开发、架构、部署与配置，一份手册讲清楚

mysql -u root -p < jy-site/blog_site.sql
mysql -u root -p blog_site < jy-site/migrations/001_site_deploy_settings.sql
mysql -u root -p blog_site < jy-site/migrations/002_auto_publish_setting.sql

cp jy-site/.env.example jy-site/.env
cp jy-admin/.env.example jy-admin/.env

# 编辑两个 .env：
# - DATABASE_* 指向同一个 blog_site
# - jy-admin 的 SESSION_SECRET 至少 32 字符
# - 需要发布按钮时再配置 GITHUB_REPOSITORY / GITHUB_TOKEN

jy_prj/
├── .github/workflows/
│   ├── ci-jy-admin.yml            # 管理端 TypeScript CI
│   └── deploy-jy-site.yml         # 静态站构建与发布
├── jy-site/
│   ├── src/routes/                # SvelteKit 页面与端点
│   ├── src/lib/                   # 组件、Markdown、主题、数据库读取
│   ├── scripts/                   # 搜索索引、sitemap、构建规范化
│   ├── migrations/                # 手工 SQL 增量
│   ├── static/                    # PWA、图片、搜索索引等
│   ├── blog_site.sql              # 全量 schema + seed
│   └── nginx.conf                 # 当前 HTTP 静态站参考配置
├── jy-admin/
│   ├── app/                       # Next.js App Router
│   ├── components/                # Ant Design 管理组件
│   └── lib/                       # Server Actions、DB、会话、GitHub API
└── README.md                      # 当前高层说明

cd jy-site
pnpm build:static
pnpm preview

React Client Component
  └─ Server Action ('use server')
      ├─ getSession() / requireUser()
      ├─ getPool() → mysql2/promise
      ├─ 事务 / 参数化 SQL
      ├─ revalidatePath()
      └─ status=published 时可选 triggerSitePublish()

cd jy-admin
pnpm install --frozen-lockfile
pnpm verify
NODE_ENV=production pnpm start  # :5174

DATABASE_HOST=127.0.0.1
DATABASE_PORT=3306
DATABASE_USER=jy_app
DATABASE_PASSWORD=${JY_DATABASE_PASSWORD}
DATABASE_NAME=blog_site
SITE_URL=https://blog.example.com

# jy-admin only
SESSION_SECRET=${JY_SESSION_SECRET}
GITHUB_REPOSITORY=example-org/jy-prj
GITHUB_TOKEN=${JY_GITHUB_TOKEN}

pnpm install --frozen-lockfile
node --import tsx scripts/build-static.ts

rsync -avz --delete \
  jy-site/build/ "${DEPLOY_SSH_USER}@${DEPLOY_SSH_HOST}:${DEPLOY_SSH_PATH}/"

deploy/
├── compose.production.yml
├── admin.Dockerfile
├── site-builder.Dockerfile
├── nginx.conf
├── deploy-site.sh
├── backup-db.sh
└── env/
    ├── admin.env.example
    ├── database.env.example
    └── site-build.env.example

/srv/jy/
├── app/                 # 真实 Git checkout
├── site-releases/
│   ├── 20260814-abcdef/
│   └── current -> 20260814-abcdef
└── backups/

name: jy-production

services:
  db:
    image: mysql:8.4
    restart: unless-stopped
    env_file: ./env/database.env
    volumes:
      - mysql-data:/var/lib/mysql
      - ../jy-site/blog_site.sql:/docker-entrypoint-initdb.d/00-schema.sql:ro
      - ../jy-site/migrations/001_site_deploy_settings.sql:/docker-entrypoint-initdb.d/01-settings.sql:ro
      - ../jy-site/migrations/002_auto_publish_setting.sql:/docker-entrypoint-initdb.d/02-auto-publish.sql:ro
    healthcheck:
      test: ["CMD-SHELL", "mysqladmin ping -h 127.0.0.1 -u root -p$$MYSQL_ROOT_PASSWORD --silent"]
      interval: 10s
      timeout: 5s
      retries: 12
    networks: [backend]

  admin:
    build:
      context: ../jy-admin
      dockerfile: ../deploy/admin.Dockerfile
    restart: unless-stopped
    env_file: ./env/admin.env
    environment:
      NODE_ENV: production
      DATABASE_HOST: db
      DATABASE_PORT: 3306
    depends_on:
      db:
        condition: service_healthy
    expose: ["5174"]
    healthcheck:
      test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:5174/login >/dev/null || exit 1"]
      interval: 20s
      timeout: 5s
      retries: 6
    networks: [frontend, backend]

  nginx:
    image: nginx:1.27-alpine
    restart: unless-stopped
    depends_on:
      admin:
        condition: service_healthy
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./nginx.conf:/etc/nginx/conf.d/default.conf:ro
      - /srv/jy/site-releases:/srv/jy/site-releases:ro
      - /etc/letsencrypt:/etc/letsencrypt:ro
    networks: [frontend]

  site-builder:
    profiles: ["tools"]
    build:
      context: ..
      dockerfile: deploy/site-builder.Dockerfile
    env_file: ./env/site-build.env
    environment:
      DATABASE_HOST: db
      DATABASE_PORT: 3306
    depends_on:
      db:
        condition: service_healthy
    volumes:
      - /srv/jy/site-releases:/releases
    networks: [backend]

volumes:
  mysql-data:

networks:
  frontend:
  backend:
    internal: true

FROM node:22.22.1-alpine AS deps
RUN corepack enable && corepack prepare pnpm@10.15.0 --activate
WORKDIR /app
COPY package.json pnpm-lock.yaml ./
RUN pnpm install --frozen-lockfile

FROM deps AS build
COPY . .
RUN pnpm build

FROM node:22.22.1-alpine AS runtime
RUN corepack enable && corepack prepare pnpm@10.15.0 --activate
WORKDIR /app
ENV NODE_ENV=production
COPY --from=build --chown=node:node /app/package.json ./
COPY --from=build --chown=node:node /app/node_modules ./node_modules
COPY --from=build --chown=node:node /app/.next ./.next
COPY --from=build --chown=node:node /app/public ./public
USER node
EXPOSE 5174
CMD ["pnpm", "start"]

FROM node:22.22.1-alpine
RUN corepack enable && corepack prepare pnpm@10.15.0 --activate
WORKDIR /workspace/jy-site
COPY jy-site/package.json jy-site/pnpm-lock.yaml ./
RUN pnpm install --frozen-lockfile
COPY jy-site/ ./
CMD ["pnpm", "build:static"]

server {
  listen 80;
  server_name blog.example.com admin.example.com;
  return 301 https://$host$request_uri;
}

server {
  listen 443 ssl;
  http2 on;
  server_name blog.example.com;
  ssl_certificate /etc/letsencrypt/live/blog.example.com/fullchain.pem;
  ssl_certificate_key /etc/letsencrypt/live/blog.example.com/privkey.pem;
  add_header Strict-Transport-Security "max-age=31536000" always;
  add_header X-Content-Type-Options "nosniff" always;

  root /srv/jy/site-releases/current;
  index index.html;

  location / {
    try_files $uri $uri.html $uri/ =404;
  }
  location ^~ /_app/immutable/ {
    expires 1y;
    add_header Cache-Control "public, immutable";
  }
  location = /search-index.json {
    add_header Cache-Control "public, max-age=300";
  }
  location = /healthz {
    access_log off;
    return 200 "ok\n";
  }
}

server {
  listen 443 ssl;
  http2 on;
  server_name admin.example.com;
  ssl_certificate /etc/letsencrypt/live/admin.example.com/fullchain.pem;
  ssl_certificate_key /etc/letsencrypt/live/admin.example.com/privkey.pem;
  add_header Strict-Transport-Security "max-age=31536000" always;
  add_header X-Content-Type-Options "nosniff" always;

  # 推荐在此加 VPN、SSO 或 allow/deny IP 策略
  location / {
    proxy_pass http://admin:5174;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
  }
}

#!/usr/bin/env sh
set -eu

release_id="${1:?release id required}"
release_dir="/srv/jy/site-releases/${release_id}"

mkdir -p "${release_dir}"
docker compose -f deploy/compose.production.yml run --rm \
  --entrypoint sh site-builder -c \
  'pnpm build:static && test -s build/index.html && test -s build/sitemap.xml && test -s build/search-index.json && cp -a build/. "/releases/'"${release_id}"'/"'

ln -sfn "${release_id}" /srv/jy/site-releases/.current.next
mv -Tf /srv/jy/site-releases/.current.next /srv/jy/site-releases/current
docker compose -f deploy/compose.production.yml exec -T nginx nginx -s reload

curl --fail --silent --show-error https://blog.example.com/ >/dev/null
curl --fail --silent --show-error https://blog.example.com/sitemap.xml >/dev/null

- name: Configure SSH
  env:
    SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
    KNOWN_HOSTS: ${{ secrets.DEPLOY_KNOWN_HOSTS }}
  run: |
    install -m 700 -d ~/.ssh
    printf '%s\n' "$SSH_KEY" > ~/.ssh/deploy_key
    chmod 600 ~/.ssh/deploy_key
    printf '%s\n' "$KNOWN_HOSTS" > ~/.ssh/known_hosts

- name: Build and atomically publish on server
  env:
    HOST: ${{ secrets.DEPLOY_SSH_HOST }}
    USER: ${{ secrets.DEPLOY_SSH_USER }}
    RELEASE_ID: ${{ github.run_id }}-${{ github.run_attempt }}
  run: |
    ssh -i ~/.ssh/deploy_key "$USER@$HOST" \
      "cd /srv/jy/app && ./deploy/deploy-site.sh '$RELEASE_ID'"

cd /srv/jy/site-releases
test -s "20260813-previous/index.html"
ln -sfn "20260813-previous" .current.next
mv -Tf .current.next current
docker compose -f /srv/jy/app/deploy/compose.production.yml exec -T nginx nginx -s reload
curl --fail https://blog.example.com/

umask 077
stamp="$(date +%Y%m%d-%H%M%S)"
mkdir -p /srv/jy/backups

docker compose -f deploy/compose.production.yml exec -T db sh -c \
  'exec mysqldump --single-transaction --routines --triggers \
    -u"$MYSQL_USER" -p"$MYSQL_PASSWORD" "$MYSQL_DATABASE"' \
  | gzip -9 > "/srv/jy/backups/blog_site-${stamp}.sql.gz"

sha256sum "/srv/jy/backups/blog_site-${stamp}.sql.gz" \
  > "/srv/jy/backups/blog_site-${stamp}.sha256"