From 6ba4537d3db1493122cac631b7cb6c96df9889d2 Mon Sep 17 00:00:00 2001
From: ouyangxq <775153912@qq.com>
Date: Tue, 25 Aug 2026 11:39:12 +0800
Subject: [PATCH] fix(deploy): bind development ports to loopback

---
 deploy/docker-compose.overseas.yml            |  8 +++----
 deploy/docker-compose.yml                     | 22 +++++++++----------
 deploy/scripts/deploy-built-service.sh        | 12 ++++++++++
 deploy/scripts/deploy-development-service.sh  |  2 ++
 ...est-environment-pipeline-contract.test.mjs | 10 +++++++++
 5 files changed, 39 insertions(+), 15 deletions(-)

diff --git a/deploy/docker-compose.overseas.yml b/deploy/docker-compose.overseas.yml
index 29f78af91..5eb84191d 100644
--- a/deploy/docker-compose.overseas.yml
+++ b/deploy/docker-compose.overseas.yml
@@ -37,7 +37,7 @@ services:
     <<: *overseas-common
     image: ${IMAGE_REPOSITORY}/gateway-overseas:${IMAGE_TAG}
     container_name: firstleg-${DEPLOY_ENV:-test}-gateway-overseas
-    ports: ["${GATEWAY_OVERSEAS_PORT:-9300}:9300"]
+    ports: ["${PUBLISHED_BIND_ADDRESS:-0.0.0.0}:${GATEWAY_OVERSEAS_PORT:-9300}:9300"]
     volumes: ["${LOG_ROOT:-/data/logs/baiyue-firstleg}/gateway-overseas:/app/logs"]
     environment:
       <<: *overseas-environment
@@ -52,7 +52,7 @@ services:
     <<: *overseas-common
     image: ${IMAGE_REPOSITORY}/lastleg-service:${IMAGE_TAG}
     container_name: firstleg-${DEPLOY_ENV:-test}-lastleg
-    ports: ["${LASTLEG_PORT:-9303}:9303"]
+    ports: ["${PUBLISHED_BIND_ADDRESS:-0.0.0.0}:${LASTLEG_PORT:-9303}:9303"]
     volumes: ["${LOG_ROOT:-/data/logs/baiyue-firstleg}/lastleg-service:/app/logs"]
     environment:
       <<: *overseas-environment
@@ -70,7 +70,7 @@ services:
     <<: *overseas-common
     image: ${IMAGE_REPOSITORY}/warehouse-overseas-service:${IMAGE_TAG}
     container_name: firstleg-${DEPLOY_ENV:-test}-warehouse-overseas
-    ports: ["${WAREHOUSE_OVERSEAS_PORT:-9305}:9305"]
+    ports: ["${PUBLISHED_BIND_ADDRESS:-0.0.0.0}:${WAREHOUSE_OVERSEAS_PORT:-9305}:9305"]
     volumes: ["${LOG_ROOT:-/data/logs/baiyue-firstleg}/warehouse-overseas-service:/app/logs"]
     environment:
       <<: *overseas-environment
@@ -83,7 +83,7 @@ services:
     <<: *overseas-common
     image: ${IMAGE_REPOSITORY}/event-bridge-service:${IMAGE_TAG}
     container_name: firstleg-${DEPLOY_ENV:-test}-event-bridge-overseas
-    ports: ["${EVENT_BRIDGE_OVERSEAS_PORT:-9313}:9312"]
+    ports: ["${PUBLISHED_BIND_ADDRESS:-0.0.0.0}:${EVENT_BRIDGE_OVERSEAS_PORT:-9313}:9312"]
     volumes: ["${LOG_ROOT:-/data/logs/baiyue-firstleg}/event-bridge-service-overseas:/app/logs"]
     environment:
       <<: *overseas-environment
diff --git a/deploy/docker-compose.yml b/deploy/docker-compose.yml
index e917070cf..4f6700005 100644
--- a/deploy/docker-compose.yml
+++ b/deploy/docker-compose.yml
@@ -39,7 +39,7 @@ services:
     <<: *common
     image: ${IMAGE_REPOSITORY}/gateway:${IMAGE_TAG}
     container_name: firstleg-${DEPLOY_ENV:-test}-gateway
-    ports: ["${GATEWAY_PORT:-9000}:9000"]
+    ports: ["${PUBLISHED_BIND_ADDRESS:-0.0.0.0}:${GATEWAY_PORT:-9000}:9000"]
     volumes: ["${LOG_ROOT:-/data/logs/baiyue-firstleg}/gateway:/app/logs"]
     environment:
       <<: *common-environment
@@ -52,7 +52,7 @@ services:
     <<: *common
     image: ${IMAGE_REPOSITORY}/auth:${IMAGE_TAG}
     container_name: firstleg-${DEPLOY_ENV:-test}-auth
-    ports: ["${AUTH_PORT:-9100}:9100"]
+    ports: ["${PUBLISHED_BIND_ADDRESS:-0.0.0.0}:${AUTH_PORT:-9100}:9100"]
     volumes: ["${LOG_ROOT:-/data/logs/baiyue-firstleg}/auth:/app/logs"]
     environment:
       <<: *common-environment
@@ -71,7 +71,7 @@ services:
     <<: *common
     image: ${IMAGE_REPOSITORY}/iam:${IMAGE_TAG}
     container_name: firstleg-${DEPLOY_ENV:-test}-iam
-    ports: ["${IAM_PORT:-9201}:9201"]
+    ports: ["${PUBLISHED_BIND_ADDRESS:-0.0.0.0}:${IAM_PORT:-9201}:9201"]
     volumes: ["${LOG_ROOT:-/data/logs/baiyue-firstleg}/iam:/app/logs"]
     environment:
       <<: *common-environment
@@ -84,7 +84,7 @@ services:
     <<: *common
     image: ${IMAGE_REPOSITORY}/firstleg:${IMAGE_TAG}
     container_name: firstleg-${DEPLOY_ENV:-test}-business
-    ports: ["${FIRSTLEG_PORT:-9202}:9202"]
+    ports: ["${PUBLISHED_BIND_ADDRESS:-0.0.0.0}:${FIRSTLEG_PORT:-9202}:9202"]
     volumes: ["${LOG_ROOT:-/data/logs/baiyue-firstleg}/firstleg:/app/logs"]
     environment:
       <<: *common-environment
@@ -110,7 +110,7 @@ services:
     <<: *common
     image: ${IMAGE_REPOSITORY}/finance:${IMAGE_TAG}
     container_name: firstleg-${DEPLOY_ENV:-test}-finance
-    ports: ["${FINANCE_PORT:-9203}:9203"]
+    ports: ["${PUBLISHED_BIND_ADDRESS:-0.0.0.0}:${FINANCE_PORT:-9203}:9203"]
     volumes: ["${LOG_ROOT:-/data/logs/baiyue-firstleg}/finance:/app/logs"]
     environment:
       <<: *common-environment
@@ -123,7 +123,7 @@ services:
     <<: *common
     image: ${IMAGE_REPOSITORY}/order:${IMAGE_TAG}
     container_name: firstleg-${DEPLOY_ENV:-test}-order
-    ports: ["${ORDER_PORT:-9204}:9204"]
+    ports: ["${PUBLISHED_BIND_ADDRESS:-0.0.0.0}:${ORDER_PORT:-9204}:9204"]
     volumes: ["${LOG_ROOT:-/data/logs/baiyue-firstleg}/order:/app/logs"]
     environment:
       <<: *common-environment
@@ -136,7 +136,7 @@ services:
     <<: *common
     image: ${IMAGE_REPOSITORY}/warehouse:${IMAGE_TAG}
     container_name: firstleg-${DEPLOY_ENV:-test}-warehouse
-    ports: ["${WAREHOUSE_PORT:-9205}:9205"]
+    ports: ["${PUBLISHED_BIND_ADDRESS:-0.0.0.0}:${WAREHOUSE_PORT:-9205}:9205"]
     volumes: ["${LOG_ROOT:-/data/logs/baiyue-firstleg}/warehouse:/app/logs"]
     environment:
       <<: *common-environment
@@ -149,7 +149,7 @@ services:
     <<: *common
     image: ${IMAGE_REPOSITORY}/file:${IMAGE_TAG}
     container_name: firstleg-${DEPLOY_ENV:-test}-file
-    ports: ["${FILE_PORT:-9206}:9206"]
+    ports: ["${PUBLISHED_BIND_ADDRESS:-0.0.0.0}:${FILE_PORT:-9206}:9206"]
     volumes:
       - "${FILE_UPLOADS_HOST_DIR:-/data/firstleg/uploads}:/data/files"
       - "${LOG_ROOT:-/data/logs/baiyue-firstleg}/file:/app/logs"
@@ -173,7 +173,7 @@ services:
     <<: *common
     image: ${IMAGE_REPOSITORY}/print:${IMAGE_TAG}
     container_name: firstleg-${DEPLOY_ENV:-test}-print
-    ports: ["${PRINT_PORT:-9207}:9207"]
+    ports: ["${PUBLISHED_BIND_ADDRESS:-0.0.0.0}:${PRINT_PORT:-9207}:9207"]
     volumes: ["${LOG_ROOT:-/data/logs/baiyue-firstleg}/print:/app/logs"]
     environment:
       <<: *common-environment
@@ -184,7 +184,7 @@ services:
     <<: *common
     image: ${IMAGE_REPOSITORY}/integration-service:${IMAGE_TAG}
     container_name: firstleg-${DEPLOY_ENV:-test}-integration
-    ports: ["${INTEGRATION_PORT:-9210}:9210"]
+    ports: ["${PUBLISHED_BIND_ADDRESS:-0.0.0.0}:${INTEGRATION_PORT:-9210}:9210"]
     volumes: ["${LOG_ROOT:-/data/logs/baiyue-firstleg}/integration-service:/app/logs"]
     environment:
       <<: *common-environment
@@ -234,7 +234,7 @@ services:
     <<: *common
     image: ${IMAGE_REPOSITORY}/event-bridge-service:${IMAGE_TAG}
     container_name: firstleg-${DEPLOY_ENV:-test}-event-bridge
-    ports: ["${EVENT_BRIDGE_PORT:-9312}:9312"]
+    ports: ["${PUBLISHED_BIND_ADDRESS:-0.0.0.0}:${EVENT_BRIDGE_PORT:-9312}:9312"]
     volumes: ["${LOG_ROOT:-/data/logs/baiyue-firstleg}/event-bridge-service:/app/logs"]
     environment:
       <<: *common-environment
diff --git a/deploy/scripts/deploy-built-service.sh b/deploy/scripts/deploy-built-service.sh
index 790431300..860474778 100644
--- a/deploy/scripts/deploy-built-service.sh
+++ b/deploy/scripts/deploy-built-service.sh
@@ -36,6 +36,13 @@ case "$DEPLOY_ENV" in
     ;;
 esac
 
+if [ "$DEPLOY_ENV" = "development" ]; then
+  PUBLISHED_BIND_ADDRESS=127.0.0.1
+else
+  PUBLISHED_BIND_ADDRESS="${PUBLISHED_BIND_ADDRESS:-0.0.0.0}"
+fi
+export PUBLISHED_BIND_ADDRESS
+
 case "$SERVICE" in
   *[!A-Za-z0-9_-]*|'')
     echo "非法服务名: $SERVICE" >&2
@@ -390,6 +397,11 @@ cd "$remote_dir"
 export DEPLOY_ENV="$deploy_env"
 export IMAGE_REPOSITORY="$image_repository"
 export IMAGE_TAG="$image_tag"
+if [ "$deploy_env" = "development" ]; then
+  export PUBLISHED_BIND_ADDRESS=127.0.0.1
+else
+  export PUBLISHED_BIND_ADDRESS="${PUBLISHED_BIND_ADDRESS:-0.0.0.0}"
+fi
 
 compose() {
   docker compose \
diff --git a/deploy/scripts/deploy-development-service.sh b/deploy/scripts/deploy-development-service.sh
index b1034e2b9..23343f7a4 100644
--- a/deploy/scripts/deploy-development-service.sh
+++ b/deploy/scripts/deploy-development-service.sh
@@ -64,6 +64,7 @@ if [ "${DEVELOPMENT_DEPLOY_LOCAL:-false}" = "true" ]; then
   cd "$REMOTE_DIR"
   export DEPLOY_ENV=development
   export IMAGE_REPOSITORY IMAGE_TAG
+  export PUBLISHED_BIND_ADDRESS=127.0.0.1
 
   docker compose \
     --project-name "$PROJECT_NAME" \
@@ -143,6 +144,7 @@ cd "$remote_dir"
 export DEPLOY_ENV=development
 export IMAGE_REPOSITORY="$image_repository"
 export IMAGE_TAG="$image_tag"
+export PUBLISHED_BIND_ADDRESS=127.0.0.1
 
 docker compose \
   --project-name "$project_name" \
diff --git a/scripts/test-environment-pipeline-contract.test.mjs b/scripts/test-environment-pipeline-contract.test.mjs
index cb7a9566c..4a69ce5fe 100644
--- a/scripts/test-environment-pipeline-contract.test.mjs
+++ b/scripts/test-environment-pipeline-contract.test.mjs
@@ -12,6 +12,10 @@ const ciMavenSettings = (await readFile(new URL('../deploy/maven/settings-ci.xml
   .replaceAll('\r\n', '\n')
 const serviceDockerfile = (await readFile(new URL('../deploy/docker/Dockerfile', import.meta.url), 'utf8'))
   .replaceAll('\r\n', '\n')
+const serviceCompose = (await readFile(new URL('../deploy/docker-compose.yml', import.meta.url), 'utf8'))
+  .replaceAll('\r\n', '\n')
+const overseasCompose = (await readFile(new URL('../deploy/docker-compose.overseas.yml', import.meta.url), 'utf8'))
+  .replaceAll('\r\n', '\n')
 
 test('service pipeline keeps boolean operators on parseable Groovy continuation lines', () => {
   assert.doesNotMatch(pipeline, /^\s*(?:&&|\|\|)/m)
@@ -77,6 +81,12 @@ test('development and test deployment locks are acquired before target executors
   assert.ok(lockIndex < nodeIndex, 'deployment lock must be acquired before target node allocation')
 })
 
+test('development publishes service ports on loopback without changing test defaults', () => {
+  assert.match(serviceCompose, /\$\{PUBLISHED_BIND_ADDRESS:-0\.0\.0\.0\}:\$\{GATEWAY_PORT:-9000\}:9000/)
+  assert.match(overseasCompose, /\$\{PUBLISHED_BIND_ADDRESS:-0\.0\.0\.0\}:\$\{GATEWAY_OVERSEAS_PORT:-9300\}:9300/)
+  assert.match(directDeployScript, /if \[ "\$DEPLOY_ENV" = "development" \]; then[\s\S]*?PUBLISHED_BIND_ADDRESS=127\.0\.0\.1/)
+})
+
 test('parallel image publications isolate registry credentials per Jenkins job', () => {
   const imageStage = pipeline.slice(
     pipeline.indexOf("stage('构建并发布单服务镜像')"),