wangxuming/NianAIGC
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: route authenticated SSR through Go

Browse Source
This commit is contained in:
brother7
2026-08-16 17:53:45 +08:00
parent b26f9679ab
commit 498c2fa242
6 changed files with 445 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
scripts/check-ack-manifests.mjs
View File

@@ -20,6 +20,9 @@ assert(!migrationJob.includes("DATABASE_CA_CERT_PATH"), "migration Job must keep
const web = read("web.yaml");
assert(/^\s*replicas: 1\s*$/m.test(web), "Web must default to one replica until object storage is shared");
assert(web.includes("path: /api/health"), "Web must use process-level readiness (it is database-free in production)");
assert(web.includes("name: zhinian-runtime"), "Web must consume the Web runtime ConfigMap");
assert(!web.includes("ZHINIAN_DATA_BACKEND"), "Web must not select a database backend in production");
assert(!web.includes("DATABASE_URL"), "Web must not receive DATABASE_URL in production");
assert(!web.includes("zhinian-web-db"), "Web must not hold RDS credentials in production");
assert(!web.includes("rds-ca"), "Web must not mount the RDS CA in production");
@@ -34,6 +37,14 @@ assert(!goApi.includes("DATABASE_SSL_MODE"), "Go API must keep database TLS insi
assert(!goApi.includes("DATABASE_CA_CERT_PATH"), "Go API must keep database TLS inside DATABASE_URL");
const configMap = read("configmap.yaml");
const webRuntime = configMap.split("\n---\n", 1)[0];
const expectedInternalBaseUrl = "http://zhinian-go-api:8080";
const internalBaseUrl = webRuntime.match(/^\s*ZHINIAN_GO_INTERNAL_BASE_URL:\s*(\S+)\s*$/m)?.[1];
assert(internalBaseUrl, "Web runtime ConfigMap must define ZHINIAN_GO_INTERNAL_BASE_URL");
assert(internalBaseUrl === expectedInternalBaseUrl, "Web runtime ConfigMap must use the cluster-internal Go API URL");
assert(!webRuntime.includes("ZHINIAN_DATA_BACKEND"), "Web runtime ConfigMap must not select a database backend");
assert(!webRuntime.includes("DATABASE_URL"), "Web runtime ConfigMap must not carry DATABASE_URL");
assert(!webRuntime.includes("rds-ca"), "Web runtime ConfigMap must not carry the RDS CA");
assert(configMap.includes("ZHINIAN_GO_EMBEDDED_WORKER: \"true\""), "Go runtime ConfigMap must embed the WorkerLoop");
assert(configMap.includes("GO_BACKEND_HOST: 0.0.0.0"), "Go runtime ConfigMap must listen on the Pod interface");
assert(!configMap.includes("DATABASE_SSL_MODE"), "ConfigMaps must not carry database TLS settings");
@@ -50,6 +61,16 @@ assert(ingress.includes("name: zhinian-web"), "Ingress must route pages/static p
const service = read("service.yaml");
assert(service.includes("name: zhinian-public-deny"), "selectorless deny Service is required");
const goService = goApi.match(
/kind: Service\s+metadata:\s+name:\s+(\S+)[\s\S]*?ports:\s+- name: http\s+port:\s+(\d+)\s+targetPort:\s+(\d+)/,
);
assert(goService, "Go API Service must declare an HTTP name, port, and targetPort");
const [, serviceName, servicePort, targetPort] = goService;
const parsedInternalBaseUrl = new URL(internalBaseUrl);
assert(parsedInternalBaseUrl.hostname === serviceName, "Web internal Go URL must use the Go API Service name");
assert(parsedInternalBaseUrl.port === servicePort, "Web internal Go URL must use the Go API Service port");
assert(targetPort === servicePort, "Go API Service targetPort must match its port");
console.log(`ACK manifest assertions passed (${files.length} files)`);
function read(file) {