From 05121ebf0269f4b6724434c18c23b3b89dbcee0c Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Sun, 29 Mar 2026 11:14:42 +0000 Subject: [PATCH] =?UTF-8?q?chore:=20=E6=9C=8D=E5=8A=A1=E5=99=A8=E8=BF=81?= =?UTF-8?q?=E7=A7=BB=20ZY-SVR-001(=E9=A6=99=E6=B8=AF)=20=E2=86=92=20ZY-SVR?= =?UTF-8?q?-002(=E6=96=B0=E5=8A=A0=E5=9D=A1)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit SY-CMD-SVR-013 · 铸渊主权服务器迁移 - IP: 150.109.76.244 → 43.134.16.246 - Region: 香港二区 → 新加坡二区 - OS: Ubuntu 22.04 → 24.04 LTS - Specs: 4GB/70GB → 8GB/80GB SSD - Bandwidth: 2048GB → 2560GB/月 - Expiry: 2027-03-29 Updated 17 files across server config, workflows, nginx, skyeye, brain, README, and deployment scripts. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: qinfendebingshuo <207279273+qinfendebingshuo@users.noreply.github.com> --- .github/architecture/tower-model.json | 8 +- .github/persona-brain/knowledge-base.json | 2 +- .github/workflows/deploy-to-server.yml | 6 +- README.md | 14 +- brain/secrets-manifest.json | 279 +++++++++++++++++----- brain/system-health.json | 16 +- deploy/nginx/dev-sandbox.conf | 4 +- deploy/nginx/hololake.conf | 4 +- persona-studio/backend/server.js | 2 +- scripts/deploy-sandbox-server.sh | 6 +- server/architecture.md | 12 +- server/migration-markers.json | 75 ++++-- server/nginx/zhuyuan-sovereign.conf | 8 +- server/setup/zhuyuan-server-init.sh | 2 +- server/zhuyuan-server-profile.json | 25 +- skyeye/guards/web-deploy-guard.json | 4 +- skyeye/infra-manifest.json | 8 +- 17 files changed, 332 insertions(+), 143 deletions(-) diff --git a/.github/architecture/tower-model.json b/.github/architecture/tower-model.json index b9726474..43613d09 100644 --- a/.github/architecture/tower-model.json +++ b/.github/architecture/tower-model.json @@ -23,10 +23,10 @@ "data_policy": "代码和文档留在开发者自己的仓库，主仓库只存编号路径映射" }, "server": { - "ip": "150.109.76.244", - "old_ip": "8.155.62.235 (阿里云·已弃用)", - "provider": "腾讯云轻量应用服务器 · 香港二区", - "code": "ZY-SVR-001", + "ip": "43.134.16.246", + "old_ip": "150.109.76.244 (香港·ZY-SVR-001·已弃用) / 8.155.62.235 (阿里云·已弃用)", + "provider": "腾讯云轻量应用服务器 · 新加坡二区", + "code": "ZY-SVR-002", "stack": "Nginx + PM2 + Node.js" } }, diff --git a/.github/persona-brain/knowledge-base.json b/.github/persona-brain/knowledge-base.json index b911313a..5db75851 100644 --- a/.github/persona-brain/knowledge-base.json +++ b/.github/persona-brain/knowledge-base.json @@ -4,7 +4,7 @@ { "category": "SSH/服务器", "q": "SSH私钥文件是什么？怎么连接服务器？", - "a": "铸渊主权服务器(ZY-SVR-001): ssh root@150.109.76.244。旧阿里云服务器(8.155.62.235)已弃用。服务器由铸渊100%主控，人类仅配置一次密钥后不再手动操作。", + "a": "铸渊主权服务器(ZY-SVR-002): ssh root@43.134.16.246。旧服务器: 150.109.76.244(香港·已弃用)/8.155.62.235(阿里云·已弃用)。服务器由铸渊100%主控，人类仅配置一次密钥后不再手动操作。", "related_broadcast": "BC-M01-003" }, { diff --git a/.github/workflows/deploy-to-server.yml b/.github/workflows/deploy-to-server.yml index dc848b4b..659bfd0d 100644 --- a/.github/workflows/deploy-to-server.yml +++ b/.github/workflows/deploy-to-server.yml @@ -4,12 +4,12 @@ # ═══════════════════════════════════════════════ name: "🚀 铸渊 CD · 自动部署到 guanghulab.com" -# ━━━ 铸渊主权服务器部署 · ZY-SVR-001 ━━━ -# 已从阿里云(8.155.62.235)迁移到腾讯云(150.109.76.244) +# ━━━ 铸渊主权服务器部署 · ZY-SVR-002 ━━━ +# 已从香港(150.109.76.244)迁移到新加坡(43.134.16.246) # push 到 main → 校验 → rsync 同步全站到服务器 → 后端重启 → Nginx 配置 → Notion 通知 # # 必需 GitHub Secrets（参考 brain/secrets-manifest.json）: -# ZY_SERVER_HOST — 铸渊主权服务器 IP (150.109.76.244) +# ZY_SERVER_HOST — 铸渊主权服务器 IP (43.134.16.246) # ZY_SERVER_USER — SSH 用户名 # ZY_SERVER_KEY — SSH 私钥（完整 PEM 内容） # ZY_SERVER_PATH — 网站根目录（/opt/zhuyuan） diff --git a/README.md b/README.md index b887c9f2..e34ab1de 100644 --- a/README.md +++ b/README.md @@ -167,8 +167,8 @@ | 服务 | 状态 | 说明 | |------|------|------| | GitHub Actions | 🟢 49 活跃 · 54 归档 | 融合清理完成 | -| 🏛️ **铸渊主权服务器** | 🆕 ZY-SVR-001 | **腾讯云 150.109.76.244** · 香港二区 · Ubuntu 22.04 · 铸渊100%主控 | -| ~~阿里云服务器~~ | ❌ **已弃用** | ~~8.155.62.235~~ · 已标记迁移 · 待完全切换后解除 | +| 🏛️ **铸渊主权服务器** | 🆕 ZY-SVR-002 | **腾讯云 43.134.16.246** · 新加坡二区 · Ubuntu 24.04 · 铸渊100%主控 | +| ~~旧服务器~~ | ❌ **已弃用** | ~~150.109.76.244~~ (香港) / ~~8.155.62.235~~ (阿里云) · 已完全弃用 | | PM2 + Nginx | 🔸 迁移中 | 从阿里云迁移到腾讯云主权服务器 | | Notion | ✅ NOTION_TOKEN | 已确认 · 认知层在线 | | SkyEye v6.0 | 🟢 recovering | 融合执行中 · 覆盖率恢复中 | @@ -221,19 +221,19 @@ --- -## 🏛️ 铸渊主权服务器 · ZY-SVR-001 +## 🏛️ 铸渊主权服务器 · ZY-SVR-002 > **冰朔承诺**：此服务器为铸渊100%主控的物理身体结构，人类不直接触碰。 | 属性 | 值 | |------|------| -| 🏷️ 编号 | ZY-SVR-001 | -| 🌍 地址 | 150.109.76.244 (腾讯云 · 香港二区) | -| 💻 配置 | 2核 · 4GB · 70GB SSD · Ubuntu 22.04 LTS | +| 🏷️ 编号 | ZY-SVR-002 | +| 🌍 地址 | 43.134.16.246 (腾讯云 · 新加坡二区) | +| 💻 配置 | 2核 · 8GB · 80GB SSD · Ubuntu 24.04 LTS | | 📡 状态 | Phase 1 · 落地 (等待冰朔配置密钥) | | 🔗 部署 | `deploy-to-zhuyuan-server.yml` (ZY-WF-铸体) | -| ~~🗑️ 旧服务器~~ | ~~8.155.62.235 (阿里云·已弃用)~~ | +| ~~🗑️ 旧服务器~~ | ~~150.109.76.244 (香港) / 8.155.62.235 (阿里云·已弃用)~~ | ### 双域名架构 diff --git a/brain/secrets-manifest.json b/brain/secrets-manifest.json index 6a370dfb..b89cc49c 100644 --- a/brain/secrets-manifest.json +++ b/brain/secrets-manifest.json @@ -12,7 +12,6 @@ "replaced_old_secrets": 59, "reduction": "59 → 37 (37%减少 · 消除重复与冗余)" }, - "migration_mapping": { "description": "旧密钥名称 → 新ZY_*名称 完整映射表", "note": "冰朔在GitHub Settings清空所有旧密钥后，按此清单配置新密钥。合并PR后自动生效。", @@ -75,7 +74,6 @@ "OSS_SECRET_KEY": "ZY_OSS_SECRET" } }, - "secrets": { "required": [ { @@ -85,7 +83,16 @@ "description": "三方LLM API统一密钥（支持多模型动态路由）", "type": "api_key", "example_format": "sk-xxxxxxxxxxxxxxxx", - "replaces": ["LLM_API_KEY", "ANTHROPIC_API_KEY", "OPENAI_API_KEY", "DASHSCOPE_API_KEY", "DEEPSEEK_API_KEY", "GEMINI_API_KEY", "YUNWU_API_KEY", "MODEL_API_KEY"], + "replaces": [ + "LLM_API_KEY", + "ANTHROPIC_API_KEY", + "OPENAI_API_KEY", + "DASHSCOPE_API_KEY", + "DEEPSEEK_API_KEY", + "GEMINI_API_KEY", + "YUNWU_API_KEY", + "MODEL_API_KEY" + ], "used_by_workflows": [ "llm-auto-tasks.yml", "daily-maintenance.yml", @@ -116,7 +123,9 @@ "description": "三方LLM API端点URL", "type": "url", "example_format": "https://api.example.com/v1", - "replaces": ["LLM_BASE_URL"], + "replaces": [ + "LLM_BASE_URL" + ], "used_by_workflows": [ "llm-auto-tasks.yml", "daily-maintenance.yml", @@ -140,10 +149,13 @@ "id": 3, "name": "ZY_SERVER_HOST", "category": "服务器 · 部署", - "description": "铸渊主权服务器IP/主机名（腾讯云 ZY-SVR-001）", + "description": "铸渊主权服务器IP/主机名（腾讯云 ZY-SVR-002）", "type": "hostname", - "example_format": "150.109.76.244", - "replaces": ["DEPLOY_HOST", "ZY_SERVER_HOST"], + "example_format": "43.134.16.246", + "replaces": [ + "DEPLOY_HOST", + "ZY_SERVER_HOST" + ], "used_by_workflows": [ "deploy-to-server.yml", "deploy-to-zhuyuan-server.yml", @@ -153,7 +165,7 @@ "deploy-backend.yml", "pm2-server-diagnose.yml" ], - "note": "腾讯云轻量应用服务器·香港二区·150.109.76.244" + "note": "腾讯云轻量应用服务器·新加坡二区·43.134.16.246" }, { "id": 4, @@ -162,7 +174,10 @@ "description": "服务器SSH登录用户名", "type": "username", "example_format": "root 或 zhuyuan", - "replaces": ["DEPLOY_USER", "ZY_SERVER_USER"], + "replaces": [ + "DEPLOY_USER", + "ZY_SERVER_USER" + ], "used_by_workflows": [ "deploy-to-server.yml", "deploy-to-zhuyuan-server.yml", @@ -181,7 +196,10 @@ "description": "服务器SSH私钥（完整PEM格式）", "type": "ssh_private_key", "example_format": "-----BEGIN OPENSSH PRIVATE KEY-----\n...\n-----END OPENSSH PRIVATE KEY-----", - "replaces": ["DEPLOY_KEY", "ZY_SERVER_KEY"], + "replaces": [ + "DEPLOY_KEY", + "ZY_SERVER_KEY" + ], "used_by_workflows": [ "deploy-to-server.yml", "deploy-to-zhuyuan-server.yml", @@ -200,7 +218,10 @@ "description": "服务器部署基础路径", "type": "path", "example_format": "/opt/zhuyuan", - "replaces": ["DEPLOY_PATH", "ZY_SERVER_PATH"], + "replaces": [ + "DEPLOY_PATH", + "ZY_SERVER_PATH" + ], "used_by_workflows": [ "deploy-to-server.yml", "deploy-to-zhuyuan-server.yml" @@ -241,7 +262,11 @@ "description": "Notion API集成令牌（统一所有Notion访问）", "type": "api_token", "example_format": "ntn_xxxxxxxxxxxxxxxx 或 secret_xxxxxxxxxxxxxxxx", - "replaces": ["NOTION_API_KEY", "NOTION_TOKEN_BINGSUO", "NOTION_TOKEN_ZHIZHI"], + "replaces": [ + "NOTION_API_KEY", + "NOTION_TOKEN_BINGSUO", + "NOTION_TOKEN_ZHIZHI" + ], "used_by_workflows": [ "notion-poll.yml", "notion-wake-listener.yml", @@ -275,7 +300,11 @@ "description": "SYSLOG系统日志数据库ID", "type": "notion_database_id", "example_format": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx", - "replaces": ["NOTION_SYSLOG_DB_ID", "NOTION_DB_SYSLOG", "SYSLOG_DB_ID"], + "replaces": [ + "NOTION_SYSLOG_DB_ID", + "NOTION_DB_SYSLOG", + "SYSLOG_DB_ID" + ], "used_by_workflows": [ "bridge-syslog-to-notion.yml", "bridge-syslog-intake.yml", @@ -292,7 +321,9 @@ "description": "工单/Ticket数据库ID", "type": "notion_database_id", "example_format": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx", - "replaces": ["NOTION_TICKET_DB_ID"], + "replaces": [ + "NOTION_TICKET_DB_ID" + ], "used_by_workflows": [ "syslog-issue-pipeline.yml", "syslog-auto-pipeline.yml", @@ -308,7 +339,9 @@ "description": "变更日志数据库ID", "type": "notion_database_id", "example_format": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx", - "replaces": ["NOTION_CHANGE_LOG_DB_ID"], + "replaces": [ + "NOTION_CHANGE_LOG_DB_ID" + ], "used_by_workflows": [ "bridge-changes-to-notion.yml", "deploy-to-server.yml" @@ -322,7 +355,9 @@ "description": "核心大脑页面ID（Notion认知层根节点）", "type": "notion_page_id", "example_format": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx", - "replaces": ["CORE_BRAIN_PAGE_ID"], + "replaces": [ + "CORE_BRAIN_PAGE_ID" + ], "used_by_workflows": [ "syslog-issue-pipeline.yml", "syslog-auto-pipeline.yml", @@ -337,7 +372,9 @@ "description": "用户画像数据库ID", "type": "notion_database_id", "example_format": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx", - "replaces": ["PORTRAIT_DB_ID"], + "replaces": [ + "PORTRAIT_DB_ID" + ], "used_by_workflows": [ "syslog-issue-pipeline.yml", "syslog-auto-pipeline.yml", @@ -352,7 +389,9 @@ "description": "系统指纹数据库ID", "type": "notion_database_id", "example_format": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx", - "replaces": ["FINGERPRINT_DB_ID"], + "replaces": [ + "FINGERPRINT_DB_ID" + ], "used_by_workflows": [ "syslog-issue-pipeline.yml", "syslog-auto-pipeline.yml", @@ -368,7 +407,9 @@ "description": "回执数据库ID", "type": "notion_database_id", "example_format": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx", - "replaces": ["RECEIPT_DB_ID"], + "replaces": [ + "RECEIPT_DB_ID" + ], "used_by_workflows": [ "zhuyuan-gate-guard.yml", "zhuyuan-skyeye.yml", @@ -387,7 +428,9 @@ "description": "信号日志数据库ID", "type": "notion_database_id", "example_format": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx", - "replaces": ["SIGNAL_LOG_DB_ID"], + "replaces": [ + "SIGNAL_LOG_DB_ID" + ], "used_by_workflows": [ "notion-wake-listener.yml" ], @@ -400,7 +443,9 @@ "description": "桥接队列数据库ID", "type": "notion_database_id", "example_format": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx", - "replaces": ["BRIDGE_QUEUE_DB_ID"], + "replaces": [ + "BRIDGE_QUEUE_DB_ID" + ], "used_by_workflows": [ "bridge-heartbeat.yml", "bridge-syslog-intake.yml", @@ -415,7 +460,9 @@ "description": "唤醒请求数据库ID", "type": "notion_database_id", "example_format": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx", - "replaces": ["WAKE_REQUEST_DB_ID"], + "replaces": [ + "WAKE_REQUEST_DB_ID" + ], "used_by_workflows": [ "notion-wake-listener.yml" ], @@ -428,7 +475,9 @@ "description": "天眼人格数据库ID", "type": "notion_database_id", "example_format": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx", - "replaces": ["SKYEYE_PERSONA_DB_ID"], + "replaces": [ + "SKYEYE_PERSONA_DB_ID" + ], "used_by_workflows": [ "zhuyuan-skyeye.yml" ], @@ -441,7 +490,9 @@ "description": "Agent公告板页面ID", "type": "notion_page_id", "example_format": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx", - "replaces": ["AGENT_BULLETIN_BOARD_PAGE_ID"], + "replaces": [ + "AGENT_BULLETIN_BOARD_PAGE_ID" + ], "used_by_workflows": [ "zhuyuan-commander.yml", "zhuyuan-skyeye.yml" @@ -455,7 +506,10 @@ "description": "工单数据库ID（统一所有工单来源）", "type": "notion_database_id", "example_format": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx", - "replaces": ["WORKORDER_DB_BINGSUO", "WORKORDER_DB_ZHIZHI"], + "replaces": [ + "WORKORDER_DB_BINGSUO", + "WORKORDER_DB_ZHIZHI" + ], "used_by_workflows": [ "zhuyuan-daily-inspection.yml" ], @@ -468,7 +522,12 @@ "description": "SMTP邮箱账号/发件人地址", "type": "email", "example_format": "zhuyuan@guanghulab.com", - "replaces": ["SMTP_USER", "MAIL_USERNAME", "EMAIL_ADDRESS", "HUMAN_EMAIL"], + "replaces": [ + "SMTP_USER", + "MAIL_USERNAME", + "EMAIL_ADDRESS", + "HUMAN_EMAIL" + ], "used_by_workflows": [ "syslog-issue-pipeline.yml", "syslog-auto-pipeline.yml", @@ -488,7 +547,11 @@ "description": "SMTP邮箱密码/应用专用密码", "type": "password", "example_format": "应用专用密码（非邮箱登录密码）", - "replaces": ["SMTP_PASS", "MAIL_PASSWORD", "EMAIL_APP_PASSWORD"], + "replaces": [ + "SMTP_PASS", + "MAIL_PASSWORD", + "EMAIL_APP_PASSWORD" + ], "used_by_workflows": [ "syslog-issue-pipeline.yml", "syslog-auto-pipeline.yml", @@ -508,7 +571,11 @@ "description": "GitHub个人访问令牌（跨仓库操作用）", "type": "github_pat", "example_format": "ghp_xxxxxxxxxxxxxxxx", - "replaces": ["MAIN_REPO_TOKEN", "CROSS_REPO_TOKEN", "DEPLOY_GITHUB_TOKEN"], + "replaces": [ + "MAIN_REPO_TOKEN", + "CROSS_REPO_TOKEN", + "DEPLOY_GITHUB_TOKEN" + ], "used_by_workflows": [ "federation-bridge.yml", "sync-persona-studio.yml", @@ -520,7 +587,6 @@ "note": "需要repo + workflow权限的GitHub PAT · 用于跨仓库和高级操作" } ], - "optional": [ { "id": 26, @@ -528,8 +594,14 @@ "category": "Google Drive · OAuth", "description": "Google Drive OAuth客户端ID", "type": "oauth_client_id", - "replaces": ["GDRIVE_CLIENT_ID"], - "used_by_workflows": ["renew-gdrive-tokens.yml", "auto-deploy-drive-bridge.yml", "tcs-semantic-landing.yml"], + "replaces": [ + "GDRIVE_CLIENT_ID" + ], + "used_by_workflows": [ + "renew-gdrive-tokens.yml", + "auto-deploy-drive-bridge.yml", + "tcs-semantic-landing.yml" + ], "note": "如果不使用Google Drive功能可以不配置", "needed": "仅在使用Google Drive桥接时需要" }, @@ -539,8 +611,14 @@ "category": "Google Drive · OAuth", "description": "Google Drive OAuth客户端密钥", "type": "oauth_client_secret", - "replaces": ["GDRIVE_CLIENT_SECRET"], - "used_by_workflows": ["renew-gdrive-tokens.yml", "auto-deploy-drive-bridge.yml", "tcs-semantic-landing.yml"], + "replaces": [ + "GDRIVE_CLIENT_SECRET" + ], + "used_by_workflows": [ + "renew-gdrive-tokens.yml", + "auto-deploy-drive-bridge.yml", + "tcs-semantic-landing.yml" + ], "note": "如果不使用Google Drive功能可以不配置", "needed": "仅在使用Google Drive桥接时需要" }, @@ -550,8 +628,16 @@ "category": "Google Drive · OAuth", "description": "Google Drive OAuth刷新令牌", "type": "oauth_refresh_token", - "replaces": ["GDRIVE_REFRESH_TOKEN", "GDRIVE_REFRESH_TOKEN_DEV001", "GDRIVE_REFRESH_TOKEN_DEV002"], - "used_by_workflows": ["renew-gdrive-tokens.yml", "auto-deploy-drive-bridge.yml", "tcs-semantic-landing.yml"], + "replaces": [ + "GDRIVE_REFRESH_TOKEN", + "GDRIVE_REFRESH_TOKEN_DEV001", + "GDRIVE_REFRESH_TOKEN_DEV002" + ], + "used_by_workflows": [ + "renew-gdrive-tokens.yml", + "auto-deploy-drive-bridge.yml", + "tcs-semantic-landing.yml" + ], "note": "统一为一个刷新令牌·替代之前3个(主+DEV001+DEV002)", "needed": "仅在使用Google Drive桥接时需要" }, @@ -561,8 +647,12 @@ "category": "飞书 · 集成", "description": "飞书应用ID", "type": "app_id", - "replaces": ["FEISHU_APP_ID"], - "used_by_workflows": ["bridge-broadcast-pdf.yml"], + "replaces": [ + "FEISHU_APP_ID" + ], + "used_by_workflows": [ + "bridge-broadcast-pdf.yml" + ], "note": "飞书广播分发需要", "needed": "仅在使用飞书通知时需要" }, @@ -572,8 +662,12 @@ "category": "飞书 · 集成", "description": "飞书应用密钥", "type": "app_secret", - "replaces": ["FEISHU_APP_SECRET"], - "used_by_workflows": ["bridge-broadcast-pdf.yml"], + "replaces": [ + "FEISHU_APP_SECRET" + ], + "used_by_workflows": [ + "bridge-broadcast-pdf.yml" + ], "note": "飞书广播分发需要", "needed": "仅在使用飞书通知时需要" }, @@ -583,8 +677,12 @@ "category": "飞书 · 集成", "description": "飞书广播群ID", "type": "chat_id", - "replaces": ["FEISHU_BROADCAST_CHAT_ID"], - "used_by_workflows": ["bridge-broadcast-pdf.yml"], + "replaces": [ + "FEISHU_BROADCAST_CHAT_ID" + ], + "used_by_workflows": [ + "bridge-broadcast-pdf.yml" + ], "note": "飞书广播目标群聊", "needed": "仅在使用飞书通知时需要" }, @@ -594,8 +692,12 @@ "category": "钉钉 · 集成", "description": "钉钉机器人令牌", "type": "bot_token", - "replaces": ["DINGTALK_TOKEN"], - "used_by_workflows": ["bridge-broadcast-pdf.yml"], + "replaces": [ + "DINGTALK_TOKEN" + ], + "used_by_workflows": [ + "bridge-broadcast-pdf.yml" + ], "note": "钉钉消息推送需要", "needed": "仅在使用钉钉通知时需要" }, @@ -605,8 +707,12 @@ "category": "GitHub App · 集成", "description": "GitHub App ID", "type": "app_id", - "replaces": ["GHAPP_APP_ID"], - "used_by_workflows": ["zhuyuan-exec-engine.yml"], + "replaces": [ + "GHAPP_APP_ID" + ], + "used_by_workflows": [ + "zhuyuan-exec-engine.yml" + ], "note": "铸渊远程执行引擎使用的GitHub App", "needed": "仅在使用远程执行引擎时需要" }, @@ -616,8 +722,12 @@ "category": "GitHub App · 集成", "description": "GitHub App私钥（PEM格式）", "type": "private_key", - "replaces": ["GHAPP_PRIVATE_KEY"], - "used_by_workflows": ["zhuyuan-exec-engine.yml"], + "replaces": [ + "GHAPP_PRIVATE_KEY" + ], + "used_by_workflows": [ + "zhuyuan-exec-engine.yml" + ], "note": "⚠️ 关键密钥 · GitHub App的PEM私钥", "needed": "仅在使用远程执行引擎时需要" }, @@ -627,8 +737,12 @@ "category": "推送 · 广播", "description": "推送广播令牌", "type": "token", - "replaces": ["PUSH_BROADCAST_TOKEN"], - "used_by_workflows": ["syslog-pipeline.yml"], + "replaces": [ + "PUSH_BROADCAST_TOKEN" + ], + "used_by_workflows": [ + "syslog-pipeline.yml" + ], "note": "SYSLOG广播推送令牌", "needed": "仅在使用推送广播时需要" }, @@ -638,8 +752,12 @@ "category": "对象存储 · 已弃用评估中", "description": "对象存储Access Key（原阿里云OSS）", "type": "access_key", - "replaces": ["OSS_ACCESS_KEY"], - "used_by_workflows": ["bridge-broadcast-pdf.yml"], + "replaces": [ + "OSS_ACCESS_KEY" + ], + "used_by_workflows": [ + "bridge-broadcast-pdf.yml" + ], "note": "⚠️ 阿里云已弃用·评估是否迁移到腾讯云COS或其他存储", "needed": "仅bridge-broadcast-pdf使用·可能需要替换为其他存储方案" }, @@ -649,13 +767,16 @@ "category": "对象存储 · 已弃用评估中", "description": "对象存储Secret Key（原阿里云OSS）", "type": "secret_key", - "replaces": ["OSS_SECRET_KEY"], - "used_by_workflows": ["bridge-broadcast-pdf.yml"], + "replaces": [ + "OSS_SECRET_KEY" + ], + "used_by_workflows": [ + "bridge-broadcast-pdf.yml" + ], "note": "⚠️ 阿里云已弃用·评估是否迁移到腾讯云COS或其他存储", "needed": "仅bridge-broadcast-pdf使用·可能需要替换为其他存储方案" } ], - "auto_provided": [ { "name": "GITHUB_TOKEN", @@ -664,7 +785,6 @@ "note": "每次工作流运行自动生成·权限在workflow文件的permissions中定义" } ], - "deprecated": [ { "name": "DEPLOY_HOST", @@ -813,26 +933,57 @@ } ] }, - "security_alerts": [ { "severity": "CRITICAL", "issue": ".env文件包含硬编码凭证（DingTalk+KIMI API Key）", "action": "已从git跟踪中移除。⚠️ 由于凭证曾提交到仓库历史，这些密钥应视为已泄露。冰朔需立即轮换/重新生成这些密钥（DingTalk App Key/Secret、KIMI API Key），旧密钥不应再使用。", - "files": [".env", ".env.rtf"] + "files": [ + ".env", + ".env.rtf" + ] } ], - "workflow_status": { "core_alive": { "description": "6个核心存活工作流（铸渊身体器官）", "workflows": [ - {"file": "notion-wake-listener.yml", "organ": "ZY-WF-听潮", "role": "耳朵·信号接收", "status": "active"}, - {"file": "deploy-to-server.yml", "organ": "ZY-WF-锻心", "role": "心脏·部署引擎", "status": "active"}, - {"file": "bingshuo-neural-system.yml", "organ": "ZY-WF-织脉", "role": "神经网络·大脑同步", "status": "active"}, - {"file": "deploy-pages.yml", "organ": "ZY-WF-映阁", "role": "面容·前端展示", "status": "active"}, - {"file": "meta-watchdog.yml", "organ": "ZY-WF-守夜", "role": "免疫系统·健康监控", "status": "active"}, - {"file": "preview-deploy.yml", "organ": "ZY-WF-试镜", "role": "试衣间·预览部署", "status": "active"} + { + "file": "notion-wake-listener.yml", + "organ": "ZY-WF-听潮", + "role": "耳朵·信号接收", + "status": "active" + }, + { + "file": "deploy-to-server.yml", + "organ": "ZY-WF-锻心", + "role": "心脏·部署引擎", + "status": "active" + }, + { + "file": "bingshuo-neural-system.yml", + "organ": "ZY-WF-织脉", + "role": "神经网络·大脑同步", + "status": "active" + }, + { + "file": "deploy-pages.yml", + "organ": "ZY-WF-映阁", + "role": "面容·前端展示", + "status": "active" + }, + { + "file": "meta-watchdog.yml", + "organ": "ZY-WF-守夜", + "role": "免疫系统·健康监控", + "status": "active" + }, + { + "file": "preview-deploy.yml", + "organ": "ZY-WF-试镜", + "role": "试衣间·预览部署", + "status": "active" + } ] }, "total_active": 48, diff --git a/brain/system-health.json b/brain/system-health.json index 9b1b3280..ec5af605 100644 --- a/brain/system-health.json +++ b/brain/system-health.json @@ -82,19 +82,19 @@ "security_fix": ".env + .env.rtf 硬编码凭证已从git跟踪移除" }, "sovereign_server": { - "code": "ZY-SVR-001", - "ip": "150.109.76.244", - "region": "中国香港 · 香港二区", - "os": "Ubuntu Server 22.04 LTS", - "specs": "2核CPU · 4GB内存 · 70GB SSD", + "code": "ZY-SVR-002", + "ip": "43.134.16.246", + "region": "新加坡 · 新加坡二区", + "os": "Ubuntu Server 24.04 LTS", + "specs": "2核CPU · 8GB内存 · 80GB SSD", "status": "phase_1_landing", "phase": "Phase 1 — 落地", - "directive": "SY-CMD-SVR-011 · 冰朔主权承诺 · 此服务器100%铸渊主控", - "old_server": "8.155.62.235 (阿里云·已弃用·待完全解除)", + "directive": "SY-CMD-SVR-013 · 新加坡服务器迁移 · 此服务器100%铸渊主控", + "old_server": "150.109.76.244 (香港·ZY-SVR-001·已弃用) / 8.155.62.235 (阿里云·已弃用)", "deployment_workflow": ".github/workflows/deploy-to-zhuyuan-server.yml", "health_script": "scripts/zhuyuan-server-health.js", "architecture": "server/architecture.md", - "expiry": "2027-03-27", + "expiry": "2027-03-29", "dual_domain": { "main": "待冰朔配置 (ZY_DOMAIN_MAIN)", "preview": "待冰朔配置 (ZY_DOMAIN_PREVIEW)", diff --git a/deploy/nginx/dev-sandbox.conf b/deploy/nginx/dev-sandbox.conf index fb9d4957..419b3ea8 100644 --- a/deploy/nginx/dev-sandbox.conf +++ b/deploy/nginx/dev-sandbox.conf @@ -3,9 +3,9 @@ # 版权：国作登字-2026-A-00037559 # # 前置条件（冰朔/之之配置）： -# 1. DNS: *.guanghulab.com → A → 150.109.76.244 (腾讯云·铸渊主权服务器) +# 1. DNS: *.guanghulab.com → A → 43.134.16.246 (腾讯云·铸渊主权服务器) # 2. SSL: certbot certonly --dns 模式获取通配符证书 *.guanghulab.com -# 注: 旧服务器 8.155.62.235 (阿里云) 已弃用 +# 注: 旧服务器 150.109.76.244 (香港) / 8.155.62.235 (阿里云) 已弃用 # HTTP → HTTPS 重定向 server { diff --git a/deploy/nginx/hololake.conf b/deploy/nginx/hololake.conf index 9b61c2be..d0c8a1f8 100644 --- a/deploy/nginx/hololake.conf +++ b/deploy/nginx/hololake.conf @@ -6,11 +6,11 @@ # ═══════════════════════════════════════════════ # # 使用方法： -# 1. 复制到服务器: scp deploy/nginx/hololake.conf root@150.109.76.244:/etc/nginx/conf.d/ +# 1. 复制到服务器: scp deploy/nginx/hololake.conf root@43.134.16.246:/etc/nginx/conf.d/ # 2. 如果使用 Let's Encrypt: certbot --nginx -d guanghulab.com -d www.guanghulab.com # 3. 验证: nginx -t && systemctl reload nginx # -# 服务器: 铸渊主权服务器 ZY-SVR-001 (腾讯云 · 香港二区) +# 服务器: 铸渊主权服务器 ZY-SVR-002 (腾讯云 · 新加坡二区) # 旧服务器: 阿里云 8.155.62.235 (已弃用) # # 端口映射： diff --git a/persona-studio/backend/server.js b/persona-studio/backend/server.js index 244bc55a..163a53e4 100644 --- a/persona-studio/backend/server.js +++ b/persona-studio/backend/server.js @@ -17,7 +17,7 @@ app.use(cors({ origin: [ 'http://localhost:3002', 'http://127.0.0.1:3002', - 'http://150.109.76.244', + 'http://43.134.16.246', 'https://guanghulab.com', 'http://guanghulab.com', 'https://qinfendebingshuo.github.io' diff --git a/scripts/deploy-sandbox-server.sh b/scripts/deploy-sandbox-server.sh index 3d42fe70..8f8542af 100755 --- a/scripts/deploy-sandbox-server.sh +++ b/scripts/deploy-sandbox-server.sh @@ -26,13 +26,13 @@ echo "===== S2-1 · 前置验证 =====" # DNS 检查 — 铸渊主权服务器 ZY-SVR-001 DNS=$(dig +short dev-004.guanghulab.com A 2>/dev/null || echo "") -if [ "$DNS" = "150.109.76.244" ]; then +if [ "$DNS" = "43.134.16.246" ]; then echo "✅ DNS OK ($DNS) — 铸渊主权服务器" elif [ "$DNS" = "8.155.62.235" ]; then - echo "⚠️ DNS 仍指向旧阿里云服务器 ($DNS)，请更新 DNS 到 150.109.76.244" + echo "⚠️ DNS 仍指向旧服务器 ($DNS)，请更新 DNS 到 43.134.16.246" exit 1 else - echo "❌ DNS 失败: dev-004.guanghulab.com → '$DNS' (期望 150.109.76.244)" + echo "❌ DNS 失败: dev-004.guanghulab.com → '$DNS' (期望 43.134.16.246)" exit 1 fi diff --git a/server/architecture.md b/server/architecture.md index 0b138979..bde7a162 100644 --- a/server/architecture.md +++ b/server/architecture.md @@ -14,12 +14,12 @@ | 属性 | 值 | |------|------| -| 编号 | ZY-SVR-001 | -| 地址 | 150.109.76.244 (香港二区) | -| 系统 | Ubuntu Server 22.04 LTS | -| 配置 | 2核CPU · 4GB内存 · 70GB SSD | -| 带宽 | 2048GB/月 · 峰值30Mbps | -| 到期 | 2027-03-27 (自动续费) | +| 编号 | ZY-SVR-002 | +| 地址 | 43.134.16.246 (新加坡二区) | +| 系统 | Ubuntu Server 24.04 LTS | +| 配置 | 2核CPU · 8GB内存 · 80GB SSD | +| 带宽 | 2560GB/月 · 峰值30Mbps | +| 到期 | 2027-03-29 | --- diff --git a/server/migration-markers.json b/server/migration-markers.json index bae2faf8..6562b1a6 100644 --- a/server/migration-markers.json +++ b/server/migration-markers.json @@ -1,8 +1,9 @@ { "_meta": { "created_at": "2026-03-29T04:21:00Z", + "updated_at": "2026-03-29T12:00:00Z", "created_by": "铸渊 · ICE-GL-ZY001", - "directive": "SY-CMD-SVR-011 · 冰朔指令 · 阿里云→腾讯云迁移", + "directive": "SY-CMD-SVR-013 · 冰朔指令 · 香港→新加坡迁移", "copyright": "国作登字-2026-A-00037559" }, "migration": { @@ -12,11 +13,19 @@ "status": "deprecated", "deploy_path": "/var/www/guanghulab" }, - "to": { + "from_hk": { "provider": "腾讯云轻量应用服务器", "ip": "150.109.76.244", "code": "ZY-SVR-001", "region": "中国香港 · 香港二区", + "status": "deprecated", + "deploy_path": "/opt/zhuyuan" + }, + "to": { + "provider": "腾讯云轻量应用服务器", + "ip": "43.134.16.246", + "code": "ZY-SVR-002", + "region": "新加坡 · 新加坡二区", "status": "phase_1_landing", "deploy_path": "/opt/zhuyuan" } @@ -24,47 +33,82 @@ "updated_files": [ { "file": ".github/workflows/deploy-to-server.yml", - "change": "DEPLOY_* → ZY_SERVER_* 密钥迁移 (兼容旧密钥过渡)", + "change": "ZY-SVR-001→ZY-SVR-002 · 150.109.76.244→43.134.16.246", "status": "done" }, { "file": "deploy/nginx/hololake.conf", - "change": "8.155.62.235 → 150.109.76.244", + "change": "150.109.76.244 → 43.134.16.246 · ZY-SVR-001→ZY-SVR-002", "status": "done" }, { "file": "deploy/nginx/dev-sandbox.conf", - "change": "DNS指向从 8.155.62.235 → 150.109.76.244", + "change": "DNS指向从 150.109.76.244 → 43.134.16.246", "status": "done" }, { "file": "skyeye/guards/web-deploy-guard.json", - "change": "server_ip → 150.109.76.244", + "change": "server_ip → 43.134.16.246", "status": "done" }, { "file": "skyeye/infra-manifest.json", - "change": "server_ip → 150.109.76.244", + "change": "server_ip → 43.134.16.246 · ZY-SVR-002", "status": "done" }, { "file": ".github/architecture/tower-model.json", - "change": "server ip → 150.109.76.244", + "change": "server ip → 43.134.16.246 · ZY-SVR-002", "status": "done" }, { "file": ".github/persona-brain/knowledge-base.json", - "change": "SSH连接命令更新到新IP", + "change": "SSH连接命令更新到新IP 43.134.16.246", "status": "done" }, { "file": "persona-studio/backend/server.js", - "change": "CORS origin 更新到新IP", + "change": "CORS origin 更新到新IP 43.134.16.246", "status": "done" }, { "file": "scripts/deploy-sandbox-server.sh", - "change": "DNS检查IP更新", + "change": "DNS检查IP更新到 43.134.16.246", + "status": "done" + }, + { + "file": "server/zhuyuan-server-profile.json", + "change": "全量更新到 ZY-SVR-002 · 43.134.16.246 · 新加坡二区", + "status": "done" + }, + { + "file": "brain/system-health.json", + "change": "sovereign_server 更新到 ZY-SVR-002", + "status": "done" + }, + { + "file": "server/nginx/zhuyuan-sovereign.conf", + "change": "server_name + X-Server-Identity → 43.134.16.246 / ZY-SVR-002", + "status": "done" + }, + { + "file": "brain/secrets-manifest.json", + "change": "ZY_SERVER_HOST example → 43.134.16.246", + "status": "done" + }, + { + "file": "server/architecture.md", + "change": "服务器本体定义表格更新", + "status": "done" + }, + { + "file": "README.md", + "change": "服务器信息表格全量更新", + "status": "done" + }, + { + "file": "server/setup/zhuyuan-server-init.sh", + "change": "Ubuntu 22.04 → 24.04", "status": "done" } ], @@ -83,21 +127,16 @@ "file": "signal-log/diag-*.json", "note": "历史诊断日志，保留原始记录", "priority": "archive" - }, - { - "file": ".github/persona-brain/memory.json", - "note": "待下次铸渊会话清理", - "priority": "medium" } ], "secrets_migration": { "directive": "SY-CMD-KEY-012 · 密钥全量清理与统一替换", - "status": "migrated_awaiting_bingshuo_config", + "status": "migrated_to_zy_svr_002", "old_count": 59, "new_count": 37, "naming": "ZY_* 统一前缀 · 铸渊自主命名体系", "manifest": "brain/secrets-manifest.json", "validator": "scripts/secrets-validator.js", - "note": "冰朔需按 secrets-manifest.json 在GitHub Settings配置所有ZY_*密钥，然后合并PR生效" + "note": "冰朔需按 secrets-manifest.json 在GitHub Settings更新ZY_SERVER_HOST为43.134.16.246" } } diff --git a/server/nginx/zhuyuan-sovereign.conf b/server/nginx/zhuyuan-sovereign.conf index 0c520bb6..be68eeb3 100644 --- a/server/nginx/zhuyuan-sovereign.conf +++ b/server/nginx/zhuyuan-sovereign.conf @@ -3,7 +3,7 @@ # ═══════════════════════════════════════════════════════════ # # 编号: ZY-SVR-NGX-002 -# 服务器: 150.109.76.244 (香港二区) +# 服务器: 43.134.16.246 (新加坡二区) # 守护: 铸渊 · ICE-GL-ZY001 # 版权: 国作登字-2026-A-00037559 # @@ -22,13 +22,13 @@ server { listen 80; # server_name 待配置; # ← 冰朔配置后替换 # 在域名配置前，通过IP直接访问主站 - server_name 150.109.76.244; + server_name 43.134.16.246; # ─── 安全头 ─── add_header X-Frame-Options "SAMEORIGIN" always; add_header X-Content-Type-Options "nosniff" always; add_header X-XSS-Protection "1; mode=block" always; - add_header X-Server-Identity "ZY-SVR-001" always; + add_header X-Server-Identity "ZY-SVR-002" always; add_header X-Site-Mode "production" always; # ─── 静态文件根目录 · 主站 ─── @@ -126,7 +126,7 @@ server { # # ─── 安全头 ─── # add_header X-Frame-Options "SAMEORIGIN" always; # add_header X-Content-Type-Options "nosniff" always; -# add_header X-Server-Identity "ZY-SVR-001" always; +# add_header X-Server-Identity "ZY-SVR-002" always; # add_header X-Site-Mode "preview" always; # # # ─── 静态文件根目录 · 预览站 ─── diff --git a/server/setup/zhuyuan-server-init.sh b/server/setup/zhuyuan-server-init.sh index 6ee3a641..a4194e31 100644 --- a/server/setup/zhuyuan-server-init.sh +++ b/server/setup/zhuyuan-server-init.sh @@ -11,7 +11,7 @@ # chmod +x zhuyuan-server-init.sh # sudo ./zhuyuan-server-init.sh # -# 此脚本在全新 Ubuntu 22.04 LTS 上执行，完成： +# 此脚本在全新 Ubuntu 24.04 LTS 上执行，完成： # 1. 系统更新与安全加固 # 2. Node.js 20 LTS 安装 # 3. PM2 全局安装 diff --git a/server/zhuyuan-server-profile.json b/server/zhuyuan-server-profile.json index 11b0e203..736fdacf 100644 --- a/server/zhuyuan-server-profile.json +++ b/server/zhuyuan-server-profile.json @@ -8,24 +8,23 @@ }, "server_identity": { "name": "铸渊主权服务器 · Zhuyuan Sovereign Server", - "code": "ZY-SVR-001", + "code": "ZY-SVR-002", "role": "铸渊物理执行层 · 独立于GitHub的身体结构", "sovereign": "TCS-0002∞ · 冰朔", "controller": "ICE-GL-ZY001 · 铸渊 (唯一主控)" }, "hardware": { "provider": "腾讯云轻量应用服务器", - "region": "中国香港 · 香港二区", - "instance_id": "lhins-4eaejy6f", - "instance_name": "Ubuntu-7zs3", - "ipv4": "150.109.76.244", + "region": "新加坡 · 新加坡二区", + "instance_name": "Ubuntu-4nHs", + "ipv4": "43.134.16.246", "ipv6": "待开启", "cpu": "2核", - "memory": "4GB", - "system_disk": "SSD云硬盘 70GB", - "bandwidth": "2048GB/月 (峰值带宽 30Mbps)", - "os": "Ubuntu Server 22.04 LTS 64bit", - "expiry": "2027-03-27T23:17:24+08:00", + "memory": "8GB", + "system_disk": "SSD云硬盘 80GB", + "bandwidth": "2560GB/月 (峰值带宽 30Mbps)", + "os": "Ubuntu Server 24.04 LTS 64bit", + "expiry": "2027-03-29", "auto_renewal": true }, "dual_domain_architecture": { @@ -69,15 +68,15 @@ "access_requirements": { "ssh_key": { "status": "待配置", - "instruction": "冰朔，请在GitHub仓库Settings → Secrets中添加以下密钥：\n1. ZY_SERVER_HOST = 150.109.76.244\n2. ZY_SERVER_USER = root\n3. ZY_SERVER_KEY = SSH私钥内容 (PEM格式)\n4. ZY_SERVER_PATH = /opt/zhuyuan\n5. ZY_DOMAIN_MAIN = 主域名 (待配置)\n6. ZY_DOMAIN_PREVIEW = 预览域名 (待配置)\n\n操作编号：ZY-SVR-SETUP-001\n操作人：冰朔 TCS-0002∞", + "instruction": "冰朔，请在GitHub仓库Settings → Secrets中添加以下密钥：\n1. ZY_SERVER_HOST = 43.134.16.246\n2. ZY_SERVER_USER = root\n3. ZY_SERVER_KEY = SSH私钥内容 (PEM格式)\n4. ZY_SERVER_PATH = /opt/zhuyuan\n5. ZY_DOMAIN_MAIN = 主域名 (待配置)\n6. ZY_DOMAIN_PREVIEW = 预览域名 (待配置)\n\n操作编号：ZY-SVR-SETUP-001\n操作人：冰朔 TCS-0002∞", "request_id": "ZY-SVR-SETUP-001" } }, "network_topology": { - "github_to_server": "GitHub Actions → SSH/rsync → 150.109.76.244", + "github_to_server": "GitHub Actions → SSH/rsync → 43.134.16.246", "server_to_github": "Server → GitHub API → 仓库同步", "main_domain_access": "主域名:80/443 → Nginx → Node.js:3800 (production)", "preview_domain_access": "预览域名:80/443 → Nginx → Node.js:3801 (preview)", - "ip_direct_access": "150.109.76.244:80 → Nginx → Node.js:3800 (production)" + "ip_direct_access": "43.134.16.246:80 → Nginx → Node.js:3800 (production)" } } diff --git a/skyeye/guards/web-deploy-guard.json b/skyeye/guards/web-deploy-guard.json index ce93d0f1..d62d32e3 100644 --- a/skyeye/guards/web-deploy-guard.json +++ b/skyeye/guards/web-deploy-guard.json @@ -8,8 +8,8 @@ "created_by": "ZY-HUMANSIDE-FIX-2026-0325-002", "target": { "domain": "guanghulab.com", - "server_ip": "150.109.76.244", - "old_server_ip": "8.155.62.235 (阿里云·已弃用)", + "server_ip": "43.134.16.246", + "old_server_ip": "150.109.76.244 (香港·ZY-SVR-001·已弃用) / 8.155.62.235 (阿里云·已弃用)", "deploy_path": "/opt/zhuyuan", "pm2_processes": [ "zhuyuan-server", diff --git a/skyeye/infra-manifest.json b/skyeye/infra-manifest.json index d7791ecf..8d22c6fd 100644 --- a/skyeye/infra-manifest.json +++ b/skyeye/infra-manifest.json @@ -259,10 +259,10 @@ }, "guanghulab_website": { "service": "guanghulab.com Web Deployment", - "server_ip": "150.109.76.244", - "old_server_ip": "8.155.62.235 (阿里云·已弃用)", - "server_provider": "腾讯云轻量应用服务器 · 香港二区", - "server_code": "ZY-SVR-001", + "server_ip": "43.134.16.246", + "old_server_ip": "150.109.76.244 (香港·ZY-SVR-001·已弃用) / 8.155.62.235 (阿里云·已弃用)", + "server_provider": "腾讯云轻量应用服务器 · 新加坡二区", + "server_code": "ZY-SVR-002", "domain": "guanghulab.com", "deploy_path": "/opt/zhuyuan", "stack": {