KKCE：免备案VPS、把它做成“按 PR 生灭的预览沙盒”网站测速、400+在线节点

开发者推 PR
   │ Webhook / CI
   ▼
CI 构建镜像 → 推私有 Registry
   │ SSH 到免备案VPS
   ▼
docker compose -p pr-184 up -d
   ├─ api (独立容器)
   ├─ worker (可选)
   ├─ postgres (独立库+独立 volume)
   └─ Traefik 标签路由：pr-184.preview.example.com
        │
        ▼
评审员访问 https://pr-184.preview.example.com （Basic Auth）

# 创建部署用户
adduser deploy
usermod -aG docker,sudo deploy
# 装 Docker
apt-get install -y ca-certificates curl gnupg
install -m 0755 -d /etc/apt/keyrings
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg
echo "deb [arch=amd64 signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu $(. /etc/os-release && echo $VERSION_CODENAME) stable" > /etc/apt/sources.list.d/docker.list
apt-get update
apt-get install -y docker-ce docker-compose-plugin

A    preview.example.com         → VPS_IP
CNAME *.preview.example.com      → preview.example.com

services:
  traefik:
    image: traefik:v3.3
    command:
      - --providers.docker=true
      - --providers.docker.exposedbydefault=false
      - --entrypoints.web.address=:80
      - --entrypoints.websecure.address=:443
      - --certificatesresolvers.letsencrypt.acme.dnschallenge=true
      - --certificatesresolvers.letsencrypt.acme.dnschallenge.provider=cloudflare
      - --certificatesresolvers.letsencrypt.acme.email=ops@example.com
      - --certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json
    environment:
      CF_DNS_API_TOKEN: ${CF_TOKEN}
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./letsencrypt:/letsencrypt
    networks:
      - traefik-public
networks:
  traefik-public:
    name: traefik-public

# pr-184/docker-compose.yml
services:
  api:
    image: registry.example.com/app/api:pr-184
    labels:
      - traefik.enable=true
      - traefik.http.routers.api-pr184.rule=Host(`pr-184.preview.example.com`)
      - traefik.http.routers.api-pr184.entrypoints=websecure
      - traefik.http.routers.api-pr184.tls.certresolver=letsencrypt
      - traefik.http.middlewares.pr184-auth.basicauth.users=${BASIC_AUTH}
    environment:
      DATABASE_URL: postgres://preview:preview@db:5432/pr184
      NODE_ENV: preview
    networks:
      - traefik-public
      - pr184
  db:
    image: postgres:16-alpine
    environment:
      POSTGRES_USER: preview
      POSTGRES_PASSWORD: preview
      POSTGRES_DB: pr184
    volumes:
      - pr184_pg:/var/lib/postgresql/data
    networks:
      - pr184
networks:
  traefik-public:
    external: true
  pr184:
    name: pr184
volumes:
  pr184_pg:

ssh deploy@vps "
  mkdir -p /opt/previews/pr-184
  cat > /opt/previews/pr-184/docker-compose.yml <<'EOF'
  $(cat pr-184/docker-compose.yml)
EOF
  cd /opt/previews/pr-184
  docker compose -p pr-184 up -d
"

echo "预览环境已就绪：https://pr-184.preview.example.com" | gh pr comment 184 --body-file -

# 中间件加安全头
- traefik.http.middlewares.pr184-sec.headers.customresponseheaders.X-Robots-Tag=noindex,nofollow

add_header X-Robots-Tag "noindex, nofollow" always;

#!/bin/bash
for d in /opt/previews/*/; do
  pr=$(basename "$d")
  # 查 PR 状态（GitHub CLI）
  state=$(gh pr view "${pr#pr-}" --json state -q .state 2>/dev/null)
  if [ "$state" = "MERGED" ] || [ "$state" = "CLOSED" ]; then
    docker compose -p "$pr" down -v
    rm -rf "$d"
    echo "$(date) destroyed $pr"
  fi
done

[Timer]
OnCalendar=hourly
Persistent=true

# 创建时写元数据
echo '{"pr":184,"expire":"2026-11-02T00:00:00Z"}' > /opt/previews/pr-184/meta.json
# 清理脚本顺手看 expire

ufw default deny incoming
ufw allow 80,443/tcp
ufw allow from 办公IP to any port 22222
ufw enable

services:
  api:
    deploy:
      resources:
        limits:
          cpus: "1.0"
          memory: 512M

docker system prune -f --filter "until=24h"