AegisGate/docker-compose.yml at main · ax128/AegisGate · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
# 默认基础部署：仅启动 AegisGate。

services:
  aegisgate:
    build:
      context: .
      dockerfile: Dockerfile
    container_name: aegisgate
    user: "10001:10001"
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    ports:
      - "127.0.0.1:18080:18080"
    expose:
      - "18080"
    networks:
      - default
      - cliproxy_net
      - sub2api_net
    extra_hosts:
      - "host.docker.internal:host-gateway"
    env_file:
      - path: ./config/.env
        required: false
    environment:
      AEGIS_ENV: "prod"
      AEGIS_HOST: "0.0.0.0"
      AEGIS_PORT: "18080"
      AEGIS_ENFORCE_LOOPBACK_ONLY: "false"
      # 可选：配置后可直接请求 /v1/...（单上游直连模式）
      AEGIS_UPSTREAM_BASE_URL: "${AEGIS_UPSTREAM_BASE_URL:-}"
      AEGIS_SQLITE_DB_PATH: "/app/logs/aegisgate.db"
      AEGIS_AUDIT_LOG_PATH: "/app/logs/audit.jsonl"
      AEGIS_GW_TOKENS_PATH: "/app/aegisgate/policies/rules/gw_tokens.json"
      AEGIS_INIT_STRICT: "true"
      AEGIS_BOOTSTRAP_RULES_DIR: "/app/bootstrap/rules"
      AEGIS_SECURITY_RULES_PATH: "/app/aegisgate/policies/rules/security_filters.yaml"
      # 本地端口自动路由：/v1/__gw__/t/{port}/... → http://host.docker.internal:{port}/v1/...
      AEGIS_ENABLE_LOCAL_PORT_ROUTING: "${AEGIS_ENABLE_LOCAL_PORT_ROUTING:-true}"
      AEGIS_LOCAL_PORT_ROUTING_HOST: "${AEGIS_LOCAL_PORT_ROUTING_HOST:-host.docker.internal}"
      # Docker 上游自动注入（启动时自动注册 token → Docker 服务名，优先级高于端口路由）
      # 格式：token:service[:port]，逗号分隔。port 省略时默认等于 token。
      # 改名/改端口：直接修改此变量，重启网关即生效。
      AEGIS_DOCKER_UPSTREAMS: "${AEGIS_DOCKER_UPSTREAMS:-8317:cli-proxy-api,8080:sub2api,3000:aiclient2api}"
    volumes:
      - ./logs:/app/logs:rw
      - ./config:/app/aegisgate/policies/rules:rw
      - ./config:/app/config:rw
    tmpfs:
      - /tmp
    restart: unless-stopped

networks:
  cliproxy_net:
    external: true
    name: ${CLIPROXY_NETWORK:-cliproxyapi_default}
  sub2api_net:
    external: true
    name: ${SUB2API_NETWORK:-sub2api-deploy_sub2api-network}