simplify production database configuration

deploy/ack/configmap.yaml

@@ -6,19 +6,11 @@ metadata:
 data:
   NODE_ENV: production
   PORT: "3000"
-  ZHINIAN_DATA_BACKEND: postgres
-  ZHINIAN_AUTH_REQUIRED: auto
-  ZHINIAN_WORKER_BASE_URL: http://zhinian-web:3000
-  DATABASE_SSL_MODE: verify-full
-  DATABASE_CA_CERT_PATH: /etc/zhinian/rds/ca.pem
-  DATABASE_POOL_MAX: "10"
-  DATABASE_CONNECTION_TIMEOUT_MS: "5000"
-  DATABASE_IDLE_TIMEOUT_MS: "30000"
-  DATABASE_STATEMENT_TIMEOUT_MS: "30000"
-  DATABASE_APPLICATION_NAME: zhinian-web
+  ZHINIAN_AUTH_REQUIRED: "1"
+  ZHINIAN_PUBLIC_BASE_URL: https://REPLACE_WITH_PUBLIC_HOST
 ---
 # Go API runtime settings. Provider endpoints/models use code defaults unless
-# overridden here; credentials always come from zhinian-go-providers.
+# optional provider/OSS credentials are added to the Deployment.
 apiVersion: v1
 kind: ConfigMap
 metadata:
@@ -26,21 +18,13 @@ metadata:
   namespace: zhinian
 data:
   NODE_ENV: production
+  GO_BACKEND_HOST: 0.0.0.0
   GO_BACKEND_PORT: "8080"
   ZHINIAN_DATA_BACKEND: postgres
   ZHINIAN_AUTH_REQUIRED: "true"
   ZHINIAN_AUTH_COOKIE_SECURE: "true"
   ZHINIAN_PUBLIC_BASE_URL: https://REPLACE_WITH_PUBLIC_HOST
-  DATABASE_SSL_MODE: verify-full
-  DATABASE_CA_CERT_PATH: /etc/zhinian/rds/ca.pem
-  DATABASE_POOL_MAX: "10"
-  DATABASE_CONNECTION_TIMEOUT_MS: "5000"
-  DATABASE_IDLE_TIMEOUT_MS: "30000"
-  DATABASE_STATEMENT_TIMEOUT_MS: "30000"
-  DATABASE_APPLICATION_NAME: zhinian-go-api
   ZHINIAN_GO_EMBEDDED_WORKER: "true"
-  ZHINIAN_WORKER_ID: zhinian-go-api-embedded
-  ZHINIAN_BILLING_REQUIRED: "1"
   ZHINIAN_RUNTIME_DIR: /var/lib/zhinian/runtime
   ZHINIAN_LOG_DIR: /var/lib/zhinian/logs
   ZHINIAN_SETTINGS_FILE: /var/lib/zhinian/settings.env

deploy/ack/go-api.yaml

@@ -62,83 +62,6 @@ spec:
                 secretKeyRef:
                   name: zhinian-go-bootstrap
                   key: ZHINIAN_BOOTSTRAP_ADMIN_PASSWORD
-            - name: ZHINIAN_BOOTSTRAP_ADMIN_NAME
-              valueFrom:
-                secretKeyRef:
-                  name: zhinian-go-bootstrap
-                  key: ZHINIAN_BOOTSTRAP_ADMIN_NAME
-                  optional: true
-            - name: VOLCENGINE_ACCESS_KEY_ID
-              valueFrom:
-                secretKeyRef:
-                  name: zhinian-go-providers
-                  key: VOLCENGINE_ACCESS_KEY_ID
-                  optional: true
-            - name: VOLCENGINE_SECRET_ACCESS_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: zhinian-go-providers
-                  key: VOLCENGINE_SECRET_ACCESS_KEY
-                  optional: true
-            - name: JIMENG_IMAGE_GENERATE_46_REQ_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: zhinian-go-providers
-                  key: JIMENG_IMAGE_GENERATE_46_REQ_KEY
-                  optional: true
-            - name: EVOLINK_API_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: zhinian-go-providers
-                  key: EVOLINK_API_KEY
-                  optional: true
-            - name: SEEDANCE_API_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: zhinian-go-providers
-                  key: SEEDANCE_API_KEY
-                  optional: true
-            - name: BAILIAN_API_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: zhinian-go-providers
-                  key: BAILIAN_API_KEY
-                  optional: true
-            - name: DASHSCOPE_API_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: zhinian-go-providers
-                  key: DASHSCOPE_API_KEY
-                  optional: true
-            - name: ALI_OSS_ACCESS_KEY_ID
-              valueFrom:
-                secretKeyRef:
-                  name: zhinian-go-providers
-                  key: ALI_OSS_ACCESS_KEY_ID
-                  optional: true
-            - name: ALI_OSS_ACCESS_KEY_SECRET
-              valueFrom:
-                secretKeyRef:
-                  name: zhinian-go-providers
-                  key: ALI_OSS_ACCESS_KEY_SECRET
-                  optional: true
-            - name: ZHINIAN_WEBHOOK_SECRET
-              valueFrom:
-                secretKeyRef:
-                  name: zhinian-go-secrets
-                  key: ZHINIAN_WEBHOOK_SECRET
-            - name: ZHINIAN_API_KEYS
-              valueFrom:
-                secretKeyRef:
-                  name: zhinian-go-secrets
-                  key: ZHINIAN_API_KEYS
-                  optional: true
-            - name: ZHINIAN_INTERNAL_WORKER_TOKEN
-              valueFrom:
-                secretKeyRef:
-                  name: zhinian-go-secrets
-                  key: ZHINIAN_INTERNAL_WORKER_TOKEN
-                  optional: true
           volumeMounts:
             - name: rds-ca
               mountPath: /etc/zhinian/rds

deploy/ack/migration-job.yaml

@@ -31,7 +31,7 @@ spec:
               value: production
             - name: ZHINIAN_DATA_BACKEND
               value: postgres
-            # Must match the username in zhinian-web-db/DATABASE_URL.
+            # Must match the username in zhinian-go-db/DATABASE_URL.
             - name: DATABASE_APP_ROLE
               value: REPLACE_WITH_RDS_APP_ROLE
             - name: DATABASE_URL
@@ -39,14 +39,6 @@ spec:
                 secretKeyRef:
                   name: zhinian-migration-db
                   key: DATABASE_URL
-            - name: DATABASE_SSL_MODE
-              value: verify-full
-            - name: DATABASE_CA_CERT_PATH
-              value: /etc/zhinian/rds/ca.pem
-            - name: DATABASE_CONNECTION_TIMEOUT_MS
-              value: "5000"
-            - name: DATABASE_STATEMENT_TIMEOUT_MS
-              value: "60000"
           volumeMounts:
             - name: rds-ca
               mountPath: /etc/zhinian/rds

deploy/ack/secrets.example.yaml

@@ -1,15 +1,16 @@
 # Example only. Replace every placeholder and keep the populated file out of Git.
-# Secrets marked "(local development only)" are not referenced by the first
-# production deployment; keep or drop them as your local workflow requires.
+# Provider, OSS, public API, and webhook secrets are optional add-ons and are
+# intentionally not injected by the minimal production Deployment.
 apiVersion: v1
 kind: Secret
 metadata:
-  name: zhinian-web-db
+  name: zhinian-rds-ca
   namespace: zhinian
 type: Opaque
 stringData:
-  # Local development only: the production Web workload holds no RDS credentials.
-  DATABASE_URL: postgresql://APP_USER:APP_PASSWORD@RDS_INTERNAL_HOST:5432/APP_DATABASE
+  # Public CA certificate for the RDS endpoint used in DATABASE_URL.
+  ca.pem: |
+    REPLACE_WITH_RDS_CA_PEM
 ---
 apiVersion: v1
 kind: Secret
@@ -19,17 +20,7 @@ metadata:
 type: Opaque
 stringData:
   # Manual schema execution only: run database/migrations/*.sql with this role.
-  DATABASE_URL: postgresql://MIGRATION_USER:MIGRATION_PASSWORD@RDS_INTERNAL_HOST:5432/APP_DATABASE
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: zhinian-worker-auth
-  namespace: zhinian
-type: Opaque
-stringData:
-  # Local development only: the Node Worker is not deployed in production.
-  ZHINIAN_INTERNAL_WORKER_TOKEN: REPLACE_WITH_A_LONG_RANDOM_VALUE
+  DATABASE_URL: "postgresql://MIGRATION_USER:MIGRATION_PASSWORD@RDS_INTERNAL_HOST:5432/APP_DATABASE?sslmode=verify-full&sslrootcert=/etc/zhinian/rds/ca.pem"
 ---
 apiVersion: v1
 kind: Secret
@@ -50,7 +41,7 @@ metadata:
 type: Opaque
 stringData:
   # Application role (least privilege): grants applied manually after the SQL.
-  DATABASE_URL: postgresql://APP_USER:APP_PASSWORD@RDS_INTERNAL_HOST:5432/APP_DATABASE
+  DATABASE_URL: "postgresql://APP_USER:APP_PASSWORD@RDS_INTERNAL_HOST:5432/APP_DATABASE?sslmode=verify-full&sslrootcert=/etc/zhinian/rds/ca.pem"
 ---
 apiVersion: v1
 kind: Secret
@@ -63,35 +54,3 @@ stringData:
   # administrator exists. Password must be at least 8 characters.
   ZHINIAN_BOOTSTRAP_ADMIN_PHONE: REPLACE_WITH_ADMIN_PHONE
   ZHINIAN_BOOTSTRAP_ADMIN_PASSWORD: REPLACE_WITH_STRONG_PASSWORD
-  ZHINIAN_BOOTSTRAP_ADMIN_NAME: 平台超级管理员
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: zhinian-go-providers
-  namespace: zhinian
-type: Opaque
-stringData:
-  # Provider credentials. Delete keys for providers you do not use; the Go
-  # workload tolerates missing optional keys and fails closed when an enabled
-  # engine has no credentials.
-  VOLCENGINE_ACCESS_KEY_ID: REPLACE_OR_REMOVE
-  VOLCENGINE_SECRET_ACCESS_KEY: REPLACE_OR_REMOVE
-  JIMENG_IMAGE_GENERATE_46_REQ_KEY: REPLACE_OR_REMOVE
-  EVOLINK_API_KEY: REPLACE_OR_REMOVE
-  SEEDANCE_API_KEY: REPLACE_OR_REMOVE
-  BAILIAN_API_KEY: REPLACE_OR_REMOVE
-  DASHSCOPE_API_KEY: REPLACE_OR_REMOVE
-  ALI_OSS_ACCESS_KEY_ID: REPLACE_OR_REMOVE
-  ALI_OSS_ACCESS_KEY_SECRET: REPLACE_OR_REMOVE
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: zhinian-go-secrets
-  namespace: zhinian
-type: Opaque
-stringData:
-  ZHINIAN_WEBHOOK_SECRET: REPLACE_WITH_A_LONG_RANDOM_VALUE
-  ZHINIAN_API_KEYS: REPLACE_WITH_PUBLIC_API_KEYS
-  ZHINIAN_INTERNAL_WORKER_TOKEN: REPLACE_OR_REMOVE