docker-compose.prod.yml

name: docstudio

# 生产环境一键部署
# 使用方式：
#   1. cp .env.example .env  然后修改所有变量
#   2. docker compose -f docker-compose.prod.yml up -d --build

# ── 日志轮转配置（所有服务共享）──────────────────────────────
x-logging: &default-logging
  driver: json-file
  options:
    max-size: "10m"
    max-file: "5"
    compress: "true"

services:
  # ── 数据库 ────────────────────────────────────────────────
  postgres:
    image: postgres:16-alpine
    container_name: docstudio-postgres
    restart: unless-stopped
    logging: *default-logging
    environment:
      POSTGRES_USER: ${POSTGRES_USER:-postgres}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      POSTGRES_DB: ${POSTGRES_DB:-docstudio}
    volumes:
      - postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ['CMD-SHELL', 'pg_isready -U ${POSTGRES_USER:-postgres}']
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - docstudio

  # ── 缓存 & 实时协作同步 ───────────────────────────────────
  redis:
    image: redis:7-alpine
    container_name: docstudio-redis
    restart: unless-stopped
    logging: *default-logging
    command: redis-server --appendonly yes
    volumes:
      - redis_data:/data
    healthcheck:
      test: ['CMD', 'redis-cli', 'ping']
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - docstudio

  # ── 对象存储（头像、文件上传）───────────────────────────
  minio:
    image: minio/minio:latest
    container_name: docstudio-minio
    restart: unless-stopped
    logging: *default-logging
    environment:
      MINIO_ROOT_USER: ${MINIO_ACCESS_KEY}
      MINIO_ROOT_PASSWORD: ${MINIO_SECRET_KEY}
    command: server /data --console-address ":9001"
    ports:
      - '9000:9000'   # API（用于文件读写）
      - '9001:9001'   # Console（管理界面）
    volumes:
      - minio_data:/data
    healthcheck:
      test: ['CMD', 'curl', '-f', 'http://localhost:9000/minio/health/live']
      interval: 30s
      timeout: 20s
      retries: 3
    networks:
      - docstudio

  # ── 后端 API（NestJS + Hocuspocus WebSocket）─────────────
  api:
    build:
      context: .
      dockerfile: apps/api/Dockerfile
    container_name: docstudio-api
    restart: unless-stopped
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
      minio:
        condition: service_healthy
    environment:
      NODE_ENV: production
      # 数据库（指向同网络内的 postgres 容器）
      DATABASE_URL: postgresql://${POSTGRES_USER:-postgres}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB:-docstudio}
      PORT: 3001
      API_URL: ${API_URL}
      FRONTEND_URL: ${FRONTEND_URL}
      # JWT
      JWT_SECRET: ${JWT_SECRET}
      JWT_EXPIRES_IN: ${JWT_EXPIRES_IN:-7d}
      # 超级管理员
      SUPER_ADMIN_EMAIL: ${SUPER_ADMIN_EMAIL}
      SUPER_ADMIN_PASSWORD: ${SUPER_ADMIN_PASSWORD}
      # Redis（指向同网络内的 redis 容器）
      REDIS_HOST: redis
      REDIS_PORT: 6379
      # Hocuspocus WebSocket
      COLLAB_PORT: 1234
      # MinIO（指向同网络内的 minio 容器）
      MINIO_ENDPOINT: minio
      MINIO_PORT: 9000
      MINIO_ACCESS_KEY: ${MINIO_ACCESS_KEY}
      MINIO_SECRET_KEY: ${MINIO_SECRET_KEY}
      MINIO_BUCKET: ${MINIO_BUCKET:-avatars}
      MINIO_PUBLIC_ENDPOINT: ${MINIO_PUBLIC_ENDPOINT}
      MINIO_USE_SSL: ${MINIO_USE_SSL:-false}
      # SMTP 邮件（可选）
      SMTP_HOST: ${SMTP_HOST:-}
      SMTP_PORT: ${SMTP_PORT:-587}
      SMTP_SECURE: ${SMTP_SECURE:-false}
      SMTP_USER: ${SMTP_USER:-}
      SMTP_PASS: ${SMTP_PASS:-}
      SMTP_FROM: ${SMTP_FROM:-}
      # AI（可选）
      AI_PROVIDER: ${AI_PROVIDER:-}
      AI_API_KEY: ${AI_API_KEY:-}
      AI_BASE_URL: ${AI_BASE_URL:-}
      AI_MODEL: ${AI_MODEL:-}
      AI_DAILY_LIMIT: ${AI_DAILY_LIMIT:-50}
      # GitHub OAuth（可选，Callback URL 自动派生自 API_URL）
      GITHUB_CLIENT_ID: ${GITHUB_CLIENT_ID:-}
      GITHUB_CLIENT_SECRET: ${GITHUB_CLIENT_SECRET:-}
      # Google OAuth（可选，Callback URL 自动派生自 API_URL）
      GOOGLE_CLIENT_ID: ${GOOGLE_CLIENT_ID:-}
      GOOGLE_CLIENT_SECRET: ${GOOGLE_CLIENT_SECRET:-}
    ports:
      - '3001:3001'   # HTTP API
      - '1234:1234'   # Hocuspocus WebSocket
    logging: *default-logging
    networks:
      - docstudio

  # ── 前端（Next.js）──────────────────────────────────────
  web:
    build:
      context: .
      dockerfile: apps/web/Dockerfile
      # NEXT_PUBLIC_* 在构建时烧入镜像，修改后需重新 build
      args:
        NEXT_PUBLIC_API_URL: ${NEXT_PUBLIC_API_URL}
        NEXT_PUBLIC_WEBSOCKET_URL: ${NEXT_PUBLIC_WEBSOCKET_URL}
        NEXT_PUBLIC_CDN_URL: ${NEXT_PUBLIC_CDN_URL}
        NEXT_PUBLIC_SITE_URL: ${NEXT_PUBLIC_SITE_URL}
    container_name: docstudio-web
    restart: unless-stopped
    logging: *default-logging
    depends_on:
      - api
    ports:
      - '3000:3000'
    networks:
      - docstudio

  # ── Nginx 反向代理 ──────────────────────────────────────────
  nginx:
    image: nginx:alpine
    container_name: docstudio-nginx
    restart: unless-stopped
    logging: *default-logging
    depends_on:
      - api
      - web
    ports:
      - '80:80'
      - '443:443'
    volumes:
      - ./nginx/nginx.conf:/etc/nginx/conf.d/default.conf:ro
      - ./nginx/proxy.conf:/etc/nginx/conf.d/proxy.conf:ro
      - certbot_www:/var/www/certbot:ro
      - certbot_conf:/etc/letsencrypt:ro
    networks:
      - docstudio

  # ── Let's Encrypt 自动证书（首次运行后每 12 小时续期）─────
  # 首次申请：
  #   docker compose -f docker-compose.prod.yml run --rm certbot \
  #     certonly --webroot -w /var/www/certbot \
  #     -d your-domain.com --email admin@your-domain.com --agree-tos
  certbot:
    image: certbot/certbot:latest
    container_name: docstudio-certbot
    volumes:
      - certbot_www:/var/www/certbot
      - certbot_conf:/etc/letsencrypt
    entrypoint: "/bin/sh -c 'trap exit TERM; while :; do certbot renew --quiet; sleep 12h & wait $${!}; done'"
    networks:
      - docstudio

  # ── 数据库自动备份（每天凌晨 3:00）──────────────────────────
  db-backup:
    image: postgres:16-alpine
    container_name: docstudio-db-backup
    restart: unless-stopped
    depends_on:
      postgres:
        condition: service_healthy
    environment:
      PGHOST: postgres
      PGUSER: ${POSTGRES_USER:-postgres}
      PGPASSWORD: ${POSTGRES_PASSWORD}
      PGDATABASE: ${POSTGRES_DB:-docstudio}
      BACKUP_DIR: /backups
      BACKUP_RETAIN_DAYS: ${BACKUP_RETAIN_DAYS:-30}
    volumes:
      - ./scripts/backup-db.sh:/usr/local/bin/backup-db.sh:ro
      - db_backups:/backups
    entrypoint: ["/bin/sh", "-c"]
    command:
      - |
        echo "[db-backup] Scheduled daily backup at 03:00"
        while true; do
          # 计算到次日 03:00 的秒数
          NOW=$$(date +%s)
          TARGET=$$(date -d "tomorrow 03:00" +%s 2>/dev/null || date -v+1d -v3H -v0M -v0S +%s)
          SLEEP_SEC=$$((TARGET - NOW))
          if [ "$$SLEEP_SEC" -le 0 ]; then SLEEP_SEC=86400; fi
          echo "[db-backup] Next backup in $$SLEEP_SEC seconds"
          sleep "$$SLEEP_SEC"
          /usr/local/bin/backup-db.sh
        done
    networks:
      - docstudio

networks:
  docstudio:
    driver: bridge

volumes:
  postgres_data:
  redis_data:
  minio_data:
  db_backups:
  certbot_www:
  certbot_conf: