Files
FileShare/deploy/docker-compose.yml
T
SKYMirror 7f060dd0e4 26.9(安全审计修复版)
Go 1.27.1 (Gin+GORM) + Vue 3 文件快传服务:

- 安全审计全部修复(docs/security-audit-2026-09-05.md):
  bcrypt 密码哈希与自动升级、presign 直传服务端大小/内容校验、
  全局请求体上限、依赖升级(govulncheck 0 命中)、janitor 后台清理、
  管理端审计动作落库、/admin CORS 收紧、通知内容白名单净化、
  会话默认 7 天、限流缓存故障降级、robots.txt 端点等
- 前端:取件链接复制修复(不再重复拼接提取码)、markdown 净化器加固
- Redis 支持库号(FCB_REDIS_DB / redis://…/db URL)
- 文档:docs/api/* 与 openapi.yaml 同步最新行为(robots.txt、
  提码 5 位起、chunk 32MiB 上限、admin 审计动作等)

验证:gofmt/go vet/go test 全绿;二进制端到端冒烟通过
2026-09-05 04:22:41 +08:00

145 lines
5.2 KiB
YAML
Raw Blame History

This file contains ambiguous Unicode characters
This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
# 文件快传 Go 版部署编排(v2,需求 ⑧):
# docker compose up -d --build # 默认:SQLite 零依赖(仅 server 容器)
# docker compose --profile postgres up -d --build # 可选:Postgres 模式(自动注入 FCB_DB_DSN
# docker compose --profile redis up -d # 可选:Redis 缓存增强
# docker compose --profile minio up -d # 可选:S3 引擎冒烟(FCB_STORAGE_ENGINE=s3
# docker compose --profile webdav up -d # 可选:WebDAV 引擎冒烟(FCB_STORAGE_ENGINE=webdav
#
# 数据库默认 SQLitemodernc.org/sqlite 纯 Go 驱动,数据落 serverdata 卷 /app/data/filecodebox.db);
# postgres 为可选 profile 服务,启用时 server 经 FCB_DB_DRIVER/FCB_DB_DSN 自动接入;
# Redis 同为可选,未配置时服务端内存降级。
name: filecodebox
services:
postgres:
image: postgres:16-alpine
restart: unless-stopped
# 可选服务(需求 ⑧):默认 SQLite 模式不会启动 postgres
# 需要时 docker compose --profile postgres up -d --build
profiles: ["postgres"]
environment:
POSTGRES_USER: ${POSTGRES_USER:-filecodebox}
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-filecodebox}
POSTGRES_DB: ${POSTGRES_DB:-filecodebox}
volumes:
- pgdata:/var/lib/postgresql/data
healthcheck:
test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-filecodebox}"]
interval: 5s
timeout: 3s
retries: 20
server:
build:
context: ..
dockerfile: deploy/Dockerfile
restart: unless-stopped
depends_on:
# postgres 为可选 profile 服务:--profile postgres 启用时等它健康,
# 默认 SQLite 模式不启用该 profile,不阻塞启动
postgres:
condition: service_healthy
required: false
# redis 为可选 profile 服务:启用时等它健康,未启用不阻塞启动
redis:
condition: service_healthy
required: false
healthcheck:
test: ["CMD", "curl", "-sf", "http://127.0.0.1:8466/api/v1/health"]
interval: 5s
timeout: 3s
retries: 30
start_period: 5s
environment:
# 需求 ⑧:数据库驱动 sqlite(默认,零依赖)| postgres(需 --profile postgres
# 默认 SQLiteDSN 留空 → 数据库文件落 /app/data/filecodebox.dbserverdata 卷)
# postgres 模式:在 .env 设 FCB_DB_DRIVER=postgres 与 FCB_DB_DSN(模板见 deploy/.env.example
FCB_DB_DRIVER: ${FCB_DB_DRIVER:-sqlite}
FCB_DB_DSN: ${FCB_DB_DSN:-}
FCB_LISTEN: ":8466"
FCB_STORAGE_ENGINE: ${FCB_STORAGE_ENGINE:-local}
# Redis 可选增强:.env 设 FCB_REDIS_ADDR=redis:6379 且 --profile redis 启用时接入;
# 默认留空=内存缓存(需求 ⑧)
FCB_REDIS_ADDR: ${FCB_REDIS_ADDR:-}
FCB_REDIS_DB: ${FCB_REDIS_DB:-0}
FCB_TRUSTED_PROXIES: ${FCB_TRUSTED_PROXIES:-}
# 本地引擎根目录(容器内)
FCB_LOCAL_STORAGE_PATH: /app/data
# S3 引擎(MinIO profile
FCB_S3_ENDPOINT_URL: ${FCB_S3_ENDPOINT_URL:-}
FCB_S3_BUCKET_NAME: ${FCB_S3_BUCKET_NAME:-filecodebox}
FCB_S3_ACCESS_KEY_ID: ${FCB_S3_ACCESS_KEY_ID:-minioadmin}
FCB_S3_SECRET_ACCESS_KEY: ${FCB_S3_SECRET_ACCESS_KEY:-minioadmin}
FCB_S3_REGION_NAME: ${FCB_S3_REGION_NAME:-us-east-1}
# WebDAV 引擎(dufs profile
FCB_WEBDAV_URL: ${FCB_WEBDAV_URL:-}
FCB_WEBDAV_USERNAME: ${FCB_WEBDAV_USERNAME:-admin}
FCB_WEBDAV_PASSWORD: ${FCB_WEBDAV_PASSWORD:-admin123}
FCB_WEBDAV_ROOT_PATH: ${FCB_WEBDAV_ROOT_PATH:-filebox_storage}
ports:
- "${WEB_PORT:-8466}:8466"
volumes:
- serverdata:/app/data
redis:
image: redis:7-alpine
restart: unless-stopped
profiles: ["redis"]
volumes:
- redisdata:/data
healthcheck:
test: ["CMD", "redis-cli", "ping"]
interval: 5s
timeout: 3s
retries: 20
minio:
image: minio/minio:latest
restart: unless-stopped
profiles: ["minio"]
command: server /data --console-address ":9001"
environment:
MINIO_ROOT_USER: ${FCB_S3_ACCESS_KEY_ID:-minioadmin}
MINIO_ROOT_PASSWORD: ${FCB_S3_SECRET_ACCESS_KEY:-minioadmin}
ports:
- "${MINIO_API_PORT:-9000}:9000"
- "${MINIO_CONSOLE_PORT:-9001}:9001"
volumes:
- miniodata:/data
healthcheck:
test: ["CMD", "mc", "ready", "local"]
interval: 5s
timeout: 3s
retries: 20
# MinIO 建桶初始化(mc;一次性任务)
minio-init:
image: minio/mc:latest
profiles: ["minio"]
depends_on:
minio:
condition: service_healthy
entrypoint: >
/bin/sh -c "
mc alias set local http://minio:9000 ${FCB_S3_ACCESS_KEY_ID:-minioadmin} ${FCB_S3_SECRET_ACCESS_KEY:-minioadmin} &&
mc mb --ignore-existing local/${FCB_S3_BUCKET_NAME:-filecodebox} &&
echo 'MinIO 桶已就绪'"
# WebDAV 冒烟服务器(dufs,简单读写 + Basic 认证)
webdav:
image: sigoden/dufs:latest
restart: unless-stopped
profiles: ["webdav"]
command: /data -A -a admin:admin123@/:rw
ports:
- "${WEBDAV_PORT:-5005}:5000"
volumes:
- webdavdata:/data
volumes:
pgdata:
redisdata:
miniodata:
webdavdata:
serverdata: