279 lines
8.6 KiB
YAML
279 lines
8.6 KiB
YAML
# ============================================================
|
||
# 红动未来 - 第三方中间件
|
||
# ============================================================
|
||
# 启动：docker compose -f deploy/docker-compose-infra-main.yml up -d
|
||
# 停止：docker compose -f deploy/docker-compose-infra-main.yml down
|
||
# ============================================================
|
||
|
||
name: redfuture
|
||
|
||
networks:
|
||
redfuture-net:
|
||
driver: bridge
|
||
|
||
services:
|
||
|
||
# ---- PostgreSQL (pgvector) ----
|
||
postgres:
|
||
image: docker.m.daocloud.io/pgvector/pgvector:pg16
|
||
container_name: postgres
|
||
restart: unless-stopped
|
||
ports:
|
||
- "5432:5432"
|
||
environment:
|
||
# 仅首次初始化空数据卷时生效；库内超级用户已被 ALTER ROLE 改名、口令已改，
|
||
# 这里写成与新库一致的名字/口令（占位符，需你自行替换成实际值）。
|
||
POSTGRES_USER: 259278618@qq.com
|
||
POSTGRES_PASSWORD: Tongli686^*^
|
||
POSTGRES_DB: postgres
|
||
volumes:
|
||
- /data/pgsql:/var/lib/postgresql/data
|
||
command: ["postgres", "-c", "wal_level=replica", "-c", "max_wal_senders=10", "-c", "max_replication_slots=10", "-c", "hot_standby=on"]
|
||
networks:
|
||
- redfuture-net
|
||
healthcheck:
|
||
# 真实连接探测（容器内本地 socket 是 trust 认证免密），角色/库名引用环境变量；
|
||
# 不用 pg_isready：它不带 -U 时以 OS 用户 root 握手，服务器每 10s 记一条 FATAL: role "root" does not exist
|
||
test: ["CMD-SHELL", "psql -U \"$$POSTGRES_USER\" -d \"$$POSTGRES_DB\" -c 'select 1'"]
|
||
interval: 10s
|
||
timeout: 5s
|
||
retries: 5
|
||
|
||
# ---- PostgreSQL 自动备份 (每日凌晨 2:00) ----
|
||
postgres-backup:
|
||
image: docker.m.daocloud.io/pgvector/pgvector:pg16
|
||
container_name: postgres-backup
|
||
restart: unless-stopped
|
||
depends_on:
|
||
postgres:
|
||
condition: service_healthy
|
||
volumes:
|
||
- /data/pgsql/backup:/backup
|
||
environment:
|
||
TZ: Asia/Shanghai # 使下面的 02:00 与备份文件名时间都按北京时间计算
|
||
PGUSER: 259278618@qq.com # ← 改为你 ALTER ROLE 后的新超级用户名
|
||
PGPASSWORD: Tongli686^*^ # ← 改为新超级用户口令
|
||
PGHOST: postgres
|
||
PGPORT: 5432
|
||
BACKUP_DIR: /backup
|
||
RETENTION_DAYS: 7
|
||
networks:
|
||
- redfuture-net
|
||
entrypoint: ["/bin/sh", "-c"]
|
||
command:
|
||
- |
|
||
set -e
|
||
mkdir -p "/backup"
|
||
echo "[$(date '+%F %T %Z')] postgres-backup started. Will run once per day at 02:00."
|
||
while true; do
|
||
# 睡到下一个 02:00（容器 TZ=Asia/Shanghai → 即北京时间凌晨2点）
|
||
now=$$(date +%s)
|
||
target=$$(date -d "today 02:00" +%s)
|
||
[ "$${target}" -le "$${now}" ] && target=$$(date -d "tomorrow 02:00" +%s)
|
||
echo "[$(date '+%F %T')] next backup scheduled at $(date -d "@$${target}" '+%F %T')"
|
||
sleep $(( target - now ))
|
||
|
||
f="backup_$(date +%Y%m%d_%H%M%S).sql.gz"
|
||
tmp="/backup/$${f}.tmp"
|
||
echo "[$(date '+%F %T')] Starting backup: $${f}"
|
||
# 连接身份取自上面环境变量 PGUSER/PGPASSWORD（无需在命令里再写 -U）
|
||
if pg_dumpall -h postgres > "$${tmp}" && gzip -f "$${tmp}" && mv "$${tmp}.gz" "/backup/$${f}"; then
|
||
echo "[$(date '+%F %T')] Backup complete"
|
||
else
|
||
echo "[$(date '+%F %T')] Backup FAILED, removing partial file"
|
||
rm -f "$${tmp}" "$${tmp}.gz"
|
||
fi
|
||
find /backup -name "backup_*.sql.gz" -mtime +7 -delete 2>/dev/null || true
|
||
done
|
||
|
||
# ---- Redis ----
|
||
redis:
|
||
image: docker.m.daocloud.io/redis:7.4.8
|
||
container_name: redis
|
||
restart: unless-stopped
|
||
ports:
|
||
- "6379:6379"
|
||
command: redis-server --requirepass Tongli686^*^
|
||
volumes:
|
||
- /data/redis:/data
|
||
networks:
|
||
- redfuture-net
|
||
healthcheck:
|
||
test: ["CMD", "redis-cli", "--raw", "incr", "ping"]
|
||
interval: 10s
|
||
timeout: 5s
|
||
retries: 5
|
||
|
||
# ---- Consul ----
|
||
consul:
|
||
image: docker.m.daocloud.io/consul:1.15.4
|
||
container_name: consul
|
||
restart: unless-stopped
|
||
ports:
|
||
- "8500:8500"
|
||
init: true
|
||
command: agent -server -bootstrap -ui -data-dir=/consul/data -bind=0.0.0.0 -client=0.0.0.0
|
||
volumes:
|
||
- /data/consul:/consul/data
|
||
networks:
|
||
- redfuture-net
|
||
|
||
# ---- MinIO ----
|
||
minio:
|
||
image: docker.m.daocloud.io/minio/minio
|
||
container_name: minio
|
||
restart: unless-stopped
|
||
ports:
|
||
- "9000:9000"
|
||
- "9001:9001"
|
||
environment:
|
||
MINIO_ROOT_USER: admin
|
||
MINIO_ROOT_PASSWORD: Bjang09@686^*^
|
||
command: server /data --console-address ":9001"
|
||
volumes:
|
||
- /data/minio:/data
|
||
networks:
|
||
- redfuture-net
|
||
|
||
# ---- MeiliSearch ----
|
||
meilisearch:
|
||
image: docker.m.daocloud.io/getmeili/meilisearch:v1.40.0
|
||
container_name: meilisearch
|
||
restart: unless-stopped
|
||
ports:
|
||
- "7700:7700"
|
||
environment:
|
||
MEILI_MASTER_KEY: wMW7BPM3CLwnEGpPbaoci-HvB8R37wV-5tGIizsDQSQ
|
||
volumes:
|
||
- /data/meilisearch:/meili_data
|
||
networks:
|
||
- redfuture-net
|
||
|
||
# ---- NATS (with JetStream) ----
|
||
nats:
|
||
image: docker.m.daocloud.io/nats:latest
|
||
container_name: nats
|
||
restart: unless-stopped
|
||
ports:
|
||
- "4222:4222"
|
||
- "8222:8222"
|
||
command: -js -sd /data -m 8222
|
||
volumes:
|
||
- /data/nats:/data
|
||
depends_on:
|
||
redis:
|
||
condition: service_healthy
|
||
networks:
|
||
- redfuture-net
|
||
|
||
# ---- Jaeger (All-in-One 分布式追踪) ----
|
||
jaeger:
|
||
image: docker.m.daocloud.io/jaegertracing/all-in-one:latest
|
||
container_name: jaeger
|
||
restart: unless-stopped
|
||
ports:
|
||
- "16686:16686"
|
||
- "4317:4317"
|
||
- "4318:4318"
|
||
- "14250:14250"
|
||
environment:
|
||
COLLECTOR_OTLP_ENABLED: "true"
|
||
COLLECTOR_ZIPKIN_ENABLED: "false"
|
||
LOG_LEVEL: "info"
|
||
networks:
|
||
- redfuture-net
|
||
|
||
# ---- Gitea (Git 代码托管) ----
|
||
gitea:
|
||
image: docker.m.daocloud.io/gitea/gitea:latest
|
||
container_name: gitea
|
||
restart: unless-stopped
|
||
ports:
|
||
- "3000:3000"
|
||
- "2222:2222"
|
||
environment:
|
||
USER_UID: 1000
|
||
USER_GID: 1000
|
||
GITEA__server__SSH_PORT: "2222"
|
||
volumes:
|
||
- /data/gitea:/data
|
||
networks:
|
||
- redfuture-net
|
||
healthcheck:
|
||
test: ["CMD", "curl", "-f", "http://localhost:3000/api/healthz"]
|
||
interval: 30s
|
||
timeout: 5s
|
||
retries: 3
|
||
|
||
# ---- Gitea CI/CD Runner (act_runner) ----
|
||
# host 模式：job 在 runner 容器内直接执行（kubectl/docker 可直接用）
|
||
# k3s 在 121.37.117.181，经宿主机 systemd 服务 k3s-ssh-tunnel.service
|
||
# (ssh -L 16443:127.0.0.1:6443) 隧道访问，故 runner 必须与隧道同网络命名空间
|
||
gitea-runner:
|
||
build:
|
||
context: ./gitea-runner
|
||
dockerfile: Dockerfile
|
||
image: redfuture-runner:latest
|
||
container_name: gitea-runner
|
||
restart: unless-stopped
|
||
network_mode: host
|
||
depends_on:
|
||
gitea:
|
||
condition: service_healthy
|
||
environment:
|
||
GITEA_INSTANCE_URL: http://127.0.0.1:3000
|
||
GITEA_RUNNER_REGISTRATION_TOKEN: 9lGvGJxk7M781IYBWDV0ZuZpXV5RkGKlIpkhRVNs
|
||
GITEA_RUNNER_NAME: gitea-runner
|
||
# host 标签：job 直接在 runner 容器内执行，才能使用挂载的 kubectl/kubeconfig
|
||
GITEA_RUNNER_LABELS: "ubuntu-latest:host"
|
||
volumes:
|
||
- /var/run/docker.sock:/var/run/docker.sock
|
||
- /data/gitea-runner:/data
|
||
- /data/gitea-runner/bin/kubectl:/usr/local/bin/kubectl
|
||
- /data/gitea-runner/bin/docker:/usr/local/bin/docker
|
||
- /data/gitea-runner/.kube/config:/root/.kube/config
|
||
# dev 宿主机本地 k3s (127.0.0.1:6443)，与 181 集群(16443)分开
|
||
- /etc/rancher/k3s/k3s.yaml:/root/.kube/k3s-dev.yaml
|
||
healthcheck:
|
||
test: ["CMD-SHELL", "test -f /data/.runner"]
|
||
interval: 30s
|
||
timeout: 5s
|
||
retries: 5
|
||
|
||
# ---- 本地镜像仓库 (CI 构建产物中转，k3s containerd 拉取) ----
|
||
# 仅绑定 127.0.0.1，供本机 runner push / k3s containerd pull
|
||
registry:
|
||
image: docker.m.daocloud.io/registry:2
|
||
container_name: registry
|
||
restart: unless-stopped
|
||
ports:
|
||
- "127.0.0.1:5000:5000"
|
||
volumes:
|
||
- /data/registry:/var/lib/registry
|
||
networks:
|
||
- redfuture-net
|
||
|
||
# ---- Nginx 反向代理 ----
|
||
nginx:
|
||
build:
|
||
context: ./nginx-proxy
|
||
dockerfile: Dockerfile
|
||
container_name: nginx
|
||
restart: unless-stopped
|
||
ports:
|
||
- "80:80"
|
||
- "443:443"
|
||
networks:
|
||
- redfuture-net
|
||
|
||
# ---- media 运行时基础镜像（ffmpeg/python/node/chromium/hyperframes） ----
|
||
media-deps:
|
||
build:
|
||
context: ../
|
||
dockerfile: deploy/media-deps/Dockerfile
|
||
image: redfuture-media-deps:latest
|
||
container_name: media-deps
|
||
restart: "no"
|
||
networks:
|
||
- redfuture-net
|