update-server/docker-compose.yml

services:
  minio:
    image: minio/minio:RELEASE.2025-04-22T22-12-26Z
    command: server /data --console-address ":9001"
    restart: unless-stopped
    environment:
      MINIO_ROOT_USER: ${MINIO_ACCESS_KEY:?MINIO_ACCESS_KEY is required}
      MINIO_ROOT_PASSWORD: ${MINIO_SECRET_KEY:?MINIO_SECRET_KEY is required}
    ports:
      - "${MINIO_API_PORT:-9000}:9000"
      - "${MINIO_CONSOLE_PORT:-9001}:9001"
    volumes:
      - ./minio_data:/data
    healthcheck:
      test: ["CMD", "curl", "-f", "http://127.0.0.1:9000/minio/health/live"]
      interval: 10s
      timeout: 5s
      retries: 10

  minio-init:
    image: minio/mc:RELEASE.2025-04-16T18-13-26Z
    depends_on:
      minio:
        condition: service_healthy
    restart: "no"
    entrypoint: ["/bin/sh", "-c"]
    command:
      - >-
        mc alias set update-store http://minio:9000 "$${MINIO_ROOT_USER}" "$${MINIO_ROOT_PASSWORD}" &&
        mc mb --ignore-existing "update-store/$${MINIO_BUCKET}"
    environment:
      MINIO_ROOT_USER: ${MINIO_ACCESS_KEY:?MINIO_ACCESS_KEY is required}
      MINIO_ROOT_PASSWORD: ${MINIO_SECRET_KEY:?MINIO_SECRET_KEY is required}
      MINIO_BUCKET: ${MINIO_BUCKET:?MINIO_BUCKET is required}

  api:
    # 开发/源码部署使用 build，从当前源码构建镜像；正式离线交付通常使用 docker-compose.image.yml 生成的包。
    build:
      context: .
      dockerfile: Dockerfile
    restart: unless-stopped
    user: "${APP_UID:-1000}:${APP_GID:-1000}"
    env_file:
      - .env
    environment:
      SERVER_HOST: 0.0.0.0
      SERVER_PORT: 8000
      ENV_FILE_PATH: /app/.env
      DB_FILE: /data/mini.db
      SQL_FILE: /app/tables.sql
      LOCAL_UPLOAD_ROOT: /data/uploads
      UPLOAD_SPOOL_DIR: /data/upload_spool
      MINIO_DATA_DIR: /minio_data
      CRASH_STORAGE_ROOT: /data/crash_storage
      MANIFEST_PRIVATE_KEY_PATH: /run/secrets/update-keys/manifest_private_key.pem
      MINIO_ENDPOINT: minio:9000
      MINIO_PUBLIC_ENDPOINT: ${MINIO_PUBLIC_ENDPOINT:?MINIO_PUBLIC_ENDPOINT is required}
      MINIO_AUTO_START: "false"
      MINIO_SECURE: "false"
    ports:
      - "${SERVER_PORT:-8000}:8000"
    volumes:
      # 数据卷和密钥挂载在容器外，重建镜像或升级容器时不会丢失历史版本和授权数据。
      - ./.env:/app/.env
      - ./runtime:/data
      - ./minio_data:/minio_data:ro
      - ./keys:/run/secrets/update-keys:ro
    depends_on:
      minio:
        condition: service_healthy
      minio-init:
        condition: service_completed_successfully
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8000/health', timeout=2)"]
      interval: 15s
      timeout: 3s
      start_period: 10s
      retries: 3