build(newapi): 全容器化部署并添加 PostgreSQL 服务

newapi/stack.yml

@@ -1,10 +1,10 @@
-# path:: mkdir -pv /data/volumes/newapi/{data,logs}
+# path:: mkdir -pv /data/volumes/newapi/{data,logs,redis,pgsql_data}
 # pull:: docker compose -p newapi --env-file ./newapi/env.cfg -f ./newapi/stack.yml pull
 # run::  docker compose -p newapi --env-file ./newapi/env.cfg -f ./newapi/stack.yml up -d
-# disc:: 数据库使用宿主机已有 PostgreSQL，需先建库建号（SQL 见 env.cfg.example），栈内不跑 PG
-# disc:: new-api 与 redis 均为 host 网络：无 ports 映射，PG/Redis 经 127.0.0.1 直连，
-# disc:: 宿主机 PG 保持默认 localhost 监听即可，无需改 listen_addresses / pg_hba.conf
-# disc:: 第一个注册的账号自动成为管理员；公网只放行 80/443，3000 由 Nginx/Caddy 反代，勿直接暴露
+# disc:: 全栈容器化部署：包含 new-api、Redis 缓存及 PostgreSQL 数据库
+# disc:: 容器间处于自定义桥接网络 newapi 内，内部通过服务名 postgres:5432 / redis:6379 互通
+# disc:: 容器 PG 不暴露宿主机端口，与宿主机已有 PostgreSQL 服务互不冲突
+# disc:: 第一个注册的账号自动成为管理员；生产务必修改 env.cfg 中的全部密码
 
 services:
   newapi:
@@ -12,7 +12,13 @@ services:
     container_name: newapi_app
     restart: always
     command: --log-dir /app/logs
-    network_mode: host
+    ports:
+      - "${PORT:-3000}:3000"
+    networks:
+      - newapi
+    depends_on:
+      - redis
+      - postgres
     volumes:
       - ${Volumes_Path}/data:/data
       - ${Volumes_Path}/logs:/app/logs
@@ -22,18 +28,18 @@ services:
       - SQL_DSN=postgresql://${DB_USER}:${DB_PASSWORD}@${DB_HOST}:${DB_PORT}/${DB_NAME}
       # 本机无 TLS 的 PG 也可显式关闭 SSL：
       # - SQL_DSN=postgresql://${DB_USER}:${DB_PASSWORD}@${DB_HOST}:${DB_PORT}/${DB_NAME}?sslmode=disable
-      - REDIS_CONN_STRING=redis://:${REDIS_PASSWORD}@127.0.0.1:6379
+      - REDIS_CONN_STRING=redis://:${REDIS_PASSWORD}@redis:6379
       - TZ=Asia/Shanghai
       - BATCH_UPDATE_ENABLED=true
       - ERROR_LOG_ENABLED=true
       - NODE_NAME=${NODE_NAME}
       - SESSION_SECRET=${SESSION_SECRET}
       # 可选：独立日志库（PG 或 ClickHouse），不设则日志与业务同库
-      # - LOG_SQL_DSN=postgresql://user:pass@127.0.0.1:5432/new_api_log
+      # - LOG_SQL_DSN=postgresql://${DB_USER}:${DB_PASSWORD}@postgres:5432/new_api_log
       # 流式无响应超时（秒），默认 120，出现空补全时调大：
       # - STREAMING_TIMEOUT=300
     healthcheck:
-      test: ["CMD-SHELL", "wget -q -O - http://localhost:3000/api/status > /dev/null || exit 1"]
+      test: ["CMD-SHELL", "wget -q -O - http://127.0.0.1:3000/api/status > /dev/null || exit 1"]
       interval: 30s
       timeout: 10s
       retries: 3
@@ -42,11 +48,40 @@ services:
     image: ${REDIS_IMAGE_TAG}
     container_name: newapi_redis
     restart: always
-    network_mode: host
-    # 宿主网络下只绑 127.0.0.1，外部无法直连；宿主机 6379 已被占用时先处理冲突
-    command: ["redis-server", "--requirepass", "${REDIS_PASSWORD}", "--bind", "127.0.0.1"]
+    networks:
+      - newapi
+    volumes:
+      - ${Volumes_Path}/redis:/data
+    command: ["redis-server", "--requirepass", "${REDIS_PASSWORD}"]
     healthcheck:
       test: ["CMD-SHELL", "redis-cli -a ${REDIS_PASSWORD} ping | grep -q PONG"]
       interval: 10s
       timeout: 5s
       retries: 5
+
+  postgres:
+    image: ${PGSQL_IMAGE_TAG}
+    container_name: newapi_pgsql
+    restart: always
+    shm_size: 256mb
+    environment:
+      - POSTGRES_USER=${DB_USER}
+      - POSTGRES_PASSWORD=${DB_PASSWORD}
+      - POSTGRES_DB=${DB_NAME}
+      - POSTGRES_HOST_AUTH_METHOD=scram-sha-256
+      - TZ=Asia/Shanghai
+    volumes:
+      - ${Volumes_Path}/pgsql_data:/var/lib/postgresql/data
+      - /etc/timezone:/etc/timezone:ro
+      - /etc/localtime:/etc/localtime:ro
+    networks:
+      - newapi
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U ${DB_USER} -d ${DB_NAME}"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+
+networks:
+  newapi:
+    driver: bridge