From c3ba591b026f57d3897e62c09dda7a77b612197a Mon Sep 17 00:00:00 2001
From: root <root@localhost>
Date: Mon, 28 Sep 2026 22:08:24 +0800
Subject: [PATCH] chore(deploy): keep docker env in .env.deploy, restore .env
 for development

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 .gitignore             | 1 +
 docker-compose.yml     | 2 +-
 docs/runbook/deploy.md | 6 +++---
 3 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/.gitignore b/.gitignore
index f39aba68..2fbaeb69 100644
--- a/.gitignore
+++ b/.gitignore
@@ -14,3 +14,4 @@ types/deno.d.ts
 apps/web/test/screenshots/
 data/
 docker-compose.override.yml
+.env.deploy
diff --git a/docker-compose.yml b/docker-compose.yml
index 3e02dbca..8942242c 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,7 +1,7 @@
 # 生产/试运行部署:只有两个服务 —— app(单容器:API + worker(io 组)+ worker:agent + web 静态,单端口 4380)+ postgres。
 # 用法(详见 docs/runbook/deploy.md):
 #   cp docker/compose.env.example .env      # 按注释生成 SECRET_MASTER_KEY / POSTGRES_PASSWORD
-#   docker compose up -d --build
+#   docker compose --env-file .env.deploy up -d --build
 #   docker compose logs app | grep -i setup  # 首次启动打印一次性 setup token
 # 开发只起数据库用 docker-compose.dev.yml。
 name: umt
diff --git a/docs/runbook/deploy.md b/docs/runbook/deploy.md
index dd9a6a82..39eeafab 100644
--- a/docs/runbook/deploy.md
+++ b/docs/runbook/deploy.md
@@ -29,10 +29,10 @@ APP_VERSION=v0.1.0 docker compose build                         # 版本号写
 
 ```sh
 mkdir -p /opt/umt && cd /opt/umt                                # 部署目录(放 docker-compose.yml 与 .env)
-cp <仓库>/docker/compose.env.example .env
+cp <仓库>/docker/compose.env.example .env.deploy   # 部署配置独立于开发用 .env
 sed -i "s/^SECRET_MASTER_KEY=.*/SECRET_MASTER_KEY=$(openssl rand -hex 32)/" .env
 sed -i "s/^POSTGRES_PASSWORD=.*/POSTGRES_PASSWORD=$(openssl rand -hex 16)/" .env
-docker compose up -d --build
+docker compose --env-file .env.deploy up -d --build
 docker compose ps                                               # app 变成 healthy 即可访问
 curl -s localhost:4380/api/v1/health
 ```
@@ -116,7 +116,7 @@ docker compose logs app | grep 'setup token'
 ```sh
 cd <仓库> && git pull
 docker compose exec app umt backup                              # 升级前先备份
-docker compose up -d --build app                                # 重建镜像并替换容器;启动时自动迁移
+docker compose --env-file .env.deploy up -d --build app                                # 重建镜像并替换容器;启动时自动迁移
 docker compose ps && docker compose logs --tail=50 app
 ```