feat(k8s): 启用 postgres 每日备份到 S3（已实测上传成功）

- 编辑器初始化等待文章和草稿两个查询都返回，此前草稿接口先返回
  空内容时会用默认文本初始化并被自动保存覆盖真实草稿
- CodeMirror 容器加 min-h-0（flex 子项默认 min-height:auto 会被
  内容撑开），并约束 .cm-editor 高度为 100% 使内部滚动生效
- 修复规则必须放在 @layer 外，否则被 Tailwind 当作未使用样式裁剪

.gitignore

@@ -7,4 +7,8 @@
 .DS_Store
 
 picture/
-images/
+images/
+
+# k8s 真实密钥文件不入库，仓库里只放 secret.example.yaml 模板
+k8s/backend/secret.yaml
+k8s/postgres/secret.yaml

frontend/src/index.css

@@ -285,3 +285,9 @@
     @apply shadow-[0_0_0_3px_rgba(129,140,248,0.2)];
   }
 }
+
+/* CodeMirror 编辑器内部滚动（必须是无层级的普通 CSS，
+   放在 @layer 里会被 Tailwind 当作未使用样式裁剪掉） */
+.cm-editor {
+  height: 100%;
+}

frontend/src/pages/admin/AdminProfilePage.tsx

@@ -234,7 +234,7 @@ export function AdminProfilePage() {
             theme={theme === 'dark' ? oneDark : 'light'}
             extensions={[markdown()]}
             onChange={(value) => setContent(value)}
-            className="flex-1 text-sm"
+            className="flex-1 min-h-0 text-sm"
             basicSetup={{ lineNumbers: true, highlightActiveLineGutter: true, highlightActiveLine: true, foldGutter: false }}
           />
         </div>

frontend/src/pages/admin/EditorPage.tsx

@@ -53,14 +53,16 @@ export function EditorPage() {
     enabled: isEdit,
   });
 
-  const { data: draft } = useQuery({
+  const { data: draft, isLoading: draftLoading } = useQuery({
     queryKey: ['admin-draft', id],
     queryFn: () => api.getDraft(id!),
     enabled: isEdit,
   });
 
+  // 必须等文章和草稿两个查询都返回后再初始化，
+  // 否则会先用默认文本渲染，自动保存随即覆盖掉真实草稿（数据丢失）
   useEffect(() => {
-    if (!initialized && (post || draft)) {
+    if (!initialized && !isLoading && !draftLoading && (post || draft)) {
       setTitle(post?.title || '');
       setSlug(post?.slug || '');
       setSummary(post?.summary || '');
@@ -70,7 +72,7 @@ export function EditorPage() {
       setContentMd(md);
       setInitialized(true);
     }
-  }, [post, draft, initialized]);
+  }, [post, draft, isLoading, draftLoading, initialized]);
 
   // 自动保存草稿
   useEffect(() => {
@@ -356,7 +358,7 @@ export function EditorPage() {
               theme={theme === 'dark' ? oneDark : 'light'}
               extensions={[markdown()]}
               onChange={(value) => setContentMd(value)}
-              className="flex-1 text-sm"
+              className="flex-1 min-h-0 text-sm"
               basicSetup={{
                 lineNumbers: true,
                 highlightActiveLineGutter: true,

frontend/tsconfig.tsbuildinfo

@@ -1 +1 @@
-{"root":["./src/App.tsx","./src/main.tsx","./src/types.ts","./src/vite-env.d.ts","./src/api/client.ts","./src/api/index.ts","./src/components/AuthInit.tsx","./src/components/Header.tsx","./src/components/PostCard.tsx","./src/components/StarBackground.tsx","./src/pages/HomePage.tsx","./src/pages/OAuthCallback.tsx","./src/pages/PostPage.tsx","./src/pages/RssPage.tsx","./src/pages/TagsPage.tsx","./src/pages/admin/AdminLayout.tsx","./src/pages/admin/AdminPage.tsx","./src/pages/admin/EditorPage.tsx","./src/store/auth.ts","./src/store/theme.ts"],"version":"6.0.3"}
+{"root":["./src/App.tsx","./src/main.tsx","./src/types.ts","./src/vite-env.d.ts","./src/api/client.ts","./src/api/index.ts","./src/components/AuthInit.tsx","./src/components/ErrorBoundary.tsx","./src/components/Header.tsx","./src/components/Markdown.tsx","./src/components/PostCard.tsx","./src/components/StarBackground.tsx","./src/config/hero.ts","./src/config/profile.ts","./src/lib/tree.ts","./src/pages/HomePage.tsx","./src/pages/LibraryPage.tsx","./src/pages/OAuthCallback.tsx","./src/pages/PostPage.tsx","./src/pages/ProfilePage.tsx","./src/pages/RssPage.tsx","./src/pages/admin/AdminHeroPage.tsx","./src/pages/admin/AdminLayout.tsx","./src/pages/admin/AdminPage.tsx","./src/pages/admin/AdminProfilePage.tsx","./src/pages/admin/EditorPage.tsx","./src/store/auth.ts","./src/store/theme.ts"],"version":"6.0.3"}

k8s/backend/deployment.yaml

@@ -57,9 +57,9 @@ spec:
                   name: backend-secret
                   key: github-admin-id
             - name: APP_URL
-              value: "https://your-domain.com"
+              value: "https://blog.zhaoxi.net.cn"
             - name: FRONTEND_URL
-              value: "https://your-domain.com"
+              value: "https://blog.zhaoxi.net.cn"
             # MOCK_OAUTH 生产环境绝不开启，缺省即关闭
             - name: S3_ENDPOINT
               valueFrom:

k8s/backend/secret.example.yaml

@@ -0,0 +1,18 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: backend-secret
+  namespace: blog
+type: Opaque
+stringData:
+  database-url: "postgres://blog:CHANGE_ME@postgres:5432/blog"
+  jwt-secret: "CHANGE_ME_random_base64"
+  github-client-id: ""
+  github-client-secret: ""
+  github-admin-id: ""
+  s3-endpoint: ""
+  s3-region: "us-east-1"
+  s3-bucket: ""
+  s3-access-key: ""
+  s3-secret-key: ""
+  s3-public-url: ""

k8s/backend/secret.yaml

@@ -1,19 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-  name: backend-secret
-  namespace: blog
-type: Opaque
-stringData:
-  database-url: "postgres://blog:change-me-in-production@postgres:5432/blog"
-  jwt-secret: "change-me-in-production"
-  github-client-id: "your-github-client-id"
-  github-client-secret: "your-github-client-secret"
-  github-admin-id: "your-github-user-id"
-  # S3 兼容对象存储，留空表示关闭上传功能
-  s3-endpoint: ""
-  s3-region: "us-east-1"
-  s3-bucket: ""
-  s3-access-key: ""
-  s3-secret-key: ""
-  s3-public-url: ""

k8s/ingress.yaml

@@ -7,7 +7,7 @@ metadata:
     traefik.ingress.kubernetes.io/router.entrypoints: web
 spec:
   rules:
-    - host: your-domain.com
+    - host: blog.zhaoxi.net.cn
       http:
         paths:
           # 前端静态文件由外部 Caddy 直接托管，集群内只暴露 API

k8s/kustomization.yaml

@@ -8,17 +8,14 @@ resources:
   - postgres/secret.yaml
   - postgres/statefulset.yaml
   - postgres/service.yaml
-  # 可选：PostgreSQL 每日备份到 S3，填好 s3-* 后取消注释
-  # - postgres/backup-cronjob.yaml
+  # PostgreSQL 每日备份到 S3
+  - postgres/backup-cronjob.yaml
   - backend/secret.yaml
   - backend/deployment.yaml
   - backend/service.yaml
   - ingress.yaml
 
-images:
-  - name: blog-backend
-    newName: your-registry/blog-backend
-    newTag: latest
+# 镜像通过 k3s ctr images import 本地导入，不走 registry
 
 # 可选：统一修改域名
 # replacements:

k8s/postgres/secret.example.yaml

@@ -5,4 +5,4 @@ metadata:
   namespace: blog
 type: Opaque
 stringData:
-  password: "change-me-in-production"
+  password: "CHANGE_ME"