From 72d711158181fd4d83a444815816cd1ffea08742 Mon Sep 17 00:00:00 2001 From: Yaojia Wang Date: Tue, 7 Jul 2026 14:16:52 +0200 Subject: [PATCH] =?UTF-8?q?fix(devops):=20=E7=94=9F=E4=BA=A7=20compose=20?= =?UTF-8?q?=E6=94=B6=E7=B4=A7=E2=80=94=E2=80=94api/web=20=E4=BB=85?= =?UTF-8?q?=E7=BB=91=20127.0.0.1(nginx=20=E5=94=AF=E4=B8=80=E5=85=A5?= =?UTF-8?q?=E5=8F=A3,basic=20auth=20=E4=B8=8D=E5=8F=AF=E7=BB=95)=E3=80=81p?= =?UTF-8?q?g=20=E4=B8=8D=E5=8F=91=E5=B8=83=E5=AE=BF=E4=B8=BB=E7=AB=AF?= =?UTF-8?q?=E5=8F=A3=E3=80=81web=20=E6=9E=84=E5=BB=BA=E9=BB=98=E8=AE=A4?= =?UTF-8?q?=E8=B5=B0=20npmmirror?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- docker-compose.prod.yml | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml index 1bab666..3110774 100644 --- a/docker-compose.prod.yml +++ b/docker-compose.prod.yml @@ -13,9 +13,10 @@ services: POSTGRES_USER: writer POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?POSTGRES_PASSWORD 必填（生产强口令，勿用 base 弱口令）} POSTGRES_DB: writer - # 不对公网暴露：仅绑本机回环（供宿主机跑迁移）。彻底隔离可整段删掉只走 compose 内网。 - ports: - - "127.0.0.1:5432:5432" + # 生产不发布任何宿主端口：迁移经 compose 内网（`run --rm api alembic`）直连 pg 服务名， + # 且宿主已有别的 pg 占用 127.0.0.1:5432。!reset 清掉 base 的 "5432:5432"——否则 compose + # 会「拼接」两份端口（base 的 0.0.0.0:5432 + 本层），既暴露公网又与宿主 pg 冲突。 + ports: !reset [] restart: unless-stopped api: @@ -26,6 +27,10 @@ services: LOG_JSON: "true" CREDENTIAL_ENC_KEY: ${CREDENTIAL_ENC_KEY:?CREDENTIAL_ENC_KEY 必填（生产 Fernet key，勿用占位值）} CORS_ORIGINS: ${CORS_ORIGINS:?CORS_ORIGINS 必填（前端真实来源，逗号分隔，禁通配）} + # base 发布 0.0.0.0:8000（dev 便利）；生产只绑回环——nginx 是唯一公网入口，basic auth 不可绕过。 + # !override 整体替换 base 的端口列表（否则拼接会残留 0.0.0.0:8000）。 + ports: !override + - "127.0.0.1:8000:8000" restart: unless-stopped web: @@ -34,7 +39,12 @@ services: args: # 构建期内联：生产须指向浏览器可达的公网 API（通常反代后的 https 域名）。 NEXT_PUBLIC_API_BASE: ${NEXT_PUBLIC_API_BASE:?NEXT_PUBLIC_API_BASE 必填（浏览器可达的公网 API 基址）} + # 本机所在区域 registry.npmjs.org 不可达，构建走 npmmirror 镜像（可用 env NPM_REGISTRY 覆盖）。 + NPM_REGISTRY: ${NPM_REGISTRY:-https://registry.npmmirror.com} environment: NEXT_PUBLIC_API_BASE: ${NEXT_PUBLIC_API_BASE:?NEXT_PUBLIC_API_BASE 必填} API_BASE_INTERNAL: http://api:8000 + # 只绑回环（同 api）：nginx 反代 127.0.0.1:3000 是唯一公网入口。!override 替换 base 的 3000:3000。 + ports: !override + - "127.0.0.1:3000:3000" restart: unless-stopped