1
version: "3.9"
2

3
services:
4
  db:
5
    image: m.daocloud.io/docker.io/library/postgres:15
6
    container_name: umami-db
7
    restart: unless-stopped
8
    environment:
9
      # 数据库名/用户/密码：你可以改，但要和下面 Umami 的 DATABASE_URL 对应
10
      POSTGRES_DB: umami
11
      POSTGRES_USER: umami
12
      POSTGRES_PASSWORD: "CHANGE_ME_STRONG_PASSWORD"
13
    volumes:
14
      # 持久化数据库数据，容器删除/重建不会丢
15
      - ./postgres:/var/lib/postgresql/data
16
    healthcheck:
17
      # 让 Umami 等数据库健康后再启动（减少首次启动时的报错概率）
18
      test: ["CMD-SHELL", "pg_isready -U umami -d umami"]
19
      interval: 10s
20
      timeout: 5s
21
      retries: 5
22

23
  umami:
24
    # 官方预构建镜像（含 postgresql 支持），两个 registry 二选一：
25
    image: docker.umami.is/umami-software/umami:postgresql-latest
26
    # image: umamisoftware/umami:postgresql-latest
27

28
    container_name: umami
29
    restart: unless-stopped
30
    depends_on:
31
      db:
32
        condition: service_healthy
33

34
    environment:
35
      # 注意：host 写 db（compose 网络内的服务名），不是 127.0.0.1
36
      DATABASE_URL: "postgresql://umami:CHANGE_ME_STRONG_PASSWORD@db:5432/umami"
37

38
      # 用于加密会话/令牌，必须随机且足够长
39
      APP_SECRET: "CHANGE_ME_RANDOM_SECRET"
40

41
      # 建议填写你对外访问的完整 URL（含 https）
42
      APP_URL: "https://analytics.example.com"
43

44
    ports:
45
      # 只绑 127.0.0.1，Umami 不直接暴露公网，外部走 Nginx 反代 + HTTPS
46
      - "127.0.0.1:3000:3000"

1
server {
2
    # 80 强制跳转到 443
3
    listen 80;
4
    server_name analytics.example.com;
5
    return 301 https://$host$request_uri;
6
}
7
server {
8
    listen 443 ssl http2;
9
    server_name analytics.example.com;
10

11
    # ssl证书
12
    ssl_certificate     /etc/nginx/ssl/analytics.example.com/fullchain.pem;
13
    ssl_certificate_key /etc/nginx/ssl/analytics.example.com/privkey.pem;
14

15
    # 反代到本机 Umami（只在 127.0.0.1:3000 监听）
16
    location / {
17
        proxy_pass http://127.0.0.1:3000;
18

19
        # 这些 header 很关键：让 Umami 识别真实域名、访客 IP、协议
20
        proxy_set_header Host $host;
21
        proxy_set_header X-Real-IP $remote_addr;
22
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
23
        proxy_set_header X-Forwarded-Proto $scheme;
24

25
        # HTTP/1.1 + 关闭缓冲，避免 WebSocket 或长连接异常
26
        proxy_http_version 1.1;
27
        proxy_buffering off;
28
    }
29
}