From 3ffb5495aea806feac18d150a0e01a852b4cbf85 Mon Sep 17 00:00:00 2001
From: yml2213 <a2213290201@gmail.com>
Date: Tue, 14 Jul 2026 17:04:59 +0800
Subject: [PATCH] =?UTF-8?q?=E6=8E=A5=E5=85=A5Beszel=E8=BD=BB=E9=87=8F?=
 =?UTF-8?q?=E7=9B=91=E6=8E=A7?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 deploy/caddy/Caddyfile         | 15 +++++++++
 deploy/docker-compose.prod.yml | 58 ++++++++++++++++++++++++++++++++++
 2 files changed, 73 insertions(+)

diff --git a/deploy/caddy/Caddyfile b/deploy/caddy/Caddyfile
index 23dc088..76b0326 100644
--- a/deploy/caddy/Caddyfile
+++ b/deploy/caddy/Caddyfile
@@ -61,3 +61,18 @@
 		file_server
 	}
 }
+
+# Beszel 自带登录与权限控制；单独子域避免与业务站点的 CSP、路由相互影响。
+monitor.{$CADDY_DOMAIN} {
+	encode zstd gzip
+
+	request_body {
+		max_size 10MB
+	}
+
+	reverse_proxy beszel:8090 {
+		transport http {
+			read_timeout 360s
+		}
+	}
+}
diff --git a/deploy/docker-compose.prod.yml b/deploy/docker-compose.prod.yml
index 3c3f4a8..a7dd237 100644
--- a/deploy/docker-compose.prod.yml
+++ b/deploy/docker-compose.prod.yml
@@ -124,9 +124,67 @@ services:
     expose:
       - "8080"
 
+  beszel:
+    image: henrygd/beszel:0.18.7
+    restart: unless-stopped
+    environment:
+      TZ: Asia/Shanghai
+      APP_URL: https://monitor.${CADDY_DOMAIN}
+      CHECK_UPDATES: "false"
+    ports:
+      # 仅供同主机的 Agent 通过回环地址注册，公网访问统一经过 Caddy。
+      - "127.0.0.1:8090:8090"
+    volumes:
+      - beszel_data:/beszel_data
+      - beszel_socket:/beszel_socket
+    deploy:
+      resources:
+        limits:
+          memory: 128M
+          cpus: '0.25'
+        reservations:
+          memory: 32M
+          cpus: '0.05'
+    healthcheck:
+      test: ["CMD", "/beszel", "health", "--url", "http://localhost:8090"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 10s
+
+  beszel-agent:
+    image: henrygd/beszel-agent:0.18.7
+    profiles: ["beszel-agent"]
+    restart: unless-stopped
+    network_mode: host
+    volumes:
+      - beszel_agent_data:/var/lib/beszel-agent
+      - beszel_socket:/beszel_socket
+      # Beszel 只读取 Docker 状态和指标，使用只读 Socket 降低风险。
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+    environment:
+      TZ: Asia/Shanghai
+      LISTEN: /beszel_socket/beszel.sock
+      HUB_URL: http://127.0.0.1:8090
+      SYSTEM_NAME: hfb-production
+      # 在 Hub 的“添加系统”页面生成后写入 backend/.env。
+      KEY: ${BESZEL_AGENT_KEY:-}
+      TOKEN: ${BESZEL_AGENT_TOKEN:-}
+    deploy:
+      resources:
+        limits:
+          memory: 64M
+          cpus: '0.25'
+        reservations:
+          memory: 16M
+          cpus: '0.05'
+
 volumes:
   caddy_data:
   caddy_config:
   mysql_data:
   redis_data:
   minio_data:
+  beszel_data:
+  beszel_socket:
+  beszel_agent_data: