fix: start nginx without resolving A-site at boot [deploy]

.gitea/workflows/ci.yml

@@ -195,10 +195,22 @@ jobs:
           export DEPLOYMENT="${REPO_NAME}-deploy"
           export CONTAINER="app"
 
-          echo "Deploying ${IMAGE_LATEST} to ${NAMESPACE}/${DEPLOYMENT}"
-          kubectl set image "deployment/${DEPLOYMENT}" "${CONTAINER}=${IMAGE_LATEST}" -n "${NAMESPACE}"
+          export IMAGE_SHA="104.225.236.253:30500/${REPO_NAME}:${GITHUB_SHA}"
+          echo "Deploying ${IMAGE_SHA} (and ${IMAGE_LATEST}) to ${NAMESPACE}/${DEPLOYMENT}"
+          kubectl set image "deployment/${DEPLOYMENT}" "${CONTAINER}=${IMAGE_SHA}" -n "${NAMESPACE}"
           kubectl rollout restart "deployment/${DEPLOYMENT}" -n "${NAMESPACE}"
-          kubectl rollout status "deployment/${DEPLOYMENT}" -n "${NAMESPACE}" --timeout=180s
+          if ! kubectl rollout status "deployment/${DEPLOYMENT}" -n "${NAMESPACE}" --timeout=180s; then
+            echo "❌ rollout timed out; dumping diagnostics"
+            kubectl get pods -n "${NAMESPACE}" -o wide || true
+            kubectl describe "deployment/${DEPLOYMENT}" -n "${NAMESPACE}" || true
+            kubectl get pods -n "${NAMESPACE}" -o name | while read -r p; do
+              echo "----- ${p} describe -----"
+              kubectl describe -n "${NAMESPACE}" "${p}" || true
+              echo "----- ${p} logs -----"
+              kubectl logs -n "${NAMESPACE}" "${p}" --all-containers --tail=80 || true
+            done
+            exit 1
+          fi
           echo "✅ Deployment completed successfully"
 
   deploy-only:

Dockerfile

@@ -1,12 +1,13 @@
 # CI 中先 pnpm build 产出 dist/；运行时由 nginx 托管，并把 /embed /images /api/contact 反代到 A 站
 FROM nginx:1.27-alpine
 
-# 集群内 A 站地址，可被 K8s env 覆盖
 ENV A_UPSTREAM=http://project57-deploy.ns-project57.svc.cluster.local:3000
-# 只替换 A_UPSTREAM，避免 envsubst 把 nginx 的 $host/$uri 等变量清空导致容器起不来
-ENV NGINX_ENVSUBST_FILTER=A_UPSTREAM
 
-COPY nginx.conf /etc/nginx/templates/default.conf.template
+# 不走 templates/envsubst，避免把 nginx 的 $host/$uri 清空
+COPY nginx.conf /etc/nginx/conf.d/default.conf
+COPY docker-entrypoint.d/40-a-upstream.sh /docker-entrypoint.d/40-a-upstream.sh
+RUN sed -i 's/\r$//' /docker-entrypoint.d/40-a-upstream.sh \
+  && chmod 0755 /docker-entrypoint.d/40-a-upstream.sh
 COPY dist /usr/share/nginx/html
 
 EXPOSE 3000

docker-entrypoint.d/40-a-upstream.sh

@@ -0,0 +1,18 @@
+#!/bin/sh
+set -eu
+
+CONF=/etc/nginx/conf.d/default.conf
+A_UPSTREAM="${A_UPSTREAM:-http://project57-deploy.ns-project57.svc.cluster.local:3000}"
+A_UPSTREAM="${A_UPSTREAM%/}"
+
+NS="$(awk '/^nameserver/{print $2; exit}' /etc/resolv.conf || true)"
+if [ -z "${NS}" ]; then
+  NS=kube-dns.kube-system.svc.cluster.local
+fi
+
+sed -i \
+  -e "s|__RESOLVER__|${NS}|g" \
+  -e "s|__A_UPSTREAM__|${A_UPSTREAM}|g" \
+  "${CONF}"
+
+nginx -t

nginx.conf

@@ -4,15 +4,18 @@ server {
   root /usr/share/nginx/html;
   index index.html;
 
+  # 由入口脚本写入：集群 DNS + A 站地址。用变量做 proxy_pass，启动时不解析上游，A 站暂不可达也不会让 nginx 起不来。
+  resolver __RESOLVER__ valid=10s ipv6=off;
+
   location = /api/health {
     default_type text/plain;
     add_header Content-Type text/plain;
     return 200 "ok";
   }
 
-  # A 站无公网域名：浏览器只访问 B 站，由 B 反代到集群内 project57
   location /embed/ {
-    proxy_pass ${A_UPSTREAM}/embed/;
+    set $a_upstream __A_UPSTREAM__;
+    proxy_pass $a_upstream;
     proxy_http_version 1.1;
     proxy_set_header Host $host;
     proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
@@ -20,7 +23,8 @@ server {
   }
 
   location /images/ {
-    proxy_pass ${A_UPSTREAM}/images/;
+    set $a_upstream __A_UPSTREAM__;
+    proxy_pass $a_upstream;
     proxy_http_version 1.1;
     proxy_set_header Host $host;
     proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
@@ -28,7 +32,8 @@ server {
   }
 
   location = /api/contact {
-    proxy_pass ${A_UPSTREAM}/api/contact;
+    set $a_upstream __A_UPSTREAM__;
+    proxy_pass $a_upstream;
     proxy_http_version 1.1;
     proxy_set_header Host $host;
     proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;