增加支付逻辑

deploy/ack/configmap.yaml

@@ -10,6 +10,11 @@ data:
   GO_BACKEND_HOST: 0.0.0.0
   GO_BACKEND_PORT: "8080"
   ZHINIAN_DATA_BACKEND: postgres
+  # Run the checked-in Go migration bundle before the API starts listening.
+  DATABASE_AUTO_MIGRATE: "true"
+  DATABASE_MIGRATION_TIMEOUT_SECONDS: "180"
+  # PostgreSQL role named by zhinian-go-db's APP_USER; replace before deploy.
+  DATABASE_APP_ROLE: REPLACE_WITH_APP_DB_ROLE
   ZHINIAN_AUTH_REQUIRED: "true"
   ZHINIAN_AUTH_COOKIE_SECURE: "true"
   ZHINIAN_PUBLIC_BASE_URL: https://REPLACE_WITH_PUBLIC_HOST
@@ -17,3 +22,8 @@ data:
   ZHINIAN_RUNTIME_DIR: /var/lib/zhinian/runtime
   ZHINIAN_LOG_DIR: /var/lib/zhinian/logs
   ZHINIAN_SETTINGS_FILE: /var/lib/zhinian/settings.env
+  WECHAT_PAY_ENABLED: "false"
+  WECHAT_PAY_NOTIFY_URL: https://REPLACE_WITH_PUBLIC_HOST/api/payments/wechat/notify
+  WECHAT_PAY_MIN_AMOUNT_FEN: "100"
+  WECHAT_PAY_MAX_AMOUNT_FEN: "1000000"
+  WECHAT_PAY_PRESET_AMOUNTS_FEN: "10000,50000,100000"

deploy/ack/go-api.yaml

@@ -42,12 +42,22 @@ spec:
             - secretRef:
                 name: zhinian-go-providers
                 optional: true
+            - secretRef:
+                name: zhinian-go-wechat-pay
+                optional: true
           env:
             - name: DATABASE_URL
               valueFrom:
                 secretKeyRef:
                   name: zhinian-go-db
                   key: DATABASE_URL
+            # Migration credentials stay separate from the least-privilege
+            # application DATABASE_URL above. Never inject this Secret via envFrom.
+            - name: DATABASE_MIGRATION_URL
+              valueFrom:
+                secretKeyRef:
+                  name: zhinian-migration-db
+                  key: DATABASE_URL
             # Go alone creates and verifies the browser session cookie. The
             # static Web workload must never receive this signing secret.
             - name: ZHINIAN_AUTH_SESSION_SECRET
@@ -75,7 +85,8 @@ spec:
               path: /api/health
               port: http
             periodSeconds: 5
-            failureThreshold: 24
+            # 180s migration deadline plus DB/bootstrap and startup headroom.
+            failureThreshold: 60
           readinessProbe:
             httpGet:
               path: /api/ready

deploy/ack/secrets.example.yaml

@@ -8,7 +8,9 @@ metadata:
   namespace: zhinian
 type: Opaque
 stringData:
-  # Manual schema execution only. This connection intentionally uses plaintext.
+  # Startup migration connection, also usable for manual migrations. This
+  # account needs schema ownership/DDL and grant permissions. Plaintext RDS
+  # transport is limited to the private VPC by this deployment's DB policy.
   DATABASE_URL: "postgresql://MIGRATION_USER:MIGRATION_PASSWORD@RDS_INTERNAL_HOST:5432/APP_DATABASE?sslmode=disable"
 ---
 apiVersion: v1
@@ -46,7 +48,9 @@ metadata:
   namespace: zhinian
 type: Opaque
 stringData:
-  # Application role (least privilege). PostgreSQL transport is plaintext.
+  # Least-privilege application role. Set DATABASE_APP_ROLE in configmap.yaml
+  # to this connection's PostgreSQL user (APP_USER) so migrations grant it
+  # access to new tables/functions. PostgreSQL transport is plaintext.
   DATABASE_URL: "postgresql://APP_USER:APP_PASSWORD@RDS_INTERNAL_HOST:5432/APP_DATABASE?sslmode=disable"
 ---
 apiVersion: v1
@@ -60,3 +64,21 @@ stringData:
   # administrator exists. Password must be at least 8 characters.
   ZHINIAN_BOOTSTRAP_ADMIN_PHONE: REPLACE_WITH_ADMIN_PHONE
   ZHINIAN_BOOTSTRAP_ADMIN_PASSWORD: REPLACE_WITH_STRONG_PASSWORD
+---
+# Optional. Apply only when enabling WeChat Native payments; Go-only envFrom.
+apiVersion: v1
+kind: Secret
+metadata:
+  name: zhinian-go-wechat-pay
+  namespace: zhinian
+type: Opaque
+stringData:
+  WECHAT_PAY_MCH_ID: REPLACE_WITH_MERCHANT_ID
+  WECHAT_PAY_APP_ID: REPLACE_WITH_BOUND_APP_ID
+  WECHAT_PAY_MERCHANT_SERIAL: REPLACE_WITH_MERCHANT_CERT_SERIAL
+  WECHAT_PAY_API_V3_KEY: REPLACE_WITH_32_BYTE_API_V3_KEY
+  WECHAT_PAY_PUBLIC_KEY_ID: REPLACE_WITH_WECHAT_PUBLIC_KEY_ID
+  WECHAT_PAY_PRIVATE_KEY_PEM: |
+    REPLACE_WITH_PKCS8_MERCHANT_PRIVATE_KEY_PEM
+  WECHAT_PAY_PUBLIC_KEY_PEM: |
+    REPLACE_WITH_WECHAT_PAYMENT_PUBLIC_KEY_PEM