feat: 增加生产环境容器编排

ai_knowledge_base_v2/.env.example

@@ -10,6 +10,14 @@ FEISHU_SEARCH_URL=
 # 生产环境必须替换为安全账号密码，不能使用 admin123456
 # ============================================
 APP_ENV=production
+MYSQL_ROOT_PASSWORD=replace-with-strong-root-password
+MYSQL_PASSWORD=replace-with-strong-database-password
+REDIS_PASSWORD=replace-with-strong-redis-password
+DATABASE_URL=mysql+pymysql://ai_kb:URL编码后的数据库密码@mysql:3306/ai_knowledge_base_v2?charset=utf8mb4
+REDIS_URL=redis://:URL编码后的Redis密码@redis:6379/0
+JWT_SECRET_KEY=replace-with-at-least-32-random-characters
+# 使用命令生成：python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"
+CONFIG_ENCRYPTION_KEY=replace-with-generated-fernet-key
 BOOTSTRAP_ADMIN_USERNAME=admin
 BOOTSTRAP_ADMIN_PASSWORD=replace-with-strong-password
 BOOTSTRAP_ADMIN_NAME=系统管理员

ai_knowledge_base_v2/apps/admin-web/Dockerfile.prod

@@ -0,0 +1,12 @@
+FROM node:22-alpine AS builder
+
+WORKDIR /app
+COPY package*.json ./
+RUN npm ci
+COPY . .
+RUN npm run build
+
+FROM nginx:1.27-alpine
+COPY nginx.prod.conf /etc/nginx/conf.d/default.conf
+COPY --from=builder /app/dist /usr/share/nginx/html
+EXPOSE 80

ai_knowledge_base_v2/apps/admin-web/nginx.prod.conf

@@ -0,0 +1,15 @@
+server {
+    listen 80;
+    server_name _;
+    root /usr/share/nginx/html;
+
+    location / {
+        try_files $uri $uri/ /index.html;
+    }
+
+    location ~* \.(?:js|css|png|jpg|jpeg|gif|svg|ico|woff2?)$ {
+        expires 7d;
+        add_header Cache-Control "public, immutable";
+        try_files $uri =404;
+    }
+}

ai_knowledge_base_v2/apps/backend/.env.example

@@ -12,6 +12,7 @@ DB_POOL_RECYCLE=1800
 AUTO_CREATE_TABLES=false
 
 JWT_SECRET_KEY=change-me-in-production
+CONFIG_ENCRYPTION_KEY=
 JWT_ALGORITHM=HS256
 ACCESS_TOKEN_EXPIRE_MINUTES=43200
 

ai_knowledge_base_v2/apps/user-client/Dockerfile.prod

@@ -0,0 +1,12 @@
+FROM node:22-alpine AS builder
+
+WORKDIR /app
+COPY package*.json ./
+RUN npm ci
+COPY . .
+RUN npm run build
+
+FROM nginx:1.27-alpine
+COPY nginx.prod.conf /etc/nginx/conf.d/default.conf
+COPY --from=builder /app/dist /usr/share/nginx/html
+EXPOSE 80

ai_knowledge_base_v2/apps/user-client/nginx.prod.conf

@@ -0,0 +1,15 @@
+server {
+    listen 80;
+    server_name _;
+    root /usr/share/nginx/html;
+
+    location / {
+        try_files $uri $uri/ /index.html;
+    }
+
+    location ~* \.(?:js|css|png|jpg|jpeg|gif|svg|ico|woff2?)$ {
+        expires 7d;
+        add_header Cache-Control "public, immutable";
+        try_files $uri =404;
+    }
+}

ai_knowledge_base_v2/deploy/gateway.prod.conf

@@ -0,0 +1,45 @@
+map $http_upgrade $connection_upgrade {
+    default upgrade;
+    '' close;
+}
+
+server {
+    listen 80;
+    server_name _;
+    client_max_body_size 20m;
+
+    location = /login {
+        return 302 /login/;
+    }
+
+    location ^~ /api/ {
+        proxy_pass http://backend:8100;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection $connection_upgrade;
+        proxy_buffering off;
+        proxy_read_timeout 3600s;
+    }
+
+    location ^~ /login/ {
+        proxy_pass http://admin-web/;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+
+    location / {
+        proxy_pass http://user-client;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}

ai_knowledge_base_v2/docker-compose.prod.yml

@@ -0,0 +1,88 @@
+services:
+  mysql:
+    image: mysql:8.4
+    restart: unless-stopped
+    environment:
+      MYSQL_ROOT_PASSWORD: ${MYSQL_ROOT_PASSWORD:?必须配置 MYSQL_ROOT_PASSWORD}
+      MYSQL_DATABASE: ai_knowledge_base_v2
+      MYSQL_USER: ai_kb
+      MYSQL_PASSWORD: ${MYSQL_PASSWORD:?必须配置 MYSQL_PASSWORD}
+      TZ: Asia/Shanghai
+    command: ["--character-set-server=utf8mb4", "--collation-server=utf8mb4_unicode_ci"]
+    volumes:
+      - ai_kb_v2_mysql_data:/var/lib/mysql
+    healthcheck:
+      test: ["CMD-SHELL", "mysqladmin ping -h 127.0.0.1 -uroot -p$$MYSQL_ROOT_PASSWORD --silent"]
+      interval: 10s
+      timeout: 5s
+      retries: 20
+
+  redis:
+    image: redis:7-alpine
+    restart: unless-stopped
+    environment:
+      REDIS_PASSWORD: ${REDIS_PASSWORD:?必须配置 REDIS_PASSWORD}
+    command: ["redis-server", "--appendonly", "yes", "--requirepass", "${REDIS_PASSWORD:?必须配置 REDIS_PASSWORD}"]
+    volumes:
+      - ai_kb_v2_redis_data:/data
+    healthcheck:
+      test: ["CMD-SHELL", "redis-cli -a $$REDIS_PASSWORD ping | grep PONG"]
+      interval: 10s
+      timeout: 5s
+      retries: 20
+
+  backend:
+    build:
+      context: ./apps/backend
+    restart: unless-stopped
+    environment:
+      APP_ENV: production
+      DEBUG: "false"
+      DATABASE_URL: ${DATABASE_URL:?必须配置经过 URL 编码的 DATABASE_URL}
+      REDIS_URL: ${REDIS_URL:?必须配置经过 URL 编码的 REDIS_URL}
+      BACKEND_WORKERS: ${BACKEND_WORKERS:-4}
+      DB_POOL_SIZE: ${DB_POOL_SIZE:-20}
+      DB_MAX_OVERFLOW: ${DB_MAX_OVERFLOW:-20}
+      JWT_SECRET_KEY: ${JWT_SECRET_KEY:?必须配置 JWT_SECRET_KEY}
+      CONFIG_ENCRYPTION_KEY: ${CONFIG_ENCRYPTION_KEY:?必须配置 CONFIG_ENCRYPTION_KEY}
+      MOCK_SMS_ENABLED: "false"
+      MOCK_RAG_ENABLED: "false"
+      MOCK_MODEL_ENABLED: "false"
+      FEISHU_MOCK_ENABLED: "false"
+      BOOTSTRAP_ADMIN_USERNAME: ${BOOTSTRAP_ADMIN_USERNAME:?必须配置 BOOTSTRAP_ADMIN_USERNAME}
+      BOOTSTRAP_ADMIN_PASSWORD: ${BOOTSTRAP_ADMIN_PASSWORD:?必须配置 BOOTSTRAP_ADMIN_PASSWORD}
+      BOOTSTRAP_ADMIN_NAME: ${BOOTSTRAP_ADMIN_NAME:-系统管理员}
+      AUTO_CREATE_TABLES: "false"
+    depends_on:
+      mysql:
+        condition: service_healthy
+      redis:
+        condition: service_healthy
+
+  user-client:
+    build:
+      context: ./apps/user-client
+      dockerfile: Dockerfile.prod
+    restart: unless-stopped
+
+  admin-web:
+    build:
+      context: ./apps/admin-web
+      dockerfile: Dockerfile.prod
+    restart: unless-stopped
+
+  gateway:
+    image: nginx:1.27-alpine
+    restart: unless-stopped
+    ports:
+      - "${GATEWAY_PORT:-8080}:80"
+    volumes:
+      - ./deploy/gateway.prod.conf:/etc/nginx/conf.d/default.conf:ro
+    depends_on:
+      - backend
+      - user-client
+      - admin-web
+
+volumes:
+  ai_kb_v2_mysql_data:
+  ai_kb_v2_redis_data: