mongodb/mongodb-community-server:8.0-ubi8       1.37GB
rocketchat/rocket.chat:8.9.0    1.6GB

grep -o 'avx[^ ]*' /proc/cpuinfo | sort -u | head -3

avx
avx2

docker --version && docker compose version

Docker version 29.8.1, build 4a63305
Docker Compose version v5.5.1

ss -ltn | grep -E ':(8133|9458) ' || echo "端口空闲"

端口空闲

mkdir -p /opt/rocketchat-compose && cd /opt/rocketchat-compose

name: rocketchat-8.9.0-stack

services:
  rocketchat:
    image: docker.io/rocketchat/rocket.chat:8.9.0
    container_name: rocketchat-8.9.0-app
    restart: always
    environment:
      ROOT_URL: http://192.168.146.128:8133
      PORT: "3000"
      DEPLOY_METHOD: docker
      DEPLOY_PLATFORM: compose
      MONGO_URL: mongodb://mongodb:27017/rocketchat?replicaSet=rs0
      TRANSPORTER: monolith+nats://nats:4222
      OVERWRITE_SETTING_Prometheus_Enabled: "true"
      OVERWRITE_SETTING_Prometheus_Port: "9458"
    ports:
      - "8133:3000"
      - "9458:9458"
    volumes:
      - ./uploads:/app/uploads
    depends_on:
      mongodb:
        condition: service_healthy
      mongodb-init:
        condition: service_completed_successfully
    healthcheck:
      test: ["CMD", "node", "-e", "require('http').get('http://localhost:3000/api/info', r => process.exit(r.statusCode === 200 ? 0 : 1)).on('error', () => process.exit(1))"]
      interval: 30s
      timeout: 10s
      retries: 10
      start_period: 180s
    networks:
      - rocketchat-net

  mongodb-fix-permission:
    image: docker.io/mongodb/mongodb-community-server:8.0-ubi8
    container_name: rocketchat-8.9.0-mongodb-fixperm
    restart: on-failure
    user: "0"
    volumes:
      - mongodb_data:/data/db:rw
    environment:
      MONGODB_USER_ID: "1001"
    entrypoint: |
      sh -xc '
        owner="$(stat -c %u /data/db)";
        if [ "$$owner" != "$$MONGODB_USER_ID" ]; then
          echo "=====> Fixing directory ownership to uid $$MONGODB_USER_ID";
          chown -R "$$MONGODB_USER_ID" /data/db;
        else echo "=====> Nothing to do"; fi;
      '
    networks:
      - rocketchat-net

  mongodb:
    image: docker.io/mongodb/mongodb-community-server:8.0-ubi8
    container_name: rocketchat-8.9.0-mongodb
    restart: always
    user: "1001"
    command: ["mongod", "--replSet", "rs0", "--bind_ip_all"]
    depends_on:
      mongodb-fix-permission:
        condition: service_completed_successfully
    volumes:
      - mongodb_data:/data/db
    healthcheck:
      test: ["CMD", "mongosh", "mongodb://mongodb:27017/?directConnection=true", "--eval", "db.adminCommand('ping')"]
      interval: 30s
      timeout: 10s
      retries: 10
      start_period: 30s
    networks:
      - rocketchat-net

  mongodb-init:
    image: docker.io/mongodb/mongodb-community-server:8.0-ubi8
    container_name: rocketchat-8.9.0-mongodb-init
    restart: on-failure
    depends_on:
      mongodb:
        condition: service_healthy
    entrypoint: |
      sh -c '
        echo "=====> Waiting for MongoDB to be healthy before initiating replica set...";
        until mongosh "mongodb://mongodb:27017/?directConnection=true" --eval "db.adminCommand(\"ping\")" >/dev/null 2>&1; do
          echo "=====> MongoDB not ready yet, retrying in 5 seconds...";
          sleep 5;
        done;
        echo "=====> Initiating ReplSet rs0 at mongodb:27017...";
        mongosh "mongodb://mongodb:27017/?directConnection=true" --eval "rs.initiate({_id: \"rs0\", members: [{ _id: 0, host: \"mongodb:27017\" }]})";
        echo "=====> Initiating ReplSet done...";
      '
    networks:
      - rocketchat-net

  nats:
    image: docker.io/nats:2.11-alpine
    container_name: rocketchat-8.9.0-nats
    restart: always
    command: --http_port 8222
    networks:
      - rocketchat-net

volumes:
  mongodb_data:
    driver: local

networks:
  rocketchat-net:
    driver: bridge
    name: rocketchat-8.9.0-net
    ipam:
      config:
        - subnet: 10.89.56.0/24

docker compose up -d

docker compose ps

NAME                       IMAGE                                                 COMMAND                   SERVICE      CREATED       STATUS                 PORTS
rocketchat-8.9.0-app       docker.io/rocketchat/rocket.chat:8.9.0                "docker-entrypoint.s…"   rocketchat   3 hours ago   Up 3 hours (healthy)   0.0.0.0:9458->9458/tcp, [::]:9458->9458/tcp, 0.0.0.0:8133->3000/tcp, [::]:8133->3000/tcp
rocketchat-8.9.0-mongodb   docker.io/mongodb/mongodb-community-server:8.0-ubi8   "python3 /usr/local/…"   mongodb      3 hours ago   Up 3 hours (healthy)   27017/tcp
rocketchat-8.9.0-nats      docker.io/nats:2.11-alpine                            "docker-entrypoint.s…"   nats         3 hours ago   Up 3 hours             4222/tcp, 6222/tcp, 8222/tcp

=====> Waiting for MongoDB to be healthy before initiating replica set...
=====> Initiating ReplSet rs0 at mongodb:27017...
{
  ok: 1,
  '$clusterTime': {
    clusterTime: Timestamp({ t: 1792567266, i: 1 }),
    signature: {
      hash: Binary.createFromBase64('AAAAAAAAAAAAAAAAAAAAAAAAAAA=', 0),
      keyId: Long('0')
    }
  },
  operationTime: Timestamp({ t: 1792567266, i: 1 })
}
=====> Initiating ReplSet done...

{"level":30,"time":"2026-10-21T07:27:59.681Z","pid":1,"hostname":"d98e32ad8e66","name":"homeserver","name":"DatabaseConnectionService","msg":"Connected to MongoDB database: rocketchat"}
[2026-10-21T07:27:59.659Z] INFO  82acd873-8888-4763-b559-f3dd4e994ed7/TRANSPORTER: NATS lib version: 2.28.2
[2026-10-21T07:27:59.659Z] INFO  82acd873-8888-4763-b559-f3dd4e994ed7/BROKER: Transporter: NatsTransporter
[2026-10-21T07:28:00.713Z] INFO  82acd873-8888-4763-b559-f3dd4e994ed7/TRANSPORTER: NATS client v2 is connected.

docker exec rocketchat-8.9.0-mongodb mongosh "mongodb://mongodb:27017/?directConnection=true" --quiet --eval 'JSON.stringify({set: rs.status().set, ok: rs.status().ok, members: rs.status().members.map(m=>({name:m.name, stateStr:m.stateStr, health:m.health}))})'

{"set":"rs0","ok":1,"members":[{"name":"mongodb:27017","stateStr":"PRIMARY","health":1}]}

docker exec rocketchat-8.9.0-mongodb mongosh --quiet --eval 'db.version()'

8.0.34

curl -s http://192.168.146.128:8133/api/info

{"workspaceUrl":"192.168.146.128:8133","hashedWorkspaceUrl":"d9bc7db85cea027e994162a01fc0f50c839661786c3cc6ef777a5995f16","version":"8.9","minimumClientVersions":{"desktop":"3.9.6","mobile":"4.39.0"},"supportedVersions":{"signed":"eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9…"},"cloudWorkspaceId":"","success":true}

curl -s -o /dev/null -w 'HTTP %{http_code}, %{size_download} bytes\n' http://192.168.146.128:8133/

HTTP 200, 1864 bytes

                                      SERVER RUNNING
|  Rocket.Chat Version: 8.9.0
|       NodeJS Version: 24.15.0 - x64
|      MongoDB Version: 8.0.34
|       MongoDB Engine: wiredTiger
|      OpenSSL Version: 3.5.5

docker exec rocketchat-8.9.0-mongodb mongosh "mongodb://mongodb:27017/rocketchat?replicaSet=rs0" --quiet --eval 'db.users.find({username:"admin"},{username:1,name:1,roles:1}).forEach(u=>print(JSON.stringify(u)))'

{"_id":"FAqZDu2LStf9g6nku","name":"Administrator","roles":["user","admin"],"username":"admin"}

curl -s -X POST http://192.168.146.128:8133/api/v1/login -H 'Content-Type: application/json' -d '{"user":"admin","password":"q1w2e3r4"}'

{"status":"success","data":{"userId":"FAqZDu2LStf9g6nku","authToken":"0fyO47KgmJq3mH7HYe3jDiZE3sIPv8M021YLQ8UWFUl","me":{"_id":"FAqZDu2LStf9g6nku","services":{"password":{"exists":true}},"emails":[{"address":"admin@example.com","verified":false}],"name":"Administrator","roles":["user","admin"],…}}}

sudo apt update && sudo apt install -y certbot
sudo certbot certonly --standalone --email admin@example.com -d chat.example.com

server {
    listen 443 ssl;
    server_name chat.example.com;
    ssl_certificate /etc/letsencrypt/live/chat.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/chat.example.com/privkey.pem;
    ssl_protocols TLSv1.2 TLSv1.3;

    location / {
        proxy_pass http://localhost:8133/;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
        proxy_redirect off;
    }
}
server {
    listen 80;
    server_name chat.example.com;
    return 301 https://$host$request_uri;
}

sudo ln -s /etc/nginx/sites-available/rocketchat /etc/nginx/sites-enabled/
sudo nginx -t

nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful

    environment:
      ROOT_URL: https://chat.example.com

docker compose stop rocketchat && docker compose rm -f rocketchat && docker compose up -d rocketchat

curl -sI https://chat.example.com/api/info | head -4

HTTP/1.1 200 OK
X-XSS-Protection: 1
X-Content-Type-Options: nosniff
X-Frame-Options: sameorigin

docker volume ls | grep rocket

local     rocketchat-890-stack_mongodb_data

docker volume inspect rocketchat-890-stack_mongodb_data --format '{{.Name}} | {{.Mountpoint}}'

rocketchat-890-stack_mongodb_data | /var/lib/docker/volumes/rocketchat-890-stack_mongodb_data/_data

# 备份：导出为单文件归档 db.dump
docker exec rocketchat-8.9.0-mongodb sh -c 'mongodump --archive' > db.dump

# 恢复：从归档流导入
docker exec -i rocketchat-8.9.0-mongodb sh -c 'mongorestore --archive' < db.dump

curl -s -o /dev/null -w 'prometheus metrics: HTTP %{http_code}\n' http://192.168.146.128:9458/metrics

prometheus metrics: HTTP 200

    volumes:
      - ./uploads:/app/uploads

total 8
drwxr-xr-x 2 root root 4096 10月 21 15:21 .
drwxr-xr-x 3 root root 4096 10月 21 15:21 ..

# 1. 内网与一次性初始化任务（副本集必须在应用启动前 rs.initiate）
docker network create --driver bridge --subnet 10.89.56.0/24 rocketchat-8.9.0-net

docker run -d --name rocketchat-8.9.0-mongodb \
  --network rocketchat-8.9.0-net --user 1001 \
  docker.io/mongodb/mongodb-community-server:8.0-ubi8 \
  mongod --replSet rs0 --bind_ip_all

docker run --rm --network rocketchat-8.9.0-net \
  docker.io/mongodb/mongodb-community-server:8.0-ubi8 \
  mongosh "mongodb://mongodb:27017/?directConnection=true" \
  --eval 'rs.initiate({_id: "rs0", members: [{ _id: 0, host: "mongodb:27017" }]})'

# 2. NATS 服务总线
docker run -d --name rocketchat-8.9.0-nats \
  --network rocketchat-8.9.0-net \
  docker.io/nats:2.11-alpine --http_port 8222

# 3. Rocket.Chat 应用（等价于 compose 内的全部 environment/ports/volumes）
docker run -d --name rocketchat-8.9.0-app \
  --network rocketchat-8.9.0-net \
  -p 8133:3000 -p 9458:9458 \
  -e ROOT_URL=http://192.168.146.128:8133 \
  -e PORT=3000 \
  -e MONGO_URL=mongodb://mongodb:27017/rocketchat?replicaSet=rs0 \
  -e TRANSPORTER=monolith+nats://nats:4222 \
  -e OVERWRITE_SETTING_Prometheus_Enabled=true \
  -e OVERWRITE_SETTING_Prometheus_Port=9458 \
  -v /opt/rocketchat-compose/uploads:/app/uploads \
  --restart always \
  docker.io/rocketchat/rocket.chat:8.9.0

docker compose stop rocketchat      # 只停应用（升级/改环境变量前）
docker compose up -d rocketchat     # 启动应用
docker compose restart rocketchat   # 原地重启
docker compose ps                   # 常驻服务状态
docker compose ps -a                # 含一次性任务（mongodb-init 等）

docker compose logs -f rocketchat          # 实时跟踪应用日志
docker compose logs --tail 10 rocketchat   # 最近 10 行

# 1. 修改镜像标签
sed -i 's|rocket.chat:8.9.0|rocket.chat:8.10.0|' docker-compose.yml
# 2. 拉新镜像并只重建应用服务
docker compose up -d rocketchat
# 3. 验证新版本
curl -s http://192.168.146.128:8133/api/info | grep -o '"version":"[^"]*"'

=====> Initiating ReplSet rs0 at mongodb:27017...
{
  ok: 1,
  ...
}
=====> Initiating ReplSet done...
=====> Waiting for MongoDB to be healthy before initiating replica set...
=====> Initiating ReplSet rs0 at mongodb:27017...
MongoServerError: already initialized
=====> Initiating ReplSet done...

{"level":50,"time":"2026-10-21T07:28:00.158Z","pid":1,"hostname":"d98e32ad8e66","name":"System","msg":"Failed to communicate with Rocket.Chat Cloud","url":"https://releases.rocket.chat/v2/server/supportedVersions","err":{"type":"FetchError","message":"request to https://releases.rocket.chat/v2/server/supportedVersions failed, reason: ","errno":"ETIMEDOUT","code":"ETIMEDOUT","name":"FetchError"}}

### chat.postMessage
{"success":false,"error":"restricted-workspace"}

# 1. 生成正确哈希（在任意有 node 的环境；也可用 python bcrypt 库按同样两步生成）
node -e "const crypto=require('crypto'); const sha=crypto.createHash('sha256').update('q1w2e3r4').digest('hex'); console.log(require('bcrypt').hashSync(sha, 10));"
# 输出形如 $2b$10$pdjnA7791GtDgDZH.qcqQ.jTbooJEfOt2AXS2SLJrqSrrUrlAGli6

# 2. 写入数据库
mongosh "mongodb://mongodb:27017/rocketchat?replicaSet=rs0" --eval 'db.users.updateOne({username:"admin"}, {$set:{"services.password.bcrypt":"<上一步哈希>"}})'

# 3. 数秒内生效（变更流同步缓存），直接登录验证

cd /opt/rocketchat-compose
docker compose down -v    # 停止并删除服务、网络，-v 连同命名卷一并删除
rm -rf /opt/rocketchat-compose   # 如不再需要，删除部署目录（含 uploads 附件）

docker compose down       # 不带 -v，命名卷保留