rootandClaude Opus 5.5
1fcfcac885
camofox reaps a tab after TAB_INACTIVITY_MS (5 min) without API tool calls;
desktop-mode input goes straight to Selkies and screenshots don't count, so
tabs disappeared under the user during takeover.
- BrowserKeepalive (in-process): sessions held by an open desktop WebSocket
(ref-counted), a human takeover lease, or a running/queued agent run that
used browser.* get a keepalive every BROWSER_KEEPALIVE_MS (default 120s,
0 = off). Holds are re-checked each round; release/lease expiry/agent end/
session close stop it and camofox reaps as usual.
- Keepalive call: camofox 1.17 has no keepalive/touch endpoint and /stats does
not bump toolCalls; use GET /tabs/{id}/downloads without includeData/consume
(read-only metadata). Goes through BrowserService.run so restarts or reaped
tabs self-heal via BR-3 reconnect; no lastAutomationAt, no control needed.
- Runbook browser.md §12, deploy env table, compose env; tests against the
testkit mock camofox.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
225 lines
11 KiB
YAML
225 lines
11 KiB
YAML
# 生产/试运行部署:app(单容器:API + worker(io 组)+ worker:agent + web 静态,单端口 4380)+ postgres
|
|
# + camofox(浏览器服务,原站视图 / Agent 浏览器能力用;只在内网,不映射端口;挂了不影响 app)。
|
|
# 用法(详见 docs/runbook/deploy.md):
|
|
# cp docker/compose.env.example .env # 按注释生成 SECRET_MASTER_KEY / POSTGRES_PASSWORD
|
|
# docker compose --env-file .env.deploy up -d --build
|
|
# docker compose logs app | grep -i setup # 首次启动打印一次性 setup token
|
|
# 开发只起数据库用 docker-compose.dev.yml。
|
|
# 不要自带浏览器:.env 里 CAMOFOX_REPLICAS=0 + BROWSER_ENABLED=false;接自有 camofox:改 BROWSER_PROVIDER_URL
|
|
# (见 docs/runbook/browser.md §1)。
|
|
name: umt
|
|
|
|
x-logging: &logging
|
|
driver: json-file
|
|
options:
|
|
max-size: "10m"
|
|
max-file: "5"
|
|
|
|
services:
|
|
postgres:
|
|
image: postgres:16-alpine
|
|
restart: unless-stopped
|
|
# 内存参数按 4C/8G 机器给 PG 3G 设定(CACHE-2);机器不同按 docs/runbook/storage.md「PG 参数」调整,
|
|
# 改 .env 里的 PG_* 后 docker compose up -d postgres 重建生效
|
|
command:
|
|
- postgres
|
|
- -c
|
|
- shared_buffers=${PG_SHARED_BUFFERS:-2GB}
|
|
- -c
|
|
- effective_cache_size=${PG_EFFECTIVE_CACHE_SIZE:-5GB}
|
|
- -c
|
|
- work_mem=${PG_WORK_MEM:-32MB}
|
|
- -c
|
|
- maintenance_work_mem=${PG_MAINTENANCE_WORK_MEM:-256MB}
|
|
- -c
|
|
- max_wal_size=${PG_MAX_WAL_SIZE:-2GB}
|
|
mem_limit: ${PG_MEM_LIMIT:-3g}
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
memory: ${PG_MEM_LIMIT:-3g}
|
|
# 并行查询的动态共享内存走 /dev/shm,Docker 缺省 64MB 不够
|
|
shm_size: 512mb
|
|
environment:
|
|
POSTGRES_USER: umt
|
|
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?请设置 POSTGRES_PASSWORD}
|
|
POSTGRES_DB: umt
|
|
volumes:
|
|
- umt-pg-data:/var/lib/postgresql/data
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U umt -d umt"]
|
|
interval: 5s
|
|
timeout: 3s
|
|
retries: 20
|
|
stop_grace_period: 30s
|
|
logging: *logging
|
|
|
|
# 浏览器服务:camofox-browser(jo-inc v1.17.0,commit 389c996)。缺省镜像 = 浏览器桌面(docker/browser-desktop:
|
|
# linuxserver baseimage-selkies Wayland 桌面 + 有头 camofox,原站视图"桌面模式"看到的就是 Agent 驱动的同一个 Firefox);
|
|
# 它从旧镜像 camofox-browser:1.17.0(docker/camofox)复制 camofox,所以要先有旧镜像(见 docs/runbook/browser.md §1.1、§8)。
|
|
# 切回旧的纯截图镜像:CAMOFOX_IMAGE=camofox-browser:1.17.0(同一个卷,登录状态通用;原站视图自动回退截图模式)。
|
|
# 端口一律不映射:9377(camofox API)与 3000(Selkies)只给 app;桌面画面只经 app 的 /api/v1/browser/desktop/* 反代。
|
|
camofox:
|
|
build:
|
|
context: docker/browser-desktop
|
|
args:
|
|
APT_MIRROR: ${APT_MIRROR:-}
|
|
image: ${CAMOFOX_IMAGE:-umt-browser-desktop:1.17.0}
|
|
restart: unless-stopped
|
|
deploy:
|
|
# 0 = 不起浏览器服务(同时设 BROWSER_ENABLED=false)
|
|
replicas: ${CAMOFOX_REPLICAS:-1}
|
|
environment:
|
|
CAMOFOX_PORT: "9377"
|
|
# 设置后除 /health 外全部接口要求 Authorization: Bearer <key>;app 用同一个值。
|
|
# 桌面镜像还用它派生 Selkies 的控制 / 只读口令(app 用同一算法注入),不设则桌面模式不可用
|
|
CAMOFOX_ACCESS_KEY: ${CAMOFOX_ACCESS_KEY:-}
|
|
# 登录状态(cookies + localStorage)按 userId 存这里,随卷持久化(两个镜像同一路径)
|
|
CAMOFOX_PROFILE_DIR: /root/.camofox/profiles
|
|
# 上游缺省把崩溃报告发到它的中继服务;这里关掉
|
|
CAMOFOX_CRASH_REPORT_ENABLED: "false"
|
|
# 不装缺省扩展(uBlock Origin):每次启动浏览器都要从 addons.mozilla.org 下载,内网 / 国内网络下失败重试拖慢启动
|
|
CAMOFOX_DISABLE_DEFAULT_ADDONS: "true"
|
|
# 无请求多久回收会话(回收时落盘登录状态,下次打开恢复)/ 浏览器空闲多久退出(省内存,下次请求再启动)
|
|
SESSION_TIMEOUT_MS: ${CAMOFOX_SESSION_TIMEOUT_MS:-1800000}
|
|
BROWSER_IDLE_TIMEOUT_MS: ${CAMOFOX_BROWSER_IDLE_TIMEOUT_MS:-300000}
|
|
MAX_SESSIONS: ${CAMOFOX_MAX_SESSIONS:-8}
|
|
CAMOFOX_LOCALE: ${CAMOFOX_LOCALE:-}
|
|
CAMOFOX_TIMEZONE: ${CAMOFOX_TIMEZONE:-}
|
|
# ── 以下只对桌面镜像生效(旧镜像忽略)──
|
|
TZ: ${TZ:-Asia/Shanghai}
|
|
# 桌面里浏览器进程的运行用户(登录状态目录启动时 chown 给它)
|
|
PUID: ${CAMOFOX_PUID:-1000}
|
|
PGID: ${CAMOFOX_PGID:-1000}
|
|
TITLE: 原站视图
|
|
# 分辨率锁定(浏览器窗口最大化铺满,无标题栏);DPI 锁 96 保证 DPR = 1
|
|
SELKIES_MANUAL_WIDTH: ${BROWSER_DESKTOP_WIDTH:-1280}
|
|
SELKIES_MANUAL_HEIGHT: ${BROWSER_DESKTOP_HEIGHT:-900}
|
|
SELKIES_SCALING_DPI: "96|locked"
|
|
# 纯 CPU 编码:帧率上限 30;有 GPU 时挂 /dev/dri 自动启用硬编
|
|
SELKIES_FRAMERATE: ${BROWSER_DESKTOP_FRAMERATE:-24,8-30}
|
|
# 只允许文本剪贴板;音频、麦克风、摄像头、手柄、文件传输、打印、命令、共享一律关闭
|
|
SELKIES_ENABLE_BINARY_CLIPBOARD: "false|locked"
|
|
SELKIES_AUDIO_ENABLED: "false|locked"
|
|
SELKIES_MICROPHONE_ENABLED: "false|locked"
|
|
SELKIES_WEBCAM_ENABLED: "false|locked"
|
|
SELKIES_GAMEPAD_ENABLED: "false|locked"
|
|
SELKIES_FILE_TRANSFERS: ""
|
|
SELKIES_PRINTING_ENABLED: "false|locked"
|
|
SELKIES_COMMAND_ENABLED: "false|locked"
|
|
SELKIES_ENABLE_SHARING: "false|locked"
|
|
SELKIES_UI_SIDEBAR_SHOW_FILES: "false"
|
|
SELKIES_UI_SIDEBAR_SHOW_APPS: "false"
|
|
SELKIES_UI_SIDEBAR_SHOW_SHARING: "false"
|
|
SELKIES_UI_SIDEBAR_SHOW_GAMEPADS: "false"
|
|
SELKIES_UI_SIDEBAR_SHOW_WEBCAM: "false"
|
|
SELKIES_UI_SIDEBAR_SHOW_AUDIO_SETTINGS: "false"
|
|
# 容器内输入法(备选;缺省用访问者本机输入法):fcitx5 = 启动 fcitx5(拼音 + mozc,Ctrl+Space 切换)
|
|
UMT_DESKTOP_IME: ${BROWSER_DESKTOP_IME:-}
|
|
volumes:
|
|
- umt-camofox:/root/.camofox
|
|
# Firefox 多进程需要较大的 /dev/shm(上游 Makefile 用 2g)
|
|
shm_size: 2gb
|
|
# 桌面镜像另有 labwc + Selkies + nginx 常驻(实测见 runbook §8);纯截图旧镜像 2g 足够
|
|
mem_limit: ${CAMOFOX_MEM_LIMIT:-3g}
|
|
healthcheck:
|
|
test: ["CMD", "curl", "-fsS", "-o", "/dev/null", "http://127.0.0.1:9377/health"]
|
|
interval: 30s
|
|
timeout: 5s
|
|
start_period: 30s
|
|
retries: 3
|
|
# 桌面镜像由 s6 逐级停止,camofox 关机要落盘登录状态
|
|
stop_grace_period: 30s
|
|
logging: *logging
|
|
|
|
# 可选 HTTPS 入口(profile tls):桌面模式的视频解码(WebCodecs)与剪贴板只在 HTTPS(或 localhost)下可用。
|
|
# 已有反代(nginx / Caddy / Traefik)终结 TLS 时不需要它。配置见 docker/browser-desktop/Caddyfile:
|
|
# TLS_DOMAIN 不设 = 自签(Caddy 内部 CA);TLS_DOMAIN=域名 + TLS_ISSUER=邮箱 = ACME 自动证书
|
|
# docker compose --profile tls up -d
|
|
caddy:
|
|
image: caddy:2-alpine
|
|
profiles: ["tls"]
|
|
restart: unless-stopped
|
|
depends_on:
|
|
- app
|
|
environment:
|
|
# 空 = https://(任意主机名,自签按需签发)
|
|
TLS_DOMAIN: ${TLS_DOMAIN:-https://}
|
|
TLS_ISSUER: ${TLS_ISSUER:-internal}
|
|
ports:
|
|
- "${TLS_BIND:-0.0.0.0}:${TLS_PORT:-443}:443"
|
|
volumes:
|
|
- ./docker/browser-desktop/Caddyfile:/etc/caddy/Caddyfile:ro
|
|
- umt-caddy:/data
|
|
logging: *logging
|
|
|
|
app:
|
|
build:
|
|
context: .
|
|
args:
|
|
APP_VERSION: ${APP_VERSION:-}
|
|
APT_MIRROR: ${APT_MIRROR:-}
|
|
image: uhd-media-tool:${APP_VERSION:-latest}
|
|
restart: unless-stopped
|
|
depends_on:
|
|
postgres:
|
|
condition: service_healthy
|
|
# 只要求已启动,不等健康:浏览器服务挂了 app 照常运行,界面标"浏览器不可用"
|
|
camofox:
|
|
condition: service_started
|
|
required: false
|
|
environment:
|
|
NODE_ENV: production
|
|
DATABASE_URL: postgres://umt:${POSTGRES_PASSWORD}@postgres:5432/umt
|
|
SECRET_MASTER_KEY: ${SECRET_MASTER_KEY:?请设置 SECRET_MASTER_KEY(openssl rand -hex 32)}
|
|
LOG_LEVEL: ${LOG_LEVEL:-info}
|
|
# 运行用户:DATA_DIR 由 entrypoint chown 成它;媒体库/下载目录需对它可读写
|
|
PUID: ${PUID:-10001}
|
|
PGID: ${PGID:-10001}
|
|
BACKUP_KEEP: ${BACKUP_KEEP:-14}
|
|
# worker 并发:io 组(文件 / 网络 / 维护三条道)与 agent 组(runAgent/resolveDecision)分池
|
|
# io worker 三条道的并发(WK-1):不设 = 用 设置 → 自动化 → 高级 里的值(缺省 文件 2 / 网络 4 / 维护 1);
|
|
# 设了就以环境变量为准。旧 WORKER_CONCURRENCY 映射到网络道。
|
|
WORKER_CONCURRENCY: ${WORKER_CONCURRENCY:-}
|
|
WORKER_FILE_CONCURRENCY: ${WORKER_FILE_CONCURRENCY:-}
|
|
WORKER_NETWORK_CONCURRENCY: ${WORKER_NETWORK_CONCURRENCY:-}
|
|
WORKER_MAINTENANCE_CONCURRENCY: ${WORKER_MAINTENANCE_CONCURRENCY:-}
|
|
WORKER_AGENT_CONCURRENCY: ${WORKER_AGENT_CONCURRENCY:-2}
|
|
# 手动按路径整理时递归遍历的文件数上限
|
|
ORGANIZE_WALK_MAX_FILES: ${ORGANIZE_WALK_MAX_FILES:-5000}
|
|
# 浏览器服务:缺省指向上面的 camofox;接自有实例改成它的地址与访问凭据;false = 停用
|
|
BROWSER_PROVIDER_URL: ${BROWSER_PROVIDER_URL:-http://camofox:9377}
|
|
BROWSER_ACCESS_KEY: ${BROWSER_ACCESS_KEY:-${CAMOFOX_ACCESS_KEY:-}}
|
|
BROWSER_ENABLED: ${BROWSER_ENABLED:-true}
|
|
# 桌面接管 / 人工接管 / 智能体正在用的会话每隔多久保活一次(camofox 标签页空闲 5 分钟回收);0 = 关闭
|
|
BROWSER_KEEPALIVE_MS: ${BROWSER_KEEPALIVE_MS:-120000}
|
|
# 原站视图桌面模式的上游(桌面镜像的 Selkies);缺省由 BROWSER_PROVIDER_URL 推出(端口换 3000)
|
|
BROWSER_DESKTOP_URL: ${BROWSER_DESKTOP_URL:-}
|
|
# 出站代理(HTTP_PROXY/HTTPS_PROXY)在 override 里给(见 docs/runbook/deploy.md「容器经宿主代理」)。
|
|
# Deno 按主机名匹配 NO_PROXY、不会因解析到内网 IP 而直连:同 compose 网络的服务名(postgres、camofox、
|
|
# 下载器 qbittorrent 等)必须列在这里,否则连下载器也会绕到代理上失败。自有下载器服务名不同就改 UMT_NO_PROXY。
|
|
NO_PROXY: ${UMT_NO_PROXY:-localhost,127.0.0.1,::1,postgres,camofox,proxy-relay,qbittorrent,qbittorrent-nox,qb,transmission,deluge,aria2,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16}
|
|
ports:
|
|
- "${UMT_BIND:-0.0.0.0}:${UMT_PORT:-4380}:4380"
|
|
volumes:
|
|
# 应用数据:agent-sessions/ backups/ exports/ tmp/
|
|
- umt-data:/data
|
|
# 媒体库根与下载缓存目录按需挂载(容器内路径 = 控制台里登记的库根 / 路径映射 local 前缀):
|
|
# - /srv/media:/media
|
|
# - /srv/downloads:/downloads
|
|
stop_grace_period: 15s
|
|
logging: *logging
|
|
|
|
volumes:
|
|
umt-pg-data:
|
|
umt-data:
|
|
umt-camofox:
|
|
umt-caddy:
|
|
|
|
networks:
|
|
# 固定网段(属于 172.16.0.0/12),便于宿主防火墙按网段放行容器到宿主的代理/中继端口
|
|
default:
|
|
ipam:
|
|
config:
|
|
- subnet: ${UMT_SUBNET:-172.30.0.0/24}
|