notefast/docker-compose.https.yml at main · atbeta/notefast · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
# NoteFast + Caddy 反向代理示例
#
# 用法：
#   cp docker-compose.https.yml docker-compose.https.local.yml
#   # 编辑 .env 或本文件，设置 NOTEFAST_DOMAIN 等
#   docker compose -f docker-compose.https.yml up -d
#
# 与 docker-compose.example.yml 互斥：本文件包含 Caddy + notefast，
# 不要再同时跑 docker-compose.example.yml。

services:
  notefast:
    image: xbeta/notefast:0.1.0
    container_name: notefast
    # 注意：ports 段去掉，Caddy 通过内部网络访问
    expose:
      - '3140'
    environment:
      - PORT=3140
      - DATA_DIR=/app/data
      - AUTO_EXPORT_DIR=/app/export
      - AUTH_PASSWORD=${AUTH_PASSWORD:-}
      - CORS_ORIGINS=${CORS_ORIGINS:-https://notefast.example.com}
      - AI_PROVIDER=${AI_PROVIDER:-openrouter}
      - AI_API_KEY=${AI_API_KEY:-}
      - EMBEDDING_MODEL=${EMBEDDING_MODEL:-}
      - LLM_MODEL=${LLM_MODEL:-}
      # 接收代理转发的真实协议（HTTPS）
      - TRUSTED_PROXIES=*
    volumes:
      - notefast_data:/app/data
      - notefast_export:/app/export
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    read_only: true
    tmpfs:
      - /tmp
      - /run
    mem_limit: 512m
    cpus: '1.0'
    pids_limit: 200
    healthcheck:
      test: ['CMD', 'bun', '-e', "fetch('http://localhost:3140/health').then(r=>process.exit(r.ok?0:1))"]
      interval: 15s
      timeout: 3s
      retries: 3

  caddy:
    image: caddy:2
    container_name: notefast-caddy
    ports:
      - '80:80'
      - '443:443'
    environment:
      # Caddy 用 Let's Encrypt 需要 ACME 邮箱
      - ACME_EMAIL=${ACME_EMAIL:-admin@example.com}
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile:ro
      - caddy_data:/data
      - caddy_config:/config
    depends_on:
      notefast:
        condition: service_healthy
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true

  # 数据库灾备改由应用内 S3 快照完成（Web 设置页配置）。
  # 旧 Litestream sidecar 已移除。

volumes:
  notefast_data:
  notefast_export:
  caddy_data:
  caddy_config: