增加支付逻辑

deploy/ack/secrets.example.yaml

@@ -8,7 +8,9 @@ metadata:
   namespace: zhinian
 type: Opaque
 stringData:
-  # Manual schema execution only. This connection intentionally uses plaintext.
+  # Startup migration connection, also usable for manual migrations. This
+  # account needs schema ownership/DDL and grant permissions. Plaintext RDS
+  # transport is limited to the private VPC by this deployment's DB policy.
   DATABASE_URL: "postgresql://MIGRATION_USER:MIGRATION_PASSWORD@RDS_INTERNAL_HOST:5432/APP_DATABASE?sslmode=disable"
 ---
 apiVersion: v1
@@ -46,7 +48,9 @@ metadata:
   namespace: zhinian
 type: Opaque
 stringData:
-  # Application role (least privilege). PostgreSQL transport is plaintext.
+  # Least-privilege application role. Set DATABASE_APP_ROLE in configmap.yaml
+  # to this connection's PostgreSQL user (APP_USER) so migrations grant it
+  # access to new tables/functions. PostgreSQL transport is plaintext.
   DATABASE_URL: "postgresql://APP_USER:APP_PASSWORD@RDS_INTERNAL_HOST:5432/APP_DATABASE?sslmode=disable"
 ---
 apiVersion: v1
@@ -60,3 +64,21 @@ stringData:
   # administrator exists. Password must be at least 8 characters.
   ZHINIAN_BOOTSTRAP_ADMIN_PHONE: REPLACE_WITH_ADMIN_PHONE
   ZHINIAN_BOOTSTRAP_ADMIN_PASSWORD: REPLACE_WITH_STRONG_PASSWORD
+---
+# Optional. Apply only when enabling WeChat Native payments; Go-only envFrom.
+apiVersion: v1
+kind: Secret
+metadata:
+  name: zhinian-go-wechat-pay
+  namespace: zhinian
+type: Opaque
+stringData:
+  WECHAT_PAY_MCH_ID: REPLACE_WITH_MERCHANT_ID
+  WECHAT_PAY_APP_ID: REPLACE_WITH_BOUND_APP_ID
+  WECHAT_PAY_MERCHANT_SERIAL: REPLACE_WITH_MERCHANT_CERT_SERIAL
+  WECHAT_PAY_API_V3_KEY: REPLACE_WITH_32_BYTE_API_V3_KEY
+  WECHAT_PAY_PUBLIC_KEY_ID: REPLACE_WITH_WECHAT_PUBLIC_KEY_ID
+  WECHAT_PAY_PRIVATE_KEY_PEM: |
+    REPLACE_WITH_PKCS8_MERCHANT_PRIVATE_KEY_PEM
+  WECHAT_PAY_PUBLIC_KEY_PEM: |
+    REPLACE_WITH_WECHAT_PAYMENT_PUBLIC_KEY_PEM