增加腾讯云生产 Docker 部署编排与一键脚本

- 提供 API/Web 多阶段镜像、Nginx 反代与 WS/文件路径
- docker-compose.prod 含 Postgres、MinIO、API、前端
- deploy.sh 生成密钥、构建启动、可选种子与备份脚本

deploy/docker/Dockerfile.api

@@ -0,0 +1,44 @@
+# 客服云 API — 生产镜像（多阶段构建）
+# build context: 仓库根目录
+# docker build -f deploy/docker/Dockerfile.api -t kefu-api:latest .
+
+FROM golang:1.24-alpine AS builder
+
+# 若 go.mod 要求更高版本，自动下载 toolchain
+ENV GOTOOLCHAIN=auto
+ENV CGO_ENABLED=0
+
+RUN apk add --no-cache git ca-certificates tzdata
+
+WORKDIR /src
+
+# 先下依赖，利用缓存
+COPY server/go.mod server/go.sum ./
+RUN go mod download
+
+COPY server/ ./
+RUN GOOS=linux GOARCH=amd64 \
+    go build -trimpath -ldflags="-s -w" -o /out/server ./cmd/main.go
+
+# 种子程序（compose profile seed 使用）
+RUN GOOS=linux GOARCH=amd64 \
+    go build -trimpath -ldflags="-s -w" -o /out/seed ./cmd/seed
+
+FROM alpine:3.21
+
+RUN apk add --no-cache ca-certificates tzdata wget \
+    && adduser -D -H -u 10001 kefu
+
+ENV TZ=Asia/Shanghai
+WORKDIR /app
+
+COPY --from=builder /out/server /app/server
+COPY --from=builder /out/seed /app/seed
+
+USER kefu
+EXPOSE 8080
+
+HEALTHCHECK --interval=15s --timeout=5s --start-period=20s --retries=5 \
+  CMD wget -qO- http://127.0.0.1:8080/health || exit 1
+
+ENTRYPOINT ["/app/server"]

deploy/docker/Dockerfile.web

@@ -0,0 +1,25 @@
+# 客服云前端 — Nginx 托管静态资源并反代 API / 文件
+# build context: 仓库根目录
+
+FROM node:22-alpine AS builder
+
+WORKDIR /web
+COPY web/package.json web/package-lock.json ./
+RUN npm ci
+
+COPY web/ ./
+RUN npm run build
+
+FROM nginx:1.27-alpine
+
+RUN apk add --no-cache tzdata \
+    && cp /usr/share/zoneinfo/Asia/Shanghai /etc/localtime \
+    && echo Asia/Shanghai > /etc/timezone
+
+COPY deploy/docker/nginx.conf /etc/nginx/conf.d/default.conf
+COPY --from=builder /web/dist /usr/share/nginx/html
+
+EXPOSE 80
+
+HEALTHCHECK --interval=15s --timeout=5s --start-period=10s --retries=5 \
+  CMD wget -qO- http://127.0.0.1/healthz || exit 1

deploy/docker/nginx.conf

@@ -0,0 +1,89 @@
+# 生产 Nginx：SPA + API/WebSocket 反代 + 对象存储公共读路径
+# 上游服务名与 docker-compose.prod.yml 中 service 名一致
+
+map $http_upgrade $connection_upgrade {
+    default upgrade;
+    ''      close;
+}
+
+upstream kefu_api {
+    server api:8080;
+    keepalive 32;
+}
+
+upstream kefu_minio {
+    server minio:9000;
+}
+
+server {
+    listen 80;
+    server_name _;
+
+    client_max_body_size 20m;
+    # 上传/长连接
+    proxy_read_timeout 3600s;
+    proxy_send_timeout 3600s;
+
+    # 健康探针（不经 API）
+    location = /healthz {
+        access_log off;
+        add_header Content-Type text/plain;
+        return 200 'ok';
+    }
+
+    # 后端健康检查
+    location = /health {
+        proxy_pass http://kefu_api/health;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+
+    # API + WebSocket（/api/ws、/api/widget/ws）
+    location /api/ {
+        proxy_pass http://kefu_api/api/;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection $connection_upgrade;
+        proxy_buffering off;
+    }
+
+    # 图片公共访问：浏览器访问 /files/* → MinIO bucket kefu/*
+    # 须与 STORAGE_PUBLIC_BASE_URL=https://你的域名/files 一致
+    location /files/ {
+        proxy_pass http://kefu_minio/kefu/;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        # 允许跨域拉取图片（嵌入站点）
+        add_header Access-Control-Allow-Origin * always;
+        add_header Access-Control-Allow-Methods "GET, HEAD, OPTIONS" always;
+        if ($request_method = OPTIONS) {
+            return 204;
+        }
+        expires 7d;
+        add_header Cache-Control "public" always;
+    }
+
+    # 前端静态资源
+    location / {
+        root /usr/share/nginx/html;
+        try_files $uri $uri/ /index.html;
+    }
+
+    # 构建产物长缓存
+    location /assets/ {
+        root /usr/share/nginx/html;
+        expires 30d;
+        add_header Cache-Control "public, immutable";
+        try_files $uri =404;
+    }
+}