hfb_sys/deploy/docker-compose.prod.yml

services:
  caddy:
    build:
      context: ..
      dockerfile: deploy/caddy/Dockerfile
      args:
        VITE_ADMIN_BASE_PATH: ${VITE_ADMIN_BASE_PATH:-/manage-7x9k2p}
    restart: unless-stopped
    environment:
      TZ: Asia/Shanghai
      CADDY_DOMAIN: ${CADDY_DOMAIN:?请先导出 CADDY_DOMAIN，或使用 scripts/deploy-prod.sh 部署}
      CADDY_EMAIL: ${CADDY_EMAIL:?请先导出 CADDY_EMAIL，或使用 scripts/deploy-prod.sh 部署}
      # 选号网域名可选；未配置时 conf.d 为空，不影响主站
      CADDY_SHOW_DOMAIN: ${CADDY_SHOW_DOMAIN:-}
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./caddy/Caddyfile:/etc/caddy/Caddyfile:ro
      - ./caddy/conf.d:/etc/caddy/conf.d:ro
      - caddy_data:/data
      - caddy_config:/config
    deploy:
      resources:
        limits:
          memory: 256M
          cpus: '0.5'
        reservations:
          memory: 128M
          cpus: '0.25'
    depends_on:
      - backend

  mysql:
    image: mysql:8.4
    restart: unless-stopped
    command: --character-set-server=utf8mb4 --collation-server=utf8mb4_unicode_ci
    env_file:
      - ../backend/.env
    environment:
      TZ: Asia/Shanghai
    volumes:
      - mysql_data:/var/lib/mysql
      - ./mysql/my.cnf:/etc/mysql/conf.d/my.cnf:ro
    deploy:
      resources:
        limits:
          memory: 1G
          cpus: '1.0'
        reservations:
          memory: 256M
          cpus: '0.5'
    healthcheck:
      test: ["CMD-SHELL", "mysqladmin ping -h 127.0.0.1 -uroot -p\"$${MYSQL_ROOT_PASSWORD}\""]
      interval: 10s
      timeout: 5s
      retries: 10

  redis:
    image: redis:7.4-alpine
    restart: unless-stopped
    volumes:
      - redis_data:/data
    deploy:
      resources:
        limits:
          memory: 256M
          cpus: '0.5'
        reservations:
          memory: 128M
          cpus: '0.25'
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 10

  minio:
    image: minio/minio:RELEASE.2025-09-07T16-13-09Z
    restart: unless-stopped
    command: server /data --console-address ":9001"
    env_file:
      - ../backend/.env
    environment:
      TZ: Asia/Shanghai
    volumes:
      - minio_data:/data
    deploy:
      resources:
        limits:
          memory: 512M
          cpus: '0.5'
        reservations:
          memory: 256M
          cpus: '0.25'
    healthcheck:
      test: ["CMD", "mc", "ready", "local"]
      interval: 10s
      timeout: 5s
      retries: 10

  backend:
    build:
      context: ../backend
    restart: unless-stopped
    # 使用宿主机业务用户的 UID/GID，避免绑定挂载的日志被 root 创建。
    user: "${BACKEND_UID:?请在 backend/.env 配置 BACKEND_UID}:${BACKEND_GID:?请在 backend/.env 配置 BACKEND_GID}"
    env_file:
      - ../backend/.env
    environment:
      TZ: Asia/Shanghai
    volumes:
      - ../backend/logs:/app/logs
    deploy:
      resources:
        limits:
          memory: 512M
          cpus: '1.0'
        reservations:
          memory: 256M
          cpus: '0.5'
    depends_on:
      mysql:
        condition: service_healthy
      redis:
        condition: service_healthy
      minio:
        condition: service_healthy
    expose:
      - "8080"

  beszel:
    image: henrygd/beszel:0.18.7
    restart: unless-stopped
    environment:
      TZ: Asia/Shanghai
      APP_URL: https://monitor.${CADDY_DOMAIN}
      CHECK_UPDATES: "false"
    ports:
      # 仅供同主机的 Agent 通过回环地址注册，公网访问统一经过 Caddy。
      - "127.0.0.1:8090:8090"
    volumes:
      - beszel_data:/beszel_data
      - beszel_socket:/beszel_socket
    deploy:
      resources:
        limits:
          memory: 128M
          cpus: '0.25'
        reservations:
          memory: 32M
          cpus: '0.05'
    healthcheck:
      test: ["CMD", "/beszel", "health", "--url", "http://localhost:8090"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s

  beszel-agent:
    image: henrygd/beszel-agent:0.18.7
    profiles: ["beszel-agent"]
    restart: unless-stopped
    network_mode: host
    volumes:
      - beszel_agent_data:/var/lib/beszel-agent
      - beszel_socket:/beszel_socket
      # Beszel 只读取 Docker 状态和指标，使用只读 Socket 降低风险。
      - /var/run/docker.sock:/var/run/docker.sock:ro
    environment:
      TZ: Asia/Shanghai
      LISTEN: /beszel_socket/beszel.sock
      HUB_URL: http://127.0.0.1:8090
      SYSTEM_NAME: hfb-production
      # 在 Hub 的“添加系统”页面生成后写入 backend/.env。
      KEY: ${BESZEL_AGENT_KEY:-}
      TOKEN: ${BESZEL_AGENT_TOKEN:-}
    deploy:
      resources:
        limits:
          memory: 64M
          cpus: '0.25'
        reservations:
          memory: 16M
          cpus: '0.05'

volumes:
  caddy_data:
  caddy_config:
  mysql_data:
  redis_data:
  minio_data:
  beszel_data:
  beszel_socket:
  beszel_agent_data: