hicocos
841e1ebd55
Persist upload, OAuth, session, and Telegram lease state while enforcing fail-closed authentication and storage behavior. Add deletion compensation, bounded frontend requests and uploads, readiness checks, operational safeguards, backup tooling, and regression coverage.
124 lines
3.7 KiB
YAML
124 lines
3.7 KiB
YAML
name: tg-vault
|
|
|
|
services:
|
|
# 前端（暴露到宿主机供 Nginx 反代）
|
|
frontend:
|
|
image: tg-vault-frontend:latest
|
|
build:
|
|
context: ./frontend
|
|
args:
|
|
- VITE_API_URL=${VITE_API_URL:-https://api.example.com}
|
|
container_name: tg-vault-frontend
|
|
ports:
|
|
- "127.0.0.1:47832:80"
|
|
networks:
|
|
- tg-vault-network
|
|
depends_on:
|
|
backend:
|
|
condition: service_healthy
|
|
restart: unless-stopped
|
|
stop_grace_period: 15s
|
|
healthcheck:
|
|
test: [ "CMD-SHELL", "wget -q -O - http://127.0.0.1/ >/dev/null" ]
|
|
interval: 15s
|
|
timeout: 5s
|
|
retries: 5
|
|
logging:
|
|
driver: json-file
|
|
options:
|
|
max-size: "10m"
|
|
max-file: "3"
|
|
|
|
# 后端（暴露到宿主机供 Nginx 反代）
|
|
backend:
|
|
image: tg-vault-backend:latest
|
|
build: ./backend
|
|
container_name: tg-vault-backend
|
|
ports:
|
|
- "127.0.0.1:51947:51947"
|
|
depends_on:
|
|
postgres:
|
|
condition: service_healthy
|
|
environment:
|
|
- DATABASE_URL=postgresql://tgvault:${DB_PASSWORD:?DB_PASSWORD is required}@postgres:5432/tgvault
|
|
- PORT=51947
|
|
- NODE_ENV=production
|
|
- COOKIE_SECURE=${COOKIE_SECURE:-true}
|
|
- UPLOAD_DIR=/data/uploads
|
|
- THUMBNAIL_DIR=/data/thumbnails
|
|
- PREVIEW_DIR=/data/previews
|
|
- CHUNK_DIR=/data/chunks
|
|
- DUPLICATE_FILE_MODE=${DUPLICATE_FILE_MODE:-copy}
|
|
- AUTO_CLEANUP_ORPHANS=${AUTO_CLEANUP_ORPHANS:-true}
|
|
- VITE_API_URL=${VITE_API_URL:-https://api.example.com}
|
|
- CORS_ORIGIN=${CORS_ORIGIN:-https://cloud.example.com}
|
|
- SESSION_SECRET=${SESSION_SECRET:-}
|
|
- STORAGE_CREDENTIALS_SECRET=${STORAGE_CREDENTIALS_SECRET:-}
|
|
- TG_VAULT_SECRET_DIR=/data/secrets
|
|
- DOMAIN=${DOMAIN:-cloud.example.com}
|
|
- TELEGRAM_BOT_TOKEN=${TELEGRAM_BOT_TOKEN:-}
|
|
- TELEGRAM_API_ID=${TELEGRAM_API_ID:-}
|
|
- TELEGRAM_API_HASH=${TELEGRAM_API_HASH:-}
|
|
- TELEGRAM_USER_SESSION_FILE=${TELEGRAM_USER_SESSION_FILE:-/data/telegram_user_session.txt}
|
|
- TELEGRAM_DOWNLOAD_WORKERS=${TELEGRAM_DOWNLOAD_WORKERS:-4}
|
|
- TELEGRAM_FILE_DOWNLOAD_CONCURRENCY=${TELEGRAM_FILE_DOWNLOAD_CONCURRENCY:-2}
|
|
- TELEGRAM_RATE_WINDOW_MS=${TELEGRAM_RATE_WINDOW_MS:-60000}
|
|
- TELEGRAM_RATE_MAX=${TELEGRAM_RATE_MAX:-30}
|
|
- TELEGRAM_HEAVY_RATE_WINDOW_MS=${TELEGRAM_HEAVY_RATE_WINDOW_MS:-600000}
|
|
- TELEGRAM_HEAVY_RATE_MAX=${TELEGRAM_HEAVY_RATE_MAX:-5}
|
|
- TELEGRAM_COMMENTS_MAX_PER_POST=${TELEGRAM_COMMENTS_MAX_PER_POST:-200}
|
|
- TOTP_SECRET=${TOTP_SECRET:-}
|
|
volumes:
|
|
- file-storage:/data
|
|
networks:
|
|
- tg-vault-network
|
|
restart: unless-stopped
|
|
stop_grace_period: 35s
|
|
healthcheck:
|
|
test: [ "CMD-SHELL", "node -e \"fetch('http://127.0.0.1:51947/readyz').then(r=>{if(!r.ok)process.exit(1)}).catch(()=>process.exit(1))\"" ]
|
|
interval: 15s
|
|
timeout: 5s
|
|
retries: 10
|
|
start_period: 20s
|
|
logging:
|
|
driver: json-file
|
|
options:
|
|
max-size: "10m"
|
|
max-file: "5"
|
|
|
|
# 数据库
|
|
postgres:
|
|
image: postgres:16-alpine
|
|
container_name: tg-vault-postgres
|
|
environment:
|
|
- POSTGRES_DB=tgvault
|
|
- POSTGRES_USER=tgvault
|
|
- POSTGRES_PASSWORD=${DB_PASSWORD:?DB_PASSWORD is required}
|
|
volumes:
|
|
- postgres-data:/var/lib/postgresql/data
|
|
- ./init.sql:/docker-entrypoint-initdb.d/init.sql
|
|
networks:
|
|
- tg-vault-network
|
|
restart: unless-stopped
|
|
healthcheck:
|
|
test: [ "CMD-SHELL", "pg_isready -U tgvault -d tgvault" ]
|
|
interval: 5s
|
|
timeout: 5s
|
|
retries: 5
|
|
stop_grace_period: 30s
|
|
logging:
|
|
driver: json-file
|
|
options:
|
|
max-size: "10m"
|
|
max-file: "5"
|
|
|
|
volumes:
|
|
file-storage:
|
|
driver: local
|
|
postgres-data:
|
|
driver: local
|
|
|
|
networks:
|
|
tg-vault-network:
|
|
driver: bridge
|