接入Beszel轻量监控

deploy/caddy/Caddyfile

@@ -61,3 +61,18 @@
 		file_server
 	}
 }
+
+# Beszel 自带登录与权限控制；单独子域避免与业务站点的 CSP、路由相互影响。
+monitor.{$CADDY_DOMAIN} {
+	encode zstd gzip
+
+	request_body {
+		max_size 10MB
+	}
+
+	reverse_proxy beszel:8090 {
+		transport http {
+			read_timeout 360s
+		}
+	}
+}

deploy/docker-compose.prod.yml

@@ -124,9 +124,67 @@ services:
     expose:
       - "8080"
 
+  beszel:
+    image: henrygd/beszel:0.18.7
+    restart: unless-stopped
+    environment:
+      TZ: Asia/Shanghai
+      APP_URL: https://monitor.${CADDY_DOMAIN}
+      CHECK_UPDATES: "false"
+    ports:
+      # 仅供同主机的 Agent 通过回环地址注册，公网访问统一经过 Caddy。
+      - "127.0.0.1:8090:8090"
+    volumes:
+      - beszel_data:/beszel_data
+      - beszel_socket:/beszel_socket
+    deploy:
+      resources:
+        limits:
+          memory: 128M
+          cpus: '0.25'
+        reservations:
+          memory: 32M
+          cpus: '0.05'
+    healthcheck:
+      test: ["CMD", "/beszel", "health", "--url", "http://localhost:8090"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 10s
+
+  beszel-agent:
+    image: henrygd/beszel-agent:0.18.7
+    profiles: ["beszel-agent"]
+    restart: unless-stopped
+    network_mode: host
+    volumes:
+      - beszel_agent_data:/var/lib/beszel-agent
+      - beszel_socket:/beszel_socket
+      # Beszel 只读取 Docker 状态和指标，使用只读 Socket 降低风险。
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+    environment:
+      TZ: Asia/Shanghai
+      LISTEN: /beszel_socket/beszel.sock
+      HUB_URL: http://127.0.0.1:8090
+      SYSTEM_NAME: hfb-production
+      # 在 Hub 的“添加系统”页面生成后写入 backend/.env。
+      KEY: ${BESZEL_AGENT_KEY:-}
+      TOKEN: ${BESZEL_AGENT_TOKEN:-}
+    deploy:
+      resources:
+        limits:
+          memory: 64M
+          cpus: '0.25'
+        reservations:
+          memory: 16M
+          cpus: '0.05'
+
 volumes:
   caddy_data:
   caddy_config:
   mysql_data:
   redis_data:
   minio_data:
+  beszel_data:
+  beszel_socket:
+  beszel_agent_data: