feat(deploy): 增加受控更新与环境配置迁移

2026-09-27 11:12:55 +08:00
parent 74ada0b0bf
commit 195e2e5a98
12 changed files with 667 additions and 17 deletions
@@ -8,7 +8,7 @@ services:
    image: registry.cn-shanghai.aliyuncs.com/comfy-ai/one-ai:${VERSION}
    #端口冲突时，只需要修改前面的端口比如修改为，3011:3010
    labels:
-      - "com.centurylinklabs.watchtower.enable=true"
+      - "com.centurylinklabs.watchtower.enable=${WATCHTOWER_CORE_UPDATE_ENABLED:-true}"
    ports:
      - "${EASYAI_PROXY_BIND_IP:-127.0.0.1}:${WEB_PORT}:3010"
 #    read_only: true
@@ -41,6 +41,12 @@ services:
      options:
        max-size: "100m"
        max-file: "10"
+    healthcheck:
+      test: ["CMD-SHELL", "node -e \"require('http').get('http://127.0.0.1:3010/health', (res) => { res.resume(); process.exit(res.statusCode === 200 ? 0 : 1); }).on('error', () => process.exit(1))\""]
+      interval: 10s
+      timeout: 5s
+      retries: 12
+      start_period: 30s
    # 资源限制，防止内存溢出
    deploy:
      resources:
@@ -53,7 +59,7 @@ services:
    # 阿里云镜像地址
    image: registry.cn-shanghai.aliyuncs.com/comfy-ai/comfy-server:${VERSION} # 阿里云
    labels:
-      - "com.centurylinklabs.watchtower.enable=true"
+      - "com.centurylinklabs.watchtower.enable=${WATCHTOWER_CORE_UPDATE_ENABLED:-true}"
    ports:
      - "${SERVER_HTTP_BIND_IP:-127.0.0.1}:${SERVER_HTTP_PORT}:3001"    # Linux Nginx 部署默认仅回环；Windows/LAN 直连由启动脚本显式覆盖
 #    read_only: true
@@ -133,11 +139,16 @@ services:
      # easyai-server 发布事件到 ws-gateway（默认走容器内网服务名）
      - WS_GATEWAY_TCP_HOST=${WS_GATEWAY_TCP_HOST:-ws-gateway}
      - WS_GATEWAY_TCP_PORT=${WS_GATEWAY_TCP_PORT:-4002}
+      # 在线更新：未配置时保持原 Watchtower 兼容模式。
+      - SYSTEM_UPDATE_MODE=${SYSTEM_UPDATE_MODE:-legacy_watchtower}
+      - SYSTEM_UPDATE_SERVICE_URL=${SYSTEM_UPDATE_SERVICE_URL:-http://easyai-updater:3015}
+      - SYSTEM_UPDATE_INTERNAL_TOKEN=${SYSTEM_UPDATE_INTERNAL_TOKEN}
+      - EASYAI_DEPLOYMENT_SCHEMA_VERSION=${EASYAI_DEPLOYMENT_SCHEMA_VERSION:-1}
    # 日志大小设置，避免日志文件过大
    env_file:
      - .env
    healthcheck:
-      test: ["CMD-SHELL", "node -e \"require('http').get('http://127.0.0.1:3001/health', (res) => { res.resume(); process.exit(res.statusCode === 200 ? 0 : 1); }).on('error', () => process.exit(1))\""]
+      test: ["CMD-SHELL", "node -e \"require('http').get('http://127.0.0.1:3001/health/update-ready', (res) => { res.resume(); process.exit(res.statusCode === 200 ? 0 : 1); }).on('error', () => process.exit(1))\""]
      interval: 30s
      timeout: 10s
      retries: 3
@@ -152,7 +163,7 @@ services:
    # 阿里云镜像地址
    image: registry.cn-shanghai.aliyuncs.com/easyaigc/wsgateway:latest # 阿里云
    labels:
-      - "com.centurylinklabs.watchtower.enable=true"
+      - "com.centurylinklabs.watchtower.enable=${WATCHTOWER_CORE_UPDATE_ENABLED:-true}"
    ports:
      - "${EASYAI_PROXY_BIND_IP:-127.0.0.1}:${CONFIG_WS_PORT:-3002}:3002"    # Linux IP/域名模式默认仅供同机 Nginx 访问
    read_only: true
@@ -187,6 +198,8 @@ services:
      - GATEWAY_INBOUND_TCP_PORT=${GATEWAY_INBOUND_TCP_PORT:-4001}
      - GATEWAY_INBOUND_TCP_PATTERN=${GATEWAY_INBOUND_TCP_PATTERN:-gateway.inbound.command}
      - GATEWAY_INBOUND_TIMEOUT_MS=${GATEWAY_INBOUND_TIMEOUT_MS:-5000}
+      - WS_GATEWAY_HEALTH_PORT=3012
+      - EASYAI_BUILD_ID=${EASYAI_BUILD_ID:-unknown}
    # 日志大小设置，避免日志文件过大
    env_file:
      - .env
@@ -195,6 +208,12 @@ services:
      options:
        max-size: "100m"
        max-file: "10"
+    healthcheck:
+      test: ["CMD-SHELL", "node -e \"require('http').get('http://127.0.0.1:3012/health', (res) => { res.resume(); process.exit(res.statusCode === 200 ? 0 : 1); }).on('error', () => process.exit(1))\""]
+      interval: 10s
+      timeout: 5s
+      retries: 12
+      start_period: 20s
  mongo:
    # 镜像见 .env 中 MONGO_IMAGE；4.4 备选地址与用途见 .env.sample 注释
    image: ${MONGO_IMAGE:-registry.cn-shanghai.aliyuncs.com/comfy-ai/mongo-aliyun:latest}
@@ -278,7 +297,12 @@ services:
    image: registry.cn-shanghai.aliyuncs.com/comfy-ai/watchtower-aliyun:latest
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
-    command: --debug
+      - ${DOCKER_CONFIG_FILE:-/root/.docker/config.json}:/config.json:ro
+    # 新安装只负责 easyai-updater 自身；存量环境未配置目标时保持原来的全容器扫描方式。
+    command: --debug ${WATCHTOWER_UPDATE_TARGET:-}
+    environment:
+      - WATCHTOWER_POLL_INTERVAL=${SYSTEM_UPDATER_UPDATE_INTERVAL_SECONDS:-86400}
+      - WATCHTOWER_CLEANUP=${WATCHTOWER_CLEANUP:-false}
    restart: always
    labels:
      - "com.centurylinklabs.watchtower.enable=false"
@@ -294,6 +318,46 @@ services:
      options:
        max-size: "100m"
        max-file: "10"
+  easyai-updater:
+    image: registry.cn-shanghai.aliyuncs.com/easyaigc/easyai-updater:latest
+    container_name: easyai-updater
+    profiles:
+      - managed-update
+    labels:
+      - "com.centurylinklabs.watchtower.enable=true"
+    restart: unless-stopped
+    read_only: true
+    cap_drop:
+      - ALL
+    security_opt:
+      - no-new-privileges:true
+    environment:
+      - PORT=3015
+      - SYSTEM_UPDATE_INTERNAL_TOKEN=${SYSTEM_UPDATE_INTERNAL_TOKEN}
+      - EASYAI_DEPLOYMENT_SCHEMA_VERSION=${EASYAI_DEPLOYMENT_SCHEMA_VERSION:-1}
+      - UPDATE_HEALTH_TIMEOUT_MS=${UPDATE_HEALTH_TIMEOUT_MS:-300000}
+      - DOCKER_CONFIG_FILE=/run/secrets/docker-config.json
+      - UPDATE_STATE_DIR=/var/lib/easyai-updater
+      - UPDATE_MANIFEST_FILE=/var/lib/easyai-updater/release-manifest.json
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - ${DOCKER_CONFIG_FILE:-/root/.docker/config.json}:/run/secrets/docker-config.json:ro
+      - ./data/update-state:/var/lib/easyai-updater
+    tmpfs:
+      - /tmp:mode=1777
+    networks:
+      - easyai
+    healthcheck:
+      test: ["CMD-SHELL", "node -e \"require('http').get('http://127.0.0.1:3015/health', (res) => { res.resume(); process.exit(res.statusCode === 200 ? 0 : 1); }).on('error', () => process.exit(1))\""]
+      interval: 10s
+      timeout: 5s
+      retries: 6
+      start_period: 10s
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "50m"
+        max-file: "3"
  video-edit:
    image: registry.cn-shanghai.aliyuncs.com/easyaigc/videoedit:latest
    container_name: video-edit