chore(k8s): 适配生产部署

- ingress 只暴露 /api（前端静态文件由外部 Caddy 托管）
- deployment 填入正式域名 blog.zhaoxi.net.cn
- 真实 secret 移出 git 跟踪，改用 secret.example.yaml 模板

.gitignore

@@ -7,4 +7,8 @@
 .DS_Store
 
 picture/
-images/
+images/
+
+# k8s 真实密钥文件不入库，仓库里只放 secret.example.yaml 模板
+k8s/backend/secret.yaml
+k8s/postgres/secret.yaml

k8s/backend/deployment.yaml

@@ -57,9 +57,9 @@ spec:
                   name: backend-secret
                   key: github-admin-id
             - name: APP_URL
-              value: "https://your-domain.com"
+              value: "https://blog.zhaoxi.net.cn"
             - name: FRONTEND_URL
-              value: "https://your-domain.com"
+              value: "https://blog.zhaoxi.net.cn"
             # MOCK_OAUTH 生产环境绝不开启，缺省即关闭
             - name: S3_ENDPOINT
               valueFrom:

k8s/backend/secret.example.yaml

@@ -0,0 +1,18 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: backend-secret
+  namespace: blog
+type: Opaque
+stringData:
+  database-url: "postgres://blog:CHANGE_ME@postgres:5432/blog"
+  jwt-secret: "CHANGE_ME_random_base64"
+  github-client-id: ""
+  github-client-secret: ""
+  github-admin-id: ""
+  s3-endpoint: ""
+  s3-region: "us-east-1"
+  s3-bucket: ""
+  s3-access-key: ""
+  s3-secret-key: ""
+  s3-public-url: ""

k8s/backend/secret.yaml

@@ -1,19 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-  name: backend-secret
-  namespace: blog
-type: Opaque
-stringData:
-  database-url: "postgres://blog:change-me-in-production@postgres:5432/blog"
-  jwt-secret: "change-me-in-production"
-  github-client-id: "your-github-client-id"
-  github-client-secret: "your-github-client-secret"
-  github-admin-id: "your-github-user-id"
-  # S3 兼容对象存储，留空表示关闭上传功能
-  s3-endpoint: ""
-  s3-region: "us-east-1"
-  s3-bucket: ""
-  s3-access-key: ""
-  s3-secret-key: ""
-  s3-public-url: ""

k8s/ingress.yaml

@@ -7,7 +7,7 @@ metadata:
     traefik.ingress.kubernetes.io/router.entrypoints: web
 spec:
   rules:
-    - host: your-domain.com
+    - host: blog.zhaoxi.net.cn
       http:
         paths:
           # 前端静态文件由外部 Caddy 直接托管，集群内只暴露 API

k8s/postgres/secret.example.yaml

@@ -5,4 +5,4 @@ metadata:
   namespace: blog
 type: Opaque
 stringData:
-  password: "change-me-in-production"
+  password: "CHANGE_ME"