M0+M1: 基建 + 用户/密钥/核心代理

后端 (Go/Gin/GORM): - 配置(viper+env)、SQLite/Postgres 迁移、argon2id、AES-GCM 渠道密钥、JWT+refresh cookie - 用户注册/登录/刷新/登出、API Key CRUD(仅存哈希、明文一次展示) - 代理网关: /v1/chat/completions、/v1/responses、/v1/models 直通 OpenAI 渠道非流式+流式(SSE 零缓冲转发), 用量捕获(chat 末块/responses completed 嵌套), OpenAI 错误格式(401/402/404/502), 余额检查 - 异步批量记账 + 余额流水 + 日聚合, admin 用户/余额/配置 API - 单测: crypto/jwt/apikey/流式 usage 提取前端 (Vue3+TS+Vite+Tailwind v4): - taste-skill 设计 tokens: 深色仪表盘, 石墨+信号铜色, Outfit+JetBrains Mono - Landing/登录/注册, 控制台(仪表盘图表/密钥管理/用量明细) - 基础组件 Button/Input/Badge/Modal, ECharts 用量图部署: docker-compose(nginx+api+postgres), 双 Dockerfile, nginx SSE 反代联调: scripts/mockupstream 本地 mock 上游, 端到端验证通过
2026-08-15 13:10:47 +08:00
commit 360c6b33a6
75 changed files with 7044 additions and 0 deletions
@@ -0,0 +1,15 @@
+# API 镜像：多阶段构建 Go 二进制
+FROM golang:1.26-alpine AS builder
+WORKDIR /src
+COPY server/go.mod server/go.sum ./
+RUN go mod download
+COPY server/ .
+RUN CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o /out/openteam ./cmd/server
+
+FROM alpine:3.21
+RUN adduser -D -u 10001 app
+USER app
+WORKDIR /app
+COPY --from=builder /out/openteam /app/openteam
+EXPOSE 8080
+ENTRYPOINT ["/app/openteam"]
@@ -0,0 +1,12 @@
+# 前端镜像：构建静态资源 + nginx
+FROM node:24-alpine AS builder
+WORKDIR /src
+COPY web/package.json web/pnpm-lock.yaml ./
+RUN corepack enable && pnpm install --frozen-lockfile
+COPY web/ .
+RUN pnpm build
+
+FROM nginx:1.27-alpine
+COPY deploy/nginx.conf /etc/nginx/conf.d/default.conf
+COPY --from=builder /src/dist /usr/share/nginx/html
+EXPOSE 80
@@ -0,0 +1,54 @@
+# ===== openteam 单实例部署（nginx + api + postgres）=====
+# 使用：cp .env.example ../.env 并修改密钥，然后 docker compose up -d
+services:
+  api:
+    build:
+      context: ..
+      dockerfile: deploy/Dockerfile.api
+    restart: unless-stopped
+    environment:
+      OT_ENV: production
+      OT_PORT: "8080"
+      OT_DB_DRIVER: postgres
+      OT_DB_DSN: host=postgres user=openteam password=${OT_DB_PASSWORD:-openteam} dbname=openteam port=5432 sslmode=disable
+      OT_JWT_SECRET: ${OT_JWT_SECRET:?set in .env}
+      OT_MASTER_KEY: ${OT_MASTER_KEY:?set in .env}
+      OT_ADMIN_PASSWORD: ${OT_ADMIN_PASSWORD:-admin123}
+      OT_PROXY_UPSTREAM_KEY: ${OT_PROXY_UPSTREAM_KEY:-}
+      OT_PROXY_UPSTREAM_BASE_URL: ${OT_PROXY_UPSTREAM_BASE_URL:-https://api.openai.com}
+      OT_PROXY_DEFAULT_MODEL: ${OT_PROXY_DEFAULT_MODEL:-gpt-4o-mini}
+    depends_on:
+      postgres:
+        condition: service_healthy
+    # 预留 Redis（M6 限流）；当前单实例不依赖
+    # redis:
+    #   image: redis:7-alpine
+    #   restart: unless-stopped
+
+  postgres:
+    image: postgres:16-alpine
+    restart: unless-stopped
+    environment:
+      POSTGRES_USER: openteam
+      POSTGRES_PASSWORD: ${OT_DB_PASSWORD:-openteam}
+      POSTGRES_DB: openteam
+    volumes:
+      - pgdata:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U openteam"]
+      interval: 5s
+      timeout: 3s
+      retries: 10
+
+  web:
+    build:
+      context: ..
+      dockerfile: deploy/Dockerfile.web
+    restart: unless-stopped
+    ports:
+      - "${OT_HTTP_PORT:-80}:80"
+    depends_on:
+      - api
+
+volumes:
+  pgdata:
@@ -0,0 +1,42 @@
+server {
+    listen 80;
+    server_name _;
+
+    root /usr/share/nginx/html;
+    index index.html;
+
+    # SPA 路由回退
+    location / {
+        try_files $uri $uri/ /index.html;
+    }
+
+    # 管理 API + 代理端点 → Go 服务
+    location /api/ {
+        proxy_pass http://api:8080;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+    location /v1/ {
+        proxy_pass http://api:8080;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        # SSE 流式透传：关闭缓冲
+        proxy_buffering off;
+        proxy_cache off;
+        proxy_read_timeout 300s;
+    }
+
+    # 静态资源缓存
+    location /assets/ {
+        expires 30d;
+        add_header Cache-Control "public, immutable";
+    }
+
+    gzip on;
+    gzip_types text/plain text/css application/json application/javascript image/svg+xml;
+}