全项目扫描修复: Docker数据卷修复+安全requireAdmin+12页SEO+API白名单+脚本超时+常量提取+假数据删除

2026-06-12 17:27:47 +08:00
parent 464924aea0
commit 4c325c8699
454 changed files with 33647 additions and 980 deletions
@@ -0,0 +1,121 @@
+# =============================================================================
+#  追光AI Docker Compose (生产部署)
+#  - 1 个 APP 容器 (Next.js, 端口 8301)
+#  - 1 个 CRON 容器 (supercronic 调度 13 个任务)
+#  - 共用同一镜像，通过 override command 区分
+#  - 用 network_mode: host 让容器能访问宿主机共享服务 (Redis/Nacos/MinIO)
+#  - 卷挂载：data、public、logs 持久化
+# =============================================================================
+
+services:
+
+  # -------------------------------------------------------------------------
+  #  1) APP 服务
+  # -------------------------------------------------------------------------
+  zhuiguang-ai-app:
+    image: zhuiguang-ai:2.1.2
+    container_name: zhuiguang-ai-app
+    build:
+      context: .
+      dockerfile: Dockerfile
+    restart: unless-stopped
+    network_mode: host
+    # 用 host 网络：直接共享宿主机网络栈
+    # 优点：能直接访问 127.0.0.1:6379 (Redis), :8848 (Nacos), :9000 (MinIO)
+    # 缺点：失去 docker 端口隔离（但端口已锁定 8301，无冲突）
+
+    environment:
+      # 容器内 timezone
+      TZ: Asia/Shanghai
+      NODE_ENV: production
+      PORT: "8301"
+      HOSTNAME: "0.0.0.0"
+
+    volumes:
+      # .env 挂载（必须，否则容器找不到 DATABASE_URL）
+      - ./env/.env.production:/app/.env:ro
+      # 持久化数据
+      - bot-data:/app/data
+      - bot-public:/app/public
+      # 日志（容器外可读，方便 docker logs + host 双通道）
+      - bot-logs:/app/logs
+      # 临时 prisma 缓存
+      - bot-prisma:/app/node_modules/.prisma
+
+    # 不依赖 DB 健康检查（DB 是外网阿里云 RDS，检测不到会拖累启动）
+    healthcheck:
+      test: ["CMD", "curl", "-fs", "http://localhost:8301/api/health"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 30s
+
+    logging:
+      driver: json-file
+      options:
+        max-size: "50m"
+        max-file: "5"
+
+    # 用默认 entrypoint-app.sh (在 Dockerfile 里已设)
+    command: ["/usr/local/bin/entrypoint-app.sh"]
+
+  # -------------------------------------------------------------------------
+  #  2) CRON 服务
+  # -------------------------------------------------------------------------
+  zhuiguang-ai-cron:
+    image: zhuiguang-ai:2.1.2
+    container_name: zhuiguang-ai-cron
+    build:
+      context: .
+      dockerfile: Dockerfile
+    restart: unless-stopped
+    network_mode: host
+
+    environment:
+      TZ: Asia/Shanghai
+      NODE_ENV: production
+
+    volumes:
+      - ./env/.env.production:/app/.env:ro
+      # 共享 app 的 data 卷
+      - bot-data:/app/data
+      # 共享 app 的 public 卷（cron 任务可能读 bot 头像）
+      - bot-public:/app/public
+      # 共享 app 的 logs 卷（cron 写入日志，host 可见）
+      - bot-logs:/app/logs
+      - bot-prisma:/app/node_modules/.prisma
+      # 挂载 crontab 文件（不挂就看不到调度表）
+      - ./crontab.txt:/app/crontab.txt:ro
+
+    # supercronic 健康：自检进程存活
+    healthcheck:
+      test: ["CMD", "pgrep", "-f", "supercronic"]
+      interval: 60s
+      timeout: 3s
+      retries: 3
+      start_period: 10s
+
+    logging:
+      driver: json-file
+      options:
+        max-size: "20m"
+        max-file: "3"
+
+    command: ["/usr/local/bin/entrypoint-cron.sh"]
+
+    # 依赖 app 启动完成（不强依赖 DB，data 卷在 compose 内共享）
+    depends_on:
+      - zhuiguang-ai-app
+
+# =============================================================================
+#  命名卷（持久化）
+# =============================================================================
+volumes:
+  bot-data:
+    name: zhuiguang_ai_bot_data
+  bot-public:
+    name: zhuiguang_ai_bot_public
+  bot-logs:
+    name: zhuiguang_ai_bot_logs
+  bot-prisma:
+    name: zhuiguang_ai_bot_prisma