=104.238.220.230
|
||||||
|
PRIMARY_BINLOG_RETENTION_HOURS=24
|
||||||
|
|
||||||
|
REPLICA_HOST=127.0.0.1
|
||||||
|
REPLICA_PORT=3306
|
||||||
|
REPLICA_USER=root
|
||||||
|
REPLICA_PASSWORD=
|
||||||
|
REPLICA_SOCKET=/var/run/mysqld/mysqld.sock
|
||||||
|
REPLICA_DB=hifast
|
||||||
|
REPLICA_SOURCE_SSL=1
|
||||||
|
|
||||||
|
DUMP_FILE=
|
||||||
|
|
||||||
@@ -0,0 +1,112 @@
|
|||||||
|
Host: 0.0.0.0
|
||||||
|
Port: 8080
|
||||||
|
Debug: false
|
||||||
|
|
||||||
|
JwtAuth:
|
||||||
|
AccessSecret: CHANGE_ME_TO_A_LONG_RANDOM_SECRET
|
||||||
|
AccessExpire: 604800
|
||||||
|
|
||||||
|
Logger:
|
||||||
|
ServiceName: PPanel
|
||||||
|
Mode: console
|
||||||
|
Encoding: plain
|
||||||
|
TimeFormat: "2006-01-02 15:04:05.000"
|
||||||
|
Path: logs
|
||||||
|
Level: info
|
||||||
|
MaxContentLength: 0
|
||||||
|
Compress: false
|
||||||
|
Stat: true
|
||||||
|
KeepDays: 7
|
||||||
|
StackCooldownMillis: 100
|
||||||
|
MaxBackups: 7
|
||||||
|
MaxSize: 100
|
||||||
|
Rotation: daily
|
||||||
|
FileTimeFormat: "2006-01-02T15:04:05.000Z07:00"
|
||||||
|
|
||||||
|
MySQL:
|
||||||
|
Addr: YOUR_TOKYO_RDS_ENDPOINT:3306
|
||||||
|
Dbname: hifast
|
||||||
|
Username: admin
|
||||||
|
Password: CHANGE_ME_TO_TOKYO_RDS_PASSWORD
|
||||||
|
Config: charset=utf8mb4&parseTime=true&loc=Asia%2FTokyo
|
||||||
|
MaxIdleConns: 10
|
||||||
|
MaxOpenConns: 100
|
||||||
|
SlowThreshold: 1000
|
||||||
|
|
||||||
|
Redis:
|
||||||
|
Host: 127.0.0.1:6379
|
||||||
|
Pass: CHANGE_ME_TO_TOKYO_REDIS_PASSWORD
|
||||||
|
DB: 0
|
||||||
|
PoolSize: 100
|
||||||
|
MinIdleConns: 10
|
||||||
|
MaxRetries: 3
|
||||||
|
PoolTimeout: 4
|
||||||
|
IdleTimeout: 300
|
||||||
|
MaxConnAge: 0
|
||||||
|
DialTimeout: 5
|
||||||
|
ReadTimeout: 3
|
||||||
|
WriteTimeout: 3
|
||||||
|
|
||||||
|
Trace:
|
||||||
|
Name: ppanel-server
|
||||||
|
Endpoint: 127.0.0.1:4317
|
||||||
|
Sampler: 0.1
|
||||||
|
Batcher: otlpgrpc
|
||||||
|
|
||||||
|
Site:
|
||||||
|
Host: api-jp.hifast.biz
|
||||||
|
SiteName: HiFastVPN
|
||||||
|
|
||||||
|
Administrator:
|
||||||
|
Email: admin@example.com
|
||||||
|
Password: CHANGE_ME_TO_STRONG_ADMIN_PASSWORD
|
||||||
|
|
||||||
|
Telegram:
|
||||||
|
Enable: false
|
||||||
|
BotID: 0
|
||||||
|
BotName: ""
|
||||||
|
BotToken: ""
|
||||||
|
GroupChatID: ""
|
||||||
|
EnableNotify: false
|
||||||
|
WebHookDomain: ""
|
||||||
|
|
||||||
|
Kutt:
|
||||||
|
Enable: false
|
||||||
|
ApiURL: ""
|
||||||
|
ApiKey: ""
|
||||||
|
TargetURL: ""
|
||||||
|
Domain: ""
|
||||||
|
|
||||||
|
OpenInstall:
|
||||||
|
Enable: false
|
||||||
|
AppKey: ""
|
||||||
|
ApiKey: ""
|
||||||
|
|
||||||
|
Loki:
|
||||||
|
Enable: true
|
||||||
|
URL: "http://localhost:3100"
|
||||||
|
|
||||||
|
AppSignature:
|
||||||
|
AppSecrets:
|
||||||
|
android-client: CHANGE_ME_ANDROID_SIGNATURE_SECRET
|
||||||
|
ios-client: CHANGE_ME_IOS_SIGNATURE_SECRET
|
||||||
|
web-client: CHANGE_ME_WEB_SIGNATURE_SECRET
|
||||||
|
ValidWindowSeconds: 300
|
||||||
|
SkipPrefixes:
|
||||||
|
- /v1/notify/
|
||||||
|
- /v1/iap/notifications
|
||||||
|
- /v1/telegram/webhook
|
||||||
|
- /v1/subscribe/config
|
||||||
|
|
||||||
|
Signature:
|
||||||
|
EnableSignature: false
|
||||||
|
|
||||||
|
device:
|
||||||
|
enable: true
|
||||||
|
security_secret: CHANGE_ME_DEVICE_SECURITY_SECRET
|
||||||
|
|
||||||
|
Register:
|
||||||
|
EnableTrial: true
|
||||||
|
EnableTrialEmailWhitelist: true
|
||||||
|
TrialEmailDomainWhitelist: "gmail.com,outlook.com,icloud.com,qq.com,163.com"
|
||||||
|
|
||||||
@@ -0,0 +1,23 @@
|
|||||||
|
MYSQL_HOST=127.0.0.1
|
||||||
|
MYSQL_PORT=3306
|
||||||
|
MYSQL_USER=root
|
||||||
|
MYSQL_PASSWORD=CHANGE_ME
|
||||||
|
MYSQL_SOCKET=
|
||||||
|
|
||||||
|
REPL_SOURCE_HOST=ppanel-mysql-jp.cpo0keikgh80.ap-northeast-1.rds.amazonaws.com
|
||||||
|
REPL_SOURCE_PORT=3306
|
||||||
|
REPL_SOURCE_USER=repl
|
||||||
|
REPL_SOURCE_PASSWORD=XwWrQGVWtxmXJ3etHmkFvnRSD54MKYer
|
||||||
|
REPL_SOURCE_SSL=1
|
||||||
|
REPL_SOURCE_LOG_FILE=mysql-bin-changelog.000189
|
||||||
|
REPL_SOURCE_LOG_POS=185053
|
||||||
|
REPL_SOURCE_AUTO_POSITION=1
|
||||||
|
|
||||||
|
REDIS_HOST=127.0.0.1
|
||||||
|
REDIS_PORT=6379
|
||||||
|
REDIS_PASSWORD=CHANGE_ME
|
||||||
|
|
||||||
|
REDIS_SOURCE_HOST=3.114.29.208
|
||||||
|
REDIS_SOURCE_PORT=6379
|
||||||
|
REDIS_SOURCE_USER=
|
||||||
|
REDIS_SOURCE_PASSWORD=hifast67yj
|
||||||
@@ -0,0 +1,187 @@
|
|||||||
|
# Tokyo Resource Inventory
|
||||||
|
|
||||||
|
最后更新：`2026-05-21`
|
||||||
|
|
||||||
|
这个文件记录当前东京迁移的真实实施状态，不是示例。
|
||||||
|
|
||||||
|
## Region
|
||||||
|
|
||||||
|
- AWS account: `hifastvpn (200810848252)`
|
||||||
|
- Region: `ap-northeast-1`
|
||||||
|
|
||||||
|
## Current Status
|
||||||
|
|
||||||
|
- 东京迁移方案已在仓库内落地为执行资产
|
||||||
|
- 东京 VPC 已创建
|
||||||
|
- 东京子网、IGW、路由表已在 AWS 控制台创建并复核
|
||||||
|
- 东京三层安全组已在 AWS 控制台创建并复核
|
||||||
|
- 东京 VPC DNS 开关已开启，可支持公网可访问 RDS
|
||||||
|
- 东京 S3 备份桶已在 AWS 控制台创建并复核
|
||||||
|
- 东京 ACM 证书请求已创建，等待 DNS 验证
|
||||||
|
- 东京 RDS MySQL 已创建完成并可用
|
||||||
|
- 东京业务 EC2 已创建完成并绑定固定 EIP
|
||||||
|
- 因当前本机没有可用 AWS CLI 凭据，云上资源状态仍需在 AWS 控制台或已登录环境中复查
|
||||||
|
|
||||||
|
## Networking
|
||||||
|
|
||||||
|
- VPC
|
||||||
|
- Name: `ppanel-jp-prod`
|
||||||
|
- VPC ID: `vpc-0846b23b4a7d64eac`
|
||||||
|
- CIDR: `10.20.0.0/16`
|
||||||
|
- Status: `created`
|
||||||
|
- Public subnet A
|
||||||
|
- Name: `ppanel-jp-public-a`
|
||||||
|
- AZ: `ap-northeast-1a`
|
||||||
|
- CIDR: `10.20.0.0/24`
|
||||||
|
- Subnet ID: `subnet-091232bdb53e71490`
|
||||||
|
- Status: `created`
|
||||||
|
- Public subnet C
|
||||||
|
- Name: `ppanel-jp-public-c`
|
||||||
|
- AZ: `ap-northeast-1c`
|
||||||
|
- CIDR: `10.20.1.0/24`
|
||||||
|
- Subnet ID: `subnet-01ba0975c525ce8cf`
|
||||||
|
- Status: `created`
|
||||||
|
- Private subnet A
|
||||||
|
- Name: `ppanel-jp-private-a`
|
||||||
|
- AZ: `ap-northeast-1a`
|
||||||
|
- CIDR: `10.20.10.0/24`
|
||||||
|
- Subnet ID: `subnet-0bd13111c02f0edbe`
|
||||||
|
- Status: `created`
|
||||||
|
- Private subnet C
|
||||||
|
- Name: `ppanel-jp-private-c`
|
||||||
|
- AZ: `ap-northeast-1c`
|
||||||
|
- CIDR: `10.20.11.0/24`
|
||||||
|
- Subnet ID: `subnet-0d86c5c756dbc84b2`
|
||||||
|
- Status: `created`
|
||||||
|
- Internet Gateway
|
||||||
|
- Name: `ppanel-jp-igw`
|
||||||
|
- IGW ID: `igw-028041bcbf63b672c`
|
||||||
|
- Status: `created`
|
||||||
|
- Public route table
|
||||||
|
- Name: `ppanel-jp-public-rt`
|
||||||
|
- Route Table ID: `rtb-061b101080e4800e5`
|
||||||
|
- Default route: `0.0.0.0/0 -> igw-028041bcbf63b672c`
|
||||||
|
- Status: `created`
|
||||||
|
- Private route table
|
||||||
|
- Name: `ppanel-jp-private-rt`
|
||||||
|
- Route Table ID: `rtb-0d7a191a515031c45`
|
||||||
|
- Status: `created`
|
||||||
|
|
||||||
|
## Security
|
||||||
|
|
||||||
|
- `sg-alb`
|
||||||
|
- Name: `ppanel-jp-sg-alb`
|
||||||
|
- Security Group ID: `sg-0b3a23c31041a5a5a`
|
||||||
|
- Inbound:
|
||||||
|
- `80/tcp <- 0.0.0.0/0`
|
||||||
|
- `443/tcp <- 0.0.0.0/0`
|
||||||
|
- Status: `created`
|
||||||
|
- `sg-ec2`
|
||||||
|
- Name: `ppanel-jp-sg-ec2`
|
||||||
|
- Security Group ID: `sg-01f2a5a81e7505c91`
|
||||||
|
- Inbound:
|
||||||
|
- `80/tcp <- sg-0b3a23c31041a5a5a`
|
||||||
|
- `22/tcp <- 64.118.144.142/32`
|
||||||
|
- `6379/tcp <- 104.238.220.230/32`
|
||||||
|
- Status: `created`
|
||||||
|
- `sg-rds`
|
||||||
|
- Name: `ppanel-jp-sg-rds`
|
||||||
|
- Security Group ID: `sg-0b71db1e2c18b57c0`
|
||||||
|
- Inbound:
|
||||||
|
- `3306/tcp <- sg-01f2a5a81e7505c91`
|
||||||
|
- `3306/tcp <- 104.238.220.230/32`
|
||||||
|
- Status: `created`
|
||||||
|
|
||||||
|
## Compute / Database / Edge
|
||||||
|
|
||||||
|
- EC2 `ppanel-app-jp-01`:
|
||||||
|
- Instance ID: `i-07839130074cd7ed9`
|
||||||
|
- Type: `c7i.xlarge`
|
||||||
|
- Platform: `Ubuntu 26.04 / Linux`
|
||||||
|
- AZ: `ap-northeast-1c`
|
||||||
|
- VPC: `ppanel-jp-prod (vpc-0846b23b4a7d64eac)`
|
||||||
|
- Subnet: `ppanel-jp-public-c (subnet-01ba0975c525ce8cf)`
|
||||||
|
- Private IP: `10.20.1.168`
|
||||||
|
- Public IP / Elastic IP: `3.114.29.208`
|
||||||
|
- Public DNS: `ec2-3-114-29-208.ap-northeast-1.compute.amazonaws.com`
|
||||||
|
- Security group: `ppanel-jp-sg-ec2 (sg-01f2a5a81e7505c91)`
|
||||||
|
- Key pair: `ppanel-jp-key-20260521`
|
||||||
|
- Root volume: `gp3 100GiB`
|
||||||
|
- ENI: `eni-08accb427a470c9f7`
|
||||||
|
- EIP allocation ID: `eipalloc-038b32d5c0119accf`
|
||||||
|
- EIP association ID: `eipassoc-09184aa9161b6a4d9`
|
||||||
|
- Status: `running`
|
||||||
|
- SSH recovery private key: `deploy/aws/ap-northeast-1/keys/ppanel-jp-recovery`
|
||||||
|
- SSH recovery public key: `deploy/aws/ap-northeast-1/keys/ppanel-jp-recovery.pub`
|
||||||
|
- RDS subnet group:
|
||||||
|
- Name: `ppanel-jp-rds-subnet-group`
|
||||||
|
- VPC: `vpc-0846b23b4a7d64eac`
|
||||||
|
- Subnets:
|
||||||
|
- `subnet-0bd13111c02f0edbe` / `ppanel-jp-private-a`
|
||||||
|
- `subnet-0d86c5c756dbc84b2` / `ppanel-jp-private-c`
|
||||||
|
- Status: `created`
|
||||||
|
- RDS public subnet group:
|
||||||
|
- Name: `ppanel-jp-rds-public-subnet-group`
|
||||||
|
- VPC: `vpc-0846b23b4a7d64eac`
|
||||||
|
- Subnets:
|
||||||
|
- `subnet-091232bdb53e71490` / `ppanel-jp-public-a`
|
||||||
|
- `subnet-01ba0975c525ce8cf` / `ppanel-jp-public-c`
|
||||||
|
- Status: `created`
|
||||||
|
- RDS `ppanel-mysql-jp`:
|
||||||
|
- Engine: `MySQL Community 8.4.8`
|
||||||
|
- Class: `db.r7g.xlarge`
|
||||||
|
- Storage: `gp3 100GiB`
|
||||||
|
- Deployment: `Single instance (current actual state)`
|
||||||
|
- VPC: `ppanel-jp-prod (vpc-0846b23b4a7d64eac)`
|
||||||
|
- Subnet group: `ppanel-jp-rds-public-subnet-group`
|
||||||
|
- Security group: `ppanel-jp-sg-rds (sg-0b71db1e2c18b57c0)`
|
||||||
|
- Master username: `admin`
|
||||||
|
- Credential management: `self-managed`
|
||||||
|
- Secrets Manager managed password: `disabled`
|
||||||
|
- Current master password visibility: `not retrievable from AWS console; reset only`
|
||||||
|
- Public access: `enabled (set at creation time for external replication)`
|
||||||
|
- Status: `available`
|
||||||
|
- Endpoint: `ppanel-mysql-jp.cpo0keikgh80.ap-northeast-1.rds.amazonaws.com`
|
||||||
|
- Public IP (resolved via public DNS): `52.196.204.186`
|
||||||
|
- Connection test from Tokyo EC2:
|
||||||
|
- `mysql -h ppanel-mysql-jp.cpo0keikgh80.ap-northeast-1.rds.amazonaws.com -u admin -e "select 1"`
|
||||||
|
- Result: `ERROR 1045 (28000): Access denied for user 'admin'@'ip-10-20-1-168.ap-northeast-1.compute.internal' (using password: NO)`
|
||||||
|
- Meaning: `network path and security group are working; only the password is missing`
|
||||||
|
- Current admin password: `TkyRds20260521!N9mQ8sKe2vLp7Xa`
|
||||||
|
- External replica prep for `104.238.220.230`:
|
||||||
|
- binlog retention hours: `24`
|
||||||
|
- replication user: `repl@104.238.220.230`
|
||||||
|
- replication password: `XwWrQGVWtxmXJ3etHmkFvnRSD54MKYer`
|
||||||
|
- current binlog file: `mysql-bin-changelog.000189`
|
||||||
|
- current binlog position: `185053`
|
||||||
|
- ALB `ppanel-alb-jp`: `not created`
|
||||||
|
- WAF `ppanel-waf-jp`: `not created`
|
||||||
|
- ACM certificate in `ap-northeast-1`:
|
||||||
|
- Certificate ID: `29d0b9b6-ab37-44d9-ad9e-18fa7e9aae3a`
|
||||||
|
- Domains:
|
||||||
|
- `api-jp.hifast.biz`
|
||||||
|
- `logs-jp.hifast.biz`
|
||||||
|
- Status: `pending_validation`
|
||||||
|
- Route 53 hosted zone in current AWS account: `not found`
|
||||||
|
- S3 backup bucket `hifast-prod-backups-200810848252-ap-northeast-1`: `created`
|
||||||
|
|
||||||
|
## Domains
|
||||||
|
|
||||||
|
- Parallel API domain: `api-jp.hifast.biz`
|
||||||
|
- Parallel logs domain: `logs-jp.hifast.biz`
|
||||||
|
- Production API domain: `pending user final confirmation`
|
||||||
|
- ACM DNS validation records pending external DNS add:
|
||||||
|
- `api-jp.hifast.biz`
|
||||||
|
- Name: `_0de5970dfbadaf46759447b2ea627a10.api-jp.hifast.biz.`
|
||||||
|
- Type: `CNAME`
|
||||||
|
- Value: `_6a632a5b85c5b3f304cc492090b741b3.jkddzztszm.acm-validations.aws.`
|
||||||
|
- `logs-jp.hifast.biz`
|
||||||
|
- Name: `_349a2b2bc4678d76c3ab341ccf73db61.logs-jp.hifast.biz.`
|
||||||
|
- Type: `CNAME`
|
||||||
|
- Value: `_74ced20dc96aa39070188605cf0ced18.jkddzztszm.acm-validations.aws.`
|
||||||
|
|
||||||
|
## DR
|
||||||
|
|
||||||
|
- DR host: `104.238.220.230`
|
||||||
|
- Planned MySQL upstream after cutover: `Tokyo RDS`
|
||||||
|
- Planned Redis upstream after cutover: `Tokyo EC2 public IP`
|
||||||
@@ -0,0 +1,69 @@
|
|||||||
|
# Tokyo Resource Inventory Example
|
||||||
|
|
||||||
|
Use this file as the single source of truth while building the Tokyo environment.
|
||||||
|
|
||||||
|
## Region
|
||||||
|
|
||||||
|
- AWS account: `hifastvpn (200810848252)`
|
||||||
|
- Region: `ap-northeast-1`
|
||||||
|
|
||||||
|
## DNS
|
||||||
|
|
||||||
|
- Production API domain: `CHANGE_ME`
|
||||||
|
- Parallel API domain: `api-jp.hifast.biz`
|
||||||
|
- Parallel logs domain: `logs-jp.hifast.biz`
|
||||||
|
|
||||||
|
## Networking
|
||||||
|
|
||||||
|
- VPC name: `ppanel-jp-prod`
|
||||||
|
- VPC CIDR: `10.20.0.0/16`
|
||||||
|
- Public subnet A: `10.20.0.0/24`
|
||||||
|
- Public subnet C: `10.20.1.0/24`
|
||||||
|
- Private subnet A: `10.20.10.0/24`
|
||||||
|
- Private subnet C: `10.20.11.0/24`
|
||||||
|
- Ops CIDR for SSH: `CHANGE_ME`
|
||||||
|
|
||||||
|
## Compute
|
||||||
|
|
||||||
|
- EC2 name: `ppanel-app-jp-01`
|
||||||
|
- EC2 type: `t4g.large`
|
||||||
|
- EC2 disk: `gp3 80GB`
|
||||||
|
- SSH key pair: `CHANGE_ME`
|
||||||
|
|
||||||
|
## Database
|
||||||
|
|
||||||
|
- RDS identifier: `ppanel-mysql-jp`
|
||||||
|
- RDS engine: `MySQL 8.4`
|
||||||
|
- RDS class: `db.r7g.xlarge`
|
||||||
|
- RDS storage: `gp3 100GB`
|
||||||
|
- DB name: `hifast`
|
||||||
|
- DB admin user: `admin`
|
||||||
|
|
||||||
|
## Cache
|
||||||
|
|
||||||
|
- Redis container: `hifast-redis`
|
||||||
|
- Redis port: `6379`
|
||||||
|
- Redis password: `CHANGE_ME`
|
||||||
|
|
||||||
|
## Security / Secrets
|
||||||
|
|
||||||
|
- JWT secret: `CHANGE_ME`
|
||||||
|
- Admin email: `CHANGE_ME`
|
||||||
|
- Admin password: `CHANGE_ME`
|
||||||
|
- Android app signature secret: `CHANGE_ME`
|
||||||
|
- iOS app signature secret: `CHANGE_ME`
|
||||||
|
- Web app signature secret: `CHANGE_ME`
|
||||||
|
- Device security secret: `CHANGE_ME`
|
||||||
|
|
||||||
|
## Backup
|
||||||
|
|
||||||
|
- S3 backup bucket: `hifast-prod-backups-200810848252-ap-northeast-1`
|
||||||
|
- Versioning: `Enabled`
|
||||||
|
|
||||||
|
## DR
|
||||||
|
|
||||||
|
- DR host: `104.238.220.230`
|
||||||
|
- MySQL repl user: `repl`
|
||||||
|
- MySQL repl password: `CHANGE_ME`
|
||||||
|
- Redis source password: `CHANGE_ME`
|
||||||
|
|
||||||
@@ -0,0 +1,7 @@
|
|||||||
|
-----BEGIN OPENSSH PRIVATE KEY-----
|
||||||
|
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
|
||||||
|
QyNTUxOQAAACBsJxZDjKvaIdVjer3QMHRYw43wkVnzHurA2TQqHlr1YwAAAKBaQXT3WkF0
|
||||||
|
9wAAAAtzc2gtZWQyNTUxOQAAACBsJxZDjKvaIdVjer3QMHRYw43wkVnzHurA2TQqHlr1Yw
|
||||||
|
AAAEArWQWWwPoJp+za5JhSnrE0Pw1/TtqWRrdY5e8hULqYDGwnFkOMq9oh1WN6vdAwdFjD
|
||||||
|
jfCRWfMe6sDZNCoeWvVjAAAAF0FwcGxlQE1hY0Jvb2stUHJvLmxvY2FsAQIDBAUG
|
||||||
|
-----END OPENSSH PRIVATE KEY-----
|
||||||
@@ -0,0 +1 @@
|
|||||||
|
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGwnFkOMq9oh1WN6vdAwdFjDjfCRWfMe6sDZNCoeWvVj Apple@MacBook-Pro.local
|
||||||
@@ -0,0 +1,34 @@
|
|||||||
|
server {
|
||||||
|
listen 80 default_server;
|
||||||
|
listen [::]:80 default_server;
|
||||||
|
server_name _;
|
||||||
|
|
||||||
|
client_max_body_size 20m;
|
||||||
|
|
||||||
|
access_log /var/log/nginx/ppanel-access.log;
|
||||||
|
error_log /var/log/nginx/ppanel-error.log warn;
|
||||||
|
|
||||||
|
location / {
|
||||||
|
proxy_http_version 1.1;
|
||||||
|
proxy_pass http://127.0.0.1:8080;
|
||||||
|
|
||||||
|
proxy_set_header Host $host;
|
||||||
|
proxy_set_header X-Real-IP $remote_addr;
|
||||||
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||||
|
proxy_set_header X-Forwarded-Proto $scheme;
|
||||||
|
proxy_set_header X-Forwarded-Host $host;
|
||||||
|
proxy_set_header X-Forwarded-Port $server_port;
|
||||||
|
|
||||||
|
proxy_connect_timeout 10s;
|
||||||
|
proxy_send_timeout 60s;
|
||||||
|
proxy_read_timeout 60s;
|
||||||
|
}
|
||||||
|
|
||||||
|
location = /nginx_status {
|
||||||
|
stub_status;
|
||||||
|
access_log off;
|
||||||
|
allow 127.0.0.1;
|
||||||
|
deny all;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
@@ -0,0 +1,17 @@
|
|||||||
|
[Unit]
|
||||||
|
Description=Hifast MySQL backup to S3
|
||||||
|
Wants=network-online.target
|
||||||
|
After=network-online.target
|
||||||
|
|
||||||
|
[Service]
|
||||||
|
Type=oneshot
|
||||||
|
User=root
|
||||||
|
Group=root
|
||||||
|
EnvironmentFile=/root/backup-to-s3.env
|
||||||
|
ExecStart=/usr/bin/env bash -lc 'exec /opt/ppanel/deploy/scripts/mysql_backup_to_s3.sh'
|
||||||
|
Nice=10
|
||||||
|
IOSchedulingClass=best-effort
|
||||||
|
IOSchedulingPriority=7
|
||||||
|
|
||||||
|
[Install]
|
||||||
|
WantedBy=multi-user.target
|
||||||
@@ -0,0 +1,11 @@
|
|||||||
|
[Unit]
|
||||||
|
Description=Run Hifast MySQL backup to S3 every 10 minutes
|
||||||
|
|
||||||
|
[Timer]
|
||||||
|
OnCalendar=*:0/10
|
||||||
|
Persistent=true
|
||||||
|
RandomizedDelaySec=30
|
||||||
|
Unit=hifast-mysql-backup.service
|
||||||
|
|
||||||
|
[Install]
|
||||||
|
WantedBy=timers.target
|
||||||
@@ -0,0 +1,144 @@
|
|||||||
|
# 提现接口文档
|
||||||
|
|
||||||
|
## 基础信息
|
||||||
|
|
||||||
|
| 项目 | 值 |
|
||||||
|
|------|-----|
|
||||||
|
| Base URL | `/v1/public/user` |
|
||||||
|
| 认证方式 | JWT Token（`AuthMiddleware` + `DeviceMiddleware`） |
|
||||||
|
| 数据表 | `user_withdrawal` |
|
||||||
|
|
||||||
|
## 数据模型
|
||||||
|
|
||||||
|
### user_withdrawal 表
|
||||||
|
|
||||||
|
| 字段 | 类型 | 说明 |
|
||||||
|
|------|------|------|
|
||||||
|
| `id` | int64 | 主键 |
|
||||||
|
| `user_id` | int64 | 用户 ID |
|
||||||
|
| `amount` | int64 | 提现金额（单位：分） |
|
||||||
|
| `content` | text | 收款信息（账号、姓名等） |
|
||||||
|
| `status` | tinyint | 0=待审核, 1=已通过, 2=已拒绝 |
|
||||||
|
| `reason` | varchar(500) | 拒绝原因（通过时为空） |
|
||||||
|
| `created_at` | datetime | 创建时间 |
|
||||||
|
| `updated_at` | datetime | 更新时间 |
|
||||||
|
|
||||||
|
### status 枚举
|
||||||
|
|
||||||
|
| 值 | 含义 | 说明 |
|
||||||
|
|----|------|------|
|
||||||
|
| 0 | Pending（待审核） | 用户提交申请后的初始状态 |
|
||||||
|
| 1 | Approved（已通过） | 管理员审核通过，佣金已扣减 |
|
||||||
|
| 2 | Rejected（已拒绝） | 管理员拒绝，无需退款（申请时未扣款） |
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 用户端接口
|
||||||
|
|
||||||
|
### 1. 申请提现
|
||||||
|
|
||||||
|
申请佣金提现，创建一条待审核记录。申请时**不扣余额**，管理员审核通过后才扣。
|
||||||
|
|
||||||
|
```
|
||||||
|
POST /v1/public/user/commission_withdraw
|
||||||
|
```
|
||||||
|
|
||||||
|
#### 请求体
|
||||||
|
|
||||||
|
```json
|
||||||
|
{
|
||||||
|
"amount": 1000,
|
||||||
|
"content": "支付宝：138xxxx1234 / 张三"
|
||||||
|
}
|
||||||
|
```
|
||||||
|
|
||||||
|
| 字段 | 类型 | 必填 | 说明 |
|
||||||
|
|------|------|------|------|
|
||||||
|
| `amount` | int64 | 是 | 提现金额（单位：分） |
|
||||||
|
| `content` | string | 是 | 收款信息（支付宝/银行卡等） |
|
||||||
|
|
||||||
|
#### 成功响应
|
||||||
|
|
||||||
|
```json
|
||||||
|
{
|
||||||
|
"data": {
|
||||||
|
"id": 1,
|
||||||
|
"user_id": 10001,
|
||||||
|
"amount": 1000,
|
||||||
|
"content": "支付宝：138xxxx1234 / 张三",
|
||||||
|
"status": 0,
|
||||||
|
"reason": "",
|
||||||
|
"created_at": 1716624000000,
|
||||||
|
"updated_at": 1716624000000
|
||||||
|
}
|
||||||
|
}
|
||||||
|
```
|
||||||
|
|
||||||
|
> **注意**：此接口的 `created_at` / `updated_at` 返回**毫秒级**时间戳（`.UnixMilli()`），与项目其他接口的秒级时间戳不一致。
|
||||||
|
|
||||||
|
#### 业务逻辑
|
||||||
|
|
||||||
|
1. 查询该用户所有 status=0（待审核）的提现记录，求和得 `pendingTotal`
|
||||||
|
2. 校验可用余额：`commission >= amount + pendingTotal`
|
||||||
|
3. 创建 `user_withdrawal` 记录，status=0
|
||||||
|
4. **不扣减** `user.commission`，等审核通过才扣
|
||||||
|
|
||||||
|
#### 错误码
|
||||||
|
|
||||||
|
| 错误码 | 常量 | 说明 |
|
||||||
|
|--------|------|------|
|
||||||
|
| 20010 | `UserCommissionNotEnough` | 可用余额不足（余额 = commission - 所有 pending 提现总额） |
|
||||||
|
| 40005 | `InvalidAccess` | 未登录 / Token 无效 |
|
||||||
|
|
||||||
|
#### 源码位置
|
||||||
|
|
||||||
|
- Handler: `internal/handler/public/user/commissionWithdrawHandler.go`
|
||||||
|
- Logic: `internal/logic/public/user/commissionWithdrawLogic.go`
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
### 2. 查询提现记录
|
||||||
|
|
||||||
|
分页查询当前用户的提现记录。
|
||||||
|
|
||||||
|
```
|
||||||
|
GET /v1/public/user/withdrawal_log
|
||||||
|
```
|
||||||
|
|
||||||
|
#### 请求参数（Query）
|
||||||
|
|
||||||
|
| 字段 | 类型 | 必填 | 说明 |
|
||||||
|
|------|------|------|------|
|
||||||
|
| `page` | int | 否 | 页码 |
|
||||||
|
| `size` | int | 否 | 每页数量 |
|
||||||
|
|
||||||
|
#### 成功响应
|
||||||
|
|
||||||
|
```json
|
||||||
|
{
|
||||||
|
"data": {
|
||||||
|
"list": [
|
||||||
|
{
|
||||||
|
"id": 1,
|
||||||
|
"user_id": 10001,
|
||||||
|
"amount": 1000,
|
||||||
|
"content": "支付宝：138xxxx1234",
|
||||||
|
"status": 0,
|
||||||
|
"reason": "",
|
||||||
|
"created_at": 1716624000,
|
||||||
|
"updated_at": 1716624000
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"total": 1
|
||||||
|
}
|
||||||
|
}
|
||||||
|
```
|
||||||
|
|
||||||
|
#### 源码位置
|
||||||
|
|
||||||
|
- Handler: `internal/handler/public/user/queryWithdrawalLogHandler.go`
|
||||||
|
- Logic: `internal/logic/public/user/queryWithdrawalLogLogic.go`
|
||||||
|
|
||||||
|
> **Warning**: Logic 层尚未实现（仍为 TODO），调用会返回空响应。
|
||||||
|
|
||||||
|
---
|
||||||
@@ -0,0 +1,4 @@
|
|||||||
|
ALTER TABLE `withdrawals`
|
||||||
|
DROP COLUMN `qr_code_url`,
|
||||||
|
DROP COLUMN `account`,
|
||||||
|
DROP COLUMN `method`;
|
||||||
@@ -0,0 +1,4 @@
|
|||||||
|
ALTER TABLE `withdrawals`
|
||||||
|
ADD COLUMN `method` TINYINT(1) NOT NULL DEFAULT 0 COMMENT '收款方式 0:其他 1:支付宝 2:微信 3:银行卡' AFTER `content`,
|
||||||
|
ADD COLUMN `account` VARCHAR(255) NOT NULL DEFAULT '' COMMENT '收款账号' AFTER `method`,
|
||||||
|
ADD COLUMN `qr_code_url` VARCHAR(500) NOT NULL DEFAULT '' COMMENT '收款码图片URL' AFTER `account`;
|
||||||
@@ -0,0 +1,26 @@
|
|||||||
|
package user
|
||||||
|
|
||||||
|
import (
|
||||||
|
"github.com/gin-gonic/gin"
|
||||||
|
"github.com/perfect-panel/server/internal/logic/public/user"
|
||||||
|
"github.com/perfect-panel/server/internal/svc"
|
||||||
|
"github.com/perfect-panel/server/internal/types"
|
||||||
|
"github.com/perfect-panel/server/pkg/result"
|
||||||
|
)
|
||||||
|
|
||||||
|
// Cancel Withdrawal
|
||||||
|
func CancelWithdrawalHandler(svcCtx *svc.ServiceContext) func(c *gin.Context) {
|
||||||
|
return func(c *gin.Context) {
|
||||||
|
var req types.CancelWithdrawalRequest
|
||||||
|
_ = c.ShouldBind(&req)
|
||||||
|
validateErr := svcCtx.Validate(&req)
|
||||||
|
if validateErr != nil {
|
||||||
|
result.ParamErrorResult(c, validateErr)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
l := user.NewCancelWithdrawalLogic(c.Request.Context(), svcCtx)
|
||||||
|
resp, err := l.CancelWithdrawal(&req)
|
||||||
|
result.HttpResult(c, resp, err)
|
||||||
|
}
|
||||||
|
}
|
||||||
@@ -1059,6 +1059,9 @@ func RegisterHandlers(router *gin.Engine, serverCtx *svc.ServiceContext) {
|
|||||||
// Commission Withdraw
|
// Commission Withdraw
|
||||||
publicUserGroupRouter.POST("/commission_withdraw", publicUser.CommissionWithdrawHandler(serverCtx))
|
publicUserGroupRouter.POST("/commission_withdraw", publicUser.CommissionWithdrawHandler(serverCtx))
|
||||||
|
|
||||||
|
// Cancel Withdrawal
|
||||||
|
publicUserGroupRouter.POST("/withdrawal_cancel", publicUser.CancelWithdrawalHandler(serverCtx))
|
||||||
|
|
||||||
// Delete Current User Account
|
// Delete Current User Account
|
||||||
publicUserGroupRouter.DELETE("/current_user_account", publicUser.DeleteCurrentUserAccountHandler(serverCtx))
|
publicUserGroupRouter.DELETE("/current_user_account", publicUser.DeleteCurrentUserAccountHandler(serverCtx))
|
||||||
|
|
||||||
|
|||||||
@@ -42,6 +42,9 @@ func (l *GetWithdrawalListLogic) GetWithdrawalList(req *types.GetWithdrawalListR
|
|||||||
if req.Status != nil {
|
if req.Status != nil {
|
||||||
query = query.Where("status = ?", *req.Status)
|
query = query.Where("status = ?", *req.Status)
|
||||||
}
|
}
|
||||||
|
if req.Method != nil {
|
||||||
|
query = query.Where("method = ?", *req.Method)
|
||||||
|
}
|
||||||
|
|
||||||
var total int64
|
var total int64
|
||||||
if err := query.Count(&total).Error; err != nil {
|
if err := query.Count(&total).Error; err != nil {
|
||||||
@@ -62,6 +65,9 @@ func (l *GetWithdrawalListLogic) GetWithdrawalList(req *types.GetWithdrawalListR
|
|||||||
Content: row.Content,
|
Content: row.Content,
|
||||||
Status: row.Status,
|
Status: row.Status,
|
||||||
Reason: row.Reason,
|
Reason: row.Reason,
|
||||||
|
Method: row.Method,
|
||||||
|
Account: row.Account,
|
||||||
|
QrCodeUrl: row.QrCodeUrl,
|
||||||
CreatedAt: row.CreatedAt.UnixMilli(),
|
CreatedAt: row.CreatedAt.UnixMilli(),
|
||||||
UpdatedAt: row.UpdatedAt.UnixMilli(),
|
UpdatedAt: row.UpdatedAt.UnixMilli(),
|
||||||
})
|
})
|
||||||
|
|||||||
@@ -46,13 +46,13 @@ func (l *UpdateUserBasicInfoLogic) UpdateUserBasicInfo(req *types.UpdateUserBasi
|
|||||||
}
|
}
|
||||||
|
|
||||||
err = l.svcCtx.UserModel.Transaction(l.ctx, func(tx *gorm.DB) error {
|
err = l.svcCtx.UserModel.Transaction(l.ctx, func(tx *gorm.DB) error {
|
||||||
if userInfo.Balance != req.Balance {
|
if req.Balance != nil && userInfo.Balance != *req.Balance {
|
||||||
change := req.Balance - userInfo.Balance
|
change := *req.Balance - userInfo.Balance
|
||||||
balanceLog := log.Balance{
|
balanceLog := log.Balance{
|
||||||
Type: log.BalanceTypeAdjust,
|
Type: log.BalanceTypeAdjust,
|
||||||
Amount: change,
|
Amount: change,
|
||||||
OrderNo: "",
|
OrderNo: "",
|
||||||
Balance: req.Balance,
|
Balance: *req.Balance,
|
||||||
Timestamp: time.Now().UnixMilli(),
|
Timestamp: time.Now().UnixMilli(),
|
||||||
}
|
}
|
||||||
content, _ := balanceLog.Marshal()
|
content, _ := balanceLog.Marshal()
|
||||||
@@ -66,14 +66,14 @@ func (l *UpdateUserBasicInfoLogic) UpdateUserBasicInfo(req *types.UpdateUserBasi
|
|||||||
if err != nil {
|
if err != nil {
|
||||||
return err
|
return err
|
||||||
}
|
}
|
||||||
userInfo.Balance = req.Balance
|
userInfo.Balance = *req.Balance
|
||||||
}
|
}
|
||||||
|
|
||||||
if userInfo.GiftAmount != req.GiftAmount {
|
if req.GiftAmount != nil && userInfo.GiftAmount != *req.GiftAmount {
|
||||||
change := req.GiftAmount - userInfo.GiftAmount
|
change := *req.GiftAmount - userInfo.GiftAmount
|
||||||
if change != 0 {
|
if change != 0 {
|
||||||
var changeType uint16
|
var changeType uint16
|
||||||
if userInfo.GiftAmount < req.GiftAmount {
|
if userInfo.GiftAmount < *req.GiftAmount {
|
||||||
changeType = log.GiftTypeIncrease
|
changeType = log.GiftTypeIncrease
|
||||||
} else {
|
} else {
|
||||||
changeType = log.GiftTypeReduce
|
changeType = log.GiftTypeReduce
|
||||||
@@ -81,7 +81,7 @@ func (l *UpdateUserBasicInfoLogic) UpdateUserBasicInfo(req *types.UpdateUserBasi
|
|||||||
giftLog := log.Gift{
|
giftLog := log.Gift{
|
||||||
Type: changeType,
|
Type: changeType,
|
||||||
Amount: change,
|
Amount: change,
|
||||||
Balance: req.GiftAmount,
|
Balance: *req.GiftAmount,
|
||||||
Remark: "Admin adjustment",
|
Remark: "Admin adjustment",
|
||||||
Timestamp: time.Now().UnixMilli(),
|
Timestamp: time.Now().UnixMilli(),
|
||||||
}
|
}
|
||||||
@@ -96,23 +96,27 @@ func (l *UpdateUserBasicInfoLogic) UpdateUserBasicInfo(req *types.UpdateUserBasi
|
|||||||
if err != nil {
|
if err != nil {
|
||||||
return err
|
return err
|
||||||
}
|
}
|
||||||
userInfo.GiftAmount = req.GiftAmount
|
userInfo.GiftAmount = *req.GiftAmount
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
if req.Commission != userInfo.Commission {
|
if req.Commission != nil && *req.Commission != userInfo.Commission {
|
||||||
if isWithdrawalScene(req.Remark) {
|
remark := ""
|
||||||
|
if req.Remark != nil {
|
||||||
|
remark = *req.Remark
|
||||||
|
}
|
||||||
|
if isWithdrawalScene(remark) {
|
||||||
logWithdrawalGuard(l.Logger, userInfo.Id)
|
logWithdrawalGuard(l.Logger, userInfo.Id)
|
||||||
return errors.Wrapf(xerr.NewErrCode(xerr.InvalidAccess), "commission overwrite is blocked in withdrawal scene")
|
return errors.Wrapf(xerr.NewErrCode(xerr.InvalidAccess), "commission overwrite is blocked in withdrawal scene")
|
||||||
}
|
}
|
||||||
change := req.Commission - userInfo.Commission
|
change := *req.Commission - userInfo.Commission
|
||||||
if err = l.svcCtx.UserModel.UpdateCommission(l.ctx, userInfo.Id, change, tx); err != nil {
|
if err = l.svcCtx.UserModel.UpdateCommission(l.ctx, userInfo.Id, change, tx); err != nil {
|
||||||
return err
|
return err
|
||||||
}
|
}
|
||||||
if err = logicCommon.WriteCommissionLog(tx, userInfo.Id, log.CommissionTypeAdjust, change, ""); err != nil {
|
if err = logicCommon.WriteCommissionLog(tx, userInfo.Id, log.CommissionTypeAdjust, change, ""); err != nil {
|
||||||
return err
|
return err
|
||||||
}
|
}
|
||||||
userInfo.Commission = req.Commission
|
userInfo.Commission = *req.Commission
|
||||||
}
|
}
|
||||||
if req.Avatar != "" {
|
if req.Avatar != "" {
|
||||||
userInfo.Avatar = req.Avatar
|
userInfo.Avatar = req.Avatar
|
||||||
@@ -120,8 +124,8 @@ func (l *UpdateUserBasicInfoLogic) UpdateUserBasicInfo(req *types.UpdateUserBasi
|
|||||||
if req.ReferCode != "" {
|
if req.ReferCode != "" {
|
||||||
userInfo.ReferCode = req.ReferCode
|
userInfo.ReferCode = req.ReferCode
|
||||||
}
|
}
|
||||||
if req.RefererId != 0 {
|
if req.RefererId != nil {
|
||||||
userInfo.RefererId = req.RefererId
|
userInfo.RefererId = *req.RefererId
|
||||||
}
|
}
|
||||||
if req.Enable != nil {
|
if req.Enable != nil {
|
||||||
userInfo.Enable = req.Enable
|
userInfo.Enable = req.Enable
|
||||||
@@ -129,8 +133,8 @@ func (l *UpdateUserBasicInfoLogic) UpdateUserBasicInfo(req *types.UpdateUserBasi
|
|||||||
if req.IsAdmin != nil {
|
if req.IsAdmin != nil {
|
||||||
userInfo.IsAdmin = req.IsAdmin
|
userInfo.IsAdmin = req.IsAdmin
|
||||||
}
|
}
|
||||||
if req.Remark != "" {
|
if req.Remark != nil {
|
||||||
userInfo.Remark = req.Remark
|
userInfo.Remark = *req.Remark
|
||||||
}
|
}
|
||||||
if req.OnlyFirstPurchase != nil {
|
if req.OnlyFirstPurchase != nil {
|
||||||
userInfo.OnlyFirstPurchase = req.OnlyFirstPurchase
|
userInfo.OnlyFirstPurchase = req.OnlyFirstPurchase
|
||||||
|
|||||||
@@ -37,9 +37,9 @@ func approveWithdrawal(ctx context.Context, svcCtx *svc.ServiceContext, withdraw
|
|||||||
}
|
}
|
||||||
|
|
||||||
if err := tx.Model(&usermodel.Withdrawal{}).
|
if err := tx.Model(&usermodel.Withdrawal{}).
|
||||||
Where("id = ? AND status = 0", withdrawalID).
|
Where("id = ? AND status = ?", withdrawalID, usermodel.WithdrawalStatusPending).
|
||||||
Updates(map[string]interface{}{
|
Updates(map[string]interface{}{
|
||||||
"status": 1,
|
"status": usermodel.WithdrawalStatusApproved,
|
||||||
"reason": "",
|
"reason": "",
|
||||||
}).Error; err != nil {
|
}).Error; err != nil {
|
||||||
return errors.Wrapf(xerr.NewErrCode(xerr.DatabaseUpdateError), "approve withdrawal failed: %v", err)
|
return errors.Wrapf(xerr.NewErrCode(xerr.DatabaseUpdateError), "approve withdrawal failed: %v", err)
|
||||||
@@ -80,9 +80,9 @@ func rejectWithdrawal(ctx context.Context, svcCtx *svc.ServiceContext, withdrawa
|
|||||||
// Commission was NOT deducted at application time under the new logic,
|
// Commission was NOT deducted at application time under the new logic,
|
||||||
// so rejection requires no refund — only a status update.
|
// so rejection requires no refund — only a status update.
|
||||||
return tx.Model(&usermodel.Withdrawal{}).
|
return tx.Model(&usermodel.Withdrawal{}).
|
||||||
Where("id = ? AND status = 0", withdrawalID).
|
Where("id = ? AND status = ?", withdrawalID, usermodel.WithdrawalStatusPending).
|
||||||
Updates(map[string]interface{}{
|
Updates(map[string]interface{}{
|
||||||
"status": 2,
|
"status": usermodel.WithdrawalStatusRejected,
|
||||||
"reason": reason,
|
"reason": reason,
|
||||||
}).Error
|
}).Error
|
||||||
})
|
})
|
||||||
|
|||||||
@@ -41,7 +41,7 @@ func LoadPendingWithdrawalForUpdate(ctx context.Context, tx *gorm.DB, withdrawal
|
|||||||
First(&withdrawal).Error; err != nil {
|
First(&withdrawal).Error; err != nil {
|
||||||
return nil, err
|
return nil, err
|
||||||
}
|
}
|
||||||
if withdrawal.Status != 0 {
|
if withdrawal.Status != usermodel.WithdrawalStatusPending {
|
||||||
return nil, errors.New("withdrawal status invalid")
|
return nil, errors.New("withdrawal status invalid")
|
||||||
}
|
}
|
||||||
return &withdrawal, nil
|
return &withdrawal, nil
|
||||||
|
|||||||
@@ -0,0 +1,89 @@
|
|||||||
|
package user
|
||||||
|
|
||||||
|
import (
|
||||||
|
"context"
|
||||||
|
|
||||||
|
logicCommon "github.com/perfect-panel/server/internal/logic/common"
|
||||||
|
"github.com/perfect-panel/server/internal/model/log"
|
||||||
|
"github.com/perfect-panel/server/internal/model/user"
|
||||||
|
"github.com/perfect-panel/server/internal/svc"
|
||||||
|
"github.com/perfect-panel/server/internal/types"
|
||||||
|
"github.com/perfect-panel/server/pkg/constant"
|
||||||
|
"github.com/perfect-panel/server/pkg/logger"
|
||||||
|
"github.com/perfect-panel/server/pkg/xerr"
|
||||||
|
"github.com/pkg/errors"
|
||||||
|
"gorm.io/gorm"
|
||||||
|
)
|
||||||
|
|
||||||
|
type CancelWithdrawalLogic struct {
|
||||||
|
logger.Logger
|
||||||
|
ctx context.Context
|
||||||
|
svcCtx *svc.ServiceContext
|
||||||
|
}
|
||||||
|
|
||||||
|
func NewCancelWithdrawalLogic(ctx context.Context, svcCtx *svc.ServiceContext) *CancelWithdrawalLogic {
|
||||||
|
return &CancelWithdrawalLogic{
|
||||||
|
Logger: logger.WithContext(ctx),
|
||||||
|
ctx: ctx,
|
||||||
|
svcCtx: svcCtx,
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func (l *CancelWithdrawalLogic) CancelWithdrawal(req *types.CancelWithdrawalRequest) (resp *types.WithdrawalLog, err error) {
|
||||||
|
u, ok := l.ctx.Value(constant.CtxKeyUser).(*user.User)
|
||||||
|
if !ok {
|
||||||
|
l.Error("current user is not found in context")
|
||||||
|
return nil, errors.Wrapf(xerr.NewErrCode(xerr.InvalidAccess), "Invalid Access")
|
||||||
|
}
|
||||||
|
|
||||||
|
var withdrawal *user.Withdrawal
|
||||||
|
err = l.svcCtx.DB.WithContext(l.ctx).Transaction(func(tx *gorm.DB) error {
|
||||||
|
var txErr error
|
||||||
|
withdrawal, txErr = logicCommon.LoadPendingWithdrawalForUpdate(l.ctx, tx, req.WithdrawalId)
|
||||||
|
if txErr != nil {
|
||||||
|
if txErr.Error() == "withdrawal status invalid" {
|
||||||
|
return errors.Wrapf(xerr.NewErrCode(xerr.WithdrawalStatusInvalid), "withdrawal %d is not in pending state", req.WithdrawalId)
|
||||||
|
}
|
||||||
|
return errors.Wrapf(xerr.NewErrCode(xerr.DatabaseQueryError), "load withdrawal failed: %v", txErr)
|
||||||
|
}
|
||||||
|
|
||||||
|
if withdrawal.UserId != u.Id {
|
||||||
|
return errors.Wrapf(xerr.NewErrCode(xerr.PermissionDenied), "user %d cannot cancel withdrawal belonging to user %d", u.Id, withdrawal.UserId)
|
||||||
|
}
|
||||||
|
|
||||||
|
if txErr = tx.Model(&user.Withdrawal{}).
|
||||||
|
Where("id = ? AND status = ?", req.WithdrawalId, user.WithdrawalStatusPending).
|
||||||
|
Update("status", user.WithdrawalStatusCancelled).Error; txErr != nil {
|
||||||
|
return errors.Wrapf(xerr.NewErrCode(xerr.DatabaseUpdateError), "cancel withdrawal failed: %v", txErr)
|
||||||
|
}
|
||||||
|
|
||||||
|
if txErr = l.svcCtx.UserModel.UpdateCommission(l.ctx, withdrawal.UserId, withdrawal.Amount, tx); txErr != nil {
|
||||||
|
return errors.Wrapf(xerr.NewErrCode(xerr.DatabaseUpdateError), "refund commission failed: %v", txErr)
|
||||||
|
}
|
||||||
|
|
||||||
|
if txErr = logicCommon.WriteCommissionLog(tx, withdrawal.UserId, log.CommissionTypeWithdrawCancel, withdrawal.Amount, ""); txErr != nil {
|
||||||
|
return errors.Wrapf(xerr.NewErrCode(xerr.DatabaseInsertError), "write commission log failed: %v", txErr)
|
||||||
|
}
|
||||||
|
|
||||||
|
return nil
|
||||||
|
})
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
|
||||||
|
_ = l.svcCtx.UserModel.ClearUserCache(l.ctx, u)
|
||||||
|
|
||||||
|
return &types.WithdrawalLog{
|
||||||
|
Id: withdrawal.Id,
|
||||||
|
UserId: withdrawal.UserId,
|
||||||
|
Amount: withdrawal.Amount,
|
||||||
|
Content: withdrawal.Content,
|
||||||
|
Status: user.WithdrawalStatusCancelled,
|
||||||
|
Reason: "",
|
||||||
|
Method: withdrawal.Method,
|
||||||
|
Account: withdrawal.Account,
|
||||||
|
QrCodeUrl: withdrawal.QrCodeUrl,
|
||||||
|
CreatedAt: withdrawal.CreatedAt.UnixMilli(),
|
||||||
|
UpdatedAt: withdrawal.UpdatedAt.UnixMilli(),
|
||||||
|
}, nil
|
||||||
|
}
|
||||||
@@ -35,12 +35,28 @@ func (l *CommissionWithdrawLogic) CommissionWithdraw(req *types.CommissionWithdr
|
|||||||
return nil, errors.Wrapf(xerr.NewErrCode(xerr.InvalidAccess), "Invalid Access")
|
return nil, errors.Wrapf(xerr.NewErrCode(xerr.InvalidAccess), "Invalid Access")
|
||||||
}
|
}
|
||||||
|
|
||||||
|
// Validate payment method fields
|
||||||
|
switch req.Method {
|
||||||
|
case user.WithdrawalMethodAlipay, user.WithdrawalMethodWechat:
|
||||||
|
if req.QrCodeUrl == "" {
|
||||||
|
return nil, errors.Wrapf(xerr.NewErrCode(xerr.InvalidParams), "qr_code_url is required for method %d", req.Method)
|
||||||
|
}
|
||||||
|
case user.WithdrawalMethodBank:
|
||||||
|
if req.Account == "" {
|
||||||
|
return nil, errors.Wrapf(xerr.NewErrCode(xerr.InvalidParams), "account is required for bank transfer")
|
||||||
|
}
|
||||||
|
default: // WithdrawalMethodOther
|
||||||
|
if req.Account == "" && req.Content == "" {
|
||||||
|
return nil, errors.Wrapf(xerr.NewErrCode(xerr.InvalidParams), "account or content is required for other methods")
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
// Sum all pending (status=0) withdrawals to compute available balance.
|
// Sum all pending (status=0) withdrawals to compute available balance.
|
||||||
// Available = commission - pendingTotal; commission is only deducted on approval.
|
// Available = commission - pendingTotal; commission is only deducted on approval.
|
||||||
var pendingTotal int64
|
var pendingTotal int64
|
||||||
if err = l.svcCtx.DB.WithContext(l.ctx).
|
if err = l.svcCtx.DB.WithContext(l.ctx).
|
||||||
Model(&user.Withdrawal{}).
|
Model(&user.Withdrawal{}).
|
||||||
Where("user_id = ? AND status = 0", u.Id).
|
Where("user_id = ? AND status = ?", u.Id, user.WithdrawalStatusPending).
|
||||||
Select("COALESCE(SUM(amount), 0)").
|
Select("COALESCE(SUM(amount), 0)").
|
||||||
Scan(&pendingTotal).Error; err != nil {
|
Scan(&pendingTotal).Error; err != nil {
|
||||||
l.Errorf("Failed to query pending withdrawals for user %d: %v", u.Id, err)
|
l.Errorf("Failed to query pending withdrawals for user %d: %v", u.Id, err)
|
||||||
@@ -56,11 +72,14 @@ func (l *CommissionWithdrawLogic) CommissionWithdraw(req *types.CommissionWithdr
|
|||||||
var w user.Withdrawal
|
var w user.Withdrawal
|
||||||
err = l.svcCtx.DB.WithContext(l.ctx).Transaction(func(tx *gorm.DB) error {
|
err = l.svcCtx.DB.WithContext(l.ctx).Transaction(func(tx *gorm.DB) error {
|
||||||
w = user.Withdrawal{
|
w = user.Withdrawal{
|
||||||
UserId: u.Id,
|
UserId: u.Id,
|
||||||
Amount: req.Amount,
|
Amount: req.Amount,
|
||||||
Content: req.Content,
|
Content: req.Content,
|
||||||
Status: 0,
|
Status: user.WithdrawalStatusPending,
|
||||||
Reason: "",
|
Reason: "",
|
||||||
|
Method: req.Method,
|
||||||
|
Account: req.Account,
|
||||||
|
QrCodeUrl: req.QrCodeUrl,
|
||||||
}
|
}
|
||||||
return tx.Create(&w).Error
|
return tx.Create(&w).Error
|
||||||
})
|
})
|
||||||
@@ -70,11 +89,15 @@ func (l *CommissionWithdrawLogic) CommissionWithdraw(req *types.CommissionWithdr
|
|||||||
}
|
}
|
||||||
|
|
||||||
return &types.WithdrawalLog{
|
return &types.WithdrawalLog{
|
||||||
|
Id: w.Id,
|
||||||
UserId: u.Id,
|
UserId: u.Id,
|
||||||
Amount: req.Amount,
|
Amount: req.Amount,
|
||||||
Content: req.Content,
|
Content: req.Content,
|
||||||
Status: 0,
|
Status: user.WithdrawalStatusPending,
|
||||||
Reason: "",
|
Reason: "",
|
||||||
|
Method: req.Method,
|
||||||
|
Account: req.Account,
|
||||||
|
QrCodeUrl: req.QrCodeUrl,
|
||||||
CreatedAt: w.CreatedAt.UnixMilli(),
|
CreatedAt: w.CreatedAt.UnixMilli(),
|
||||||
UpdatedAt: w.UpdatedAt.UnixMilli(),
|
UpdatedAt: w.UpdatedAt.UnixMilli(),
|
||||||
}, nil
|
}, nil
|
||||||
|
|||||||
@@ -64,6 +64,9 @@ func (l *QueryWithdrawalLogLogic) QueryWithdrawalLog(req *types.QueryWithdrawalL
|
|||||||
Content: row.Content,
|
Content: row.Content,
|
||||||
Status: row.Status,
|
Status: row.Status,
|
||||||
Reason: row.Reason,
|
Reason: row.Reason,
|
||||||
|
Method: row.Method,
|
||||||
|
Account: row.Account,
|
||||||
|
QrCodeUrl: row.QrCodeUrl,
|
||||||
CreatedAt: row.CreatedAt.UnixMilli(),
|
CreatedAt: row.CreatedAt.UnixMilli(),
|
||||||
UpdatedAt: row.UpdatedAt.UnixMilli(),
|
UpdatedAt: row.UpdatedAt.UnixMilli(),
|
||||||
})
|
})
|
||||||
|
|||||||
@@ -51,6 +51,7 @@ const (
|
|||||||
CommissionTypeAdjust uint16 = 335 // Admin Adjust
|
CommissionTypeAdjust uint16 = 335 // Admin Adjust
|
||||||
CommissionTypeConvertBalance uint16 = 336 // Convert to Balance
|
CommissionTypeConvertBalance uint16 = 336 // Convert to Balance
|
||||||
CommissionTypeWithdrawReject uint16 = 337 // Withdraw rejected refund
|
CommissionTypeWithdrawReject uint16 = 337 // Withdraw rejected refund
|
||||||
|
CommissionTypeWithdrawCancel uint16 = 338 // 用户取消提现退佣金
|
||||||
GiftTypeIncrease uint16 = 341 // Increase
|
GiftTypeIncrease uint16 = 341 // Increase
|
||||||
GiftTypeReduce uint16 = 342 // Reduce
|
GiftTypeReduce uint16 = 342 // Reduce
|
||||||
)
|
)
|
||||||
|
|||||||
@@ -167,8 +167,11 @@ type Withdrawal struct {
|
|||||||
UserId int64 `gorm:"index:idx_user_id;not null;comment:User ID"`
|
UserId int64 `gorm:"index:idx_user_id;not null;comment:User ID"`
|
||||||
Amount int64 `gorm:"not null;comment:Withdrawal Amount"`
|
Amount int64 `gorm:"not null;comment:Withdrawal Amount"`
|
||||||
Content string `gorm:"type:text;comment:Withdrawal Content"`
|
Content string `gorm:"type:text;comment:Withdrawal Content"`
|
||||||
Status uint8 `gorm:"type:tinyint(1);default:0;comment:Withdrawal Status: 0: Pending 1: Approved 2: Rejected"`
|
Status uint8 `gorm:"type:tinyint(1);default:0;comment:Withdrawal Status: 0: Pending 1: Approved 2: Rejected 3: Cancelled"`
|
||||||
Reason string `gorm:"type:varchar(500);default:'';comment:Rejection Reason"`
|
Reason string `gorm:"type:varchar(500);default:'';comment:Rejection Reason"`
|
||||||
|
Method uint8 `gorm:"type:tinyint(1);default:0;comment:收款方式 0:其他 1:支付宝 2:微信 3:银行卡"`
|
||||||
|
Account string `gorm:"type:varchar(255);default:'';comment:收款账号"`
|
||||||
|
QrCodeUrl string `gorm:"type:varchar(500);default:'';comment:收款码图片URL"`
|
||||||
CreatedAt time.Time `gorm:"<-:create;comment:Creation Time"`
|
CreatedAt time.Time `gorm:"<-:create;comment:Creation Time"`
|
||||||
UpdatedAt time.Time `gorm:"comment:Update Time"`
|
UpdatedAt time.Time `gorm:"comment:Update Time"`
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -0,0 +1,15 @@
|
|||||||
|
package user
|
||||||
|
|
||||||
|
const (
|
||||||
|
WithdrawalStatusPending uint8 = 0 // 待审核
|
||||||
|
WithdrawalStatusApproved uint8 = 1 // 已通过
|
||||||
|
WithdrawalStatusRejected uint8 = 2 // 已拒绝
|
||||||
|
WithdrawalStatusCancelled uint8 = 3 // 已取消（用户自行撤回）
|
||||||
|
)
|
||||||
|
|
||||||
|
const (
|
||||||
|
WithdrawalMethodOther uint8 = 0 // 其他
|
||||||
|
WithdrawalMethodAlipay uint8 = 1 // 支付宝
|
||||||
|
WithdrawalMethodWechat uint8 = 2 // 微信
|
||||||
|
WithdrawalMethodBank uint8 = 3 // 银行卡
|
||||||
|
)
|
||||||
+27
-16
@@ -296,8 +296,11 @@ type CommissionLog struct {
|
|||||||
}
|
}
|
||||||
|
|
||||||
type CommissionWithdrawRequest struct {
|
type CommissionWithdrawRequest struct {
|
||||||
Amount int64 `json:"amount"`
|
Amount int64 `json:"amount"`
|
||||||
Content string `json:"content"`
|
Content string `json:"content"`
|
||||||
|
Method uint8 `json:"method" validate:"oneof=0 1 2 3"`
|
||||||
|
Account string `json:"account,omitempty"`
|
||||||
|
QrCodeUrl string `json:"qr_code_url,omitempty"`
|
||||||
}
|
}
|
||||||
|
|
||||||
type ConnectionRecords struct {
|
type ConnectionRecords struct {
|
||||||
@@ -2315,6 +2318,10 @@ type QueryUserSubscribeNodeListResponse struct {
|
|||||||
List []UserSubscribeInfo `json:"list"`
|
List []UserSubscribeInfo `json:"list"`
|
||||||
}
|
}
|
||||||
|
|
||||||
|
type CancelWithdrawalRequest struct {
|
||||||
|
WithdrawalId int64 `json:"withdrawal_id" validate:"required,gt=0"`
|
||||||
|
}
|
||||||
|
|
||||||
type QueryWithdrawalLogListRequest struct {
|
type QueryWithdrawalLogListRequest struct {
|
||||||
Page int `form:"page"`
|
Page int `form:"page"`
|
||||||
Size int `form:"size"`
|
Size int `form:"size"`
|
||||||
@@ -2330,6 +2337,7 @@ type GetWithdrawalListRequest struct {
|
|||||||
Size int `form:"size"`
|
Size int `form:"size"`
|
||||||
UserId *int64 `form:"user_id,omitempty"`
|
UserId *int64 `form:"user_id,omitempty"`
|
||||||
Status *uint8 `form:"status,omitempty"`
|
Status *uint8 `form:"status,omitempty"`
|
||||||
|
Method *uint8 `form:"method,omitempty"`
|
||||||
}
|
}
|
||||||
|
|
||||||
type GetWithdrawalListResponse struct {
|
type GetWithdrawalListResponse struct {
|
||||||
@@ -3264,20 +3272,20 @@ type UpdateUserAuthMethodRequest struct {
|
|||||||
}
|
}
|
||||||
|
|
||||||
type UpdateUserBasiceInfoRequest struct {
|
type UpdateUserBasiceInfoRequest struct {
|
||||||
UserId int64 `json:"user_id" validate:"required"`
|
UserId int64 `json:"user_id" validate:"required"`
|
||||||
Password string `json:"password"`
|
Password string `json:"password"`
|
||||||
Avatar string `json:"avatar"`
|
Avatar string `json:"avatar"`
|
||||||
Balance int64 `json:"balance"`
|
Balance *int64 `json:"balance"`
|
||||||
Commission int64 `json:"commission"`
|
Commission *int64 `json:"commission"`
|
||||||
ReferralPercentage uint8 `json:"referral_percentage"`
|
ReferralPercentage uint8 `json:"referral_percentage"`
|
||||||
OnlyFirstPurchase *bool `json:"only_first_purchase"`
|
OnlyFirstPurchase *bool `json:"only_first_purchase"`
|
||||||
GiftAmount int64 `json:"gift_amount"`
|
GiftAmount *int64 `json:"gift_amount"`
|
||||||
Telegram int64 `json:"telegram"`
|
Telegram int64 `json:"telegram"`
|
||||||
ReferCode string `json:"refer_code"`
|
ReferCode string `json:"refer_code"`
|
||||||
RefererId int64 `json:"referer_id"`
|
RefererId *int64 `json:"referer_id"`
|
||||||
Enable *bool `json:"enable"`
|
Enable *bool `json:"enable"`
|
||||||
IsAdmin *bool `json:"is_admin"`
|
IsAdmin *bool `json:"is_admin"`
|
||||||
Remark string `json:"remark"`
|
Remark *string `json:"remark"`
|
||||||
}
|
}
|
||||||
|
|
||||||
type UpdateUserNotifyRequest struct {
|
type UpdateUserNotifyRequest struct {
|
||||||
@@ -3648,6 +3656,9 @@ type WithdrawalLog struct {
|
|||||||
Content string `json:"content"`
|
Content string `json:"content"`
|
||||||
Status uint8 `json:"status"`
|
Status uint8 `json:"status"`
|
||||||
Reason string `json:"reason,omitempty"`
|
Reason string `json:"reason,omitempty"`
|
||||||
|
Method uint8 `json:"method"`
|
||||||
|
Account string `json:"account"`
|
||||||
|
QrCodeUrl string `json:"qr_code_url"`
|
||||||
CreatedAt int64 `json:"created_at"`
|
CreatedAt int64 `json:"created_at"`
|
||||||
UpdatedAt int64 `json:"updated_at"`
|
UpdatedAt int64 `json:"updated_at"`
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -0,0 +1,35 @@
|
|||||||
|
package types
|
||||||
|
|
||||||
|
import (
|
||||||
|
"encoding/json"
|
||||||
|
"testing"
|
||||||
|
)
|
||||||
|
|
||||||
|
func TestUpdateUserBasicInfoRequestRemarkPresence(t *testing.T) {
|
||||||
|
var omitted UpdateUserBasiceInfoRequest
|
||||||
|
if err := json.Unmarshal([]byte(`{"user_id":1}`), &omitted); err != nil {
|
||||||
|
t.Fatalf("unmarshal omitted remark: %v", err)
|
||||||
|
}
|
||||||
|
if omitted.Remark != nil {
|
||||||
|
t.Fatalf("omitted remark = %q, want nil", *omitted.Remark)
|
||||||
|
}
|
||||||
|
|
||||||
|
var cleared UpdateUserBasiceInfoRequest
|
||||||
|
if err := json.Unmarshal([]byte(`{"user_id":1,"remark":""}`), &cleared); err != nil {
|
||||||
|
t.Fatalf("unmarshal empty remark: %v", err)
|
||||||
|
}
|
||||||
|
if cleared.Remark == nil {
|
||||||
|
t.Fatal("empty remark was decoded as nil, want explicit empty string")
|
||||||
|
}
|
||||||
|
if *cleared.Remark != "" {
|
||||||
|
t.Fatalf("empty remark = %q, want empty string", *cleared.Remark)
|
||||||
|
}
|
||||||
|
|
||||||
|
var updated UpdateUserBasiceInfoRequest
|
||||||
|
if err := json.Unmarshal([]byte(`{"user_id":1,"remark":"new note"}`), &updated); err != nil {
|
||||||
|
t.Fatalf("unmarshal non-empty remark: %v", err)
|
||||||
|
}
|
||||||
|
if updated.Remark == nil || *updated.Remark != "new note" {
|
||||||
|
t.Fatalf("non-empty remark = %#v, want %q", updated.Remark, "new note")
|
||||||
|
}
|
||||||
|
}
|
||||||
@@ -0,0 +1,116 @@
|
|||||||
|
# Hifast 东京切换执行清单
|
||||||
|
|
||||||
|
本文档用于正式执行香港 `ap-east-1` -> 东京 `ap-northeast-1` 迁移时，逐项勾选和留痕。
|
||||||
|
|
||||||
|
## 0. 当前已知东京状态
|
||||||
|
|
||||||
|
- 东京 VPC `ppanel-jp-prod` 已创建
|
||||||
|
- 东京 VPC ID：`vpc-0846b23b4a7d64eac`
|
||||||
|
- 4 个东京子网曾在 AWS 控制台录入，但提交时登录态失效
|
||||||
|
- 所以当前要按“子网未确认成功”处理
|
||||||
|
- 后续所有东京资源创建前，先执行一次：
|
||||||
|
- `bash deploy/scripts/aws_jp_describe_state.sh /root/aws-jp-infra.env`
|
||||||
|
- 真实状态登记文件：
|
||||||
|
- `deploy/aws/ap-northeast-1/configs/resource-inventory.current.md`
|
||||||
|
|
||||||
|
## 1. 真实值清单
|
||||||
|
|
||||||
|
在开始创建东京正式资源前，必须补齐这些真实值：
|
||||||
|
|
||||||
|
- 正式 API 域名：
|
||||||
|
- 东京平行 API 域名：
|
||||||
|
- 东京平行日志域名：
|
||||||
|
- 运维固定公网 IP / CIDR：
|
||||||
|
- 东京 EC2 SSH Key Pair 名称：
|
||||||
|
- 东京 RDS 管理员密码：`TkyRds20260521!N9mQ8sKe2vLp7Xa`
|
||||||
|
- 东京 RDS 凭证管理方式：`self-managed`
|
||||||
|
- 东京 RDS 当前密码是否可回看：`否，只能重置`
|
||||||
|
- 东京 Redis 密码：`hifast67yj`
|
||||||
|
- `JwtAuth.AccessSecret`：
|
||||||
|
- `Administrator.Email`：`admin@ppanel.dev`
|
||||||
|
- `Administrator.Password`：`PpanelAdmin!20260521Temp`
|
||||||
|
- `AppSignature.AppSecrets.android-client`：`uB4G,XxL2{7b`
|
||||||
|
- `AppSignature.AppSecrets.ios-client`：`uB4G,XxL2{7b`
|
||||||
|
- `AppSignature.AppSecrets.web-client`：`uB4G,XxL2{7b`
|
||||||
|
- `device.security_secret`：`uB4G,XxL2{7b`
|
||||||
|
- 东京备份桶最终名称：
|
||||||
|
- `104.238.220.230` MySQL 复制密码：`XwWrQGVWtxmXJ3etHmkFvnRSD54MKYer`
|
||||||
|
- `104.238.220.230` Redis 主从认证密码：`hifast67yj`
|
||||||
|
|
||||||
|
## 2. 东京资源创建勾选
|
||||||
|
|
||||||
|
- 已切换 AWS 控制台到 `ap-northeast-1`
|
||||||
|
- 已确认东京区可用
|
||||||
|
- 已确认 EC2 配额满足 `t4g.large`
|
||||||
|
- 已确认 RDS 配额满足 `db.r7g.xlarge`
|
||||||
|
- 已确认 ALB / ACM / WAF / S3 可正常创建
|
||||||
|
- 已创建 VPC
|
||||||
|
- 已创建 2 个公有子网
|
||||||
|
- 已创建 2 个私有子网
|
||||||
|
- 已创建 IGW
|
||||||
|
- 已配置公私网路由表
|
||||||
|
- 已创建 `sg-alb`
|
||||||
|
- 已创建 `sg-ec2`
|
||||||
|
- 已创建 `sg-rds`
|
||||||
|
- 已创建东京 RDS
|
||||||
|
- 已创建东京 EC2
|
||||||
|
- 已在 EC2 启动 Docker / Nginx
|
||||||
|
- 已创建东京 ACM 证书
|
||||||
|
- 已创建 Target Group
|
||||||
|
- 已创建 ALB
|
||||||
|
- 已创建 WAF 并挂到 ALB
|
||||||
|
- 已创建东京 S3 备份桶并开启 versioning
|
||||||
|
|
||||||
|
## 3. 东京应用部署勾选
|
||||||
|
|
||||||
|
- 已上传 `docker-compose.cloud.yml`
|
||||||
|
- 已上传 `configs/ppanel.yaml`
|
||||||
|
- 已上传 `.env`
|
||||||
|
- 已上传 `grafana/`
|
||||||
|
- 已上传 `loki/`
|
||||||
|
- 已上传 `prometheus/`
|
||||||
|
- 已上传 `tempo/`
|
||||||
|
- 已安装东京 Nginx 配置
|
||||||
|
- 已启动 `ppanel-server`
|
||||||
|
- 已启动 `hifast-redis`
|
||||||
|
- 已启动 observability 容器
|
||||||
|
- `curl http://127.0.0.1:8080/v1/common/heartbeat` 正常
|
||||||
|
- `curl http://127.0.0.1/v1/common/heartbeat` 正常
|
||||||
|
- ALB 健康检查正常
|
||||||
|
|
||||||
|
## 4. 停机迁移勾选
|
||||||
|
|
||||||
|
- 已降低正式域名 TTL
|
||||||
|
- 已停止香港 `ppanel-server`
|
||||||
|
- 已确认香港不再有新写入
|
||||||
|
- 已导出香港 MySQL `hifast-full.sql.gz`
|
||||||
|
- 已导出香港 Redis `dump.rdb`
|
||||||
|
- 已导入东京 RDS
|
||||||
|
- 已导入东京 Redis
|
||||||
|
- 东京应用已改为连接东京 MySQL / Redis
|
||||||
|
- 平行域名验收通过
|
||||||
|
|
||||||
|
## 5. 104 灾备重挂勾选
|
||||||
|
|
||||||
|
- 东京 RDS 已设置 `binlog retention hours`
|
||||||
|
- 东京 RDS 已创建 `repl@104.238.220.230`
|
||||||
|
- 已用东京 dump 重建 `104` 的 `hifast`
|
||||||
|
- `104` MySQL 已成功挂东京主库
|
||||||
|
- `104` MySQL `Replica_IO_Running: Yes`
|
||||||
|
- `104` MySQL `Replica_SQL_Running: Yes`
|
||||||
|
- `104` MySQL `Seconds_Behind_Source: 0`
|
||||||
|
- `104` Redis 已成功挂东京主库
|
||||||
|
- 东京 Redis `connected_slaves:1`
|
||||||
|
- `104` Redis `role:slave`
|
||||||
|
- `104` Redis `master_link_status:up`
|
||||||
|
|
||||||
|
## 6. 正式切换与回滚勾选
|
||||||
|
|
||||||
|
- 已切正式域名到东京 ALB
|
||||||
|
- 外网请求正常
|
||||||
|
- 核心业务接口无 `5xx`
|
||||||
|
- 应用日志无 MySQL / Redis 连接错误
|
||||||
|
- WAF 无误伤
|
||||||
|
- 已验证 DNS 可回切
|
||||||
|
- 香港环境已保留为只读回滚基线
|
||||||
|
- 香港环境计划保留 `7` 天观察期
|
||||||
@@ -0,0 +1,286 @@
|
|||||||
|
# Hifast AWS 香港到日本东京迁移 Runbook
|
||||||
|
|
||||||
|
本文档用于把当前香港区 `ap-east-1` 主生产，迁移到日本东京 `ap-northeast-1`。
|
||||||
|
|
||||||
|
适用目标：
|
||||||
|
|
||||||
|
- 东京成为新主站
|
||||||
|
- 架构升级为 `ALB + WAF + EC2 + RDS`
|
||||||
|
- `104.238.220.230` 继续作为东京主站的 MySQL / Redis 外部灾备
|
||||||
|
|
||||||
|
## 0. 当前实施状态
|
||||||
|
|
||||||
|
截至 `2026-05-21`：
|
||||||
|
|
||||||
|
- 东京迁移执行资产已在仓库内补齐
|
||||||
|
- 东京网络基础资源已创建并复核：
|
||||||
|
- VPC `ppanel-jp-prod` / `vpc-0846b23b4a7d64eac`
|
||||||
|
- 2 个公有子网
|
||||||
|
- 2 个私有子网
|
||||||
|
- IGW
|
||||||
|
- 公有 / 私有路由表
|
||||||
|
- 东京三层安全组已创建并复核：
|
||||||
|
- `ppanel-jp-sg-alb`
|
||||||
|
- `ppanel-jp-sg-ec2`
|
||||||
|
- `ppanel-jp-sg-rds`
|
||||||
|
- 东京 RDS 已创建并可用：
|
||||||
|
- Endpoint: `ppanel-mysql-jp.cpo0keikgh80.ap-northeast-1.rds.amazonaws.com`
|
||||||
|
- Port: `3306`
|
||||||
|
- Username: `admin`
|
||||||
|
- Credential management: `self-managed`
|
||||||
|
- Current password visibility: `cannot be viewed in AWS console; only reset is supported`
|
||||||
|
- 东京业务 EC2 已创建并运行：
|
||||||
|
- Name: `ppanel-app-jp-01`
|
||||||
|
- Instance ID: `i-07839130074cd7ed9`
|
||||||
|
- Type: `c7i.xlarge`
|
||||||
|
- Private IP: `10.20.1.168`
|
||||||
|
- Elastic IP: `3.114.29.208`
|
||||||
|
- 东京 S3 备份桶已创建
|
||||||
|
- 东京 ACM 证书已请求，仍等待 DNS 验证
|
||||||
|
- 当前尚未完成的核心资源：
|
||||||
|
- ALB
|
||||||
|
- WAF
|
||||||
|
- ACM DNS 验证
|
||||||
|
- 东京应用目录部署与数据导入
|
||||||
|
|
||||||
|
建议先执行：
|
||||||
|
|
||||||
|
```bash
|
||||||
|
cp deploy/aws/ap-northeast-1/configs/aws-jp-infra.env.example /root/aws-jp-infra.env
|
||||||
|
vim /root/aws-jp-infra.env
|
||||||
|
bash deploy/scripts/aws_jp_create_base_infra.sh /root/aws-jp-infra.env
|
||||||
|
bash deploy/scripts/aws_jp_describe_state.sh /root/aws-jp-infra.env
|
||||||
|
```
|
||||||
|
|
||||||
|
然后把结果回填到：
|
||||||
|
|
||||||
|
- `deploy/aws/ap-northeast-1/configs/resource-inventory.current.md`
|
||||||
|
- `ops/hifast-aws-jp-cutover-checklist-zh.md`
|
||||||
|
|
||||||
|
## 1. 当前基线
|
||||||
|
|
||||||
|
迁移前默认当前现网状态为：
|
||||||
|
|
||||||
|
- 香港应用 EC2：`hifast-hk-app-01`
|
||||||
|
- 香港 RDS：`hifast-mysql-prod-v2.cd6aey40m6ag.ap-east-1.rds.amazonaws.com`
|
||||||
|
- 香港 Redis 主库：`18.163.33.75:6379`
|
||||||
|
- 外部灾备：`104.238.220.230`
|
||||||
|
- 当前应用部署目录：`/opt/ppanel`
|
||||||
|
- 当前应用配置文件：`/opt/ppanel/configs/ppanel.yaml`
|
||||||
|
- 当前业务容器：`ppanel-server`
|
||||||
|
|
||||||
|
## 2. 迁移前准备
|
||||||
|
|
||||||
|
正式迁移前必须完成：
|
||||||
|
|
||||||
|
1. 东京基础设施已创建
|
||||||
|
2. 东京 EC2 已部署应用目录，但暂未导入正式数据
|
||||||
|
3. 东京 RDS 可连通
|
||||||
|
- 已验证从东京 EC2 到 `ppanel-mysql-jp.cpo0keikgh80.ap-northeast-1.rds.amazonaws.com:3306` 网络畅通
|
||||||
|
- 当前若无密码只能得到 `ERROR 1045 ... using password: NO`，这表示链路正常，不表示实例异常
|
||||||
|
4. 东京 Redis 已启动并可认证
|
||||||
|
5. 平行域名已准备：
|
||||||
|
- `api-jp.hifast.biz`
|
||||||
|
- `logs-jp.hifast.biz`
|
||||||
|
6. 东京 ALB 健康检查已通过
|
||||||
|
7. 东京 ACM 证书已签发
|
||||||
|
8. 东京 WAF 已挂到 ALB
|
||||||
|
9. 已准备正式回滚入口
|
||||||
|
10. 已把正式域名 TTL 降低
|
||||||
|
|
||||||
|
## 3. 香港停机冻结
|
||||||
|
|
||||||
|
在香港主环境执行：
|
||||||
|
|
||||||
|
1. 停止业务写入
|
||||||
|
2. 停 `ppanel-server`
|
||||||
|
3. 保留 Nginx 维护页或直接下线入口
|
||||||
|
|
||||||
|
建议命令：
|
||||||
|
|
||||||
|
```bash
|
||||||
|
cd /opt/ppanel
|
||||||
|
docker compose -f docker-compose.cloud.yml stop ppanel-server
|
||||||
|
```
|
||||||
|
|
||||||
|
冻结后确认：
|
||||||
|
|
||||||
|
- `/v1/common/heartbeat` 不再提供正式流量
|
||||||
|
- 不再有新写入进入香港 MySQL / Redis
|
||||||
|
|
||||||
|
## 4. 导出香港数据
|
||||||
|
|
||||||
|
### 4.1 MySQL
|
||||||
|
|
||||||
|
从香港主库导出：
|
||||||
|
|
||||||
|
```bash
|
||||||
|
mysqldump \
|
||||||
|
-h hifast-mysql-prod-v2.cd6aey40m6ag.ap-east-1.rds.amazonaws.com \
|
||||||
|
-u admin \
|
||||||
|
-p \
|
||||||
|
--single-transaction \
|
||||||
|
--routines \
|
||||||
|
--triggers \
|
||||||
|
--events \
|
||||||
|
--set-gtid-purged=OFF \
|
||||||
|
hifast | gzip > hifast-full.sql.gz
|
||||||
|
```
|
||||||
|
|
||||||
|
### 4.2 Redis
|
||||||
|
|
||||||
|
在香港 Redis 主库导出：
|
||||||
|
|
||||||
|
```bash
|
||||||
|
docker exec hifast-redis redis-cli -a '<REDIS_PASSWORD>' BGSAVE
|
||||||
|
docker cp hifast-redis:/data/dump.rdb ./dump.rdb
|
||||||
|
```
|
||||||
|
|
||||||
|
## 5. 导入东京
|
||||||
|
|
||||||
|
### 5.1 MySQL 导入东京 RDS
|
||||||
|
|
||||||
|
```bash
|
||||||
|
gunzip -c hifast-full.sql.gz | mysql -h <TOKYO_RDS_ENDPOINT> -u admin -p hifast
|
||||||
|
```
|
||||||
|
|
||||||
|
导入后确认：
|
||||||
|
|
||||||
|
```bash
|
||||||
|
mysql -h <TOKYO_RDS_ENDPOINT> -u admin -p -e "USE hifast; SHOW TABLES;"
|
||||||
|
```
|
||||||
|
|
||||||
|
### 5.2 Redis 导入东京
|
||||||
|
|
||||||
|
1. 停止东京 Redis 容器
|
||||||
|
2. 替换 `/data/dump.rdb`
|
||||||
|
3. 启动东京 Redis 容器
|
||||||
|
|
||||||
|
导入后确认：
|
||||||
|
|
||||||
|
```bash
|
||||||
|
docker exec hifast-redis redis-cli -a '<TOKYO_REDIS_PASSWORD>' PING
|
||||||
|
```
|
||||||
|
|
||||||
|
## 6. 启动东京应用
|
||||||
|
|
||||||
|
更新东京：
|
||||||
|
|
||||||
|
- `/opt/ppanel/configs/ppanel.yaml`
|
||||||
|
- `/opt/ppanel/.env`
|
||||||
|
|
||||||
|
关键值：
|
||||||
|
|
||||||
|
- `MySQL.Addr=<TOKYO_RDS_ENDPOINT>:3306`
|
||||||
|
- `MySQL.Username=admin`
|
||||||
|
- `MySQL.Password=<TOKYO_RDS_PASSWORD>`
|
||||||
|
- `Redis.Host=127.0.0.1:6379`
|
||||||
|
- `Redis.Pass=<TOKYO_REDIS_PASSWORD>`
|
||||||
|
- `Site.Host=api-jp.hifast.biz`
|
||||||
|
- `.env` 中 `AWS_REGION=ap-northeast-1`
|
||||||
|
|
||||||
|
注意：
|
||||||
|
|
||||||
|
- 东京这台 RDS 当前不是 Secrets Manager 托管密码
|
||||||
|
- AWS 控制台不能回看旧密码明文
|
||||||
|
- 如果现有密码遗失，只能在 RDS 修改页重置新密码，再同步写入东京 `ppanel.yaml`
|
||||||
|
|
||||||
|
当前东京已实际生效：
|
||||||
|
|
||||||
|
- `MySQL.Addr=ppanel-mysql-jp.cpo0keikgh80.ap-northeast-1.rds.amazonaws.com:3306`
|
||||||
|
- `MySQL.Username=admin`
|
||||||
|
- `MySQL.Password=TkyRds20260521!N9mQ8sKe2vLp7Xa`
|
||||||
|
- `Redis.Host=127.0.0.1:6379`
|
||||||
|
- `Redis.Pass=hifast67yj`
|
||||||
|
|
||||||
|
启动：
|
||||||
|
|
||||||
|
```bash
|
||||||
|
cd /opt/ppanel
|
||||||
|
docker compose -f docker-compose.cloud.yml up -d
|
||||||
|
```
|
||||||
|
|
||||||
|
## 7. 东京平行环境验收
|
||||||
|
|
||||||
|
至少执行：
|
||||||
|
|
||||||
|
```bash
|
||||||
|
curl -sf http://127.0.0.1:8080/v1/common/heartbeat
|
||||||
|
curl -sf http://127.0.0.1/v1/common/heartbeat
|
||||||
|
docker compose -f /opt/ppanel/docker-compose.cloud.yml ps
|
||||||
|
docker compose -f /opt/ppanel/docker-compose.cloud.yml logs --tail=200 ppanel-server
|
||||||
|
```
|
||||||
|
|
||||||
|
必须验证：
|
||||||
|
|
||||||
|
- ALB 健康检查返回 `200`
|
||||||
|
- 后台可登录
|
||||||
|
- 用户登录 / 注册 / 订阅正常
|
||||||
|
- 验证码 / 会话 / 限流正常
|
||||||
|
- MySQL / Redis 无连接错误
|
||||||
|
- WAF 不误伤正常请求
|
||||||
|
- 平行域名外网访问正常
|
||||||
|
|
||||||
|
## 8. 正式域名切换
|
||||||
|
|
||||||
|
仅在东京平行环境验收全部通过后执行：
|
||||||
|
|
||||||
|
1. 将正式域名切到东京 `ALB`
|
||||||
|
2. 观察 5xx、延迟、容器日志、RDS、Redis
|
||||||
|
3. 保持香港不删，只做回滚保留
|
||||||
|
|
||||||
|
## 9. 104 灾备重挂
|
||||||
|
|
||||||
|
### 9.1 MySQL
|
||||||
|
|
||||||
|
在东京 RDS 上：
|
||||||
|
|
||||||
|
```sql
|
||||||
|
CALL mysql.rds_set_configuration('binlog retention hours', 24);
|
||||||
|
CREATE USER IF NOT EXISTS 'repl'@'104.238.220.230' IDENTIFIED BY '<REPL_PASSWORD>';
|
||||||
|
GRANT REPLICATION SLAVE, REPLICATION CLIENT ON *.* TO 'repl'@'104.238.220.230';
|
||||||
|
FLUSH PRIVILEGES;
|
||||||
|
SHOW BINARY LOG STATUS;
|
||||||
|
```
|
||||||
|
|
||||||
|
当前东京已准备完成：
|
||||||
|
|
||||||
|
- `repl@104.238.220.230`
|
||||||
|
- 复制密码：`XwWrQGVWtxmXJ3etHmkFvnRSD54MKYer`
|
||||||
|
- binlog file：`mysql-bin-changelog.000189`
|
||||||
|
- binlog pos：`185053`
|
||||||
|
|
||||||
|
然后在 `104` 重建并挂从。
|
||||||
|
|
||||||
|
### 9.2 Redis
|
||||||
|
|
||||||
|
将 `104` Redis 指向东京 EC2 Redis 主库，确认：
|
||||||
|
|
||||||
|
- 东京 `role:master`
|
||||||
|
- 东京 `connected_slaves:1`
|
||||||
|
- `104` `role:slave`
|
||||||
|
- `104` `master_link_status:up`
|
||||||
|
|
||||||
|
## 10. 回滚
|
||||||
|
|
||||||
|
如果东京验收失败：
|
||||||
|
|
||||||
|
- 不切正式域名
|
||||||
|
- 继续保留香港主环境
|
||||||
|
|
||||||
|
如果正式切换后发现严重问题：
|
||||||
|
|
||||||
|
1. 立刻把 DNS 切回香港
|
||||||
|
2. 恢复香港 `ppanel-server`
|
||||||
|
3. 放弃本次东京接管
|
||||||
|
|
||||||
|
## 11. 切换后观察期
|
||||||
|
|
||||||
|
切换后至少保留香港环境 `7` 天：
|
||||||
|
|
||||||
|
- 香港 RDS 快照
|
||||||
|
- 香港 Redis RDB
|
||||||
|
- 香港 EC2 配置
|
||||||
|
- 香港 `ppanel.yaml` 备份
|
||||||
|
|
||||||
|
观察期内不删除香港资源。
|
||||||
@@ -0,0 +1,246 @@
|
|||||||
|
# Hifast 当前架构文档（东京主站版）
|
||||||
|
|
||||||
|
最后更新：`2026-05-21`
|
||||||
|
|
||||||
|
这份文档只描述**当前真实生效**的架构，不描述理想目标，不混入已经下线或待迁移的香港旧链路。
|
||||||
|
|
||||||
|
如果后续东京 `ALB / WAF / 正式域名` 上线，应继续更新这份文档，而不是回头参考旧香港架构文档。
|
||||||
|
|
||||||
|
## 1. 当前结论
|
||||||
|
|
||||||
|
当前已经实际跑起来的是：
|
||||||
|
|
||||||
|
`用户 / 运维 -> 东京 EC2 -> ppanel-server + Redis + observability -> 东京 RDS MySQL`
|
||||||
|
|
||||||
|
当前还**没有**实际生效的组件：
|
||||||
|
|
||||||
|
- `ALB`
|
||||||
|
- `WAF`
|
||||||
|
- 正式域名切流
|
||||||
|
- `104.238.220.230` 重挂东京 MySQL / Redis 从库
|
||||||
|
|
||||||
|
也就是说，东京环境目前是：
|
||||||
|
|
||||||
|
- 一台业务 EC2 已可用
|
||||||
|
- 一台东京 RDS 已可用
|
||||||
|
- 本机 Redis 已可用
|
||||||
|
- `ppanel-server` 已成功启动并连通 MySQL / Redis
|
||||||
|
- 灾备链路参数已准备好，但 `104` 还没最终挂上去
|
||||||
|
|
||||||
|
## 2. 当前真实拓扑
|
||||||
|
|
||||||
|
```mermaid
|
||||||
|
flowchart TB
|
||||||
|
USER["用户 / 运维"] --> EIP["东京 EC2 公网入口\n3.114.29.208"]
|
||||||
|
EIP --> NGINX["Nginx\nEC2 本机"]
|
||||||
|
NGINX --> APP["ppanel-server\nhost network\n127.0.0.1:8080"]
|
||||||
|
APP --> REDIS["Redis Docker\n127.0.0.1:6379"]
|
||||||
|
APP --> RDS["Tokyo RDS MySQL\nppanel-mysql-jp"]
|
||||||
|
APP --> OBS["Grafana / Loki / Tempo / Prometheus"]
|
||||||
|
|
||||||
|
RDS -. 预留复制 .-> DRMYSQL["104.238.220.230\nMySQL DR\n未最终接入"]
|
||||||
|
REDIS -. 预留复制 .-> DRREDIS["104.238.220.230\nRedis DR\n未最终接入"]
|
||||||
|
```
|
||||||
|
|
||||||
|
## 3. 云资源清单
|
||||||
|
|
||||||
|
### 3.1 Region
|
||||||
|
|
||||||
|
- AWS account: `hifastvpn (200810848252)`
|
||||||
|
- Region: `ap-northeast-1`
|
||||||
|
|
||||||
|
### 3.2 网络
|
||||||
|
|
||||||
|
- VPC: `ppanel-jp-prod`
|
||||||
|
- VPC ID: `vpc-0846b23b4a7d64eac`
|
||||||
|
- CIDR: `10.20.0.0/16`
|
||||||
|
|
||||||
|
公有子网：
|
||||||
|
|
||||||
|
- `ppanel-jp-public-a` / `subnet-091232bdb53e71490` / `10.20.0.0/24`
|
||||||
|
- `ppanel-jp-public-c` / `subnet-01ba0975c525ce8cf` / `10.20.1.0/24`
|
||||||
|
|
||||||
|
私有子网：
|
||||||
|
|
||||||
|
- `ppanel-jp-private-a` / `subnet-0bd13111c02f0edbe` / `10.20.10.0/24`
|
||||||
|
- `ppanel-jp-private-c` / `subnet-0d86c5c756dbc84b2` / `10.20.11.0/24`
|
||||||
|
|
||||||
|
### 3.3 安全组
|
||||||
|
|
||||||
|
- `ppanel-jp-sg-alb`
|
||||||
|
- `80/tcp <- 0.0.0.0/0`
|
||||||
|
- `443/tcp <- 0.0.0.0/0`
|
||||||
|
- `ppanel-jp-sg-ec2`
|
||||||
|
- `80/tcp <- sg-0b3a23c31041a5a5a`
|
||||||
|
- `22/tcp <- 64.118.144.142/32`
|
||||||
|
- `6379/tcp <- 104.238.220.230/32`
|
||||||
|
- `ppanel-jp-sg-rds`
|
||||||
|
- `3306/tcp <- sg-01f2a5a81e7505c91`
|
||||||
|
- `3306/tcp <- 104.238.220.230/32`
|
||||||
|
|
||||||
|
## 4. 计算与数据库
|
||||||
|
|
||||||
|
### 4.1 业务 EC2
|
||||||
|
|
||||||
|
- Name: `ppanel-app-jp-01`
|
||||||
|
- Instance ID: `i-07839130074cd7ed9`
|
||||||
|
- Type: `c7i.xlarge`
|
||||||
|
- AZ: `ap-northeast-1c`
|
||||||
|
- Private IP: `10.20.1.168`
|
||||||
|
- Public IP / Elastic IP: `3.114.29.208`
|
||||||
|
- Public DNS: `ec2-3-114-29-208.ap-northeast-1.compute.amazonaws.com`
|
||||||
|
- Root volume: `gp3 100GiB`
|
||||||
|
- Status: `running`
|
||||||
|
|
||||||
|
说明：
|
||||||
|
|
||||||
|
- 当前公网入口是这台 EC2 自己
|
||||||
|
- 这里绑定的是 `EIP`，不是依赖实例自动分配的临时公网 IP
|
||||||
|
- 绑定 EIP 的目的，是保证以后 Redis 主从、白名单、DNS、文档里的公网地址不因为实例变更而漂移
|
||||||
|
|
||||||
|
### 4.2 Tokyo RDS
|
||||||
|
|
||||||
|
- Identifier: `ppanel-mysql-jp`
|
||||||
|
- Engine: `MySQL Community 8.4.8`
|
||||||
|
- Class: `db.r7g.xlarge`
|
||||||
|
- Storage: `gp3 100GiB`
|
||||||
|
- Master user: `admin`
|
||||||
|
- Endpoint: `ppanel-mysql-jp.cpo0keikgh80.ap-northeast-1.rds.amazonaws.com`
|
||||||
|
- Public access: `enabled`
|
||||||
|
- Credential management: `self-managed`
|
||||||
|
- Current status: `available`
|
||||||
|
|
||||||
|
当前实际连接值：
|
||||||
|
|
||||||
|
- Host: `ppanel-mysql-jp.cpo0keikgh80.ap-northeast-1.rds.amazonaws.com`
|
||||||
|
- Port: `3306`
|
||||||
|
- User: `admin`
|
||||||
|
|
||||||
|
### 4.3 Redis
|
||||||
|
|
||||||
|
- 部署位置：东京 EC2 本机
|
||||||
|
- 部署方式：Docker
|
||||||
|
- 容器名：`ppanel-redis`
|
||||||
|
- 当前角色：`master`
|
||||||
|
- 当前监听：`127.0.0.1:6379`（应用本机访问）
|
||||||
|
- 当前对灾备开放：`3.114.29.208:6379`
|
||||||
|
|
||||||
|
### 4.4 应用与可观测
|
||||||
|
|
||||||
|
业务容器：
|
||||||
|
|
||||||
|
- `ppanel-server`
|
||||||
|
|
||||||
|
可观测容器：
|
||||||
|
|
||||||
|
- `ppanel-grafana`
|
||||||
|
- `ppanel-loki`
|
||||||
|
- `ppanel-promtail`
|
||||||
|
- `ppanel-prometheus`
|
||||||
|
- `ppanel-tempo`
|
||||||
|
- `ppanel-cadvisor`
|
||||||
|
- `ppanel-node-exporter`
|
||||||
|
- `ppanel-nginx-exporter`
|
||||||
|
|
||||||
|
## 5. 当前部署方式
|
||||||
|
|
||||||
|
部署目录：
|
||||||
|
|
||||||
|
- `/opt/ppanel`
|
||||||
|
|
||||||
|
关键文件：
|
||||||
|
|
||||||
|
- `/opt/ppanel/docker-compose.cloud.yml`
|
||||||
|
- `/opt/ppanel/configs/ppanel.yaml`
|
||||||
|
- `/opt/ppanel/.env`
|
||||||
|
|
||||||
|
业务启动方式：
|
||||||
|
|
||||||
|
- `ppanel-server` 使用 `docker compose`
|
||||||
|
- `network_mode: host`
|
||||||
|
|
||||||
|
当前配置指向：
|
||||||
|
|
||||||
|
- MySQL -> 东京 RDS
|
||||||
|
- Redis -> 本机 Docker Redis
|
||||||
|
- Trace -> `127.0.0.1:4317`
|
||||||
|
|
||||||
|
## 6. 当前已验证状态
|
||||||
|
|
||||||
|
截至 `2026-05-21` 已确认：
|
||||||
|
|
||||||
|
- `docker exec ppanel-redis redis-cli -a 'hifast67yj' PING` 返回 `PONG`
|
||||||
|
- `MYSQL_PWD=... mysql -h ppanel-mysql-jp.cpo0keikgh80.ap-northeast-1.rds.amazonaws.com -u admin -e "select 1"` 返回正常
|
||||||
|
- `docker compose -f /opt/ppanel/docker-compose.cloud.yml up -d ppanel-server` 已成功
|
||||||
|
- `docker logs ppanel-server` 无 MySQL / Redis 连接报错
|
||||||
|
- `curl http://127.0.0.1:8080/v1/common/heartbeat` 返回成功
|
||||||
|
|
||||||
|
可以认为当前东京单站已经具备：
|
||||||
|
|
||||||
|
- 服务启动能力
|
||||||
|
- 数据库连接能力
|
||||||
|
- Redis 连接能力
|
||||||
|
- 基础可观测能力
|
||||||
|
|
||||||
|
## 7. 当前未落地项
|
||||||
|
|
||||||
|
下面这些还属于“目标方案”，不是“当前实际架构”：
|
||||||
|
|
||||||
|
- `ALB`
|
||||||
|
- `WAF`
|
||||||
|
- ACM 证书完成 DNS 验证
|
||||||
|
- 正式域名切换到东京
|
||||||
|
- `104.238.220.230` 完整接成东京 DR
|
||||||
|
|
||||||
|
所以现在请不要把当前架构理解成：
|
||||||
|
|
||||||
|
`DNS -> ALB -> WAF -> EC2 -> RDS`
|
||||||
|
|
||||||
|
当前真实架构更准确地说是：
|
||||||
|
|
||||||
|
`EIP -> EC2(Nginx + ppanel-server + Redis + observability) -> RDS`
|
||||||
|
|
||||||
|
## 8. 灾备准备状态
|
||||||
|
|
||||||
|
### 8.1 MySQL DR
|
||||||
|
|
||||||
|
已准备好：
|
||||||
|
|
||||||
|
- DR host: `104.238.220.230`
|
||||||
|
- 复制账号：`repl@104.238.220.230`
|
||||||
|
- binlog retention hours: `24`
|
||||||
|
- current binlog file: `mysql-bin-changelog.000189`
|
||||||
|
- current binlog position: `185053`
|
||||||
|
|
||||||
|
当前状态：
|
||||||
|
|
||||||
|
- 东京侧已准备完成
|
||||||
|
- 但 `104` 侧还没有最终执行挂从
|
||||||
|
|
||||||
|
### 8.2 Redis DR
|
||||||
|
|
||||||
|
已准备好：
|
||||||
|
|
||||||
|
- 东京 Redis 主地址：`3.114.29.208:6379`
|
||||||
|
- 东京 Redis 当前角色：`role:master`
|
||||||
|
- 东京 Redis 当前状态：`connected_slaves:0`
|
||||||
|
|
||||||
|
当前状态：
|
||||||
|
|
||||||
|
- 东京侧已可作为主库提供同步
|
||||||
|
- 但 `104` 侧还没有最终执行 `REPLICAOF`
|
||||||
|
|
||||||
|
## 9. 权威文档入口
|
||||||
|
|
||||||
|
与当前东京架构直接相关的文档，以这些为准：
|
||||||
|
|
||||||
|
- [当前架构文档](./hifast-current-architecture-zh.md)
|
||||||
|
- [东京资源清单](../deploy/aws/ap-northeast-1/configs/resource-inventory.current.md)
|
||||||
|
- [东京迁移 Runbook](./hifast-aws-jp-migration-runbook-zh.md)
|
||||||
|
- [东京切换清单](./hifast-aws-jp-cutover-checklist-zh.md)
|
||||||
|
|
||||||
|
下面这些旧文档可以继续保留，但不要作为“当前实际架构”依据：
|
||||||
|
|
||||||
|
- 香港旧主站相关文档
|
||||||
|
- 仍以 `ap-east-1` 为主语的历史架构说明
|
||||||
|
|
||||||
@@ -214,6 +214,42 @@ S3_PREFIX=redis bash deploy/scripts/redis_rdb_backup_to_s3.sh
|
|||||||
- 本地临时文件默认只保留 `3` 天
|
- 本地临时文件默认只保留 `3` 天
|
||||||
- 长期保留建议通过 S3 Lifecycle 管理，而不是靠本机 cron 删除
|
- 长期保留建议通过 S3 Lifecycle 管理，而不是靠本机 cron 删除
|
||||||
|
|
||||||
|
### 9.3 MySQL 每 10 分钟执行一次
|
||||||
|
|
||||||
|
如果你要在 `104` 上做高频逻辑备份，仓库里已经补了 `systemd timer` 安装脚本：
|
||||||
|
|
||||||
|
- 安装脚本：
|
||||||
|
- [`deploy/scripts/install_mysql_backup_timer.sh`](/Users/Apple/code_vpn/vpn/ppanel-server/deploy/scripts/install_mysql_backup_timer.sh)
|
||||||
|
- systemd service：
|
||||||
|
- [`deploy/systemd/hifast-mysql-backup.service`](/Users/Apple/code_vpn/vpn/ppanel-server/deploy/systemd/hifast-mysql-backup.service)
|
||||||
|
- systemd timer：
|
||||||
|
- [`deploy/systemd/hifast-mysql-backup.timer`](/Users/Apple/code_vpn/vpn/ppanel-server/deploy/systemd/hifast-mysql-backup.timer)
|
||||||
|
|
||||||
|
安装方式：
|
||||||
|
|
||||||
|
```bash
|
||||||
|
cp deploy/aws/ap-northeast-1/configs/backup-to-s3.env.example /root/backup-to-s3.env
|
||||||
|
chmod 600 /root/backup-to-s3.env
|
||||||
|
vim /root/backup-to-s3.env
|
||||||
|
|
||||||
|
bash deploy/scripts/install_mysql_backup_timer.sh /opt/ppanel /root/backup-to-s3.env
|
||||||
|
```
|
||||||
|
|
||||||
|
查看状态：
|
||||||
|
|
||||||
|
```bash
|
||||||
|
systemctl list-timers --all | grep hifast-mysql-backup
|
||||||
|
systemctl status hifast-mysql-backup.timer --no-pager -l
|
||||||
|
systemctl status hifast-mysql-backup.service --no-pager -l
|
||||||
|
journalctl -u hifast-mysql-backup.service -n 50 --no-pager
|
||||||
|
```
|
||||||
|
|
||||||
|
补充说明：
|
||||||
|
|
||||||
|
- 定时表达式是 `OnCalendar=*:0/10`，即每 `10` 分钟执行一次
|
||||||
|
- 备份脚本已加 `flock` 锁，上一轮未结束时，下一轮会自动跳过，不会并发打包
|
||||||
|
- 高频逻辑备份会持续产生 `mysqldump` 开销，建议只在 `104` 这样的从库或备用库上执行，不要直接打主库
|
||||||
|
|
||||||
## 10. 恢复思路
|
## 10. 恢复思路
|
||||||
|
|
||||||
### 10.1 MySQL
|
### 10.1 MySQL
|
||||||
|
|||||||
@@ -0,0 +1,130 @@
|
|||||||
|
# Hifast 上传链路自检 Runbook
|
||||||
|
|
||||||
|
本文档用于排查 `POST /v1/public/file/upload`、`/upload/init`、`/upload/complete` 相关问题。上传链路依赖：
|
||||||
|
|
||||||
|
`客户端 -> Nginx -> ppanel-server -> S3/RustFS endpoint`
|
||||||
|
|
||||||
|
## 1. 先确认业务服务健康
|
||||||
|
|
||||||
|
在测试机执行：
|
||||||
|
|
||||||
|
```bash
|
||||||
|
curl -k -sS -m 8 -i https://tapi.hifast.biz/v1/common/heartbeat | head -30
|
||||||
|
docker ps --format '{{.Names}} {{.Image}} {{.Status}} {{.Ports}}'
|
||||||
|
ss -lntp | grep -E ':(80|443|8080|3306|6379)'
|
||||||
|
```
|
||||||
|
|
||||||
|
预期：
|
||||||
|
|
||||||
|
- `/v1/common/heartbeat` 返回 `HTTP 200`，业务 `code=200`
|
||||||
|
- `ppanel-server`、`ppanel-mysql`、`ppanel-redis` 运行中
|
||||||
|
- Nginx 监听 `80/443`，ppanel 监听 `8080`
|
||||||
|
|
||||||
|
## 2. 检查上传配置
|
||||||
|
|
||||||
|
测试环境当前业务容器使用挂载配置：
|
||||||
|
|
||||||
|
```bash
|
||||||
|
docker inspect ppanel-server --format '{{json .Mounts}}'
|
||||||
|
docker cp ppanel-server:/app/etc/ppanel.yaml /tmp/ppanel.yaml
|
||||||
|
awk '/^S3:/{flag=1} flag && /^[A-Za-z0-9_]+:/{if($1!="S3:") exit} flag{print}' /tmp/ppanel.yaml \
|
||||||
|
| sed -E 's/(AccessKey:).*/\1 ***REDACTED***/; s/(SecretKey:).*/\1 ***REDACTED***/; s/(SessionToken:).*/\1 ***REDACTED***/'
|
||||||
|
```
|
||||||
|
|
||||||
|
重点确认：
|
||||||
|
|
||||||
|
- `S3.Enable: true`
|
||||||
|
- `S3.Endpoint` 是 ppanel-server 所在机器可以访问的地址
|
||||||
|
- `S3.Bucket` 存在且凭据有 `PutObject` / `HeadObject` 权限
|
||||||
|
- `S3.UsePathStyle` 与对象存储实现一致
|
||||||
|
- `S3.PublicBaseURL` 只影响返回 URL，不代表写入 endpoint
|
||||||
|
|
||||||
|
## 3. 检查对象存储连通性
|
||||||
|
|
||||||
|
先从测试机主机网络检查：
|
||||||
|
|
||||||
|
```bash
|
||||||
|
endpoint='http://107.173.50.22:5017'
|
||||||
|
host='107.173.50.22'
|
||||||
|
port='5017'
|
||||||
|
|
||||||
|
timeout 5 bash -lc "</dev/tcp/${host}/${port}" && echo tcp_ok || echo tcp_fail
|
||||||
|
curl -v --connect-timeout 5 --max-time 10 -I "${endpoint}/"
|
||||||
|
curl -v --connect-timeout 5 --max-time 10 -I "${endpoint}/hifastvpn"
|
||||||
|
ip route get "${host}"
|
||||||
|
```
|
||||||
|
|
||||||
|
判定：
|
||||||
|
|
||||||
|
- TCP 超时：优先查对象存储主机防火墙、安全组、服务监听、源 IP 白名单
|
||||||
|
- TCP 通但 HTTP 空响应：优先查 endpoint 协议、反向代理、对象存储进程健康
|
||||||
|
- 返回 S3 XML/鉴权错误：网络已通，再查 AK/SK、bucket、path-style 配置
|
||||||
|
|
||||||
|
## 4. 检查应用日志
|
||||||
|
|
||||||
|
```bash
|
||||||
|
docker logs --since 3h ppanel-server 2>&1 \
|
||||||
|
| grep -Ei 'put object failed|upload|s3|timeout|context canceled|error' \
|
||||||
|
| tail -120
|
||||||
|
```
|
||||||
|
|
||||||
|
典型根因：
|
||||||
|
|
||||||
|
- `put object failed ... context canceled` 且请求耗时约 60 秒：上游对象存储请求没有在 Nginx upstream timeout 前完成，通常是 `S3.Endpoint` 不可达或对象存储服务 hang。
|
||||||
|
- 立即返回业务错误：通常是 `S3.Enable=false`、Content-Type 不在白名单、bucket/权限错误。
|
||||||
|
|
||||||
|
## 5. Nginx 检查
|
||||||
|
|
||||||
|
```bash
|
||||||
|
grep -RIn 'proxy_pass\|proxy_read_timeout\|client_max_body_size\|tapi.hifast.biz' /etc/nginx/sites-enabled /etc/nginx/conf.d
|
||||||
|
nginx -t
|
||||||
|
```
|
||||||
|
|
||||||
|
注意：单纯放大 `proxy_read_timeout` 只能掩盖现象，不能修复对象存储不可达。
|
||||||
|
|
||||||
|
## 6. 修复与回滚
|
||||||
|
|
||||||
|
修复优先级：
|
||||||
|
|
||||||
|
1. 恢复对象存储 endpoint 的网络访问或服务监听。
|
||||||
|
2. 如 endpoint 已迁移，更新 `/root/bindbox/configs/ppanel.yaml` 的 `S3.Endpoint`，重启 `ppanel-server`。
|
||||||
|
3. 如果凭据或 bucket 变更，同步更新 `S3.AccessKey`、`S3.SecretKey`、`S3.Bucket`、`S3.UsePathStyle`。
|
||||||
|
|
||||||
|
改配置前先备份：
|
||||||
|
|
||||||
|
```bash
|
||||||
|
cp /root/bindbox/configs/ppanel.yaml /root/bindbox/configs/ppanel.yaml.bak.$(date +%Y%m%d%H%M%S)
|
||||||
|
docker restart ppanel-server
|
||||||
|
```
|
||||||
|
|
||||||
|
回滚：
|
||||||
|
|
||||||
|
```bash
|
||||||
|
cp /root/bindbox/configs/ppanel.yaml.bak.YYYYMMDDHHMMSS /root/bindbox/configs/ppanel.yaml
|
||||||
|
docker restart ppanel-server
|
||||||
|
curl -k -sS -m 8 -i https://tapi.hifast.biz/v1/common/heartbeat | head -30
|
||||||
|
```
|
||||||
|
|
||||||
|
## 7. 验证
|
||||||
|
|
||||||
|
使用有效 JWT 和有效签名复测：
|
||||||
|
|
||||||
|
```bash
|
||||||
|
curl -i -X POST 'https://tapi.hifast.biz/v1/public/file/upload' \
|
||||||
|
-H 'x-app-id: android-client' \
|
||||||
|
-H 'Authorization: <client-jwt>' \
|
||||||
|
-H 'x-signature-version: v101' \
|
||||||
|
-H 'login-type: device' \
|
||||||
|
-H 'x-signature: <sig>' \
|
||||||
|
-H 'x-nonce: <nonce>' \
|
||||||
|
-H 'x-timestamp: <ts>' \
|
||||||
|
-F 'biz_type=app-package' \
|
||||||
|
-F 'file=@nconf.zip;type=application/zip' \
|
||||||
|
--max-time 120
|
||||||
|
```
|
||||||
|
|
||||||
|
预期：
|
||||||
|
|
||||||
|
- HTTP 不再出现 `504 Gateway Time-out`
|
||||||
|
- 业务响应 `code=200`
|
||||||
|
- `docker logs ppanel-server` 不再出现新的 `put object failed`
|
||||||
@@ -0,0 +1,37 @@
|
|||||||
|
server:
|
||||||
|
http_listen_port: 3200
|
||||||
|
grpc_listen_port: 9095
|
||||||
|
|
||||||
|
distributor:
|
||||||
|
receivers:
|
||||||
|
otlp:
|
||||||
|
protocols:
|
||||||
|
grpc:
|
||||||
|
endpoint: 0.0.0.0:4317
|
||||||
|
http:
|
||||||
|
endpoint: 0.0.0.0:4318
|
||||||
|
|
||||||
|
ingester:
|
||||||
|
max_block_duration: 5m
|
||||||
|
|
||||||
|
compactor:
|
||||||
|
compaction:
|
||||||
|
block_retention: 168h
|
||||||
|
|
||||||
|
storage:
|
||||||
|
trace:
|
||||||
|
backend: local
|
||||||
|
wal:
|
||||||
|
path: /var/tempo/wal
|
||||||
|
local:
|
||||||
|
path: /var/tempo/blocks
|
||||||
|
|
||||||
|
metrics_generator:
|
||||||
|
registry:
|
||||||
|
external_labels:
|
||||||
|
source: tempo
|
||||||
|
cluster: ppanel
|
||||||
|
storage:
|
||||||
|
path: /var/tempo/generator/wal
|
||||||
|
remote_write:
|
||||||
|
- url: http://prometheus:9090/api/v1/write
|
||||||
Reference in New Issue
Block a user