feat: SeaweedFS 替代 MinIO，Authentik ForwardAuth，多服务升级

新增: - SeaweedFS v4.28 替代 MinIO (域名 file.xiteng.site) - Authentik Outpost (Uptime Kuma + SeaweedFS 独立实例) - ForwardAuth 为 Uptime Kuma 和 SeaweedFS 提供认证 - gpu-exporter.py 监控脚本升级: - Traefik v3.6 → v3.7 - Authentik 固定版本 2026.5.0 + trusted proxy CIDR - HedgeDoc PG 11 → 16，添加 OIDC 认证 - Homepage 添加 OIDC 认证安全: - Outpost token 迁移至 .env 引用（不再硬编码） - .gitignore 扩展覆盖数据/缓存/旧 MinIO - security.toml 清理注释掉的旧密钥移除: - MinIO（已全部迁移至 SeaweedFS）
2026-05-27 19:51:12 +08:00
parent 9473a98165
commit 8c7eddbaee
12 changed files with 203 additions and 62 deletions
@@ -0,0 +1,60 @@
+services:
+  seaweedfs:
+    image: chrislusf/seaweedfs:latest
+    container_name: seaweedfs
+    restart: unless-stopped
+    command: "server -s3 -s3.port=8333 -master.port=9333 -volume.port=8080 -filer -filer.port=8888 -dir=/data -s3.domainName=file.xiteng.site"
+    environment:
+      - WEED_SECURITY_CONFIG=/etc/seaweedfs/security.toml
+    volumes:
+      - ./data:/data
+      - ./security.toml:/etc/seaweedfs/security.toml:ro
+    ports:
+      - "9333:9333"   # master
+      - "8081:8080"   # volume
+      - "8888:8888"   # filer
+      - "8333:8333"   # s3
+    labels:
+      - "traefik.enable=true"
+      # --- Traefik: S3 Console (带 Authentik ForwardAuth) ---
+      - "traefik.http.routers.minio.rule=Host(`file.xiteng.site`)"
+      - "traefik.http.services.minio.loadbalancer.server.port=8888"
+      - "traefik.http.routers.minio.entrypoints=websecure"
+      - "traefik.http.routers.minio.tls=true"
+      - "traefik.http.routers.minio.tls.certresolver=cfresolver"
+      - "traefik.http.routers.minio-http.rule=Host(`file.xiteng.site`)"
+      - "traefik.http.routers.minio-http.service=minio"
+      - "traefik.http.routers.minio-http.entrypoints=web"
+      # --- ForwardAuth：显式转发 Cookie 头给 outpost ---
+      - "traefik.http.middlewares.minio-scheme.headers.customrequestheaders.X-Forwarded-Proto=https"
+      - "traefik.http.middlewares.minio-auth.forwardauth.address=http://authentik-outpost-seaweedfs:9000/outpost.goauthentik.io/auth/traefik"
+      - "traefik.http.middlewares.minio-auth.forwardauth.trustForwardHeader=true"
+      - "traefik.http.middlewares.minio-auth.forwardauth.authResponseHeaders=X-authentik-username,X-authentik-groups,X-authentik-email,X-authentik-name"
+      - "traefik.http.routers.minio.middlewares=minio-scheme,minio-auth"
+      - "traefik.http.routers.minio-http.middlewares=minio-scheme,minio-auth"
+      # --- Traefik: S3 API (8333) ---
+      - "traefik.http.routers.minio-api.rule=Host(`minio-api.xiteng.site`)"
+      - "traefik.http.services.minio-api.loadbalancer.server.port=8333"
+      - "traefik.http.routers.minio-api.entrypoints=websecure"
+      - "traefik.http.routers.minio-api.tls=true"
+      - "traefik.http.routers.minio-api.tls.certresolver=cfresolver"
+      - "traefik.http.routers.minio-api-http.rule=Host(`minio-api.xiteng.site`)"
+      - "traefik.http.routers.minio-api-http.service=minio-api"
+      - "traefik.http.routers.minio-api-http.entrypoints=web"
+      # --- Homepage ---
+      - "homepage.group=我的服务"
+      - "homepage.name=SeaweedFS"
+      - "homepage.icon=/icons/seaweedfs-local.png"
+      - "homepage.href=https://file.xiteng.site"
+      - "homepage.description=对象存储"
+      # --- AutoKuma ---
+      - "kuma.minio.http.name=SeaweedFS"
+      - "kuma.minio.http.url=http://seaweedfs:8888"
+      - "kuma.minio.http.interval=60"
+      - "kuma.minio.http.max_retries=3"
+    networks:
+      - homelab_net
+
+networks:
+  homelab_net:
+    external: true