mkdir /opt/selfhost/halo
cd /opt/selfhost/halo

vim docker-compose.yml

version: "3"

services:
  halo:
    image: halohub/halo-pro:2.21
    restart: on-failure:3
    depends_on:
      halodb:
        condition: service_healthy
    networks:
      halo_network:
    volumes:
      - ./halo2:/root/.halo2
    ports:
      - "8090:8090"
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8090/actuator/health/readiness"]
      interval: 30s
      timeout: 5s
      retries: 5
      start_period: 30s          
    command:
      - --spring.r2dbc.url=r2dbc:pool:postgresql://halodb/halo
      - --spring.r2dbc.username=halo
      # PostgreSQL 的密码，请保证与下方 POSTGRES_PASSWORD 的变量值一致。
      - --spring.r2dbc.password=openpostgresql
      - --spring.sql.init.platform=postgresql
      # 外部访问地址，请根据实际需要修改
      - --halo.external-url=http://localhost:8090/
  halodb:
    image: postgres:15.4
    restart: on-failure:3
    networks:
      halo_network:
    volumes:
      - ./db:/var/lib/postgresql/data
    healthcheck:
      test: [ "CMD", "pg_isready" ]
      interval: 10s
      timeout: 5s
      retries: 5
    environment:
      - POSTGRES_PASSWORD=openpostgresql
      - POSTGRES_USER=halo
      - POSTGRES_DB=halo
      - PGUSER=halo

networks:
  halo_network:

docker compose up -d

#!/bin/bash
# 自动从 Cloudflare 获取最新 IPv4/IPv6 段并更新 UFW 规则
# 作者: ChatGPT (自动生成)
# 更新时间: $(date)

CF_IPV4_URL="https://www.cloudflare.com/ips-v4"
CF_IPV6_URL="https://www.cloudflare.com/ips-v6"

TMP_DIR="/tmp/cloudflare_ufw"
mkdir -p "$TMP_DIR"
TMP_V4="$TMP_DIR/cf_ipv4.txt"
TMP_V6="$TMP_DIR/cf_ipv6.txt"

# 下载最新 IP 列表
curl -s $CF_IPV4_URL -o $TMP_V4
curl -s $CF_IPV6_URL -o $TMP_V6

# 检查是否下载成功
if [[ ! -s $TMP_V4 || ! -s $TMP_V6 ]]; then
    echo "❌ 获取 Cloudflare IP 列表失败"
    exit 1
fi

echo "✅ Cloudflare IP 段已获取，开始更新 UFW 规则..."

# 重置 Cloudflare 相关规则
ufw --force reset

# 启用 UFW（如果未启用）
ufw --force enable


# 添加 Cloudflare IPv4
for ip in $(cat $TMP_V4); do
    ufw allow from $ip to any port 80,443 proto tcp
done

# 添加 Cloudflare IPv6
for ip in $(cat $TMP_V6); do
    ufw allow from $ip to any port 80,443 proto tcp
done

ufw reload
echo "✅ UFW 规则更新完成"
ufw status numbered

log_format main 'CDN_IP:$remote_addr - CLIENT_IP:$HTTP_X_FORWARDED_FOR - $remote_user [$time_local] "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent"';