接入Beszel轻量监控

deploy/docker-compose.prod.yml

@@ -124,9 +124,67 @@ services:
     expose:
       - "8080"
 
+  beszel:
+    image: henrygd/beszel:0.18.7
+    restart: unless-stopped
+    environment:
+      TZ: Asia/Shanghai
+      APP_URL: https://monitor.${CADDY_DOMAIN}
+      CHECK_UPDATES: "false"
+    ports:
+      # 仅供同主机的 Agent 通过回环地址注册，公网访问统一经过 Caddy。
+      - "127.0.0.1:8090:8090"
+    volumes:
+      - beszel_data:/beszel_data
+      - beszel_socket:/beszel_socket
+    deploy:
+      resources:
+        limits:
+          memory: 128M
+          cpus: '0.25'
+        reservations:
+          memory: 32M
+          cpus: '0.05'
+    healthcheck:
+      test: ["CMD", "/beszel", "health", "--url", "http://localhost:8090"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 10s
+
+  beszel-agent:
+    image: henrygd/beszel-agent:0.18.7
+    profiles: ["beszel-agent"]
+    restart: unless-stopped
+    network_mode: host
+    volumes:
+      - beszel_agent_data:/var/lib/beszel-agent
+      - beszel_socket:/beszel_socket
+      # Beszel 只读取 Docker 状态和指标，使用只读 Socket 降低风险。
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+    environment:
+      TZ: Asia/Shanghai
+      LISTEN: /beszel_socket/beszel.sock
+      HUB_URL: http://127.0.0.1:8090
+      SYSTEM_NAME: hfb-production
+      # 在 Hub 的“添加系统”页面生成后写入 backend/.env。
+      KEY: ${BESZEL_AGENT_KEY:-}
+      TOKEN: ${BESZEL_AGENT_TOKEN:-}
+    deploy:
+      resources:
+        limits:
+          memory: 64M
+          cpus: '0.25'
+        reservations:
+          memory: 16M
+          cpus: '0.05'
+
 volumes:
   caddy_data:
   caddy_config:
   mysql_data:
   redis_data:
   minio_data:
+  beszel_data:
+  beszel_socket:
+  beszel_agent_data: