feat: PikaOA切换NC01数据库与本地附件备份

2026-07-16 02:48:39 +02:00
parent 656df984bd
commit 00b96769e4
10 changed files with 246 additions and 214 deletions
@@ -7,6 +7,7 @@ metadata:
  owner: unidesk
  relatedIssues:
    - 1875
+    - 2250

 cluster:
  role: primary
@@ -119,6 +120,16 @@ postgres:
        user: web_probe_monitor
        address: 10.42.0.0/16
        method: scram-sha-256
+      - type: hostssl
+        database: pikaoa
+        user: pikaoa
+        address: 10.42.0.0/16
+        method: scram-sha-256
+      - type: hostssl
+        database: pikaoa_test
+        user: pikaoa_test
+        address: 10.42.0.0/16
+        method: scram-sha-256

 secrets:
  source: master-local
@@ -166,6 +177,34 @@ secrets:
          WEB_PROBE_MONITOR_NC01_DB_NAME: web_probe_monitor
        randomHex:
          WEB_PROBE_MONITOR_NC01_DB_PASSWORD: 32
+    - name: pikaoa-nc01-db-credentials
+      sourceRef: platform-db/pikaoa-db.env
+      type: env
+      requiredKeys:
+        - PIKAOA_DB_USER
+        - PIKAOA_DB_PASSWORD
+        - PIKAOA_DB_NAME
+      createIfMissing:
+        enabled: true
+        values:
+          PIKAOA_DB_USER: pikaoa
+          PIKAOA_DB_NAME: pikaoa
+        randomHex:
+          PIKAOA_DB_PASSWORD: 32
+    - name: pikaoa-test-nc01-db-credentials
+      sourceRef: platform-db/pikaoa-test-db.env
+      type: env
+      requiredKeys:
+        - PIKAOA_TEST_DB_USER
+        - PIKAOA_TEST_DB_PASSWORD
+        - PIKAOA_TEST_DB_NAME
+      createIfMissing:
+        enabled: true
+        values:
+          PIKAOA_TEST_DB_USER: pikaoa_test
+          PIKAOA_TEST_DB_NAME: pikaoa_test
+        randomHex:
+          PIKAOA_TEST_DB_PASSWORD: 32

 objects:
  roles:
@@ -196,6 +235,24 @@ objects:
        createdb: false
        createrole: false
        superuser: false
+    - name: pikaoa
+      passwordRef:
+        sourceRef: platform-db/pikaoa-db.env
+        key: PIKAOA_DB_PASSWORD
+      login: true
+      attributes:
+        createdb: false
+        createrole: false
+        superuser: false
+    - name: pikaoa_test
+      passwordRef:
+        sourceRef: platform-db/pikaoa-test-db.env
+        key: PIKAOA_TEST_DB_PASSWORD
+      login: true
+      attributes:
+        createdb: false
+        createrole: false
+        superuser: false
  databases:
    - name: agentrun_v02
      owner: agentrun_v02
@@ -212,6 +269,16 @@ objects:
      encoding: UTF8
      locale: C.UTF-8
      extensions: []
+    - name: pikaoa
+      owner: pikaoa
+      encoding: UTF8
+      locale: C.UTF-8
+      extensions: []
+    - name: pikaoa_test
+      owner: pikaoa_test
+      encoding: UTF8
+      locale: C.UTF-8
+      extensions: []

 managedOperations:
  monitorReset:
@@ -267,15 +334,68 @@ exports:
        - scope: hwlab-web-probe-monitor
          secret: hwlab-web-probe-monitor-db
          key: DATABASE_URL
+    - name: pikaoa-database-url
+      sourceSecretRef: platform-db/pikaoa-db.env
+      render:
+        envKey: DATABASE_URL
+        format: postgresql://$(PIKAOA_DB_USER):$(PIKAOA_DB_PASSWORD)@$(PGHOST):5432/$(PIKAOA_DB_NAME)?sslmode=require
+        variables:
+          PGHOST: 10.42.0.1
+      writeToSecretSource:
+        sourceRef: platform-infra/pikaoa.env
+        key: DATABASE_URL
+        mode: update-or-insert
+      consumers:
+        - scope: pikaoa
+          secret: pikaoa-runtime
+          key: DATABASE_URL
+    - name: pikaoa-test-database-url
+      sourceSecretRef: platform-db/pikaoa-test-db.env
+      render:
+        envKey: DATABASE_URL
+        format: postgresql://$(PIKAOA_TEST_DB_USER):$(PIKAOA_TEST_DB_PASSWORD)@$(PGHOST):5432/$(PIKAOA_TEST_DB_NAME)?sslmode=require
+        variables:
+          PGHOST: 10.42.0.1
+      writeToSecretSource:
+        sourceRef: platform-infra/pikaoa-test.env
+        key: DATABASE_URL
+        mode: update-or-insert
+      consumers:
+        - scope: pikaoa-test
+          secret: pikaoa-test-runtime
+          key: DATABASE_URL

 backup:
-  logicalDump:
-    enabled: false
-    schedule: "*-*-* 03:37:00"
-    database: agentrun_v02
-    retentionDays: 7
-    destination:
-      type: local-directory
-      path: /var/backups/unidesk/platform-db/nc01/agentrun-v02
-    encryption:
-      enabled: false
+  logicalDumps:
+    - enabled: false
+      database: agentrun_v02
+      scriptPath: /usr/local/sbin/unidesk-nc01-agentrun-v02-pgdump.sh
+      serviceName: unidesk-nc01-agentrun-v02-pgdump.service
+      timerName: unidesk-nc01-agentrun-v02-pgdump.timer
+      schedule: "*-*-* 03:37:00"
+      retentionDays: 7
+      warningAfterHours: 36
+      destination:
+        type: nc01-local
+        path: /var/backups/unidesk/platform-db/nc01/agentrun-v02
+      pgDump:
+        host: 127.0.0.1
+        format: custom
+      encryption:
+        enabled: false
+    - enabled: true
+      database: pikaoa
+      scriptPath: /usr/local/sbin/unidesk-nc01-pikaoa-pgdump.sh
+      serviceName: unidesk-nc01-pikaoa-pgdump.service
+      timerName: unidesk-nc01-pikaoa-pgdump.timer
+      schedule: "*-*-* 03:47:00"
+      retentionDays: 14
+      warningAfterHours: 36
+      destination:
+        type: nc01-local
+        path: /var/backups/unidesk/platform-db/nc01/pikaoa
+      pgDump:
+        host: 127.0.0.1
+        format: custom
+      encryption:
+        enabled: false
@@ -361,31 +361,6 @@ postgres:
        user: hwlab_jd01_v03_app
        address: 74.48.78.17/32
        method: scram-sha-256
-      - type: hostssl
-        database: pikaoa
-        user: pikaoa
-        address: 10.0.8.0/22
-        method: scram-sha-256
-      - type: hostssl
-        database: pikaoa
-        user: pikaoa
-        address: 74.48.78.17/32
-        method: scram-sha-256
-      - type: hostssl
-        database: pikaoa
-        user: pikaoa
-        address: 152.53.229.148/32
-        method: scram-sha-256
-      - type: hostssl
-        database: pikaoa_test
-        user: pikaoa_test
-        address: 10.0.8.0/22
-        method: scram-sha-256
-      - type: hostssl
-        database: pikaoa_test
-        user: pikaoa_test
-        address: 152.53.229.148/32
-        method: scram-sha-256

 secrets:
  source: master-local
@@ -489,34 +464,6 @@ secrets:
          HWLAB_JD01_V03_DB_NAME: hwlab_jd01_v03
        randomHex:
          HWLAB_JD01_V03_DB_PASSWORD: 32
-    - name: pikaoa-db-credentials
-      sourceRef: platform-db/pikaoa-db.env
-      type: env
-      requiredKeys:
-        - PIKAOA_DB_USER
-        - PIKAOA_DB_PASSWORD
-        - PIKAOA_DB_NAME
-      createIfMissing:
-        enabled: true
-        values:
-          PIKAOA_DB_USER: pikaoa
-          PIKAOA_DB_NAME: pikaoa
-        randomHex:
-          PIKAOA_DB_PASSWORD: 32
-    - name: pikaoa-test-db-credentials
-      sourceRef: platform-db/pikaoa-test-db.env
-      type: env
-      requiredKeys:
-        - PIKAOA_TEST_DB_USER
-        - PIKAOA_TEST_DB_PASSWORD
-        - PIKAOA_TEST_DB_NAME
-      createIfMissing:
-        enabled: true
-        values:
-          PIKAOA_TEST_DB_USER: pikaoa_test
-          PIKAOA_TEST_DB_NAME: pikaoa_test
-        randomHex:
-          PIKAOA_TEST_DB_PASSWORD: 32
 objects:
  roles:
    - name: sub2api
@@ -582,24 +529,6 @@ objects:
        createdb: false
        createrole: false
        superuser: false
-    - name: pikaoa
-      passwordRef:
-        sourceRef: platform-db/pikaoa-db.env
-        key: PIKAOA_DB_PASSWORD
-      login: true
-      attributes:
-        createdb: false
-        createrole: false
-        superuser: false
-    - name: pikaoa_test
-      passwordRef:
-        sourceRef: platform-db/pikaoa-test-db.env
-        key: PIKAOA_TEST_DB_PASSWORD
-      login: true
-      attributes:
-        createdb: false
-        createrole: false
-        superuser: false
  databases:
    - name: sub2api
      owner: sub2api
@@ -636,16 +565,6 @@ objects:
      encoding: UTF8
      locale: C.UTF-8
      extensions: []
-    - name: pikaoa
-      owner: pikaoa
-      encoding: UTF8
-      locale: C.UTF-8
-      extensions: []
-    - name: pikaoa_test
-      owner: pikaoa_test
-      encoding: UTF8
-      locale: C.UTF-8
-      extensions: []

 exports:
  connectionStrings:
@@ -788,38 +707,6 @@ exports:
        - scope: hwlab-jd01-v03
          secret: hwlab-v03-openfga
          key: DATASTORE_URI
-    - name: pikaoa-database-url
-      sourceSecretRef: platform-db/pikaoa-db.env
-      render:
-        envKey: DATABASE_URL
-        format: postgresql://$(PIKAOA_DB_USER):$(PIKAOA_DB_PASSWORD)@$(PGHOST):$(PGPORT)/$(PIKAOA_DB_NAME)?sslmode=require
-        variables:
-          PGHOST: 82.156.23.220
-          PGPORT: "5432"
-      writeToSecretSource:
-        sourceRef: platform-infra/pikaoa.env
-        key: DATABASE_URL
-        mode: update-or-insert
-      consumers:
-        - scope: pikaoa
-          secret: pikaoa-runtime
-          key: DATABASE_URL
-    - name: pikaoa-test-database-url
-      sourceSecretRef: platform-db/pikaoa-test-db.env
-      render:
-        envKey: DATABASE_URL
-        format: postgresql://$(PIKAOA_TEST_DB_USER):$(PIKAOA_TEST_DB_PASSWORD)@$(PGHOST):$(PGPORT)/$(PIKAOA_TEST_DB_NAME)?sslmode=require
-        variables:
-          PGHOST: 82.156.23.220
-          PGPORT: "5432"
-      writeToSecretSource:
-        sourceRef: platform-infra/pikaoa-test.env
-        key: DATABASE_URL
-        mode: update-or-insert
-      consumers:
-        - scope: pikaoa-test
-          secret: pikaoa-test-runtime
-          key: DATABASE_URL

 backup:
  phase: minimum-restoreable
@@ -841,22 +728,6 @@ backup:
      encryption:
        enabled: false
        futureKeyRef: platform-db/backup-age-recipient.txt
-    - enabled: true
-      database: pikaoa
-      scriptPath: /usr/local/sbin/unidesk-pk01-pikaoa-pgdump.sh
-      serviceName: unidesk-pk01-pikaoa-pgdump.service
-      timerName: unidesk-pk01-pikaoa-pgdump.timer
-      schedule: "*-*-* 03:37:00"
-      retentionDays: 14
-      warningAfterHours: 36
-      destination:
-        type: pk01-local
-        path: /var/backups/unidesk/platform-db/pk01/pikaoa
-      pgDump:
-        host: 127.0.0.1
-        format: custom
-      encryption:
-        enabled: false
        futureKeyRef: platform-db/backup-age-recipient.txt
  physicalWalArchive:
    enabled: false
@@ -889,12 +760,6 @@ observability:
    - kind: psql-app-role
      database: hwlab_d601_v03
      user: hwlab_d601_v03_app
-    - kind: psql-app-role
-      database: pikaoa
-      user: pikaoa
-    - kind: psql-app-role
-      database: pikaoa_test
-      user: pikaoa_test
    - kind: disk-free
      path: /var/lib/postgresql/16/main
      minFreeGiB: 10