ws: 使用宿主机版mysql，docker 不再起 mysql 容器

- docker-compose 移除 mysql 服务，agent/provision 通过 host.docker.internal
  连接宿主机 MySQL，连接信息通过 .env 配置
- 宿主机 binlog 目录只读挂载进 agent 容器，config 的 binlog_dir 覆盖为
  挂载点（避免 Windows 路径自动发现失败）
- provision 脚本 MySQL 连接参数化；e2e-test.sh 改用宿主机 mysql 客户端，
  启动前校验 binlog_format=ROW 并自动创建测试库
- 新增 .env.example；deploy/README.md 增加 Host MySQL setup 章节

Author: Developer

.env.example

@@ -0,0 +1,26 @@
+# ============================================================================
+# mysql-pitr docker compose — 宿主机 MySQL 配置
+# 复制为 .env 并填写后：docker compose up -d
+# ============================================================================
+
+# 宿主机 MySQL 连接（agent / provision 通过 host.docker.internal 访问）
+# Windows 下 Docker Desktop 内置 host.docker.internal；Linux 需在
+# docker-compose.yml 中保留 extra_hosts（已配置）
+MYSQL_HOST=host.docker.internal
+MYSQL_PORT=3306
+# 需要允许来自容器网段的访问，例如：
+#   CREATE USER 'pitr'@'%' IDENTIFIED BY '密码';
+#   GRANT SELECT, REPLICATION SLAVE, REPLICATION CLIENT ON *.* TO 'pitr'@'%';
+#   GRANT SELECT ON `你的库`.* TO 'pitr'@'%';
+# （用 root 也可以，但需授权 root@'%' 或 root@'172.%'）
+MYSQL_USER=root
+MYSQL_PASSWORD=你的MySQL密码
+MYSQL_DATABASE=mysql
+
+# 宿主机 MySQL 数据目录（包含 binlog 文件），只读挂载进 agent 容器。
+# Windows 默认：C:\ProgramData\MySQL\MySQL Server 8.0\Data
+# Linux 默认：/var/lib/mysql
+MYSQL_BINLOG_DIR_HOST=C:/ProgramData/MySQL/MySQL Server 8.0/Data
+
+# agent 加密配置口令（serve 启动时使用）
+PITR_PASSPHRASE=pitr-test

deploy/README.md

@@ -45,25 +45,71 @@ agent, issues its mTLS certificate from the server's internal CA, and writes
 the encrypted agent config — so `docker compose up` brings up a working
 agent-connected stack end to end.
 
+> **Using MySQL on the host?** The stack is configured for a host MySQL out
+> of the box — no MySQL container is started. See
+> [Host MySQL setup](#host-mysql-setup) below.
+
 ```bash
 git clone https://github.com/a-shan/mysql-pitr.git
 cd mysql-pitr
 
-# Start all services (provision runs once, then the agent connects)
+# 1. Configure the host MySQL connection (see .env.example)
+cp .env.example .env
+#    edit .env: MYSQL_PASSWORD, MYSQL_BINLOG_DIR_HOST, ...
+
+# 2. Start all services (provision runs once, then the agent connects)
 docker compose up -d
 
-# Watch the agent come online
+# 3. Watch the agent come online
 docker compose logs -f agent
 ```
 
 This starts:
 
-- **mysql** — MySQL 8.0 with binary logging enabled (required for PITR)
 - **provision** — one-shot: CA extraction, agent registration, cert issuance
-- **agent** — `mysql-pitr-agent serve`, connected to the server hub
+- **agent** — `mysql-pitr-agent serve`, connected to the server hub; reads
+  the **host** MySQL's binlog directory (mounted read-only)
 - **server** — web dashboard + API (`localhost:8080`) and the mTLS agent
   endpoint (`localhost:9443`)
 
+### Host MySQL setup
+
+The agent connects to MySQL on the host via `host.docker.internal` and reads
+the host's binlog files from a mounted directory. Prepare the host MySQL once:
+
+1. **Enable ROW binlog** — in `my.ini` under `[mysqld]`:
+
+   ```ini
+   log-bin=mysql-bin
+   binlog-format=ROW
+   binlog-row-image=FULL
+   ```
+
+   then restart the MySQL service. Windows example path for the data
+   directory: `C:\ProgramData\MySQL\MySQL Server 8.0\Data` (where the
+   `mysql-bin.*` files live).
+
+2. **Create a dedicated account** for the agent (containers connect from the
+   Docker bridge network, so `root@localhost` won't work):
+
+   ```sql
+   CREATE USER 'pitr'@'%' IDENTIFIED BY 'change-me';
+   GRANT SELECT, REPLICATION SLAVE, REPLICATION CLIENT ON *.* TO 'pitr'@'%';
+   GRANT SELECT ON `mydb`.* TO 'pitr'@'%';
+   ```
+
+3. **Fill in `.env`** (copy from `.env.example`):
+
+   | Variable | Description |
+   |---|---|
+   | `MYSQL_HOST` | `host.docker.internal` (Docker Desktop built-in) |
+   | `MYSQL_USER` / `MYSQL_PASSWORD` | the account above |
+   | `MYSQL_BINLOG_DIR_HOST` | host MySQL data dir, e.g. `C:/ProgramData/MySQL/MySQL Server 8.0/Data` |
+   | `PITR_PASSPHRASE` | passphrase for the encrypted agent config |
+
+   Linux note: if `host.docker.internal` does not resolve, use the host's LAN
+   IP in `MYSQL_HOST` and grant the account to `'pitr'@'%'`.
+
 ---
 
 ## Quick Start (systemd / bare metal)
@@ -176,11 +222,13 @@ target schema, `REPLICATION SLAVE`, `REPLICATION CLIENT`).
 
 ### Production docker-compose.yml
 
-Use the included `docker-compose.yml` as a starting point. For production:
+Use the included `docker-compose.yml` as a starting point (host MySQL — see
+[Host MySQL setup](#host-mysql-setup)). For production:
 
-1. **Change default passwords** — override `MYSQL_ROOT_PASSWORD` and the
-   provision/agent config values
-2. **Persist MySQL data** — named volumes are already mounted; keep them
+1. **Change default passwords** — set `MYSQL_PASSWORD` and `PITR_PASSPHRASE`
+   in `.env`; use a dedicated MySQL account instead of root
+2. **Persist volumes** — `server-data` (CA material) and `agent-data`
+   (checkpoints) are named volumes; keep them
 3. **Place the web server behind a reverse proxy** (nginx, Caddy, Traefik)
    with TLS; the agent endpoint (`:9443`) already speaks TLS with its own
    internal CA

docker-compose.yml

@@ -1,41 +1,39 @@
 version: '3.8'
 
-services:
-  mysql:
-    image: mysql:8.0
-    environment:
-      MYSQL_ROOT_PASSWORD: pitr_test
-      MYSQL_DATABASE: pitr_test
-    command: --binlog-format=ROW --binlog-row-image=FULL --log-bin=mysql-bin
-    ports:
-      - "3306:3306"
-    volumes:
-      - mysql-data:/var/lib/mysql
-    networks:
-      - pitr-network
-    healthcheck:
-      test: ["CMD", "mysqladmin", "ping", "-h", "localhost"]
-      interval: 10s
-      timeout: 5s
-      retries: 5
+# 使用宿主机 MySQL（不在 Docker 内另起 mysql 容器）。
+# 连接信息与 binlog 目录通过 .env 配置（参考 .env.example）：
+#   - agent / provision 通过 host.docker.internal 访问宿主机 MySQL
+#   - 宿主机的 MySQL 数据目录（含 binlog 文件）只读挂载进 agent 容器
+#   - 宿主机 MySQL 必须开启 binlog：log-bin=mysql-bin、binlog-format=ROW、
+#     binlog-row-image=FULL（Windows: my.ini 中 [mysqld] 段）
 
-  # One-shot provisioning: waits for the server CA, registers an agent via
-  # the API, issues its mTLS client certificate, and writes the encrypted
-  # agent config into the shared agent-config volume.
+services:
+  # 一次性初始化：提取 server CA → 通过 API 注册 agent → 签发 mTLS 证书 →
+  # 写入加密的 agent 配置（MySQL 连接指向宿主机）
   provision:
     build:
       context: .
       target: agent
     entrypoint: ["/bin/sh", "/scripts/e2e-provision.sh"]
     environment:
-      PITR_PASSPHRASE: pitr-test
+      PITR_PASSPHRASE: ${PITR_PASSPHRASE:-pitr-test}
+      MYSQL_HOST: ${MYSQL_HOST:-host.docker.internal}
+      MYSQL_PORT: ${MYSQL_PORT:-3306}
+      MYSQL_USER: ${MYSQL_USER:-root}
+      MYSQL_PASSWORD: ${MYSQL_PASSWORD}
+      MYSQL_DATABASE: ${MYSQL_DATABASE:-mysql}
+      # 容器内挂载点，config 的 binlog_dir 指向此处（覆盖 Windows 路径自动发现）
+      MYSQL_BINLOG_DIR: /var/lib/mysql
     depends_on:
       server:
         condition: service_started
     volumes:
       - ./scripts:/scripts:ro
       - server-data:/var/lib/mysql-pitr:ro
       - agent-config:/etc/agent
+      - ${MYSQL_BINLOG_DIR_HOST:?set MYSQL_BINLOG_DIR_HOST in .env (host MySQL data dir)}:/var/lib/mysql:ro
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
     networks:
       - pitr-network
     restart: "no"
@@ -44,14 +42,16 @@ services:
     build:
       context: .
       target: agent
-    command: ["serve", "--config=/etc/agent/config.json", "--passphrase=pitr-test"]
+    command: ["serve", "--config=/etc/agent/config.json", "--passphrase=${PITR_PASSPHRASE:-pitr-test}"]
     depends_on:
       provision:
         condition: service_completed_successfully
     volumes:
-      - mysql-data:/var/lib/mysql:ro
+      - ${MYSQL_BINLOG_DIR_HOST:?set MYSQL_BINLOG_DIR_HOST in .env (host MySQL data dir)}:/var/lib/mysql:ro
       - agent-config:/etc/agent:ro
       - agent-data:/var/lib/mysql-pitr
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
     networks:
       - pitr-network
     restart: unless-stopped
@@ -64,22 +64,17 @@ services:
       - "8080:8080"
       - "9443:9443"
     environment:
-      DATABASE_URL: "root:pitr_test@tcp(mysql:3306)/pitr_server"
       LISTEN_ADDR: ":8080"
       AGENT_LISTEN_ADDR: ":9443"
       AGENT_DATA_DIR: /var/lib/mysql-pitr
       AGENT_CERT_HOSTS: "server,localhost,127.0.0.1"
     volumes:
       - server-data:/var/lib/mysql-pitr
-    depends_on:
-      mysql:
-        condition: service_healthy
     networks:
       - pitr-network
     restart: unless-stopped
 
 volumes:
-  mysql-data:
   server-data:
   agent-data:
   agent-config:

scripts/e2e-provision.sh

@@ -1,12 +1,13 @@
 #!/bin/sh
 # ============================================================================
-# E2E provisioning: register an agent, issue its mTLS certificate from the
+# Provisioning: register an agent, issue its mTLS certificate from the
 # server's internal CA, and write the encrypted agent config.
 #
 # Runs once inside the `provision` compose service (agent image). Expects:
 #   - server:8080 reachable (REST API)
 #   - /var/lib/mysql-pitr/ca.json (server CA, created on server startup)
 #   - /etc/agent writable (agent-config volume)
+#   - MYSQL_HOST / MYSQL_PASSWORD etc. set by compose (host MySQL)
 # ============================================================================
 set -e
 
@@ -17,6 +18,14 @@ DATA_DIR="/var/lib/mysql-pitr"
 CONFIG_DIR="/etc/agent"
 PASSPHRASE="${PITR_PASSPHRASE:-pitr-test}"
 
+# Host MySQL connection (configured via .env, see docker-compose.yml).
+MYSQL_HOST="${MYSQL_HOST:-host.docker.internal}"
+MYSQL_PORT="${MYSQL_PORT:-3306}"
+MYSQL_USER="${MYSQL_USER:-root}"
+MYSQL_PASSWORD="${MYSQL_PASSWORD:?set MYSQL_PASSWORD in .env}"
+MYSQL_DATABASE="${MYSQL_DATABASE:-mysql}"
+MYSQL_BINLOG_DIR="${MYSQL_BINLOG_DIR:-/var/lib/mysql}"
+
 echo "[provision] waiting for server CA..."
 for i in $(seq 1 60); do
   [ -f "$DATA_DIR/ca.json" ] && break
@@ -77,19 +86,20 @@ echo "[provision] writing encrypted agent config..."
 cat > "$CONFIG_DIR/plain.json" <<EOF
 {
   "mysql": {
-    "host": "mysql",
-    "port": 3306,
-    "user": "root",
-    "password": "pitr_test",
-    "database": "pitr_test"
+    "host": "$MYSQL_HOST",
+    "port": $MYSQL_PORT,
+    "user": "$MYSQL_USER",
+    "password": "$MYSQL_PASSWORD",
+    "database": "$MYSQL_DATABASE"
   },
   "server": {
     "url": "wss://server:9443/ws/agent",
     "cert_file": "$CONFIG_DIR/client.pem",
     "key_file": "$CONFIG_DIR/client-key.pem",
     "ca_file": "$CONFIG_DIR/ca.pem"
   },
-  "data_dir": "/var/lib/mysql-pitr"
+  "data_dir": "/var/lib/mysql-pitr",
+  "binlog_dir": "$MYSQL_BINLOG_DIR"
 }
 EOF