production runtime and mock removal

deploy/ack/configmap.yaml

@@ -1,5 +1,5 @@
-# Go API runtime settings. Provider endpoints/models use code defaults unless
-# optional provider/OSS credentials are added to the Deployment.
+# Go API runtime settings. Provider endpoints/models use code defaults; real
+# provider credentials are injected into the Go workload through Secret.
 apiVersion: v1
 kind: ConfigMap
 metadata:

deploy/ack/go-api.yaml

@@ -39,6 +39,8 @@ spec:
           envFrom:
             - configMapRef:
                 name: zhinian-go-runtime
+            - secretRef:
+                name: zhinian-go-providers
           env:
             - name: DATABASE_URL
               valueFrom:

deploy/ack/secrets.example.yaml

@@ -1,6 +1,6 @@
 # Example only. Replace every placeholder and keep the populated file out of Git.
-# Provider, OSS, public API, and webhook secrets are optional add-ons and are
-# intentionally not injected by the minimal production Deployment.
+# Provider credentials are required by the production Go API. OSS, public API,
+# and webhook secrets can be added to the same Secret or injected separately.
 apiVersion: v1
 kind: Secret
 metadata:
@@ -24,6 +24,21 @@ stringData:
 ---
 apiVersion: v1
 kind: Secret
+metadata:
+  name: zhinian-go-providers
+  namespace: zhinian
+type: Opaque
+stringData:
+  # The Go API refuses to start in PostgreSQL production mode when any of the
+  # four selectable real providers is missing its credentials.
+  VOLCENGINE_ACCESS_KEY_ID: REPLACE_WITH_VOLCENGINE_ACCESS_KEY_ID
+  VOLCENGINE_SECRET_ACCESS_KEY: REPLACE_WITH_VOLCENGINE_SECRET_ACCESS_KEY
+  EVOLINK_API_KEY: REPLACE_WITH_EVOLINK_API_KEY
+  BAILIAN_API_KEY: REPLACE_WITH_BAILIAN_API_KEY
+  SEEDANCE_API_KEY: REPLACE_WITH_SEEDANCE_API_KEY
+---
+apiVersion: v1
+kind: Secret
 metadata:
   name: zhinian-go-db
   namespace: zhinian

deploy/nginx-compose.conf

@@ -0,0 +1,61 @@
+worker_processes auto;
+pid /tmp/nginx.pid;
+
+events {
+  worker_connections 1024;
+}
+
+http {
+  include /etc/nginx/mime.types;
+  default_type application/octet-stream;
+  access_log /dev/stdout;
+  error_log /dev/stderr warn;
+  sendfile on;
+  server_tokens off;
+
+  client_body_temp_path /tmp/client_temp;
+  proxy_temp_path /tmp/proxy_temp;
+  fastcgi_temp_path /tmp/fastcgi_temp;
+  uwsgi_temp_path /tmp/uwsgi_temp;
+  scgi_temp_path /tmp/scgi_temp;
+
+  upstream zhinian_go_api {
+    server zhinian-go-api:8080;
+  }
+
+  server {
+    listen 3000;
+    root /usr/share/nginx/html;
+    client_max_body_size 100m;
+
+    location = /healthz {
+      access_log off;
+      default_type text/plain;
+      return 200 "ok\n";
+    }
+
+    location ~ ^/(api|uploads|generated-results)(?:/|$) {
+      proxy_pass http://zhinian_go_api;
+      proxy_http_version 1.1;
+      proxy_set_header Host $host;
+      proxy_set_header X-Real-IP $remote_addr;
+      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+      proxy_set_header X-Forwarded-Proto $scheme;
+      proxy_read_timeout 120s;
+      proxy_send_timeout 120s;
+    }
+
+    location /_next/static/ {
+      expires 1y;
+      add_header Cache-Control "public, max-age=31536000, immutable";
+      try_files $uri =404;
+    }
+
+    location / {
+      add_header Cache-Control "no-cache, no-store, must-revalidate" always;
+      add_header Pragma "no-cache" always;
+      add_header Expires "0" always;
+      try_files $uri $uri.html $uri/ /index.html;
+    }
+  }
+}