Files
rent/deploy/docker/docker-compose.prod.yml
T
xiaoquan b358dbdab1 feat: 使用 Gitea Secrets 管理全部密钥
- deploy.yml 从 secrets 动态生成 .env,部署后自动删除
- docker-compose.prod.yml 支持全部业务配置注入(短信/微信/支付宝等)
- .env.example 只保留 GITEA_RUNNER_TOKEN,其他密钥全部迁移到 Secrets
- 更新 deploy/README.md 文档,完整列出 Secrets 配置清单

服务器上不再存储任何密码文件,安全性大幅提升

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-01 21:01:22 +08:00

134 lines
3.4 KiB
YAML

version: '3.8'
services:
mysql:
image: mysql:8.0
container_name: rent-prod-mysql
restart: always
environment:
MYSQL_ROOT_PASSWORD: ${PROD_DB_PASSWORD:-rent123456}
MYSQL_DATABASE: rent_platform
MYSQL_CHARSET: utf8mb4
MYSQL_COLLATION: utf8mb4_unicode_ci
ports:
- "3306:3306"
volumes:
- mysql_prod_data:/var/lib/mysql
- ../../database/migrations:/docker-entrypoint-initdb.d
command: --character-set-server=utf8mb4 --collation-server=utf8mb4_unicode_ci
healthcheck:
test: ["CMD", "mysqladmin", "ping", "-h", "localhost"]
interval: 10s
timeout: 5s
retries: 5
networks:
- rent-prod
redis:
image: redis:7-alpine
container_name: rent-prod-redis
restart: always
ports:
- "6379:6379"
volumes:
- redis_prod_data:/data
command: redis-server --appendonly yes
healthcheck:
test: ["CMD", "redis-cli", "ping"]
interval: 10s
timeout: 5s
retries: 5
networks:
- rent-prod
server:
build:
context: ../..
dockerfile: deploy/docker/Dockerfile.server
container_name: rent-prod-server
restart: always
ports:
- "3000:3000"
environment:
NODE_ENV: production
PORT: 3000
# Docker 内部网络
DB_HOST: mysql
DB_PORT: 3306
DB_USERNAME: root
DB_DATABASE: rent_platform
REDIS_HOST: redis
REDIS_PORT: 6379
# 从 .env.prod 注入的密钥
DB_PASSWORD: ${PROD_DB_PASSWORD}
JWT_SECRET: ${PROD_JWT_SECRET}
JWT_EXPIRES_IN: ${PROD_JWT_EXPIRES_IN:-2h}
JWT_REFRESH_EXPIRES_IN: ${PROD_JWT_REFRESH_EXPIRES_IN:-7d}
SMS_ACCESS_KEY_ID: ${PROD_SMS_ACCESS_KEY_ID:-}
SMS_ACCESS_KEY_SECRET: ${PROD_SMS_ACCESS_KEY_SECRET:-}
SMS_SIGN_NAME: ${PROD_SMS_SIGN_NAME:-}
SMS_TEMPLATE_CODE: ${PROD_SMS_TEMPLATE_CODE:-}
WECHAT_APPID: ${PROD_WECHAT_APPID:-}
WECHAT_SECRET: ${PROD_WECHAT_SECRET:-}
WECHAT_MCHID: ${PROD_WECHAT_MCHID:-}
WECHAT_SERIAL_NO: ${PROD_WECHAT_SERIAL_NO:-}
WECHAT_APIV3_KEY: ${PROD_WECHAT_APIV3_KEY:-}
WECHAT_PRIVATE_KEY: ${PROD_WECHAT_PRIVATE_KEY:-}
WECHAT_PAY_NOTIFY_URL: ${PROD_WECHAT_PAY_NOTIFY_URL:-}
WECHAT_REFUND_NOTIFY_URL: ${PROD_WECHAT_REFUND_NOTIFY_URL:-}
ALIPAY_APPID: ${PROD_ALIPAY_APPID:-}
ALIPAY_PRIVATE_KEY: ${PROD_ALIPAY_PRIVATE_KEY:-}
API_BASE_URL: ${PROD_API_BASE_URL:-http://localhost:3000}
depends_on:
mysql:
condition: service_healthy
redis:
condition: service_healthy
networks:
- rent-prod
merchant-admin:
build:
context: ../..
dockerfile: deploy/docker/Dockerfile.merchant
container_name: rent-prod-merchant
restart: always
ports:
- "8081:80"
depends_on:
- server
networks:
- rent-prod
platform-admin:
build:
context: ../..
dockerfile: deploy/docker/Dockerfile.platform
container_name: rent-prod-platform
restart: always
ports:
- "8082:80"
depends_on:
- server
networks:
- rent-prod
website:
build:
context: ../..
dockerfile: deploy/docker/Dockerfile.website
container_name: rent-prod-website
restart: always
ports:
- "8083:80"
networks:
- rent-prod
volumes:
mysql_prod_data:
redis_prod_data:
networks:
rent-prod:
name: rent-prod