7326e273e1
Protect upload cleanup and atomic completion paths, add durable media worker leases and brand asset validation, and introduce verified migration/bootstrap/deployment gates.
127 lines
5.0 KiB
YAML
127 lines
5.0 KiB
YAML
# 当前生产发布不使用本文件作为入口。
|
||
# 生产发布以 scripts/git-incremental-deploy.ps1 为准；本文件仅作单机/基础环境参考。
|
||
# 本文件仍按生产数据安全边界配置：必须显式传入真实 uploads 宿主机挂载，禁止回落到 ./uploads。
|
||
# 不要按此文件推断当前线上容器启动参数、uploads 挂载或健康检查。
|
||
services:
|
||
app:
|
||
build:
|
||
context: .
|
||
dockerfile: Dockerfile
|
||
container_name: youyidian-3d-material
|
||
restart: unless-stopped
|
||
ports:
|
||
- "4320:3000"
|
||
dns:
|
||
- 223.5.5.5 # 阿里云DNS
|
||
- 8.8.8.8 # Google DNS
|
||
- 114.114.114.114 # 114DNS
|
||
# 内存限制配置（防止内存泄漏影响系统）
|
||
deploy:
|
||
resources:
|
||
limits:
|
||
memory: 6G # 硬限制：最大6GB（正常1-2GB + 缓冲2-3GB + 安全边界1GB）
|
||
reservations:
|
||
memory: 512M # 软限制：保证至少512MB
|
||
# 健康检查
|
||
healthcheck:
|
||
test: ["CMD", "node", "-e", "process.exit(0)"]
|
||
interval: 30s
|
||
timeout: 10s
|
||
retries: 3
|
||
start_period: 40s
|
||
environment:
|
||
- NODE_ENV=production
|
||
- UPLOAD_DIR=/app/uploads
|
||
- DATABASE_URL=${DATABASE_URL:?DATABASE_URL is required}
|
||
- DATABASE_DRIVER=node
|
||
- KEY_VAULTS_SECRET=${KEY_VAULTS_SECRET:?KEY_VAULTS_SECRET is required}
|
||
- VECTOR_DB=pgvector
|
||
- PGVECTOR_DB_URL=${PGVECTOR_DB_URL:?PGVECTOR_DB_URL is required}
|
||
- STORAGE_PROVIDER=s3
|
||
- S3_ENDPOINT=http://192.168.58.20:9000
|
||
- S3_BUCKET=gongxiangpan
|
||
- S3_ACCESS_KEY_ID=${S3_ACCESS_KEY_ID:?S3_ACCESS_KEY_ID is required}
|
||
- S3_SECRET_ACCESS_KEY=${S3_SECRET_ACCESS_KEY:?S3_SECRET_ACCESS_KEY is required}
|
||
- S3_REGION=us-east-1
|
||
- S3_PUBLIC_DOMAIN=https://s3.jiansun.vip/gongxiangpan
|
||
- S3_ENABLE_PATH_STYLE=1
|
||
- S3_SET_ACL=1
|
||
- S3_PREVIEW_URL_EXPIRE_IN=7200
|
||
- NEXT_PUBLIC_S3_FILE_PATH=由壹点AI/
|
||
- APP_PUBLIC_URL=https://sc.jiansun.vip
|
||
- NEXT_PUBLIC_DINGTALK_CALLBACK_ORIGIN=https://sc.jiansun.vip
|
||
- NEXTAUTH_URL=https://sc.jiansun.vip
|
||
# 钉钉 OAuth 必须回公网；认证完成后仅允许把会话交接回这一条受信内网入口。
|
||
- DINGTALK_INTERNAL_RETURN_ORIGINS=http://192.168.58.20:4320
|
||
# 内网地址配置（用于流量分离：内网用户走内网网络，不占用外网带宽）
|
||
- SERVER_IP=192.168.58.20
|
||
- MINIO_API_PORT=9000
|
||
- NEXTAUTH_SECRET=${NEXTAUTH_SECRET:?NEXTAUTH_SECRET is required}
|
||
- GEMINI_API_KEY=${GEMINI_API_KEY:?GEMINI_API_KEY is required}
|
||
- GEMINI_API_BASE_URL=https://api.huandutech.com/v1
|
||
- GEMINI_MODEL=gemini-2.0-flash-exp
|
||
- DINGTALK_CLIENT_ID=ding1bs1gxwrcfu16x0f
|
||
- DINGTALK_CLIENT_SECRET=${DINGTALK_CLIENT_SECRET:?DINGTALK_CLIENT_SECRET is required}
|
||
- DINGTALK_ROBOT_CODE=${DINGTALK_ROBOT_CODE:-}
|
||
- DINGTALK_PERFORMANCE_SURVEY_NOTIFICATION_CHANNEL=${DINGTALK_PERFORMANCE_SURVEY_NOTIFICATION_CHANNEL:-work_notice}
|
||
- DINGTALK_ROBOT_OTO_TEST_USER_IDS=${DINGTALK_ROBOT_OTO_TEST_USER_IDS:-}
|
||
- YYD_NOTIFICATION_CENTER_URL=${YYD_NOTIFICATION_CENTER_URL:-}
|
||
- YYD_NOTIFICATION_CENTER_PROJECT_CODE=${YYD_NOTIFICATION_CENTER_PROJECT_CODE:-material_library}
|
||
- YYD_NOTIFICATION_CENTER_PROJECT_SECRET=${YYD_NOTIFICATION_CENTER_PROJECT_SECRET:-}
|
||
- YYD_NOTIFICATION_CENTER_TEST_USER_IDS=${YYD_NOTIFICATION_CENTER_TEST_USER_IDS:-}
|
||
# 视频转码配置：默认 720P H.265、10 秒片段；单实例单任务、单线程
|
||
- VIDEO_PREVIEW_RESOLUTION=720
|
||
- VIDEO_CLIP_DURATION=10
|
||
- VIDEO_PREVIEW_CRF=20
|
||
- VIDEO_CLIP_CRF=24
|
||
- VIDEO_TRANSCODE_THREADS=1
|
||
- VIDEO_TRANSCODE_MAX_CONCURRENT=1
|
||
- VIDEO_TRANSCODE_TIMEOUT=3600000
|
||
- VIDEO_MAX_TEMP_FILE_SIZE=10737418240
|
||
- VIDEO_TRANSCODE_RUNTIME_DIR=/app/uploads/.video-transcode-runtime
|
||
# 下载 Token 密钥（用于外部接口文件下载鉴权）
|
||
- DOWNLOAD_TOKEN_SECRET=${DOWNLOAD_TOKEN_SECRET:?DOWNLOAD_TOKEN_SECRET is required}
|
||
# Redis配置（用于上传会话存储）
|
||
- USE_REDIS=true
|
||
- REDIS_URL=redis://redis:6379
|
||
volumes:
|
||
- type: bind
|
||
source: ${GONGXIANGP2_UPLOADS_MOUNT:?GONGXIANGP2_UPLOADS_MOUNT must point to the verified host uploads mount}
|
||
target: /app/uploads
|
||
bind:
|
||
# 路径写错或真实挂载未准备好时必须失败，不能静默创建空目录继续运行。
|
||
create_host_path: false
|
||
networks:
|
||
- app-network
|
||
depends_on:
|
||
- redis
|
||
|
||
redis:
|
||
image: redis:7-alpine
|
||
container_name: gongxiangpan-redis
|
||
restart: unless-stopped
|
||
command: redis-server --maxmemory 100mb --maxmemory-policy allkeys-lru --save ""
|
||
deploy:
|
||
resources:
|
||
limits:
|
||
memory: 128M
|
||
reservations:
|
||
memory: 32M
|
||
healthcheck:
|
||
test: ["CMD", "redis-cli", "ping"]
|
||
interval: 30s
|
||
timeout: 10s
|
||
retries: 3
|
||
networks:
|
||
- app-network
|
||
volumes:
|
||
- redis-data:/data
|
||
|
||
networks:
|
||
app-network:
|
||
driver: bridge
|
||
|
||
volumes:
|
||
redis-data:
|
||
|