从零部署一套 Umami

services:
  umami:
    # 官方镜像不支持运行时 BASE_PATH，需用 --build-arg BASE_PATH=/Umami 自建
    image: umami-123one:3.4.0
    container_name: umami
    restart: always
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"
    ports:
      - "127.0.0.1:3010:3000"
    volumes:
      # 构建时用 SKIP_BUILD_GEO=1 时必需，否则 /api/send 会 500
      - ./geo:/app/geo:ro
    environment:
      DATABASE_URL: postgresql://umami:${POSTGRES_PASSWORD}@db:5432/umami
      APP_SECRET: ${APP_SECRET}
      TWO_FACTOR_ENCRYPTION_KEY: ${TWO_FACTOR_ENCRYPTION_KEY}
      BASE_PATH: /Umami
      DISABLE_TELEMETRY: 1
      DISABLE_UPDATES: 1
      DEFAULT_LOCALE: zh-CN
      DEFAULT_CURRENCY: CNY
    depends_on:
      db:
        condition: service_healthy
    mem_limit: 768m
    healthcheck:
      test: ["CMD-SHELL", "curl -fsS http://127.0.0.1:3000/Umami/api/heartbeat || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 6
      start_period: 60s

  db:
    image: postgres:15-alpine
    container_name: umami-db
    restart: always
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"
    environment:
      POSTGRES_DB: umami
      POSTGRES_USER: umami
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      TZ: UTC
    volumes:
      - umami-db:/var/lib/postgresql/data
    mem_limit: 512m
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U umami -d umami"]
      interval: 10s
      timeout: 5s
      retries: 6

volumes:
  umami-db:

# /opt/umami/.env —— 权限设为 600，不要提交到 Git
POSTGRES_PASSWORD=把这里换成随机密码
APP_SECRET=把这里换成 openssl rand -hex 32 的结果
TWO_FACTOR_ENCRYPTION_KEY=把这里换成 openssl rand -hex 32 的结果

# 1. 建目录
sudo mkdir -p /opt/umami && cd /opt/umami

# 2. 写入 docker-compose.yml（内容见上一节）
sudo nano docker-compose.yml

# 3. 生成 .env（三个随机值一次写入）
umask 077
{
  echo "POSTGRES_PASSWORD=$(openssl rand -hex 24)"
  echo "APP_SECRET=$(openssl rand -hex 32)"
  echo "TWO_FACTOR_ENCRYPTION_KEY=$(openssl rand -hex 32)"
} > .env
chmod 600 .env

# 4. 启动
sudo docker compose up -d

# 5. 等待健康检查通过
sudo docker compose ps
curl -fsS http://127.0.0.1:3010/Umami/api/heartbeat && echo " OK"

# 注意：Umami 的 BASE_PATH 是大写 /Umami
# 不要写 location = /Umami { return 301 .../Umami/; }
# Next.js 会把 /Umami/ 归一化为 /Umami，补斜杠会造成无限重定向
location ^~ /Umami {
    proxy_pass http://127.0.0.1:3010;   # 结尾不要加 /，否则路径会被剥掉
    proxy_http_version 1.1;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_read_timeout 120s;
    proxy_buffering off;
    # 后台/登录页不需要被搜索引擎收录
    add_header X-Robots-Tag "noindex, nofollow" always;
    client_max_body_size 10m;
}

# 先备份，再改配置
sudo cp /www/server/panel/vhost/nginx/120.26.18.73.conf \
        /www/server/panel/vhost/nginx/120.26.18.73.conf.bak-$(date +%F)

# 把上面的 location 粘进 server { ... } 里，然后：
sudo nginx -t && sudo nginx -s reload

# 验证（三条都应返回 200 / 301）
curl -I https://123one.online/Umami
curl -I https://123one.online/Umami/login
curl -I https://123one.online/Umami/script.js

# 手动备份（输出到 /opt/umami/backup/）
cd /opt/umami
mkdir -p backup
docker exec umami-db pg_dump -U umami umami \
  | gzip > "backup/umami-$(date +%F-%H%M).sql.gz"

# 只保留最近 30 天
find backup -name "umami-*.sql.gz" -mtime +30 -delete

# 每天凌晨 3:10 自动备份，日志写到 /var/log/umami-backup.log
10 3 * * * cd /opt/umami && mkdir -p backup && docker exec umami-db pg_dump -U umami umami | gzip > "backup/umami-$(date +\%F).sql.gz" >> /var/log/umami-backup.log 2>&1 && find backup -name "umami-*.sql.gz" -mtime +30 -delete

cd /opt/umami

# 查看状态 / 日志
docker compose ps
docker compose logs -f --tail=100 umami

# 重启应用
docker compose restart umami

# 升级（先备份，再拉新镜像）
docker compose pull
docker compose up -d
docker compose ps

# 资源占用
docker stats --no-stream umami umami-db

# 恢复某个备份（会覆盖现有数据，务必先停应用）
cd /opt/umami
docker compose stop umami
gunzip -c backup/umami-2026-01-01.sql.gz \
  | docker exec -i umami-db psql -U umami -d umami
docker compose start umami