From 5aa0be13dc877b840ac3fa133580b6f31ee58713 Mon Sep 17 00:00:00 2001
From: Sakurasan <26715255+Sakurasan@users.noreply.github.com>
Date: Tue, 18 Aug 2026 21:57:16 +0800
Subject: [PATCH] =?UTF-8?q?=E9=83=A8=E7=BD=B2:=20docker-compose=20?=
 =?UTF-8?q?=E4=B8=80=E9=94=AE=E5=90=AF=E5=8A=A8?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- 密钥从仓库根 .env 读取（:? 缺失即报错）
- db 绑定挂载当前目录 ./data，按宿主用户运行（OT_UID/OT_GID 可覆盖）
- healthcheck 探测 /healthz，restart unless-stopped

Co-Authored-By: Claude <noreply@anthropic.com>
---
 docker-compose.yml | 39 +++++++++++++++++++++++++++++++++++++++
 1 file changed, 39 insertions(+)
 create mode 100644 docker-compose.yml

diff --git a/docker-compose.yml b/docker-compose.yml
new file mode 100644
index 0000000..fc44587
--- /dev/null
+++ b/docker-compose.yml
@@ -0,0 +1,39 @@
+# openteam 自托管部署
+#
+# 启动：docker compose up -d
+# 首次会本地构建镜像（见 Dockerfile）；若已用 build-image.sh 推到仓库，
+# 把 image 改为仓库地址并删掉 build 段即可拉取多架构镜像。
+#
+# 密钥从仓库根 .env 读取（与本地开发共用），缺失时 compose 直接报错。
+name: openteam
+
+services:
+  openteam:
+    build:
+      context: .
+      dockerfile: Dockerfile
+    image: openteam:latest
+    container_name: openteam
+    restart: unless-stopped
+    ports:
+      - "${HOST_PORT:-8080}:8080"
+    # 以宿主用户运行，保证能写当前目录的 ./data 绑盘（默认 1000:1000，可用 OT_UID/OT_GID 覆盖）
+    user: "${OT_UID:-1000}:${OT_GID:-1000}"
+    environment:
+      OT_ENV: production
+      OT_PORT: 8080
+      # sqlite 落盘到当前目录 ./data（容器 WORKDIR=/app，DSN 用相对路径）
+      OT_DB_DRIVER: sqlite
+      OT_DB_DSN: data/openteam.db
+      # 必填密钥：渠道加密主密钥 / 管理员密码 / JWT 签名
+      OT_MASTER_KEY: ${OT_MASTER_KEY:?请在 .env 中设置 OT_MASTER_KEY}
+      OT_ADMIN_PASSWORD: ${OT_ADMIN_PASSWORD:?请在 .env 中设置 OT_ADMIN_PASSWORD}
+      OT_JWT_SECRET: ${OT_JWT_SECRET:?请在 .env 中设置 OT_JWT_SECRET}
+    volumes:
+      - ./data:/app/data
+    healthcheck:
+      test: ["CMD", "wget", "-qO-", "http://127.0.0.1:8080/healthz"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 10s