chore(deploy): 生产 docker compose + scratch Dockerfile + 部署文档

- docker-compose.prod.yml：仅 api 绑 127.0.0.1:8120，DB/redis/minio 不暴露，restart=unless-stopped，凭据走 .env
- api/Dockerfile.prod：runtime 改用 scratch + 拷贝 ca-certs（gcr.io/distroless 不可达环境），Go 模块走 goproxy.cn
- .env.example / docs/deploy.md

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

.env.example

@@ -0,0 +1,7 @@
+# Copy to .env and fill in real values before running docker-compose.prod.yml.
+# Used by docker-compose.prod.yml for production deployment.
+POSTGRES_USER=opengoods
+POSTGRES_PASSWORD=change-me
+POSTGRES_DB=opengoods
+MINIO_ROOT_USER=opengoods
+MINIO_ROOT_PASSWORD=change-me

.github/workflows/ci.yml

@@ -19,13 +19,11 @@ jobs:
           POSTGRES_USER: opengoods
           POSTGRES_PASSWORD: opengoods
           POSTGRES_DB: opengoods
-        ports:
-          - "5432:5432"
         options: >-
           --health-cmd "pg_isready -U opengoods"
           --health-interval 5s --health-timeout 5s --health-retries 10
     env:
-      OPENGOODS_DATABASE_URL: postgres://opengoods:opengoods@localhost:5432/opengoods?sslmode=disable
+      OPENGOODS_DATABASE_URL: postgres://opengoods:opengoods@postgres:5432/opengoods?sslmode=disable
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-go@v5
@@ -73,13 +71,11 @@ jobs:
           POSTGRES_USER: opengoods
           POSTGRES_PASSWORD: opengoods
           POSTGRES_DB: opengoods
-        ports:
-          - "5432:5432"
         options: >-
           --health-cmd "pg_isready -U opengoods"
           --health-interval 5s --health-timeout 5s --health-retries 10
     env:
-      DBURL: postgres://opengoods:opengoods@localhost:5432/opengoods?sslmode=disable
+      DBURL: postgres://opengoods:opengoods@postgres:5432/opengoods?sslmode=disable
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-go@v5

api/Dockerfile.prod

@@ -0,0 +1,16 @@
+# Build stage
+FROM golang:1.23-alpine AS build
+ENV GOPROXY=https://goproxy.cn,direct
+WORKDIR /src
+COPY go.mod go.sum ./
+RUN go mod download
+COPY . .
+RUN CGO_ENABLED=0 go build -o /out/server ./cmd/server
+
+# Runtime stage: scratch + ca-certs copied from the build image.
+# Used for deployments where gcr.io/distroless is not reachable.
+FROM scratch
+COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
+COPY --from=build /out/server /server
+EXPOSE 8080
+ENTRYPOINT ["/server"]

docker-compose.prod.yml

@@ -0,0 +1,61 @@
+name: goods
+services:
+  postgres:
+    image: postgres:16-alpine
+    restart: unless-stopped
+    environment:
+      POSTGRES_USER: ${POSTGRES_USER}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
+      POSTGRES_DB: ${POSTGRES_DB}
+    volumes:
+      - pgdata:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER}"]
+      interval: 5s
+      timeout: 5s
+      retries: 10
+
+  redis:
+    image: redis:7-alpine
+    restart: unless-stopped
+    healthcheck:
+      test: ["CMD", "redis-cli", "ping"]
+      interval: 5s
+      timeout: 5s
+      retries: 10
+
+  minio:
+    image: minio/minio:latest
+    restart: unless-stopped
+    command: server /data --console-address ":9001"
+    environment:
+      MINIO_ROOT_USER: ${MINIO_ROOT_USER}
+      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD}
+    volumes:
+      - miniodata:/data
+    healthcheck:
+      test: ["CMD", "mc", "ready", "local"]
+      interval: 5s
+      timeout: 5s
+      retries: 10
+
+  api:
+    build:
+      context: ./api
+      dockerfile: Dockerfile.prod
+    restart: unless-stopped
+    depends_on:
+      postgres:
+        condition: service_healthy
+      redis:
+        condition: service_healthy
+    environment:
+      OPENGOODS_ADDR: ":8080"
+      OPENGOODS_DATABASE_URL: "postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB}?sslmode=disable"
+      OPENGOODS_REDIS_URL: "redis://redis:6379/0"
+    ports:
+      - "127.0.0.1:8120:8080"
+
+volumes:
+  pgdata:
+  miniodata:

docs/deploy.md

@@ -0,0 +1,25 @@
+# 生产部署 (Docker)
+
+用 `docker-compose.prod.yml` 部署，与本地 `docker-compose.yml` 的区别：
+
+- 仅 `api` 映射宿主端口，且绑定 `127.0.0.1:8120`（由外层 nginx 反代 + HTTPS）；`postgres`/`redis`/`minio` 不对外暴露端口，仅容器内网互通。
+- 所有服务 `restart: unless-stopped`。
+- 凭据从 `.env` 注入（见 `.env.example`），不写入仓库。
+- `api` 使用 `api/Dockerfile.prod`：运行镜像用 `scratch`（从构建镜像拷贝 ca-certs），适用于 `gcr.io/distroless` 不可达的环境；Go 模块走 `goproxy.cn`。
+
+## 步骤
+
+```bash
+cp .env.example .env   # 填入真实随机密码
+docker compose -f docker-compose.prod.yml up -d --build
+
+# 迁移（migrate 容器接入同一网络，DSN 指向 postgres 服务）
+set -a; . ./.env; set +a
+DBURL="postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB}?sslmode=disable"
+docker run --rm --network goods_default -v "$PWD/migrations:/migrations" \
+  migrate/migrate -path=/migrations -database "$DBURL" up
+
+curl -s http://127.0.0.1:8120/healthz   # {"status":"ok"}
+```
+
+nginx 反代（子域 + HTTPS）：80 端口 301 跳转到 443，443 `proxy_pass http://127.0.0.1:8120`，证书用 acme.sh 签发并配 `--reloadcmd "nginx -s reload"` 自动续期。