climber
41a0a85141
【已完成】 - 关闭FRP SSH隧道 (消除公网暴露风险) - 移除MySQL/Redis端口映射 (仅内网访问) - 启用UFW防火墙 (deny all + allow 80/443) - 关闭临时Python HTTP服务 (端口8888) - 配置定期备份脚本 (每日2点执行) - 更新监控告警规则 (新增登录异常检测) 【待手动完成 - 需sudo】 - 启用FRP TLS加密 (修改/opt/frp/frpc.ini) - 延长日志留存180天 (修改/opt/frp/frpc.ini)
119 lines
3.2 KiB
YAML
119 lines
3.2 KiB
YAML
name: lehuo-local
|
|
|
|
services:
|
|
mysql:
|
|
image: mysql:8.4.8
|
|
restart: unless-stopped
|
|
environment:
|
|
MYSQL_DATABASE: lehuo
|
|
MYSQL_PASSWORD: change-me-local-only
|
|
MYSQL_ROOT_PASSWORD: root-lehuo-2026
|
|
MYSQL_USER: lehuo
|
|
TZ: Asia/Shanghai
|
|
volumes:
|
|
- mysql-data:/var/lib/mysql
|
|
healthcheck:
|
|
test: ['CMD-SHELL', 'mysqladmin ping -h 127.0.0.1 -u root -proot-lehuo-2026 --silent']
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 10
|
|
start_period: 30s
|
|
networks:
|
|
- backend
|
|
|
|
redis:
|
|
image: redis:7.4-alpine
|
|
restart: unless-stopped
|
|
command: ['redis-server', '--appendonly', 'yes']
|
|
volumes:
|
|
- redis-data:/data
|
|
healthcheck:
|
|
test: ['CMD', 'redis-cli', 'ping']
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 5
|
|
networks:
|
|
- backend
|
|
|
|
api:
|
|
build:
|
|
context: ../..
|
|
dockerfile: apps/api/Dockerfile
|
|
restart: unless-stopped
|
|
environment:
|
|
APP_ENV: demo
|
|
API_PORT: '3000'
|
|
DATABASE_URL: mysql://lehuo:change-me-local-only@mysql:3306/lehuo?allowPublicKeyRetrieval=true&useSSL=false
|
|
REDIS_URL: redis://redis:6379
|
|
SESSION_SECRET: lehuo-local-session-secret-2026
|
|
SESSION_TOKEN_PEPPER: lehuo-local-token-pepper-2026
|
|
AUDIT_IP_HASH_KEY: lehuo-local-audit-key-2026
|
|
FIELD_ENCRYPTION_KEY: eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHg=
|
|
OBJECT_STORAGE_ENDPOINT: http://seaweedfs:8333/seaweedfs/s3
|
|
OBJECT_STORAGE_REGION: auto
|
|
OBJECT_STORAGE_BUCKET: lehuo
|
|
OBJECT_STORAGE_ACCESS_KEY: local-dev-key
|
|
OBJECT_STORAGE_SECRET_KEY: local-dev-secret
|
|
OBJECT_STORAGE_FORCE_PATH_STYLE: 'true'
|
|
ADMIN_WEB_ORIGIN: https://lhgy.net
|
|
ADMIN_COOKIE_SECURE: 'true'
|
|
AUTH_SESSION_TTL_SECONDS: '86400'
|
|
WECHAT_APP_ID: wx6cfca7c83002d678
|
|
WECHAT_APP_SECRET: 28ba8995b5329fab7e8207edf290ec74
|
|
WECHAT_PRIVATE_KEY_PATH: /app/ssl/private.key
|
|
NOTIFICATION_WORKER_ENABLED: 'false'
|
|
BOOTSTRAP_ADMIN_USERNAME: admin
|
|
BOOTSTRAP_ADMIN_PASSWORD: lehuo@123456
|
|
BOOTSTRAP_ADMIN_DISPLAY_NAME: System Administrator
|
|
ports:
|
|
- '3000:3000'
|
|
depends_on:
|
|
mysql:
|
|
condition: service_healthy
|
|
redis:
|
|
condition: service_healthy
|
|
networks:
|
|
- backend
|
|
read_only: true
|
|
tmpfs:
|
|
- /tmp:size=64m,noexec,nosuid
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
|
|
admin-web:
|
|
build:
|
|
context: ../..
|
|
dockerfile: apps/admin-web/Dockerfile
|
|
args:
|
|
VITE_API_BASE_URL: https://lhgy.net/api
|
|
restart: unless-stopped
|
|
ports:
|
|
- '5173:80'
|
|
environment:
|
|
ADMIN_WEB_ORIGIN: https://lhgy.net
|
|
VITE_API_BASE_URL: https://lhgy.net/api
|
|
PUBLIC_HOST: lhgy.net
|
|
PUBLIC_WS: wss://lhgy.net
|
|
depends_on:
|
|
- api
|
|
networks:
|
|
- backend
|
|
- edge
|
|
volumes:
|
|
- ./nginx.local.conf.template:/etc/nginx/templates/default.conf.template
|
|
tmpfs:
|
|
- /tmp:size=64m,noexec,nosuid
|
|
- /var/cache/nginx:size=32m,noexec,nosuid
|
|
- /var/run:size=4m,noexec,nosuid
|
|
- /var/log/nginx:size=32m,noexec,nosuid
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
|
|
volumes:
|
|
mysql-data:
|
|
redis-data:
|
|
|
|
networks:
|
|
backend:
|
|
edge:
|