kdletters
057522fc2e
新增 Pingora TLS 证书同步脚本，默认 dry-run，apply 时原子复制证书到私有目录并复核服务用户可读。 将证书同步脚本纳入 API release 构建、部署复制和 current release 自审清单。 补充发布包、deploy、自审和脚本自身门禁，覆盖缺失脚本、symlink 目标与权限边界。 更新 Pingora env 示例、运维文档和项目踩坑记录，明确不要放宽 Let’s Encrypt 原路径权限。
77 lines
4.9 KiB
Bash
77 lines
4.9 KiB
Bash
# Pingora 独立网关试点配置示例。
|
||
# 当前只用于本机影子验证，不绑定 80/443，也不替代生产 Nginx。
|
||
# systemd 模板默认读取 /etc/genarrative/pingora-gateway.env。
|
||
|
||
GENARRATIVE_PINGORA_GATEWAY_LISTEN=127.0.0.1:18081
|
||
# 可选：直连 HTTPS 入口。默认关闭；启用时必须同时配置 cert/key，并把 FORWARDED_PROTO 设为 https。
|
||
# cert/key 必须允许 genarrative 用户读取；不要直接 chmod Let's Encrypt live/archive 原始目录。
|
||
# 可先用随包 scripts/deploy/pingora-tls-cert-sync.mjs 把证书同步到 /etc/genarrative/pingora-tls/<host>/。
|
||
# 80/443 必须先从 Nginx 或其它进程释放；高端口 loopback 演练可先使用 127.0.0.1:18443 / 127.0.0.1:18080。
|
||
# 如果要绑定 443/80，必须另行人工启用 systemd direct-entry drop-in 授予 CAP_NET_BIND_SERVICE。
|
||
# GENARRATIVE_PINGORA_GATEWAY_TLS_LISTEN=0.0.0.0:18443
|
||
# GENARRATIVE_PINGORA_GATEWAY_TLS_CERT_FILE=/etc/genarrative/pingora-tls/genarrative.world/fullchain.pem
|
||
# GENARRATIVE_PINGORA_GATEWAY_TLS_KEY_FILE=/etc/genarrative/pingora-tls/genarrative.world/privkey.pem
|
||
# 可选：直连 HTTP 只做 301 到 HTTPS；启用时必须已经配置 TLS_LISTEN，ACME challenge 仍从 ACME_ROOT 静态读取。
|
||
# GENARRATIVE_PINGORA_GATEWAY_HTTP_REDIRECT_LISTEN=0.0.0.0:18080
|
||
# GENARRATIVE_PINGORA_GATEWAY_HTTP_REDIRECT_TARGET_SCHEME=https
|
||
GENARRATIVE_PINGORA_GATEWAY_API_UPSTREAM=127.0.0.1:8082
|
||
GENARRATIVE_PINGORA_GATEWAY_SPACETIME_UPSTREAM=127.0.0.1:3101
|
||
|
||
GENARRATIVE_PINGORA_GATEWAY_WEB_ROOT=/srv/genarrative/web
|
||
GENARRATIVE_PINGORA_GATEWAY_ACME_ROOT=/var/www/html
|
||
GENARRATIVE_PINGORA_GATEWAY_MAINTENANCE_FILE=/var/lib/genarrative/maintenance/enabled
|
||
|
||
GENARRATIVE_PINGORA_GATEWAY_FORWARDED_PROTO=http
|
||
GENARRATIVE_PINGORA_GATEWAY_MAX_API_BODY_BYTES=67108864
|
||
# gzip 默认开启；等级和最小响应长度对齐 Nginx gzip_comp_level 5 / gzip_min_length 1024。
|
||
# Pingora 正式化口径固定为 gzip-only；br / zstd 不进入当前网关，Brotli 继续由 Nginx / 前置代理承担。
|
||
GENARRATIVE_PINGORA_GATEWAY_COMPRESSION_ALGORITHMS=gzip
|
||
GENARRATIVE_PINGORA_GATEWAY_GZIP_ENABLED=true
|
||
GENARRATIVE_PINGORA_GATEWAY_GZIP_LEVEL=5
|
||
GENARRATIVE_PINGORA_GATEWAY_GZIP_MIN_LENGTH_BYTES=1024
|
||
|
||
# 静态响应缓存头：HTML / SPA fallback 保持 no-cache，Vite 指纹资源长缓存，其它静态资源保守 no-cache。
|
||
# 网关会额外写入 ETag / Last-Modified 并支持 304 协商缓存；下面三项只控制 Cache-Control。
|
||
GENARRATIVE_PINGORA_GATEWAY_HTML_CACHE_CONTROL=no-cache
|
||
GENARRATIVE_PINGORA_GATEWAY_ASSET_CACHE_CONTROL=public, max-age=31536000, immutable
|
||
GENARRATIVE_PINGORA_GATEWAY_STATIC_CACHE_CONTROL=no-cache
|
||
|
||
# 上游超时默认对齐当前 Nginx 模板：普通无显式长超时路由 60 秒，/api、公开列表/详情和 subscribe 为 3600 秒。
|
||
GENARRATIVE_PINGORA_GATEWAY_UPSTREAM_CONNECT_TIMEOUT_MS=3000
|
||
GENARRATIVE_PINGORA_GATEWAY_UPSTREAM_DEFAULT_READ_TIMEOUT_SECONDS=60
|
||
GENARRATIVE_PINGORA_GATEWAY_UPSTREAM_API_READ_TIMEOUT_SECONDS=3600
|
||
GENARRATIVE_PINGORA_GATEWAY_UPSTREAM_LONG_READ_TIMEOUT_SECONDS=3600
|
||
GENARRATIVE_PINGORA_GATEWAY_UPSTREAM_WRITE_TIMEOUT_SECONDS=3600
|
||
|
||
# 默认只信任 TCP 对端 IP；只有确认前置 Nginx / LB 会清洗 X-Forwarded-For 后才打开。
|
||
GENARRATIVE_PINGORA_GATEWAY_TRUST_X_FORWARDED_FOR=false
|
||
# 打开 TRUST_X_FORWARDED_FOR 前必须显式确认；否则网关会拒绝启动。
|
||
GENARRATIVE_PINGORA_GATEWAY_TRUSTED_FRONT_PROXY_CONFIRMED=false
|
||
|
||
# 单进程内接流保护；默认值对齐当前 Nginx limit_conn / limit_req 口径。
|
||
# INSTANCE_COUNT 默认 1；若横向运行多个 Pingora 实例且仍启用网关接流保护，必须先落地共享保护层并显式确认。
|
||
GENARRATIVE_PINGORA_GATEWAY_INSTANCE_COUNT=1
|
||
GENARRATIVE_PINGORA_GATEWAY_SHARED_PROTECTION_CONFIRMED=false
|
||
GENARRATIVE_PINGORA_GATEWAY_PROTECTION_ENABLED=true
|
||
GENARRATIVE_PINGORA_GATEWAY_ADMIN_API_MAX_CONCURRENT=64
|
||
GENARRATIVE_PINGORA_GATEWAY_ADMIN_API_RATE_PER_SECOND=30
|
||
GENARRATIVE_PINGORA_GATEWAY_ADMIN_API_BURST=16
|
||
GENARRATIVE_PINGORA_GATEWAY_GALLERY_LIST_MAX_CONCURRENT=320
|
||
GENARRATIVE_PINGORA_GATEWAY_GALLERY_LIST_RATE_PER_SECOND=5000
|
||
GENARRATIVE_PINGORA_GATEWAY_GALLERY_LIST_BURST=4096
|
||
GENARRATIVE_PINGORA_GATEWAY_GALLERY_DETAIL_MAX_CONCURRENT=32
|
||
GENARRATIVE_PINGORA_GATEWAY_GALLERY_DETAIL_RATE_PER_SECOND=300
|
||
GENARRATIVE_PINGORA_GATEWAY_GALLERY_DETAIL_BURST=32
|
||
GENARRATIVE_PINGORA_GATEWAY_API_MAX_CONCURRENT=64
|
||
GENARRATIVE_PINGORA_GATEWAY_API_RATE_PER_SECOND=300
|
||
GENARRATIVE_PINGORA_GATEWAY_API_BURST=64
|
||
GENARRATIVE_PINGORA_GATEWAY_SPACETIME_MAX_CONCURRENT=256
|
||
GENARRATIVE_PINGORA_GATEWAY_SPACETIME_RATE_PER_SECOND=1000
|
||
GENARRATIVE_PINGORA_GATEWAY_SPACETIME_BURST=256
|
||
# 仅供本机影子探针使用；为空时 /__genarrative_pingora/healthz 一律返回 404。
|
||
GENARRATIVE_PINGORA_GATEWAY_PROBE_TOKEN=
|
||
|
||
GENARRATIVE_PINGORA_GATEWAY_LOG=info,pingora=info,pingora_gateway=info
|
||
GENARRATIVE_PINGORA_GATEWAY_ACCESS_LOG_FILE=/var/log/genarrative/pingora-gateway.access.log
|
||
GENARRATIVE_PINGORA_GATEWAY_OTEL_ENABLED=false
|