wangjia
73e026a4df
deploy-pangolin / deploy (push) Has been cancelled
- edge 改为自定义镜像:官方 nginx + certbot + dns-cloudflare 插件 - pangolin-entrypoint.sh:后台每12h certbot renew,续期后本容器内 nginx -s reload - 不再需要宿主 cron / docker socket / 独立 certbot 服务做日常续期 - /etc/letsencrypt 改 rw 挂载,挂入 cloudflare.ini - compose 去掉 build:(宿主 docker-compose 不支持 compose build),改脚本 docker build - deploy.sh/cutover.sh: docker build -t pangolin-edge:local 后再 up Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
64 lines
2.6 KiB
YAML
64 lines
2.6 KiB
YAML
# pangolin 数据/分发面(方案 C)。
|
|
# 与现网 marzban/jiu/billing/blog 并存:edge 反代到它们,其余容器不动。
|
|
# 镜像固定版本(EC2 实测:nginx 1.27 / sing-box 1.13.12 / xray 26.3.27)。
|
|
# project 名由命令行 `-p pangolin` 指定(兼容宿主 docker-compose 版本)。
|
|
|
|
services:
|
|
# 分发层:接管 80/443,移植现网全部路由(host 网络才能绑端口并回连 127.0.0.1 后端)。
|
|
# 自定义镜像 = 官方 nginx + certbot,容器自己续签自己用的证书(无需宿主 cron / docker socket)。
|
|
edge:
|
|
# 镜像由脚本用 `docker build -t pangolin-edge:local ./edge` 预先构建
|
|
# (宿主 docker-compose 版本不支持 compose build)。
|
|
image: pangolin-edge:local
|
|
container_name: pangolin-edge
|
|
restart: unless-stopped
|
|
network_mode: host
|
|
volumes:
|
|
- ./edge/nginx.conf:/etc/nginx/nginx.conf:ro
|
|
- ./edge/stream.conf:/etc/nginx/stream.conf:ro
|
|
- ./edge/conf.d:/etc/nginx/conf.d:ro
|
|
- /etc/letsencrypt:/etc/letsencrypt # rw:certbot 续期写入,nginx 读取
|
|
- ./secrets/cloudflare.ini:/etc/cloudflare.ini:ro # DNS-01 续期凭据
|
|
- /opt/jiu:/opt/jiu:ro # jiu 静态(images/web/marketing)
|
|
- /var/www/pay:/var/www/pay:ro # 收款页静态
|
|
healthcheck:
|
|
test: ["CMD", "nginx", "-t"]
|
|
interval: 1m
|
|
timeout: 10s
|
|
retries: 3
|
|
|
|
# Hysteria2 加速线(UDP 443)
|
|
singbox:
|
|
image: ghcr.io/sagernet/sing-box:v1.13.12
|
|
container_name: pangolin-singbox
|
|
restart: unless-stopped
|
|
network_mode: host
|
|
volumes:
|
|
- ./singbox/config.json:/etc/sing-box/config.json:ro
|
|
- ./secrets/hy2:/etc/sing-box/cert:ro
|
|
command: ["run", "-c", "/etc/sing-box/config.json"]
|
|
|
|
# 证书工具(DNS-01 / Cloudflare)—— 仅手动用于首次签发/重配:
|
|
# docker-compose -p pangolin run --rm certbot certonly --dns-cloudflare ...
|
|
# 日常【自动续期由 edge 容器自身完成】(见 edge/pangolin-entrypoint.sh),无需本服务。
|
|
certbot:
|
|
image: certbot/dns-cloudflare:latest
|
|
container_name: pangolin-certbot
|
|
profiles: ["certbot"]
|
|
volumes:
|
|
- /etc/letsencrypt:/etc/letsencrypt
|
|
- ./secrets/cloudflare.ini:/etc/cloudflare.ini:ro
|
|
entrypoint: ["certbot"]
|
|
|
|
# 新节点用的 REALITY —— 本台不启用(REALITY 仍由 Marzban 提供)
|
|
xray:
|
|
image: ghcr.io/xtls/xray-core:26.3.27
|
|
container_name: pangolin-xray
|
|
profiles: ["newnode"]
|
|
restart: unless-stopped
|
|
ports:
|
|
- "127.0.0.1:11443:11443"
|
|
volumes:
|
|
- ./xray/config.json:/etc/xray/config.json:ro
|
|
command: ["run", "-c", "/etc/xray/config.json"]
|