From ac4148d24b591b718371134ad26eca46a2c0c05f Mon Sep 17 00:00:00 2001 From: kdletters <61648117+kdletters@users.noreply.github.com> Date: Thu, 1 Oct 2026 18:37:31 +0800 Subject: [PATCH] =?UTF-8?q?=E7=94=9F=E4=BA=A7=20Nginx=20=E6=94=B6=E6=95=9B?= =?UTF-8?q?=E5=88=B0=E4=BB=93=E5=BA=93=E6=A8=A1=E6=9D=BF=E5=B9=B6=E5=90=8C?= =?UTF-8?q?=E6=AD=A5=E7=94=9F=E4=BA=A7=E6=9C=BA=20host-only=20=E8=A6=86?= =?UTF-8?q?=E7=9B=96?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - 主模板 http 段新增 genarrative_gallery_rps 限流 zone，供公开作品架与自定义世界画廊读取接口使用 - 新增 deploy/nginx/snippets/genarrative-host-extras.conf：内部工具页、公开画廊读取 location、主站官网首页入口 - 主模板改为 include host-only snippet，线上 vhost 以仓库模板为唯一来源 - Server-Provision 安装、备份并回滚 genarrative-host-extras.conf，补充 require_path 与临时文件清理 - 生产运维护栏新增 host-only snippet 安装断言 - 运维文档补充主站 SPA 白名单与 host-only 覆盖小节及生效配置核对命令 - 踩坑记录新增线上手工维护漂移条目：/profile 刷新 404 与 client_max_body_size 停在 64m - 决策记录新增生产 vhost 单一来源、host-only 独立成 snippet、退役路由不做显式 404 的长期口径 --- deploy/nginx/genarrative.conf | 8 + .../snippets/genarrative-host-extras.conf | 152 ++++++++++++++++++ .../shared-memory/decision-log.md | 7 + docs/project-memory/shared-memory/pitfalls.md | 8 + ...发运维】本地开发验证与生产运维-2026-05-15.md | 24 +++ scripts/check-production-ops-guardrails.mjs | 6 + scripts/jenkins-server-provision.sh | 24 ++- 7 files changed, 226 insertions(+), 3 deletions(-) create mode 100644 deploy/nginx/snippets/genarrative-host-extras.conf diff --git a/deploy/nginx/genarrative.conf b/deploy/nginx/genarrative.conf index 981a7c932..ebf5d4520 100644 --- a/deploy/nginx/genarrative.conf +++ b/deploy/nginx/genarrative.conf @@ -12,6 +12,9 @@ upstream genarrative_api { } limit_conn_zone $binary_remote_addr zone=genarrative_api_conn:10m; +# 中文注释：公开作品架 / 自定义世界画廊的读取 QPS 远高于普通创作接口，单独使用高阈值限流 zone； +# 连接数上限仍复用 genarrative_api_conn，避免绕过 API 侧的整体连接保护。 +limit_req_zone $binary_remote_addr zone=genarrative_gallery_rps:10m rate=5000r/s; limit_req_zone $binary_remote_addr zone=genarrative_api_rps:10m rate=300r/s; limit_req_zone $binary_remote_addr zone=genarrative_admin_rps:10m rate=30r/s; @@ -135,6 +138,11 @@ server { try_files $uri =404; } + # 中文注释：以下为生产机 host-only 覆盖（内部工具页 / 官网页 / 公开画廊读取限流）。 + # 这些路径不属于平台共享发布产物，也不在 Pingora 路由矩阵覆盖范围内， + # 因此独立成 snippet：新增平台路由仍必须走矩阵 + Pingora 门禁。 + include /etc/nginx/snippets/genarrative-host-extras.conf; + # 临时兼容主站仍在使用的 /api/* HTTP facade；前端完成 SpacetimeDB SDK 迁移后删除。 location ~ ^/api(?:/|$) { diff --git a/deploy/nginx/snippets/genarrative-host-extras.conf b/deploy/nginx/snippets/genarrative-host-extras.conf new file mode 100644 index 000000000..e78971432 --- /dev/null +++ b/deploy/nginx/snippets/genarrative-host-extras.conf @@ -0,0 +1,152 @@ +# 生产机 host-only 覆盖：内部工具页、主站域名上的官网页入口、公开画廊读取限流。 +# 中文注释：这些路径依赖生产机本地静态根（/srv/genarrative/tools、/srv/genarrative/corporate-site-current）， +# 不属于平台共享发布产物，因此不进入 deploy/pingora/nginx-route-parity.matrix.json 的 Pingora 路由矩阵。 +# 新增平台路由仍必须在主模板内声明并同步矩阵与 Pingora 网关；只有确认与网关无关的生产机专属路径才放这里。 +# Pingora 接公网 443 前，必须为这里的路径单独确认处理方式，否则这些页面与限流会在切换后丢失。 + +# 中文注释：内部工具静态页与主站 Web 根分离，页面产物放在 /srv/genarrative/tools/<页面>/； +# 这里只声明精确入口，且不接入维护窗口，避免把内部工具页并入公网维护开关。 +location = /finance-forecast { + return 301 /finance-forecast/; +} + +location ^~ /finance-forecast/ { + root /srv/genarrative/tools; + index index.html; + try_files $uri $uri/ /finance-forecast/index.html; +} + +location = /medical-science { + return 301 /medical-science/; +} + +location ^~ /medical-science/ { + root /srv/genarrative/tools; + index index.html; + try_files $uri $uri/ /medical-science/index.html; +} + +# 中文注释：公开作品架 / 自定义世界画廊读取接口使用专用高阈值限流（zone 在主模板 http 段声明）； +# 其余 /api 请求继续走主模板的通用 location，保持默认保护强度。 +location = /api/runtime/puzzle/gallery { + default_type application/json; + limit_conn genarrative_api_conn 320; + limit_req zone=genarrative_gallery_rps burst=4096 nodelay; + + if ($genarrative_maintenance) { + return 503 '{"ok":false,"error":{"code":"MAINTENANCE","message":"服务维护中"}}'; + } + + proxy_pass http://genarrative_api; + proxy_http_version 1.1; + proxy_buffering off; + proxy_read_timeout 3600s; + proxy_send_timeout 3600s; + add_header X-Accel-Buffering no always; + proxy_set_header Connection ""; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Forwarded-Host $host; + proxy_set_header X-Request-Id $request_id; +} + +location = /api/runtime/custom-world-gallery { + default_type application/json; + limit_conn genarrative_api_conn 320; + limit_req zone=genarrative_gallery_rps burst=4096 nodelay; + + if ($genarrative_maintenance) { + return 503 '{"ok":false,"error":{"code":"MAINTENANCE","message":"服务维护中"}}'; + } + + proxy_pass http://genarrative_api; + proxy_http_version 1.1; + proxy_buffering off; + proxy_read_timeout 3600s; + proxy_send_timeout 3600s; + add_header X-Accel-Buffering no always; + proxy_set_header Connection ""; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Forwarded-Host $host; + proxy_set_header X-Request-Id $request_id; +} + +location ~ ^/api/runtime/puzzle/gallery/[^/]+$ { + default_type application/json; + limit_conn genarrative_api_conn 32; + limit_req zone=genarrative_api_rps burst=32 nodelay; + + if ($genarrative_maintenance) { + return 503 '{"ok":false,"error":{"code":"MAINTENANCE","message":"服务维护中"}}'; + } + + proxy_pass http://genarrative_api; + proxy_http_version 1.1; + proxy_buffering off; + proxy_read_timeout 3600s; + proxy_send_timeout 3600s; + add_header X-Accel-Buffering no always; + proxy_set_header Connection ""; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Forwarded-Host $host; + proxy_set_header X-Request-Id $request_id; +} + +location ~ ^/api/runtime/custom-world-gallery/[^/]+/[^/]+$ { + default_type application/json; + limit_conn genarrative_api_conn 32; + limit_req zone=genarrative_api_rps burst=32 nodelay; + + if ($genarrative_maintenance) { + return 503 '{"ok":false,"error":{"code":"MAINTENANCE","message":"服务维护中"}}'; + } + + proxy_pass http://genarrative_api; + proxy_http_version 1.1; + proxy_buffering off; + proxy_read_timeout 3600s; + proxy_send_timeout 3600s; + add_header X-Accel-Buffering no always; + proxy_set_header Connection ""; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Forwarded-Host $host; + proxy_set_header X-Request-Id $request_id; +} + +# BEGIN CORPORATE SITE HOME ROUTE +# 中文注释：主站域名保留清智创游官网首页入口，静态根与官网独立 vhost +# （/etc/nginx/conf.d/tsingnova-games.conf）共用同一份官网构建；只有 /home 与 /home/ 生效。 +# 该入口是 2026-08-11 官网拆分前的历史遗留，是否退役需要与官网侧一起确认； +# 退役时必须同时删除本块与线上对应 location，避免两侧再次漂移。 +location = /home { + error_page 503 /maintenance.html; + + if ($genarrative_maintenance) { + return 503; + } + + return 301 /home/; +} + +location ^~ /home/ { + error_page 503 /maintenance.html; + root /srv/genarrative/corporate-site-current; + + if ($genarrative_maintenance) { + return 503; + } + + try_files $uri $uri/ /home/index.html; +} +# END CORPORATE SITE HOME ROUTE diff --git a/docs/project-memory/shared-memory/decision-log.md b/docs/project-memory/shared-memory/decision-log.md index c01d2a426..09d50f630 100644 --- a/docs/project-memory/shared-memory/decision-log.md +++ b/docs/project-memory/shared-memory/decision-log.md @@ -1,5 +1,12 @@ # 决策记录 +## 2026-10-01 生产 Nginx 以模板为唯一来源：host-only 块独立成 snippet、退役路由不做显式 404 + +- 背景：线上主站 `genarrative.conf` 长期手工维护，`profile` 未进 SPA allowlist 导致 `/profile` 刷新 404，`client_max_body_size` 也停在 `64m`；同时线上存在 4 处仓库模板没有的 host-only 块（画廊读取限流、`/finance-forecast/`、`/medical-science/`、`/home/` 官网首页入口），直接用 `Genarrative-Server-Provision` 覆盖会静默删除它们。 +- 决策：生产 vhost 以 `deploy/nginx/genarrative.conf` 为唯一来源；生产机专属路径收进 `deploy/nginx/snippets/genarrative-host-extras.conf`，由主模板 include、由 Server-Provision 安装，新增平台路由仍必须在主模板内声明并同步 `deploy/pingora/nginx-route-parity.matrix.json` 与 Pingora 网关。snippet 内的 location 有意不在矩阵覆盖范围，Pingora 接公网 443 前必须单独确认这些路径的处理方式。 +- 边界：退役路由（`/match3d`、`/puzzle`、`/runtime/*`、`/gallery/*/detail`、`/works/detail`、`/worlds/detail`、`/bark-battle` 等）不再进 SPA allowlist，也不配置显式 404，统一落 `location /` 的 `error_page 404 /404.html`。`/home/` 是 2026-08-11 官网拆分前的历史入口，是否退役需与官网侧一起决定。 +- 验证方式：`node scripts/check-nginx-spa-routes.mjs`、`node scripts/check-pingora-route-parity.mjs`、`npm run check:production-ops`、`npm run check:encoding`、`git diff --check`、`bash -n scripts/jenkins-server-provision.sh`；线上改后按生效配置烟测 `/profile`、模板 12 条 SPA 路由、`/admin/`、`/home/`、`/finance-forecast/`、`/medical-science/`、画廊 API 与 `/games/game_/…` 发行网关。 + ## 2026-09-30 release 渠道移除产品名与包名后缀 - 决策：`release` 渠道的正式产品名统一为 `陶泥儿`，Windows NSIS、macOS DMG / updater 归档等由 Tauri `productName` 派生的包名不再包含 `Release` 文本；`identifier=world.genarrative.ai-game-creator.release` 与 `release-win` 更新分区保持不变。 diff --git a/docs/project-memory/shared-memory/pitfalls.md b/docs/project-memory/shared-memory/pitfalls.md index 3528c71a9..eaa5c4bee 100644 --- a/docs/project-memory/shared-memory/pitfalls.md +++ b/docs/project-memory/shared-memory/pitfalls.md @@ -2,6 +2,14 @@ 这里只记录对当前开发仍有用的症状、根因、排查方法和风险边界。同一事实保留一个当前口径；退役对象的专属过程与单轮测试结果由 Git 历史追溯。遇到旧路径或版本时，以现行代码和专题文档为准。 +## 2026-10-01 线上 Nginx 手工维护漂移：`/profile` 刷新 404、发行包请求体仍限 64m + +- **现象**：登录后刷新 `https://www.genarrative.world/profile` 直接 404，返回 Nginx 默认 404 页（162 字节）；应用内点击进入正常。`curl` 复现：`/`、`/project`、`/creation`、`/components`、`/design-system`、`/games*`、`/editor/canvas` 全部 200 且正文与 `/` 同一份 SPA 外壳，只有 `/profile`（含 `/PROFILE`、`/profile/`）404。 +- **原因**：刷新是真实 HTTP 请求，命中线上 `/etc/nginx/conf.d/genarrative.conf` 的 SPA allowlist；线上白名单是手工维护的（留档 `genarrative.conf.bak-sparoutes-20260923T153751Z`），`profile` 从未加入，该深链落回 `location /` 的 `try_files $uri $uri/ =404`。仓库三份模板当时都写了 `profile`，而 `npm run check:nginx-spa-routes` 只校验仓库模板，查不出线上漂移。同一份线上文件还把 `client_max_body_size` 停在 `64m`（模板 210m，会让 200 MiB 发行包上传 413），并保有 4 处模板没有的 host-only 块（画廊读取限流 location、`/finance-forecast/`、`/medical-science/`、`/home/` 官网首页入口），所以直接拿模板整文件覆盖会删掉这些线上能力。 +- **处理**：线上只收敛 SPA allowlist（12 条，含 `/profile`）并补 `error_page 404 /404.html`；host-only 块收进 `deploy/nginx/snippets/genarrative-host-extras.conf`，由主模板 include、由 `Genarrative-Server-Provision` 安装。退役路由不进白名单，也不需要显式 404 配置，落 `location /` 即得品牌 404（非 HTML 客户端保持纯 404）。 +- **判据/取证**：改前 `grep -c profile /etc/nginx/conf.d/genarrative.conf` 为 0；改后 `curl -s -o /dev/null -w '%{http_code}' https://www.genarrative.world/profile` 为 200（正文 sha 与 `/` 一致），`sudo nginx -T | grep -c 'editor/canvas|profile|project'` 为 1，`match3d` 计数为 0。 +- **长期口径**：任何 SPA/路由白名单改动都要同时核对**生效配置**（`sudo nginx -T`）与仓库模板；线上主站 vhost 只由模板 + `genarrative-host-extras.conf` 生成，不再手工追加路由。snippet 内的 location 不在 Pingora 路由矩阵覆盖范围，Pingora 接公网 443 前要单独确认这些 host-only 路径。 + ## 2026-09-30 Jenkins release 渠道环境污染 AGC 构建单测 - **现象**：Jenkins `Genarrative-Agc-MacOS-Build` 的 release lane 在执行 `build-release.test.mjs` 时，`release stages Node before Tauri...` 用例报 `Cannot read properties of undefined (reading 'nsis')`。 diff --git a/docs/【开发运维】本地开发验证与生产运维-2026-05-15.md b/docs/【开发运维】本地开发验证与生产运维-2026-05-15.md index 7946645c1..6db558aa9 100644 --- a/docs/【开发运维】本地开发验证与生产运维-2026-05-15.md +++ b/docs/【开发运维】本地开发验证与生产运维-2026-05-15.md @@ -23,6 +23,30 @@ grep -i '^cache-control: no-store' ~/data/tmp/tsingnova-client-download.headers 验收必须同时满足：接口返回 `200 application/json`，响应包含 `downloads` 与 `unavailablePlatforms`，并带 `Cache-Control: no-store`；`https://tsingnovagames.com/` 仍返回官网首页。若 API 直连 `http://127.0.0.1:8082/api/client-downloads` 是 `200`、官网域名仍是 `404`，说明官网 vhost 没有 include 下载 snippet，不能靠 reload 旧配置解决。 +### 主站 SPA 白名单与 host-only 覆盖 + +主站 SPA 深链（`/profile`、`/project`、`/games/*` 等）只在 `deploy/nginx/genarrative.conf` 的 `# BEGIN GENARRATIVE MAIN SPA ROUTES` allowlist 内回退 `/index.html`；不在白名单的路径落回 `location /` 的 `try_files $uri $uri/ =404`，再经 `error_page 404 /404.html` 返回品牌 404 页。非 HTML 客户端（`Accept` 不含 `text/html`）保持纯 404，由维护 snippet 的 `location = /404.html` 决定，属预期行为。 + +2026-10-01 线上 `/profile` 刷新 404 就是白名单漂移：线上 `genarrative.conf` 是手工维护的，`profile` 从未加进 allowlist，而仓库三份模板都写了它；`npm run check:nginx-spa-routes` 只校验仓库模板，查不出线上漂移。同一份线上文件还把 `client_max_body_size` 停在 `64m`，并保有 4 处模板当时没有的 host-only 块，因此**不能**直接拿模板整文件覆盖线上。 + +- 生产 vhost 以 `deploy/nginx/genarrative.conf` 为唯一来源；生产机专属路径收在 `deploy/nginx/snippets/genarrative-host-extras.conf`（`/finance-forecast/`、`/medical-science/`、公开画廊读取限流 location、`/home/` 官网首页入口），由主模板 include，并由 `Genarrative-Server-Provision` 安装到 `/etc/nginx/snippets/`。 +- snippet 内的 location 不在 `deploy/pingora/nginx-route-parity.matrix.json` 覆盖范围；新增**平台**路由必须在主模板内声明并同步矩阵与 Pingora 网关，否则 `npm run check:pingora-route-parity` 的「模板 location 必须被矩阵覆盖」会失败。 +- 退役路由（`/match3d`、`/puzzle`、`/runtime/*`、`/gallery/*/detail`、`/works/detail`、`/worlds/detail` 等）不需要任何显式 404 配置，也不进白名单，落 `location /` 即得品牌 404。 + +改动或排障后按生效配置核对，不要只看仓库模板： + +```bash +sudo nginx -T | grep -n -A6 'GENARRATIVE MAIN SPA ROUTES' # allowlist 生效内容 +sudo nginx -T | grep -n 'client_max_body_size' # 期望 210m +sudo nginx -T | grep -n 'genarrative-host-extras' # host-only snippet 已 include +for p in / /profile /project /creation /components /design-system /games /games/detail \ + /games/mine /games/play /games/publish /editor/canvas; do + printf '%s %s\n' "$p" "$(curl -s -o /dev/null -w '%{http_code}' https://www.genarrative.world$p)" +done # 期望全部 200，且正文与 / 的 index.html 一致 +curl -s -o /dev/null -w '%{http_code}\n' https://www.genarrative.world/match3d # 期望 404 +sudo nginx -t && sudo systemctl reload nginx +``` + ## 构建回归的隔离与发布文件权限 Git hook 的临时仓库测试必须清除子进程继承的仓库定位环境（例如 `GIT_DIR`、`GIT_WORK_TREE`、`GIT_INDEX_FILE`）；仅设置 `cwd` 不能隔离 Git。回归应从带这些变量的外层仓库运行，验证外层引用、索引与配置不变。临时测试文件必须留在独立目录并清理，不得通过测试生成主仓库提交或覆盖 ESLint、Prettier 配置。修复 lint 配置时保留原有规则、忽略范围与零警告门禁，不以关闭规则代替排障。 diff --git a/scripts/check-production-ops-guardrails.mjs b/scripts/check-production-ops-guardrails.mjs index a4ef58b77..d412db2c3 100644 --- a/scripts/check-production-ops-guardrails.mjs +++ b/scripts/check-production-ops-guardrails.mjs @@ -2079,6 +2079,12 @@ const checks = [ reason: 'Server-Provision 必须安装 Pingora 真实路径 canary snippet，供人工启用直连前中间验证。', }, + { + file: 'scripts/jenkins-server-provision.sh', + includes: 'genarrative-host-extras.conf', + reason: + 'Server-Provision 必须安装生产机 host-only snippet，避免 provision 后内部工具页与官网首页入口丢失。', + }, { file: 'scripts/jenkins-server-provision.sh', includes: 'genarrative-pingora-gateway', diff --git a/scripts/jenkins-server-provision.sh b/scripts/jenkins-server-provision.sh index 9d2bda38a..dc20e57f1 100755 --- a/scripts/jenkins-server-provision.sh +++ b/scripts/jenkins-server-provision.sh @@ -1094,13 +1094,16 @@ install_nginx_config_with_rollback() { local snippet_target="/etc/nginx/snippets/genarrative-maintenance.conf" local pingora_canary_snippet_target="/etc/nginx/snippets/genarrative-pingora-canary.conf" local pingora_realpath_canary_snippet_target="/etc/nginx/snippets/genarrative-pingora-realpath-canary.conf" + local host_extras_snippet_target="/etc/nginx/snippets/genarrative-host-extras.conf" local config_source local rendered_config rendered_snippet rendered_pingora_canary_snippet rendered_pingora_realpath_canary_snippet - local config_backup snippet_backup pingora_canary_snippet_backup pingora_realpath_canary_snippet_backup disabled_sites + local rendered_host_extras_snippet + local config_backup snippet_backup pingora_canary_snippet_backup pingora_realpath_canary_snippet_backup host_extras_snippet_backup disabled_sites local had_config="false" local had_snippet="false" local had_pingora_canary_snippet="false" local had_pingora_realpath_canary_snippet="false" + local had_host_extras_snippet="false" run_cmd mkdir -p /etc/nginx/snippets /etc/nginx/conf.d if [[ "${NGINX_CONFIG_MODE}" == "production-https" ]]; then @@ -1116,6 +1119,7 @@ install_nginx_config_with_rollback() { echo "+ install -m 0644 deploy/nginx/snippets/genarrative-maintenance.conf ${snippet_target}" echo "+ install -m 0644 deploy/nginx/snippets/genarrative-pingora-canary.conf ${pingora_canary_snippet_target}" echo "+ install -m 0644 deploy/nginx/snippets/genarrative-pingora-realpath-canary.conf ${pingora_realpath_canary_snippet_target}" + echo "+ install -m 0644 deploy/nginx/snippets/genarrative-host-extras.conf ${host_extras_snippet_target}" if [[ "${DRY_RUN}" == "true" ]]; then echo "+ disable /etc/nginx/sites-enabled/default* if present" @@ -1128,10 +1132,12 @@ install_nginx_config_with_rollback() { rendered_snippet="$(mktemp)" rendered_pingora_canary_snippet="$(mktemp)" rendered_pingora_realpath_canary_snippet="$(mktemp)" + rendered_host_extras_snippet="$(mktemp)" config_backup="$(mktemp)" snippet_backup="$(mktemp)" pingora_canary_snippet_backup="$(mktemp)" pingora_realpath_canary_snippet_backup="$(mktemp)" + host_extras_snippet_backup="$(mktemp)" disabled_sites="$(mktemp)" if [[ "${NGINX_CONFIG_MODE}" == "production-https" ]]; then validate_nginx_tls @@ -1142,6 +1148,7 @@ install_nginx_config_with_rollback() { cp deploy/nginx/snippets/genarrative-maintenance.conf "${rendered_snippet}" cp deploy/nginx/snippets/genarrative-pingora-canary.conf "${rendered_pingora_canary_snippet}" cp deploy/nginx/snippets/genarrative-pingora-realpath-canary.conf "${rendered_pingora_realpath_canary_snippet}" + cp deploy/nginx/snippets/genarrative-host-extras.conf "${rendered_host_extras_snippet}" if [[ -f "${config_target}" ]]; then cp -p "${config_target}" "${config_backup}" @@ -1159,11 +1166,16 @@ install_nginx_config_with_rollback() { cp -p "${pingora_realpath_canary_snippet_target}" "${pingora_realpath_canary_snippet_backup}" had_pingora_realpath_canary_snippet="true" fi + if [[ -f "${host_extras_snippet_target}" ]]; then + cp -p "${host_extras_snippet_target}" "${host_extras_snippet_backup}" + had_host_extras_snippet="true" + fi install -m 0644 "${rendered_config}" "${config_target}" install -m 0644 "${rendered_snippet}" "${snippet_target}" install -m 0644 "${rendered_pingora_canary_snippet}" "${pingora_canary_snippet_target}" install -m 0644 "${rendered_pingora_realpath_canary_snippet}" "${pingora_realpath_canary_snippet_target}" + install -m 0644 "${rendered_host_extras_snippet}" "${host_extras_snippet_target}" disable_nginx_default_sites_enabled "${disabled_sites}" if ! nginx -t; then @@ -1188,14 +1200,19 @@ install_nginx_config_with_rollback() { else rm -f "${pingora_realpath_canary_snippet_target}" fi + if [[ "${had_host_extras_snippet}" == "true" ]]; then + cp -p "${host_extras_snippet_backup}" "${host_extras_snippet_target}" + else + rm -f "${host_extras_snippet_target}" + fi restore_nginx_default_sites_enabled "${disabled_sites}" - rm -f "${rendered_config}" "${rendered_snippet}" "${rendered_pingora_canary_snippet}" "${rendered_pingora_realpath_canary_snippet}" "${config_backup}" "${snippet_backup}" "${pingora_canary_snippet_backup}" "${pingora_realpath_canary_snippet_backup}" "${disabled_sites}" + rm -f "${rendered_config}" "${rendered_snippet}" "${rendered_pingora_canary_snippet}" "${rendered_pingora_realpath_canary_snippet}" "${rendered_host_extras_snippet}" "${config_backup}" "${snippet_backup}" "${pingora_canary_snippet_backup}" "${pingora_realpath_canary_snippet_backup}" "${host_extras_snippet_backup}" "${disabled_sites}" exit 1 fi echo "+ nginx -s reload" nginx -s reload - rm -f "${rendered_config}" "${rendered_snippet}" "${rendered_pingora_canary_snippet}" "${rendered_pingora_realpath_canary_snippet}" "${config_backup}" "${snippet_backup}" "${pingora_canary_snippet_backup}" "${pingora_realpath_canary_snippet_backup}" "${disabled_sites}" + rm -f "${rendered_config}" "${rendered_snippet}" "${rendered_pingora_canary_snippet}" "${rendered_pingora_realpath_canary_snippet}" "${rendered_host_extras_snippet}" "${config_backup}" "${snippet_backup}" "${pingora_canary_snippet_backup}" "${pingora_realpath_canary_snippet_backup}" "${host_extras_snippet_backup}" "${disabled_sites}" } cleanup_placeholder_nginx_config() { @@ -1417,6 +1434,7 @@ require_path deploy/nginx/genarrative-dev-http.conf require_path deploy/nginx/snippets/genarrative-maintenance.conf require_path deploy/nginx/snippets/genarrative-pingora-canary.conf require_path deploy/nginx/snippets/genarrative-pingora-realpath-canary.conf +require_path deploy/nginx/snippets/genarrative-host-extras.conf require_path deploy/logrotate/genarrative-pingora-gateway require_path deploy/env/api-server.env.example require_path deploy/env/external-generation-worker.env.example