austnv/remnawave-minishop
1
0
Fork 0
Code Issues 1 Pull Requests Activity

docs: update deploy examples

Browse Source
This commit is contained in:
3252a8
2026-05-23 22:01:40 +03:00
parent dab70d5a97
commit 60d8c297f9
22 changed files with 949 additions and 224 deletions
Download Patch File Download Diff File Expand all files Collapse all files
deploy/examples/.gitignore
+4
View File
@@ -0,0 +1,4 @@
**/.env
nginx/ssl/*
!nginx/ssl/README.md
deploy/examples/README.md
+33
View File
@@ -0,0 +1,33 @@
# Готовые варианты запуска
В этой папке лежат самодостаточные compose-примеры. Каждый вариант запускается из своей директории обычной командой:
```bash
cp .env.example .env
nano .env
docker compose up -d
```
После старта полезно проверить:
```bash
docker compose ps
docker compose logs -f backend worker frontend
```
## Какой вариант выбрать
| Папка | Когда использовать | Что править |
| --- | --- | --- |
| [`caddy`](caddy) | Нужен самый простой публичный HTTPS с автоматическими сертификатами Let's Encrypt. | `.env`; при нестандартной схеме можно поправить `Caddyfile`. |
| [`nginx`](nginx) | Уже используете Nginx и готовы положить TLS-сертификаты рядом с примером. | `.env`, `nginx.conf.template`, файлы в `ssl/`. |
| [`newt`](newt) | Публикуете сервисы через Pangolin/Newt без входящих портов на сервере приложения. | `.env` и ресурсы в панели Pangolin. |
| [`no-proxy`](no-proxy) | Нужно напрямую открыть порты backend/frontend или проверить стек без reverse proxy. | `.env`. |
Для всех вариантов нужны два публичных URL:
- webhook/backend URL для Telegram, платежных систем и Remnawave webhooks;
- Mini App/frontend URL для Telegram Mini App и Web App.
Обычно это два домена, например `webhooks.example.com` и `app.example.com`.
deploy/examples/caddy/.env.example
+41
View File
@@ -0,0 +1,41 @@
# Copy this file to .env, fill real values, then run:
# docker compose up -d
COMPOSE_PROJECT_NAME=remnawave-minishop
IMAGE_TAG=latest
# Public hostnames. Caddyfile uses the same values and gets HTTPS certificates.
WEBHOOK_HOST=webhooks.example.com
MINIAPP_HOST=app.example.com
# Optional bind addresses for Caddy.
HTTP_BIND=0.0.0.0:80
HTTPS_BIND=0.0.0.0:443
# Telegram bot token from @BotFather.
BOT_TOKEN=your_bot_token_here
# Telegram numeric user IDs allowed to open the admin panel.
ADMIN_IDS=123456789
# PostgreSQL credentials created by Docker Compose.
POSTGRES_USER=remnawave_minishop
POSTGRES_PASSWORD=change_me_to_a_long_random_password
POSTGRES_DB=remnawave_minishop
# Keep Web App enabled for the first setup.
WEBAPP_ENABLED=True
# Stable secrets. Generate with:
# openssl rand -hex 32
WEBAPP_SESSION_SECRET=change_me_to_64_hex_chars
WEBHOOK_SECRET_TOKEN=change_me_to_64_hex_chars
# Remnawave panel integration.
PANEL_API_URL=https://panel.example.com/api
PANEL_API_KEY=change_me
PANEL_WEBHOOK_SECRET=change_me
# Caddy and Docker network ranges that may set X-Forwarded-For.
TRUSTED_PROXIES=127.0.0.1,::1,172.16.0.0/12
deploy/examples/caddy/Caddyfile
+19
View File
@@ -0,0 +1,19 @@
# Domains are read from .env:
# WEBHOOK_HOST=webhooks.example.com
# MINIAPP_HOST=app.example.com
#
# If you prefer hardcoded hostnames, replace {$WEBHOOK_HOST} and
# {$MINIAPP_HOST} with your real domains.
{$WEBHOOK_HOST} {
encode zstd gzip
reverse_proxy backend:8080
}
{$MINIAPP_HOST} {
encode zstd gzip
reverse_proxy frontend:80
}
deploy/examples/caddy/README.md
+31
View File
@@ -0,0 +1,31 @@
# Запуск с Caddy
Caddy сам выпускает и продлевает HTTPS-сертификаты. На сервере должны быть открыты входящие `80/tcp` и `443/tcp`, а DNS-записи `WEBHOOK_HOST` и `MINIAPP_HOST` должны смотреть на этот сервер.
```bash
cp .env.example .env
nano .env
docker compose up -d
```
Минимально поменяйте в `.env`:
- `WEBHOOK_HOST` и `MINIAPP_HOST`;
- `BOT_TOKEN`, `ADMIN_IDS`;
- `POSTGRES_PASSWORD`;
- `WEBAPP_SESSION_SECRET`, `WEBHOOK_SECRET_TOKEN`;
- `PANEL_API_URL`, `PANEL_API_KEY`, `PANEL_WEBHOOK_SECRET`.
`Caddyfile` лежит рядом и использует домены из `.env`. Если нужна нестандартная логика Caddy, правьте его и перезапускайте:
```bash
docker compose up -d --force-recreate caddy
```
Проверка:
```bash
docker compose ps
docker compose logs -f caddy backend worker frontend
```
deploy/examples/caddy/docker-compose.yml
+155
View File
@@ -0,0 +1,155 @@
x-app-env-file: &app_env_file
- ${APP_ENV_FILE:-.env}
x-app-environment: &app_environment
IMAGE_TAG: ${IMAGE_TAG:-latest}
POSTGRES_HOST: postgres
REDIS_URL: redis://redis:6379/0
WEBHOOK_BASE_URL: https://${WEBHOOK_HOST:?set WEBHOOK_HOST in .env}
SUBSCRIPTION_MINI_APP_URL: https://${MINIAPP_HOST:?set MINIAPP_HOST in .env}/
services:
postgres:
image: postgres:17
restart: unless-stopped
environment:
POSTGRES_USER: ${POSTGRES_USER:?set POSTGRES_USER in .env}
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD in .env}
POSTGRES_DB: ${POSTGRES_DB:?set POSTGRES_DB in .env}
volumes:
- postgres-data:/var/lib/postgresql/data
networks:
- remnawave-shop
healthcheck:
test: ["CMD-SHELL", "pg_isready -U $$POSTGRES_USER -d $$POSTGRES_DB"]
interval: 5s
timeout: 5s
retries: 20
redis:
image: redis:7-alpine
restart: unless-stopped
command: ["redis-server", "--appendonly", "yes"]
volumes:
- redis-data:/data
networks:
- remnawave-shop
healthcheck:
test: ["CMD", "redis-cli", "ping"]
interval: 5s
timeout: 3s
retries: 20
migrate:
image: ghcr.io/3252a8/remnawave-minishop-backend:${IMAGE_TAG:-latest}
restart: "no"
command: ["python", "backend/main_migrate.py"]
env_file: *app_env_file
environment:
<<: *app_environment
volumes:
- shop-data:/app/data
networks:
- remnawave-shop
depends_on:
postgres:
condition: service_healthy
redis:
condition: service_healthy
backend:
image: ghcr.io/3252a8/remnawave-minishop-backend:${IMAGE_TAG:-latest}
restart: unless-stopped
env_file: *app_env_file
environment:
<<: *app_environment
WEBAPP_ENABLED: ${WEBAPP_ENABLED:-true}
TRUSTED_PROXIES: ${TRUSTED_PROXIES:-127.0.0.1,::1,172.16.0.0/12}
volumes:
- shop-data:/app/data
networks:
- remnawave-shop
depends_on:
postgres:
condition: service_healthy
redis:
condition: service_healthy
migrate:
condition: service_completed_successfully
healthcheck:
test: ["CMD-SHELL", "python -c \"import urllib.request; urllib.request.urlopen('http://127.0.0.1:8080/healthz', timeout=3).read()\""]
interval: 30s
timeout: 5s
retries: 5
start_period: 30s
worker:
image: ghcr.io/3252a8/remnawave-minishop-worker:${IMAGE_TAG:-latest}
restart: unless-stopped
env_file: *app_env_file
environment:
<<: *app_environment
volumes:
- shop-data:/app/data
networks:
- remnawave-shop
depends_on:
postgres:
condition: service_healthy
redis:
condition: service_healthy
migrate:
condition: service_completed_successfully
frontend:
image: ghcr.io/3252a8/remnawave-minishop-frontend:${IMAGE_TAG:-latest}
restart: unless-stopped
environment:
IMAGE_TAG: ${IMAGE_TAG:-latest}
FRONTEND_PUBLIC: https://${MINIAPP_HOST:?set MINIAPP_HOST in .env}/
networks:
- remnawave-shop
depends_on:
backend:
condition: service_healthy
healthcheck:
test: ["CMD-SHELL", "wget -qO- http://127.0.0.1/health | grep -q ok"]
interval: 30s
timeout: 5s
retries: 5
caddy:
image: caddy:2-alpine
restart: unless-stopped
environment:
WEBHOOK_HOST: ${WEBHOOK_HOST:?set WEBHOOK_HOST in .env}
MINIAPP_HOST: ${MINIAPP_HOST:?set MINIAPP_HOST in .env}
ports:
- "${HTTP_BIND:-0.0.0.0:80}:80"
- "${HTTPS_BIND:-0.0.0.0:443}:443"
volumes:
- ./Caddyfile:/etc/caddy/Caddyfile:ro
- caddy-data:/data
- caddy-config:/config
networks:
- remnawave-shop
depends_on:
frontend:
condition: service_healthy
backend:
condition: service_healthy
networks:
remnawave-shop:
volumes:
postgres-data:
name: remnawave-minishop-db-data
redis-data:
name: remnawave-minishop-redis-data
shop-data:
name: remnawave-minishop-shop-data
caddy-data:
name: remnawave-minishop-caddy-data
caddy-config:
name: remnawave-minishop-caddy-config
deploy/examples/newt/.env.example
+42
View File
@@ -0,0 +1,42 @@
# Copy this file to .env, fill real values, then run:
# docker compose up -d
COMPOSE_PROJECT_NAME=remnawave-minishop
IMAGE_TAG=latest
# Public hostnames configured as Pangolin resources.
WEBHOOK_HOST=webhooks.example.com
MINIAPP_HOST=app.example.com
# Newt credentials from Pangolin site settings.
PANGOLIN_ENDPOINT=https://pangolin.example.com
NEWT_ID=change_me
NEWT_SECRET=change_me
# Telegram bot token from @BotFather.
BOT_TOKEN=your_bot_token_here
# Telegram numeric user IDs allowed to open the admin panel.
ADMIN_IDS=123456789
# PostgreSQL credentials created by Docker Compose.
POSTGRES_USER=remnawave_minishop
POSTGRES_PASSWORD=change_me_to_a_long_random_password
POSTGRES_DB=remnawave_minishop
# Keep Web App enabled for the first setup.
WEBAPP_ENABLED=True
# Stable secrets. Generate with:
# openssl rand -hex 32
WEBAPP_SESSION_SECRET=change_me_to_64_hex_chars
WEBHOOK_SECRET_TOKEN=change_me_to_64_hex_chars
# Remnawave panel integration.
PANEL_API_URL=https://panel.example.com/api
PANEL_API_KEY=change_me
PANEL_WEBHOOK_SECRET=change_me
# Pangolin/Newt and Docker network ranges that may set X-Forwarded-For.
TRUSTED_PROXIES=127.0.0.1,::1,172.16.0.0/12
deploy/examples/newt/README.md
+33
View File
@@ -0,0 +1,33 @@
# Запуск через Newt / Pangolin
Этот вариант не открывает входящие порты на сервере приложения. Newt подключается к Pangolin, а публичные домены настраиваются ресурсами в панели Pangolin.
```bash
cp .env.example .env
nano .env
docker compose up -d
```
В `.env` заполните:
- `WEBHOOK_HOST` и `MINIAPP_HOST` - публичные домены ресурсов в Pangolin;
- `PANGOLIN_ENDPOINT`, `NEWT_ID`, `NEWT_SECRET` - значения из настроек site/client в Pangolin;
- обычные переменные приложения: `BOT_TOKEN`, `ADMIN_IDS`, `POSTGRES_PASSWORD`, секреты и доступ к Remnawave.
Официальная инструкция Pangolin по установке Newt site: <https://docs.pangolin.net/manage/sites/install-site>.
В Pangolin создайте два HTTP-ресурса для этого Newt site:
| Публичный домен | Upstream |
| --- | --- |
| `https://webhooks.example.com` | `http://backend:8080` |
| `https://app.example.com` | `http://frontend:80` |
Домены в Pangolin должны совпадать с `WEBHOOK_HOST` и `MINIAPP_HOST`.
Проверка:
```bash
docker compose ps
docker compose logs -f newt backend worker frontend
```
deploy/examples/newt/docker-compose.yml
+146
View File
@@ -0,0 +1,146 @@
x-app-env-file: &app_env_file
- ${APP_ENV_FILE:-.env}
x-app-environment: &app_environment
IMAGE_TAG: ${IMAGE_TAG:-latest}
POSTGRES_HOST: postgres
REDIS_URL: redis://redis:6379/0
WEBHOOK_BASE_URL: https://${WEBHOOK_HOST:?set WEBHOOK_HOST in .env}
SUBSCRIPTION_MINI_APP_URL: https://${MINIAPP_HOST:?set MINIAPP_HOST in .env}/
services:
postgres:
image: postgres:17
restart: unless-stopped
environment:
POSTGRES_USER: ${POSTGRES_USER:?set POSTGRES_USER in .env}
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD in .env}
POSTGRES_DB: ${POSTGRES_DB:?set POSTGRES_DB in .env}
volumes:
- postgres-data:/var/lib/postgresql/data
networks:
- remnawave-shop
healthcheck:
test: ["CMD-SHELL", "pg_isready -U $$POSTGRES_USER -d $$POSTGRES_DB"]
interval: 5s
timeout: 5s
retries: 20
redis:
image: redis:7-alpine
restart: unless-stopped
command: ["redis-server", "--appendonly", "yes"]
volumes:
- redis-data:/data
networks:
- remnawave-shop
healthcheck:
test: ["CMD", "redis-cli", "ping"]
interval: 5s
timeout: 3s
retries: 20
migrate:
image: ghcr.io/3252a8/remnawave-minishop-backend:${IMAGE_TAG:-latest}
restart: "no"
command: ["python", "backend/main_migrate.py"]
env_file: *app_env_file
environment:
<<: *app_environment
volumes:
- shop-data:/app/data
networks:
- remnawave-shop
depends_on:
postgres:
condition: service_healthy
redis:
condition: service_healthy
backend:
image: ghcr.io/3252a8/remnawave-minishop-backend:${IMAGE_TAG:-latest}
restart: unless-stopped
env_file: *app_env_file
environment:
<<: *app_environment
WEBAPP_ENABLED: ${WEBAPP_ENABLED:-true}
TRUSTED_PROXIES: ${TRUSTED_PROXIES:-127.0.0.1,::1,172.16.0.0/12}
volumes:
- shop-data:/app/data
networks:
- remnawave-shop
depends_on:
postgres:
condition: service_healthy
redis:
condition: service_healthy
migrate:
condition: service_completed_successfully
healthcheck:
test: ["CMD-SHELL", "python -c \"import urllib.request; urllib.request.urlopen('http://127.0.0.1:8080/healthz', timeout=3).read()\""]
interval: 30s
timeout: 5s
retries: 5
start_period: 30s
worker:
image: ghcr.io/3252a8/remnawave-minishop-worker:${IMAGE_TAG:-latest}
restart: unless-stopped
env_file: *app_env_file
environment:
<<: *app_environment
volumes:
- shop-data:/app/data
networks:
- remnawave-shop
depends_on:
postgres:
condition: service_healthy
redis:
condition: service_healthy
migrate:
condition: service_completed_successfully
frontend:
image: ghcr.io/3252a8/remnawave-minishop-frontend:${IMAGE_TAG:-latest}
restart: unless-stopped
environment:
IMAGE_TAG: ${IMAGE_TAG:-latest}
FRONTEND_PUBLIC: https://${MINIAPP_HOST:?set MINIAPP_HOST in .env}/
networks:
- remnawave-shop
depends_on:
backend:
condition: service_healthy
healthcheck:
test: ["CMD-SHELL", "wget -qO- http://127.0.0.1/health | grep -q ok"]
interval: 30s
timeout: 5s
retries: 5
newt:
image: fosrl/newt:latest
restart: unless-stopped
environment:
PANGOLIN_ENDPOINT: ${PANGOLIN_ENDPOINT:?set PANGOLIN_ENDPOINT in .env}
NEWT_ID: ${NEWT_ID:?set NEWT_ID in .env}
NEWT_SECRET: ${NEWT_SECRET:?set NEWT_SECRET in .env}
HEALTH_FILE: /tmp/healthy
networks:
- remnawave-shop
healthcheck:
test: ["CMD-SHELL", "test -f /tmp/healthy"]
interval: 30s
timeout: 5s
retries: 5
networks:
remnawave-shop:
volumes:
postgres-data:
name: remnawave-minishop-db-data
redis-data:
name: remnawave-minishop-redis-data
shop-data:
name: remnawave-minishop-shop-data
deploy/examples/nginx/.env.example
+41
View File
@@ -0,0 +1,41 @@
# Copy this file to .env, fill real values, then run:
# docker compose up -d
COMPOSE_PROJECT_NAME=remnawave-minishop
IMAGE_TAG=latest
# Public hostnames. nginx.conf.template uses the same values.
WEBHOOK_HOST=webhooks.example.com
MINIAPP_HOST=app.example.com
# Optional bind addresses for Nginx.
HTTP_BIND=0.0.0.0:80
HTTPS_BIND=0.0.0.0:443
# Telegram bot token from @BotFather.
BOT_TOKEN=your_bot_token_here
# Telegram numeric user IDs allowed to open the admin panel.
ADMIN_IDS=123456789
# PostgreSQL credentials created by Docker Compose.
POSTGRES_USER=remnawave_minishop
POSTGRES_PASSWORD=change_me_to_a_long_random_password
POSTGRES_DB=remnawave_minishop
# Keep Web App enabled for the first setup.
WEBAPP_ENABLED=True
# Stable secrets. Generate with:
# openssl rand -hex 32
WEBAPP_SESSION_SECRET=change_me_to_64_hex_chars
WEBHOOK_SECRET_TOKEN=change_me_to_64_hex_chars
# Remnawave panel integration.
PANEL_API_URL=https://panel.example.com/api
PANEL_API_KEY=change_me
PANEL_WEBHOOK_SECRET=change_me
# Nginx and Docker network ranges that may set X-Forwarded-For.
TRUSTED_PROXIES=127.0.0.1,::1,172.16.0.0/12
deploy/examples/nginx/README.md
+42
View File
@@ -0,0 +1,42 @@
# Запуск с Nginx
Этот пример поднимает Nginx в той же Docker-сети, что и приложение:
- `WEBHOOK_HOST` проксируется в `backend:8080`;
- `MINIAPP_HOST` проксируется в `frontend:80`;
- `frontend` сам проксирует внутренние `/api`, `/auth` и ассеты тем в `backend:8081`.
## Подготовка
```bash
cp .env.example .env
nano .env
```
Положите TLS-сертификаты в `ssl/`:
```text
ssl/
webhooks.example.com/
fullchain.pem
privkey.pem
app.example.com/
fullchain.pem
privkey.pem
```
Имена папок должны совпадать с `WEBHOOK_HOST` и `MINIAPP_HOST` в `.env`.
## Запуск
```bash
docker compose up -d
docker compose logs -f nginx backend worker frontend
```
Если нужно поменять заголовки, лимиты или TLS-настройки, правьте `nginx.conf.template` рядом с compose и перезапускайте Nginx:
```bash
docker compose up -d --force-recreate nginx
```
deploy/examples/nginx/docker-compose.yml
+150
View File
@@ -0,0 +1,150 @@
x-app-env-file: &app_env_file
- ${APP_ENV_FILE:-.env}
x-app-environment: &app_environment
IMAGE_TAG: ${IMAGE_TAG:-latest}
POSTGRES_HOST: postgres
REDIS_URL: redis://redis:6379/0
WEBHOOK_BASE_URL: https://${WEBHOOK_HOST:?set WEBHOOK_HOST in .env}
SUBSCRIPTION_MINI_APP_URL: https://${MINIAPP_HOST:?set MINIAPP_HOST in .env}/
services:
postgres:
image: postgres:17
restart: unless-stopped
environment:
POSTGRES_USER: ${POSTGRES_USER:?set POSTGRES_USER in .env}
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD in .env}
POSTGRES_DB: ${POSTGRES_DB:?set POSTGRES_DB in .env}
volumes:
- postgres-data:/var/lib/postgresql/data
networks:
- remnawave-shop
healthcheck:
test: ["CMD-SHELL", "pg_isready -U $$POSTGRES_USER -d $$POSTGRES_DB"]
interval: 5s
timeout: 5s
retries: 20
redis:
image: redis:7-alpine
restart: unless-stopped
command: ["redis-server", "--appendonly", "yes"]
volumes:
- redis-data:/data
networks:
- remnawave-shop
healthcheck:
test: ["CMD", "redis-cli", "ping"]
interval: 5s
timeout: 3s
retries: 20
migrate:
image: ghcr.io/3252a8/remnawave-minishop-backend:${IMAGE_TAG:-latest}
restart: "no"
command: ["python", "backend/main_migrate.py"]
env_file: *app_env_file
environment:
<<: *app_environment
volumes:
- shop-data:/app/data
networks:
- remnawave-shop
depends_on:
postgres:
condition: service_healthy
redis:
condition: service_healthy
backend:
image: ghcr.io/3252a8/remnawave-minishop-backend:${IMAGE_TAG:-latest}
restart: unless-stopped
env_file: *app_env_file
environment:
<<: *app_environment
WEBAPP_ENABLED: ${WEBAPP_ENABLED:-true}
TRUSTED_PROXIES: ${TRUSTED_PROXIES:-127.0.0.1,::1,172.16.0.0/12}
volumes:
- shop-data:/app/data
networks:
- remnawave-shop
depends_on:
postgres:
condition: service_healthy
redis:
condition: service_healthy
migrate:
condition: service_completed_successfully
healthcheck:
test: ["CMD-SHELL", "python -c \"import urllib.request; urllib.request.urlopen('http://127.0.0.1:8080/healthz', timeout=3).read()\""]
interval: 30s
timeout: 5s
retries: 5
start_period: 30s
worker:
image: ghcr.io/3252a8/remnawave-minishop-worker:${IMAGE_TAG:-latest}
restart: unless-stopped
env_file: *app_env_file
environment:
<<: *app_environment
volumes:
- shop-data:/app/data
networks:
- remnawave-shop
depends_on:
postgres:
condition: service_healthy
redis:
condition: service_healthy
migrate:
condition: service_completed_successfully
frontend:
image: ghcr.io/3252a8/remnawave-minishop-frontend:${IMAGE_TAG:-latest}
restart: unless-stopped
environment:
IMAGE_TAG: ${IMAGE_TAG:-latest}
FRONTEND_PUBLIC: https://${MINIAPP_HOST:?set MINIAPP_HOST in .env}/
networks:
- remnawave-shop
depends_on:
backend:
condition: service_healthy
healthcheck:
test: ["CMD-SHELL", "wget -qO- http://127.0.0.1/health | grep -q ok"]
interval: 30s
timeout: 5s
retries: 5
nginx:
image: nginx:1.27-alpine
restart: unless-stopped
environment:
WEBHOOK_HOST: ${WEBHOOK_HOST:?set WEBHOOK_HOST in .env}
MINIAPP_HOST: ${MINIAPP_HOST:?set MINIAPP_HOST in .env}
ports:
- "${HTTP_BIND:-0.0.0.0:80}:80"
- "${HTTPS_BIND:-0.0.0.0:443}:443"
volumes:
- ./nginx.conf.template:/etc/nginx/templates/default.conf.template:ro
- ./ssl:/etc/nginx/ssl:ro
networks:
- remnawave-shop
depends_on:
frontend:
condition: service_healthy
backend:
condition: service_healthy
networks:
remnawave-shop:
volumes:
postgres-data:
name: remnawave-minishop-db-data
redis-data:
name: remnawave-minishop-redis-data
shop-data:
name: remnawave-minishop-shop-data
deploy/examples/nginx/nginx.conf.template
+62
View File
@@ -0,0 +1,62 @@
upstream remnawave_backend_webhooks {
server backend:8080;
keepalive 16;
}
upstream remnawave_frontend {
server frontend:80;
keepalive 16;
}
server {
listen 80;
server_name ${WEBHOOK_HOST} ${MINIAPP_HOST};
return 301 https://$host$request_uri;
}
# WEBHOOK_BASE_URL: Telegram, payment providers and Remnawave webhooks.
server {
listen 443 ssl;
http2 on;
server_name ${WEBHOOK_HOST};
ssl_certificate /etc/nginx/ssl/${WEBHOOK_HOST}/fullchain.pem;
ssl_certificate_key /etc/nginx/ssl/${WEBHOOK_HOST}/privkey.pem;
client_max_body_size 20m;
location / {
proxy_pass http://remnawave_backend_webhooks;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Proto $scheme;
}
}
# SUBSCRIPTION_MINI_APP_URL: static Mini App frontend.
# The frontend container proxies /api, /auth and theme/logo assets to backend:8081.
server {
listen 443 ssl;
http2 on;
server_name ${MINIAPP_HOST};
ssl_certificate /etc/nginx/ssl/${MINIAPP_HOST}/fullchain.pem;
ssl_certificate_key /etc/nginx/ssl/${MINIAPP_HOST}/privkey.pem;
client_max_body_size 20m;
location / {
proxy_pass http://remnawave_frontend;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Proto $scheme;
}
}
deploy/examples/nginx/ssl/README.md
+18
View File
@@ -0,0 +1,18 @@
# TLS-сертификаты для Nginx
Положите сюда сертификаты для доменов из `.env`.
Пример структуры:
```text
ssl/
webhooks.example.com/
fullchain.pem
privkey.pem
app.example.com/
fullchain.pem
privkey.pem
```
Если используете wildcard-сертификат, можно положить одинаковые `fullchain.pem` и `privkey.pem` в обе папки.
deploy/examples/no-proxy/.env.example
+41
View File
@@ -0,0 +1,41 @@
# Copy this file to .env, fill real values, then run:
# docker compose up -d
COMPOSE_PROJECT_NAME=remnawave-minishop
IMAGE_TAG=latest
# Direct host port publishing. Use 127.0.0.1:PORT for local-only access.
WEB_SERVER_BIND=0.0.0.0:8080
FRONTEND_BIND=0.0.0.0:8082
# URLs that reach the published ports.
# For local checks HTTP is fine. Telegram webhooks and Mini Apps require
# public HTTPS in production; the app containers themselves do not terminate TLS.
WEBHOOK_PUBLIC_URL=http://127.0.0.1:8080
MINIAPP_PUBLIC_URL=http://127.0.0.1:8082/
# Telegram bot token from @BotFather.
BOT_TOKEN=your_bot_token_here
# Telegram numeric user IDs allowed to open the admin panel.
ADMIN_IDS=123456789
# PostgreSQL credentials created by Docker Compose.
POSTGRES_USER=remnawave_minishop
POSTGRES_PASSWORD=change_me_to_a_long_random_password
POSTGRES_DB=remnawave_minishop
# Keep Web App enabled for the first setup.
WEBAPP_ENABLED=True
# Stable secrets. Generate with:
# openssl rand -hex 32
WEBAPP_SESSION_SECRET=change_me_to_64_hex_chars
WEBHOOK_SECRET_TOKEN=change_me_to_64_hex_chars
# Remnawave panel integration.
PANEL_API_URL=https://panel.example.com/api
PANEL_API_KEY=change_me
PANEL_WEBHOOK_SECRET=change_me
TRUSTED_PROXIES=127.0.0.1,::1
deploy/examples/no-proxy/README.md
+23
View File
@@ -0,0 +1,23 @@
# Запуск без reverse proxy
Этот вариант напрямую публикует два HTTP-порта:
- backend/webhooks: `WEB_SERVER_BIND`, по умолчанию `0.0.0.0:8080`;
- frontend/Mini App: `FRONTEND_BIND`, по умолчанию `0.0.0.0:8082`.
```bash
cp .env.example .env
nano .env
docker compose up -d
```
Важно: контейнеры приложения сами не выпускают TLS-сертификаты. Для реального Telegram webhook и Mini App публичные URL должны быть HTTPS. Используйте этот вариант для локальной проверки, внутренней сети или когда HTTPS уже завершается внешней платформой и дальше трафик приходит на эти порты.
Проверка локально:
```bash
curl http://127.0.0.1:8080/healthz
curl http://127.0.0.1:8082/health
docker compose logs -f backend worker frontend
```
deploy/examples/no-proxy/docker-compose.yml
+134
View File
@@ -0,0 +1,134 @@
x-app-env-file: &app_env_file
- ${APP_ENV_FILE:-.env}
x-app-environment: &app_environment
IMAGE_TAG: ${IMAGE_TAG:-latest}
POSTGRES_HOST: postgres
REDIS_URL: redis://redis:6379/0
WEBHOOK_BASE_URL: ${WEBHOOK_PUBLIC_URL:?set WEBHOOK_PUBLIC_URL in .env}
SUBSCRIPTION_MINI_APP_URL: ${MINIAPP_PUBLIC_URL:?set MINIAPP_PUBLIC_URL in .env}
services:
postgres:
image: postgres:17
restart: unless-stopped
environment:
POSTGRES_USER: ${POSTGRES_USER:?set POSTGRES_USER in .env}
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD in .env}
POSTGRES_DB: ${POSTGRES_DB:?set POSTGRES_DB in .env}
volumes:
- postgres-data:/var/lib/postgresql/data
networks:
- remnawave-shop
healthcheck:
test: ["CMD-SHELL", "pg_isready -U $$POSTGRES_USER -d $$POSTGRES_DB"]
interval: 5s
timeout: 5s
retries: 20
redis:
image: redis:7-alpine
restart: unless-stopped
command: ["redis-server", "--appendonly", "yes"]
volumes:
- redis-data:/data
networks:
- remnawave-shop
healthcheck:
test: ["CMD", "redis-cli", "ping"]
interval: 5s
timeout: 3s
retries: 20
migrate:
image: ghcr.io/3252a8/remnawave-minishop-backend:${IMAGE_TAG:-latest}
restart: "no"
command: ["python", "backend/main_migrate.py"]
env_file: *app_env_file
environment:
<<: *app_environment
volumes:
- shop-data:/app/data
networks:
- remnawave-shop
depends_on:
postgres:
condition: service_healthy
redis:
condition: service_healthy
backend:
image: ghcr.io/3252a8/remnawave-minishop-backend:${IMAGE_TAG:-latest}
restart: unless-stopped
env_file: *app_env_file
environment:
<<: *app_environment
WEBAPP_ENABLED: ${WEBAPP_ENABLED:-true}
TRUSTED_PROXIES: ${TRUSTED_PROXIES:-127.0.0.1,::1}
ports:
- "${WEB_SERVER_BIND:-0.0.0.0:8080}:8080"
volumes:
- shop-data:/app/data
networks:
- remnawave-shop
depends_on:
postgres:
condition: service_healthy
redis:
condition: service_healthy
migrate:
condition: service_completed_successfully
healthcheck:
test: ["CMD-SHELL", "python -c \"import urllib.request; urllib.request.urlopen('http://127.0.0.1:8080/healthz', timeout=3).read()\""]
interval: 30s
timeout: 5s
retries: 5
start_period: 30s
worker:
image: ghcr.io/3252a8/remnawave-minishop-worker:${IMAGE_TAG:-latest}
restart: unless-stopped
env_file: *app_env_file
environment:
<<: *app_environment
volumes:
- shop-data:/app/data
networks:
- remnawave-shop
depends_on:
postgres:
condition: service_healthy
redis:
condition: service_healthy
migrate:
condition: service_completed_successfully
frontend:
image: ghcr.io/3252a8/remnawave-minishop-frontend:${IMAGE_TAG:-latest}
restart: unless-stopped
environment:
IMAGE_TAG: ${IMAGE_TAG:-latest}
FRONTEND_PUBLIC: ${MINIAPP_PUBLIC_URL:?set MINIAPP_PUBLIC_URL in .env}
ports:
- "${FRONTEND_BIND:-0.0.0.0:8082}:80"
networks:
- remnawave-shop
depends_on:
backend:
condition: service_healthy
healthcheck:
test: ["CMD-SHELL", "wget -qO- http://127.0.0.1/health | grep -q ok"]
interval: 30s
timeout: 5s
retries: 5
networks:
remnawave-shop:
volumes:
postgres-data:
name: remnawave-minishop-db-data
redis-data:
name: remnawave-minishop-redis-data
shop-data:
name: remnawave-minishop-shop-data