chore(deploy): добавить Traefik-стеки и общий compose с CDNManager

Единый стек CDN+MM, вариант рядом с CDN Traefik и CLI-скрипт запуска. Co-authored-by: Cursor <cursoragent@cursor.com>
2026-09-04 19:07:49 +07:00
parent 42a2e18047
commit 0208aa4d7c
6 changed files with 666 additions and 7 deletions
@@ -0,0 +1,52 @@
+# Production .env for deploy/docker-compose.cdn-mm.yml
+# (CDN Manager + MikrotikManager + one Traefik).
+# Copy to /opt/cdn-mm/.env and fill secrets. Do not commit.
+
+# --- Traefik / Let's Encrypt (Cloudflare DNS-01) ---
+# Token for ACME only (Zone DNS Edit). Separate from CLOUDFLARE_API_TOKEN below.
+CF_DNS_API_TOKEN=
+LETSENCRYPT_EMAIL=admin@shnt.top
+# TRAEFIK_IMAGE_TAG=v3.7
+# TRAEFIK_HTTP_PORT=80
+# TRAEFIK_HTTPS_PORT=443
+# TRAEFIK_LOG_LEVEL=INFO
+
+# --- Public hosts ---
+CDN_DOMAIN=cdn.shnt.top
+MM_DOMAIN=mm.shnt.top
+# Must match MM UI origin (https:// + MM_DOMAIN).
+CORS_ORIGIN=https://mm.shnt.top
+
+# --- Images ---
+CDN_IMAGE_TAG=latest
+# drop-in alias (same manifest): git.shx.one/denozord/cdn-manager
+MM_BACKEND_IMAGE_TAG=latest
+MM_FRONTEND_IMAGE_TAG=latest
+MM_UPDATER_IMAGE_TAG=latest
+
+# --- CDN Manager ---
+CLOUDFLARE_API_TOKEN=
+LOG_LEVEL=info
+NODE_ENV=production
+
+# Portal SSO (prod default AUTH_REQUIRED=true)
+AUTH_REQUIRED=true
+# Same HS256 secret as auth-portal JWT_SECRET (required)
+AUTH_JWT_SECRET=
+# Optional alias — CDN Manager also reads JWT_SECRET
+JWT_SECRET=
+AUTH_ISSUER=https://auth.shnt.top
+AUTH_PORTAL_URL=https://auth.shnt.top
+# Shared with auth-portal AUDIT_INGEST_SECRET (optional)
+AUTH_AUDIT_INGEST_SECRET=
+
+# Legacy local admin — only when AUTH_REQUIRED=false
+ADMIN_USERNAME=admin
+ADMIN_PASSWORD_HASH=
+
+# --- MikrotikManager updater (optional; private registry pull) ---
+REGISTRY_USERNAME=
+REGISTRY_PASSWORD=
+# POLL_INTERVAL_SECONDS=300
+# HEALTH_TIMEOUT_SECONDS=120
+# STOP_TIMEOUT_SECONDS=30