name: sub2api-stack

services:
  sub2api-db:
    image: postgres:18-alpine
    container_name: sub2api-db
    restart: unless-stopped
    environment:
      POSTGRES_DB: ${POSTGRES_DB}
      POSTGRES_USER: ${POSTGRES_USER}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      PGDATA: /var/lib/postgresql/data
      TZ: ${TZ}
    volumes:
      - ./volumes/sub2api-postgres:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U $$POSTGRES_USER -d $$POSTGRES_DB"]
      interval: 10s
      timeout: 5s
      retries: 10
    networks:
      - sub2api_net

  sub2api-redis:
    image: redis:8-alpine
    container_name: sub2api-redis
    restart: unless-stopped
    command: >
      sh -c 'redis-server
      --save 60 1
      --appendonly yes
      --appendfsync everysec
      --requirepass "$$REDIS_PASSWORD"'
    environment:
      REDIS_PASSWORD: ${REDIS_PASSWORD}
      REDISCLI_AUTH: ${REDIS_PASSWORD}
      TZ: ${TZ}
    volumes:
      - ./volumes/sub2api-redis:/data
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 10
    networks:
      - sub2api_net

  sub2api:
    image: weishaw/sub2api:latest
    container_name: sub2api
    restart: unless-stopped
    depends_on:
      sub2api-db:
        condition: service_healthy
      sub2api-redis:
        condition: service_healthy
    extra_hosts:
      - "host.docker.internal:host-gateway"
    ulimits:
      nofile:
        soft: 100000
        hard: 100000
    volumes:
      - ./volumes/sub2api-data:/app/data
    environment:
      AUTO_SETUP: "true"

      SERVER_HOST: "0.0.0.0"
      SERVER_PORT: "8080"
      SERVER_MODE: "release"
      RUN_MODE: "standard"

      DATABASE_HOST: "sub2api-db"
      DATABASE_PORT: "5432"
      DATABASE_USER: "${POSTGRES_USER}"
      DATABASE_PASSWORD: "${POSTGRES_PASSWORD}"
      DATABASE_DBNAME: "${POSTGRES_DB}"
      DATABASE_SSLMODE: "disable"
      DATABASE_MAX_OPEN_CONNS: "10"
      DATABASE_MAX_IDLE_CONNS: "2"
      DATABASE_CONN_MAX_LIFETIME_MINUTES: "30"
      DATABASE_CONN_MAX_IDLE_TIME_MINUTES: "5"

      REDIS_HOST: "sub2api-redis"
      REDIS_PORT: "6379"
      REDIS_PASSWORD: "${REDIS_PASSWORD}"
      REDIS_DB: "0"
      REDIS_POOL_SIZE: "64"
      REDIS_MIN_IDLE_CONNS: "2"
      REDIS_ENABLE_TLS: "false"

      ADMIN_EMAIL: "${ADMIN_EMAIL}"
      ADMIN_PASSWORD: "${ADMIN_PASSWORD}"

      JWT_SECRET: "${JWT_SECRET}"
      JWT_EXPIRE_HOUR: "24"
      TOTP_ENCRYPTION_KEY: "${TOTP_ENCRYPTION_KEY}"

      TZ: "${TZ}"

      SECURITY_URL_ALLOWLIST_ENABLED: "false"
      SECURITY_URL_ALLOWLIST_ALLOW_INSECURE_HTTP: "true"
      SECURITY_URL_ALLOWLIST_ALLOW_PRIVATE_HOSTS: "true"
      SECURITY_URL_ALLOWLIST_UPSTREAM_HOSTS: ""

      UPDATE_PROXY_URL: "${UPDATE_PROXY_URL:-}"
    healthcheck:
      test: ["CMD", "wget", "-q", "-T", "5", "-O", "/dev/null", "http://127.0.0.1:8080/health"]
      interval: 20s
      timeout: 5s
      retries: 10
      start_period: 30s
    networks:
      - sub2api_net

  cloudflared:
    image: cloudflare/cloudflared:latest
    container_name: cloudflared
    restart: unless-stopped
    command: tunnel --no-autoupdate run --token ${CLOUDFLARED_TOKEN}
    depends_on:
      sub2api:
        condition: service_healthy
    networks:
      - sub2api_net

networks:
  sub2api_net:
    driver: bridge

cat > .env <<'EOF'
TZ=Asia/Shanghai

POSTGRES_DB=sub2api
POSTGRES_USER=sub2api
POSTGRES_PASSWORD=change-me-db-password
REDIS_PASSWORD=change-me-redis-password

ADMIN_EMAIL=admin@example.com
ADMIN_PASSWORD=change-me-admin-password

JWT_SECRET=change-me-jwt-secret
TOTP_ENCRYPTION_KEY=change-me-totp-encryption-key

CLOUDFLARED_TOKEN=change-me-cloudflare-tunnel-token

# 可选：如果不需要代理，保持为空。
UPDATE_PROXY_URL=
EOF

# 每执行一次生成一个随机值，分别替换不同的 change-me-*。
# 使用 hex 可以避免 .env 里出现需要转义的特殊字符。
openssl rand -hex 32

docker compose pull
docker compose up -d
docker compose ps

docker exec sub2api wget -qO- http://127.0.0.1:8080/

docker exec sub2api wget -qO- http://127.0.0.1:8080/health

curl -I https://api.example.com/

docker compose pull sub2api
docker compose up -d --no-deps --force-recreate sub2api
docker compose ps

docker compose pull
docker compose up -d
docker compose ps

docker logs --tail 100 sub2api

docker logs --tail 100 cloudflared

docker run --rm --network sub2api-stack_sub2api_net curlimages/curl:8.12.1 -fsS http://sub2api:8080/health

Service Type: HTTP
URL / Service: sub2api:8080