diff --git a/.gitignore b/.gitignore index e9a0913..9e35c58 100644 --- a/.gitignore +++ b/.gitignore @@ -62,3 +62,8 @@ deploy/0.2.1/.env # Windows 打包产物 (本地生成, 不入库) /artifacts/ + +# 生产部署密钥与数据卷 +/deploy/prod/.env +/deploy/prod/data/ + diff --git a/deploy/prod/.env.example b/deploy/prod/.env.example new file mode 100644 index 0000000..10fd62f --- /dev/null +++ b/deploy/prod/.env.example @@ -0,0 +1,9 @@ +# 鐢熶骇鐜鍙橀噺 (deploy/prod/.env, 鏉冮檺 600, 缁濅笉鍏ュ簱) +# POWERSYNC_JWT_KEY_B64 = base64url(POWERSYNC_JWT_SECRET 鐨 UTF-8 瀛楄妭) +# printf %s "$POWERSYNC_JWT_SECRET" | openssl base64 -A | tr '+/' '-_' | tr -d '=' +PG_PASSWORD=change-me +PS_STORAGE_PASSWORD=change-me +JWT_SECRET=change-me +POWERSYNC_JWT_SECRET=change-me +POWERSYNC_JWT_KEY_B64=change-me +PUBLIC_URL=https://iboard.honor3.com diff --git a/deploy/prod/README.md b/deploy/prod/README.md new file mode 100644 index 0000000..83fdbe7 --- /dev/null +++ b/deploy/prod/README.md @@ -0,0 +1,59 @@ +# iBoard 0.2.1 鐢熶骇閮ㄧ讲 (鍗曠鍙, 鏃犵嫭绔嬪悓姝ョ鍙) + +``` +pg (鍐呯綉) 鈫 app (3001 瀵瑰, /sync 鍙嶄唬) 鈫 powersync (鍐呯綉) +``` + +瀵瑰鍙湁 **3001** 涓涓鍙ｏ紝鍩熷悕 `https://iboard.honor3.com` 鐢 NPM 鍙嶄唬鍒拌繖閲岋紱 +鍚屾鏈嶅姟涓嶅啀鍗曠嫭鏆撮湶绔彛锛堝鎴风鎷垮埌鐨 `POWERSYNC_URL` 鏄煙鍚嶆湰韬紝璇锋眰缁 app 鐨 +`/sync`銆乣/socket` 鍙嶄唬杩涘叆鍐呯綉 powersync锛夈 + +## 棣栨閮ㄧ讲椤哄簭 (鍏抽敭: publication 瑕佸湪寤鸿〃涔嬪悗) + +```bash +# 0) 鐩綍: /app/iboard-prod (婧愮爜宸蹭笂浼), 闀滃儚 iboard:latest 宸叉瀯寤 +cd /app/iboard-prod/deploy/prod +cp .env.example .env && chmod 600 .env # 濉湡瀹炲瘑閽 +mkdir -p data/pg data/cache + +# 1) 鍏堝彧璧锋暟鎹簱 +docker compose --env-file .env up -d pg + +# 2) 璺戣縼绉诲缓琛 (涓娆℃) +docker run --rm --network iboard-prod_default \ + -e DATABASE_URL="postgresql://iboard:@pg:5432/iboard" \ + iboard:latest npx prisma migrate deploy + +# 3) 寤洪昏緫澶嶅埗 publication (琛ㄥ凡瀛樺湪) +docker compose --env-file .env exec -T pg \ + psql -U iboard -d iboard -f /dev/stdin < sql/publication.sql + +# 4) 璧峰簲鐢ㄤ笌鍚屾鏈嶅姟 +docker compose --env-file .env up -d app powersync + +# 5) 楠岃瘉 +curl -s http://127.0.0.1:3001/api/health +docker compose logs --tail 20 powersync # 搴旂湅鍒 replication 婵娲 +``` + +## 鏁版嵁杩佺Щ (浠庣幇缃 MySQL 蹇収) + +```bash +# 鍙婧愬簱; 鐩爣蹇呴』鏄┖搴 (鏈夋暟鎹細璺宠繃, ETL_FORCE=1 寮哄埗) +docker run --rm --network iboard-prod_default \ + -e DATABASE_URL="postgresql://iboard:@pg:5432/iboard" \ + -e SRC_DATABASE_URL="mysql://:@:3306/iboard" \ + iboard:latest node scripts/etl-mariadb-to-pg.mjs +``` + +杩佺Щ鍚庨渶瑕侀噸鍚 powersync 璁╁畠閲嶆柊蹇収锛 + +```bash +docker compose --env-file .env restart powersync +``` + +## 鐗堟湰涓庡洖婊 + +- 鏂扮増鏈: 鏋勫缓鏂伴暅鍍 鈫 `docker compose up -d app` (鍙噸寤 app, 鏁版嵁鍗蜂笉鍔) +- 鍥炴粴: 鐢ㄤ笂涓娆＄殑闀滃儚鏍囩閲嶆柊 `up -d app` +- 鏁版嵁: `data/pg` 鎸佷箙鍖; 鍙樻洿鍓嶅缓璁 `docker compose exec -T pg pg_dump -U iboard iboard > backup.sql` diff --git a/deploy/prod/docker-compose.yml b/deploy/prod/docker-compose.yml new file mode 100644 index 0000000..3bafd5f --- /dev/null +++ b/deploy/prod/docker-compose.yml @@ -0,0 +1,77 @@ +name: iboard-prod + +# iBoard 0.2.1 鐢熶骇鏍 (鍗曠鍙ｅ澶) +# - app : 3001 瀵瑰 (鍞竴鍏ュ彛), 鍐呴儴鎶 /sync 鍙嶄唬鍒 powersync +# - pg : PostgreSQL 16, 浠呭鍣ㄥ唴缃 (閫昏緫澶嶅埗渚涘悓姝ユ湇鍔℃秷璐) +# - powersync : 鍚屾鏈嶅姟, 浠呭鍣ㄥ唴缃 (涓嶅澶栨毚闇茬鍙) +# +# 涓庢棫鐨勭敓浜ф柟寮忓尯鍒: 涓嶅啀渚濊禆瀹夸富 MySQL, 鏁版嵁搴撲笌鍚屾鏈嶅姟閮藉湪鏍堝唴; +# 瀵瑰鍙湁 3001 涓涓鍙, 鍩熷悕 https://iboard.honor3.com (NPM 鍙嶄唬) 鍗冲彲銆 +# +# 鐢ㄦ硶 (baihu:/app/iboard-prod): +# cp deploy/prod/.env.example deploy/prod/.env # 濉瘑閽 +# docker compose --env-file deploy/prod/.env -f deploy/prod/docker-compose.yml up -d + +services: + pg: + image: postgres:16-alpine + restart: unless-stopped + command: ["postgres", "-c", "wal_level=logical"] + environment: + POSTGRES_USER: iboard + POSTGRES_PASSWORD: ${PG_PASSWORD:?PG_PASSWORD missing} + POSTGRES_DB: iboard + PS_STORAGE_PASSWORD: ${PS_STORAGE_PASSWORD:?PS_STORAGE_PASSWORD missing} + volumes: + - ./data/pg:/var/lib/postgresql/data + - ./initdb:/docker-entrypoint-initdb.d:ro + healthcheck: + test: ["CMD-SHELL", "pg_isready -U iboard -d iboard"] + interval: 5s + timeout: 5s + retries: 12 + + app: + image: iboard:latest + restart: unless-stopped + depends_on: + pg: + condition: service_healthy + environment: + DATABASE_URL: postgresql://iboard:${PG_PASSWORD}@pg:5432/iboard + PORT: "3001" + JWT_SECRET: ${JWT_SECRET:?JWT_SECRET missing} + POWERSYNC_JWT_SECRET: ${POWERSYNC_JWT_SECRET:?POWERSYNC_JWT_SECRET missing} + # 瀹㈡埛绔嬁鍒扮殑鍚屾鍦板潃 = 鍚屽煙 (缁忕敱 app 鐨 /sync 鍙嶄唬) + POWERSYNC_URL: ${PUBLIC_URL:-https://iboard.honor3.com} + # app 鍐呴儴杞彂鍚屾璇锋眰鍒板唴缃 powersync + POWERSYNC_UPSTREAM: http://powersync:8080 + OTA_PUBLIC_BASE: ${PUBLIC_URL:-https://iboard.honor3.com} + OTA_PACKAGE_DIR: /app/ota-package + MIHOME_CACHE_DIR: /app/cache + volumes: + - ./data/cache:/app/cache + ports: + - "3001:3001" + healthcheck: + test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:3001/api/health || exit 1"] + interval: 30s + timeout: 5s + retries: 5 + start_period: 20s + + powersync: + image: journeyapps/powersync-service:latest + restart: unless-stopped + depends_on: + pg: + condition: service_healthy + command: ["start", "-r", "unified"] + volumes: + - ./powersync/service.yaml:/config/service.yaml:ro + - ./powersync/sync-config.yaml:/config/sync-config.yaml:ro + environment: + POWERSYNC_CONFIG_PATH: /config/service.yaml + PS_SOURCE_URI: postgresql://iboard:${PG_PASSWORD}@pg:5432/iboard?sslmode=disable + PS_STORAGE_URI: postgresql://powersync_storage:${PS_STORAGE_PASSWORD}@pg:5432/iboard?sslmode=disable + PS_JWT_KEY_B64: ${POWERSYNC_JWT_KEY_B64:?POWERSYNC_JWT_KEY_B64 missing} diff --git a/deploy/prod/initdb/01-powersync-storage.sh b/deploy/prod/initdb/01-powersync-storage.sh new file mode 100644 index 0000000..6afb759 --- /dev/null +++ b/deploy/prod/initdb/01-powersync-storage.sh @@ -0,0 +1,17 @@ +#!/bin/bash +# 鐢熶骇 PG 鍒濆鍖: PowerSync bucket storage 涓撶敤鐢ㄦ埛 +set -e +: "${PS_STORAGE_PASSWORD:?PS_STORAGE_PASSWORD missing}" + +psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" <<-EOSQL + DO \$\$ + BEGIN + IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'powersync_storage') THEN + CREATE USER powersync_storage WITH PASSWORD '$PS_STORAGE_PASSWORD'; + END IF; + END + \$\$; + GRANT CREATE ON DATABASE $POSTGRES_DB TO powersync_storage; +EOSQL + +echo '[initdb] powersync_storage ready.' diff --git a/deploy/prod/powersync/service.yaml b/deploy/prod/powersync/service.yaml new file mode 100644 index 0000000..757674d --- /dev/null +++ b/deploy/prod/powersync/service.yaml @@ -0,0 +1,41 @@ +# PowerSync Service 涓婚厤缃 (0.2.1 楠岃瘉閮ㄧ讲) +# 鍙傝: https://docs.powersync.com/configuration/powersync-service/self-hosted-instances +# 娉ㄦ剰: !env 鏄 YAML 鏁村兼爣绛, 鍙兘鏁翠釜鍊兼浛鎹㈠彉閲, 涓嶈兘鍐呭祵鍦 URI 瀛楃涓蹭腑; +# 瀹屾暣杩炴帴涓茬敱 docker-compose 浠 PS_* 鐜鍙橀噺娉ㄥ叆銆 + +replication: + connections: + - type: postgresql + # 婧愬簱: 鏈爤 pg 瀹瑰櫒 (0.2.1 鐙珛瀹炰緥), 澶嶅埗璧 iboard021 璐﹀彿 + uri: !env PS_SOURCE_URI + sslmode: disable + +# bucket storage: 鍚屽疄渚 PG (16 >= 14 鍏佽鍚屽簱涓嶅悓 schema, service 鑷缓 powersync schema) +storage: + type: postgresql + uri: !env PS_STORAGE_URI + sslmode: disable + +port: 8080 + +sync_config: + path: /config/sync-config.yaml + +# 瀹㈡埛绔壌鏉: app 鍚庣 /api/powersync/token 绛惧彂 HS256 JWT (aud=powersync) +# oct 瀵嗛挜 k = base64url(POWERSYNC_JWT_SECRET) +client_auth: + jwks: + keys: + - kty: oct + k: !env PS_JWT_KEY_B64 + alg: HS256 + audience: + - powersync + +telemetry: + disable_telemetry_sharing: true + +system: + logging: + level: info + format: text diff --git a/deploy/prod/powersync/sync-config.yaml b/deploy/prod/powersync/sync-config.yaml new file mode 100644 index 0000000..041834e --- /dev/null +++ b/deploy/prod/powersync/sync-config.yaml @@ -0,0 +1,25 @@ +# Sync Streams (edition 3): 浠诲姟妯″潡 6 琛 + User (灞曠ず鐢) +# Sequential ID Mapping (瑙 docs/V0.2/绂荤嚎缂栬緫妯″潡/0.2.1瀹炴柦鏂规.md 搂3): +# - 瀹㈡埛绔富閿 = uuid 鍒 (绂荤嚎鏂板缓琛屽悓姝ュ洖濉悗 id 绋冲畾); int 鑷 id 涓嶄笅鍙 +# - 澶栭敭杈撳嚭 uuid 闀滃儚鍒, 鍒悕鍥 projectId/columnId/parentId/taskId (瀹㈡埛绔瓧娈靛悕涓嶅彉) +# - 寮曞彿淇濈暀 PG PascalCase 鏍囪瘑; 鍙鎬ф寜 ProjectMember 杩囨护 + +config: + edition: 3 + +streams: + iboard_users: + auto_subscribe: true + query: SELECT CAST("id" AS TEXT) AS "id", "name", "email" FROM "User" + + iboard_task_data: + auto_subscribe: true + with: + my_projects: SELECT "projectId" FROM "ProjectMember" WHERE CAST("userId" AS TEXT) = auth.user_id() + queries: + - SELECT "uuid" AS "id", "uuid", "code", "name", CAST("ownerId" AS TEXT) AS "ownerId", "isPersonal", "archived", "notes", "taskKinds", "icon", "autoArchive", "createdAt", "updatedAt" FROM "Project" WHERE "id" IN my_projects + - SELECT "uuid" AS "id", "uuid", "projectUuid" AS "projectId", CAST("userId" AS TEXT) AS "userId", "permission", "createdAt" FROM "ProjectMember" WHERE "projectId" IN my_projects + - SELECT "uuid" AS "id", "uuid", "projectUuid" AS "projectId", "name", "sortOrder", "boundStatus", "retention", "createdAt", "updatedAt" FROM "BoardColumn" WHERE "projectId" IN my_projects + - SELECT "uuid" AS "id", "uuid", "projectUuid" AS "projectId", "columnUuid" AS "columnId", "parentUuid" AS "parentId", "title", "description", "kind", "markDate", "status", "doneAt", CAST("assigneeId" AS TEXT) AS "assigneeId", CAST("creatorId" AS TEXT) AS "creatorId", "extras", "sortOrder", "number", "archived", "archivedAt", "archiveSource", "createdAt", "updatedAt" FROM "Task" WHERE "projectId" IN my_projects + - SELECT "uuid" AS "id", "uuid", "taskUuid" AS "taskId", CAST("userId" AS TEXT) AS "userId" FROM "TaskMember" WHERE "taskId" IN (SELECT "id" FROM "Task" WHERE "projectId" IN my_projects) + - SELECT "uuid" AS "id", "uuid", "taskUuid" AS "taskId", "name" FROM "TaskTag" WHERE "taskId" IN (SELECT "id" FROM "Task" WHERE "projectId" IN my_projects) diff --git a/deploy/prod/sql/publication.sql b/deploy/prod/sql/publication.sql new file mode 100644 index 0000000..dcf3127 --- /dev/null +++ b/deploy/prod/sql/publication.sql @@ -0,0 +1,11 @@ +-- 鐢熶骇 PG: PowerSync 閫昏緫澶嶅埗 publication +-- 蹇呴』鍦 prisma migrate deploy 寤鸿〃涔嬪悗鎵ц (initdb 闃舵琛ㄨ繕涓嶅瓨鍦, 鏁呬笉鏀 initdb 鐩綍)銆 +-- 骞傜瓑: 宸插瓨鍦ㄥ垯璺宠繃銆 +DO $$ +BEGIN + IF NOT EXISTS (SELECT 1 FROM pg_publication WHERE pubname = 'powersync') THEN + CREATE PUBLICATION powersync FOR TABLE + "Project", "ProjectMember", "BoardColumn", "Task", "TaskMember", "TaskTag", "User"; + END IF; +END +$$; diff --git a/server/index.js b/server/index.js index 1d803de..2859086 100644 --- a/server/index.js +++ b/server/index.js @@ -17,12 +17,15 @@ import checklistsRouter from './routes/checklists.js' import projectsRouter, { columnRouter } from './routes/projects.js' import tasksRouter from './routes/tasks.js' import powersyncRouter from './routes/powersync.js' +import { powersyncProxy } from './powersync-proxy.js' const PORT = Number(process.env.PORT) || 3001 const DIST_DIR = path.join(process.cwd(), 'dist') const HAS_DIST = fs.existsSync(DIST_DIR) const app = express() +// 鍚屾鏈嶅姟鍚屽煙鍙嶄唬蹇呴』鏈鍏堟寕杞 (娴佸紡闀胯繛鎺, 涓嶈兘缁忚繃 json/cors 涓棿浠) +app.use(powersyncProxy()) app.use(cors()) app.use(express.json()) diff --git a/server/powersync-proxy.js b/server/powersync-proxy.js new file mode 100644 index 0000000..ab3c0d2 --- /dev/null +++ b/server/powersync-proxy.js @@ -0,0 +1,54 @@ +// PowerSync 鍚屽煙鍙嶄唬 (0.2.1): 鎶 /sync銆/socket 杞彂鍒板唴缃戝悓姝ユ湇鍔, +// 瀵瑰鍙毚闇插簲鐢ㄦ湰韬竴涓鍙 (鏃犻渶鍗曠嫭鐨 powersync 绔彛)銆 +// - 鏈厤缃 POWERSYNC_UPSTREAM 鏃剁洿鎺ヨ烦杩 (鏈湴寮鍙/鏃犲悓姝ユ湇鍔℃椂琛屼负涓嶅彉) +// - 蹇呴』鎸傚湪 express.json()/cors 涔嬪墠: 鍚屾璧伴暱杩炴帴娴佸紡鍝嶅簲, 涓嶈兘琚 body 瑙ｆ瀽鎵撴柇 +import http from 'node:http' +import https from 'node:https' + +const PREFIXES = ['/sync', '/socket'] + +export function powersyncProxy() { + const upstream = process.env.POWERSYNC_UPSTREAM + if (!upstream) return (_req, _res, next) => next() + + let target + try { + target = new URL(upstream) + } catch { + console.error('[powersync-proxy] POWERSYNC_UPSTREAM 闈炴硶:', upstream) + return (_req, _res, next) => next() + } + const transport = target.protocol === 'https:' ? https : http + const basePort = Number(target.port) || (target.protocol === 'https:' ? 443 : 80) + console.log('[powersync-proxy] 鍚屾璇锋眰杞彂鍒', target.origin) + + return (req, res, next) => { + if (!PREFIXES.some((p) => req.url === p || req.url.startsWith(p + '/') || req.url.startsWith(p + '?'))) { + return next() + } + const headers = { ...req.headers, host: target.host } + const upstreamReq = transport.request( + { + protocol: target.protocol, + hostname: target.hostname, + port: basePort, + method: req.method, + path: req.url, + headers, + }, + (upstreamRes) => { + res.writeHead(upstreamRes.statusCode || 502, upstreamRes.headers) + upstreamRes.pipe(res) + }, + ) + upstreamReq.on('error', (e) => { + console.error('[powersync-proxy] 杞彂澶辫触:', e.message) + if (!res.headersSent) res.writeHead(502, { 'content-type': 'text/plain' }) + res.end('powersync upstream error') + }) + // 闀胯繛鎺: 瀹㈡埛绔柇寮鏃跺悓姝ユ柇寮涓婃父 + req.on('aborted', () => upstreamReq.destroy()) + res.on('close', () => upstreamReq.destroy()) + req.pipe(upstreamReq) + } +}