Jinsi ya kupeleka stack ya Docker Compose kwenye VPS

Docker Compose huelezea stack ya kontena nyingi kwenye faili moja na kuiendesha kwa amri moja. Huu ni mwongozo wa kupeleka; kwanza sakinisha Docker ikiwa hujafanya. Kwa stack mahususi ya wakala wa AI (wakala + hifadhidata ya vekta + Redis), angalia docker-compose kwa wakala wa AI.

1. Stack: programu + hifadhidata + reverse proxy

# /opt/stack/docker-compose.yml
services:
  app:
    image: your/app:latest
    restart: unless-stopped
    env_file: [.env]
    depends_on: [db]
    # no ports: — reached only through the proxy below

  db:
    image: postgres:16-alpine
    restart: unless-stopped
    environment:
      POSTGRES_PASSWORD: ${DB_PASSWORD}
    volumes: ["pg:/var/lib/postgresql/data"]   # internal only

  caddy:                                        # HTTPS automatically
    image: caddy:2
    restart: unless-stopped
    ports: ["80:80", "443:443"]                 # the only public entrypoint
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile
      - caddy_data:/data

volumes: { pg: {}, caddy_data: {} }

Siri huishi kwenye .env, kamwe kwenye faili la compose:

# /opt/stack/.env  (chmod 600, git-ignored)
DB_PASSWORD=a-long-random-string

Caddyfile ndogo hupitisha kikoa chako kwa programu na hujipatia HTTPS yenyewe:

app.yourdomain.com {
  reverse_proxy app:8080
}

2. Iwashe

cd /opt/stack
docker compose up -d
docker compose ps
docker compose logs -f app

restart: unless-stopped kwenye kila huduma + Docker iliyowashwa wakati wa kuwasha = stack hurudi yenyewe baada ya kuwasha upya.

3. Amri za kila siku

docker compose pull && docker compose up -d   # update images
docker compose down                            # stop the stack
docker compose restart app                     # restart one service

Sehemu watu wanayoikosea: bandari zilizofunuliwa

Docker huchapisha bandari kupitia iptables, hivyo kontena lenye ports: ["5432:5432"] linaweza kufikiwa kutoka intaneti hata nyuma ya ngome ya UFW uliyodhani imefungwa. Chapisha tu kiingilio cha umma (proxy kwenye 80/443); weka hifadhidata na kache kwenye mtandao wa compose au zimefungwa kwa 127.0.0.1. Chochote kinachohudumia trafiki ya wavuti kinahitaji mpango wa IP maalum; unganisha na ngome ya UFW.

Kwa stack nzima nyuma ya IP moja, angalia jipangishie huduma nyingi. Root kwa takribani dakika moja, NVMe, bila KYC, malipo kwa crypto.