From 880cec4d23b519d3aaa702e7638d56131d088bcc Mon Sep 17 00:00:00 2001 From: root Date: Tue, 29 Sep 2026 02:30:55 +0800 Subject: [PATCH] feat(docker): browser desktop image (Selkies Wayland + headed camofox) and optional TLS proxy Selkies baseimage (debiantrixie, digest-pinned) with camofox 1.17.0 copied from camofox-browser:1.17.0, run headed under labwc so the desktop shows the same Firefox the agent drives. s6 service waits for wayland-0 and depends on svc-de and svc-dbus so shutdown persists login state. Selkies control/view passwords derive from CAMOFOX_ACCESS_KEY. Compose defaults to the new image; CAMOFOX_IMAGE=camofox-browser:1.17.0 switches back. Optional caddy (profile tls). Co-Authored-By: Claude Opus 5.5 --- docker-compose.yml | 78 ++++++++++++++++--- docker/browser-desktop/Caddyfile | 20 +++++ docker/browser-desktop/Dockerfile | 64 +++++++++++++++ .../root/defaults/autostart_wayland | 6 ++ .../dependencies.d/init-umt-desktop | 0 .../dependencies.d/init-selkies-config | 0 .../s6-overlay/s6-rc.d/init-umt-desktop/run | 30 +++++++ .../s6-overlay/s6-rc.d/init-umt-desktop/type | 1 + .../s6-overlay/s6-rc.d/init-umt-desktop/up | 1 + .../svc-camofox/dependencies.d/init-services | 0 .../svc-camofox/dependencies.d/svc-dbus | 0 .../s6-rc.d/svc-camofox/dependencies.d/svc-de | 0 .../etc/s6-overlay/s6-rc.d/svc-camofox/run | 17 ++++ .../s6-rc.d/svc-camofox/timeout-finish | 1 + .../etc/s6-overlay/s6-rc.d/svc-camofox/type | 1 + .../s6-rc.d/user/contents.d/init-umt-desktop | 0 .../s6-rc.d/user/contents.d/svc-camofox | 0 docker/compose.env.example | 28 ++++++- 18 files changed, 235 insertions(+), 12 deletions(-) create mode 100644 docker/browser-desktop/Caddyfile create mode 100644 docker/browser-desktop/Dockerfile create mode 100755 docker/browser-desktop/root/defaults/autostart_wayland create mode 100644 docker/browser-desktop/root/etc/s6-overlay/s6-rc.d/init-selkies-end/dependencies.d/init-umt-desktop create mode 100644 docker/browser-desktop/root/etc/s6-overlay/s6-rc.d/init-umt-desktop/dependencies.d/init-selkies-config create mode 100755 docker/browser-desktop/root/etc/s6-overlay/s6-rc.d/init-umt-desktop/run create mode 100644 docker/browser-desktop/root/etc/s6-overlay/s6-rc.d/init-umt-desktop/type create mode 100644 docker/browser-desktop/root/etc/s6-overlay/s6-rc.d/init-umt-desktop/up create mode 100644 docker/browser-desktop/root/etc/s6-overlay/s6-rc.d/svc-camofox/dependencies.d/init-services create mode 100644 docker/browser-desktop/root/etc/s6-overlay/s6-rc.d/svc-camofox/dependencies.d/svc-dbus create mode 100644 docker/browser-desktop/root/etc/s6-overlay/s6-rc.d/svc-camofox/dependencies.d/svc-de create mode 100755 docker/browser-desktop/root/etc/s6-overlay/s6-rc.d/svc-camofox/run create mode 100644 docker/browser-desktop/root/etc/s6-overlay/s6-rc.d/svc-camofox/timeout-finish create mode 100644 docker/browser-desktop/root/etc/s6-overlay/s6-rc.d/svc-camofox/type create mode 100644 docker/browser-desktop/root/etc/s6-overlay/s6-rc.d/user/contents.d/init-umt-desktop create mode 100644 docker/browser-desktop/root/etc/s6-overlay/s6-rc.d/user/contents.d/svc-camofox diff --git a/docker-compose.yml b/docker-compose.yml index 1dcbefea..4bdd7fde 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -33,25 +33,27 @@ services: stop_grace_period: 30s logging: *logging - # camofox-browser(jo-inc/camofox-browser v1.17.0,commit 389c996):上游不发布镜像,按锁定的 tag 从源码构建 - # (docker/camofox/Dockerfile,修了上游 v1.17.0 Dockerfile 的构建错误)。本机已有同名镜像时 `up` 不会重新构建。 + # 浏览器服务:camofox-browser(jo-inc v1.17.0,commit 389c996)。缺省镜像 = 浏览器桌面(docker/browser-desktop: + # linuxserver baseimage-selkies Wayland 桌面 + 有头 camofox,原站视图"桌面模式"看到的就是 Agent 驱动的同一个 Firefox); + # 它从旧镜像 camofox-browser:1.17.0(docker/camofox)复制 camofox,所以要先有旧镜像(见 docs/runbook/browser.md §1.1、§8)。 + # 切回旧的纯截图镜像:CAMOFOX_IMAGE=camofox-browser:1.17.0(同一个卷,登录状态通用;原站视图自动回退截图模式)。 + # 端口一律不映射:9377(camofox API)与 3000(Selkies)只给 app;桌面画面只经 app 的 /api/v1/browser/desktop/* 反代。 camofox: build: - context: docker/camofox - additional_contexts: - upstream: https://github.com/jo-inc/camofox-browser.git#v1.17.0 + context: docker/browser-desktop args: APT_MIRROR: ${APT_MIRROR:-} - image: ${CAMOFOX_IMAGE:-camofox-browser:1.17.0} + image: ${CAMOFOX_IMAGE:-umt-browser-desktop:1.17.0} restart: unless-stopped deploy: # 0 = 不起浏览器服务(同时设 BROWSER_ENABLED=false) replicas: ${CAMOFOX_REPLICAS:-1} environment: CAMOFOX_PORT: "9377" - # 设置后除 /health 外全部接口要求 Authorization: Bearer ;app 用同一个值 + # 设置后除 /health 外全部接口要求 Authorization: Bearer ;app 用同一个值。 + # 桌面镜像还用它派生 Selkies 的控制 / 只读口令(app 用同一算法注入),不设则桌面模式不可用 CAMOFOX_ACCESS_KEY: ${CAMOFOX_ACCESS_KEY:-} - # 登录状态(cookies + localStorage)按 userId 存 /root/.camofox/profiles,随卷持久化 + # 登录状态(cookies + localStorage)按 userId 存这里,随卷持久化(两个镜像同一路径) CAMOFOX_PROFILE_DIR: /root/.camofox/profiles # 上游缺省把崩溃报告发到它的中继服务;这里关掉 CAMOFOX_CRASH_REPORT_ENABLED: "false" @@ -63,18 +65,71 @@ services: MAX_SESSIONS: ${CAMOFOX_MAX_SESSIONS:-8} CAMOFOX_LOCALE: ${CAMOFOX_LOCALE:-} CAMOFOX_TIMEZONE: ${CAMOFOX_TIMEZONE:-} + # ── 以下只对桌面镜像生效(旧镜像忽略)── + TZ: ${TZ:-Asia/Shanghai} + # 桌面里浏览器进程的运行用户(登录状态目录启动时 chown 给它) + PUID: ${CAMOFOX_PUID:-1000} + PGID: ${CAMOFOX_PGID:-1000} + TITLE: 原站视图 + # 分辨率锁定(浏览器窗口最大化铺满,无标题栏);DPI 锁 96 保证 DPR = 1 + SELKIES_MANUAL_WIDTH: ${BROWSER_DESKTOP_WIDTH:-1280} + SELKIES_MANUAL_HEIGHT: ${BROWSER_DESKTOP_HEIGHT:-900} + SELKIES_SCALING_DPI: "96|locked" + # 纯 CPU 编码:帧率上限 30;有 GPU 时挂 /dev/dri 自动启用硬编 + SELKIES_FRAMERATE: ${BROWSER_DESKTOP_FRAMERATE:-24,8-30} + # 只允许文本剪贴板;音频、麦克风、摄像头、手柄、文件传输、打印、命令、共享一律关闭 + SELKIES_ENABLE_BINARY_CLIPBOARD: "false|locked" + SELKIES_AUDIO_ENABLED: "false|locked" + SELKIES_MICROPHONE_ENABLED: "false|locked" + SELKIES_WEBCAM_ENABLED: "false|locked" + SELKIES_GAMEPAD_ENABLED: "false|locked" + SELKIES_FILE_TRANSFERS: "" + SELKIES_PRINTING_ENABLED: "false|locked" + SELKIES_COMMAND_ENABLED: "false|locked" + SELKIES_ENABLE_SHARING: "false|locked" + SELKIES_UI_SIDEBAR_SHOW_FILES: "false" + SELKIES_UI_SIDEBAR_SHOW_APPS: "false" + SELKIES_UI_SIDEBAR_SHOW_SHARING: "false" + SELKIES_UI_SIDEBAR_SHOW_GAMEPADS: "false" + SELKIES_UI_SIDEBAR_SHOW_WEBCAM: "false" + SELKIES_UI_SIDEBAR_SHOW_AUDIO_SETTINGS: "false" + # 容器内输入法(备选;缺省用访问者本机输入法):fcitx5 = 启动 fcitx5(拼音 + mozc,Ctrl+Space 切换) + UMT_DESKTOP_IME: ${BROWSER_DESKTOP_IME:-} volumes: - umt-camofox:/root/.camofox # Firefox 多进程需要较大的 /dev/shm(上游 Makefile 用 2g) shm_size: 2gb - mem_limit: ${CAMOFOX_MEM_LIMIT:-2g} + # 桌面镜像另有 labwc + Selkies + nginx 常驻(实测见 runbook §8);纯截图旧镜像 2g 足够 + mem_limit: ${CAMOFOX_MEM_LIMIT:-3g} healthcheck: test: ["CMD", "curl", "-fsS", "-o", "/dev/null", "http://127.0.0.1:9377/health"] interval: 30s timeout: 5s start_period: 30s retries: 3 - stop_grace_period: 20s + # 桌面镜像由 s6 逐级停止,camofox 关机要落盘登录状态 + stop_grace_period: 30s + logging: *logging + + # 可选 HTTPS 入口(profile tls):桌面模式的视频解码(WebCodecs)与剪贴板只在 HTTPS(或 localhost)下可用。 + # 已有反代(nginx / Caddy / Traefik)终结 TLS 时不需要它。配置见 docker/browser-desktop/Caddyfile: + # TLS_DOMAIN 不设 = 自签(Caddy 内部 CA);TLS_DOMAIN=域名 + TLS_ISSUER=邮箱 = ACME 自动证书 + # docker compose --profile tls up -d + caddy: + image: caddy:2-alpine + profiles: ["tls"] + restart: unless-stopped + depends_on: + - app + environment: + # 空 = https://(任意主机名,自签按需签发) + TLS_DOMAIN: ${TLS_DOMAIN:-https://} + TLS_ISSUER: ${TLS_ISSUER:-internal} + ports: + - "${TLS_BIND:-0.0.0.0}:${TLS_PORT:-443}:443" + volumes: + - ./docker/browser-desktop/Caddyfile:/etc/caddy/Caddyfile:ro + - umt-caddy:/data logging: *logging app: @@ -110,6 +165,8 @@ services: BROWSER_PROVIDER_URL: ${BROWSER_PROVIDER_URL:-http://camofox:9377} BROWSER_ACCESS_KEY: ${BROWSER_ACCESS_KEY:-${CAMOFOX_ACCESS_KEY:-}} BROWSER_ENABLED: ${BROWSER_ENABLED:-true} + # 原站视图桌面模式的上游(桌面镜像的 Selkies);缺省由 BROWSER_PROVIDER_URL 推出(端口换 3000) + BROWSER_DESKTOP_URL: ${BROWSER_DESKTOP_URL:-} ports: - "${UMT_BIND:-0.0.0.0}:${UMT_PORT:-4380}:4380" volumes: @@ -125,6 +182,7 @@ volumes: umt-pg-data: umt-data: umt-camofox: + umt-caddy: networks: # 固定网段(属于 172.16.0.0/12),便于宿主防火墙按网段放行容器到宿主的代理/中继端口 diff --git a/docker/browser-desktop/Caddyfile b/docker/browser-desktop/Caddyfile new file mode 100644 index 00000000..9f9c0a35 --- /dev/null +++ b/docker/browser-desktop/Caddyfile @@ -0,0 +1,20 @@ +# 可选 HTTPS 入口(docker-compose.yml 的 caddy 服务,profile tls;docs/runbook/browser.md §8.4)。 +# 桌面模式的视频解码(WebCodecs)与剪贴板只在安全上下文(HTTPS 或 localhost)可用。 +# TLS_DOMAIN 未设:自签(Caddy 内部 CA,按访问的主机名 / IP 现场签发),浏览器需手动放行或导入根证书 +# (容器内 /data/caddy/pki/authorities/local/root.crt) +# TLS_DOMAIN=media.example.com + TLS_ISSUER=you@example.com:ACME 自动申请(80/443 需公网可达) +# TLS_UPSTREAM:反代目标,缺省 app:4380(app 不在同一 compose 网络时改) +{ + auto_https disable_redirects +} + +{$TLS_DOMAIN:https://} { + tls {$TLS_ISSUER:internal} { + on_demand + } + encode zstd gzip + reverse_proxy {$TLS_UPSTREAM:app:4380} { + # SSE 与桌面 WebSocket 不缓冲 + flush_interval -1 + } +} diff --git a/docker/browser-desktop/Dockerfile b/docker/browser-desktop/Dockerfile new file mode 100644 index 00000000..b350a8d5 --- /dev/null +++ b/docker/browser-desktop/Dockerfile @@ -0,0 +1,64 @@ +# 浏览器桌面镜像(原站视图桌面模式,docs/design/webtop-remote-browser.md、docs/runbook/browser.md §8): +# linuxserver baseimage-selkies(Webtop 4.0 的底座:pixelflux + labwc Wayland 桌面 + Selkies Web 客户端) +# + camofox-browser 1.17.0 以有头模式跑在同一个 Wayland 会话里 → 桌面上看到的就是 Agent 驱动的那个 Firefox。 +# +# camofox 部分不重新下载:直接从旧镜像 camofox-browser:1.17.0(docker/camofox/Dockerfile 构建)复制 +# node、/app 与 Camoufox 浏览器包,两个镜像的 camofox 完全一致,可随时用 CAMOFOX_IMAGE 切回旧镜像。 +# 手工构建: +# docker build -t camofox-browser:1.17.0 --build-context upstream=… docker/camofox # 先有旧镜像 +# docker build -t umt-browser-desktop:1.17.0 docker/browser-desktop +ARG CAMOFOX_BASE=camofox-browser:1.17.0 +# baseimage-selkies debiantrixie(Selkies 2.x、labwc 0.8.3,已含 fonts-noto-cjk);按 digest 锁定,升级需重新核验 +ARG SELKIES_BASE=ghcr.io/linuxserver/baseimage-selkies:debiantrixie@sha256:f3ca0b10e923a603941a996ea1c3356b9527cc53163259f4e836f61fd4523e12 + +FROM ${CAMOFOX_BASE} AS camofox + +FROM ${SELKIES_BASE} + +ARG APT_MIRROR= +# 1 = 装容器内输入法 fcitx5(拼音 + mozc,缺省装;是否启动由运行时 UMT_DESKTOP_IME=fcitx5 决定) +ARG WITH_FCITX5=1 + +RUN if [ -n "$APT_MIRROR" ]; then sed -i "s@deb.debian.org@${APT_MIRROR}@g" /etc/apt/sources.list.d/debian.sources; fi \ + && apt-get update \ + && apt-get install -y --no-install-recommends \ + libdbus-glib-1-2 libxt6t64 libasound2t64 libx11-xcb1 libxcomposite1 libxcursor1 libxdamage1 libxfixes3 \ + libxi6 libxrandr2 libxrender1 libxss1 libxtst6 libegl1 libgl1-mesa-dri libgbm1 \ + fonts-noto-cjk fonts-noto-cjk-extra fonts-noto-color-emoji fontconfig \ + && if [ "$WITH_FCITX5" = "1" ]; then \ + apt-get install -y --no-install-recommends \ + fcitx5 fcitx5-chinese-addons fcitx5-mozc fcitx5-frontend-gtk3 fcitx5-config-qt- ; \ + fi \ + && apt-get clean && rm -rf /var/lib/apt/lists/* /tmp/* + +COPY --from=camofox /usr/local/bin/node /usr/local/bin/node +COPY --from=camofox /app /opt/camofox +COPY --from=camofox /root/.cache/camoufox /opt/camoufox +COPY root/ / + +LABEL org.opencontainers.image.title="umt-browser-desktop" \ + org.opencontainers.image.description="camofox-browser 1.17.0 (headed, Wayland) on linuxserver baseimage-selkies" \ + org.opencontainers.image.version="1.17.0" + +ENV CAMOUFOX_INSTALL_DIR=/opt/camoufox \ + NODE_ENV=production \ + CAMOFOX_PORT=9377 \ + CAMOFOX_INTERACTIVE=desktop \ + MOZ_ENABLE_WAYLAND=1 \ + PIXELFLUX_WAYLAND=true \ + START_DOCKER=false \ + NO_GAMEPAD=true \ + NO_WEBCAM=true \ + CUSTOM_USER=umt \ + TITLE="原站视图" \ + NO_DECOR=true \ + HARDEN_DESKTOP=true \ + HARDEN_OPENBOX=true \ + # HARDEN_OPENBOX 缺省会开 RESTART_APP(看门狗每秒重跑 autostart);浏览器由 svc-camofox 管,不需要 + RESTART_APP=false \ + SELKIES_ENABLE_BASIC_AUTH=true \ + # s6 停服务的宽限:camofox 关机要落盘登录状态(缺省 3 秒不够) + S6_SERVICES_GRACETIME=25000 \ + S6_KILL_GRACETIME=5000 + +EXPOSE 3000 9377 diff --git a/docker/browser-desktop/root/defaults/autostart_wayland b/docker/browser-desktop/root/defaults/autostart_wayland new file mode 100755 index 00000000..7638e3b6 --- /dev/null +++ b/docker/browser-desktop/root/defaults/autostart_wayland @@ -0,0 +1,6 @@ +#!/bin/sh +# labwc autostart(UMT 浏览器桌面):不自启应用;浏览器窗口由 svc-camofox(camofox-browser)按会话打开。 +# 容器内输入法是备选(缺省用访问者本机输入法,由 Selkies 注入上屏文本);UMT_DESKTOP_IME=fcitx5 时启用 +if [ "$UMT_DESKTOP_IME" = "fcitx5" ] && command -v fcitx5 >/dev/null 2>&1; then + fcitx5 -d --replace >/dev/null 2>&1 & +fi diff --git a/docker/browser-desktop/root/etc/s6-overlay/s6-rc.d/init-selkies-end/dependencies.d/init-umt-desktop b/docker/browser-desktop/root/etc/s6-overlay/s6-rc.d/init-selkies-end/dependencies.d/init-umt-desktop new file mode 100644 index 00000000..e69de29b diff --git a/docker/browser-desktop/root/etc/s6-overlay/s6-rc.d/init-umt-desktop/dependencies.d/init-selkies-config b/docker/browser-desktop/root/etc/s6-overlay/s6-rc.d/init-umt-desktop/dependencies.d/init-selkies-config new file mode 100644 index 00000000..e69de29b diff --git a/docker/browser-desktop/root/etc/s6-overlay/s6-rc.d/init-umt-desktop/run b/docker/browser-desktop/root/etc/s6-overlay/s6-rc.d/init-umt-desktop/run new file mode 100755 index 00000000..b60e9587 --- /dev/null +++ b/docker/browser-desktop/root/etc/s6-overlay/s6-rc.d/init-umt-desktop/run @@ -0,0 +1,30 @@ +#!/usr/bin/with-contenv bash +# UMT 浏览器桌面:在 linuxserver 的 init-selkies-config 之后、Selkies/桌面启动之前执行(root)。 +# 1) Selkies 双口令:由 CAMOFOX_ACCESS_KEY 经 HMAC 派生(app 用同一算法),不另设密钥; +# 2) labwc autostart 每次覆盖(只起可选 fcitx5,不起终端等其它应用); +# 3) 登录状态目录(与旧 camofox 镜像同一个卷 /root/.camofox)交给运行用户 abc。 +set -e +ENVDIR=/run/s6/container_environment +derive() { printf '%s' "$1" | openssl dgst -sha256 -hmac "$CAMOFOX_ACCESS_KEY" -r | cut -c1-48; } +if [ -n "${CAMOFOX_ACCESS_KEY}" ]; then + printf '%s' "$(derive umt-desktop/control)" > "$ENVDIR/SELKIES_BASIC_AUTH_PASSWORD" + printf '%s' "$(derive umt-desktop/view)" > "$ENVDIR/SELKIES_BASIC_AUTH_VIEWONLY_PASSWORD" +else + echo "[umt-desktop] CAMOFOX_ACCESS_KEY 未设置:桌面口令随机生成,app 无法接入桌面模式(原站视图回退截图模式)" + printf '%s' "$(openssl rand -hex 24)" > "$ENVDIR/SELKIES_BASIC_AUTH_PASSWORD" + printf '%s' "$(openssl rand -hex 24)" > "$ENVDIR/SELKIES_BASIC_AUTH_VIEWONLY_PASSWORD" +fi +# 口令只经 Selkies 自己的 basic auth 校验;nginx 层不开(设 PASSWORD 会让 nginx 只认单口令,拦掉只读口令) +printf 'true' > "$ENVDIR/SELKIES_ENABLE_BASIC_AUTH" +rm -f "$ENVDIR/PASSWORD" "$ENVDIR/PASSWD" + +LABWC_DIR="$HOME/.config/labwc" +mkdir -p "$LABWC_DIR" +cp /defaults/autostart_wayland "$LABWC_DIR/autostart" +chown root:abc "$LABWC_DIR/autostart" +chmod 550 "$LABWC_DIR/autostart" + +PROFILE_ROOT="$(dirname "${CAMOFOX_PROFILE_DIR:-/root/.camofox/profiles}")" +mkdir -p "${CAMOFOX_PROFILE_DIR:-/root/.camofox/profiles}" +chown -R abc:abc "$PROFILE_ROOT" +chmod 711 /root diff --git a/docker/browser-desktop/root/etc/s6-overlay/s6-rc.d/init-umt-desktop/type b/docker/browser-desktop/root/etc/s6-overlay/s6-rc.d/init-umt-desktop/type new file mode 100644 index 00000000..bdd22a18 --- /dev/null +++ b/docker/browser-desktop/root/etc/s6-overlay/s6-rc.d/init-umt-desktop/type @@ -0,0 +1 @@ +oneshot diff --git a/docker/browser-desktop/root/etc/s6-overlay/s6-rc.d/init-umt-desktop/up b/docker/browser-desktop/root/etc/s6-overlay/s6-rc.d/init-umt-desktop/up new file mode 100644 index 00000000..b6d094df --- /dev/null +++ b/docker/browser-desktop/root/etc/s6-overlay/s6-rc.d/init-umt-desktop/up @@ -0,0 +1 @@ +/etc/s6-overlay/s6-rc.d/init-umt-desktop/run diff --git a/docker/browser-desktop/root/etc/s6-overlay/s6-rc.d/svc-camofox/dependencies.d/init-services b/docker/browser-desktop/root/etc/s6-overlay/s6-rc.d/svc-camofox/dependencies.d/init-services new file mode 100644 index 00000000..e69de29b diff --git a/docker/browser-desktop/root/etc/s6-overlay/s6-rc.d/svc-camofox/dependencies.d/svc-dbus b/docker/browser-desktop/root/etc/s6-overlay/s6-rc.d/svc-camofox/dependencies.d/svc-dbus new file mode 100644 index 00000000..e69de29b diff --git a/docker/browser-desktop/root/etc/s6-overlay/s6-rc.d/svc-camofox/dependencies.d/svc-de b/docker/browser-desktop/root/etc/s6-overlay/s6-rc.d/svc-camofox/dependencies.d/svc-de new file mode 100644 index 00000000..e69de29b diff --git a/docker/browser-desktop/root/etc/s6-overlay/s6-rc.d/svc-camofox/run b/docker/browser-desktop/root/etc/s6-overlay/s6-rc.d/svc-camofox/run new file mode 100755 index 00000000..5fde7771 --- /dev/null +++ b/docker/browser-desktop/root/etc/s6-overlay/s6-rc.d/svc-camofox/run @@ -0,0 +1,17 @@ +#!/usr/bin/with-contenv bash +# camofox-browser 以有头模式跑在 labwc(应用合成器 wayland-0)里:桌面画面上的窗口就是 Agent 驱动的同一个 Firefox 进程。 +SOCKET_PATH="${XDG_RUNTIME_DIR}/wayland-0" +until [ -e "${SOCKET_PATH}" ]; do sleep 0.5; done +export WAYLAND_DISPLAY=wayland-0 +export DISPLAY=:0 +export MOZ_ENABLE_WAYLAND="${MOZ_ENABLE_WAYLAND:-1}" +export CAMOFOX_INTERACTIVE=desktop +if [[ "${UMT_DESKTOP_IME,,}" == "fcitx5" ]]; then + # Wayland 下 Firefox 经 text-input-v3 接 fcitx5;不要设 GTK_IM_MODULE(会绕过 text-input-v3) + export XMODIFIERS=@im=fcitx +fi +# Selkies 的手柄/摄像头 LD_PRELOAD 不给浏览器 +unset LD_PRELOAD +cd /opt/camofox +# exec:SIGTERM 直达 node,持久化插件关机落盘(docker/camofox/Dockerfile 同样的教训) +exec s6-setuidgid abc node --max-old-space-size="${MAX_OLD_SPACE_SIZE:-128}" server.js diff --git a/docker/browser-desktop/root/etc/s6-overlay/s6-rc.d/svc-camofox/timeout-finish b/docker/browser-desktop/root/etc/s6-overlay/s6-rc.d/svc-camofox/timeout-finish new file mode 100644 index 00000000..e87f3b8e --- /dev/null +++ b/docker/browser-desktop/root/etc/s6-overlay/s6-rc.d/svc-camofox/timeout-finish @@ -0,0 +1 @@ +25000 diff --git a/docker/browser-desktop/root/etc/s6-overlay/s6-rc.d/svc-camofox/type b/docker/browser-desktop/root/etc/s6-overlay/s6-rc.d/svc-camofox/type new file mode 100644 index 00000000..5883cff0 --- /dev/null +++ b/docker/browser-desktop/root/etc/s6-overlay/s6-rc.d/svc-camofox/type @@ -0,0 +1 @@ +longrun diff --git a/docker/browser-desktop/root/etc/s6-overlay/s6-rc.d/user/contents.d/init-umt-desktop b/docker/browser-desktop/root/etc/s6-overlay/s6-rc.d/user/contents.d/init-umt-desktop new file mode 100644 index 00000000..e69de29b diff --git a/docker/browser-desktop/root/etc/s6-overlay/s6-rc.d/user/contents.d/svc-camofox b/docker/browser-desktop/root/etc/s6-overlay/s6-rc.d/user/contents.d/svc-camofox new file mode 100644 index 00000000..e69de29b diff --git a/docker/compose.env.example b/docker/compose.env.example index 737c2a25..6824b379 100644 --- a/docker/compose.env.example +++ b/docker/compose.env.example @@ -29,7 +29,8 @@ LOG_LEVEL=info # ── 浏览器服务(camofox-browser,原站视图 / Agent 浏览器能力;docs/runbook/browser.md)── # 缺省随 compose 起一个 camofox 容器(只在内网,不映射端口),app 自动登记为 camofox-env。 -# 访问凭据:camofox 与 app 共用;建议设置(openssl rand -hex 24) +# 缺省镜像是浏览器桌面(原站视图桌面模式,docker/browser-desktop);要先有 camofox-browser:1.17.0(runbook browser.md §1.1)。 +# 访问凭据:camofox 与 app 共用;建议设置(openssl rand -hex 24)。桌面模式的控制 / 只读口令也由它派生,不设则桌面模式不可用 CAMOFOX_ACCESS_KEY= # 接自有 camofox 实例:改成它的地址与凭据,并把 CAMOFOX_REPLICAS 设 0 # BROWSER_PROVIDER_URL=http://camofox:9377 @@ -41,6 +42,29 @@ CAMOFOX_ACCESS_KEY= # CAMOFOX_SESSION_TIMEOUT_MS=1800000 # CAMOFOX_BROWSER_IDLE_TIMEOUT_MS=300000 # CAMOFOX_MAX_SESSIONS=8 -# CAMOFOX_MEM_LIMIT=2g +# CAMOFOX_MEM_LIMIT=3g # CAMOFOX_LOCALE=zh-CN # CAMOFOX_TIMEZONE=Asia/Shanghai + +# ── 原站视图桌面模式(docs/runbook/browser.md §8)── +# 只要截图模式:改回纯截图镜像(同一个卷,登录状态通用) +# CAMOFOX_IMAGE=camofox-browser:1.17.0 +# 桌面分辨率与帧率(纯 CPU 编码,持续滚动约占 1 核) +# BROWSER_DESKTOP_WIDTH=1280 +# BROWSER_DESKTOP_HEIGHT=900 +# BROWSER_DESKTOP_FRAMERATE=24,8-30 +# 容器内输入法(备选;缺省用访问者本机输入法):fcitx5 +# BROWSER_DESKTOP_IME= +# 桌面浏览器进程的运行用户 +# CAMOFOX_PUID=1000 +# CAMOFOX_PGID=1000 +# 桌面上游地址(缺省由 BROWSER_PROVIDER_URL 推出,端口换 3000) +# BROWSER_DESKTOP_URL=http://camofox:3000 + +# ── HTTPS(可选,compose profile tls;桌面模式的视频解码与剪贴板需要 HTTPS)── +# docker compose --profile tls up -d +# 不设 TLS_DOMAIN = 自签(Caddy 内部 CA);设域名 + TLS_ISSUER=邮箱 = ACME 自动证书 +# TLS_DOMAIN=media.example.com +# TLS_ISSUER=you@example.com +# TLS_PORT=443 +# TLS_BIND=0.0.0.0