iloom/docker-compose.yml
Chever John 24c449ecae
security: remove hardcoded credentials and add WebSocket auth/CORS
- Clear default passwords in all service configs, require env vars
- Add JWT auth + role middleware to WebSocket endpoints
- Add origin whitelist to WebSocket upgrader (CORS protection)
- Fix goroutine leak in WS proxy (double errCh read)
- Update docker-compose to require secrets via ${VAR:?...} syntax
- Mark deprecated k8s configmap passwords as REPLACE_AT_DEPLOY_TIME

Co-Authored-By: Claude <noreply@anthropic.com>
2026-06-17 23:16:17 +08:00

151 lines
4.6 KiB
YAML
Raw Blame History

This file contains ambiguous Unicode characters

This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

# 使用方式:
# 独立模式开发docker compose up
# - 启动本地 MySQL自动初始化 muyu + iloom 表
# - gRPC 服务需要另外启动 muyu-apiservercd ../muyu-apiserver/deploy && docker compose up
#
# 集成模式(与 muyu-apiserver 联合):
# 1. cd ../muyu-apiserver/deploy && docker compose up
# 2. 设置环境变量指向 muyu 的服务:
# export DB_DSN="root:yourpassword@tcp(muyu-mysql:3306)/muyu_wms?parseTime=true&charset=utf8mb4"
# export MUYU_SYSTEM_RPC_ADDR=muyu-system-rpc:9001
# export MUYU_INVENTORY_RPC_ADDR=muyu-inventory-rpc:9002
# 3. docker compose --profile integrated up
services:
mysql:
image: mysql:8.0
environment:
MYSQL_ROOT_PASSWORD: ${MYSQL_ROOT_PASSWORD:?Set MYSQL_ROOT_PASSWORD in .env}
MYSQL_DATABASE: ${MYSQL_DATABASE:-muyu_wms}
TZ: Asia/Shanghai
ports:
- "${MYSQL_PORT:-3306}:3306"
volumes:
- mysql_data:/var/lib/mysql
- ../muyu-apiserver/deploy/mysql/init.sql:/docker-entrypoint-initdb.d/01-muyu.sql
- ./scripts/init-iloom.sql:/docker-entrypoint-initdb.d/02-iloom.sql
command: --character-set-server=utf8mb4 --collation-server=utf8mb4_unicode_ci
healthcheck:
test: ["CMD", "mysqladmin", "ping", "-h", "localhost", "-uroot", "-p${MYSQL_ROOT_PASSWORD}"]
interval: 5s
timeout: 5s
retries: 10
gateway:
build:
context: .
dockerfile: gateway/Dockerfile
ports:
- "${GATEWAY_PORT:-8080}:8080"
environment:
- PORT=8080
- JWT_SECRET=${JWT_SECRET:?Set JWT_SECRET in .env}
- AUTH_SERVICE_URL=http://auth-service:8081
- PURCHASER_SERVICE_URL=http://purchaser-service:8082
- TEXTILE_SERVICE_URL=http://textile-service:8083
- WASHING_SERVICE_URL=http://washing-service:8084
- ALLOW_ORIGINS=${ALLOW_ORIGINS:-http://localhost:3015}
depends_on:
auth-service:
condition: service_healthy
purchaser-service:
condition: service_healthy
textile-service:
condition: service_healthy
washing-service:
condition: service_healthy
auth-service:
build:
context: .
dockerfile: auth-service/Dockerfile
ports:
- "${AUTH_SERVICE_PORT:-8081}:8081"
environment:
- PORT=8081
- DB_DSN=${DB_DSN:?Set DB_DSN in .env}
- JWT_SECRET=${JWT_SECRET:?Set JWT_SECRET in .env}
- JWT_REFRESH_SECRET=${JWT_REFRESH_SECRET:?Set JWT_REFRESH_SECRET in .env}
- MUYU_SYSTEM_RPC_ADDR=${MUYU_SYSTEM_RPC_ADDR:-system-rpc:9001}
depends_on:
mysql:
condition: service_healthy
healthcheck:
test: ["CMD", "wget", "-qO-", "http://localhost:8081/health"]
interval: 10s
timeout: 3s
retries: 3
purchaser-service:
build:
context: .
dockerfile: purchaser-service/Dockerfile
ports:
- "${PURCHASER_SERVICE_PORT:-8082}:8082"
environment:
- PORT=8082
- DB_DSN=${DB_DSN:?Set DB_DSN in .env}
- INTERNAL_SERVICE_KEY=${INTERNAL_SERVICE_KEY:?Set INTERNAL_SERVICE_KEY in .env}
- MUYU_INVENTORY_RPC_ADDR=${MUYU_INVENTORY_RPC_ADDR:-inventory-rpc:9002}
depends_on:
mysql:
condition: service_healthy
healthcheck:
test: ["CMD", "wget", "-qO-", "http://localhost:8082/health"]
interval: 10s
timeout: 3s
retries: 3
textile-service:
build:
context: .
dockerfile: textile-service/Dockerfile
ports:
- "${TEXTILE_SERVICE_PORT:-8083}:8083"
environment:
- PORT=8083
- DB_DSN=${DB_DSN:?Set DB_DSN in .env}
- INTERNAL_SERVICE_KEY=${INTERNAL_SERVICE_KEY:?Set INTERNAL_SERVICE_KEY in .env}
- PURCHASER_SERVICE_URL=http://purchaser-service:8082
depends_on:
mysql:
condition: service_healthy
healthcheck:
test: ["CMD", "wget", "-qO-", "http://localhost:8083/health"]
interval: 10s
timeout: 3s
retries: 3
washing-service:
build:
context: .
dockerfile: washing-service/Dockerfile
ports:
- "${WASHING_SERVICE_PORT:-8084}:8084"
environment:
- PORT=8084
- DB_DSN=${DB_DSN:?Set DB_DSN in .env}
- INTERNAL_SERVICE_KEY=${INTERNAL_SERVICE_KEY:?Set INTERNAL_SERVICE_KEY in .env}
- PURCHASER_SERVICE_URL=http://purchaser-service:8082
depends_on:
mysql:
condition: service_healthy
healthcheck:
test: ["CMD", "wget", "-qO-", "http://localhost:8084/health"]
interval: 10s
timeout: 3s
retries: 3
frontend:
build:
context: .
dockerfile: iloom-flatten/Dockerfile
ports:
- "${FRONTEND_PORT:-3015}:3015"
depends_on:
gateway:
condition: service_started
volumes:
mysql_data: