feat(docker): browser desktop image (Selkies Wayland + headed camofox) and optional TLS proxy
Selkies baseimage (debiantrixie, digest-pinned) with camofox 1.17.0 copied from camofox-browser:1.17.0, run headed under labwc so the desktop shows the same Firefox the agent drives. s6 service waits for wayland-0 and depends on svc-de and svc-dbus so shutdown persists login state. Selkies control/view passwords derive from CAMOFOX_ACCESS_KEY. Compose defaults to the new image; CAMOFOX_IMAGE=camofox-browser:1.17.0 switches back. Optional caddy (profile tls). Co-Authored-By: Claude Opus 5.5 <[email protected]>
This commit is contained in:
rootandClaude Opus 5.5 committed
1 parent
3f0327ad97
commit
880cec4d23
18 files changed
+235
-12
No files matched your search
+68
-10
@@ -33,25 +33,27 @@ services:
|
||||
stop_grace_period: 30s
|
||||
logging: *logging
|
||||
|
||||
# camofox-browser(jo-inc/camofox-browser v1.17.0,commit 389c996):上游不发布镜像,按锁定的 tag 从源码构建
|
||||
# (docker/camofox/Dockerfile,修了上游 v1.17.0 Dockerfile 的构建错误)。本机已有同名镜像时 `up` 不会重新构建。
|
||||
# 浏览器服务:camofox-browser(jo-inc v1.17.0,commit 389c996)。缺省镜像 = 浏览器桌面(docker/browser-desktop:
|
||||
# linuxserver baseimage-selkies Wayland 桌面 + 有头 camofox,原站视图"桌面模式"看到的就是 Agent 驱动的同一个 Firefox);
|
||||
# 它从旧镜像 camofox-browser:1.17.0(docker/camofox)复制 camofox,所以要先有旧镜像(见 docs/runbook/browser.md §1.1、§8)。
|
||||
# 切回旧的纯截图镜像:CAMOFOX_IMAGE=camofox-browser:1.17.0(同一个卷,登录状态通用;原站视图自动回退截图模式)。
|
||||
# 端口一律不映射:9377(camofox API)与 3000(Selkies)只给 app;桌面画面只经 app 的 /api/v1/browser/desktop/* 反代。
|
||||
camofox:
|
||||
build:
|
||||
context: docker/camofox
|
||||
additional_contexts:
|
||||
upstream: https://github.com/jo-inc/camofox-browser.git#v1.17.0
|
||||
context: docker/browser-desktop
|
||||
args:
|
||||
APT_MIRROR: ${APT_MIRROR:-}
|
||||
image: ${CAMOFOX_IMAGE:-camofox-browser:1.17.0}
|
||||
image: ${CAMOFOX_IMAGE:-umt-browser-desktop:1.17.0}
|
||||
restart: unless-stopped
|
||||
deploy:
|
||||
# 0 = 不起浏览器服务(同时设 BROWSER_ENABLED=false)
|
||||
replicas: ${CAMOFOX_REPLICAS:-1}
|
||||
environment:
|
||||
CAMOFOX_PORT: "9377"
|
||||
# 设置后除 /health 外全部接口要求 Authorization: Bearer <key>;app 用同一个值
|
||||
# 设置后除 /health 外全部接口要求 Authorization: Bearer <key>;app 用同一个值。
|
||||
# 桌面镜像还用它派生 Selkies 的控制 / 只读口令(app 用同一算法注入),不设则桌面模式不可用
|
||||
CAMOFOX_ACCESS_KEY: ${CAMOFOX_ACCESS_KEY:-}
|
||||
# 登录状态(cookies + localStorage)按 userId 存 /root/.camofox/profiles,随卷持久化
|
||||
# 登录状态(cookies + localStorage)按 userId 存这里,随卷持久化(两个镜像同一路径)
|
||||
CAMOFOX_PROFILE_DIR: /root/.camofox/profiles
|
||||
# 上游缺省把崩溃报告发到它的中继服务;这里关掉
|
||||
CAMOFOX_CRASH_REPORT_ENABLED: "false"
|
||||
@@ -63,18 +65,71 @@ services:
|
||||
MAX_SESSIONS: ${CAMOFOX_MAX_SESSIONS:-8}
|
||||
CAMOFOX_LOCALE: ${CAMOFOX_LOCALE:-}
|
||||
CAMOFOX_TIMEZONE: ${CAMOFOX_TIMEZONE:-}
|
||||
# ── 以下只对桌面镜像生效(旧镜像忽略)──
|
||||
TZ: ${TZ:-Asia/Shanghai}
|
||||
# 桌面里浏览器进程的运行用户(登录状态目录启动时 chown 给它)
|
||||
PUID: ${CAMOFOX_PUID:-1000}
|
||||
PGID: ${CAMOFOX_PGID:-1000}
|
||||
TITLE: 原站视图
|
||||
# 分辨率锁定(浏览器窗口最大化铺满,无标题栏);DPI 锁 96 保证 DPR = 1
|
||||
SELKIES_MANUAL_WIDTH: ${BROWSER_DESKTOP_WIDTH:-1280}
|
||||
SELKIES_MANUAL_HEIGHT: ${BROWSER_DESKTOP_HEIGHT:-900}
|
||||
SELKIES_SCALING_DPI: "96|locked"
|
||||
# 纯 CPU 编码:帧率上限 30;有 GPU 时挂 /dev/dri 自动启用硬编
|
||||
SELKIES_FRAMERATE: ${BROWSER_DESKTOP_FRAMERATE:-24,8-30}
|
||||
# 只允许文本剪贴板;音频、麦克风、摄像头、手柄、文件传输、打印、命令、共享一律关闭
|
||||
SELKIES_ENABLE_BINARY_CLIPBOARD: "false|locked"
|
||||
SELKIES_AUDIO_ENABLED: "false|locked"
|
||||
SELKIES_MICROPHONE_ENABLED: "false|locked"
|
||||
SELKIES_WEBCAM_ENABLED: "false|locked"
|
||||
SELKIES_GAMEPAD_ENABLED: "false|locked"
|
||||
SELKIES_FILE_TRANSFERS: ""
|
||||
SELKIES_PRINTING_ENABLED: "false|locked"
|
||||
SELKIES_COMMAND_ENABLED: "false|locked"
|
||||
SELKIES_ENABLE_SHARING: "false|locked"
|
||||
SELKIES_UI_SIDEBAR_SHOW_FILES: "false"
|
||||
SELKIES_UI_SIDEBAR_SHOW_APPS: "false"
|
||||
SELKIES_UI_SIDEBAR_SHOW_SHARING: "false"
|
||||
SELKIES_UI_SIDEBAR_SHOW_GAMEPADS: "false"
|
||||
SELKIES_UI_SIDEBAR_SHOW_WEBCAM: "false"
|
||||
SELKIES_UI_SIDEBAR_SHOW_AUDIO_SETTINGS: "false"
|
||||
# 容器内输入法(备选;缺省用访问者本机输入法):fcitx5 = 启动 fcitx5(拼音 + mozc,Ctrl+Space 切换)
|
||||
UMT_DESKTOP_IME: ${BROWSER_DESKTOP_IME:-}
|
||||
volumes:
|
||||
- umt-camofox:/root/.camofox
|
||||
# Firefox 多进程需要较大的 /dev/shm(上游 Makefile 用 2g)
|
||||
shm_size: 2gb
|
||||
mem_limit: ${CAMOFOX_MEM_LIMIT:-2g}
|
||||
# 桌面镜像另有 labwc + Selkies + nginx 常驻(实测见 runbook §8);纯截图旧镜像 2g 足够
|
||||
mem_limit: ${CAMOFOX_MEM_LIMIT:-3g}
|
||||
healthcheck:
|
||||
test: ["CMD", "curl", "-fsS", "-o", "/dev/null", "http://127.0.0.1:9377/health"]
|
||||
interval: 30s
|
||||
timeout: 5s
|
||||
start_period: 30s
|
||||
retries: 3
|
||||
stop_grace_period: 20s
|
||||
# 桌面镜像由 s6 逐级停止,camofox 关机要落盘登录状态
|
||||
stop_grace_period: 30s
|
||||
logging: *logging
|
||||
|
||||
# 可选 HTTPS 入口(profile tls):桌面模式的视频解码(WebCodecs)与剪贴板只在 HTTPS(或 localhost)下可用。
|
||||
# 已有反代(nginx / Caddy / Traefik)终结 TLS 时不需要它。配置见 docker/browser-desktop/Caddyfile:
|
||||
# TLS_DOMAIN 不设 = 自签(Caddy 内部 CA);TLS_DOMAIN=域名 + TLS_ISSUER=邮箱 = ACME 自动证书
|
||||
# docker compose --profile tls up -d
|
||||
caddy:
|
||||
image: caddy:2-alpine
|
||||
profiles: ["tls"]
|
||||
restart: unless-stopped
|
||||
depends_on:
|
||||
- app
|
||||
environment:
|
||||
# 空 = https://(任意主机名,自签按需签发)
|
||||
TLS_DOMAIN: ${TLS_DOMAIN:-https://}
|
||||
TLS_ISSUER: ${TLS_ISSUER:-internal}
|
||||
ports:
|
||||
- "${TLS_BIND:-0.0.0.0}:${TLS_PORT:-443}:443"
|
||||
volumes:
|
||||
- ./docker/browser-desktop/Caddyfile:/etc/caddy/Caddyfile:ro
|
||||
- umt-caddy:/data
|
||||
logging: *logging
|
||||
|
||||
app:
|
||||
@@ -110,6 +165,8 @@ services:
|
||||
BROWSER_PROVIDER_URL: ${BROWSER_PROVIDER_URL:-http://camofox:9377}
|
||||
BROWSER_ACCESS_KEY: ${BROWSER_ACCESS_KEY:-${CAMOFOX_ACCESS_KEY:-}}
|
||||
BROWSER_ENABLED: ${BROWSER_ENABLED:-true}
|
||||
# 原站视图桌面模式的上游(桌面镜像的 Selkies);缺省由 BROWSER_PROVIDER_URL 推出(端口换 3000)
|
||||
BROWSER_DESKTOP_URL: ${BROWSER_DESKTOP_URL:-}
|
||||
ports:
|
||||
- "${UMT_BIND:-0.0.0.0}:${UMT_PORT:-4380}:4380"
|
||||
volumes:
|
||||
@@ -125,6 +182,7 @@ volumes:
|
||||
umt-pg-data:
|
||||
umt-data:
|
||||
umt-camofox:
|
||||
umt-caddy:
|
||||
|
||||
networks:
|
||||
# 固定网段(属于 172.16.0.0/12),便于宿主防火墙按网段放行容器到宿主的代理/中继端口
|
||||
|
||||
Reference in new issue
Block a user