liooil
8c7eddbaee
新增: - SeaweedFS v4.28 替代 MinIO (域名 file.xiteng.site) - Authentik Outpost (Uptime Kuma + SeaweedFS 独立实例) - ForwardAuth 为 Uptime Kuma 和 SeaweedFS 提供认证 - gpu-exporter.py 监控脚本 升级: - Traefik v3.6 → v3.7 - Authentik 固定版本 2026.5.0 + trusted proxy CIDR - HedgeDoc PG 11 → 16，添加 OIDC 认证 - Homepage 添加 OIDC 认证 安全: - Outpost token 迁移至 .env 引用（不再硬编码） - .gitignore 扩展覆盖数据/缓存/旧 MinIO - security.toml 清理注释掉的旧密钥 移除: - MinIO（已全部迁移至 SeaweedFS）
84 lines
3.6 KiB
YAML
84 lines
3.6 KiB
YAML
services:
|
||
hedgedoc-db:
|
||
image: postgres:16-alpine
|
||
environment:
|
||
- POSTGRES_USER=$POSTGRES_USER
|
||
- POSTGRES_PASSWORD=$POSTGRES_PASSWORD
|
||
- POSTGRES_DB=$POSTGRES_DB
|
||
container_name: hedgedoc_db
|
||
restart: unless-stopped
|
||
volumes:
|
||
- ./data:/var/lib/postgresql/data
|
||
networks:
|
||
- homelab_net
|
||
|
||
hedgedoc:
|
||
image: quay.io/hedgedoc/hedgedoc:latest
|
||
container_name: hedgedoc
|
||
restart: unless-stopped
|
||
environment:
|
||
- CMD_DB_HOST=hedgedoc_db
|
||
- CMD_DB_PORT=5432
|
||
- CMD_DB_DATABASE=$POSTGRES_DB
|
||
- CMD_DB_USERNAME=$POSTGRES_USER
|
||
- CMD_DB_PASSWORD=$POSTGRES_PASSWORD
|
||
- CMD_DB_DIALECT=postgres
|
||
- CMD_DOMAIN=notes.xiteng.site
|
||
- CMD_URL_ADDPORT=false
|
||
- CMD_ALLOW_ORIGIN=localhost,notes.xiteng.site
|
||
- CMD_PROTOCOL_USESSL=true
|
||
- CMD_OAUTH2_PROVIDERNAME=Authentik
|
||
- CMD_OAUTH2_CLIENT_ID=hedgedoc-280baa8d
|
||
- CMD_OAUTH2_CLIENT_SECRET=0630f01b111d4ad68ff9b2d174028994decb5b55b51a4556bda24768d11b4586
|
||
- CMD_OAUTH2_AUTHORIZATION_URL=https://auth.xiteng.site/application/o/authorize/
|
||
- CMD_OAUTH2_TOKEN_URL=https://auth.xiteng.site/application/o/token/
|
||
- CMD_OAUTH2_USER_PROFILE_URL=https://auth.xiteng.site/application/o/userinfo/
|
||
- CMD_OAUTH2_SCOPE=openid profile email
|
||
- CMD_OAUTH2_ISSUER=https://auth.xiteng.site/application/o/hedgedoc/
|
||
- CMD_OAUTH2_USER_PROFILE_USERNAME_ATTR=preferred_username
|
||
- CMD_OAUTH2_USER_PROFILE_DISPLAY_NAME_ATTR=name
|
||
- CMD_OAUTH2_USER_PROFILE_EMAIL_ATTR=email
|
||
volumes:
|
||
- ./uploads:/hedgedoc/public/uploads
|
||
depends_on:
|
||
- hedgedoc-db
|
||
ports:
|
||
- "3000:3000"
|
||
labels:
|
||
# --- 1. Traefik 路由设置 ---
|
||
- "traefik.enable=true"
|
||
- "traefik.http.routers.hedgedoc.rule=Host(`notes.xiteng.site`)"
|
||
- "traefik.http.services.hedgedoc.loadbalancer.server.port=3000"
|
||
# 强制使用 websecure (443端口) 入口
|
||
- "traefik.http.routers.hedgedoc.entrypoints=websecure"
|
||
# --- HTTP 入口（来自 cloudflared tunnel）---
|
||
- "traefik.http.routers.hedgedoc-http.rule=Host(`notes.xiteng.site`)"
|
||
- "traefik.http.routers.hedgedoc-http.service=hedgedoc"
|
||
- "traefik.http.routers.hedgedoc-http.entrypoints=web"
|
||
# --- 中间件：强制 X-Forwarded-Proto（Cloudflare Tunnel 用 HTTP 连 Traefik，但用户端是 HTTPS）---
|
||
- "traefik.http.middlewares.force-https.headers.customrequestheaders.X-Forwarded-Proto=https"
|
||
- "traefik.http.routers.hedgedoc-http.middlewares=force-https"
|
||
- "traefik.http.routers.hedgedoc.middlewares=force-https"
|
||
# --- 新增：开启 TLS 并指定解析器 ---
|
||
- "traefik.http.routers.hedgedoc.tls=true"
|
||
- "traefik.http.routers.hedgedoc.tls.certresolver=cfresolver"
|
||
# --- 2. Homepage 自动发现设置 ---
|
||
- "homepage.group=我的服务" # 分组名称
|
||
- "homepage.name=HedgeDoc" # 显示名称
|
||
- "homepage.icon=si-hedgedoc" # 图标 (支持 si, mdi 等前缀)
|
||
- "homepage.href=https://notes.xiteng.site" # 点击跳转的链接
|
||
- "homepage.description=实时 Markdown 协作" # 副标题描述
|
||
# --- 3. AutoKuma 自动发现设置 ---
|
||
# 格式: kuma.<自定义ID>.<监控类型>.<属性>
|
||
- "kuma.hedgedoc.http.name=HedgeDoc" # 监控项名称
|
||
- "kuma.hedgedoc.http.url=http://hedgedoc:3000" # 内网直连
|
||
# (可选) 每 60 秒检查一次，重试 3 次
|
||
- "kuma.hedgedoc.http.interval=60"
|
||
- "kuma.hedgedoc.http.max_retries=3"
|
||
networks:
|
||
- homelab_net
|
||
|
||
networks:
|
||
homelab_net:
|
||
external: true
|