feat: 完善服务监控与下游重投

tools/deploy/production-bootstrap.sh

@@ -6,6 +6,9 @@ REPO_URL="${REPO_URL:-http://175.27.255.91:3000/hectorzhao/lislgosms.git}"
 BRANCH="${BRANCH:-main}"
 PUBLIC_HTTP_PORT="${PUBLIC_HTTP_PORT:-12026}"
 API_PORT="${API_PORT:-3000}"
+API_HOST="${API_HOST:-127.0.0.1}"
+API_METRICS_HOST="${API_METRICS_HOST:-127.0.0.1}"
+API_METRICS_PORT="${API_METRICS_PORT:-9464}"
 API_ENABLE_SEND_WORKER="${API_ENABLE_SEND_WORKER:-true}"
 API_SEND_WORKER_CONCURRENCY="${API_SEND_WORKER_CONCURRENCY:-50}"
 GATEWAY_CONTROL_ADDR="${GATEWAY_CONTROL_ADDR:-127.0.0.1:8090}"
@@ -183,6 +186,9 @@ write_env() {
   cat >/etc/cmpp-platform/cmpp-platform.env <<EOF
 NODE_ENV=production
 API_PORT=${API_PORT}
+API_HOST=${API_HOST}
+API_METRICS_HOST=${API_METRICS_HOST}
+API_METRICS_PORT=${API_METRICS_PORT}
 API_ENABLE_SEND_WORKER=${API_ENABLE_SEND_WORKER}
 API_SEND_WORKER_CONCURRENCY=${API_SEND_WORKER_CONCURRENCY}
 DATABASE_URL=postgresql://${DB_USER}:${DB_PASSWORD}@127.0.0.1:5432/${DB_NAME}?schema=public

tools/deploy/production-deploy.sh

@@ -42,6 +42,7 @@ npm --prefix api ci --include=dev
 
 echo "[deploy] Verifying dependency security mitigations"
 npm run security:verify
+npm run deploy:verify
 
 echo "[deploy] Generating Prisma client and applying migrations"
 npm --prefix api run prisma:generate
@@ -69,13 +70,20 @@ echo "[deploy] Installing restricted security boundary"
 bash "$APP_DIR/tools/security/install-security-agent.sh"
 
 echo "[deploy] Ensuring HTTP response compression"
-cat >/etc/nginx/conf.d/cmpp-compression.conf <<'EOF'
+compression_config=/etc/nginx/conf.d/cmpp-compression.conf
+: >"$compression_config"
+if grep -RqsE --exclude='cmpp-compression.conf' '^[[:space:]]*gzip[[:space:]]+on;' \
+  /etc/nginx/nginx.conf /etc/nginx/conf.d /etc/nginx/sites-enabled 2>/dev/null; then
+  echo "[deploy] Reusing existing Nginx gzip configuration"
+else
+cat >"$compression_config" <<'EOF'
 gzip on;
 gzip_vary on;
 gzip_min_length 1024;
 gzip_comp_level 5;
 gzip_types application/json application/javascript text/javascript text/css text/plain text/csv image/svg+xml;
 EOF
+fi
 nginx -t
 
 echo "[deploy] Restarting services"

tools/deploy/verify-production-deployment.mjs

@@ -0,0 +1,29 @@
+import { readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+
+const deploy = readFileSync(resolve(import.meta.dirname, 'production-deploy.sh'), 'utf8');
+const bootstrap = readFileSync(resolve(import.meta.dirname, 'production-bootstrap.sh'), 'utf8');
+const apiMain = readFileSync(resolve(import.meta.dirname, '../../api/src/main.ts'), 'utf8');
+const required = [
+  'compression_config=/etc/nginx/conf.d/cmpp-compression.conf',
+  ': >"$compression_config"',
+  "--exclude='cmpp-compression.conf'",
+  "'^[[:space:]]*gzip[[:space:]]+on;'",
+  'Reusing existing Nginx gzip configuration',
+  'cat >"$compression_config"',
+];
+for (const marker of required) {
+  if (!deploy.includes(marker)) throw new Error(`production deploy is missing the idempotent Nginx compression guard: ${marker}`);
+}
+if (deploy.includes("cat >/etc/nginx/conf.d/cmpp-compression.conf <<'EOF'")) {
+  throw new Error('production deploy still writes a duplicate global gzip directive unconditionally');
+}
+
+for (const marker of ['API_HOST="${API_HOST:-127.0.0.1}"', 'API_HOST=${API_HOST}']) {
+  if (!bootstrap.includes(marker)) throw new Error(`production bootstrap is missing the loopback API binding: ${marker}`);
+}
+if (!apiMain.includes("process.env.API_HOST?.trim() || '127.0.0.1'") || !apiMain.includes('app.listen(port, host)')) {
+  throw new Error('NestJS API must bind to API_HOST and default to loopback');
+}
+
+console.log('Production deployment verified: Nginx compression is idempotent and NestJS defaults to loopback.');