Skip to content

v0.2.0

Choose a tag to compare

View all tags
@ptonlix ptonlix released this 13 Oct 09:15
· 25 commits to main since this release
v0.2.0
86a0a16
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

v0.2.0

日期：2026-10-13

这是 v0.1.0 之后的部署修复版。店、授权范围、公开发现和买入规则没有改。这一版换成可匿名拉取的对象存储，补上可选的公网 HTTPS，并让设备码确认留在已配置的公开地址。生产应用镜像是 docker.io/ptonlix/merclink:0.2.0。

中文

这一版能做什么

  • 正式环境的对象存储从固定版本 MinIO 换成单盘 rustfs/rustfs:1.0.1。应用仍只通过已有的 S3 变量访问它，不把图片写到本地磁盘。控制台端口 9001 不发布，图片仍由应用的媒体路由提供。
  • 桶由一次性的 amazon/aws-cli:2.27.49 创建。没有图片的新部署使用空卷 rustfs_data。
  • 公网 HTTPS 可以由同一份 compose.yaml 里的 caddy:2.11.7-alpine 提供。只在 COMPOSE_PROFILES=caddy 时启动。证书由 Caddy 向 Let's Encrypt 申请并续期，保存在 caddy_data，不写进仓库。
  • 可选 APEX_DOMAIN 只 301 到 https://APP_DOMAIN，不作为第二个授权或支付地址。
  • 设备码确认表单、verification_uri 和授权发现文档的绝对地址改用 APP_BASE_URL 上的 issuer。容器监听地址 0.0.0.0:3000 不再出现在这些链接里。
  • v0.2.0 会同时推送 0.2.0 和 latest。回滚仍使用版本号标签，不使用 latest。

这一版不做

  • 不迁移旧的 minio_data。不把该卷挂给 RustFS，也不提供从 MinIO 拷贝对象的步骤。
  • 不把 RustFS 扩成多盘，不发布对象存储控制台。
  • 不把域名、证书或 ACME 账号写进仓库。未启用 Caddy 时，仍由部署机自己的反向代理提供 HTTPS。
  • 不改设备码流程、scope、买家注册或支付成功条件。没有新的数据库迁移。

升级注意

已有部署先改 .env，再拉镜像。把 MINIO_ROOT_USER 和 MINIO_ROOT_PASSWORD 改名为 RUSTFS_ACCESS_KEY 和 RUSTFS_SECRET_KEY。不要另加一套对象存储变量。APP_BASE_URL 必须是公网地址；启用 Caddy 时必须是 https:// 加 APP_DOMAIN。

需要这份 Compose 提供 HTTPS 时，设置 COMPOSE_PROFILES=caddy、APP_DOMAIN 和 ACME_EMAIL，并把 APP_BIND 设为 127.0.0.1。域名要先解析到这台机器，安全组放行 TCP 80 和 443。不要删除 caddy_data。

然后执行：

docker compose pull && docker compose up -d

不要加 --build。旧的 MinIO 图片不会出现在新卷里。需要这些图片时，用管理 Skill 重新上传。已经发出的设备码如果过期，向 Agent 再要一个。

回滚应用镜像到 0.1.0 前，先确认部署仍使用认识的对象存储和 .env 变量名。只改 MERCLINK_IMAGE 不会把 rustfs_data 变回 minio_data。

English

Date: 2026-10-13

This is a deployment fix after v0.1.0. The store, authorization scopes, public discovery, and purchase rules are unchanged. This version switches object storage to an anonymously pullable image, adds optional public HTTPS, and keeps device-code confirmation on the configured public origin. The production image is docker.io/ptonlix/merclink:0.1.1.

What this version does

  • Production object storage changes from the pinned MinIO image to single-disk rustfs/rustfs:1.0.1. The application still reaches it only through the existing S3 variables and does not write images to local disk. Console port 9001 is not published. Images are still served by the application media route.
  • The bucket is created once by amazon/aws-cli:2.27.49. A new deployment with no images uses the empty rustfs_data volume.
  • Public HTTPS can come from caddy:2.11.7-alpine in the same compose.yaml. It starts only when COMPOSE_PROFILES=caddy. Caddy requests and renews the Let's Encrypt certificate and stores it in caddy_data. The certificate is not committed.
  • Optional APEX_DOMAIN only redirects to https://APP_DOMAIN. It is not a second authorization or payment origin.
  • Device confirmation forms, verification_uri, and authorization discovery URLs now use the issuer on APP_BASE_URL. The container bind address 0.0.0.0:3000 no longer appears in those links.
  • v0.2.0 also publishes latest. Roll back by version tag, not by latest.

What this version does not do

  • It does not migrate the old minio_data volume, mount that volume on RustFS, or provide a copy procedure from MinIO.
  • It does not expand RustFS to multiple disks or publish an object-storage console.
  • It does not store domains, certificates, or the ACME account in the repository. Without the Caddy profile, HTTPS still comes from the deploy machine's own reverse proxy.
  • It does not change the device-code flow, scopes, buyer registration, or the rule that only paid means payment success. There is no new database migration.

Upgrade note

Change .env before pulling. Rename MINIO_ROOT_USER and MINIO_ROOT_PASSWORD to RUSTFS_ACCESS_KEY and RUSTFS_SECRET_KEY. Do not add a second set of object-storage variables. APP_BASE_URL must be the public origin. With Caddy, it must be https:// plus APP_DOMAIN.

To let this Compose file provide HTTPS, set COMPOSE_PROFILES=caddy, APP_DOMAIN, and ACME_EMAIL, and set APP_BIND to 127.0.0.1. Point the domain at the machine first, and open TCP 80 and 443. Do not delete caddy_data.

Then run:

docker compose pull && docker compose up -d

Do not add --build. Pictures stored in the old MinIO volume do not appear in the new volume. Upload them again through the management Skill if they are still needed. If an already issued device code has expired, ask the agent for a new one.

Before rolling the application image back to 0.1.0, confirm the deployment still uses object storage and .env names that version understands. Changing only MERCLINK_IMAGE does not turn rustfs_data back into minio_data.

Assets 2
Loading