mkdir -p /opt/bewcloud/data-files /opt/bewcloud/data-radicale /opt/bewcloud/radicale-config

name: bewcloud-v4.21.0-stack

services:
  website:
    image: ghcr.io/bewcloud/bewcloud:v4.21.0
    container_name: bewcloud-v4.21.0-web
    restart: always
    ports:
      - "8155:8000"                # 对外唯一端口：Web / API / WebDAV
    mem_limit: '256m'
    env_file:
      - path: .env                 # 密钥类环境变量（数据库口令、JWT 等）
        required: true
    volumes:
      - ./data-files:/app/data-files          # 用户文件本体
      - ./bewcloud.config.ts:/app/bewcloud.config.ts   # 业务配置（单文件挂载）
    networks:
      - bewcloud-net

  postgresql:
    image: postgres:18.6
    container_name: bewcloud-v4.21.0-db
    environment:
      - POSTGRES_USER=postgres
      - POSTGRES_PASSWORD=q1w2e3r4    # 演示口令，生产请换强口令并与 .env 保持一致
      - POSTGRES_DB=bewcloud
    restart: always
    volumes:
      - bewcloud-db:/var/lib/postgresql/18/docker
    ulimits:
      memlock:
        soft: -1
        hard: -1
    mem_limit: '256m'
    networks:
      - bewcloud-net

  radicale:
    image: tomsquest/docker-radicale:3.7.6.0
    container_name: bewcloud-v4.21.0-dav
    init: true
    read_only: true                    # Radicale 镜像按只读根文件系统设计
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - SETUID
      - SETGID
      - CHOWN
      - KILL
    restart: always
    volumes:
      - ./data-radicale:/data          # 日历/通讯录条目
      - ./radicale-config:/config:ro   # Radicale 配置（只读挂载）
    mem_limit: '256m'
    networks:
      - bewcloud-net

volumes:
  bewcloud-db:
    driver: local

networks:
  bewcloud-net:
    name: bewcloud-v4.21.0-net
    driver: bridge
    ipam:
      config:
        - subnet: 10.89.63.0/24

PORT=8000
POSTGRESQL_HOST="postgresql"
POSTGRESQL_USER="postgres"
POSTGRESQL_PASSWORD="q1w2e3r4"
POSTGRESQL_DBNAME="bewcloud"
POSTGRESQL_PORT=5432
POSTGRESQL_CAFILE=""
JWT_SECRET="bewcloud-demo-jwt-7a3f9c2e"
PASSWORD_SALT="bewcloud-demo-salt-4d8b1f6a"
#SMTP_USERNAME=""
#SMTP_PASSWORD=""

import { Config, PartialDeep } from './lib/types.ts';

const config: PartialDeep<Config> = {
  auth: {
    baseUrl: 'http://<服务器IP>:8155',   // 对外访问地址；浏览器可达即可
    allowSignups: false,                  // 关闭开放注册（第一个注册仍会放行并成为管理员）
    enableEmailVerification: false,       // 未配 SMTP，关邮箱验证
    enableForeverSignup: true,            // 注册即长期有效，不过期
    enableMultiFactor: false,             // 演示不启用 MFA
    skipCookieDomainSecurity: true,       // HTTP + IP 访问必须：跳过 Cookie 域安全校验
  },
  files: {
    rootPath: 'data-files',
    allowPublicSharing: true,             // 开启公共分享链接（实测要用）
    allowDirectoryDownloads: true,        // 允许目录打包下载
    maxUploadSizeInMegabytes: 100,        // 单文件上传上限 100MB
  },
  core: {
    enabledApps: ['dashboard', 'files', 'news', 'notes', 'photos', 'expenses', 'contacts', 'calendar'],
    maxRequestSizeInMegabytes: 12,        // 除上传外的请求体上限
  },
  visuals: {
    title: 'My own cloud',
    description: 'This is my own cloud!',
    helpEmail: '',
  },
  email: {
    from: 'help@bewcloud.com',
    host: 'localhost',
    port: 465,
    tlsMode: 'auto',
    tlsVerify: true,
  },
  contacts: {
    enableCardDavServer: true,
    cardDavUrl: 'http://radicale:5232',   // 编排内 Radicale 服务地址
  },
  calendar: {
    enableCalDavServer: true,
    calDavUrl: 'http://radicale:5232',
  },
};

export default config;

[server]
hosts = 0.0.0.0:5232

[auth]
type = http_x_remote_user

[storage]
filesystem_folder = /data/collections

[web]
type = none

[logging]
level = info
mask_passwords = True

cd /opt/bewcloud
docker compose up -d
docker compose ps

NAME                   IMAGE                               COMMAND                  SERVICE      CREATED          STATUS                    PORTS
bewcloud-v4.21.0-dav   tomsquest/docker-radicale:3.7.6.0   "docker-entrypoint.s…"   radicale     43 seconds ago   Up 43 seconds (healthy)   5232/tcp
bewcloud-v4.21.0-db    postgres:18.6                       "docker-entrypoint.s…"   postgresql   43 seconds ago   Up 43 seconds             5432/tcp
bewcloud-v4.21.0-web   ghcr.io/bewcloud/bewcloud:v4.21.0   "/tini -- docker-ent…"   website      13 seconds ago   Up 13 seconds             0.0.0.0:8155->8000/tcp, [::]:8155->8000/tcp

curl -sI http://<服务器IP>:8155/ | head -5

HTTP/1.1 303 See Other
content-type: text/plain;charset=UTF-8
location: /login
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true

docker compose run --rm website bash -c "cd /app && make migrate-db"

Container bewcloud-v4210-stack-website-run-4c60e33cd3b3 Creating
Container bewcloud-v4210-stack-website-run-4c60e33cd3b3 Created
deno task migrate-db
Task migrate-db deno task execute-with-permissions ./migrate-db.ts
Task execute-with-permissions deno run --allow-env --allow-net --allow-sys=networkInterfaces,hostname,cpus,homedir --allow-read=.,/ --allow-write=data-files,/ --allow-run './migrate-db.ts'
Running "001-base.pgsql"...
Success!
Running "002-news-app.pgsql"...
Success!
Running "003-expenses-app.pgsql"...
Success!
Running "004-public-file-sharing.pgsql"...
Success!
Running "005-authentication-challenges.pgsql"...
Success!

sudo chown -R 1993:1993 data-files
ls -ln data-files

$ ls -ln data-files
total 0

# 注册用户并上传文件后复查：
$ ls -ln data-files
total 4
drwxr-xr-x 6 1993 1993 4096 Oct 30 13:39 9d5ebad4-f6a7-4588-884e-f8c8c8ede632

curl -s http://<服务器IP>:8155/signup | grep -o '<title>[^<]*</title>'

<title>Signup - bewCloud</title>

curl -s -c /tmp/bewcloud-cookie.txt -X POST http://<服务器IP>:8155/login \
  -d 'email=admin@example.com&password=q1w2e3r4' \
  -o /dev/null -w '%{http_code} %{redirect_url}\n'

303 http://192.168.146.128:8155/

curl -s -b ~/bewcloud-cookie.txt -o /dev/null -w '%{http_code}\n' http://<服务器IP>:8155/dashboard

200

docker compose exec website grep -n 'My own cloud' /app/bewcloud.config.ts

23:    title: 'My own cloud',

# 1. 创建与 Compose 等价的 bridge 网络
docker network create --subnet 10.89.63.0/24 bewcloud-v4.21.0-net

# 2. PostgreSQL（数据卷 bewcloud-db）
docker run -d --name bewcloud-v4.21.0-db \
  --network bewcloud-v4.21.0-net \
  -e POSTGRES_USER=postgres -e POSTGRES_PASSWORD=q1w2e3r4 -e POSTGRES_DB=bewcloud \
  -v bewcloud-db:/var/lib/postgresql/18/docker \
  --memory 256m --restart always postgres:18.6

# 3. Radicale（只读根文件系统 + 最小能力集）
docker run -d --name bewcloud-v4.21.0-dav \
  --network bewcloud-v4.21.0-net --init --read-only \
  --security-opt no-new-privileges:true --cap-drop ALL \
  --cap-add SETUID --cap-add SETGID --cap-add CHOWN --cap-add KILL \
  -v /opt/bewcloud/data-radicale:/data \
  -v /opt/bewcloud/radicale-config:/config:ro \
  --memory 256m --restart always tomsquest/docker-radicale:3.7.6.0

# 4. bewCloud 应用（等 .env 写好、配置文件就位后）
docker run -d --name bewcloud-v4.21.0-web \
  --network bewcloud-v4.21.0-net \
  -p 8155:8000 --memory 256m --restart always \
  --env-file /opt/bewcloud/.env \
  -v /opt/bewcloud/data-files:/app/data-files \
  -v /opt/bewcloud/bewcloud.config.ts:/app/bewcloud.config.ts \
  ghcr.io/bewcloud/bewcloud:v4.21.0

# 5. 迁移（等价 docker compose run --rm website 的用法）
docker run --rm --network bewcloud-v4.21.0-net --env-file /opt/bewcloud/.env \
  ghcr.io/bewcloud/bewcloud:v4.21.0 bash -c "cd /app && make migrate-db"

docker compose ps                       # 三服务状态
docker compose logs website --tail 50   # 应用日志（排查登录/上传问题先看这里）
docker compose logs radicale --tail 30  # CalDAV/CardDAV 后端日志
docker compose restart website          # 改 bewcloud.config.ts 后重启生效
docker compose down                     # 停止并回收网络（数据卷与 bind 目录保留）
docker compose down -v                  # 连同数据库卷一起删除（危险：元数据全丢）
docker compose run --rm website bash -c "cd /app && make migrate-db"   # 升级后重跑迁移