# 1. 确认 Docker 与 Compose 版本（低于 v2.23 不支持 compose 内嵌 configs 语法）
docker --version && docker compose version

Docker version 27.5.1, build 9f9e405
Docker Compose version v5.6.1

# 2. 规划端口：确认 8128/8129 未被占用（避开 ClickHouse 默认 8123 与常见业务端口）
ss -ltn | grep -E ':(8128|8129)\b' || echo '端口空闲'

# 3. 内存余量确认（全家桶建议可用内存 ≥4GB）
free -h | grep Mem

端口空闲
Mem:           15Gi       7.9Gi       2.6Gi

mkdir -p /opt/rybbit && cd /opt/rybbit
curl -fsSL -o rybbit-2.9.2.tar.gz https://codeload.github.com/rybbit-io/rybbit/tar.gz/refs/tags/v2.9.2
tar xzf rybbit-2.9.2.tar.gz
cp rybbit-2.9.2/docker-compose.yml rybbit-2.9.2/Caddyfile .

# 浏览器实际访问 Rybbit 的基础地址（也是后端可信 Origin，必须与访问地址完全一致）
BASE_URL=http://192.168.1.200:8129
BETTER_AUTH_SECRET=rybbit-lab-9f3c7a1e5d2b8460-secret
DISABLE_SIGNUP=false
DISABLE_TELEMETRY=true

# 端口映射：看板 8128、API 8129（按宿主空闲端口改）
HOST_BACKEND_PORT=8129:3001
HOST_CLIENT_PORT=8128:3002

# 数据库凭据（生产务必改掉官方默认值）
CLICKHOUSE_DB=analytics
CLICKHOUSE_USER=default
CLICKHOUSE_PASSWORD=frog
POSTGRES_DB=analytics
POSTGRES_USER=frog
POSTGRES_PASSWORD=frog
REDIS_PASSWORD=rybbitRedis2026

# 镜像版本锁
IMAGE_TAG=v2.9.2

openssl rand -hex 32

name: rybbit-2.9.2-stack

networks:
  default:
    name: rybbit-292-net
    driver: bridge
    ipam:
      config:
        - subnet: 10.89.58.0/24

cd /opt/rybbit
docker compose pull
docker compose up -d

 Container backend Running
 Container client Running
 Container clickhouse Running
 Container rybbit-292-stack-postgres-1 Running
 Container redis Healthy
 Container clickhouse Healthy

# 1. 容器状态
docker compose ps --format 'table {{.Name}}\t{{.Status}}'

NAME                          STATUS
backend                       Up 43 seconds (healthy)
clickhouse                    Up 49 seconds (healthy)
client                        Up 43 seconds
redis                         Up 49 seconds (healthy)
rybbit-292-stack-postgres-1   Up 49 seconds (healthy)

# 2. 后端健康检查端点
curl -s http://127.0.0.1:8129/api/health

OK

# 3. 看板页面与 tracker 脚本可达性
curl -s -o /dev/null -w 'client HTTP %{http_code}\n' http://127.0.0.1:8128/
curl -s -o /dev/null -w 'script.js HTTP %{http_code} | %{size_download} bytes | %{content_type}\n' http://127.0.0.1:8129/api/script.js

client HTTP 200
script.js HTTP 200 | 33968 bytes | application/javascript; charset=utf-8

# 核心数据备份（ClickHouse 原生备份方式，停写窗口极小）
docker exec clickhouse clickhouse-client --password frog \
  -q "BACKUP TABLE analytics.events TO Disk('backups', 'events-$(date +%F).zip')"

# 1. 编辑 Caddyfile，把 {$DOMAIN} 换成你的域名
sed -i 's/{$DOMAIN}/analytics.example.com/' Caddyfile
# 2. .env 增加 BASE_URL 与域名
#    BASE_URL=https://analytics.example.com
# 3. 带 profile 启动（Caddy 会自动签发 Let's Encrypt 证书）
docker compose --profile with-webserver up -d

# ClickHouse（关键点：注入官方同款网络监听与异步插入配置）
docker run -d --name clickhouse \
  --memory 2560m \
  -e CLICKHOUSE_DB=analytics -e CLICKHOUSE_USER=default -e CLICKHOUSE_PASSWORD=frog \
  -e CLICKHOUSE_DEFAULT_ACCESS_MANAGEMENT=1 \
  -v clickhouse-data:/var/lib/clickhouse \
  clickhouse/clickhouse-server:26.3.17.4

# 后端（关键点：三个依赖地址 + BASE_URL 可信 Origin）
docker run -d --name backend \
  -p 8129:3001 \
  -e NODE_ENV=production \
  -e CLICKHOUSE_HOST=http://clickhouse:8123 \
  -e CLICKHOUSE_DB=analytics -e CLICKHOUSE_PASSWORD=frog \
  -e POSTGRES_HOST=postgres -e POSTGRES_DB=analytics \
  -e POSTGRES_USER=frog -e POSTGRES_PASSWORD=frog \
  -e REDIS_HOST=redis -e REDIS_PASSWORD=rybbitRedis2026 \
  -e BETTER_AUTH_SECRET=rybbit-lab-9f3c7a1e5d2b8460-secret \
  -e BASE_URL=http://192.168.1.200:8129 \
  -e CLUSTER_WORKERS=4 \
  ghcr.io/rybbit-io/rybbit-backend:v2.9.2

# 前端（关键点：仅依赖 backend 可达性）
docker run -d --name client \
  -p 8128:3002 \
  -e NODE_ENV=production \
  -e NEXT_PUBLIC_BACKEND_URL=http://192.168.1.200:8129 \
  ghcr.io/rybbit-io/rybbit-client:v2.9.2

cd /opt/rybbit
docker compose ps                          # 栈健康状态
docker compose logs -f backend             # 跟随后端日志（track/查询错误都在这）
docker compose restart backend client      # 只重启应用层（数据层不动）
docker compose down                        # 停栈保留数据卷
docker compose pull && docker compose up -d   # 升级到 .env 指定的新版本

# 1. 注册（Origin 头必须与 BASE_URL 一致，见 10.3 踩坑一）
curl -s -c /opt/rybbit/cookies.txt -X POST http://127.0.0.1:8129/api/auth/sign-up/email \
  -H 'Content-Type: application/json' -H 'Origin: http://192.168.1.200:8129' \
  -d '{"name":"admin","email":"admin@example.com","password":"Q1w2E3r4T!"}'

{"token":"MADSPPrOjRclxgEG7TUfBHEoE23HwA6f","user":{"name":"admin","email":"admin@example.com",...,"id":"VtzR6oiIVkL5xQREuwAxutXfY4XUAwfd"}}

# 2. 创建组织
curl -s -b /opt/rybbit/cookies.txt -X POST http://127.0.0.1:8129/api/auth/organization/create \
  -H 'Content-Type: application/json' -H 'Origin: http://192.168.1.200:8129' \
  -d '{"name":"Demo Org","slug":"demo-org"}'

{"name":"Demo Org","slug":"demo-org",...,"id":"lL3zKTX9RuNjYrSN1ahjXeAXBXfHiJzU","members":[{"role":"owner",...}]}

# 3. 在组织下建站（用上一步返回的组织 id）
curl -s -b /opt/rybbit/cookies.txt -X POST \
  http://127.0.0.1:8129/api/organizations/lL3zKTX9RuNjYrSN1ahjXeAXBXfHiJzU/sites \
  -H 'Content-Type: application/json' -H 'Origin: http://192.168.1.200:8129' \
  -d '{"name":"Demo Site","domain":"demo.example.com"}'

{"id":"2c0b9eb7c6a2","siteId":1,"name":"Demo Site",...,"blockBots":true,...}

# 4. 上报一条页面浏览事件（site_id 用建站返回的短 id 2c0b9eb7c6a2）
curl -s -X POST http://127.0.0.1:8129/api/track \
  -H 'Content-Type: application/json' \
  -H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/140.0 Safari/537.36' \
  -d '{"type":"pageview","site_id":"2c0b9eb7c6a2","hostname":"demo.example.com","pathname":"/posts/hello-1","page_title":"测试文章","screenWidth":1920,"screenHeight":1080,"language":"zh-CN","anonymous_id":"visitor-1"}'

{"success":true}

curl -s -H "Authorization: Bearer <你的APIKey>" 'http://127.0.0.1:8129/api/sites/1/overview?period=24h'

{"data":{"sessions":3,"pages_per_session":1.6666666666666667,"bounce_rate":33.33333333333333,"session_duration":0,"pageviews":5,"users":3}}