deploy: 2c5cbbb — 更新 docker-compose.yml

docker-compose.yml

@@ -8,13 +8,8 @@ services:
     # multiple commits per day; /model/delete field names, config.yaml keys, and
     # routing behaviour have all changed between minor versions without notice.
     #
-    # "main-stable" is the LiteLLM-maintained tag that always points to the
-    # latest release that has passed their 12-hour load-test suite. It is still
-    # a moving target, so for production deployments pin to a specific version:
-    #   ghcr.io/berriai/litellm:main-v1.81.14-stable
-    #
-    # To upgrade: review the release notes at https://docs.litellm.ai/release_notes
-    # then bump the version below and redeploy.
+    # Pin to a specific stable version. To upgrade: review release notes at
+    # https://docs.litellm.ai/release_notes then bump the version and redeploy.
     image: ghcr.io/berriai/litellm:main-v1.81.14-stable
     container_name: ai_gateway_litellm
     restart: unless-stopped
@@ -23,14 +18,19 @@ services:
       - litellm_data:/app/data
     environment:
       - LITELLM_MASTER_KEY=${LITELLM_MASTER_KEY:-sk-gateway-master-key}
-      # NOTE: STORE_MODEL_IN_DB requires PostgreSQL (not SQLite) in LiteLLM >= 1.x.
-      # We omit it here — our backend manages model persistence via SQLite and
-      # re-registers models with LiteLLM on startup via the /model/new API.
+      # BUG FIX: Added LITELLM_SALT_KEY. If DATABASE_URL is ever configured,
+      # LiteLLM uses this key to encrypt provider API keys at rest in the DB.
+      # Without it, stored keys are written as plaintext.
+      # Set a random value in .env and NEVER change it after first use —
+      # changing it makes all previously stored encrypted keys unreadable.
+      - LITELLM_SALT_KEY=${LITELLM_SALT_KEY:-}
+      # Optional: set DATABASE_URL in .env for model persistence across restarts.
+      # Must be a PostgreSQL direct connection URL (port 5432, not pooler port 6432).
+      # Example: DATABASE_URL=postgresql://user:pass@host:5432/dbname?sslmode=require
+      # Leave blank (default) to run without a database — models are re-registered
+      # from SQLite on each backend startup via the /model/new API.
+      - DATABASE_URL=${DATABASE_URL:-}
       - PORT=4000
-    # NOTE: --detailed_debug flag is intentionally omitted.
-    # It dumps every internal processing step (including per-token details) to
-    # stdout, causing massive log volume and container slowdown in production.
-    # Use --debug only during active troubleshooting; omit it normally.
     command: >
       --config /app/config.yaml
       --port 4000
@@ -60,6 +60,7 @@ services:
       - DB_PATH=/app/data/gateway.db
       - JWT_SECRET=${JWT_SECRET:-super-secret-jwt-key-change-in-production}
       - GATEWAY_PUBLIC_URL=${GATEWAY_PUBLIC_URL:-http://localhost}
+      - LOG_LEVEL=${LOG_LEVEL:-http}
     volumes:
       - backend_data:/app/data
     depends_on:
@@ -72,6 +73,7 @@ services:
       interval: 20s
       timeout: 5s
       retries: 3
+      start_period: 10s
 
   # ─── Frontend ─────────────────────────────────────────────────────────────
   frontend:
@@ -87,6 +89,12 @@ services:
       - gateway_net
     depends_on:
       - backend
+    healthcheck:
+      test: ["CMD-SHELL", "wget --quiet --tries=1 -O /dev/null http://localhost:80/ || exit 1"]
+      interval: 20s
+      timeout: 5s
+      retries: 3
+      start_period: 10s
 
   # ─── Nginx Reverse Proxy ──────────────────────────────────────────────────
   nginx:
@@ -95,15 +103,23 @@ services:
     restart: unless-stopped
     ports:
       - "${HTTP_PORT:-80}:80"
-      # To enable HTTPS: add certs to nginx/ssl/ and uncomment below + add SSL server block to nginx.conf
+      # To enable HTTPS: add certs to nginx/ssl/ and uncomment below
       # - "${HTTPS_PORT:-443}:443"
     volumes:
       - ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro
       - nginx_logs:/var/log/nginx
+    # BUG FIX: Previously used plain depends_on (only waits for container to
+    # exist, not for services to be healthy). LiteLLM needs ~60s to initialise;
+    # nginx starting too early forwards /v1/ requests to a not-yet-ready
+    # upstream and returns 502 to users for the entire startup window.
+    # Fix: require both backend and frontend to pass their healthchecks before
+    # nginx starts. LiteLLM health is already transitively guaranteed because
+    # backend depends_on litellm with condition: service_healthy.
     depends_on:
-      - frontend
-      - backend
-      - litellm
+      backend:
+        condition: service_healthy
+      frontend:
+        condition: service_healthy
     networks:
       - gateway_net
 
@@ -114,4 +130,4 @@ volumes:
 
 networks:
   gateway_net:
-    driver: bridge
+    driver: bridge