liooil
8c7eddbaee
新增: - SeaweedFS v4.28 替代 MinIO (域名 file.xiteng.site) - Authentik Outpost (Uptime Kuma + SeaweedFS 独立实例) - ForwardAuth 为 Uptime Kuma 和 SeaweedFS 提供认证 - gpu-exporter.py 监控脚本 升级: - Traefik v3.6 → v3.7 - Authentik 固定版本 2026.5.0 + trusted proxy CIDR - HedgeDoc PG 11 → 16，添加 OIDC 认证 - Homepage 添加 OIDC 认证 安全: - Outpost token 迁移至 .env 引用（不再硬编码） - .gitignore 扩展覆盖数据/缓存/旧 MinIO - security.toml 清理注释掉的旧密钥 移除: - MinIO（已全部迁移至 SeaweedFS）
61 lines
2.9 KiB
YAML
61 lines
2.9 KiB
YAML
services:
|
|
seaweedfs:
|
|
image: chrislusf/seaweedfs:latest
|
|
container_name: seaweedfs
|
|
restart: unless-stopped
|
|
command: "server -s3 -s3.port=8333 -master.port=9333 -volume.port=8080 -filer -filer.port=8888 -dir=/data -s3.domainName=file.xiteng.site"
|
|
environment:
|
|
- WEED_SECURITY_CONFIG=/etc/seaweedfs/security.toml
|
|
volumes:
|
|
- ./data:/data
|
|
- ./security.toml:/etc/seaweedfs/security.toml:ro
|
|
ports:
|
|
- "9333:9333" # master
|
|
- "8081:8080" # volume
|
|
- "8888:8888" # filer
|
|
- "8333:8333" # s3
|
|
labels:
|
|
- "traefik.enable=true"
|
|
# --- Traefik: S3 Console (带 Authentik ForwardAuth) ---
|
|
- "traefik.http.routers.minio.rule=Host(`file.xiteng.site`)"
|
|
- "traefik.http.services.minio.loadbalancer.server.port=8888"
|
|
- "traefik.http.routers.minio.entrypoints=websecure"
|
|
- "traefik.http.routers.minio.tls=true"
|
|
- "traefik.http.routers.minio.tls.certresolver=cfresolver"
|
|
- "traefik.http.routers.minio-http.rule=Host(`file.xiteng.site`)"
|
|
- "traefik.http.routers.minio-http.service=minio"
|
|
- "traefik.http.routers.minio-http.entrypoints=web"
|
|
# --- ForwardAuth：显式转发 Cookie 头给 outpost ---
|
|
- "traefik.http.middlewares.minio-scheme.headers.customrequestheaders.X-Forwarded-Proto=https"
|
|
- "traefik.http.middlewares.minio-auth.forwardauth.address=http://authentik-outpost-seaweedfs:9000/outpost.goauthentik.io/auth/traefik"
|
|
- "traefik.http.middlewares.minio-auth.forwardauth.trustForwardHeader=true"
|
|
- "traefik.http.middlewares.minio-auth.forwardauth.authResponseHeaders=X-authentik-username,X-authentik-groups,X-authentik-email,X-authentik-name"
|
|
- "traefik.http.routers.minio.middlewares=minio-scheme,minio-auth"
|
|
- "traefik.http.routers.minio-http.middlewares=minio-scheme,minio-auth"
|
|
# --- Traefik: S3 API (8333) ---
|
|
- "traefik.http.routers.minio-api.rule=Host(`minio-api.xiteng.site`)"
|
|
- "traefik.http.services.minio-api.loadbalancer.server.port=8333"
|
|
- "traefik.http.routers.minio-api.entrypoints=websecure"
|
|
- "traefik.http.routers.minio-api.tls=true"
|
|
- "traefik.http.routers.minio-api.tls.certresolver=cfresolver"
|
|
- "traefik.http.routers.minio-api-http.rule=Host(`minio-api.xiteng.site`)"
|
|
- "traefik.http.routers.minio-api-http.service=minio-api"
|
|
- "traefik.http.routers.minio-api-http.entrypoints=web"
|
|
# --- Homepage ---
|
|
- "homepage.group=我的服务"
|
|
- "homepage.name=SeaweedFS"
|
|
- "homepage.icon=/icons/seaweedfs-local.png"
|
|
- "homepage.href=https://file.xiteng.site"
|
|
- "homepage.description=对象存储"
|
|
# --- AutoKuma ---
|
|
- "kuma.minio.http.name=SeaweedFS"
|
|
- "kuma.minio.http.url=http://seaweedfs:8888"
|
|
- "kuma.minio.http.interval=60"
|
|
- "kuma.minio.http.max_retries=3"
|
|
networks:
|
|
- homelab_net
|
|
|
|
networks:
|
|
homelab_net:
|
|
external: true
|