add Dockerfile + docker-compose: single-image deploy (nginx + backend)

Multi-stage build: node builds frontend dist, golang builds static
binary (modernc sqlite, CGO off), alpine runtime runs nginx :80 +
backend :8890 in one container. nginx serves SPA with fallback, strips
/api prefix (same as vite dev proxy), proxies protocol endpoints
(/mcp, /m/*, /v1/*, /d/*, /ws/*, *.php) with buffering off for
NDJSON/SSE streams and WS upgrade headers.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

.dockerignore

@@ -0,0 +1,14 @@
+.git
+node_modules
+frontend/node_modules
+frontend/dist
+backend/data
+backend/cyibox
+docs
+*.log
+*.db
+*.db-shm
+*.db-wal
+.dockerignore
+Dockerfile
+docker-compose.yml

Dockerfile

@@ -0,0 +1,33 @@
+# ---------- 前端构建 ----------
+FROM node:22-alpine AS web
+WORKDIR /app/frontend
+COPY frontend/package.json frontend/package-lock.json ./
+RUN npm ci --no-audit --no-fund
+COPY frontend/ .
+RUN npm run build
+
+# ---------- 后端构建 ----------
+FROM golang:1-alpine AS api
+WORKDIR /app/backend
+COPY backend/go.mod backend/go.sum ./
+RUN go mod download
+COPY backend/ .
+# modernc.org/sqlite 纯 Go 实现，零 CGO 静态二进制
+RUN CGO_ENABLED=0 go build -ldflags="-s -w" -o /cyibox ./cmd/server
+
+# ---------- 运行时 ----------
+FROM alpine:3.21
+RUN apk add --no-cache nginx ca-certificates tzdata
+WORKDIR /app
+COPY --from=api /cyibox /app/cyibox
+COPY --from=web /app/frontend/dist /app/web/dist
+COPY docker/nginx.conf /etc/nginx/http.d/default.conf
+COPY docker/entrypoint.sh /entrypoint.sh
+RUN chmod +x /entrypoint.sh && mkdir -p /app/data
+
+ENV CYIBOX_PORT=8890 \
+    CYIBOX_DB=/app/data/cyibox.db
+
+EXPOSE 80
+VOLUME ["/app/data"]
+ENTRYPOINT ["/entrypoint.sh"]

README.md

@@ -47,6 +47,19 @@ make build    # go build + vite build → backend/cyibox + frontend/dist
 
 `cyibox` 单二进制即可跑（数据库首启自动创建于 `./data/cyibox.db`）；前端 dist 用任意静态服务/反代托管，把 `/api`、`/mcp`、`/m`、`/v1`、`/d` 等前缀转发到后端即可。
 
+## Docker Compose（推荐部署方式）
+
+```bash
+docker compose up -d --build
+```
+
+打开 `http://<宿主机>:8890`（compose 里 `8890:80`，左侧端口随意改）。单容器内含：nginx（托管前端 + 反代）+ 后端二进制，`/app/data` 卷承载 SQLite、vault.key 与网盘文件。
+
+```bash
+CYIBOX_ADMIN_PASSWORD=<强密码> docker compose up -d --build   # 自定义初始管理员密码
+docker compose logs -f                                       # 看日志
+```
+
 ## 环境变量
 
 | 变量 | 默认 | 说明 |

docker-compose.yml

@@ -0,0 +1,17 @@
+services:
+  cyibox:
+    build: .
+    image: cyi-box:latest
+    container_name: cyibox
+    ports:
+      - "8890:80"          # 对外端口，左侧可改成任意宿主端口
+    volumes:
+      - cyibox-data:/app/data   # SQLite + vault.key + 网盘文件都落这里
+    environment:
+      CYIBOX_ADMIN_PASSWORD: ${CYIBOX_ADMIN_PASSWORD:-admin123}   # 首启种子管理员密码，建议改
+      # CYIBOX_ADMIN_NAME: admin
+      # CYIBOX_CORS: "https://a.com,https://b.com"
+    restart: unless-stopped
+
+volumes:
+  cyibox-data:

docker/entrypoint.sh

@@ -0,0 +1,15 @@
+#!/bin/sh
+set -e
+
+# 后端跑在容器内 8890，nginx 对外 80（托管前端 + 反代 API/协议端点）
+/app/cyibox &
+API_PID=$!
+
+trap 'kill -TERM $API_PID 2>/dev/null' TERM INT
+
+nginx -g 'daemon off;' &
+NGINX_PID=$!
+
+wait $NGINX_PID
+kill -TERM $API_PID 2>/dev/null || true
+wait $API_PID 2>/dev/null || true

docker/nginx.conf

@@ -0,0 +1,81 @@
+server {
+    listen 80;
+    server_name _;
+    root /app/web/dist;
+    index index.html;
+
+    client_max_body_size 512m;
+
+    # 前端 RPC 约定走 /api 前缀，反代时剥掉（与 vite dev proxy 行为一致）
+    # /cell 同时承载 fun.Stream 的 NDJSON 长连接，必须关缓冲
+    location /api/ {
+        proxy_pass http://127.0.0.1:8890/;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header Connection "";
+        proxy_buffering off;
+        proxy_read_timeout 3600s;
+    }
+
+    # 对外协议端点（不带 /api 前缀，给第三方直接调）：
+    #   /mcp        Streamable HTTP MCP（SSE 推送，关缓冲）
+    #   /m/*        记忆阅读签名链接
+    #   /v1/*       授权校验 / 代理提取
+    #   /d/*        网盘分享下载
+    #   /files/*    SFTP 上传下载
+    #   /ws/*       SSH 终端 WebSocket
+    #   /disk/*     网盘上传下载
+    #   /dbm/*      数据库导入导出
+    #   *.php       Epay 兼容支付端点
+    location ~ ^/(cell|mcp|healthz|m)$ {
+        proxy_pass http://127.0.0.1:8890;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_buffering off;
+        proxy_read_timeout 3600s;
+    }
+
+    location ~ ^/(m|d|v1|files|disk|dbm)/ {
+        proxy_pass http://127.0.0.1:8890;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_buffering off;
+    }
+
+    location ~ ^/ws/ {
+        proxy_pass http://127.0.0.1:8890;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_buffering off;
+        proxy_read_timeout 3600s;
+    }
+
+    location ~ ^/(submit|mapi|api)\.php$ {
+        proxy_pass http://127.0.0.1:8890;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    }
+
+    # SPA 前端路由兜底
+    location / {
+        try_files $uri $uri/ /index.html;
+    }
+
+    location ~* \.(js|css|woff2?|ttf|png|jpe?g|svg|ico|webp)$ {
+        try_files $uri =404;
+        expires 7d;
+    }
+}