From d6692b8776978686d000111fdc443804daee6f58 Mon Sep 17 00:00:00 2001 From: wangjia <809946525@qq.com> Date: Sun, 31 May 2026 00:31:38 +0800 Subject: [PATCH] =?UTF-8?q?=E6=B7=BB=E5=8A=A0=20Docker=20=E6=9C=8D?= =?UTF-8?q?=E5=8A=A1=E9=85=8D=E7=BD=AE=E6=96=87=E4=BB=B6?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 新增 forgejo、mihomo 透明代理的 docker-compose 和配置文件， 敏感凭证（runner token、VLESS UUID）通过 .env 管理不入库。 同步更新 CLAUDE.md 目录结构说明，新增 README.md。 Co-Authored-By: Claude Sonnet 4.6 --- .gitignore | 11 +++++ CLAUDE.md | 41 ++++++++---------- README.md | 47 +++++++++++++++++++++ docker/forgejo/.env.example | 1 + docker/forgejo/docker-compose.yml | 35 ++++++++++++++++ docker/forgejo/runner/config.yaml | 23 +++++++++++ docker/proxy/dnsmasq/dnsmasq.conf | 12 ++++++ docker/proxy/docker-compose.yml | 11 +++++ docker/proxy/mihomo/.env.example | 1 + docker/proxy/mihomo/config.yaml | 69 +++++++++++++++++++++++++++++++ 10 files changed, 228 insertions(+), 23 deletions(-) create mode 100644 .gitignore create mode 100644 README.md create mode 100644 docker/forgejo/.env.example create mode 100644 docker/forgejo/docker-compose.yml create mode 100644 docker/forgejo/runner/config.yaml create mode 100644 docker/proxy/dnsmasq/dnsmasq.conf create mode 100644 docker/proxy/docker-compose.yml create mode 100644 docker/proxy/mihomo/.env.example create mode 100644 docker/proxy/mihomo/config.yaml diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..67ec6ee --- /dev/null +++ b/.gitignore @@ -0,0 +1,11 @@ +# Docker 运行时数据 +*.db +*.metadb +*.dat +*.tar + +# 敏感凭证 +docker/**/.env + +# 系统文件 +.DS_Store diff --git a/CLAUDE.md b/CLAUDE.md index 167d3f9..0f1f4cc 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -21,22 +21,26 @@ ssh nas # ~/.ssh/config 已配置，HostName 192.168.3.200，User wangj | 存储 | /volume1，7TB 总量 | | IP | 192.168.3.200（静态，手动配置） | -## 目录结构 +## 仓库目录结构 ``` -/volume1/docker/ +docker/ ├── forgejo/ -│ ├── docker-compose.yml # Forgejo + act-runner -│ ├── data/ # Forgejo 数据（SQLite DB、仓库、app.ini） -│ └── runner/ # act-runner 配置 -├── proxy/ -│ ├── docker-compose.yml # mihomo 容器 -│ ├── mihomo/config.yaml # 透明代理配置 -│ └── dnsmasq/dnsmasq.conf # dnsmasq 配置（预备，暂未启用） -└── backups/ - └── jiu-db/ # jiu 项目 DB 每日备份（.sql.gz） +│ ├── docker-compose.yml # Forgejo + act-runner（token 通过 .env 注入） +│ ├── .env.example # 复制为 .env 填入真实 token +│ └── runner/ +│ └── config.yaml # act-runner 配置 +└── proxy/ + ├── docker-compose.yml # mihomo 容器 + ├── mihomo/ + │ ├── config.yaml # 透明代理规则（uuid 用 占位） + │ └── .env.example # 复制为 .env 填入真实 UUID + └── dnsmasq/ + └── dnsmasq.conf # 预备 DHCP 配置（暂未启用） ``` +NAS 上实际路径：`/volume1/docker/<服务名>/`，与仓库 `docker/` 目录一一对应。 + ## Docker 服务 ### 权限说明 @@ -51,24 +55,18 @@ ssh nas # ~/.ssh/config 已配置，HostName 192.168.3.200，User wangj - **局域网直连**：`http://192.168.3.200:3000/` - **SSH Clone**：`ssh://git@git.51yanmei.com:2222/` - **配置方式**：优先通过 docker-compose.yml 的环境变量（`GITEA__section__key`）管理，避免直接改 app.ini -- **app.ini 路径**：`/volume1/docker/forgejo/data/gitea/conf/app.ini`（属于 uid=1000，wangjia 只读） +- **app.ini 路径**：`/volume1/docker/forgejo/data/gitea/conf/app.ini`（属于 uid=1000，wangjia 只读，需 root 修改） - **数据库**：SQLite，`/volume1/docker/forgejo/data/gitea/gitea.db` - **act-runner**：CI/CD runner（`forgejo-act-runner`），挂载 `/var/run/docker.sock` 可运行 Docker 任务 ```bash # 查看 Forgejo 日志 ssh nas "tail -f /volume1/docker/forgejo/data/gitea/log/gitea.log" - -# 修改 Forgejo 配置（通过环境变量，改完需在 Container Manager 重启容器） -ssh nas "vi /volume1/docker/forgejo/docker-compose.yml" - -# 如需直接改 app.ini，必须用 root（DSM 终端） -sudo sed -i 's/旧值/新值/' /volume1/docker/forgejo/data/gitea/conf/app.ini ``` ### mihomo（透明代理） -局域网透明代理网关，运行在 NAS 上，Windows 设备（192.168.3.88）以 NAS 为默认网关。 +局域网透明代理网关，Windows 设备（192.168.3.88）以 NAS 为默认网关。 **架构：** ``` @@ -101,13 +99,10 @@ ssh nas "curl -s --max-time 10 --proxy 'socks5h://127.0.0.1:7890' https://ifconf # 查看实时日志 ssh nas "curl -s http://127.0.0.1:9090/logs -N --max-time 10" - -# 查看活跃连接 -ssh nas "curl -s http://127.0.0.1:9090/connections" ``` **dnsmasq（预备，未启用）：** -配置文件已就绪（`/volume1/docker/proxy/dnsmasq/dnsmasq.conf`），待未来启用 DHCP 自动分发时使用。启用前需将 mihomo DNS 端口从 53 改为 1053，并将 dnsmasq 加入 docker-compose.yml。 +配置文件已就绪（`docker/proxy/dnsmasq/dnsmasq.conf`），待未来启用 DHCP 自动分发时使用。启用前需将 mihomo DNS 端口从 53 改为 1053，并将 dnsmasq 加入 docker-compose.yml。 ### jiu-db 自动备份 diff --git a/README.md b/README.md new file mode 100644 index 0000000..ac6f271 --- /dev/null +++ b/README.md @@ -0,0 +1,47 @@ +# NAS 运维配置 + +Synology DS925+（192.168.3.200）的 Docker 服务配置管理。 + +## 服务 + +| 服务 | 说明 | 地址 | +|------|------|------| +| Forgejo | 自托管 Git 服务 + CI/CD runner | http://git.51yanmei.com | +| mihomo | 透明代理网关（VLESS + Reality） | 局域网网关 192.168.3.200 | +| dnsmasq | DHCP/DNS（预备，暂未启用） | — | + +## 目录 + +``` +docker/ +├── forgejo/ # Forgejo + act-runner +└── proxy/ # mihomo 透明代理 + dnsmasq +``` + +## 部署 + +### 前置条件 + +```bash +cp docker/forgejo/.env.example docker/forgejo/.env +# 填入 GITEA_RUNNER_REGISTRATION_TOKEN + +cp docker/proxy/mihomo/.env.example docker/proxy/mihomo/.env +# 填入 VLESS_UUID（然后手动更新 config.yaml 中的 ） +``` + +### 启动服务 + +```bash +# Forgejo +cd docker/forgejo && docker compose up -d + +# 透明代理 +cd docker/proxy && docker compose up -d +``` + +## 连接 + +```bash +ssh nas # HostName 192.168.3.200，需配置 ~/.ssh/config +``` diff --git a/docker/forgejo/.env.example b/docker/forgejo/.env.example new file mode 100644 index 0000000..2617920 --- /dev/null +++ b/docker/forgejo/.env.example @@ -0,0 +1 @@ +GITEA_RUNNER_REGISTRATION_TOKEN= diff --git a/docker/forgejo/docker-compose.yml b/docker/forgejo/docker-compose.yml new file mode 100644 index 0000000..5575f5f --- /dev/null +++ b/docker/forgejo/docker-compose.yml @@ -0,0 +1,35 @@ +services: + forgejo: + image: gitea/gitea:latest + container_name: forgejo + restart: always + environment: + USER_UID: 1000 + USER_GID: 1000 + GITEA__actions__ENABLED: "true" + GITEA__actions__DEFAULT_ACTIONS_URL: https://gitea.com + GITEA__server__ROOT_URL: http://git.51yanmei.com/ + GITEA__server__SSH_DOMAIN: git.51yanmei.com + GITEA__server__SSH_PORT: 2222 + ports: + - "3000:3000" + - "2222:22" + volumes: + - /volume1/docker/forgejo/data:/data + + act-runner: + image: gitea/act_runner:latest + container_name: forgejo-act-runner + restart: always + network_mode: host + depends_on: + - forgejo + environment: + CONFIG_FILE: /data/config.yaml + GITEA_INSTANCE_URL: http://git.51yanmei.com/ + GITEA_RUNNER_REGISTRATION_TOKEN: ${GITEA_RUNNER_REGISTRATION_TOKEN} + GITEA_RUNNER_NAME: nas-runner + volumes: + - /volume1/docker/forgejo/runner:/data + - /var/run/docker.sock:/var/run/docker.sock + - /volume1/docker/backups:/volume1/docker/backups diff --git a/docker/forgejo/runner/config.yaml b/docker/forgejo/runner/config.yaml new file mode 100644 index 0000000..f739778 --- /dev/null +++ b/docker/forgejo/runner/config.yaml @@ -0,0 +1,23 @@ +log: + level: info + +runner: + file: .runner + capacity: 1 + timeout: 3h + labels: + - ubuntu-latest:docker://catthehacker/ubuntu:act-latest + +cache: + enabled: true + dir: /data/cache + +container: + network: bridge + privileged: false + options: >- + -v /volume1/docker/backups:/volume1/docker/backups + -v /volume1/docker/tools:/volume1/docker/tools + valid_volumes: + - /volume1/docker/backups + - /volume1/docker/tools diff --git a/docker/proxy/dnsmasq/dnsmasq.conf b/docker/proxy/dnsmasq/dnsmasq.conf new file mode 100644 index 0000000..dc5296a --- /dev/null +++ b/docker/proxy/dnsmasq/dnsmasq.conf @@ -0,0 +1,12 @@ +# DHCP 服务 +dhcp-range=192.168.3.10,192.168.3.230,12h +dhcp-option=3,192.168.3.200 +dhcp-option=6,192.168.3.200 + +# DNS 上游指向 Mihomo（端口 1053） +server=127.0.0.1#1053 + +# 本地解析 +address=/nas.local/192.168.3.200 + +no-hosts diff --git a/docker/proxy/docker-compose.yml b/docker/proxy/docker-compose.yml new file mode 100644 index 0000000..efde8f0 --- /dev/null +++ b/docker/proxy/docker-compose.yml @@ -0,0 +1,11 @@ +services: + mihomo: + image: metacubex/mihomo:latest + container_name: mihomo + restart: always + network_mode: host + privileged: true + volumes: + - /volume1/docker/proxy/mihomo:/root/.config/mihomo + environment: + - TZ=Asia/Shanghai diff --git a/docker/proxy/mihomo/.env.example b/docker/proxy/mihomo/.env.example new file mode 100644 index 0000000..57588c7 --- /dev/null +++ b/docker/proxy/mihomo/.env.example @@ -0,0 +1 @@ +VLESS_UUID= diff --git a/docker/proxy/mihomo/config.yaml b/docker/proxy/mihomo/config.yaml new file mode 100644 index 0000000..8c2890c --- /dev/null +++ b/docker/proxy/mihomo/config.yaml @@ -0,0 +1,69 @@ +mixed-port: 7890 +allow-lan: true +bind-address: '*' +mode: rule +log-level: info +ipv6: false + +external-controller: 0.0.0.0:9090 + +tun: + enable: true + stack: gvisor + mtu: 1500 + auto-route: true + auto-detect-interface: true + route-exclude-address: + - 18.136.60.128/32 + dns-hijack: + - any:53 + +dns: + enable: true + listen: 0.0.0.0:53 + enhanced-mode: fake-ip + fake-ip-persist: true + fake-ip-range: 198.18.0.0/15 + fake-ip-filter: + - '*.lan' + - '*.local' + - 'time.*.com' + - 'ntp.*.com' + - '+.pool.ntp.org' + nameserver: + - 114.114.114.114 + - 223.5.5.5 + fallback: + - 8.8.8.8 + - 1.1.1.1 + fallback-filter: + geoip: true + geoip-code: CN + +proxies: + - name: "ec2-sg" + type: vless + server: 18.136.60.128 + port: 443 + uuid: + network: tcp + tls: true + udp: true + reality-opts: + public-key: fHHr9qWw2JuqNxpv3XTcZTi5k73HWfjipa4vnXFu9W8 + short-id: 6eb28f1a766a + servername: www.cloudflare.com + client-fingerprint: chrome + +proxy-groups: + - name: "Proxy" + type: select + proxies: + - ec2-sg + - DIRECT + +rules: + - GEOIP,private,DIRECT + - GEOSITE,cn,DIRECT + - GEOIP,CN,DIRECT + - MATCH,Proxy