自托管 Sharkey 换自建 fork 镜像：让候选镜像自己报迁移，然后 39 秒切完

services:
  web:
    # 本地构建产物（无 registry；pull_policy: never 保证 compose 不会去远端拉）
    image: sharkey-stelpolva:2025.5.2-dev-stelpolva.6-2ca6365c1c
    build:
      context: /srv/sharkey/src/sharkey-stelpolva
      dockerfile: Dockerfile
      args:
        # 与 Dockerfile 默认一致；锁定 Node 大版本，避免上游改默认值时静默跳版
        NODE_VERSION: 24-alpine3.22
    pull_policy: never

    container_name: sharkey-web
    restart: always
    mem_limit: '2048m'
    memswap_limit: '2048m'
    labels:
      # 本地 tag 不能被 watchtower「更新」（否则会因无 registry 报错/误动）
      - "com.centurylinklabs.watchtower.enable=false"

    links:
      - db
      - redis
    depends_on:
      db:
        condition: service_healthy
      redis:
        condition: service_healthy

    expose:
      - "3000"

    networks:
      - default
      - npminone

    env_file:
      - .config/docker.env
    environment:
      - NODE_OPTIONS="--max-old-space-size=8192"

    volumes:
      - ./files:/sharkey/files
      - ./.config:/sharkey/.config:ro

    # 镜像内未装 curl，故用 node 自带 fetch 做健康检查（node 24 / 22 均可用）
    healthcheck:
      test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:3000/healthz').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 300s

  redis:
    restart: always
    image: redis:7-alpine
    mem_limit: '256m'
    memswap_limit: '256m'
    container_name: sharkey_redis
    networks:
      - default
    volumes:
      - ./redis:/data
    healthcheck:
      test: "redis-cli ping"
      interval: 5s
      retries: 20

  db:
    restart: always
    # pgroonga 是 Stelpolva 的硬依赖（fulltextSearch.provider: sqlPgroonga）
    image: groonga/pgroonga:4.0.1-alpine-17
    mem_limit: '4096m'
    memswap_limit: '1536m'
    container_name: sharkey_db
    labels:
      - "com.centurylinklabs.watchtower.enable=false"
    networks:
      - default
    env_file:
      - .config/docker.env
    volumes:
      - ./db:/var/lib/postgresql/data
    expose:
      - "5432"
    healthcheck:
      test: "pg_isready -U $$POSTGRES_USER -d $$POSTGRES_DB"
      interval: 5s
      retries: 20

networks:
  default:
    driver: bridge
  npminone:
    external: true
    name: npminone

#!/bin/bash
# 在服务器上从源码构建 Sharkey Stelpolva 镜像（非侵入：不触碰运行中的容器）
#
# 部署到服务器后，脱离 SSH 会话跑：
#   systemd-run --unit=sharkey-build --collect --property=Nice=10 \
#     --property=StandardOutput=file:/var/log/sharkey-build.log \
#     --property=StandardError=append:/var/log/sharkey-build.log /srv/sharkey/bin/sharkey-build.sh
#   # 进度： tail -f /var/log/sharkey-build.log
# 用法： bash sharkey-build.sh [分支]      # 默认 stelpolva

set -euo pipefail

SRC=/srv/sharkey/src/sharkey-stelpolva
BRANCH="${1:-stelpolva}"
REPO=https://github.com/Lhcfl/sharkey-stelpolva.git

if [ ! -d "$SRC/.git" ]; then
  mkdir -p /srv/sharkey/src
  # 必须 git clone：Dockerfile 构建阶段要跑 git submodule update（两个 emoji 子模块）
  git clone --branch "$BRANCH" --depth 1 "$REPO" "$SRC"
fi

cd "$SRC"
git fetch --depth 1 origin "$BRANCH"
git checkout -q FETCH_HEAD
git submodule update --init --recursive   # 供本地参考；构建容器内会自行再拉一次

SHA=$(git rev-parse --short=10 HEAD)
VER=$(grep -m1 '"version"' package.json | sed -E 's/.*: *"([^"]+)".*/\1/')
TAG="sharkey-stelpolva:${VER}-${SHA}"
echo "=== build $TAG  (commit $(git log -1 --format='%h %cd'))  start $(date -Is) ==="

DOCKER_BUILDKIT=1 docker build --progress=plain -t "$TAG" .

echo "=== build ok $(date -Is) ==="
docker images --format '{{.Repository}}:{{.Tag}} | {{.ID}} | {{.Size}} | {{.CreatedSince}}' | grep '^sharkey-stelpolva'
echo "TAG=$TAG"

#!/bin/bash
# 切换前只读预检：让候选镜像自己回答
#   ① 它启动时会执行哪些迁移   ② 能不能用现网配置连上 PG/Redis   ③ 它是什么版本
# 全部只读、不写库、不碰运行中的容器。
#
# 用法： bash preflight.sh sharkey-stelpolva:<版本>-<commit>
set -uo pipefail
TAG="${1:?用法: bash preflight.sh <镜像tag>}"
cd /srv/sharkey || exit 1

cat > /tmp/pending.mjs <<'JS'
import ormconfig from '/sharkey/packages/backend/ormconfig.js';
import { MigrationExecutor } from 'typeorm';
const ds = ormconfig;
await ds.initialize();
const exec = new MigrationExecutor(ds);
const pending = await exec.getPendingMigrations();
console.log('PENDING_COUNT=' + pending.length);
for (const m of pending) console.log('  - ' + (m.name ?? m.constructor?.name));
await ds.destroy();
JS

cat > /tmp/roquery.mjs <<'JS'
import ormconfig from '/sharkey/packages/backend/ormconfig.js';
const ds = ormconfig;
await ds.initialize();
const r = await ds.query('select count(*)::int as notes, (select count(*)::int from "user") as users from note');
console.log('DB_OK notes=%d users=%d', r[0].notes, r[0].users);
const m = await ds.query('select count(*)::int as n from migrations');
console.log('MIGRATIONS_APPLIED=%d', m[0].n);
await ds.destroy();
JS

echo "=== 1) 待应用迁移（只读） ==="
docker run --rm --network sharkey_default \
  -v /tmp/pending.mjs:/sharkey/packages/backend/pending.mjs:ro \
  -v "$PWD/.config:/sharkey/.config:ro" \
  --env-file .config/docker.env \
  --entrypoint sh "$TAG" -c 'cd /sharkey/packages/backend && node pending.mjs'

echo "=== 2) 现网配置连通性（无输出且退出码 0 = PG + 全部 Redis 均连上） ==="
docker run --rm --network sharkey_default --env-file .config/docker.env \
  -v "$PWD/.config:/sharkey/.config:ro" "$TAG" pnpm check:connect; echo "check:connect exit=$?"

echo "=== 3) 对现网库只读查询 ==="
docker run --rm --network sharkey_default --env-file .config/docker.env \
  -v /tmp/roquery.mjs:/sharkey/packages/backend/roquery.mjs:ro \
  -v "$PWD/.config:/sharkey/.config:ro" --entrypoint sh "$TAG" \
  -c 'cd /sharkey/packages/backend && node roquery.mjs'

echo "=== 4) 镜像内版本 ==="
docker run --rm "$TAG" node -v
docker run --rm "$TAG" sh -c 'grep -m1 "\"version\"" /sharkey/package.json; ls /sharkey/packages/backend/migration/*.js | wc -l'

#!/bin/bash
# 换镜像的完整动作。在部署目录（/srv/sharkey）下执行。
set -uo pipefail
cd /srv/sharkey || exit 1
TS=$(date +%Y%m%d-%H%M%S)
NEW_TAG=sharkey-stelpolva:2025.5.2-dev-stelpolva.6-2ca6365c1c
OLD_TAG=sharkey-stelpolva:rollback-stelpolva-4
F='-f docker-compose.yml -f watchtower-exclude.yml'

# ── 1) 备份 ──────────────────────────────────────────────────────────────
mkdir -p /srv/sharkey/backups
cp -a docker-compose.yml "/srv/sharkey/backups/docker-compose.yml.${TS}"
cp -a .config/default.yml "/srv/sharkey/backups/default.yml.${TS}"
# 旧镜像钉成命名 tag（第三方 tag 可能在 hub 上被移动/删除）
docker tag wuhang2003/sharkey-stelpolva-docker:latest "$OLD_TAG"
# 逻辑备份（库越大越慢；本例 9.6 GB 库 → 392 MB dump / 2 分钟）
docker exec sharkey_db pg_dump -Fc -U sharkey -d sharkey > "/srv/sharkey/backups/sharkey-${TS}.dump"
sha256sum "/srv/sharkey/backups/sharkey-${TS}.dump"

# ── 2) 装新 compose（先临时文件校验，再原子替换） ─────────────────────────
install -m 644 /srv/sharkey/backups/docker-compose.yml.new /srv/sharkey/docker-compose.yml
docker compose --project-directory . $F config >/dev/null && echo "compose 语法 OK"

# ── 3) 只重建 web ───────────────────────────────────────────────────────
docker compose $F up -d --no-deps web

# ── 4) 验收 ─────────────────────────────────────────────────────────────
sleep 30
docker ps --filter name=sharkey-web --format '{{.Names}} | {{.Image}} | {{.Status}}'
IP=$(docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}} {{end}}' sharkey-web | awk '{print $1}')
curl -s -o /dev/null -w 'healthz=%{http_code}\n' --max-time 10 "http://$IP:3000/healthz"
curl -s --max-time 20 -X POST -H 'Content-Type: application/json' -d '{}' \
  "http://$IP:3000/api/meta" | python3 -c "import sys,json;d=json.load(sys.stdin);print('version',d['version'])"
docker exec sharkey_db psql -U sharkey -d sharkey -tAc "select count(*) from migrations;"
docker logs --tail 40 sharkey-web 2>&1 | grep -iE 'error|executed successfully' | tail -10

# ── 5) 回滚（任一步失败时执行） ─────────────────────────────────────────
#   需要先把 docker-compose.yml 里的 image 改回 $OLD_TAG，然后：
#   docker compose $F up -d --no-deps web
#   三条迁移都是向后兼容的，回滚不需要还原数据库；
#   只有「迁移中途失败/库被写坏」才用 dump：
#   docker compose $F stop web
#   docker exec -i sharkey_db pg_restore -c --if-exists -U sharkey -d sharkey < /srv/sharkey/backups/sharkey-<TS>.dump
#   docker compose $F up -d