正式环境

docker-compose.prod.yml

@@ -0,0 +1,157 @@
+version: '3.7'
+
+services:
+  # ==========================================
+  # Nginx (Frontend Production)
+  # ==========================================
+  nginx:
+    build:
+      context: ./frontend
+      target: production-stage
+      args:
+        # Defaults to /api/v1 which works with the proxy config in nginx.conf
+        - VITE_API_BASE_URL=/api/v1
+    ports:
+      - "80:80"
+      # - "443:443" # Uncomment if you configure SSL in nginx.conf
+    depends_on:
+      - backend
+    restart: always
+
+  # ==========================================
+  # Backend (FastAPI)
+  # ==========================================
+  backend:
+    build:
+      context: ./backend
+    environment:
+      - TZ=Asia/Shanghai
+      - MYSQL_SERVER=db
+      - MYSQL_PORT=3306
+      - MYSQL_USER=uap_user
+      - MYSQL_PASSWORD=uap_pass
+      - MYSQL_DB=uap_db
+      - REDIS_HOST=redis
+      - REDIS_PORT=6379
+      - HYDRA_ADMIN_URL=http://hydra:4445
+      # CORS: Add your production domain here
+      - BACKEND_CORS_ORIGINS=["http://localhost", "http://127.0.0.1", "http://YOUR_DOMAIN_OR_IP"]
+    depends_on:
+      db:
+        condition: service_healthy
+      redis:
+        condition: service_healthy
+      hydra:
+        condition: service_started
+    volumes:
+      - ./backend/logs:/app/logs # Persist logs
+      # - ./backend:/app # Remove hot reload in production for stability
+    restart: always
+
+  # ==========================================
+  # Database (MySQL)
+  # ==========================================
+  db:
+    image: mysql:8.0
+    command: --default-authentication-plugin=mysql_native_password
+    restart: always
+    environment:
+      TZ: Asia/Shanghai
+      MYSQL_ROOT_PASSWORD: root_password # CHANGE THIS IN PRODUCTION
+      MYSQL_DATABASE: uap_db
+      MYSQL_USER: uap_user
+      MYSQL_PASSWORD: uap_pass # CHANGE THIS IN PRODUCTION
+    volumes:
+      - db_data:/var/lib/mysql
+    healthcheck:
+      test: ["CMD", "mysqladmin" ,"ping", "-h", "localhost", "-u", "uap_user", "-p$$MYSQL_PASSWORD"]
+      interval: 10s
+      timeout: 5s
+      retries: 10
+      start_period: 10s
+
+  # ==========================================
+  # Redis
+  # ==========================================
+  redis:
+    image: redis:alpine
+    restart: always
+    volumes:
+      - redis_data:/data
+    healthcheck:
+      test: ["CMD", "redis-cli", "ping"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+
+  # ==========================================
+  # Ory Hydra Services
+  # ==========================================
+  hydra-migrate:
+    image: oryd/hydra:v2.2.0
+    environment:
+      - TZ=Asia/Shanghai
+      - DSN=postgres://hydra:secret@postgresd:5432/hydra?sslmode=disable&max_conns=20&max_idle_conns=4
+    command: migrate sql -e --yes
+    depends_on:
+      postgresd:
+        condition: service_healthy
+    restart: on-failure
+
+  hydra:
+    image: oryd/hydra:v2.2.0
+    depends_on:
+      hydra-migrate:
+        condition: service_completed_successfully
+    ports:
+      - "4444:4444" # Public port
+      - "4445:4445" # Admin port
+      - "5555:5555" # Token port? (Usually not needed if 4444 is used)
+    # Production command: Remove --dev, remove -c if config file missing
+    # Using --dangerous-force-http because we assume SSL is terminated by an external Nginx/LoadBalancer
+    # If exposing directly without SSL, this is INSECURE but necessary to start.
+    command: serve all --dangerous-force-http
+    environment:
+      - TZ=Asia/Shanghai
+      - DSN=postgres://hydra:secret@postgresd:5432/hydra?sslmode=disable&max_conns=20&max_idle_conns=4
+      
+      # IMPORTANT: Change URLs to your production domain
+      - URLS_SELF_ISSUER=http://192.168.254.105:4444
+      - URLS_CONSENT=http://192.168.254.105/consent
+      - URLS_LOGIN=http://192.168.254.105/login
+      - URLS_LOGOUT=http://192.168.254.105/login
+      
+      # IMPORTANT: Change these secrets!
+      - SECRETS_SYSTEM=youReallyNeedToChangeThis
+      - OIDC_SUBJECT_IDENTIFIERS_SUPPORTED_TYPES=public,pairwise
+      - OIDC_SUBJECT_IDENTIFIERS_PAIRWISE_SALT=youReallyNeedToChangeThis
+      
+      # CORS
+      - SERVE_PUBLIC_CORS_ENABLED=true
+      - SERVE_PUBLIC_CORS_ALLOWED_ORIGINS=*
+      - SERVE_PUBLIC_CORS_ALLOWED_METHODS=POST,GET,PUT,DELETE,PATCH,OPTIONS
+      - SERVE_PUBLIC_CORS_ALLOWED_HEADERS=Authorization,Content-Type
+      - SERVE_ADMIN_CORS_ENABLED=true
+      - SERVE_ADMIN_CORS_ALLOWED_ORIGINS=*
+
+  postgresd:
+    image: postgres:15
+    environment:
+      - TZ=Asia/Shanghai
+      - POSTGRES_USER=hydra
+      - POSTGRES_PASSWORD=secret # CHANGE THIS
+      - POSTGRES_DB=hydra
+    volumes:
+      - postgres_data:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U hydra"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+      start_period: 10s
+
+volumes:
+  db_data:
+  postgres_data:
+  redis_data:
+