From 54764156bf0b360b76c641d46c9e1a4afdd7339c Mon Sep 17 00:00:00 2001
From: ouyangxq <775153912@qq.com>
Date: Wed, 7 Oct 2026 11:09:42 +0800
Subject: [PATCH] fix(deploy): support isolated temporary production release

---
 .dockerignore                           |  3 +++
 deploy/Dockerfile.h5.production         |  5 +++++
 deploy/docker-compose.h5.production.yml | 29 +++++++++++++++++++++++++
 deploy/nginx.production.conf.template   | 25 +++++++++++++++++++++
 tests/h5-deployment.test.mjs            | 12 ++++++++++
 5 files changed, 74 insertions(+)
 create mode 100644 deploy/Dockerfile.h5.production
 create mode 100644 deploy/docker-compose.h5.production.yml
 create mode 100644 deploy/nginx.production.conf.template

diff --git a/.dockerignore b/.dockerignore
index 2700753..8d714a4 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -8,3 +8,6 @@
 !unpackage/dist/build/
 !unpackage/dist/build/web/
 !unpackage/dist/build/web/**
+
+!deploy/Dockerfile.h5.production
+!deploy/nginx.production.conf.template
diff --git a/deploy/Dockerfile.h5.production b/deploy/Dockerfile.h5.production
new file mode 100644
index 0000000..f08e893
--- /dev/null
+++ b/deploy/Dockerfile.h5.production
@@ -0,0 +1,5 @@
+ARG NGINX_BASE_IMAGE=nginx:1.27-alpine
+FROM ${NGINX_BASE_IMAGE}
+COPY deploy/nginx.production.conf.template /etc/nginx/templates/default.conf.template
+COPY unpackage/dist/build/web/ /srv/pda-h5/
+EXPOSE 80
diff --git a/deploy/docker-compose.h5.production.yml b/deploy/docker-compose.h5.production.yml
new file mode 100644
index 0000000..60dbdfc
--- /dev/null
+++ b/deploy/docker-compose.h5.production.yml
@@ -0,0 +1,29 @@
+name: firstleg-production-pda-domestic-h5
+services:
+  pda-domestic-h5:
+    build:
+      context: ..
+      dockerfile: deploy/Dockerfile.h5.production
+      args:
+        NGINX_BASE_IMAGE: "${NGINX_BASE_IMAGE:-nginx:1.27-alpine}"
+    image: pda-domestic-h5-prod:${IMAGE_TAG:?IMAGE_TAG is required}
+    container_name: pda-domestic-h5-prod
+    restart: unless-stopped
+    environment:
+      API_UPSTREAM: "http://gateway:9000"
+    ports:
+      - "127.0.0.1:${HOST_PORT:-29005}:80"
+    healthcheck:
+      test: ["CMD-SHELL", "wget -qO /dev/null http://127.0.0.1/healthz && wget -qO /dev/null http://127.0.0.1/"]
+      interval: 5s
+      timeout: 3s
+      retries: 12
+      start_period: 5s
+    networks:
+      backend:
+        aliases:
+          - pda-domestic-h5-prod
+networks:
+  backend:
+    external: true
+    name: firstleg-production-network
diff --git a/deploy/nginx.production.conf.template b/deploy/nginx.production.conf.template
new file mode 100644
index 0000000..4ce203e
--- /dev/null
+++ b/deploy/nginx.production.conf.template
@@ -0,0 +1,25 @@
+server {
+    listen 80;
+    server_name _;
+    root /srv/pda-h5;
+
+    location = /healthz {
+        default_type text/plain;
+        add_header Cache-Control "no-store" always;
+        return 200 "ok\n";
+    }
+    location /gateway-api/ {
+        client_max_body_size 55m;
+        proxy_pass ${API_UPSTREAM}/api/;
+        proxy_http_version 1.1;
+        proxy_set_header Host $proxy_host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+    location / {
+        index index.html;
+        try_files $uri $uri/ =404;
+        add_header Cache-Control "no-store" always;
+    }
+}
diff --git a/tests/h5-deployment.test.mjs b/tests/h5-deployment.test.mjs
index 01a8827..3c38fde 100644
--- a/tests/h5-deployment.test.mjs
+++ b/tests/h5-deployment.test.mjs
@@ -72,3 +72,15 @@ test('H5 proxy uses the shared gateway prefix and preserves API suffixes', async
     assert.equal(proxy['/gateway-api'].rewrite(`/gateway-api${suffix}`), `/api${suffix}`)
   }
 })
+
+test('gray H5 runs on an isolated network with same-origin Gateway API', async () => {
+  const compose = await read('../deploy/docker-compose.h5.production.yml')
+  const nginx = await read('../deploy/nginx.production.conf.template')
+  const docker = await read('../deploy/Dockerfile.h5.production')
+  assert.match(compose, /name: firstleg-production-network/)
+  assert.match(compose, /127\.0\.0\.1:/)
+  assert.doesNotMatch(compose, /test-network|gateway-overseas/)
+  assert.match(nginx, /location \/gateway-api\//)
+  assert.ok(nginx.includes('proxy_pass ${API_UPSTREAM}/api/;'))
+  assert.match(docker, /COPY deploy\/nginx.production.conf.template \/etc\/nginx\/templates\/default.conf.template/)
+})