feat: Implement initial Cloud Run deployment configurations for the accounts service, including a preview environment and stunnel sidecar.

2026-02-10 12:59:34 +08:00 · 2026-02-10 12:59:34 +08:00 · e2825aaf1a
commit e2825aaf1a
parent e20d219143
3 changed files with 163 additions and 1 deletions
--- a/deploy/README.md
+++ b/deploy/README.md
@ -0,0 +1,59 @@
+# Deployment Configuration Guide
+
+This directory contains the deployment configurations and procedures for the Accounts Service (`accounts.svc.plus`) on Google Cloud Run.
+
+## Environments
+
+### 1. Production Environment
+- **Service Name**: `accounts-svc-plus`
+- **Repository**: [https://github.com/cloud-neutral-toolkit/accounts.svc.plus.git](https://github.com/cloud-neutral-toolkit/accounts.svc.plus.git)
+- **Branch**: `release/v0.1`
+- **Configuration File**: `gcp/cloud-run/prod-service.yaml`
+- **Deployment Status**: [Production URL](https://accounts-svc-plus-266500572462.asia-northeast1.run.app)
+
+### 2. Preview Environment
+- **Service Name**: `preview-accounts-svc-plus`
+- **Repository**: [https://github.com/cloud-neutral-toolkit/accounts.svc.plus.git](https://github.com/cloud-neutral-toolkit/accounts.svc.plus.git)
+- **Branch**: `main`
+- **Configuration File**: `gcp/cloud-run/preview-service.yaml`
+- **Deployment Status**: [Preview URL](https://preview-accounts-svc-plus-266500572462.asia-northeast1.run.app)
+
+---
+
+## Deployment Procedures
+
+### Build and Deploy Preview (from `main`)
+```bash
+# 1. Switch to main branch
+git checkout main
+
+# 2. Build image via Cloud Build
+gcloud builds submit --tag asia-northeast1-docker.pkg.dev/xzerolab-480008/cloud-run-source-deploy/accounts.svc.plus/preview-accounts-svc-plus:latest --project xzerolab-480008
+
+# 3. Apply Cloud Run configuration
+gcloud run services replace deploy/gcp/cloud-run/preview-service.yaml --project xzerolab-480008 --region asia-northeast1
+
+# 4. Ensure public access
+gcloud run services add-iam-policy-binding preview-accounts-svc-plus --project xzerolab-480008 --region asia-northeast1 --member="allUsers" --role="roles/run.invoker"
+```
+
+### Build and Deploy Production (from `release/v0.1`)
+```bash
+# 1. Switch to release branch
+git checkout release/v0.1
+
+# 2. Build image via Cloud Build
+gcloud builds submit --tag asia-northeast1-docker.pkg.dev/xzerolab-480008/cloud-run-source-deploy/accounts.svc.plus/accounts-svc-plus:v0.1 --project xzerolab-480008
+
+# 3. Apply Cloud Run configuration
+# Note: Ensure the image path in service.yaml matches the versioned tag
+gcloud run services replace deploy/gcp/cloud-run/prod-service.yaml --project xzerolab-480008 --region asia-northeast1
+```
+
+## Infrastructure Components
+- **Stunnel Sidecar**: Used for secure connection to the PostgreSQL database. Configuration is stored in Secret Manager as `stunnel-config`.
+- **Secrets**:
+  - `postgres-password`: Database access.
+  - `internal-service-token`: RPC/Internal communication.
+  - `stunnel-config`: Sidecar tunnel settings.
+  - `smtp-username` / `smtp-password`: Email delivery.
--- a/deploy/gcp/cloud-run/preview-service.yaml
+++ b/deploy/gcp/cloud-run/preview-service.yaml
@ -0,0 +1,103 @@
+apiVersion: serving.knative.dev/v1
+kind: Service
+metadata:
+  name: preview-accounts-svc-plus
+  labels:
+    cloud.googleapis.com/location: asia-northeast1
+  annotations:
+    run.googleapis.com/launch-stage: BETA
+    run.googleapis.com/ingress: all
+spec:
+  template:
+    metadata:
+      annotations:
+        run.googleapis.com/startup-cpu-boost: 'true'
+        autoscaling.knative.dev/maxScale: '1'
+    spec:
+      containerConcurrency: 80
+      timeoutSeconds: 300
+      serviceAccountName: 266500572462-compute@developer.gserviceaccount.com
+      containers:
+      # --- 主应用容器 ---
+      - name: accounts-api
+        image: asia-northeast1-docker.pkg.dev/xzerolab-480008/cloud-run-source-deploy/accounts.svc.plus/preview-accounts-svc-plus:latest
+        ports:
+        - name: http1
+          containerPort: 8080
+        env:
+        - name: CONFIG_TEMPLATE
+          value: "/app/config/account.cloudrun.yaml"
+        - name: PGADMIN_PASSWORD
+          value: admin_password
+        - name: DB_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: postgres-password
+              key: latest
+        - name: POSTGRES_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: postgres-password
+              key: latest
+        - name: DB_HOST
+          value: "127.0.0.1"
+        - name: DB_PORT
+          value: "15432"
+        - name: DB_USER
+          value: postgres
+        - name: POSTGRES_USER
+          value: postgres
+        - name: DB_NAME
+          value: account
+        - name: INTERNAL_SERVICE_TOKEN
+          valueFrom:
+            secretKeyRef:
+              name: internal-service-token
+              key: latest
+        # --- SMTP Configuration ---
+        - name: SMTP_HOST
+          value: "smtp.qq.com"
+        - name: SMTP_PORT
+          value: "587"
+        - name: SMTP_FROM
+          value: "XControl Account <manbuzhe2009@qq.com>"
+        - name: SMTP_USERNAME
+          valueFrom:
+            secretKeyRef:
+              name: smtp-username
+              key: latest
+        - name: SMTP_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: smtp-password
+              key: latest
+        resources:
+          limits:
+            cpu: 1000m
+            memory: 512Mi
+        startupProbe:
+          timeoutSeconds: 240
+          periodSeconds: 240
+          failureThreshold: 1
+          tcpSocket:
+            port: 8080
+
+      # --- Stunnel Sidecar 容器 ---
+      - name: stunnel-sidecar
+        image: dweomer/stunnel
+        volumeMounts:
+        - name: stunnel-conf-vol
+          mountPath: /etc/stunnel
+        command: ["stunnel", "/etc/stunnel/stunnel.conf"]
+        resources:
+          limits:
+            cpu: 200m
+            memory: 128Mi
+
+      volumes:
+      - name: stunnel-conf-vol
+        secret:
+          secretName: stunnel-config
+          items:
+          - key: latest
+            path: stunnel.conf
--- a/deploy/gcp/cloud-run/prod-service.yaml
+++ b/deploy/gcp/cloud-run/prod-service.yaml
@ -20,7 +20,7 @@ spec:
      containers:
      # --- 主应用容器 ---
      - name: accounts-api
-        image: asia-northeast1-docker.pkg.dev/xzerolab-480008/cloud-run-source-deploy/accounts.svc.plus/accounts-svc-plus:latest
+        image: asia-northeast1-docker.pkg.dev/xzerolab-480008/cloud-run-source-deploy/accounts.svc.plus/accounts-svc-plus:v0.1
        ports:
        - name: http1
          containerPort: 8080