fix(security): 收紧默认部署暴露面
This commit is contained in:
+20
-18
@@ -10,7 +10,7 @@ services:
|
||||
labels:
|
||||
- "com.centurylinklabs.watchtower.enable=true"
|
||||
ports:
|
||||
- "${WEB_PORT}:3010"
|
||||
- "${EASYAI_PROXY_BIND_IP:-127.0.0.1}:${WEB_PORT}:3010"
|
||||
# read_only: true
|
||||
networks:
|
||||
easyai:
|
||||
@@ -55,11 +55,12 @@ services:
|
||||
labels:
|
||||
- "com.centurylinklabs.watchtower.enable=true"
|
||||
ports:
|
||||
- "${SERVER_HTTP_BIND_IP:-127.0.0.1}:${SERVER_HTTP_PORT}:3001" # 域名/本机部署默认仅回环；IP/LAN 模式由启动脚本显式设为 0.0.0.0
|
||||
- "${SERVER_HTTP_BIND_IP:-127.0.0.1}:${SERVER_HTTP_PORT}:3001" # Linux Nginx 部署默认仅回环；Windows/LAN 直连由启动脚本显式覆盖
|
||||
# read_only: true
|
||||
networks:
|
||||
easyai:
|
||||
ipv4_address: 172.21.0.6
|
||||
sandbox-network:
|
||||
depends_on:
|
||||
- mongo
|
||||
- redis
|
||||
@@ -120,7 +121,8 @@ services:
|
||||
- ASG_TCP_PORT=4003
|
||||
# ws-gateway 转发客户端命令到 easyai-server（画布协作等），对应主服务 3001
|
||||
- GATEWAY_INBOUND_ENABLED=${GATEWAY_INBOUND_ENABLED:-true}
|
||||
- GATEWAY_INBOUND_TCP_LISTEN_HOST=${GATEWAY_INBOUND_TCP_LISTEN_HOST:-0.0.0.0}
|
||||
# 仅监听主业务网络固定地址，避免沙箱网络访问内部 TCP 命令入口
|
||||
- GATEWAY_INBOUND_TCP_LISTEN_HOST=${GATEWAY_INBOUND_TCP_LISTEN_HOST:-172.21.0.6}
|
||||
- GATEWAY_INBOUND_TCP_PORT=${GATEWAY_INBOUND_TCP_PORT:-4001}
|
||||
# Agent 记忆服务 TCP 连接（来自 .env）
|
||||
- MEMORY_TCP_HOST=${MEMORY_TCP_HOST:-agent-memory}
|
||||
@@ -149,7 +151,7 @@ services:
|
||||
labels:
|
||||
- "com.centurylinklabs.watchtower.enable=true"
|
||||
ports:
|
||||
- "${CONFIG_WS_PORT:-3002}:3002" # ws-gateway WebSocket 对外端口映射
|
||||
- "${EASYAI_PROXY_BIND_IP:-127.0.0.1}:${CONFIG_WS_PORT:-3002}:3002" # Linux IP/域名模式默认仅供同机 Nginx 访问
|
||||
read_only: true
|
||||
networks:
|
||||
- easyai
|
||||
@@ -195,10 +197,9 @@ services:
|
||||
image: ${MONGO_IMAGE:-registry.cn-shanghai.aliyuncs.com/comfy-ai/mongo-aliyun:latest}
|
||||
container_name: mongo
|
||||
restart: unless-stopped
|
||||
privileged: true
|
||||
# 生产环境建议不要暴露
|
||||
ports:
|
||||
- ${MONGO_PORT+${MONGO_PORT}:27017}
|
||||
- "${EASYAI_INFRA_BIND_IP:-127.0.0.1}:${MONGO_PORT:-27017}:27017"
|
||||
networks:
|
||||
easyai:
|
||||
ipv4_address: 172.21.0.3
|
||||
@@ -257,8 +258,8 @@ services:
|
||||
RABBITMQ_DEFAULT_USER: ${CONFIG_MQ_USER} # 登录用户名
|
||||
RABBITMQ_DEFAULT_PASS: ${CONFIG_MQ_PASSWORD} # 登录密码
|
||||
ports:
|
||||
- "${CONFIG_MQ_PORT}:${CONFIG_MQ_PORT}" # 应用连接端口 (AMQP)
|
||||
- "${CONFIG_MQ_ADMIN_PORT}:15672" # Web 管理界面
|
||||
- "${EASYAI_INFRA_BIND_IP:-127.0.0.1}:${CONFIG_MQ_PORT}:${CONFIG_MQ_PORT}" # 应用连接端口 (AMQP)
|
||||
- "${EASYAI_INFRA_BIND_IP:-127.0.0.1}:${CONFIG_MQ_ADMIN_PORT}:15672" # Web 管理界面
|
||||
volumes:
|
||||
- rabbitmq_data:/var/lib/rabbitmq # 持久化数据
|
||||
networks:
|
||||
@@ -268,10 +269,8 @@ services:
|
||||
image: registry.cn-shanghai.aliyuncs.com/comfy-ai/watchtower-aliyun:latest
|
||||
volumes:
|
||||
- /var/run/docker.sock:/var/run/docker.sock
|
||||
command: --debug --http-api-update
|
||||
command: --debug
|
||||
restart: always
|
||||
environment:
|
||||
- WATCHTOWER_HTTP_API_TOKEN=sk-ofJoA4atj9dki6AvDtI1qwxdcejjDQ
|
||||
labels:
|
||||
- "com.centurylinklabs.watchtower.enable=false"
|
||||
# ports:
|
||||
@@ -295,7 +294,7 @@ services:
|
||||
volumes:
|
||||
- ./data/videoedit/temp:/app/temp
|
||||
ports:
|
||||
- '${VIDEO_EDIT_PORT}:8000'
|
||||
- '${EASYAI_INFRA_BIND_IP:-127.0.0.1}:${VIDEO_EDIT_PORT}:8000'
|
||||
env_file:
|
||||
- .env.tools
|
||||
environment:
|
||||
@@ -328,13 +327,12 @@ services:
|
||||
image: registry.cn-shanghai.aliyuncs.com/easyaigc/dozzle:latest
|
||||
environment:
|
||||
DOZZLE_BASE: /logs-web
|
||||
# DOZZLE_AUTH_PROVIDER: simple
|
||||
DOZZLE_AUTH_TTL: 72h
|
||||
DOZZLE_ENABLE_DOWNLOAD: "false"
|
||||
volumes:
|
||||
- /var/run/docker.sock:/var/run/docker.sock
|
||||
- ./data:/data
|
||||
ports:
|
||||
- "${DOZZLE_PORT:-8080}:8080"
|
||||
- "${EASYAI_INFRA_BIND_IP:-127.0.0.1}:${DOZZLE_PORT:-8080}:8080"
|
||||
restart: unless-stopped
|
||||
logging:
|
||||
driver: "json-file"
|
||||
@@ -345,7 +343,7 @@ services:
|
||||
image: registry.cn-shanghai.aliyuncs.com/easyaigc/sandbox:latest
|
||||
container_name: sandbox
|
||||
networks:
|
||||
- easyai
|
||||
- sandbox-network
|
||||
# 不映射宿主机端口，仅允许 Docker 内网中的 easyai-server 访问
|
||||
labels:
|
||||
- "com.centurylinklabs.watchtower.enable=true"
|
||||
@@ -422,7 +420,7 @@ services:
|
||||
labels:
|
||||
- "com.centurylinklabs.watchtower.enable=true"
|
||||
ports:
|
||||
- "${ASG_PORT:-3003}:3003"
|
||||
- "${EASYAI_PROXY_BIND_IP:-127.0.0.1}:${ASG_PORT:-3003}:3003"
|
||||
networks:
|
||||
easyai:
|
||||
ipv4_address: 172.21.0.14
|
||||
@@ -453,7 +451,7 @@ services:
|
||||
labels:
|
||||
- "com.centurylinklabs.watchtower.enable=true"
|
||||
ports:
|
||||
- "${AMS_PORT:-3004}:3004"
|
||||
- "${EASYAI_INFRA_BIND_IP:-127.0.0.1}:${AMS_PORT:-3004}:3004"
|
||||
environment:
|
||||
- MEMORY_DATABASE_URL=${MEMORY_DATABASE_URL:-postgresql://easyai:easyai2025@easyai-pgvector:5432/easyai_memory}
|
||||
networks:
|
||||
@@ -530,3 +528,7 @@ networks:
|
||||
config:
|
||||
- subnet: 172.21.0.0/16
|
||||
gateway: 172.21.0.1
|
||||
# 仅 easyai-server 与 sandbox 共享，阻断沙箱横向访问数据库、缓存、MQ 与治理服务。
|
||||
# 保持普通 bridge 以允许用户脚本按业务需要访问外网。
|
||||
sandbox-network:
|
||||
driver: bridge
|
||||
|
||||
Reference in New Issue
Block a user