From 2d0ae4d7d1fc6671fedb937d61a562313ffb2ec5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E6=80=BB=E5=B7=A5?= <chief@multica.agent>
Date: Sun, 30 Aug 2026 22:51:20 +0800
Subject: [PATCH] =?UTF-8?q?HEL-271:=20=E5=8F=8D=E4=BB=A3=E8=AF=81=E4=B9=A6?=
 =?UTF-8?q?=E6=8C=82=E8=BD=BD=E6=94=B6=E7=B4=A7=E4=B8=BA=E5=8D=95=E6=96=87?=
 =?UTF-8?q?=E4=BB=B6=E5=B9=B6=E6=8C=89=E5=B1=9E=E4=B8=BB=20uid=20=E8=BF=90?=
 =?UTF-8?q?=E8=A1=8C=EF=BC=88server.key=20=E4=BF=9D=E6=8C=81=200600?=
 =?UTF-8?q?=EF=BC=89?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-authored-by: multica-agent <github@multica.ai>
---
 deploy/compose.yaml | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/deploy/compose.yaml b/deploy/compose.yaml
index c181e4e..bb37a7d 100644
--- a/deploy/compose.yaml
+++ b/deploy/compose.yaml
@@ -59,12 +59,15 @@ services:
       - "${PROXY_PORT_MAP:-8443:8443}"
     volumes:
       - ./tls/nginx.conf:/etc/nginx/conf.d/default.conf:ro
-      - ./tls/certs:/etc/nginx/tls:ro
+      - ./tls/certs/server.crt:/etc/nginx/tls/server.crt:ro
+      - ./tls/certs/server.key:/etc/nginx/tls/server.key:ro
+    # 与证书文件属主一致的 uid/gid（默认 101=镜像 nginx 用户；宿主机生成证书时
+    # 设为属主 uid/gid，保持 server.key 0600 不放宽）
+    user: "${PROXY_UID:-101}:${PROXY_GID:-101}"
     depends_on:
       - app
     restart: unless-stopped
     read_only: true
-    user: "101:101"
     tmpfs:
       - /var/cache/nginx:size=16m
       - /var/run:size=1m