自用服务器初始docker环境配置

systemctl enable docker

sudo curl -L "https://github.com/docker/compose/releases/latest/download/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose

sudo chmod +x /usr/local/bin/docker-compose

比如

docker network create safernet

此时在npm的配置应为

services:
  app:
    image: 'jc21/nginx-proxy-manager:latest'
    restart: unless-stopped
    ports:
      - '80:80' # Public HTTP Port
      - '443:443' # Public HTTPS Port
      - '81:81' # Admin Web Port
    volumes:
      - ./data:/data
      - ./letsencrypt:/etc/letsencrypt
    networks:
      - dockernetwork
      - safernet

networks:
  dockernetwork:
    external: true
  safernet:
    external: true

即，显式在容器和底部配置网络，而不是直接挂载在default。

另外，最好在npm的webui反代完81端口后，改为：

      - '127.0.0.1:81:81' # Admin Web Port

这样可以更好搭配cloudflare waf拦截非白名单请求，比如阻止

此时，对于vaultwarden这种需要隔离的容器，参考：

services:
  vaultwarden:
    image: vaultwarden/server:latest
    restart: unless-stopped
    container_name: pass
    environment:
      DOMAIN: 'https://vauletwarden.example.com/'
      SIGNUPS_ALLOWED: 'false' #开启注册，自己注册后改成fale
      WEBSOCKET_ENABLED: 'true'
    volumes:
      - ./data:/data
    networks:
      - safernet

networks:
  safernet:
    external: true

对于多容器的项目，参考：

name: lobe-chat-database
services:
  postgresql:
    image: pgvector/pgvector:pg16
    container_name: lobe-postgres
    volumes:
      - './sqldata:/var/lib/postgresql/data'
    environment:
      - 'POSTGRES_DB=lobe'
      - 'POSTGRES_PASSWORD=password'  # 修改
    healthcheck:
      test: ['CMD-SHELL', 'pg_isready -U postgres']
      interval: 5s
      timeout: 5s
      retries: 5
    restart: always
    networks:
      - internal

  lobe:
    image: lobehub/lobe-chat-database
    container_name: lobe-chat-db
    depends_on:
      - postgresql
    env_file:
      - .env
    restart: always
    environment:
      - 'SEARXNG_URL=http://searxng:8080'
    networks:
      - internal

  searxng:
    image: searxng/searxng
    container_name: lobe-searxng
    volumes:
      - './searxng-settings.yml:/etc/searxng/settings.yml'
    environment:
      - 'SEARXNG_SETTINGS_FILE=/etc/searxng/settings.yml'
    restart: always
    env_file:
      - .env
    networks:
      - internal
      - dockernetwork

volumes:
  sqldata:
    driver: local

networks:
  internal:
  dockernetwork:
    external: true

此时dockernetwork中的其他容器无法和直接使用下面配置时那样直接访问lobe-postgres，internal会被结合name: lobe-chat-database 自动创建，类似 lobe-chat-database_internal ，如果不设置name，会使用当前文件夹名创建，因此多项目不会冲突

networks:
  default:
    external: true
    name: dockernetwork