CaIon
56dbaab1d4
- add SESSION_COOKIE_SECURE / SESSION_COOKIE_TRUSTED_URL env vars with startup validation: enabling Secure requires at least one trusted HTTPS entry URL - wire common.SessionCookieSecure into the session cookie store instead of a hardcoded Secure=false - print a startup warning when Secure session cookies are disabled - document the new settings in .env.example and docker-compose files Secure stays off by default because many deployments front new-api with plain-HTTP reverse proxies, where a hardcoded Secure default would break logins entirely; enabling it safely depends on the deployment's TLS setup, so it ships as an opt-in deployment-hardening flag.
124 lines
5.6 KiB
YAML
124 lines
5.6 KiB
YAML
# New-API Docker Compose Configuration
|
||
#
|
||
# Quick Start:
|
||
# 1. docker-compose up -d
|
||
# 2. Access at http://localhost:3000
|
||
#
|
||
# Using MySQL instead of PostgreSQL:
|
||
# 1. Comment out the postgres service and SQL_DSN line 15
|
||
# 2. Uncomment the mysql service and SQL_DSN line 16
|
||
# 3. Uncomment mysql in depends_on (line 28)
|
||
# 4. Uncomment mysql_data in volumes section (line 64)
|
||
#
|
||
# ⚠️ IMPORTANT: Change all default passwords before deploying to production!
|
||
|
||
version: '3.4' # For compatibility with older Docker versions
|
||
|
||
services:
|
||
new-api:
|
||
image: calciumion/new-api:latest
|
||
container_name: new-api
|
||
restart: always
|
||
command: --log-dir /app/logs
|
||
ports:
|
||
- "3000:3000"
|
||
volumes:
|
||
- ./data:/data
|
||
- ./logs:/app/logs
|
||
environment:
|
||
- SQL_DSN=postgresql://root:123456@postgres:5432/new-api # ⚠️ IMPORTANT: Change the password in production!
|
||
# - SQL_DSN=root:123456@tcp(mysql:3306)/new-api # Point to the mysql service, uncomment if using MySQL
|
||
# - LOG_SQL_DSN=postgresql://root:123456@postgres:5432/new-api-log # OPTIONAL: If you want a separate database for logging, uncomment and set this
|
||
# - LOG_SQL_DSN=clickhouse://default:123456@clickhouse:9000/new_api_logs # OPTIONAL: Use ClickHouse for logs only; also uncomment clickhouse in depends_on and the clickhouse service below
|
||
# - LOG_SQL_CLICKHOUSE_TTL_DAYS=0 # OPTIONAL: ClickHouse log retention days. Unset or 0 disables automatic deletion; set to e.g. 30 to keep 30 days
|
||
- REDIS_CONN_STRING=redis://:123456@redis:6379 # ⚠️ IMPORTANT: Change the password in production!
|
||
- TZ=Asia/Shanghai
|
||
- ERROR_LOG_ENABLED=true # 是否启用错误日志记录 (Whether to enable error log recording)
|
||
- BATCH_UPDATE_ENABLED=true # 是否启用批量更新 (Whether to enable batch update)
|
||
- NODE_NAME=new-api-node-1 # 节点名称，用于审计日志中标识节点身份；多节点/容器部署时建议设置 (Node name used in audit logs; recommended when running multiple instances or in containers)
|
||
# - STREAMING_TIMEOUT=300 # 流模式无响应超时时间，单位秒，默认120秒，如果出现空补全可以尝试改为更大值 （Streaming timeout in seconds, default is 120s. Increase if experiencing empty completions）
|
||
# - RELAY_IDLE_CONN_TIMEOUT=90 # Relay HTTP 客户端空闲连接超时时间，单位秒，默认跟随 Go 标准库，设置为0表示不限制 (Relay HTTP client idle keep-alive timeout in seconds, defaults to Go standard library; set 0 to disable)
|
||
# - SESSION_SECRET=random_string # 多机部署时设置，必须修改这个随机字符串！！ （multi-node deployment, set this to a random string!!!!!!!）
|
||
# - SESSION_COOKIE_SECURE=true # 启用 Secure session cookie，必须同时配置 SESSION_COOKIE_TRUSTED_URL (Enable Secure session cookies; requires SESSION_COOKIE_TRUSTED_URL)
|
||
# - SESSION_COOKIE_TRUSTED_URL=https://example.com,https://admin.example.com # 可信 HTTPS 入口地址，多个用英文逗号分隔 (Trusted HTTPS entry URLs, comma-separated)
|
||
# - SYNC_FREQUENCY=60 # Uncomment if regular database syncing is needed
|
||
# - GOOGLE_ANALYTICS_ID=G-XXXXXXXXXX # Google Analytics 的测量 ID (Google Analytics Measurement ID)
|
||
# - UMAMI_WEBSITE_ID=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx # Umami 网站 ID (Umami Website ID)
|
||
# - UMAMI_SCRIPT_URL=https://analytics.umami.is/script.js # Umami 脚本 URL，默认为官方地址 (Umami Script URL, defaults to official URL)
|
||
|
||
depends_on:
|
||
- redis
|
||
- postgres
|
||
# - mysql # Uncomment if using MySQL
|
||
# - clickhouse # Uncomment if using ClickHouse for LOG_SQL_DSN
|
||
networks:
|
||
- new-api-network
|
||
healthcheck:
|
||
test: ["CMD-SHELL", "wget -q -O - http://localhost:3000/api/status | grep -o '\"success\":\\s*true' || exit 1"]
|
||
interval: 30s
|
||
timeout: 10s
|
||
retries: 3
|
||
|
||
redis:
|
||
image: redis:latest
|
||
container_name: redis
|
||
restart: always
|
||
command: ["redis-server", "--requirepass", "123456"] # ⚠️ IMPORTANT: Change this password in production!
|
||
networks:
|
||
- new-api-network
|
||
|
||
postgres:
|
||
image: postgres:15
|
||
container_name: postgres
|
||
restart: always
|
||
environment:
|
||
POSTGRES_USER: root
|
||
POSTGRES_PASSWORD: 123456 # ⚠️ IMPORTANT: Change this password in production!
|
||
POSTGRES_DB: new-api
|
||
volumes:
|
||
- pg_data:/var/lib/postgresql/data
|
||
networks:
|
||
- new-api-network
|
||
# ports:
|
||
# - "5432:5432" # Uncomment if you need to access PostgreSQL from outside Docker
|
||
|
||
# mysql:
|
||
# image: mysql:8.2
|
||
# container_name: mysql
|
||
# restart: always
|
||
# environment:
|
||
# MYSQL_ROOT_PASSWORD: 123456 # ⚠️ IMPORTANT: Change this password in production!
|
||
# MYSQL_DATABASE: new-api
|
||
# volumes:
|
||
# - mysql_data:/var/lib/mysql
|
||
# networks:
|
||
# - new-api-network
|
||
# ports:
|
||
# - "3306:3306" # Uncomment if you need to access MySQL from outside Docker
|
||
|
||
# clickhouse:
|
||
# image: clickhouse/clickhouse-server:24.8
|
||
# container_name: clickhouse
|
||
# restart: always
|
||
# environment:
|
||
# CLICKHOUSE_DB: new_api_logs
|
||
# CLICKHOUSE_USER: default
|
||
# CLICKHOUSE_PASSWORD: 123456 # ⚠️ IMPORTANT: Change this password in production!
|
||
# CLICKHOUSE_DEFAULT_ACCESS_MANAGEMENT: 1
|
||
# volumes:
|
||
# - clickhouse_data:/var/lib/clickhouse
|
||
# networks:
|
||
# - new-api-network
|
||
# ports:
|
||
# - "8123:8123" # HTTP interface, uncomment if you need external access
|
||
# - "9000:9000" # Native interface used by the LOG_SQL_DSN example above
|
||
|
||
volumes:
|
||
pg_data:
|
||
# mysql_data:
|
||
# clickhouse_data:
|
||
|
||
networks:
|
||
new-api-network:
|
||
driver: bridge
|