From f2921fa9f63d2e7bd5ccb3948ee201b673d650cd Mon Sep 17 00:00:00 2001 From: Codex Date: Sun, 27 Sep 2026 22:05:43 -0700 Subject: [PATCH] feat: expose BookOrbit through HK edge --- servers/bwh-hk-cmi/bookorbit-edge/README.md | 10 ++++++ .../bwh-hk-cmi/bookorbit-edge/compose.yaml | 35 +++++++++++++++++++ servers/bwh-hk-cmi/bookorbit-edge/frps.toml | 11 ++++++ servers/bwh-hk-cmi/web/Caddyfile | 4 +++ servers/bwh-hk-cmi/web/README.md | 1 + servers/media-core/bookorbit-edge/README.md | 9 +++++ .../media-core/bookorbit-edge/compose.yaml | 27 ++++++++++++++ servers/media-core/bookorbit-edge/frpc.toml | 24 +++++++++++++ servers/media-core/bookorbit/README.md | 1 + servers/media-core/bookorbit/compose.yaml | 4 +-- 10 files changed, 124 insertions(+), 2 deletions(-) create mode 100644 servers/bwh-hk-cmi/bookorbit-edge/README.md create mode 100644 servers/bwh-hk-cmi/bookorbit-edge/compose.yaml create mode 100644 servers/bwh-hk-cmi/bookorbit-edge/frps.toml create mode 100644 servers/media-core/bookorbit-edge/README.md create mode 100644 servers/media-core/bookorbit-edge/compose.yaml create mode 100644 servers/media-core/bookorbit-edge/frpc.toml diff --git a/servers/bwh-hk-cmi/bookorbit-edge/README.md b/servers/bwh-hk-cmi/bookorbit-edge/README.md new file mode 100644 index 0000000..b6ea63e --- /dev/null +++ b/servers/bwh-hk-cmi/bookorbit-edge/README.md @@ -0,0 +1,10 @@ +# BookOrbit HK 公网边缘 + +该项目运行 FRP 服务端，接收 `media-core` 主动建立的加密隧道。BookOrbit 只映射到容器网络 `hk-web` 的 `bookorbit-frps:13000`，不直接发布该业务端口；Caddy 负责 `https://books.kais.cloud` 的 TLS 和反向代理。 + +- 公网隧道控制端口：TCP `7000` +- 内部 BookOrbit 端口：TCP `13000`，仅 `hk-web` 可见 +- 密钥：Arcane Project Environment 中的 `FRP_TOKEN`，不得写入 Git +- 镜像：FRP `0.71.0`，固定 OCI index digest + +`FRP_TOKEN` 必须和 `servers/media-core/bookorbit-edge` 项目一致。该项目不启用 FRP Dashboard，也不允许客户端申请 `13000` 以外的远端端口。 diff --git a/servers/bwh-hk-cmi/bookorbit-edge/compose.yaml b/servers/bwh-hk-cmi/bookorbit-edge/compose.yaml new file mode 100644 index 0000000..afdca15 --- /dev/null +++ b/servers/bwh-hk-cmi/bookorbit-edge/compose.yaml @@ -0,0 +1,35 @@ +x-arcane: + icon: book-open + urls: + - https://books.kais.cloud/ + +services: + frps: + image: ghcr.io/fatedier/frps:v0.71.0@sha256:cd8b947ba61678b200baa4f71ccc33f3c52e4e2cc0059700ba3b8354e36af7c3 + container_name: bookorbit-frps + restart: unless-stopped + command: ["-c", "/etc/frp/frps.toml"] + environment: + FRP_TOKEN: ${FRP_TOKEN} + ports: + - "7000:7000" + volumes: + - ./frps.toml:/etc/frp/frps.toml:ro + networks: + - hk-web + security_opt: + - no-new-privileges:true + cap_drop: + - ALL + labels: + com.getarcaneapp.arcane.icon: book-open + logging: + driver: json-file + options: + max-size: 2m + max-file: "3" + +networks: + hk-web: + external: true + name: hk-web diff --git a/servers/bwh-hk-cmi/bookorbit-edge/frps.toml b/servers/bwh-hk-cmi/bookorbit-edge/frps.toml new file mode 100644 index 0000000..c3d5e60 --- /dev/null +++ b/servers/bwh-hk-cmi/bookorbit-edge/frps.toml @@ -0,0 +1,11 @@ +bindAddr = "0.0.0.0" +bindPort = 7000 + +auth.method = "token" +auth.token = "{{ .Envs.FRP_TOKEN }}" + +transport.tls.force = true + +allowPorts = [ + { start = 13000, end = 13000 } +] diff --git a/servers/bwh-hk-cmi/web/Caddyfile b/servers/bwh-hk-cmi/web/Caddyfile index d66b262..58c35d3 100644 --- a/servers/bwh-hk-cmi/web/Caddyfile +++ b/servers/bwh-hk-cmi/web/Caddyfile @@ -28,3 +28,7 @@ api.opfo.xyz { gitea.kais.cloud { reverse_proxy gitea-hk:3000 } + +books.kais.cloud { + reverse_proxy bookorbit-frps:13000 +} diff --git a/servers/bwh-hk-cmi/web/README.md b/servers/bwh-hk-cmi/web/README.md index a9dc577..a446a74 100644 --- a/servers/bwh-hk-cmi/web/README.md +++ b/servers/bwh-hk-cmi/web/README.md @@ -7,4 +7,5 @@ - Caddy HTTPS 只在 Docker 网络内由 HAProxy 转发，宿主机另发布 HTTP 80；HTTP/3 已关闭，将 UDP 443 留给 Hysteria2。 - `api.opfo.xyz` 由 Caddy 通过共享外部网络 `hk-web` 反向代理到 `litellm-api:1049`；LiteLLM 自身使用 `LITELLM_MASTER_KEY` 校验 Bearer token，Caddy 不重复保存或校验该密钥。 - `gitea.kais.cloud` 由 Caddy 转发到共享外部网络 `hk-web` 上的 `gitea-hk:3000`；Gitea 本体属于独立 Git Sync 项目。 +- `books.kais.cloud` 由 Caddy 转发到 `hk-web` 上的 `bookorbit-frps:13000`。该端口来自 media-core 主动建立的 FRP 隧道，Caddy 不增加 Basic Auth 或登录代理，以兼容 BookOrbit 的 KOReader、OPDS 和设备 API。 - `metacubexd` 与 `metube` 不迁移。 diff --git a/servers/media-core/bookorbit-edge/README.md b/servers/media-core/bookorbit-edge/README.md new file mode 100644 index 0000000..e0c9ce9 --- /dev/null +++ b/servers/media-core/bookorbit-edge/README.md @@ -0,0 +1,9 @@ +# BookOrbit media-core 隧道客户端 + +该项目通过 FRP 将 media-core 本机的 BookOrbit `127.0.0.1:3000` 主动映射到 HK 边缘容器的内部端口 `13000`。使用 host network 只为访问 BookOrbit 的本机发布端口，不挂载 Docker socket，也不开放管理界面。 + +- 服务端：`104.245.43.84:7000` +- 本地上游：`127.0.0.1:3000` +- HK 内部映射：`bookorbit-frps:13000` +- 密钥：Arcane Project Environment 中的 `FRP_TOKEN`，必须和 HK 项目一致 +- 链路：FRP TLS + wire protocol v2；失败后持续重连 diff --git a/servers/media-core/bookorbit-edge/compose.yaml b/servers/media-core/bookorbit-edge/compose.yaml new file mode 100644 index 0000000..7a28df5 --- /dev/null +++ b/servers/media-core/bookorbit-edge/compose.yaml @@ -0,0 +1,27 @@ +x-arcane: + icon: book-open + urls: + - https://books.kais.cloud/ + +services: + frpc: + image: ghcr.io/fatedier/frpc:v0.71.0@sha256:99ece6a2b62cfc68731e0df289af804ff1c699911cfc47871856434f1d6d53ee + container_name: bookorbit-frpc + restart: unless-stopped + network_mode: host + command: ["-c", "/etc/frp/frpc.toml"] + environment: + FRP_TOKEN: ${FRP_TOKEN} + volumes: + - ./frpc.toml:/etc/frp/frpc.toml:ro + security_opt: + - no-new-privileges:true + cap_drop: + - ALL + labels: + com.getarcaneapp.arcane.icon: book-open + logging: + driver: json-file + options: + max-size: 2m + max-file: "3" diff --git a/servers/media-core/bookorbit-edge/frpc.toml b/servers/media-core/bookorbit-edge/frpc.toml new file mode 100644 index 0000000..281ebe8 --- /dev/null +++ b/servers/media-core/bookorbit-edge/frpc.toml @@ -0,0 +1,24 @@ +serverAddr = "104.245.43.84" +serverPort = 7000 +loginFailExit = false + +auth.method = "token" +auth.token = "{{ .Envs.FRP_TOKEN }}" + +transport.protocol = "tcp" +transport.tls.enable = true +transport.wireProtocol = "v2" + +[[proxies]] +name = "bookorbit" +type = "tcp" +localIP = "127.0.0.1" +localPort = 3000 +remotePort = 13000 + +[proxies.healthCheck] +type = "http" +path = "/api/v1/health" +timeoutSeconds = 5 +maxFailed = 3 +intervalSeconds = 10 diff --git a/servers/media-core/bookorbit/README.md b/servers/media-core/bookorbit/README.md index 5c27f79..ef75910 100644 --- a/servers/media-core/bookorbit/README.md +++ b/servers/media-core/bookorbit/README.md @@ -6,6 +6,7 @@ - App data: `/opt/media-core/appdata/bookorbit/app` - PostgreSQL: `/opt/media-core/appdata/bookorbit/postgres` - Secrets: `/opt/media-core/appdata/bookorbit/secrets` (`0600`, not in Git) +- Public URL: `https://books.kais.cloud` through the media-core FRP client and HK Caddy; LAN port `3000` remains available for recovery. Create the first library with container path `/books`. Do not later widen or replace that root without a database backup and a tested migration: BookOrbit currently has an open issue where root-folder changes can duplicate books or lose metadata and reading progress. diff --git a/servers/media-core/bookorbit/compose.yaml b/servers/media-core/bookorbit/compose.yaml index 3cb28fb..f10eeb4 100644 --- a/servers/media-core/bookorbit/compose.yaml +++ b/servers/media-core/bookorbit/compose.yaml @@ -17,8 +17,8 @@ services: environment: NODE_ENV: production PORT: "3000" - APP_URL: http://192.168.50.46:3000 - CLIENT_URL: http://192.168.50.46:3000 + APP_URL: https://books.kais.cloud + CLIENT_URL: https://books.kais.cloud POSTGRES_HOST: postgres POSTGRES_PORT: "5432" POSTGRES_USER: bookorbit