feat: rebuild xiteng.site homelab platform

2026-08-12 09:48:25 +08:00
parent 557b0eca33
commit 5b84988789
128 changed files with 14979 additions and 292 deletions
@@ -0,0 +1,103 @@
+services:
+  hedgedoc2:
+    build:
+      context: /home/xiteng/src/hedgedoc
+      dockerfile: Dockerfile
+    image: hedgedoc2:ai-preview
+    container_name: hedgedoc2
+    restart: unless-stopped
+    environment:
+      - HD_BACKEND_PORT=3000
+      - HD_BACKEND_BIND_IP=0.0.0.0
+      - HD_FRONTEND_PORT=3001
+      - PORT=3001
+      - HD_DATABASE_TYPE=sqlite
+      - HD_DATABASE_NAME=/data/hedgedoc.sqlite
+      - HD_BASE_URL=https://notes2.xiteng.site
+      - HD_RENDERER_BASE_URL=https://notes2.xiteng.site
+      - HD_INTERNAL_API_URL=http://localhost:3000/
+      # Auth — Authentik OIDC
+      - HD_AUTH_SESSION_SECRET=hedgedoc2-experimental-session-secret-min-32-chars!!
+      - HD_AUTH_OIDC_SERVERS=AUTHENTIK
+      - HD_AUTH_OIDC_AUTHENTIK_ISSUER=https://auth.xiteng.site/application/o/hedgedoc2/
+      - HD_AUTH_OIDC_AUTHENTIK_CLIENT_ID=hedgedoc2
+      - HD_AUTH_OIDC_AUTHENTIK_CLIENT_SECRET=hedgedoc2-secret-9
+      - HD_AUTH_OIDC_AUTHENTIK_PROVIDER_NAME=Authentik
+      - HD_AUTH_OIDC_AUTHENTIK_AUTHORIZE_URL=https://auth.xiteng.site/application/o/authorize/
+      - HD_AUTH_OIDC_AUTHENTIK_TOKEN_URL=https://auth.xiteng.site/application/o/token/
+      - HD_AUTH_OIDC_AUTHENTIK_USERINFO_URL=https://auth.xiteng.site/application/o/userinfo/
+      - HD_AUTH_OIDC_AUTHENTIK_END_SESSION_URL=https://auth.xiteng.site/application/o/hedgedoc2/end-session/
+      - HD_AUTH_LOCAL_ENABLE_LOGIN=true
+      # Permissions
+      - HD_NOTE_PERMISSIONS_DEFAULT_EVERYONE=write
+      # Media
+      - HD_MEDIA_BACKEND_TYPE=filesystem
+      - HD_MEDIA_BACKEND_FILESYSTEM_UPLOAD_PATH=/data/uploads
+      # AI assistant config
+      - HD_AI_ENABLED=true
+      - HD_AI_TIMEOUT_MS=60000
+      - HD_AI_MAX_INPUT_CHARS=32000
+      - HD_AI_KEY_VAULT_URL=http://ai-gateway:8093
+      - HD_AI_KEY_VAULT_TOKEN_FILE=/run/secrets/key_vault_service_token
+      - HD_AI_KEY_VAULT_ISSUER=https://auth.xiteng.site
+      - HD_AI_KEY_VAULT_OIDC_IDENTIFIER=authentik
+    volumes:
+      - ./data:/data
+      - ../ai-gateway/secrets/portal_gateway_hmac:/run/secrets/key_vault_service_token:ro
+    networks:
+      - homelab_net
+    labels:
+      # Traefik routing
+      - "traefik.enable=true"
+      # Backend routes: API, realtime websocket, uploads, and media
+      - "traefik.http.routers.hedgedoc2-api.rule=Host(`notes2.xiteng.site`) && (PathPrefix(`/api`) || PathPrefix(`/realtime`) || PathPrefix(`/uploads`) || PathPrefix(`/media`))"
+      - "traefik.http.routers.hedgedoc2-api.entrypoints=websecure"
+      - "traefik.http.routers.hedgedoc2-api.tls=true"
+      - "traefik.http.routers.hedgedoc2-api.tls.certresolver=cfresolver"
+      - "traefik.http.routers.hedgedoc2-api.service=hedgedoc2-api"
+      - "traefik.http.services.hedgedoc2-api.loadbalancer.server.port=3000"
+      # Backend HTTP entrypoint
+      - "traefik.http.routers.hedgedoc2-api-http.rule=Host(`notes2.xiteng.site`) && (PathPrefix(`/api`) || PathPrefix(`/realtime`) || PathPrefix(`/uploads`) || PathPrefix(`/media`))"
+      - "traefik.http.routers.hedgedoc2-api-http.entrypoints=web"
+      - "traefik.http.routers.hedgedoc2-api-http.service=hedgedoc2-api"
+      - "traefik.http.routers.hedgedoc2-api-http.middlewares=force-https"
+      - "traefik.http.routers.hedgedoc2-api.middlewares=force-https"
+      # Frontend → frontend (3001)
+      - "traefik.http.routers.hedgedoc2.rule=Host(`notes2.xiteng.site`)"
+      - "traefik.http.routers.hedgedoc2.entrypoints=websecure"
+      - "traefik.http.routers.hedgedoc2.tls=true"
+      - "traefik.http.routers.hedgedoc2.tls.certresolver=cfresolver"
+      - "traefik.http.routers.hedgedoc2.service=hedgedoc2"
+      - "traefik.http.services.hedgedoc2.loadbalancer.server.port=3001"
+      # HTTP entrypoint (Cloudflare Tunnel)
+      - "traefik.http.routers.hedgedoc2-http.rule=Host(`notes2.xiteng.site`)"
+      - "traefik.http.routers.hedgedoc2-http.entrypoints=web"
+      - "traefik.http.routers.hedgedoc2-http.service=hedgedoc2"
+      - "xiteng.site.cache.hedgedoc2.enabled=true"
+      - "xiteng.site.cache.hedgedoc2.routers=hedgedoc2,hedgedoc2-http"
+      - "xiteng.site.cache.hedgedoc2.paths=/assets/,/static/"
+      - "xiteng.site.cache.hedgedoc2.edge-ttl=604800"
+      - "xiteng.site.cache.hedgedoc2.stale-while-revalidate=86400"
+      # Force X-Forwarded-Proto
+      - "traefik.http.routers.hedgedoc2-http.middlewares=force-https"
+      - "traefik.http.routers.hedgedoc2.middlewares=force-https"
+      - "xiteng.site.component.hedgedoc2.enabled=true"
+      - "xiteng.site.component.hedgedoc2.name=HedgeDoc 2 (AI)"
+      - "xiteng.site.component.hedgedoc2.description=带本地模型写作助手的 HedgeDoc 2 实验环境。"
+      - "xiteng.site.component.hedgedoc2.section=services"
+      - "xiteng.site.component.hedgedoc2.category=开发与协作"
+      - "xiteng.site.component.hedgedoc2.url=https://notes2.xiteng.site"
+      - "xiteng.site.component.hedgedoc2.access=sso"
+      - "xiteng.site.component.hedgedoc2.access-label=需要登录"
+      - "xiteng.site.component.hedgedoc2.icon=H2"
+      - "xiteng.site.component.hedgedoc2.icon-url=https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons/svg/hedgedoc.svg"
+      - "xiteng.site.component.hedgedoc2.accent=blue"
+      - "xiteng.site.component.hedgedoc2.order=120"
+      - "xiteng.site.component.hedgedoc2.navigation=new-tab"
+      - "xiteng.site.component.hedgedoc2.portal-link=native"
+      - "xiteng.site.component.hedgedoc2.monitor.enabled=true"
+      - "xiteng.site.component.hedgedoc2.monitor.url=http://hedgedoc2:3001"
+
+networks:
+  homelab_net:
+    external: true