docker-compose.yml

version: "3.8"

services:
  # Traefik 反向代理服务：统一入口，负责路由与负载均衡
  traefik:
    image: traefik:v2.9
    command:
      - "--providers.docker.swarmMode=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.web.address=:80"
      # 若需要 HTTPS，可添加 HTTPS 入口配置，例如：
      # - "--entrypoints.websecure.address=:443"
      # 启用详细日志配置
      - "--log.level=DEBUG"
      - "--accesslog=true"
      - "--accesslog.format=json"
      - "--log.format=json"
      - "--api.dashboard=true"
    ports:
      - "20000:80"
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
    deploy:
      placement:
        constraints:
          - node.role == manager
    networks:
      - fastapi-network

  # db-migration 服务：执行数据库迁移（alembic upgrade head）
  db-migration:
    image: harbor.exploit-db.xyz/detvron-img/fastapi-blog:latest
    command: ["alembic", "upgrade", "head"]
    environment:
      - DB_USERNAME=${DB_USERNAME}
      - DB_PASSWORD=${DB_PASSWORD}
      - DB_HOSTNAME=${DB_HOSTNAME}
      - DB_PORT=${DB_PORT}
      - DB_NAME=${DB_NAME}
    networks:
      - fastapi-network
    deploy:
      restart_policy:
        condition: none
      resources:
        limits:
          cpus: "0.5"
          memory: 512M

  # fastapi 服务：业务服务，由 Traefik 根据标签进行路由
  fastapi:
    image: harbor.exploit-db.xyz/detvron-img/fastapi-blog:latest
    # 不直接发布端口，由 Traefik 做入口负载均衡
    environment:
      - ADMIN_RECAPTCHA_SECRET_KEY=${ADMIN_RECAPTCHA_SECRET_KEY}
      - GENERAL_USER_RECAPTCHA_SECRET_KEY=${GENERAL_USER_RECAPTCHA_SECRET_KEY}
      - DB_USERNAME=${DB_USERNAME}
      - DB_PASSWORD=${DB_PASSWORD}
      - DB_HOSTNAME=${DB_HOSTNAME}
      - DB_PORT=${DB_PORT}
      - DB_NAME=${DB_NAME}
      - REDIS_DB_PASSWORD=${REDIS_DB_PASSWORD}
      - REDIS_DB_HOSTNAME=${REDIS_DB_HOSTNAME}
      - REDIS_DB_PORT=${REDIS_DB_PORT}
      - REDIS_DB_NAME=${REDIS_DB_NAME}
      - REDIS_USER_NAME=${REDIS_USER_NAME}
      - ACCESS_KEY_ID=${ACCESS_KEY_ID}
      - ACCESS_KEY_SECRET=${ACCESS_KEY_SECRET}
      - SECRET_KEY=${SECRET_KEY}
      - USER_SECRET_KEY=${USER_SECRET_KEY}
      - SMTPSERVER=${SMTPSERVER}
      - SMTPUSER=${SMTPUSER}
      - SMTPPASSWORD=${SMTPPASSWORD}
      - MQ_HOSTNAME=${MQ_HOSTNAME}
      - MQ_USERNAME=${MQ_USERNAME}
      - MQ_USERPASSWORD=${MQ_USERPASSWORD}
      - MQ_DBNAME=${MQ_DBNAME}
      - MQ_DBPORT=${MQ_DBPORT}
      - LogStathIP=${LogStathIP}
      - REFSECRET_KEY=${REFSECRET_KEY}
      - ALLOWED_ORIGINS=${ALLOWED_ORIGINS}
      - GITHUB_CLIENT_ID=${GITHUB_CLIENT_ID}
      - GITHUB_CLIENT_SECRET=${GITHUB_CLIENT_SECRET}
      - REDIRECT_URI=${REDIRECT_URI}
      - URLKEY=${URLKEY}
      - LOGSTASH_NGINX_HOST=${LOGSTASH_NGINX_HOST}
      - LOGSTASH_USER=${LOGSTASH_USER}
      - LOGSTASH_PASS=${LOGSTASH_PASS}
    deploy:
      replicas: 3
      placement:
        constraints:
          - node.role == worker
      update_config:
        parallelism: 1
        delay: 10s
        order: start-first
        failure_action: rollback
      restart_policy:
        condition: on-failure
        delay: 5s
        max_attempts: 3
        window: 120s
      resources:
        limits:
          cpus: "1"
          memory: 1G
        reservations:
          cpus: "0.5"
          memory: 512M
      labels:
        - "traefik.enable=true"
        # 这里设置路由规则：当访问blogapi-traefik.exploit-db.xyz 时，将流量路由到该服务
        - "traefik.http.routers.fastapi.rule=Host(`blogapi-traefik.exploit-db.xyz`)"
        # 指定入口，为 web 入口（即 80 端口）
        - "traefik.http.routers.fastapi.entrypoints=web"
        # 指定 fastapi 服务内监听的端口（80 端口）
        - "traefik.http.services.fastapi.loadbalancer.server.port=80"
    networks:
      - fastapi-network
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"
    depends_on:
      - db-migration

networks:
  fastapi-network:
    driver: overlay
    attachable: true