From 93edad28e578006f00b54a4a6894311e42ce752c Mon Sep 17 00:00:00 2001
From: ci <ci@local>
Date: Tue, 20 Oct 2026 19:16:05 +0800
Subject: [PATCH] =?UTF-8?q?deploy:=20=E9=80=82=E9=85=8D=201Panel=20?=
 =?UTF-8?q?=E5=8D=95=E6=9C=BA=EF=BC=88=E5=A4=8D=E7=94=A8=E7=8E=B0=E6=9C=89?=
 =?UTF-8?q?=20PG=E3=80=81=E5=9B=9E=E7=8E=AF=E7=AB=AF=E5=8F=A3=E3=80=81?=
 =?UTF-8?q?=E6=89=8B=E5=8A=A8=E8=A7=A6=E5=8F=91=20workflow=EF=BC=89?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .gitea/workflows/deploy.yml | 22 ++++++++++++++++++++++
 deploy.sh                   | 12 +++++++-----
 docker-compose.yml          | 31 ++++++++-----------------------
 3 files changed, 37 insertions(+), 28 deletions(-)
 create mode 100644 .gitea/workflows/deploy.yml
 mode change 100644 => 100755 deploy.sh

diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
new file mode 100644
index 0000000..0b67965
--- /dev/null
+++ b/.gitea/workflows/deploy.yml
@@ -0,0 +1,22 @@
+name: deploy
+on:
+  workflow_dispatch:
+
+jobs:
+  deploy:
+    runs-on: docker
+    steps:
+      - name: SSH deploy
+        shell: sh
+        env:
+          KEY_B64: ${{ secrets.DEPLOY_KEY_B64 }}
+          DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
+          DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
+        run: |
+          set -e
+          apk add --no-cache openssh-client >/dev/null 2>&1 || true
+          mkdir -p "$HOME/.ssh"
+          echo "$KEY_B64" | base64 -d > "$HOME/.ssh/id"
+          chmod 600 "$HOME/.ssh/id"
+          ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -i "$HOME/.ssh/id" \
+              "$DEPLOY_USER@$DEPLOY_HOST" "cd /opt/fashion/backend_v2 && ./deploy.sh backend"
diff --git a/deploy.sh b/deploy.sh
old mode 100644
new mode 100755
index 99d9655..a1cb14f
--- a/deploy.sh
+++ b/deploy.sh
@@ -214,12 +214,14 @@ else
   export RELEASE="${RELEASE:-latest}"
 fi
 
-# 首次部署先让代理起来（前端构建期要用 18091 取 SSG 数据）
-if ! healthy proxy; then
-  echo "==> 启动代理（首次会一并拉起 db 与 a 槽）"
-  docker compose up -d proxy
-fi
+# 首次部署：先写切换点，再只启动代理。
+#   - render_active 必须先于 proxy 启动，否则 include 的 map 为空，nginx 会因未知变量启动失败。
+#   - --no-deps 避免首次起代理时顺带构建前端（此时 18091 尚未就绪，SSG 取数会失败）。
 render_active
+if ! healthy proxy; then
+  echo "==> 启动代理（首次只起代理，槽位由 roll 流程构建）"
+  docker compose up -d --no-deps proxy
+fi
 
 if [ "$TARGET" = "rollback" ]; then
   do_rollback
diff --git a/docker-compose.yml b/docker-compose.yml
index 8cbfeee..60ce1c4 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -26,7 +26,7 @@ x-backend-base: &backend-base
     BACKSTAGE_PORT: 8092
     GIN_MODE: release
 
-    HASHID_SECRET: ${HASHID_SECRET:?HASHID_SECRET 未设置：复制 .env.example 为 .env 并填写}
+    HASHID_SECRET: ${HASHID_SECRET:-}
     JWT_SECRET: ${JWT_SECRET:?JWT_SECRET 未设置}
     SSG_TOKEN: ${SSG_TOKEN:-}
     CORS_ALLOW_ORIGINS: ${CORS_ALLOW_ORIGINS:-https://xisoa.com,https://www.xisoa.com}
@@ -35,7 +35,8 @@ x-backend-base: &backend-base
     RATE_LIMIT_RPS: ${RATE_LIMIT_RPS:-20}
     RATE_LIMIT_BURST: ${RATE_LIMIT_BURST:-40}
 
-    DB_HOST: db
+    # 复用 1Panel 现有 Postgres（宿主 5432）。host-gateway 让容器经宿主访问它。
+    DB_HOST: host.docker.internal
     DB_PORT: 5432
     DB_USER: ${DB_USER:-fashion}
     DB_PASSWORD: ${DB_PASSWORD:?DB_PASSWORD 未设置}
@@ -60,9 +61,8 @@ x-backend-base: &backend-base
     UPLOAD_DIR: /app/uploads
   volumes:
     - uploads:/app/uploads
-  depends_on:
-    db:
-      condition: service_healthy
+  extra_hosts:
+    - "host.docker.internal:host-gateway"
   healthcheck:
     test: ["CMD", "wget", "-qO-", "http://127.0.0.1:8090/api/health"]
     interval: 10s
@@ -84,29 +84,15 @@ x-web-base: &web-base
     start_period: 15s
 
 services:
-  # ---- 数据库：PostgreSQL 16 + pgvector ----
-  db:
-    image: pgvector/pgvector:pg16
-    restart: unless-stopped
-    environment:
-      POSTGRES_USER: ${DB_USER:-fashion}
-      POSTGRES_PASSWORD: ${DB_PASSWORD:?DB_PASSWORD 未设置}
-      POSTGRES_DB: ${DB_NAME:-fashion}
-      TZ: Asia/Shanghai
-    volumes:
-      - db_data:/var/lib/postgresql/data
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U ${DB_USER:-fashion} -d ${DB_NAME:-fashion}"]
-      interval: 10s
-      timeout: 5s
-      retries: 10
+  # ---- 数据库：复用 1Panel 现有 Postgres（连接信息见 .env 的 DB_HOST/DB_PORT/DB_USER/DB_PASSWORD）----
 
   # ---- 常驻代理：整个发布过程中不重建，切换只靠 reload ----
   proxy:
     image: nginx:1.27-alpine
     restart: unless-stopped
     ports:
-      - "${HTTP_PORT:-80}:80"
+      # 只绑宿主回环：80/443 由 1Panel OpenResty 占用，外层反代到 127.0.0.1:${HTTP_PORT}
+      - "127.0.0.1:${HTTP_PORT:-8080}:80"
       - "127.0.0.1:18091:18091"   # 前端构建期取 SSG
       - "127.0.0.1:18092:18092"   # 管理后台（SSH 隧道）
     volumes:
@@ -151,5 +137,4 @@ services:
     <<: *web-base
 
 volumes:
-  db_data:
   uploads: