deploy: 适配 1Panel 单机（复用现有 PG、回环端口、手动触发 workflow）

.gitea/workflows/deploy.yml

@@ -0,0 +1,22 @@
+name: deploy
+on:
+  workflow_dispatch:
+
+jobs:
+  deploy:
+    runs-on: docker
+    steps:
+      - name: SSH deploy
+        shell: sh
+        env:
+          KEY_B64: ${{ secrets.DEPLOY_KEY_B64 }}
+          DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
+          DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
+        run: |
+          set -e
+          apk add --no-cache openssh-client >/dev/null 2>&1 || true
+          mkdir -p "$HOME/.ssh"
+          echo "$KEY_B64" | base64 -d > "$HOME/.ssh/id"
+          chmod 600 "$HOME/.ssh/id"
+          ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -i "$HOME/.ssh/id" \
+              "$DEPLOY_USER@$DEPLOY_HOST" "cd /opt/fashion/backend_v2 && ./deploy.sh backend"

deploy.sh

@@ -214,12 +214,14 @@ else
   export RELEASE="${RELEASE:-latest}"
 fi
 
-# 首次部署先让代理起来（前端构建期要用 18091 取 SSG 数据）
-if ! healthy proxy; then
-  echo "==> 启动代理（首次会一并拉起 db 与 a 槽）"
-  docker compose up -d proxy
-fi
+# 首次部署：先写切换点，再只启动代理。
+#   - render_active 必须先于 proxy 启动，否则 include 的 map 为空，nginx 会因未知变量启动失败。
+#   - --no-deps 避免首次起代理时顺带构建前端（此时 18091 尚未就绪，SSG 取数会失败）。
 render_active
+if ! healthy proxy; then
+  echo "==> 启动代理（首次只起代理，槽位由 roll 流程构建）"
+  docker compose up -d --no-deps proxy
+fi
 
 if [ "$TARGET" = "rollback" ]; then
   do_rollback

docker-compose.yml

@@ -26,7 +26,7 @@ x-backend-base: &backend-base
     BACKSTAGE_PORT: 8092
     GIN_MODE: release
 
-    HASHID_SECRET: ${HASHID_SECRET:?HASHID_SECRET 未设置：复制 .env.example 为 .env 并填写}
+    HASHID_SECRET: ${HASHID_SECRET:-}
     JWT_SECRET: ${JWT_SECRET:?JWT_SECRET 未设置}
     SSG_TOKEN: ${SSG_TOKEN:-}
     CORS_ALLOW_ORIGINS: ${CORS_ALLOW_ORIGINS:-https://xisoa.com,https://www.xisoa.com}
@@ -35,7 +35,8 @@ x-backend-base: &backend-base
     RATE_LIMIT_RPS: ${RATE_LIMIT_RPS:-20}
     RATE_LIMIT_BURST: ${RATE_LIMIT_BURST:-40}
 
-    DB_HOST: db
+    # 复用 1Panel 现有 Postgres（宿主 5432）。host-gateway 让容器经宿主访问它。
+    DB_HOST: host.docker.internal
     DB_PORT: 5432
     DB_USER: ${DB_USER:-fashion}
     DB_PASSWORD: ${DB_PASSWORD:?DB_PASSWORD 未设置}
@@ -60,9 +61,8 @@ x-backend-base: &backend-base
     UPLOAD_DIR: /app/uploads
   volumes:
     - uploads:/app/uploads
-  depends_on:
-    db:
-      condition: service_healthy
+  extra_hosts:
+    - "host.docker.internal:host-gateway"
   healthcheck:
     test: ["CMD", "wget", "-qO-", "http://127.0.0.1:8090/api/health"]
     interval: 10s
@@ -84,29 +84,15 @@ x-web-base: &web-base
     start_period: 15s
 
 services:
-  # ---- 数据库：PostgreSQL 16 + pgvector ----
-  db:
-    image: pgvector/pgvector:pg16
-    restart: unless-stopped
-    environment:
-      POSTGRES_USER: ${DB_USER:-fashion}
-      POSTGRES_PASSWORD: ${DB_PASSWORD:?DB_PASSWORD 未设置}
-      POSTGRES_DB: ${DB_NAME:-fashion}
-      TZ: Asia/Shanghai
-    volumes:
-      - db_data:/var/lib/postgresql/data
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U ${DB_USER:-fashion} -d ${DB_NAME:-fashion}"]
-      interval: 10s
-      timeout: 5s
-      retries: 10
+  # ---- 数据库：复用 1Panel 现有 Postgres（连接信息见 .env 的 DB_HOST/DB_PORT/DB_USER/DB_PASSWORD）----
 
   # ---- 常驻代理：整个发布过程中不重建，切换只靠 reload ----
   proxy:
     image: nginx:1.27-alpine
     restart: unless-stopped
     ports:
-      - "${HTTP_PORT:-80}:80"
+      # 只绑宿主回环：80/443 由 1Panel OpenResty 占用，外层反代到 127.0.0.1:${HTTP_PORT}
+      - "127.0.0.1:${HTTP_PORT:-8080}:80"
       - "127.0.0.1:18091:18091"   # 前端构建期取 SSG
       - "127.0.0.1:18092:18092"   # 管理后台（SSH 隧道）
     volumes:
@@ -151,5 +137,4 @@ services:
     <<: *web-base
 
 volumes:
-  db_data:
   uploads: