build(GOV-009): 对齐应用部署与运行入口

deploy/compose/production.yml.example

@@ -4,27 +4,50 @@ name: a-share-analysis-production
 services:
   web:
     image: ${A_SHARE_WEB_IMAGE:?必须提供不可变 Web 镜像引用}
-    env_file: ${A_SHARE_WEB_ENV_FILE:-/etc/a-share-analysis/web.env}
     ports:
-      - "127.0.0.1:8080:80"
+      - '127.0.0.1:8080:80'
+    depends_on:
+      api:
+        condition: service_healthy
+    healthcheck:
+      test: ['CMD', 'wget', '-q', '-O', '/dev/null', 'http://127.0.0.1/']
+      interval: 30s
+      timeout: 3s
+      retries: 3
+      start_period: 5s
     restart: unless-stopped
 
   api:
     image: ${A_SHARE_SERVER_IMAGE:?必须提供不可变 Server 镜像引用}
-    command: ["node", "dist/apps/api/main.js"]
+    command: ['node', 'dist/apps/api/main.js']
     env_file: ${A_SHARE_API_ENV_FILE:-/etc/a-share-analysis/api.env}
+    environment:
+      # 容器网络需要对 Web 服务可达；源码部署模板仍只监听回环地址。
+      API_HOST: 0.0.0.0
     ports:
-      - "127.0.0.1:3000:3000"
+      - '127.0.0.1:3000:3000'
+    healthcheck:
+      test:
+        [
+          'CMD',
+          'node',
+          '-e',
+          "fetch('http://127.0.0.1:3000/api/v1/health').then(r=>{if(!r.ok)process.exit(1)}).catch(()=>process.exit(1))",
+        ]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 10s
     restart: unless-stopped
 
   scheduler:
     image: ${A_SHARE_SERVER_IMAGE:?必须提供不可变 Server 镜像引用}
-    command: ["node", "dist/apps/scheduler/main.js"]
+    command: ['node', 'dist/apps/scheduler/main.js']
     env_file: ${A_SHARE_SCHEDULER_ENV_FILE:-/etc/a-share-analysis/scheduler.env}
     restart: unless-stopped
 
   worker:
     image: ${A_SHARE_SERVER_IMAGE:?必须提供不可变 Server 镜像引用}
-    command: ["node", "dist/apps/worker/main.js"]
+    command: ['node', 'dist/apps/worker/main.js']
     env_file: ${A_SHARE_WORKER_ENV_FILE:-/etc/a-share-analysis/worker.env}
     restart: unless-stopped

deploy/env/development/web.env.example

@@ -1,5 +1,5 @@
 # VITE 变量会进入浏览器，只允许公开配置。
 VITE_APP_ENV=development
 VITE_APP_TITLE=A-Share Analysis
-VITE_API_BASE_URL=http://127.0.0.1:3000/api
+VITE_API_BASE_URL=http://127.0.0.1:3000
 VITE_ENABLE_DEVTOOLS=true

deploy/env/production/web.env.example

@@ -1,5 +1,5 @@
 # VITE 变量会进入浏览器，只允许公开配置。
 VITE_APP_ENV=production
 VITE_APP_TITLE=A-Share Analysis
-VITE_API_BASE_URL=/api
+VITE_API_BASE_URL=
 VITE_ENABLE_DEVTOOLS=false

deploy/systemd/a-share-api.service.example

@@ -9,11 +9,14 @@ User=a-share
 Group=a-share
 WorkingDirectory=/opt/a-share-analysis/current
 EnvironmentFile=/etc/a-share-analysis/api.env
-ExecStart=/usr/bin/node server/dist/apps/api/main.js
+ExecStart=/usr/bin/node /opt/a-share-analysis/current/server/dist/apps/api/main.js
+ExecStartPre=/usr/bin/test -r /etc/a-share-analysis/api.env
 Restart=on-failure
 RestartSec=5
 NoNewPrivileges=true
 PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
 
 [Install]
 WantedBy=multi-user.target

deploy/systemd/a-share-scheduler.service.example

@@ -9,11 +9,14 @@ User=a-share
 Group=a-share
 WorkingDirectory=/opt/a-share-analysis/current
 EnvironmentFile=/etc/a-share-analysis/scheduler.env
-ExecStart=/usr/bin/node server/dist/apps/scheduler/main.js
+ExecStart=/usr/bin/node /opt/a-share-analysis/current/server/dist/apps/scheduler/main.js
+ExecStartPre=/usr/bin/test -r /etc/a-share-analysis/scheduler.env
 Restart=on-failure
 RestartSec=5
 NoNewPrivileges=true
 PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
 
 [Install]
 WantedBy=multi-user.target

deploy/systemd/a-share-worker.service.example

@@ -9,11 +9,14 @@ User=a-share
 Group=a-share
 WorkingDirectory=/opt/a-share-analysis/current
 EnvironmentFile=/etc/a-share-analysis/worker.env
-ExecStart=/usr/bin/node server/dist/apps/worker/main.js
+ExecStart=/usr/bin/node /opt/a-share-analysis/current/server/dist/apps/worker/main.js
+ExecStartPre=/usr/bin/test -r /etc/a-share-analysis/worker.env
 Restart=on-failure
 RestartSec=5
 NoNewPrivileges=true
 PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
 
 [Install]
 WantedBy=multi-user.target