feat(start-container): 支持 derper 服务与 localhost 端口绑定

Author: mudssky

config/dockerfiles/compose/docker-compose.yml

@@ -411,6 +411,24 @@ services:
         max-file: "3"
     profiles: ["gotify"]
 
+  derper:
+    image: fredliang/derper
+    restart: ${RESTART_POLICY:-unless-stopped}
+    environment:
+      # 保持与现有 docker run 用法一致，便于复用现有 DERP/STUN 部署参数。
+      DERP_ADDR: ":8443"
+      DERP_STUN_PORT: "3478"
+      DERP_VERIFY_CLIENTS: "false"
+    ports:
+      - "8443:8443"
+      - "3478:3478/udp"
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "10m"
+        max-file: "3"
+    profiles: ["derper"]
+
   sillytavern:
     image: ghcr.io/sillytavern/sillytavern:latest
     restart: ${RESTART_POLICY:-unless-stopped}

config/dockerfiles/compose/examples/.env.linux.example

@@ -11,5 +11,7 @@ DEFAULT_PASSWORD=12345678
 
 # --- 容器运行配置 ---
 RESTART_POLICY=unless-stopped
+# 设为 true 时，start-container.ps1 会把所有已发布端口改为仅绑定 127.0.0.1。
+BIND_LOCALHOST=false
 TZ=Asia/Shanghai
 COMPOSE_PROJECT_NAME=dev-linux

config/dockerfiles/compose/examples/.env.macos.example

@@ -11,5 +11,7 @@ DEFAULT_PASSWORD=12345678
 
 # --- 容器运行配置 ---
 RESTART_POLICY=unless-stopped
+# 设为 true 时，start-container.ps1 会把所有已发布端口改为仅绑定 127.0.0.1。
+BIND_LOCALHOST=false
 TZ=Asia/Shanghai
 COMPOSE_PROJECT_NAME=dev-macos

config/dockerfiles/compose/examples/.env.windows.example

@@ -11,5 +11,7 @@ DEFAULT_PASSWORD=12345678
 
 # --- 容器运行配置 ---
 RESTART_POLICY=unless-stopped
+# 设为 true 时，start-container.ps1 会把所有已发布端口改为仅绑定 127.0.0.1。
+BIND_LOCALHOST=false
 TZ=Asia/Shanghai
 COMPOSE_PROJECT_NAME=dev-windows

docs/cheatsheet/linux/docker/docker-bind-localhost.md

@@ -90,6 +90,32 @@ services:
 - `"5432:5432"` 通常会绑定到 `0.0.0.0` / `::`
 - `"127.0.0.1:5432:5432"` 只绑定到本机回环地址
 
+## 仓库内 `start-container.ps1` 怎么用
+
+如果你使用仓库里的统一入口，可以直接在 `config/dockerfiles/compose/.env.local` 中设置：
+
+```dotenv
+BIND_LOCALHOST=true
+```
+
+然后运行：
+
+```bash
+./scripts/pwsh/devops/start-container.ps1 -ServiceName postgre
+```
+
+也可以只对单次命令显式开启：
+
+```bash
+./scripts/pwsh/devops/start-container.ps1 -ServiceName gotify -BindLocalhost
+```
+
+如果你想临时覆盖 `.env.local` 中的开启状态，也可以显式关闭：
+
+```bash
+./scripts/pwsh/devops/start-container.ps1 -ServiceName derper -BindLocalhost:$false
+```
+
 ## 已有容器怎么改
 
 Docker 端口映射不是热修改项，通常需要重建容器。