test

docker-compose.prod.yml

@@ -38,6 +38,45 @@ services:
     ports:
       - "25010:5432"
 
+  # 戎行 OpenVPN 客户端 + SOCKS5（仅 192.168.3.43 走隧道）
+  # 证书目录：默认 ./secrets/openvpn；1Panel 建议：
+  #   export RONGXING_VPN_CONFIG=/opt/1panel/apps/hyapi-secrets/openvpn
+  rongxing-vpn:
+    build:
+      context: ./deployments/openvpn
+      dockerfile: Dockerfile
+    image: hyapi-rongxing-vpn:local
+    container_name: hyapi-rongxing-vpn
+    environment:
+      TZ: Asia/Shanghai
+      RONGXING_HOST: "192.168.3.43"
+      SOCKS_HOST: "0.0.0.0"
+      SOCKS_PORT: "1080"
+    volumes:
+      - ${RONGXING_VPN_CONFIG:-./secrets/openvpn}:/vpn:ro
+    cap_add:
+      - NET_ADMIN
+    devices:
+      - /dev/net/tun:/dev/net/tun
+    networks:
+      - hyapi-network
+    # 禁止把 1080 暴露到宿主机公网
+    restart: unless-stopped
+    healthcheck:
+      test: ["CMD-SHELL", "ip link show tun0 >/dev/null 2>&1 || exit 1"]
+      interval: 30s
+      timeout: 5s
+      retries: 5
+      start_period: 60s
+    deploy:
+      resources:
+        limits:
+          memory: 256M
+          cpus: "0.3"
+        reservations:
+          memory: 64M
+          cpus: "0.1"
+
   # Redis 缓存 (生产环境)
   redis:
     image: redis:8.0.2
@@ -101,6 +140,8 @@ services:
         condition: service_healthy
       redis:
         condition: service_healthy
+      rongxing-vpn:
+        condition: service_started
     healthcheck:
       test: ["CMD", "curl", "-f", "http://localhost:8080/health"]
       interval: 30s
@@ -134,6 +175,8 @@ services:
         condition: service_healthy
       redis:
         condition: service_healthy
+      rongxing-vpn:
+        condition: service_started
     healthcheck:
       test: ["CMD", "ps", "aux", "|", "grep", "worker"]
       interval: 30s