hyapi-server/docker-compose.prod.yml

version: "3.8"

services:
  # PostgreSQL 数据库 (生产环境)
  postgres:
    image: postgres:16.9
    container_name: hyapi-postgres-prod
    environment:
      TZ: Asia/Shanghai
      PGTZ: Asia/Shanghai
      POSTGRES_DB: hyapi
      POSTGRES_USER: hyapi_user
      POSTGRES_PASSWORD: Qm8kZ3nR7pL4wT9y
      POSTGRES_INITDB_ARGS: "--encoding=UTF-8 --lc-collate=C --lc-ctype=C"
      # 性能优化配置
      POSTGRES_SHARED_PRELOAD_LIBRARIES: pg_stat_statements
    volumes:
      - postgres_data:/var/lib/postgresql/data
      - ./scripts/init.sql:/docker-entrypoint-initdb.d/init.sql
    networks:
      - hyapi-network
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U hyapi_user -d hyapi -h localhost"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 120s
    restart: unless-stopped
    deploy:
      resources:
        limits:
          memory: 2G
          cpus: "1.0"
        reservations:
          memory: 512M
          cpus: "0.5"
    # 生产环境暴露数据库端口到主机
    ports:
      - "25010:5432"

  # 戎行 OpenVPN 客户端 + SOCKS5（仅 192.168.3.43 走隧道）
  # 证书目录：默认 ./secrets/openvpn；1Panel 建议：
  #   export RONGXING_VPN_CONFIG=/opt/1panel/apps/hyapi-secrets/openvpn
  rongxing-vpn:
    build:
      context: ./deployments/openvpn
      dockerfile: Dockerfile
    image: hyapi-rongxing-vpn:local
    container_name: hyapi-rongxing-vpn
    environment:
      TZ: Asia/Shanghai
      RONGXING_HOST: "192.168.3.43"
      SOCKS_HOST: "0.0.0.0"
      SOCKS_PORT: "1080"
    volumes:
      - ${RONGXING_VPN_CONFIG:-./secrets/openvpn}:/vpn:ro
    cap_add:
      - NET_ADMIN
    devices:
      - /dev/net/tun:/dev/net/tun
    networks:
      - hyapi-network
    # 禁止把 1080 暴露到宿主机公网
    restart: unless-stopped
    healthcheck:
      test: ["CMD-SHELL", "ip link show tun0 >/dev/null 2>&1 || exit 1"]
      interval: 30s
      timeout: 5s
      retries: 5
      start_period: 60s
    deploy:
      resources:
        limits:
          memory: 256M
          cpus: "0.3"
        reservations:
          memory: 64M
          cpus: "0.1"

  # Redis 缓存 (生产环境)
  redis:
    image: redis:8.0.2
    container_name: hyapi-redis-prod
    environment:
      TZ: Asia/Shanghai
      REDIS_PASSWORD: ""
    volumes:
      - redis_data:/data
      - ./deployments/docker/redis.conf:/usr/local/etc/redis/redis.conf
    command: redis-server /usr/local/etc/redis/redis.conf
    networks:
      - hyapi-network
    healthcheck:
      test: redis-cli ping
      interval: 30s
      timeout: 10s
      retries: 5
    restart: unless-stopped
    deploy:
      resources:
        limits:
          memory: 1G
          cpus: "0.5"
        reservations:
          memory: 256M
          cpus: "0.2"
    # 生产环境不暴露端口到主机
    # ports:
    #   - "6379:6379"
  # HYAPI 应用程序
  hyapi-app:
    build:
      context: .
      dockerfile: Dockerfile
      args:
        VERSION: 1.0.0
        COMMIT: dev
    container_name: hyapi-app-prod
    environment:
      # 时区配置
      TZ: Asia/Shanghai

      # 环境设置
      ENV: production
    ports:
      - "25000:8080"
    volumes:
      - ./logs:/app/logs
      # 挂载完整 resources 目录（包含 qiye.html、Pure_Component、pdf 等）
      - ./resources:/app/resources
      # 持久化PDF缓存目录，确保生成的PDF在容器重启后仍然存在
      - ./storage/pdfg-cache:/app/storage/pdfg-cache
      # 汇博授权PDF本地留存目录（FLXGHB4F/QYGLBH7Y 等）
      - ./storage/huibo-auth-pdf:/app/storage/huibo-auth-pdf
    # user: "1001:1001"  # 注释掉，使用root权限运行
    networks:
      - hyapi-network
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
      rongxing-vpn:
        condition: service_started
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8080/health"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 60s
    restart: unless-stopped

  # HYAPI Worker 服务
  hyapi-worker:
    build:
      context: .
      dockerfile: Dockerfile.worker
      args:
        VERSION: 1.0.0
        COMMIT: dev
    container_name: hyapi-worker-prod
    environment:
      # 时区配置
      TZ: Asia/Shanghai

      # 环境设置
      ENV: production
    volumes:
      - ./logs:/root/logs
    # user: "1001:1001"  # 注释掉，使用root权限运行
    networks:
      - hyapi-network
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
      rongxing-vpn:
        condition: service_started
    healthcheck:
      test: ["CMD", "ps", "aux", "|", "grep", "worker"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 60s
    restart: unless-stopped

  # Asynq 任务监控 (生产环境)
  asynq-monitor:
    image: hibiken/asynqmon:latest
    container_name: hyapi-asynq-monitor-prod
    environment:
      TZ: Asia/Shanghai
    ports:
      - "25080:8080"
    command: --redis-addr=hyapi-redis-prod:6379
    networks:
      - hyapi-network
    depends_on:
      redis:
        condition: service_healthy
    healthcheck:
      test:
        [
          "CMD",
          "wget",
          "--no-verbose",
          "--tries=1",
          "--spider",
          "http://localhost:8080/health",
        ]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 30s
    restart: unless-stopped
    deploy:
      resources:
        limits:
          memory: 256M
          cpus: "0.3"
        reservations:
          memory: 64M
          cpus: "0.1"

volumes:
  postgres_data:
    driver: local
  redis_data:
    driver: local
  pure_component:
    driver: local

networks:
  hyapi-network:
    driver: bridge