部署教程

services:
  # MySQL 8.0 数据库
  mysql_db:
    image: ccr.ccs.tencentyun.com/jxwaf/mysql:8.0
    restart: always
    network_mode: host                              # 使用宿主机网络
    environment:
      MYSQL_ROOT_PASSWORD: 958fba75-56c6-4e81-a892-62517a9e1739  # 建议生产环境修改
      MYSQL_CHARSET: utf8mb4
      MYSQL_COLLATION: utf8mb4_0900_ai_ci
      MYSQL_DEFAULT_AUTHENTICATION_PLUGIN: mysql_native_password
    command:
      - --default-authentication-plugin=mysql_native_password
      - --character-set-server=utf8mb4
      - --collation-server=utf8mb4_0900_ai_ci
      - --innodb_buffer_pool_size=256M
      - --bind-address=127.0.0.1                    # 仅本地访问，不暴露外网
    volumes:
      - /opt/jxwaf_data/mysql:/var/lib/mysql

  # JXWAF 控制台
  jxwaf_admin_server:
    image: ccr.ccs.tencentyun.com/jxwaf/jxwaf_admin_server_professional:6.1.0
    restart: unless-stopped
    depends_on:
      - mysql_db
    network_mode: host                              # 使用宿主机网络
    environment:
      ENABLE_HTTPS: false
      MYSQL_HOST: 127.0.0.1
      MYSQL_PORT: 3306
      MYSQL_DATABASE: jxwaf_admin_server
      MYSQL_USER: root
      MYSQL_PASSWORD: 958fba75-56c6-4e81-a892-62517a9e1739
      HTTP_PORT: 80
      #HTTPS_PORT: 443
      JXWAF_MODEL_SERVER_HOST: model.jxwaf.com      # AI 模型服务器地址
      JXWAF_MODEL_SERVER_PORT: 39977
      JXWAF_MODEL_SERVER_SSL: true
      WAF_UPDATE_CONF_DATA_SIZE: "100m"
      CONF_DATA_SIZE: "100m"
      MODEL_DATA_SIZE: "100m"
      TZ: Asia/Shanghai
    # 如需启用 HTTPS，取消下面注释并放置证书文件
    #volumes:
    #  - ./ssl_certs/server.crt:/opt/jxwaf_admin_server/nginx/conf/server.crt
    #  - ./ssl_certs/server.key:/opt/jxwaf_admin_server/nginx/conf/server.key

services:
  jxwaf_base:
    image: "ccr.ccs.tencentyun.com/jxwaf/jxwaf_node_professional:6.1.0"
    network_mode: host
    privileged: true
    ulimits:
      nofile:
        soft: 602400
        hard: 602400
    environment:
      # 多端口用逗号分隔，如: HTTP_PORT: 80,8080,8888
      HTTP_PORT: 80,8000
      # 多端口用逗号分隔，如: HTTPS_PORT: 443,8443
      HTTPS_PORT: 443,8443
      JXWAF_INNER: 200m
      SSL_ATTACK_STAT_SIZE: 100m
      SSL_BLACK_IP_SIZE: 100m
      SSL_ATTACK_PROTECT: "false"
      SSL_ATTACK_STAT_TIME: 60
      SSL_ATTACK_STAT_COUNT: 10000
      SSL_ATTACK_BLOCK_TIME: 600
      JXWAF_SERVER: you_jxwaf_server_url
      WAF_AUTH: you_auth_key
      TZ: Asia/Shanghai
    restart: unless-stopped
    # 如需自定义 Nginx 模板，取消下面注释并修改 nginx.conf.tmpl
    #volumes:
    #  - ./nginx.conf.tmpl:/opt/jxwaf/nginx/conf/nginx.conf.tmpl:ro

  jxwaf_nft_node:
    image: ccr.ccs.tencentyun.com/jxwaf/jxwaf_nft_node:6.0
    container_name: jxwaf_nft_node
    restart: always
    network_mode: host
    privileged: true
    environment:
      WAF_SERVER_URL: you_jxwaf_server_url
      WAF_AUTH: you_auth_key
      SYNC_INTERVAL: 3
      TZ: Asia/Shanghai

networks:
  clickhouse_network:
    driver: bridge
    ipam:
      config:
        - subnet: 172.10.0.0/16

services:
  # ClickHouse 数据库
  clickhouse:
    image: "ccr.ccs.tencentyun.com/jxwaf/clickhouse-server:22.8.5-alpine"
    ports:
      - "9000:9000"                                 # TCP 协议端口
      - "9004:9004"                                 # MySQL 兼容端口
    environment:
      CLICKHOUSE_DB: jxwaf                          # 默认数据库
      CLICKHOUSE_USER: jxlog                        # 默认用户
      CLICKHOUSE_PASSWORD: jxlog                    # 用户密码（建议生产环境修改）
    volumes:
      - /opt/jxwaf_data/clickhouse:/var/lib/clickhouse
    restart: unless-stopped
    networks:
      clickhouse_network:
        ipv4_address: 172.10.0.10

  # jxlog 日志采集服务
  jxlog:
    container_name: jxlog
    image: "ccr.ccs.tencentyun.com/jxwaf/jxlog_professional:1.0"
    ports:
      - "8877:8877"                                 # 日志接收端口
    environment:
      CLICKHOUSE: 172.10.0.10:9000                  # ClickHouse 地址
      DATABASE: jxwaf                               # 数据库名
      USERNAME: jxlog                               # 数据库用户
      PASSWORD: jxlog                               # 数据库密码
      TABLE: jxlog                                  # 表名
      TCPSERVER: 0.0.0.0                            # 监听地址
      TCPPORT: 8877                                 # 监听端口
      BATCH_SIZE: 1000                              # 批量写入大小
      BATCH_WAIT_TIMEOUT: 3                         # 批量等待超时（秒）
      TTL_DAYS: 30                                  # 数据保留天数
      ENGINE: MergeTree                             # ClickHouse 表引擎
    depends_on:
      - clickhouse
    restart: unless-stopped
    networks:
      clickhouse_network:
        ipv4_address: 172.10.0.11