# 创建名为 "nginx_all_in_one" 的 Docker Network
docker network create -d bridge nginx_all_in_one
# 也可以直接创建，因为默认网络类型就是 bridge
docker network create nginx_all_in_one

# 1. 先用docker创建nginx，复制对应文件
docker run --name nginx-demo -d nginx
# 2. 确保进入到 Nginx 项目位置
mkdir -p /home/docker-compose/nginx
cd /home/docker-compose/nginx
# 3. 创建相应的文件夹
mkdir -p ./data/conf/conf.d
mkdir -p ./data/www
# 4. 复制容器内的文件到宿主机
docker cp nginx-demo:/etc/nginx/nginx.conf ./data/conf/nginx.conf
docker cp nginx-demo:/etc/nginx/conf.d/default.conf ./data/conf/conf.d/default.conf
docker cp nginx-demo:/usr/share/nginx/html ./data/www
# 5. 最后删除容器
docker stop nginx-demo && docker rm nginx-demo

# 递归地创建 Nginx 项目文件夹
mkdir -p /home/docker-compose/nginx
# 创建 nginx-docker-compose.yaml
touch /home/docker-compose/nginx/nginx-docker-compose.yaml

version: '3.8'
services:
  nginx:
    image: nginx:1.23.3
    container_name: nginx
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./data/conf/conf.d:/etc/nginx/conf.d
      - ./data/conf/nginx.conf:/etc/nginx/nginx.conf
      - ./data/conf/ssl:/etc/nginx/ssl
      - ./data/logs:/var/log/nginx
      - ./data/www:/usr/share/nginx/html
    networks:
      - nginx_all_in_one
networks:
  nginx_all_in_one:
    external: true

# 确保进入到 "nginx-docker-compose.yaml" 同级目录
cd /home/docker-compose/nginx
# 使用 docker-compose 启动 nginx
# -f 表示指定 yaml 配置文件
# -d 表示后台运行，不需要显示日志到控制台上
# up 表示启动
docker-compose -f nginx-docker-compose.yaml up -d

server {
    listen 80;
    listen 443 ssl;
    charset utf-8;
    server_name minio-admin.example.com;

    #证书文件名称
    ssl_certificate ssl/minio-admin.example.com_bundle.crt; 
    #私钥文件名称
    ssl_certificate_key ssl/minio-admin.example.com.key; 
    ssl_session_timeout 5m;
    #请按照以下协议配置
    ssl_protocols TLSv1.2 TLSv1.3; 
    #请按照以下套件配置，配置加密套件，写法遵循 openssl 标准。
    ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:HIGH:!aNULL:!MD5:!RC4:!DHE; 
    ssl_prefer_server_ciphers on;
    
    # Allow special characters in headers
    ignore_invalid_headers off;
    # Allow any size file to be uploaded.
    # Set to a value such as 1000m; to restrict file size to a specific value
    client_max_body_size 100m;
    # Disable buffering
    proxy_buffering off;
    proxy_request_buffering off;

    location / {
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-NginX-Proxy true;

        # This is necessary to pass the correct IP to be hashed
        real_ip_header X-Real-IP;

        proxy_connect_timeout 300;

        # To support websockets in MinIO versions released after January 2023
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";

        chunked_transfer_encoding off;
        
        proxy_pass http://minio:9001;
    }
}

server {
    listen 80;
    listen 443 ssl;
    charset utf-8;
    server_name minio.example.com;

    #证书文件名称
    ssl_certificate ssl/minio.example.com_bundle.crt; 
    #私钥文件名称
    ssl_certificate_key ssl/minio.example.com.key; 
    ssl_session_timeout 5m;
    #请按照以下协议配置
    ssl_protocols TLSv1.2 TLSv1.3; 
    #请按照以下套件配置，配置加密套件，写法遵循 openssl 标准。
    ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:HIGH:!aNULL:!MD5:!RC4:!DHE; 
    ssl_prefer_server_ciphers on;
   
    # Allow special characters in headers
    ignore_invalid_headers off;
    # Allow any size file to be uploaded.
    # Set to a value such as 1000m; to restrict file size to a specific value
    client_max_body_size 100m;
    # Disable buffering
    proxy_buffering off;
    proxy_request_buffering off;

    location / {
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        proxy_connect_timeout 300;
        # Default is HTTP/1, keepalive is only enabled in HTTP/1.1
        proxy_http_version 1.1;
        proxy_set_header Connection "";
        chunked_transfer_encoding off;

        proxy_pass http://minio:9000;
    }

}

server {
    listen 80;
    listen 443 ssl;
    charset utf-8;
    server_name outline.example.com;

    #证书文件名称
    ssl_certificate ssl/outline.example.com_bundle.crt; 
    #私钥文件名称
    ssl_certificate_key ssl/outline.example.com.key; 
    ssl_session_timeout 5m;
    #请按照以下协议配置
    ssl_protocols TLSv1.2 TLSv1.3; 
    #请按照以下套件配置，配置加密套件，写法遵循 openssl 标准。
    ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:HIGH:!aNULL:!MD5:!RC4:!DHE; 
    ssl_prefer_server_ciphers on;

    location / {
        proxy_pass http://outline:3000/;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "Upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;proxy_set_header Host $host;
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Scheme $scheme;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_redirect off;
    }

    error_page   500 502 503 504  /50x.html;
    location = /50x.html {
        root   html;
    }

}

server {
    listen 80;
    #SSL 访问端口号为 443
    listen 443 ssl;
    charset utf-8;
    server_name sso.example.com;

    #证书文件名称
    ssl_certificate ssl/sso.example.com_bundle.crt; 
    #私钥文件名称
    ssl_certificate_key ssl/sso.example.com.key; 
    ssl_session_timeout 5m;
    #请按照以下协议配置
    ssl_protocols TLSv1.2 TLSv1.3; 
    #请按照以下套件配置，配置加密套件，写法遵循 openssl 标准。
    ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:HIGH:!aNULL:!MD5:!RC4:!DHE; 
    ssl_prefer_server_ciphers on;
   
    location / {
        proxy_pass http://keycloak:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    error_page   500 502 503 504  /50x.html;
    location = /50x.html {
        root   html;
    }

}

user  nginx;
worker_processes  auto;

error_log  /var/log/nginx/error.log notice;
pid        /var/run/nginx.pid;

events {
    worker_connections  1024;
}

http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';
    access_log  /var/log/nginx/access.log  main;
    sendfile        on;
    keepalive_timeout  65;
    gzip  on;
    # 导入所有配置文件
    include /etc/nginx/conf.d/*;
}

# 进入 Docker 容器
docker exec -it nginx /bin/bash

# 校验配置
nginx -t
# 如果输出以下内容，就说明配置文件校验成功
# nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
# nginx: configuration file /etc/nginx/nginx.conf test is successful

# 再刷新 Nginx 配置
nginx -s reload

# 没什么问题的话，可以输入 exit 退出
exit

docker network connect nginx_all_in_one name_of_postgres_container

version: '3.8'
services:
  postgres12:
    image: postgres:12.10
    container_name: postgres12
    restart: unless-stopped
    environment:
      POSTGRES_PASSWORD: password
      PGDATA: /var/lib/postgresql/data/pgdata
    volumes:
      - ./data:/var/lib/postgresql/data
    expose:
      - 5432
    networks:
        - nginx_all_in_one
networks:
  nginx_all_in_one:
    external: true

# 确保进入到 "postgres-docker-compose.yaml" 同级目录
cd /home/docker-compose/postgres
# 使用 docker-compose 启动 redis
docker-compose -f postgres-docker-compose.yaml up -d

# 进入 PostgreSQL 数据库命令行
docker exec -it --user postgres postgres12 psql -U postgres

# 创建用户
CREATE USER outline WITH PASSWORD 'password_of_outline_user';
CREATE USER keycloak WITH PASSWORD 'password_of_keycloak_user';

# 创建数据库
CREATE DATABASE outline OWNER outline;
CREATE DATABASE outline_test OWNER outline;
CREATE DATABASE keycloak OWNER keycloak;

# 退出命令行
\q

version: '3.8'
services:
  redis:
    image: redis:7.0.8
    container_name: redis
    restart: unless-stopped
    command: 
      --requirepass "password_of_redis"
    expose:
      - 6379
    volumes:
      - ./data:/data
    privileged: true
    networks:
      - nginx_all_in_one
networks:
  nginx_all_in_one:
    external: true

# 确保进入到 "redis-docker-compose.yaml" 同级目录
cd /home/docker-compose/redis
# 使用 docker-compose 启动 redis
docker-compose -f redis-docker-compose.yaml up -d

version: "3.8"
services:
  # keycloak
  keycloak:
    image: jboss/keycloak:15.0.2
    container_name: keycloak
    expose:
        - 8080
    volumes:
        - /etc/timezone:/etc/timezone
        - /etc/localtime:/etc/localtime
    environment:
        # 初始化密码
        - KEYCLOAK_USER=admin
        - KEYCLOAK_PASSWORD=password_of_keycloak
        # DB
        - DB_VENDOR=postgres
        - DB_ADDR=postgres12
        - DB_PORT=5432
        - DB_DATABASE=keycloak
        - DB_USER=keycloak
        - DB_PASSWORD=password_of_keycloak_user
        # 开启反向代理
        - PROXY_ADDRESS_FORWARDING=true
    labels:
        - "traefik.enable=true"
        - "traefik.docker.network=nginx_all_in_one"
        - "traefik.http.routers.halobug-sso.entrypoints=https"
        - "traefik.http.routers.halobug-sso.tls=true"
        - "traefik.http.routers.halobug-sso.rule=Host(`sso.example.com`)"
        - "traefik.http.services.halobug-sso.loadbalancer.server.scheme=http"
        - "traefik.http.services.halobug-sso.loadbalancer.server.port=8080"
    logging:
      driver: "json-file"
      options:
        max-size: "1m"
    networks:
        - nginx_all_in_one
networks:
  nginx_all_in_one:
    external: true

# 确保进入到 "keycloak-docker-compose.yaml" 同级目录
cd /home/docker-compose/keycloak
# 使用 docker-compose 启动 keycloak
docker-compose -f keycloak-docker-compose.yaml up -d

version: '3.8'
services:
  minio:
    image: minio/minio:RELEASE.2021-09-03T03-56-13Z
    container_name: minio
    restart: unless-stopped
    expose:
      - 9000
      - 9001
    environment:
      MINIO_ROOT_USER: "username_of_minio"
      MINIO_ROOT_PASSWORD: "password_of_minio"
      MINIO_REGION_NAME: "cn-outline-1"
      MINIO_BROWSER: "on"
      MINIO_SERVER_URL: "https://minio.example.com/"
      MINIO_BROWSER_REDIRECT_URL: "https://minio-admin.example.com/"
    volumes:
      - ./data:/data
    command: server /data --console-address ":9001"
    networks:
      - nginx_all_in_one
networks:
  nginx_all_in_one:
    external: true

# 确保进入到 "minio-docker-compose.yaml" 同级目录
cd /home/docker-compose/minio
# 使用 docker-compose 启动 minio
docker-compose -f minio-docker-compose.yaml up -d

version: "3.8"
services:
  outline:
    image: docker.io/outlinewiki/outline:0.70.2
    container_name: outline
    env_file: ./outline-docker.env
    expose:
      - 3000
    networks:
      - nginx_all_in_one
networks:
  nginx_all_in_one:
    external: true

# –––––––––––––––– REQUIRED ––––––––––––––––

NODE_ENV=production

# Generate a hex-encoded 32-byte random key. You should use `openssl rand -hex 32`
# in your terminal to generate a random value.
SECRET_KEY=secret_key

# Generate a unique random key. The format is not important but you could still use
# `openssl rand -hex 32` in your terminal to produce this.
UTILS_SECRET=utils_secret

# For production point these at your databases, in development the default
# should work out of the box.
DATABASE_URL=postgres://outline:password_of_outline_user@postgres12:5432/outline
DATABASE_URL_TEST=postgres://outline:password_of_outline_user@postgres12:5432/outline_test
DATABASE_CONNECTION_POOL_MIN=
DATABASE_CONNECTION_POOL_MAX=
# Uncomment this to disable SSL for connecting to Postgres
PGSSLMODE=disable

# For redis you can either specify an ioredis compatible url like this
REDIS_URL=redis://:password_of_redis@redis:6379
# or alternatively, if you would like to provide additional connection options,
# use a base64 encoded JSON connection option object. Refer to the ioredis documentation
# for a list of available options.
# Example: Use Redis Sentinel for high availability
# {"sentinels":[{"host":"sentinel-0","port":26379},{"host":"sentinel-1","port":26379}],"name":"mymaster"}
# REDIS_URL=ioredis://eyJzZW50aW5lbHMiOlt7Imhvc3QiOiJzZW50aW5lbC0wIiwicG9ydCI6MjYzNzl9LHsiaG9zdCI6InNlbnRpbmVsLTEiLCJwb3J0IjoyNjM3OX1dLCJuYW1lIjoibXltYXN0ZXIifQ==

# URL should point to the fully qualified, publicly accessible URL. If using a
# proxy the port in URL and PORT may be different.
URL=https://outline.example.com
PORT=3000

# See [documentation](docs/SERVICES.md) on running a separate collaboration
# server, for normal operation this does not need to be set.
COLLABORATION_URL=

# To support uploading of images for avatars and document attachments an
# s3-compatible storage must be provided. AWS S3 is recommended for redundancy
# however if you want to keep all file storage local an alternative such as
# minio (https://github.com/minio/minio) can be used.

# A more detailed guide on setting up S3 is available here:
# => https://wiki.generaloutline.com/share/125de1cc-9ff6-424b-8415-0d58c809a40f
#
AWS_ACCESS_KEY_ID=access_key_of_minio_outline
AWS_SECRET_ACCESS_KEY=secret_key_of_minio_outline
AWS_REGION=cn-outline-1
AWS_S3_ACCELERATE_URL=
AWS_S3_UPLOAD_BUCKET_URL=https://minio.example.com
AWS_S3_UPLOAD_BUCKET_NAME=outline
AWS_S3_UPLOAD_MAX_SIZE=26214400
AWS_S3_FORCE_PATH_STYLE=true
AWS_S3_ACL=private


# –––––––––––––– AUTHENTICATION ––––––––––––––

# Third party signin credentials, at least ONE OF EITHER Google, Slack,
# or Microsoft is required for a working installation or you'll have no sign-in
# options.

# To configure Slack auth, you'll need to create an Application at
# => https://api.slack.com/apps
#
# When configuring the Client ID, add a redirect URL under "OAuth & Permissions":
# https://<URL>/auth/slack.callback

# SLACK_CLIENT_ID=
# SLACK_CLIENT_SECRET=

# To configure Google auth, you'll need to create an OAuth Client ID at
# => https://console.cloud.google.com/apis/credentials
#
# When configuring the Client ID, add an Authorized redirect URI:
# https://<URL>/auth/google.callback

# GOOGLE_CLIENT_ID=203306213201-3ildae9if5t458eu5dq8f073pjv11rck.apps.googleusercontent.com
# GOOGLE_CLIENT_SECRET=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

# To configure Microsoft/Azure auth, you'll need to create an OAuth Client. See
# the guide for details on setting up your Azure App:
# => https://wiki.generaloutline.com/share/dfa77e56-d4d2-4b51-8ff8-84ea6608faa4

# AZURE_CLIENT_ID=
# AZURE_CLIENT_SECRET=
# AZURE_RESOURCE_APP_ID=

# To configure generic OIDC auth, you'll need some kind of identity provider.
# See documentation for whichever IdP you use to acquire the following info:
# Redirect URI is https://<URL>/auth/oidc.callback
OIDC_CLIENT_ID=outline
OIDC_CLIENT_SECRET=secret_of_keycloak_outline_client
OIDC_AUTH_URI=https://sso.example.com/auth/realms/outline/protocol/openid-connect/auth
OIDC_TOKEN_URI=https://sso.example.com/auth/realms/outline/protocol/openid-connect/token
OIDC_USERINFO_URI=https://sso.example.com/auth/realms/outline/protocol/openid-connect/userinfo

# Specify which claims to derive user information from
# Supports any valid JSON path with the JWT payload
OIDC_USERNAME_CLAIM=preferred_username

# Display name for OIDC authentication
OIDC_DISPLAY_NAME=Keycloak

# Space separated auth scopes.
OIDC_SCOPES=profile email


# –––––––––––––––– OPTIONAL ––––––––––––––––

# Base64 encoded private key and certificate for HTTPS termination. This is only
# required if you do not use an external reverse proxy. See documentation:
# https://wiki.generaloutline.com/share/1c922644-40d8-41fe-98f9-df2b67239d45
SSL_KEY=
SSL_CERT=

# If using a Cloudfront/Cloudflare distribution or similar it can be set below.
# This will cause paths to javascript, stylesheets, and images to be updated to
# the hostname defined in CDN_URL. In your CDN configuration the origin server
# should be set to the same as URL.
CDN_URL=

# Auto-redirect to https in production. The default is true but you may set to
# false if you can be sure that SSL is terminated at an external loadbalancer.
FORCE_HTTPS=false

# Have the installation check for updates by sending anonymized statistics to
# the maintainers
ENABLE_UPDATES=true

# How many processes should be spawned. As a reasonable rule divide your servers
# available memory by 512 for a rough estimate
WEB_CONCURRENCY=2

# Override the maximum size of document imports, could be required if you have
# especially large Word documents with embedded imagery
MAXIMUM_IMPORT_SIZE=5120000

# You can remove this line if your reverse proxy already logs incoming http
# requests and this ends up being duplicative
DEBUG=http

# Configure lowest severity level for server logs. Should be one of
# error, warn, info, http, verbose, debug and silly
LOG_LEVEL=info

# For a complete Slack integration with search and posting to channels the
# following configs are also needed, some more details
# => https://wiki.generaloutline.com/share/be25efd1-b3ef-4450-b8e5-c4a4fc11e02a
#
# SLACK_VERIFICATION_TOKEN=your_token
# SLACK_APP_ID=A0XXXXXXX
# SLACK_MESSAGE_ACTIONS=true

# Optionally enable google analytics to track pageviews in the knowledge base
GOOGLE_ANALYTICS_ID=

# Optionally enable Sentry (sentry.io) to track errors and performance,
# and optionally add a Sentry proxy tunnel for bypassing ad blockers in the UI:
# https://docs.sentry.io/platforms/javascript/troubleshooting/#using-the-tunnel-option)
SENTRY_DSN=
SENTRY_TUNNEL=

# To support sending outgoing transactional emails such as "document updated" or
# "you've been invited" you'll need to provide authentication for an SMTP server
SMTP_HOST=
SMTP_PORT=
SMTP_USERNAME=
SMTP_PASSWORD=
SMTP_FROM_EMAIL=hello@example.com
SMTP_REPLY_EMAIL=hello@example.com
SMTP_TLS_CIPHERS=
SMTP_SECURE=true

# The default interface language. See translate.getoutline.com for a list of
# available language codes and their rough percentage translated.
DEFAULT_LANGUAGE=zh_CN

# Optionally enable rate limiter at application web server
RATE_LIMITER_ENABLED=true

# Configure default throttling parameters for rate limiter
RATE_LIMITER_REQUESTS=1000
RATE_LIMITER_DURATION_WINDOW=60

# Iframely API config
# IFRAMELY_URL=
# IFRAMELY_API_KEY=

# –––––––––––––––– REQUIRED ––––––––––––––––

# ================ Outline ================
NODE_ENV=production
# 一个十六进制编码的 32 字节随机密钥。官方推荐使用 `openssl rand -hex 32` 在你的终端生成
SECRET_KEY=secret_key
# 一个唯一的随机密钥。格式并不重要，官方推荐使用 `openssl rand -hex 32` 在你的终端生成
UTILS_SECRET=utils_secret
# 表示外部浏览器将会以什么域名连接 Outline
# 请一定要设置为 https，否则会出现登陆失败的问题
# 修改项: 
# 1. outline.example.com: 修改为你自己的域名
URL=https://outline.example.com
# 表示 Outline 使用的端口，请放心设置，因为不会占用宿主机的端口位置，仅仅作用于容器内的端口
PORT=3000
# =========================================


# ================ PostgreSQL ================
# 用于连接 PostgreSQL 的 URL
# 修改项:
# 1. password_of_outline_user: 是你当时部署 PostgreSQL 后，进入容器创建的 outline 用户的密码
DATABASE_URL=postgres://outline:password_of_outline_user@postgres12:5432/outline
DATABASE_URL_TEST=postgres://outline:password_of_outline_user@postgres12:5432/outline_test
# PostgreSQL 数据库开启 SSL 链路加密后，表示允许客户端通过 SSL 连接数据库
# 由于我们没有反代 PostgreSQL，也没有为 PostgreSQL 配置 SSL，仅仅在局域网内访问
# 因此需要将此环境变量设为 disable
PGSSLMODE=disable
# ============================================


# ================ Redis ================
# 用于连接 Redis 的 URL
# 修改项:
# 1. password_of_redis: 是当时部署 Redis 时，位于 redis-docker-compose.yaml 中的密码
REDIS_URL=redis://:password_of_redis@redis:6379
# =======================================


# ================ MinIO ================
# 这是我们 MinIO 管理界面新添加的 User 的 Access Key 字段
AWS_ACCESS_KEY_ID=access_key_of_minio_outline
# 这是我们 MinIO 管理界面新添加的 User 的 Secret Key 字段
AWS_SECRET_ACCESS_KEY=secret_key_of_minio_outline
# 位于 minio-docker-compose.yaml 的字段
AWS_REGION=cn-outline-1
# 通过 Nginx 反代后的地址
# 修改项: 
# 1. minio.example.com: 修改为你自己的域名
AWS_S3_UPLOAD_BUCKET_URL=https://minio.example.com
# 这是我们在 MinIO 管理界面新添加的 Bucket 的名称
AWS_S3_UPLOAD_BUCKET_NAME=outline
# 我们添加的 Bucket 默认是 private 的
AWS_S3_ACL=private

# 一些额外的配置项，更多的可以看文档，来更好地满足自己需求
AWS_S3_UPLOAD_MAX_SIZE=26214400
# 默认情况下，许多 S3 客户端库会使用子域名样式。然而，有时这可能会导致问题，特别是当存储桶名称包含点"."或不符合DNS子域名规范时
# 设置 AWS_S3_FORCE_PATH_STYLE 为 true 会强制客户端库使用路径样式，而不是子域名样式
AWS_S3_FORCE_PATH_STYLE=true
# =======================================

# ––––––––––––––––------------––––––––––––––




# –––––––––––––– AUTHENTICATION ––––––––––––––
# Outline 至少需要配置一个授权方式，我们在之前部署了 Keycloak 可以作为我们的 OIDC 服务

# ============== Keycloak OIDC ==============
# 这是我们在 Keycloak 管理界面新添加 Client 时，设置的 Client 名称
OIDC_CLIENT_ID=outline
# 这是我们在 Outline Client 设置界面，Credentials 选项卡中的 Secret 字段
# 你可以看本文的 `5.3.4 配置 Outline Client` 来查看图片快速找到位置
OIDC_CLIENT_SECRET=secret_of_keycloak_outline_client
# 以下是 Outline 用于完成 OIDC 验证的 API 接口，其余地方均无需修改，只需要修改域名
# 修改项
# 1. sso.example.com: 修改为你自己的域名
OIDC_AUTH_URI=https://sso.example.com/auth/realms/outline/protocol/openid-connect/auth
OIDC_TOKEN_URI=https://sso.example.com/auth/realms/outline/protocol/openid-connect/token
OIDC_USERINFO_URI=https://sso.example.com/auth/realms/outline/protocol/openid-connect/userinfo
# 这个名字将展示在 https://outline.example.com 的首页，登陆选项中将会显示 “使用 Keycloak 继续”
OIDC_DISPLAY_NAME=Keycloak
# 默认是 openid profile email，表示允许用户使用什么方式登录
# openid: 我们 Keycloak 设定的 openid 是一个 UUID，因为太长了所以用来登陆也不合适
# profile: 就是我们的账户名称 Username，注意不是 First/Last Name 字段
# email: 就是我们创建账户是，可以填入的 email 字段
OIDC_SCOPES=profile email
# ===========================================

# ––––––––––––––-----------------–––––––––––––

# 确保进入到 "outline-docker-compose.yaml" 同级目录
cd /home/docker-compose/outline
# 创建 outline 和 outline-test 数据库
docker-compose run \
    -f outline-docker-compose.yml \
    --rm outline \
    yarn db:create \
    --env=production-ssl-disabled

# 确保进入到 "outline-docker-compose.yaml" 同级目录
cd /home/docker-compose/outline
# 初始化数据库: 添加表和索引
docker-compose run \
    -f outline-docker-compose.yml \
    --rm outline \
    yarn db:migrate \
    --env=production-ssl-disabled

# 确保进入到 "outline-docker-compose.yaml" 同级目录
cd /home/docker-compose/outline
# 使用 docker-compose 启动 outline
docker-compose -f outline-docker-compose.yaml up -d

version: "3.8"
services:
  outline:
    image: docker.io/outlinewiki/outline:修改成你想升级的版本号
    container_name: outline
    env_file: ./outline-docker.env
    expose:
      - 3000
    networks:
      - nginx_all_in_one
networks:
  nginx_all_in_one:
    external: true

# 确保进入到 "outline-docker-compose.yaml" 同级目录
cd /home/docker-compose/outline
# 先关闭 outline
docker-compose -f outline-docker-compose.yaml down
# 使用 docker-compose 启动 outline
docker-compose -f outline-docker-compose.yaml up -d