feat: complete production blue-green deployment

deploy/scripts/deploy-blue-green-service.sh

@@ -33,7 +33,7 @@ env_value() {
 
 service_contract() {
   case "$SERVICE:$COMPOSE_FILE" in
-    gateway:*) echo "gateway|9000|9000|gateway|gateway" ;;
+    gateway:*) echo "gateway|9000|9000|gateway|gateway-active" ;;
     auth:*) echo "auth|9100|9100|auth-service|auth" ;;
     iam:*) echo "iam|9201|9201|iam-service|iam" ;;
     firstleg:*) echo "business|9202|9202|firstleg-service|firstleg" ;;
@@ -44,11 +44,11 @@ service_contract() {
     print:*) echo "print|9207|9207|print-service|print" ;;
     integration-service:*) echo "integration|9210|9210|integration-service|integration-service" ;;
     audit-service:*) echo "audit|9700|9700|audit-service|audit-service" ;;
-    gateway-overseas:*) echo "gateway-overseas|9300|9300|gateway-overseas|gateway-overseas" ;;
+    gateway-overseas:*) echo "gateway-overseas|9300|9300|gateway-overseas|gateway-overseas-active" ;;
     lastleg-service:*) echo "lastleg|9303|9303|lastleg-service|lastleg-service" ;;
     warehouse-overseas-service:*) echo "warehouse-overseas|9305|9305|warehouse-overseas-service|warehouse-overseas-service" ;;
-    event-bridge-service:*overseas*) echo "event-bridge-overseas|9312|9313|event-bridge-service|event-bridge-overseas" ;;
-    event-bridge-service:*) echo "event-bridge|9312|9312|event-bridge-service|event-bridge-cn" ;;
+    event-bridge-service:*overseas*) echo "event-bridge-overseas|9312|9313|event-bridge-overseas|event-bridge-overseas" ;;
+    event-bridge-service:*) echo "event-bridge|9312|9312|event-bridge-cn|event-bridge-cn" ;;
     *) echo "不支持蓝绿部署的服务: $SERVICE" >&2; exit 2 ;;
   esac
 }
@@ -173,6 +173,7 @@ start_worker_candidate() {
       -e "BAIYUE_RELEASE_ID=$IMAGE_TAG" "$SERVICE" >/dev/null; then
     return 1
   fi
+  docker network connect "$ROUTING_NETWORK" "$worker_candidate"
   if ! wait_for_container "$worker_candidate" "候选 Worker"; then
     docker logs --tail 200 "$worker_candidate" 2>&1 || true
     docker rm -f "$worker_candidate" >/dev/null 2>&1 || true
@@ -182,38 +183,50 @@ start_worker_candidate() {
   [ "$worker_image" = "$IMAGE" ] || return 1
 }
 
-connect_routing_alias() {
-  alias_name="$1"
-  container="$2"
+connect_routing_aliases() {
+  container="$1"
+  shift
   docker network inspect "$ROUTING_NETWORK" --format '{{json .Containers}}' | grep -q "\"$container\"" \
     && return 0
-  docker network connect --alias "$alias_name" "$ROUTING_NETWORK" "$container"
+  set -- docker network connect $(for alias_name in "$@"; do printf '%s\n' --alias "$alias_name"; done)
+  "$@" "$ROUTING_NETWORK" "$container"
 }
 
 bootstrap_legacy_routes() {
   for pair in \
-    gateway:gateway auth:auth iam:iam firstleg:business finance:finance order:order \
-    warehouse:warehouse file:file print:print integration-service:integration audit-service:audit \
-    gateway-overseas:gateway-overseas lastleg-service:lastleg \
-    warehouse-overseas-service:warehouse-overseas event-bridge-cn:event-bridge \
-    event-bridge-overseas:event-bridge-overseas
+    gateway-active,gateway:gateway auth,auth-service:auth iam,iam-service:iam \
+    firstleg,firstleg-service:business finance,finance-service:finance order,order-service:order \
+    warehouse,warehouse-service:warehouse file,file-service:file print,print-service:print \
+    integration-service:integration audit-service:audit \
+    gateway-overseas-active,gateway-overseas:gateway-overseas \
+    lastleg-service:lastleg warehouse-overseas-service:warehouse-overseas \
+    event-bridge-cn:event-bridge event-bridge-overseas:event-bridge-overseas
   do
-    alias_name="${pair%%:*}"
+    aliases="${pair%%:*}"
     stem="${pair#*:}"
     container="firstleg-${DEPLOY_ENV}-${stem}"
     if docker inspect "$container" >/dev/null 2>&1; then
-      connect_routing_alias "$alias_name" "$container" || true
+      connect_routing_aliases "$container" $(printf '%s' "$aliases" | tr ',' ' ') || true
     fi
   done
   for container in firstleg-prod-admin-web firstleg-prod-client-web; do
     if docker inspect "$container" >/dev/null 2>&1; then
-      connect_routing_alias "${container##*-}" "$container" || true
+      connect_routing_aliases "$container" "${container##*-}" || true
     fi
   done
 }
 
 switch_gateway_proxy() {
   [ "$SERVICE" = "gateway" ] || [ "$SERVICE" = "gateway-overseas" ] || return 0
+  if [ "$SERVICE" = "gateway" ]; then required_alias=gateway-active; else required_alias=gateway-overseas-active; fi
+  for frontend in firstleg-prod-admin-web-blue firstleg-prod-admin-web-green \
+    firstleg-prod-client-web-blue firstleg-prod-client-web-green; do
+    if docker inspect "$frontend" >/dev/null 2>&1 \
+      && ! docker exec "$frontend" nginx -T 2>&1 | grep -q "$required_alias"; then
+      echo "$frontend 尚未使用稳定上游 $required_alias，拒绝切换 Gateway" >&2
+      return 1
+    fi
+  done
   if [ "$SERVICE" = "gateway" ]; then
     config="$(env_value GATEWAY_BLUE_GREEN_NGINX_CONFIG)"
     config="${config:-/www/server/panel/vhost/nginx/api-cn.buggoglobal.com.conf}"
@@ -241,6 +254,31 @@ switch_gateway_proxy() {
   rm -f "$backup"
 }
 
+reload_frontend_proxies() {
+  [ "$SERVICE" = "gateway" ] || [ "$SERVICE" = "gateway-overseas" ] || return 0
+  for frontend in firstleg-prod-admin-web-blue firstleg-prod-admin-web-green \
+    firstleg-prod-client-web-blue firstleg-prod-client-web-green; do
+    if docker inspect "$frontend" >/dev/null 2>&1; then
+      docker exec "$frontend" nginx -t
+      docker exec "$frontend" nginx -s reload
+    fi
+  done
+}
+
+rollback_gateway_proxy() {
+  [ "$SERVICE" = "gateway" ] || [ "$SERVICE" = "gateway-overseas" ] || return 0
+  if [ "$SERVICE" = "gateway" ]; then
+    config="$(env_value GATEWAY_BLUE_GREEN_NGINX_CONFIG)"
+    config="${config:-/www/server/panel/vhost/nginx/api-cn.buggoglobal.com.conf}"
+  else
+    config="$(env_value GATEWAY_OVERSEAS_BLUE_GREEN_NGINX_CONFIG)"
+    config="${config:-/www/server/panel/vhost/nginx/api-global.buggoglobal.com.conf}"
+  fi
+  old_port="${active_port:-$BASE_PORT}"
+  sed -i "s#127\.0\.0\.1:$target_port#127.0.0.1:$old_port#g" "$config"
+  nginx -t && nginx -s reload
+}
+
 bootstrap_legacy_routes
 
 export DEPLOY_ENV IMAGE_REPOSITORY IMAGE_TAG
@@ -276,8 +314,11 @@ if [ "$running_image" != "$IMAGE" ]; then
   exit 1
 fi
 
-connect_routing_alias "$ROUTING_ALIAS" "$candidate"
-[ "$NACOS_SERVICE" = "$SERVICE" ] || connect_routing_alias "$NACOS_SERVICE" "$candidate"
+if [ "$NACOS_SERVICE" = "$ROUTING_ALIAS" ]; then
+  connect_routing_aliases "$candidate" "$ROUTING_ALIAS"
+else
+  connect_routing_aliases "$candidate" "$ROUTING_ALIAS" "$NACOS_SERVICE"
+fi
 
 if [ "$STABILIZATION_SECONDS" -gt 0 ]; then
   echo "候选槽稳定观察 ${STABILIZATION_SECONDS}s"
@@ -290,13 +331,60 @@ if ! switch_gateway_proxy; then
   exit 1
 fi
 
-if [ -n "$active_container" ] && docker inspect "$active_container" >/dev/null 2>&1; then
-  echo "优雅停止旧实例: $active_container"
-  docker stop --time "$STOP_TIMEOUT" "$active_container" >/dev/null
-  docker rm "$active_container" >/dev/null
+worker_required=false
+if needs_worker; then worker_required=true; fi
+
+if [ "$worker_required" = true ] && [ "$active_slot" != legacy ]; then
+  if [ -n "$active_worker" ] && docker inspect "$active_worker" >/dev/null 2>&1; then
+    echo "暂停旧 Worker，避免新旧任务并行: $active_worker"
+    docker stop --time "$STOP_TIMEOUT" "$active_worker" >/dev/null
+  fi
+  if ! start_worker_candidate; then
+    [ -z "$active_worker" ] || docker start "$active_worker" >/dev/null 2>&1 || true
+    rollback_gateway_proxy || true
+    cleanup_candidate
+    exit 1
+  fi
 fi
 
-printf '%s|%s|%s|%s\n' "$target_slot" "$candidate" "$target_port" "$IMAGE" > "$STATE_FILE.tmp"
+old_container_stopped=false
+if [ -n "$active_container" ] && docker inspect "$active_container" >/dev/null 2>&1; then
+  echo "优雅停止旧 Web 实例: $active_container"
+  docker stop --time "$STOP_TIMEOUT" "$active_container" >/dev/null
+  old_container_stopped=true
+fi
+
+if [ "$worker_required" = true ] && [ "$active_slot" = legacy ]; then
+  if ! start_worker_candidate; then
+    [ "$old_container_stopped" = false ] || docker start "$active_container" >/dev/null 2>&1 || true
+    rollback_gateway_proxy || true
+    cleanup_candidate
+    exit 1
+  fi
+fi
+
+if ! reload_frontend_proxies; then
+  [ "$old_container_stopped" = false ] || docker start "$active_container" >/dev/null 2>&1 || true
+  if [ "$worker_required" = true ]; then
+    docker rm -f "$worker_candidate" >/dev/null 2>&1 || true
+    [ -z "$active_worker" ] || docker start "$active_worker" >/dev/null 2>&1 || true
+  fi
+  rollback_gateway_proxy || true
+  cleanup_candidate
+  reload_frontend_proxies || true
+  exit 1
+fi
+
+[ -z "$active_worker" ] || [ "$active_worker" = "$worker_candidate" ] \
+  || docker rm "$active_worker" >/dev/null 2>&1 || true
+[ "$old_container_stopped" = false ] || docker rm "$active_container" >/dev/null
+
+if [ "$worker_required" = true ]; then
+  next_worker="$worker_candidate"
+else
+  next_worker=""
+fi
+printf '%s|%s|%s|%s|%s\n' "$target_slot" "$candidate" "$target_port" "$IMAGE" "$next_worker" > "$STATE_FILE.tmp"
 chmod 640 "$STATE_FILE.tmp"
 mv -f "$STATE_FILE.tmp" "$STATE_FILE"
 echo "蓝绿切换完成: service=$SERVICE active=$target_slot container=$candidate port=$target_port"

deploy/scripts/deploy-built-service.sh

@@ -348,6 +348,16 @@ deploy_local() {
 
 if [ "${TARGET_IS_LOCAL:-false}" = "true" ]; then
   echo "镜像已在目标服务器本机，直接部署: $IMAGE"
+  if [ "$DEPLOY_ENV" = "production" ]; then
+    printf '%s' "$REGISTRY_PASSWORD" | docker login -u "$REGISTRY_USER" --password-stdin "$REGISTRY_HOST"
+    trap local_registry_logout EXIT HUP INT TERM
+    docker pull "$IMAGE"
+    sh deploy/scripts/deploy-blue-green-service.sh \
+      "$DEPLOY_ENV" "$IMAGE_REPOSITORY" "$IMAGE_TAG" "$SERVICE" "$ENV_FILE" "$COMPOSE_FILE" "$PROJECT_NAME"
+    local_registry_logout
+    trap - EXIT HUP INT TERM
+    exit 0
+  fi
   deploy_local
   exit 0
 fi

deploy/scripts/deploy-services.sh

@@ -188,6 +188,19 @@ if [ "$DEPLOY_ENV" = "development" ]; then
     "$IMAGE_REPOSITORY" "$IMAGE_TAG" "$SERVICE_CSV" "$ENV_FILE"
 fi
 
+if [ "$DEPLOY_ENV" = "production" ]; then
+  docker compose \
+    --project-name "$PROJECT_NAME" \
+    --env-file "$ENV_FILE" \
+    -f "$COMPOSE_FILE" \
+    pull $SERVICES
+  for service in $SERVICES; do
+    sh deploy/scripts/deploy-blue-green-service.sh \
+      "$DEPLOY_ENV" "$IMAGE_REPOSITORY" "$IMAGE_TAG" "$service" "$ENV_FILE" "$COMPOSE_FILE" "$PROJECT_NAME"
+  done
+  exit 0
+fi
+
 docker compose \
   --project-name "$PROJECT_NAME" \
   --env-file "$ENV_FILE" \