docker-compose.prod.cn.yml

# =============================================
# AutoCVE V1.0.5 生产环境一键部署配置（国内加速版）
# =============================================
# 使用南京大学镜像站加速拉取 GHCR 镜像
# 部署命令: curl -fsSL https://raw.githubusercontent.com/larlarua/AutoCVE/v1.0.5/docker-compose.prod.cn.yml | docker compose -f - up -d
# 镜像加速说明：
# - 原始地址：ghcr.io
# - 加速地址：ghcr.nju.edu.cn（南京大学开源镜像站）

services:
  db:
    image: postgres:15-alpine
    restart: unless-stopped
    volumes:
      - postgres_data:/var/lib/postgresql/data
    environment:
      - POSTGRES_USER=postgres
      - POSTGRES_PASSWORD=postgres
      - POSTGRES_DB=${POSTGRES_DB_NAME:-autocve}
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres"]
      interval: 5s
      timeout: 5s
      retries: 5
    networks:
      - autocve-network

  redis:
    image: redis:7-alpine
    restart: unless-stopped
    volumes:
      - redis_data:/data
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - autocve-network

  backend:
    image: ghcr.nju.edu.cn/larlarua/autocve-backend:v1.0.5
    restart: unless-stopped
    cpus: "1.0"
    mem_limit: 1g
    volumes:
      - backend_uploads:/app/uploads
      - skill_library:/app/skill_library
      - report_template_library:/app/report_template_library
      - ./projects:/workspace/projects
      - /var/run/docker.sock:/var/run/docker.sock
    ports:
      - "8000:8000"
    environment:
      - DATABASE_URL=postgresql+asyncpg://postgres:postgres@db:5432/${POSTGRES_DB_NAME:-autocve}
      - REDIS_URL=redis://redis:6379/0
      - AGENT_ENABLED=true
      - AGENT_TASK_EXECUTION_MODE=worker
      - AGENT_WORKER_CONCURRENCY=${AGENT_WORKER_CONCURRENCY:-2}
      - AGENT_WORKER_JOB_TIMEOUT_SECONDS=${AGENT_WORKER_JOB_TIMEOUT_SECONDS:-3600}
      - AGENT_WORKER_MAX_TRIES=${AGENT_WORKER_MAX_TRIES:-2}
      - AGENT_EVENT_STREAM_ENABLED=true
      - ONE_CLICK_CVE_EXECUTION_MODE=worker
      - ONE_CLICK_CVE_MAX_REPOSITORY_SIZE_KB=${ONE_CLICK_CVE_MAX_REPOSITORY_SIZE_KB:-512000}
      - SANDBOX_ENABLED=true
      - SANDBOX_IMAGE=ghcr.nju.edu.cn/larlarua/autocve-sandbox:v1.0.5
      - MANAGED_PROJECTS_ROOT=/workspace/projects
      - PROJECT_SOURCE_STORAGE_PATH=/app/uploads/project_sources
      - HOST_PROJECT_ROOT=${HOST_PROJECT_ROOT:-}
      - CHECKMARX_FEATURE_ENABLED=${CHECKMARX_FEATURE_ENABLED:-false}
      - CHECKMARX_BASE_URL=${CHECKMARX_BASE_URL:-}
      - CHECKMARX_CLIENT_ID=${CHECKMARX_CLIENT_ID:-resource_owner_sast_client}
      - CHECKMARX_CLIENT_SECRET=${CHECKMARX_CLIENT_SECRET:-}
      - CHECKMARX_SCOPE=${CHECKMARX_SCOPE:-access_control_api sast_api}
      - WORKFLOW_URL=${WORKFLOW_URL:-}
      - WORKFLOW_API_TOKEN=${WORKFLOW_API_TOKEN:-}
      # LLM 配置 - 请根据需要修改
      - LLM_PROVIDER=${LLM_PROVIDER:-openai}
      - LLM_MODEL=${LLM_MODEL:-gpt-4o}
      - LLM_API_KEY=${LLM_API_KEY:-your-api-key-here}
      - LLM_BASE_URL=${LLM_BASE_URL:-}
      # 禁用代理
      - HTTP_PROXY=
      - HTTPS_PROXY=
      - http_proxy=
      - https_proxy=
      - NO_PROXY=*
      - no_proxy=*
    depends_on:
      db:
        condition: service_healthy
      redis:
        condition: service_healthy
      db-migrate:
        condition: service_completed_successfully
    networks:
      - autocve-network

  # 数据库迁移服务 - 在后端启动前自动执行
  agent-worker:
    image: ghcr.nju.edu.cn/larlarua/autocve-backend:v1.0.5
    restart: unless-stopped
    cpus: "2.0"
    mem_limit: 4g
    volumes:
      - backend_uploads:/app/uploads
      - skill_library:/app/skill_library
      - report_template_library:/app/report_template_library
      - ./projects:/workspace/projects
      - /var/run/docker.sock:/var/run/docker.sock
    environment:
      - DATABASE_URL=postgresql+asyncpg://postgres:postgres@db:5432/${POSTGRES_DB_NAME:-autocve}
      - REDIS_URL=redis://redis:6379/0
      - AGENT_ENABLED=true
      - AGENT_TASK_EXECUTION_MODE=worker
      - AGENT_WORKER_CONCURRENCY=${AGENT_WORKER_CONCURRENCY:-2}
      - AGENT_WORKER_JOB_TIMEOUT_SECONDS=${AGENT_WORKER_JOB_TIMEOUT_SECONDS:-3600}
      - AGENT_WORKER_MAX_TRIES=${AGENT_WORKER_MAX_TRIES:-2}
      - AGENT_EVENT_STREAM_ENABLED=true
      - ONE_CLICK_CVE_EXECUTION_MODE=worker
      - SANDBOX_ENABLED=true
      - SANDBOX_IMAGE=ghcr.nju.edu.cn/larlarua/autocve-sandbox:v1.0.5
      - MANAGED_PROJECTS_ROOT=/workspace/projects
      - PROJECT_SOURCE_STORAGE_PATH=/app/uploads/project_sources
      - HOST_PROJECT_ROOT=${HOST_PROJECT_ROOT:-}
      - CHECKMARX_FEATURE_ENABLED=${CHECKMARX_FEATURE_ENABLED:-false}
      - CHECKMARX_BASE_URL=${CHECKMARX_BASE_URL:-}
      - CHECKMARX_CLIENT_ID=${CHECKMARX_CLIENT_ID:-resource_owner_sast_client}
      - CHECKMARX_CLIENT_SECRET=${CHECKMARX_CLIENT_SECRET:-}
      - CHECKMARX_SCOPE=${CHECKMARX_SCOPE:-access_control_api sast_api}
      - WORKFLOW_URL=${WORKFLOW_URL:-}
      - WORKFLOW_API_TOKEN=${WORKFLOW_API_TOKEN:-}
      - LLM_PROVIDER=${LLM_PROVIDER:-openai}
      - LLM_MODEL=${LLM_MODEL:-gpt-4o}
      - LLM_API_KEY=${LLM_API_KEY:-your-api-key-here}
      - LLM_BASE_URL=${LLM_BASE_URL:-}
      - HTTP_PROXY=
      - HTTPS_PROXY=
      - http_proxy=
      - https_proxy=
      - NO_PROXY=*
      - no_proxy=*
    command: [".venv/bin/arq", "app.worker.agent_worker.WorkerSettings"]
    depends_on:
      db:
        condition: service_healthy
      redis:
        condition: service_healthy
      db-migrate:
        condition: service_completed_successfully
    networks:
      - autocve-network

  one-click-cve-worker:
    image: ghcr.nju.edu.cn/larlarua/autocve-backend:v1.0.5
    restart: unless-stopped
    cpus: "1.0"
    mem_limit: 2g
    volumes:
      - backend_uploads:/app/uploads
      - skill_library:/app/skill_library
      - report_template_library:/app/report_template_library
      - ./projects:/workspace/projects
      - /var/run/docker.sock:/var/run/docker.sock
    environment:
      - DATABASE_URL=postgresql+asyncpg://postgres:postgres@db:5432/${POSTGRES_DB_NAME:-autocve}
      - REDIS_URL=redis://redis:6379/0
      - AGENT_ENABLED=true
      - AGENT_TASK_EXECUTION_MODE=worker
      - AGENT_EVENT_STREAM_ENABLED=true
      - ONE_CLICK_CVE_EXECUTION_MODE=worker
      - ONE_CLICK_CVE_MAX_REPOSITORY_SIZE_KB=${ONE_CLICK_CVE_MAX_REPOSITORY_SIZE_KB:-512000}
      - ONE_CLICK_CVE_WORKER_CONCURRENCY=${ONE_CLICK_CVE_WORKER_CONCURRENCY:-1}
      - ONE_CLICK_CVE_WORKER_JOB_TIMEOUT_SECONDS=${ONE_CLICK_CVE_WORKER_JOB_TIMEOUT_SECONDS:-10800}
      - ONE_CLICK_CVE_AGENT_TIMEOUT_SECONDS=${ONE_CLICK_CVE_AGENT_TIMEOUT_SECONDS:-3000}
      - AUDIT_SESSION_RESUME_TIMEOUT_SECONDS=${AUDIT_SESSION_RESUME_TIMEOUT_SECONDS:-3000}
      - ONE_CLICK_CVE_WORKER_MAX_TRIES=${ONE_CLICK_CVE_WORKER_MAX_TRIES:-1}
      - SANDBOX_ENABLED=true
      - SANDBOX_IMAGE=ghcr.nju.edu.cn/larlarua/autocve-sandbox:v1.0.5
      - MANAGED_PROJECTS_ROOT=/workspace/projects
      - PROJECT_SOURCE_STORAGE_PATH=/app/uploads/project_sources
      - HOST_PROJECT_ROOT=${HOST_PROJECT_ROOT:-}
      - CHECKMARX_FEATURE_ENABLED=${CHECKMARX_FEATURE_ENABLED:-false}
      - CHECKMARX_BASE_URL=${CHECKMARX_BASE_URL:-}
      - CHECKMARX_CLIENT_ID=${CHECKMARX_CLIENT_ID:-resource_owner_sast_client}
      - CHECKMARX_CLIENT_SECRET=${CHECKMARX_CLIENT_SECRET:-}
      - CHECKMARX_SCOPE=${CHECKMARX_SCOPE:-access_control_api sast_api}
      - WORKFLOW_URL=${WORKFLOW_URL:-}
      - WORKFLOW_API_TOKEN=${WORKFLOW_API_TOKEN:-}
      - LLM_PROVIDER=${LLM_PROVIDER:-openai}
      - LLM_MODEL=${LLM_MODEL:-gpt-4o}
      - LLM_API_KEY=${LLM_API_KEY:-your-api-key-here}
      - LLM_BASE_URL=${LLM_BASE_URL:-}
      - HTTP_PROXY=
      - HTTPS_PROXY=
      - http_proxy=
      - https_proxy=
      - NO_PROXY=*
      - no_proxy=*
    command: [".venv/bin/arq", "app.worker.one_click_cve_worker.WorkerSettings"]
    depends_on:
      db:
        condition: service_healthy
      redis:
        condition: service_healthy
      db-migrate:
        condition: service_completed_successfully
    networks:
      - autocve-network

  db-migrate:
    image: ghcr.nju.edu.cn/larlarua/autocve-backend:v1.0.5
    restart: "no"
    environment:
      - DATABASE_URL=postgresql+asyncpg://postgres:postgres@db:5432/${POSTGRES_DB_NAME:-autocve}
    command: [".venv/bin/alembic", "upgrade", "head"]
    depends_on:
      db:
        condition: service_healthy
    networks:
      - autocve-network

  frontend:
    image: ghcr.nju.edu.cn/larlarua/autocve-frontend:v1.0.5
    restart: unless-stopped
    ports:
      - "3000:80"
    environment:
      # 禁用代理 - nginx 需要直连后端
      - HTTP_PROXY=
      - HTTPS_PROXY=
      - http_proxy=
      - https_proxy=
      - NO_PROXY=*
    depends_on:
      - backend
    networks:
      - autocve-network

  # 预拉取沙箱镜像（后端会按需调用）
  sandbox-pull:
    image: ghcr.nju.edu.cn/larlarua/autocve-sandbox:v1.0.5
    restart: "no"
    command: echo "Sandbox image ready"

networks:
  autocve-network:
    driver: bridge

volumes:
  postgres_data:
  backend_uploads:
  skill_library:
  report_template_library:
  redis_data: