修正 Pingora 高端口重定向验收

direct live 支持独立 redirect base URL 预期

release readiness 和切换证据链透传 redirect base URL

直连启用脚本透传高端口 rehearsal 参数

补充 direct live guard、运维门禁和文档示例

scripts/deploy/pingora-direct-enable.sh

@@ -26,6 +26,7 @@ DIRECT_HTTPS_BASE_URL="${GENARRATIVE_PINGORA_DIRECT_HTTPS_BASE_URL:-}"
 DIRECT_HTTP_BASE_URL="${GENARRATIVE_PINGORA_DIRECT_HTTP_BASE_URL:-}"
 DIRECT_HOST="${GENARRATIVE_PINGORA_DIRECT_HOST:-}"
 DIRECT_REDIRECT_HOST="${GENARRATIVE_PINGORA_DIRECT_REDIRECT_HOST:-}"
+DIRECT_REDIRECT_BASE_URL="${GENARRATIVE_PINGORA_DIRECT_REDIRECT_BASE_URL:-}"
 DIRECT_PROBE_TOKEN="${GENARRATIVE_PINGORA_DIRECT_PROBE_TOKEN:-}"
 DIRECT_PINGORA_ACCESS_LOG="${GENARRATIVE_PINGORA_DIRECT_PINGORA_ACCESS_LOG:-}"
 DIRECT_ACCESS_LOG_SINCE_LINES="${GENARRATIVE_PINGORA_DIRECT_ACCESS_LOG_SINCE_LINES:-}"
@@ -39,7 +40,7 @@ usage() {
   cat <<'EOF'
 用法:
   scripts/deploy/pingora-direct-enable.sh [--apply] [--preflight-env-file <path>] [--preflight-systemd] [--preflight-check-cert-readable] [--preflight-check-service-env-file] [--preflight-check-service-user-cert-readable] [--preflight-check-service-binary-executable] [--preflight-check-ports-free]
-                                          [--direct-https-base-url <url>] [--direct-http-base-url <url>] [--direct-host <host>] [--direct-redirect-host <host>]
+                                          [--direct-https-base-url <url>] [--direct-http-base-url <url>] [--direct-host <host>] [--direct-redirect-host <host>] [--direct-redirect-base-url <url>]
                                           [--direct-spacetime-database <name>] [--direct-probe-token <token>] [--direct-pingora-access-log <path>] [--direct-access-log-since-lines <count>] [--direct-timeout-ms <ms>] [--direct-live-script <path>] [--no-postcheck]
                                           [--current-release-audit-script <path>] [--current-release-root <path>] [--current-release-audit-timeout-ms <ms>]
                                           [--service <name>] [--service-unit-path <path>] [--template-path <path>] [--dropin-path <path>]
@@ -211,6 +212,14 @@ while [[ $# -gt 0 ]]; do
       fi
       shift 2
       ;;
+    --direct-redirect-base-url)
+      DIRECT_REDIRECT_BASE_URL="${2:-}"
+      if [[ -z "${DIRECT_REDIRECT_BASE_URL}" ]]; then
+        echo "[pingora-direct-enable] --direct-redirect-base-url 缺少参数" >&2
+        exit 1
+      fi
+      shift 2
+      ;;
     --direct-probe-token)
       DIRECT_PROBE_TOKEN="${2:-}"
       if [[ -z "${DIRECT_PROBE_TOKEN}" ]]; then
@@ -297,6 +306,7 @@ reject_control_characters "--direct-https-base-url" "${DIRECT_HTTPS_BASE_URL}"
 reject_control_characters "--direct-http-base-url" "${DIRECT_HTTP_BASE_URL}"
 reject_control_characters "--direct-host" "${DIRECT_HOST}"
 reject_control_characters "--direct-redirect-host" "${DIRECT_REDIRECT_HOST}"
+reject_control_characters "--direct-redirect-base-url" "${DIRECT_REDIRECT_BASE_URL}"
 reject_control_characters "--direct-probe-token" "${DIRECT_PROBE_TOKEN}"
 reject_control_characters "--direct-pingora-access-log" "${DIRECT_PINGORA_ACCESS_LOG}"
 reject_control_characters "--direct-access-log-since-lines" "${DIRECT_ACCESS_LOG_SINCE_LINES}"
@@ -732,6 +742,9 @@ run_direct_live_smoke_after_enable() {
   if [[ -n "${DIRECT_REDIRECT_HOST}" ]]; then
     direct_live_args+=(--redirect-host "${DIRECT_REDIRECT_HOST}")
   fi
+  if [[ -n "${DIRECT_REDIRECT_BASE_URL}" ]]; then
+    direct_live_args+=(--redirect-base-url "${DIRECT_REDIRECT_BASE_URL}")
+  fi
   if [[ -n "${DIRECT_PROBE_TOKEN}" ]]; then
     direct_live_args+=(--probe-token "${DIRECT_PROBE_TOKEN}")
   fi
@@ -905,5 +918,5 @@ cat <<EOF
 - systemctl is-active ${SERVICE_NAME} 为 active
 - node ${CURRENT_RELEASE_AUDIT_SCRIPT} --release-root ${CURRENT_RELEASE_ROOT} --require-pingora-gateway --systemd-show --systemd-service ${SERVICE_NAME} 已通过
 - npm run check:pingora-direct-preflight -- --env-file /etc/genarrative/pingora-gateway.env --require-live-env --systemd-cat --check-cert-readable --check-service-env-file --check-service-user-cert-readable --check-service-binary-executable --check-ports-free 已通过
-- node ${DIRECT_LIVE_SCRIPT} --https-base-url ${DIRECT_HTTPS_BASE_URL:-<direct-https-base-url>} --http-base-url ${DIRECT_HTTP_BASE_URL:-<direct-http-base-url>} --host ${DIRECT_HOST:-<direct-host>} --redirect-host ${DIRECT_REDIRECT_HOST:-<direct-redirect-host>} --pingora-access-log ${DIRECT_PINGORA_ACCESS_LOG:-<pingora-access-log>} --spacetime-database ${DIRECT_SPACETIME_DATABASE:-<database>} --require-wss-upgrade --json 已通过，且 direct-access-log 结构化证据 matched=checked、missing=0、mismatches=0
+- node ${DIRECT_LIVE_SCRIPT} --https-base-url ${DIRECT_HTTPS_BASE_URL:-<direct-https-base-url>} --http-base-url ${DIRECT_HTTP_BASE_URL:-<direct-http-base-url>} --host ${DIRECT_HOST:-<direct-host>} --redirect-host ${DIRECT_REDIRECT_HOST:-<direct-redirect-host>} ${DIRECT_REDIRECT_BASE_URL:+--redirect-base-url ${DIRECT_REDIRECT_BASE_URL} }--pingora-access-log ${DIRECT_PINGORA_ACCESS_LOG:-<pingora-access-log>} --spacetime-database ${DIRECT_SPACETIME_DATABASE:-<database>} --require-wss-upgrade --json 已通过，且 direct-access-log 结构化证据 matched=checked、missing=0、mismatches=0
 EOF