ip-radar/docker-compose.yml at master · steponeerror/ip-radar · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
services:
  ipradar:
    build: .
    image: ipradar:latest
    ports:
      - "127.0.0.1:${IPRADAR_PORT:-8000}:8000"
    env_file:
      - path: .env
        required: true
      - path: .env.local
        required: false
    volumes:
      - ipradar-data:/app/data
      # ── 一键更新(可选):取消注释并补 token 才解锁 /api/update ──
      # 挂 docker.sock = 容器获得宿主机 root 级控制,仅限内网自托管
      # - /var/run/docker.sock:/var/run/docker.sock
      # - /宿主机上的/ip-radar/绝对路径:/app/repo
      # ↓ environment 是 service 层键(与 volumes/env_file 平级),取消注释时移到 service 缩进层
      # environment:
      #   IP_RADAR_SELF_UPDATE: "1"
      #   IP_RADAR_UPDATE_TOKEN: "改成随机串"
      #   IP_RADAR_REPO_DIR: /app/repo
      #   IP_RADAR_COMPOSE_FILE: /app/repo/docker-compose.yml
      # ── 管理员/API key(可选):配齐后解锁 /admin 与 API key ──
      # ↓ 同上,environment 是 service 层键,取消注释时移到 service 缩进层
      # 反代部署:设置 IP_RADAR_PROXY_HEADERS=1 透传真实客户端 IP,否则 per-IP 限流全站共用一桶;受信代理默认 172.16.0.0/12(IP_RADAR_FORWARDED_ALLOW_IPS 可覆盖,勿设 '*')
      # 保持 IP_RADAR_ADMIN_PASSWORD 常设(重启自愈锁死的唯一途径)
      # 纯 http 内网部署(非 localhost)登录失败时设 IP_RADAR_INSECURE_COOKIE=1(Secure cookie 会被浏览器丢弃)
      # environment:
      #   IP_RADAR_ADMIN_PASSWORD: "change-me"
      #   IP_RADAR_API_JWT_SECRET: "<openssl rand -hex 32>"
      #   # IP_RADAR_PRIVATE_SOURCES: "a,b"   # 逗号分隔私源名单：web/匿名身份永不可见；改动需重启生效
      #   # IP_RADAR_ALERT_URLS: "mailto:you@example.com,https://larksuite.com/api/v2/hooks/xxx"   # 源停更/连续失败/库未加载告警(apprise 多接收者逗号分隔;默认空=静音)
      #   # IP_RADAR_REBUILD_SUBPROCESS: "1"   # 小内存机防 RSS 棘轮:重建挪子进程,完成即归还 OS
      #   # IP_RADAR_REBUILD_STALL_S: "3600"   # 重建检查点低内存时预算内等待(秒)而非弃进度;0=立即中止(旧行为)
      #   # IP_RADAR_ADMIN_EMAIL: "admin@ipradar.local"
      #   # IP_RADAR_PUBLIC_ORIGIN: "https://ipradar.huxiao0207.dpdns.org"
      #   # IP_RADAR_ENABLE_DOCS: "1"   # 开启 /docs /redoc /openapi.json(默认关闭)
      # ── 公开演示守卫(可选,默认关):适用任何公网暴露实例,详见 README ──
      # ↓ 同上,environment 是 service 层键,取消注释时移到 service 缩进层
      # ADMIN_IPS 是直连 peer 白名单(仅限应用端口直接暴露;反代后 peer 恒为代理 IP,XFF 可伪造勿默认信)
      # TRUST_XFF=1 须配套网关保证(反代剥/覆写 X-Forwarded-For),否则客户端可伪造
      # environment:
      #   IP_RADAR_PUBLIC_DEMO: "1"
      #   IP_RADAR_DEMO_ADMIN_IPS: "203.0.113.7,198.51.100.9"
      #   IP_RADAR_DEMO_TRUST_XFF: "0"
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request as u; u.urlopen('http://127.0.0.1:8000/api/db-status', timeout=5)"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 60s   # HTTP 现秒级可达(warming 期 db-status 返 200);60s 留慢机余量
volumes:
  ipradar-data: