给 Cloudreve 加上全文搜索：Tika 与 Meilisearch 的 ARM64 部署

name: cloudreve-fts
services:
  tika:
    image: apache/tika:3.2.3.0@sha256:8c160e01119845fb497e23f08e5fe13db7b0c085143916df4fb2f006e0aebcce
    platform: linux/arm64
    container_name: cloudreve-fts-tika
    restart: unless-stopped
    cpuset: "0-3"
    mem_limit: 2g
    pids_limit: 256
    environment:
      JAVA_TOOL_OPTIONS: "-Xms128m -Xmx768m -XX:ActiveProcessorCount=4 -Djava.io.tmpdir=/tmp"
    ports:
      - "127.0.0.1:9998:9998"
    read_only: true
    tmpfs:
      - /tmp:rw,nosuid,nodev,size=512m,mode=1777
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    ulimits:
      nofile:
        soft: 65535
        hard: 65535
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"
    networks:
      - fts
  meilisearch:
    image: getmeili/meilisearch:v1.54.3@sha256:80921338089709b607e6aff3bf7f6633a6b2800f5bb2756e6bb92c681304baa4
    platform: linux/arm64
    container_name: cloudreve-fts-meilisearch
    user: "10001:10001"
    restart: unless-stopped
    cpuset: "0-3"
    mem_limit: 2g
    pids_limit: 256
    environment:
      MEILI_ENV: production
      MEILI_MASTER_KEY: ${MEILI_MASTER_KEY:?必须在私密.env中配置随机密钥}
      MEILI_NO_ANALYTICS: "true"
      MEILI_EXPERIMENTAL_ALLOWED_IP_NETWORKS: "172.27.0.1/32"
      MEILI_DB_PATH: /meili_data/data.ms
      MEILI_DUMP_DIR: /meili_data/dumps
      MEILI_SNAPSHOT_DIR: /meili_data/snapshots
      MEILI_MAX_INDEXING_MEMORY: 512Mb
      MEILI_MAX_INDEXING_THREADS: "2"
    ports:
      - "127.0.0.1:7700:7700"
    volumes:
      - type: bind
        source: ./meili_data
        target: /meili_data
        bind:
          create_host_path: false
    read_only: true
    tmpfs:
      - /tmp:rw,nosuid,nodev,size=128m,mode=1777
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    ulimits:
      nofile:
        soft: 65535
        hard: 65535
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"
    networks:
      - fts
networks:
  fts:
    driver: bridge

#!/usr/bin/env bash
# 全文搜索依赖安装入口，默认只预演；不修改Cloudreve配置或业务索引。
set -euo pipefail
SOURCE=$(cd -- "$(dirname -- "$0")" && pwd)
RUNTIME=${FTS_RUNTIME:-/opt/DockerDate/cloudreve-fts}
if [[ ${1:-} != "" && ${1:-} != --apply ]]; then
  echo '用法：install.sh [--apply]' >&2
  exit 2
fi
[[ $RUNTIME == /* && $RUNTIME != / && $RUNTIME != */../* ]] || { echo '运行目录必须是明确的绝对路径' >&2; exit 1; }
[[ $(uname -m) == aarch64 ]] || { echo '仅适用于aarch64，其他架构请先调整镜像' >&2; exit 1; }
command -v docker >/dev/null
command -v openssl >/dev/null
docker compose version
[[ -f $SOURCE/compose.yaml ]] || { echo '缺少Compose文件' >&2; exit 1; }
echo "将安装到：$RUNTIME"
echo '镜像及索引必须位于系统盘；不会触碰USB盘、Cloudreve数据库或业务文件。'
echo '将保留已有密钥和索引；新环境随机生成密钥，端口只绑定127.0.0.1。'
if [[ ${1:-} != --apply ]]; then
  echo '预演完成；明确执行 --apply 才落盘、拉取镜像和启动容器。'
  exit 0
fi
[[ $EUID == 0 ]] || { echo '实际安装需root权限' >&2; exit 1; }
parent=$RUNTIME
while [[ ! -d $parent ]]; do parent=$(dirname -- "$parent"); done
[[ $(findmnt -T "$parent" -no TARGET) == / ]] || { echo '目标不是系统根盘，请先重新评估存储和USB守护配置' >&2; exit 1; }
[[ ! -L $RUNTIME ]] || { echo '运行目录不能是符号链接' >&2; exit 1; }
install -d -m 700 "$RUNTIME"
if [[ ! -e $RUNTIME/meili_data ]]; then
  install -d -m 700 -o 10001 -g 10001 "$RUNTIME/meili_data"
fi
[[ -d $RUNTIME/meili_data && ! -L $RUNTIME/meili_data && $(findmnt -T "$RUNTIME/meili_data" -no TARGET) == / ]] || { echo '索引目录不存在、是符号链接或不在系统盘' >&2; exit 1; }
if [[ ! -e $RUNTIME/.env ]]; then
  (umask 077; printf 'MEILI_MASTER_KEY=' > "$RUNTIME/.env"; openssl rand -hex 32 >> "$RUNTIME/.env")
fi
chmod 600 "$RUNTIME/.env"
if [[ -f $RUNTIME/compose.yaml ]]; then
  cp -a "$RUNTIME/compose.yaml" "$RUNTIME/compose.yaml.bak.$(date +%Y%m%d-%H%M%S)"
fi
install -m 644 "$SOURCE/compose.yaml" "$RUNTIME/compose.yaml"
docker compose --project-directory "$RUNTIME" config --quiet
docker compose --project-directory "$RUNTIME" pull
docker compose --project-directory "$RUNTIME" up -d
echo '安装完成。请等待服务就绪，再按使用说明填写Cloudreve后台。'
echo '1Panel可查看容器；本脚本未调用面板API登记编排，不要重复创建同名服务。'

sed -n 's/^MEILI_MASTER_KEY=//p' /opt/DockerDate/cloudreve-fts/.env

MEILI_MASTER_KEY=<随机 64 位十六进制密钥>

# 查看状态；1Panel 容器页面也能查看。未通过面板 API 登记编排，勿重复创建同名项目。
docker compose --project-directory /opt/DockerDate/cloudreve-fts ps
# 启动/重启/停止依赖（无外盘 bind，不会被 USB 守护反向恢复）
docker compose --project-directory /opt/DockerDate/cloudreve-fts up -d
docker compose --project-directory /opt/DockerDate/cloudreve-fts restart
docker compose --project-directory /opt/DockerDate/cloudreve-fts stop
# 日志（不要使用 config 输出密钥）
docker logs --tail 50 cloudreve-fts-tika
docker logs --tail 50 cloudreve-fts-meilisearch
# 容量与端点
du -sh /opt/DockerDate/cloudreve-fts/meili_data
df -h /
curl -fsS http://127.0.0.1:7700/health
curl -fsS http://127.0.0.1:9998/version
ss -lnt '( sport = :7700 or sport = :9998 )'
# 重跑局部验证，Python 必须使用已建虚拟环境
/root/AI/cloudreve-fts/.venv/bin/python /root/AI/cloudreve-fts/tests/verify.py

cd /root/AI/backup/cloudreve-fts
sha256sum -c MANIFEST.sha256
./restore.sh
./restore.sh --apply