Sub2API 部署实战：Fedora + Podman，把多个模型渠道整合成一个 API

podman --version

sudo dnf install -y podman-plugins
podman compose version   # 命令是 "podman compose"，没有连字符

pip install podman-compose
podman-compose --version   # 命令是 "podman-compose"，有连字符

mkdir -p ~/sub2api-deploy && cd ~/sub2api-deploy
mkdir -p data postgres_data redis_data

# 生成安全密钥
openssl rand -hex 32   # 输出一段随机字符串，复制下来

# 写入 .env
cat > .env << 'EOF'
POSTGRES_PASSWORD=你自己设的复杂密码
JWT_SECRET=刚才 openssl 生成的字符串
TOTP_ENCRYPTION_KEY=再用 openssl 生成一段
ADMIN_EMAIL=你的邮箱
ADMIN_PASSWORD=你的管理员密码
EOF

version: "3.9"

services:
  postgres:
    image: docker.io/postgres:15-alpine
    container_name: sub2api-postgres
    restart: always
    environment:
      POSTGRES_DB: sub2api
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
    ports:
      - "127.0.0.1:5432:5432"
    volumes:
      - ./postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres"]
      interval: 10s
      timeout: 5s
      retries: 5

  redis:
    image: docker.io/redis:7-alpine
    container_name: sub2api-redis
    restart: always
    ports:
      - "127.0.0.1:6379:6379"
    volumes:
      - ./redis_data:/data
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5

  sub2api:
    image: ghcr.io/wei-shaw/sub2api:latest
    container_name: sub2api
    restart: always
    ports:
      - "0.0.0.0:8080:8080"
    environment:
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
      - JWT_SECRET=${JWT_SECRET}
      - TOTP_ENCRYPTION_KEY=${TOTP_ENCRYPTION_KEY}
      - ADMIN_EMAIL=${ADMIN_EMAIL}
      - ADMIN_PASSWORD=${ADMIN_PASSWORD}
      - RUN_MODE=simple
      - SIMPLE_MODE_CONFIRM=true
      - SECURITY_URL_ALLOWLIST_ALLOW_INSECURE_HTTP=false
    volumes:
      - ./data:/data
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy

getenforce
# 如果输出 Enforcing，就需要处理

sudo semanage fcontext -a -t container_file_t "$PWD/postgres_data(/.*)?"
sudo restorecon -Rv $PWD/postgres_data
sudo semanage fcontext -a -t container_file_t "$PWD/redis_data(/.*)?"
sudo restorecon -Rv $PWD/redis_data
sudo semanage fcontext -a -t container_file_t "$PWD/data(/.*)?"
sudo restorecon -Rv $PWD/data

# 记住你的命令带连字符
podman-compose up -d

# 查看状态
podman-compose ps

# 查看日志
podman-compose logs -f sub2api

curl http://你的服务器IP:8080/v1/chat/completions \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer 你在后台生成的API Key" \
  -d '{
    "model": "deepseek-chat",
    "messages": [{"role": "user", "content": "Hello"}]
  }'

# 错的：restart 只重启进程，不读新配置
podman-compose restart sub2api

# 对的：up -d 会重新加载 compose.yml 并重建容器
podman-compose up -d

# 确认环境变量
podman exec sub2api env | grep -i "RUN_MODE\|SIMPLE"
# 如果输出为空，说明 simple 模式已经关了

# 确认日志
podman-compose logs sub2api | grep -i "mode"

podman ps -a --filter name=sub2api
# 有残留就删掉
podman rm -f sub2api sub2api-postgres sub2api-redis

cd ~/sub2api-deploy

# 查看状态
podman-compose ps

# 查看日志
podman-compose logs -f sub2api

# 重新加载配置并重建容器（改 compose 后必须用这个）
podman-compose up -d

# 仅重启容器进程（不改配置时用）
podman-compose restart sub2api

# 停止（不删数据）
podman-compose down

# 升级
podman-compose pull
podman-compose up -d

# 备份
podman-compose down
tar czf sub2api-backup-$(date +%Y%m%d).tar.gz .
podman-compose up -d

# 为每个容器生成 systemd 服务
for container in $(podman ps -a --format "{{.Names}}"); do
  podman generate systemd --name $container --new --files
done

sudo mv container-*.service /etc/systemd/system/
sudo systemctl daemon-reload
sudo systemctl enable --now container-sub2api-postgres
sudo systemctl enable --now container-sub2api-redis
sudo systemctl enable --now container-sub2api