rootandClaude Opus 5.5
34e8751b45
- DATA_DIR (/data: agent-sessions, backups, exports, tmp); entrypoint chowns it to PUID/PGID then drops privileges via gosu; /app binary stays root read-only - compile with --allow-read --allow-write so mounted library roots are writable - preflight: DATA_DIR/session dir must be writable (fatal); enabled library roots and downloader path mappings checked read/write (warn + audit) - --role export-mappings (mapping manifest JSON, --compare row counts) and --role read-only-on (automation.readOnlyReconcile=true + audit) - scripts/backup.sh (pg_dump custom + mappings + agent sessions, SHA256SUMS, BACKUP_KEEP rotation) and scripts/restore.sh (checksum, refuses with live connections, psql single-transaction replay compatible with PG16, read-only reconcile on, row-count verification) - compose: app + postgres only, data volume, env example with key generation - docs: runbook deploy.md, backup-restore.md with verification record Co-Authored-By: Claude Opus 5.5 <[email protected]>
67 lines
2.1 KiB
YAML
67 lines
2.1 KiB
YAML
# 生产/试运行部署:只有两个服务 —— app(单容器:API + worker + web 静态,单端口 4380)+ postgres。
|
|
# 用法(详见 docs/runbook/deploy.md):
|
|
# cp docker/compose.env.example .env # 按注释生成 SECRET_MASTER_KEY / POSTGRES_PASSWORD
|
|
# docker compose up -d --build
|
|
# docker compose logs app | grep -i setup # 首次启动打印一次性 setup token
|
|
# 开发只起数据库用 docker-compose.dev.yml。
|
|
name: umt
|
|
|
|
x-logging: &logging
|
|
driver: json-file
|
|
options:
|
|
max-size: "10m"
|
|
max-file: "5"
|
|
|
|
services:
|
|
postgres:
|
|
image: postgres:16-alpine
|
|
restart: unless-stopped
|
|
environment:
|
|
POSTGRES_USER: umt
|
|
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?请设置 POSTGRES_PASSWORD}
|
|
POSTGRES_DB: umt
|
|
volumes:
|
|
- umt-pg-data:/var/lib/postgresql/data
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U umt -d umt"]
|
|
interval: 5s
|
|
timeout: 3s
|
|
retries: 20
|
|
stop_grace_period: 30s
|
|
logging: *logging
|
|
|
|
app:
|
|
build:
|
|
context: .
|
|
args:
|
|
APP_VERSION: ${APP_VERSION:-}
|
|
APT_MIRROR: ${APT_MIRROR:-}
|
|
image: uhd-media-tool:${APP_VERSION:-latest}
|
|
restart: unless-stopped
|
|
depends_on:
|
|
postgres:
|
|
condition: service_healthy
|
|
environment:
|
|
NODE_ENV: production
|
|
DATABASE_URL: postgres://umt:${POSTGRES_PASSWORD}@postgres:5432/umt
|
|
SECRET_MASTER_KEY: ${SECRET_MASTER_KEY:?请设置 SECRET_MASTER_KEY(openssl rand -hex 32)}
|
|
LOG_LEVEL: ${LOG_LEVEL:-info}
|
|
# 运行用户:DATA_DIR 由 entrypoint chown 成它;媒体库/下载目录需对它可读写
|
|
PUID: ${PUID:-10001}
|
|
PGID: ${PGID:-10001}
|
|
BACKUP_KEEP: ${BACKUP_KEEP:-14}
|
|
ports:
|
|
- "${UMT_BIND:-0.0.0.0}:${UMT_PORT:-4380}:4380"
|
|
volumes:
|
|
# 应用数据:agent-sessions/ backups/ exports/ tmp/
|
|
- umt-data:/data
|
|
# 媒体库根与下载缓存目录按需挂载(容器内路径 = 控制台里登记的库根 / 路径映射 local 前缀):
|
|
# - /srv/media:/media
|
|
# - /srv/downloads:/downloads
|
|
stop_grace_period: 15s
|
|
logging: *logging
|
|
|
|
volumes:
|
|
umt-pg-data:
|
|
umt-data:
|