thread-master/deploy

Haixun Docker Deploy

Production uses two compose stacks:

• infra/: Mongo + Redis + persistent volumes.
• deploy/: nginx static frontend, API gateway, independent workers, and one-shot init.

Build Images

Build and push images outside the runtime host, then deploy by changing tags in deploy/.env.prod.

docker build -f backend/Dockerfile -t ghcr.io/kupi-cat/haixun-backend:v0.0.1 .
docker build -f backend/web/Dockerfile -t ghcr.io/kupi-cat/haixun-web:v0.0.1 .
docker build -f backend/worker/Dockerfile -t ghcr.io/kupi-cat/haixun-node-worker:v0.0.1 .

docker push ghcr.io/kupi-cat/haixun-backend:v0.0.1
docker push ghcr.io/kupi-cat/haixun-web:v0.0.1
docker push ghcr.io/kupi-cat/haixun-node-worker:v0.0.1

Env files (single source of truth)

File	用途	誰讀
deploy/.env.dev	本機 dev 全部 env	make dev-all、make dev-infra、make run、infra/start-*.sh
deploy/.env.prod	正式環境全部 env	make prod-* 的 infra / app compose

兩份都從對應 .example 複製而來，實值不進 repo。

cp deploy/.env.dev.example deploy/.env.dev      # dev
cp deploy/.env.prod.example deploy/.env.prod    # prod

infra compose 的 Mongo / Redis 容器密碼（MONGO_ROOT_PASSWORD / REDIS_PASSWORD）必須與 app 用的 HAIXUN_MONGO_URI（URL-encoded）/ HAIXUN_REDIS_PASSWORD 一致，不能各自獨立。

Start Infra + App（one-shot）

make prod-install
# = 啟動 infra compose（讀 deploy/.env.prod）
# + pull app image + up -d
# + 跑 init（索引 / permission / role / job template / 第一個 admin）

Init Database（單獨跑）

idempotent，部署新版本若有 schema/template 變更可重跑：

make prod-rebuild   # 或單獨 init：
docker compose --env-file deploy/.env.prod -f deploy/docker-compose.yml --profile init run --rm init

Start / Upgrade

make prod-install   # 首次
make prod-rebuild   # 改 tag 後升版

Upgrade by changing BACKEND_TAG, WEB_TAG, and NODE_WORKER_TAG in deploy/.env.prod, then run make prod-rebuild.

Rollback

Change the tags back to the previous version in deploy/.env.prod and run make prod-rebuild.

Stop

make prod-stop       # 關 app stack，保留 infra 與資料
make prod-stop-all   # 關 app + infra，保留資料 volume

Public Entry

Only web publishes port 80. nginx serves static files and proxies /api/ to gateway:8890 with SSE buffering disabled.