多租户 Docker：避免意外共用故障域
一篇面向生产环境的最新后续文章，将厂商文档转化为运行控制、迁移决策和可验证的发布标准。
2026 年发生了哪些变化
我们重新审视这一主题，是因为系统的运行边界已经发生变化。长期有效的原则依然值得保留，但在当前版本下，一些过去的捷径已经不再完整，甚至可能带来风险。本文以截至 2026 年 7 月 14 日可获得的厂商文档为起点，区分客观事实与本地决策，并将每一次配置调整视为受控的生产变更。
当前一手资料
如何使用本次更新
首先阅读一手资料，记录实际部署的版本，并在修改设置前定义可观测的目标结果。应在具有代表性的环境中测试最小且可回滚的改动。命令执行成功并不等于验收通过；服务健康、数据完整性、延迟、安全边界和回滚时间才是标准。旧文中仍然有效的诊断顺序会作为运行基础保留在下文，但所有与版本有关的示例都必须对照当前文档复核。
运行基础
如何创建基于模板的多租户开发环境：包含 16 个容器化服务，可离线运行，也可通过子域名路由在线访问。下文的配置文件、脚本和命令示例取自原始指南，并在必要处做了修正。
管理多个客户的开发环境，往往意味着要在复杂的手动配置与昂贵的云方案之间取舍。手动部署耗时且容易出错。云平台虽然方便，却会造成供应商锁定，而且持续费用会随使用量增加。
本文将介绍如何构建可扩展的多租户开发栈，同时实现客户环境之间的强隔离和自动化部署，并保留对基础设施的完整控制。这沿用了我们的自托管理念，正如我们之前介绍的自托管 n8n 工作流自动化方案，以及通过 Docker 部署 Windmill、全面掌控运维的方案。
我们使用的工具
先来了解这套完整的 16 容器架构中各个组件的职责：
Docker：容器化的基础
Docker 提供多租户环境所需的隔离性和一致性。每个客户都拥有自己的容器，各套环境采用相同的配置，有助于让在开发环境中可用的配置也能用于生产环境。可以将其理解为在同一套硬件上运行多台独立的服务器，但它们仍共享 CPU、内存、磁盘和内核。
核心优势是客户之间的强隔离。每个客户的数据、配置和定制内容都位于独立的容器、网络和卷中，因此不会干扰其他客户的数据、配置和定制内容。在同时服务多个需求和安全要求各不相同的企业客户时，这一点尤为关键。
Traefik：智能反向代理与负载均衡器
Traefik 负责智能流量调度，根据域名自动将请求路由到对应的客户环境。无需手动编写复杂的 Apache 或 Nginx 规则，Traefik 会读取 Docker 容器的标签并自动配置路由。
可以将 Traefik 理解为一位熟悉各个办公室的接待员：每位访客（请求）该前往哪个办公室（容器），它都清楚，无需您每次指路。在我们的配置中，Traefik 负责 SSL 终止和自动服务发现，并提供详细的监控仪表盘。
Cloudflare Tunnels：安全的外部访问
Cloudflare Tunnels 无需复杂的防火墙配置或 VPN，即可为本地开发栈提供安全访问。每个客户域名都有独立的隧道，使各客户的外部访问路径保持分离。
这样，开发环境仍保留在本地并受到保护，客户则可在通过适当身份认证后，从任何地方访问自己的服务。这与我们在 n8n 托管指南中配置安全外部访问的方法类似。
完整服务栈：客户所需的全部服务
我们的多租户栈包含四类核心服务，每个客户共使用 16 个容器：
工作流自动化与业务逻辑：
- n8n：用于业务流程自动化的完整工作流自动化平台
- Authentik：企业级单点登录与身份管理（3 个容器：server、worker、Redis 缓存）
数据库与后端服务：
- PostgreSQL：为所有服务提供支持的可靠数据库后端，配备优化的连接池
- Supabase Stack：完整的后端即服务，包含 6 个专用容器（Studio、Meta、Auth、REST API、Realtime、Kong Gateway）
- NocoDB：用于管理客户数据的无代码数据库界面
AI 与智能功能：
- Ollama：支持 GPU 加速的本地 AI 语言模型，用于智能自动化
- Qdrant（可选）：用于高级 AI 工作流和相似度搜索的向量数据库
基础设施与监控：
- Cloudflare Tunnel：安全的外部连接
- Traefik：支持自动 SSL 的反向代理，配备监控仪表盘
各组件如何协同工作
客户访问其环境时的完整流程如下：
- 客户打开自己的自定义域名（例如 workflows.client-a.com）
- Cloudflare Tunnel 将请求路由到您的本地 Traefik 实例
- Traefik 读取域名，应用中间件（身份认证、SSL、速率限制），并转发到对应的客户容器
- 如已配置，Authentik 会处理所有服务的 SSO 身份认证
- 客户进入自己的隔离环境，使用自己的数据和配置
- 无法通过该客户的路由访问其他客户的环境
各环境井然有序、相互隔离，每个客户都有自己的子域名结构，例如 auth.client-a.com、database.client-a.com、backend.client-a.com 等。
配置方法：具体步骤
准备基础环境
首先，需要安装 Docker Desktop 并配置域名管理。我们建议采用通配符 DNS 结构，便于接入新客户：
# Install Docker Desktop (macOS)
brew install --cask docker
# Verify installation
docker --version
docker compose version
# Ensure sufficient resources for multi-container environments
# Recommended: 16GB RAM, 8+ CPU cores, 500GB+ SSD storage
创建模板系统
关键在于采用模板。无需逐个手动配置客户环境，而是创建可带入客户专属配置、即时部署的模板。
创建完整的目录结构：
mkdir -p development-stack/{template,deployments}
cd development-stack/template
# Create service-specific configuration directories
mkdir -p {traefik,authentik,supabase,init}
完整的多服务模板配置
创建包含全部 16 个服务的完整 docker-compose.yml 模板：
networks:
tenant:
name: ${TENANT_NETWORK}
driver: bridge
services:
# External Connectivity (public hostnames point to https://traefik:443 in the Cloudflare dashboard)
cloudflare-tunnel:
image: cloudflare/cloudflared:2026.7.2
container_name: ${TENANT_PREFIX}-tunnel
command: tunnel --no-autoupdate run --token ${CLOUDFLARE_TOKEN}
networks:
- tenant
restart: unless-stopped
# Reverse Proxy & Load Balancer
# No host ports 80/443: client traffic arrives through the tunnel, so several
# clients can share one host. Certificates use the Cloudflare DNS challenge.
traefik:
image: traefik:v3.7.9
container_name: ${TENANT_PREFIX}-traefik
command:
- "--api.dashboard=true"
- "--ping=true"
- "--providers.docker=true"
- "--providers.docker.network=${TENANT_NETWORK}"
- "--providers.docker.exposedbydefault=false"
- "--providers.docker.constraints=Label(`com.docker.compose.project`,`${TENANT_PREFIX}`)"
- "--entrypoints.web.address=:80"
- "--entrypoints.websecure.address=:443"
- "--entrypoints.websecure.asdefault=true"
- "--entrypoints.traefik.address=:8080"
- "--certificatesresolvers.letsencrypt.acme.email=${ADMIN_EMAIL}"
- "--certificatesresolvers.letsencrypt.acme.storage=/acme.json"
- "--certificatesresolvers.letsencrypt.acme.dnschallenge.provider=cloudflare"
environment:
CF_DNS_API_TOKEN: ${CF_DNS_API_TOKEN}
ports:
# Dashboard on localhost only (http://localhost:PORT/dashboard/)
- "127.0.0.1:${TRAEFIK_DASHBOARD_PORT}:8080"
networks:
- tenant
volumes:
- /var/run/docker.sock:/var/run/docker.sock:ro
- ./traefik/acme.json:/acme.json
labels:
- "traefik.enable=true"
- "traefik.http.routers.dashboard.rule=PathPrefix(`/`)"
- "traefik.http.routers.dashboard.entrypoints=traefik"
- "traefik.http.routers.dashboard.service=api@internal"
restart: unless-stopped
healthcheck:
test: ["CMD", "traefik", "healthcheck", "--ping"]
interval: 30s
timeout: 10s
retries: 3
# Database Backend
postgres:
image: postgres:15.18-alpine
container_name: ${TENANT_PREFIX}-postgres
environment:
POSTGRES_DB: ${POSTGRES_DB}
POSTGRES_USER: ${POSTGRES_USER}
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
volumes:
- postgres_data:/var/lib/postgresql/data
- ./init:/docker-entrypoint-initdb.d
networks:
- tenant
ports:
# Localhost only, for admin tools on the host
- "127.0.0.1:${POSTGRES_PORT}:5432"
restart: unless-stopped
healthcheck:
test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB}"]
interval: 30s
timeout: 10s
retries: 5
deploy:
resources:
limits:
memory: 2G
reservations:
memory: 1G
# Workflow Automation
n8n:
image: n8nio/n8n:2.31.7
container_name: ${TENANT_PREFIX}-n8n
environment:
DB_TYPE: postgresdb
DB_POSTGRESDB_HOST: postgres
DB_POSTGRESDB_DATABASE: n8n
DB_POSTGRESDB_USER: ${POSTGRES_USER}
DB_POSTGRESDB_PASSWORD: ${POSTGRES_PASSWORD}
N8N_PROTOCOL: ${N8N_PROTOCOL}
N8N_HOST: ${N8N_DOMAIN}
N8N_PORT: 5678
N8N_SECURE_COOKIE: ${N8N_SECURE_COOKIE}
WEBHOOK_URL: https://${N8N_DOMAIN}
N8N_EDITOR_BASE_URL: https://${N8N_DOMAIN}
EXECUTIONS_DATA_PRUNE: "true"
EXECUTIONS_DATA_MAX_AGE: 168
volumes:
- n8n_data:/home/node/.n8n
networks:
- tenant
labels:
- "traefik.enable=true"
- "traefik.http.routers.n8n.rule=Host(`${N8N_DOMAIN}`)"
- "traefik.http.routers.n8n.tls.certresolver=letsencrypt"
- "traefik.http.services.n8n.loadbalancer.server.port=5678"
- "traefik.http.routers.n8n.middlewares=${AUTH_MIDDLEWARE}"
restart: unless-stopped
depends_on:
postgres:
condition: service_healthy
# No-Code Database Interface
nocodb:
image: nocodb/nocodb:2026.07.0
container_name: ${TENANT_PREFIX}-nocodb
environment:
NC_DB: "pg://postgres:5432?u=${POSTGRES_USER}&p=${POSTGRES_PASSWORD}&d=nocodb"
NC_PUBLIC_URL: https://${NOCODB_DOMAIN}
NC_DISABLE_TELE: "true"
NC_ADMIN_EMAIL: ${ADMIN_EMAIL}
NC_ADMIN_PASSWORD: ${NOCODB_ADMIN_PASSWORD}
volumes:
- nocodb_data:/usr/app/data
networks:
- tenant
labels:
- "traefik.enable=true"
- "traefik.http.routers.nocodb.rule=Host(`${NOCODB_DOMAIN}`)"
- "traefik.http.routers.nocodb.tls.certresolver=letsencrypt"
- "traefik.http.services.nocodb.loadbalancer.server.port=8080"
- "traefik.http.routers.nocodb.middlewares=${AUTH_MIDDLEWARE}"
restart: unless-stopped
depends_on:
postgres:
condition: service_healthy
# Supabase Backend Stack (5 containers)
supabase-studio:
image: supabase/studio:2026.07.27-sha-cbb076d
container_name: ${TENANT_PREFIX}-supabase-studio
environment:
STUDIO_PG_META_URL: http://supabase-meta:8080
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
DEFAULT_ORGANIZATION_NAME: ${CLIENT_NAME}
DEFAULT_PROJECT_NAME: ${CLIENT_NAME} Project
SUPABASE_PUBLIC_URL: https://${SUPABASE_DOMAIN}
networks:
- tenant
labels:
- "traefik.enable=true"
- "traefik.http.routers.supabase-studio.rule=Host(`${SUPABASE_DOMAIN}`)"
- "traefik.http.routers.supabase-studio.tls.certresolver=letsencrypt"
- "traefik.http.services.supabase-studio.loadbalancer.server.port=3000"
- "traefik.http.routers.supabase-studio.middlewares=${AUTH_MIDDLEWARE}"
restart: unless-stopped
healthcheck:
disable: true
depends_on:
postgres:
condition: service_healthy
supabase-meta:
image: supabase/postgres-meta:v0.96.6
container_name: ${TENANT_PREFIX}-supabase-meta
environment:
PG_META_PORT: 8080
PG_META_DB_HOST: postgres
PG_META_DB_PORT: 5432
PG_META_DB_NAME: supabase
PG_META_DB_USER: ${POSTGRES_USER}
PG_META_DB_PASSWORD: ${POSTGRES_PASSWORD}
networks:
- tenant
restart: unless-stopped
depends_on:
postgres:
condition: service_healthy
supabase-auth:
image: supabase/gotrue:v2.193.1
container_name: ${TENANT_PREFIX}-supabase-auth
environment:
GOTRUE_API_HOST: 0.0.0.0
GOTRUE_API_PORT: 9999
API_EXTERNAL_URL: https://api.${CLIENT_DOMAIN}
GOTRUE_DB_DRIVER: postgres
GOTRUE_DB_DATABASE_URL: postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/supabase
GOTRUE_SITE_URL: https://${SUPABASE_DOMAIN}
GOTRUE_JWT_SECRET: ${SUPABASE_JWT_SECRET}
GOTRUE_JWT_EXP: 3600
GOTRUE_JWT_DEFAULT_GROUP_NAME: authenticated
networks:
- tenant
restart: unless-stopped
depends_on:
postgres:
condition: service_healthy
supabase-rest:
image: postgrest/postgrest:v13.0.8
container_name: ${TENANT_PREFIX}-supabase-rest
environment:
PGRST_DB_URI: postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/supabase
PGRST_DB_SCHEMAS: public
PGRST_DB_ANON_ROLE: anon
PGRST_JWT_SECRET: ${SUPABASE_JWT_SECRET}
PGRST_DB_USE_LEGACY_GUCS: "false"
networks:
- tenant
restart: unless-stopped
depends_on:
postgres:
condition: service_healthy
supabase-realtime:
image: supabase/realtime:v2.120.3
container_name: ${TENANT_PREFIX}-supabase-realtime
environment:
PORT: 4000
DB_HOST: postgres
DB_PORT: 5432
DB_USER: ${POSTGRES_USER}
DB_PASSWORD: ${POSTGRES_PASSWORD}
DB_NAME: supabase
DB_AFTER_CONNECT_QUERY: 'SET search_path TO _realtime'
DB_ENC_KEY: supabaserealtime
API_JWT_SECRET: ${SUPABASE_JWT_SECRET}
SECRET_KEY_BASE: ${SUPABASE_JWT_SECRET}
METRICS_JWT_SECRET: ${SUPABASE_JWT_SECRET}
ERL_AFLAGS: -proto_dist inet_tcp
DNS_NODES: "''"
APP_NAME: realtime
SEED_SELF_HOST: "true"
networks:
- tenant
restart: unless-stopped
depends_on:
postgres:
condition: service_healthy
supabase-kong:
image: kong:3.9.1
container_name: ${TENANT_PREFIX}-supabase-kong
environment:
KONG_DATABASE: "off"
KONG_DECLARATIVE_CONFIG: /var/lib/kong/kong.yml
KONG_DNS_ORDER: LAST,A,CNAME
KONG_PLUGINS: request-size-limiting,cors,key-auth,rate-limiting
KONG_NGINX_PROXY_PROXY_BUFFER_SIZE: 160k
KONG_NGINX_PROXY_PROXY_BUFFERS: 64 160k
volumes:
- ./supabase/kong.yml:/var/lib/kong/kong.yml:ro
networks:
- tenant
labels:
- "traefik.enable=true"
- "traefik.http.routers.kong.rule=Host(`api.${CLIENT_DOMAIN}`)"
- "traefik.http.routers.kong.tls.certresolver=letsencrypt"
- "traefik.http.services.kong.loadbalancer.server.port=8000"
- "traefik.http.routers.kong.middlewares=${AUTH_MIDDLEWARE}"
restart: unless-stopped
# Local AI Language Models
ollama:
image: ollama/ollama:0.32.3
container_name: ${TENANT_PREFIX}-ollama
environment:
OLLAMA_HOST: 0.0.0.0:11434
OLLAMA_ORIGINS: "*"
volumes:
- ollama_data:/root/.ollama
networks:
- tenant
labels:
- "traefik.enable=true"
- "traefik.http.routers.ollama.rule=Host(`ai.${CLIENT_DOMAIN}`)"
- "traefik.http.routers.ollama.tls.certresolver=letsencrypt"
- "traefik.http.services.ollama.loadbalancer.server.port=11434"
- "traefik.http.routers.ollama.middlewares=${AUTH_MIDDLEWARE}"
restart: unless-stopped
deploy:
resources:
limits:
memory: 16G
reservations:
memory: 8G
healthcheck:
test: ["CMD", "ollama", "list"]
interval: 30s
timeout: 10s
retries: 3
# Enterprise SSO Authentication (3 containers)
authentik-redis:
image: redis:7.4.9-alpine
container_name: ${TENANT_PREFIX}-authentik-redis
command: --save 60 1 --loglevel warning
networks:
- tenant
volumes:
- authentik_redis_data:/data
restart: unless-stopped
healthcheck:
test: ["CMD-SHELL", "redis-cli ping | grep PONG"]
interval: 30s
timeout: 3s
retries: 3
authentik-server:
image: ghcr.io/goauthentik/server:${AUTHENTIK_TAG}
container_name: ${TENANT_PREFIX}-authentik-server
command: server
environment:
AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY}
AUTHENTIK_ERROR_REPORTING__ENABLED: "false"
AUTHENTIK_POSTGRESQL__HOST: postgres
AUTHENTIK_POSTGRESQL__USER: ${POSTGRES_USER}
AUTHENTIK_POSTGRESQL__NAME: authentik
AUTHENTIK_POSTGRESQL__PASSWORD: ${POSTGRES_PASSWORD}
AUTHENTIK_REDIS__HOST: authentik-redis
volumes:
- authentik_media:/media
- authentik_templates:/templates
networks:
- tenant
labels:
- "traefik.enable=true"
- "traefik.http.routers.authentik.rule=Host(`auth.${CLIENT_DOMAIN}`)"
- "traefik.http.routers.authentik.tls.certresolver=letsencrypt"
- "traefik.http.services.authentik.loadbalancer.server.port=9000"
restart: unless-stopped
depends_on:
postgres:
condition: service_healthy
authentik-redis:
condition: service_healthy
authentik-worker:
image: ghcr.io/goauthentik/server:${AUTHENTIK_TAG}
container_name: ${TENANT_PREFIX}-authentik-worker
command: worker
environment:
AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY}
AUTHENTIK_ERROR_REPORTING__ENABLED: "false"
AUTHENTIK_POSTGRESQL__HOST: postgres
AUTHENTIK_POSTGRESQL__USER: ${POSTGRES_USER}
AUTHENTIK_POSTGRESQL__NAME: authentik
AUTHENTIK_POSTGRESQL__PASSWORD: ${POSTGRES_PASSWORD}
AUTHENTIK_REDIS__HOST: authentik-redis
volumes:
- authentik_media:/media
- authentik_templates:/templates
- /var/run/docker.sock:/var/run/docker.sock
networks:
- tenant
restart: unless-stopped
depends_on:
postgres:
condition: service_healthy
authentik-redis:
condition: service_healthy
# Test Service for Health Monitoring
whoami:
image: traefik/whoami:v1.11.0
container_name: ${TENANT_PREFIX}-whoami
networks:
- tenant
labels:
- "traefik.enable=true"
- "traefik.http.routers.whoami.rule=Host(`test.${CLIENT_DOMAIN}`)"
- "traefik.http.routers.whoami.tls.certresolver=letsencrypt"
- "traefik.http.services.whoami.loadbalancer.server.port=80"
restart: unless-stopped
volumes:
postgres_data:
n8n_data:
nocodb_data:
ollama_data:
authentik_redis_data:
authentik_media:
authentik_templates:
完整的环境模板
创建 .env.template，涵盖所有客户专属变量：
# Client Configuration
CLIENT_NAME=CLIENT_NAME_PLACEHOLDER
CLIENT_DOMAIN=CLIENT_DOMAIN_PLACEHOLDER
TENANT_PREFIX=CLIENT_PREFIX_PLACEHOLDER
TENANT_NETWORK=CLIENT_NETWORK_PLACEHOLDER
# Compose project name: keeps volume names and Traefik's container filter per client
COMPOSE_PROJECT_NAME=CLIENT_PREFIX_PLACEHOLDER
# Service Domains (Subdomain-based routing)
N8N_DOMAIN=workflows.CLIENT_DOMAIN_PLACEHOLDER
NOCODB_DOMAIN=database.CLIENT_DOMAIN_PLACEHOLDER
SUPABASE_DOMAIN=backend.CLIENT_DOMAIN_PLACEHOLDER
AUTHENTIK_DOMAIN=auth.CLIENT_DOMAIN_PLACEHOLDER
# Host Ports (localhost only, offset per client by the deployment script)
TRAEFIK_DASHBOARD_PORT=8080
POSTGRES_PORT=5432
# Admin Configuration
ADMIN_EMAIL=admin@CLIENT_DOMAIN_PLACEHOLDER
# Database Configuration
POSTGRES_DB=main_db
POSTGRES_USER=postgres
POSTGRES_PASSWORD=SECURE_PASSWORD_PLACEHOLDER
# Service-Specific Passwords
NOCODB_ADMIN_PASSWORD=NOCODB_PASSWORD_PLACEHOLDER
SUPABASE_JWT_SECRET=SUPABASE_JWT_PLACEHOLDER
# Authentik SSO Configuration
AUTHENTIK_SECRET_KEY=AUTHENTIK_SECRET_PLACEHOLDER
AUTHENTIK_TAG=2025.8.6
# n8n Configuration
N8N_PROTOCOL=https
N8N_SECURE_COOKIE=true
# Cloudflare Integration (tunnel token, and an API token with Zone:DNS:Edit for certificates)
CLOUDFLARE_TOKEN=CLOUDFLARE_TOKEN_PLACEHOLDER
CF_DNS_API_TOKEN=CF_DNS_API_TOKEN_PLACEHOLDER
# Authentication Middleware (set to 'auth-global' for SSO, leave empty for no auth)
AUTH_MIDDLEWARE=
数据库初始化脚本
在 init/01-create-multiple-databases.sql 中创建完整的数据库初始化配置：
-- Create databases for all services
CREATE DATABASE n8n;
CREATE DATABASE nocodb;
CREATE DATABASE supabase;
CREATE DATABASE authentik;
-- Enable required extensions for Supabase
-- (pgjwt is not part of the official postgres image, and a failing statement aborts the init)
\c supabase
CREATE EXTENSION IF NOT EXISTS "uuid-ossp";
CREATE EXTENSION IF NOT EXISTS "pgcrypto";
-- Schemas and role the Supabase services expect
CREATE SCHEMA IF NOT EXISTS auth;
CREATE SCHEMA IF NOT EXISTS _realtime;
CREATE ROLE anon NOLOGIN;
GRANT USAGE ON SCHEMA public TO anon;
-- Enable required extensions for Authentik
\c authentik
CREATE EXTENSION IF NOT EXISTS "uuid-ossp";
CREATE EXTENSION IF NOT EXISTS "pgcrypto";
\echo 'Multiple databases and extensions created successfully'
Supabase Kong 网关配置
创建 supabase/kong.yml，用于配置 API 网关路由：
_format_version: "3.0"
services:
- name: auth-v1-open
url: http://supabase-auth:9999/verify
plugins:
- name: cors
routes:
- name: auth-v1-open
strip_path: true
paths:
- /auth/v1/verify
methods:
- POST
- OPTIONS
- name: auth-v1-open-callback
url: http://supabase-auth:9999/callback
plugins:
- name: cors
routes:
- name: auth-v1-open-callback
strip_path: true
paths:
- /auth/v1/callback
methods:
- GET
- POST
- OPTIONS
- name: auth-v1
_comment: "GoTrue: /auth/v1/* -> http://supabase-auth:9999/*"
url: http://supabase-auth:9999/
plugins:
- name: cors
- name: key-auth
config:
hide_credentials: false
routes:
- name: auth-v1-all
strip_path: true
paths:
- /auth/v1/
methods:
- GET
- POST
- PUT
- PATCH
- DELETE
- OPTIONS
- name: rest-v1
_comment: "PostgREST: /rest/v1/* -> http://supabase-rest:3000/*"
url: http://supabase-rest:3000/
plugins:
- name: cors
- name: key-auth
config:
hide_credentials: true
routes:
- name: rest-v1-all
strip_path: true
paths:
- /rest/v1/
methods:
- GET
- POST
- PUT
- PATCH
- DELETE
- OPTIONS
- name: realtime-v1
_comment: "Realtime: /realtime/v1/* -> ws://supabase-realtime:4000/socket/*"
url: http://supabase-realtime:4000/socket/
plugins:
- name: cors
- name: key-auth
config:
hide_credentials: false
routes:
- name: realtime-v1-all
strip_path: true
paths:
- /realtime/v1/
methods:
- GET
- POST
- PUT
- PATCH
- DELETE
- OPTIONS
consumers:
- username: anon
keyauth_credentials:
- key: your-anon-key-here
- username: service_role
keyauth_credentials:
- key: your-service-role-key-here
plugins:
- name: cors
config:
origins:
- "*"
methods:
- GET
- POST
- PUT
- PATCH
- DELETE
- OPTIONS
headers:
- Accept
- Accept-Version
- Content-Length
- Content-MD5
- Content-Type
- Date
- X-Auth-Token
- Authorization
- X-Forwarded-For
- X-Forwarded-Proto
- X-Forwarded-Port
exposed_headers:
- X-Auth-Token
credentials: true
max_age: 3600
自动化部署脚本
这份完整的部署脚本可在几分钟内创建新的客户环境：
#!/bin/bash
# deploy-client.sh - Complete Multi-Tenant Deployment
set -euo pipefail
CLIENT_DOMAIN=${1:-}
CLIENT_NAME=${2:-}
CLOUDFLARE_TOKEN=${3:-}
if [ -z "$CLIENT_DOMAIN" ] || [ -z "$CLIENT_NAME" ] || [ -z "$CLOUDFLARE_TOKEN" ] || [ -z "${CF_DNS_API_TOKEN:-}" ]; then
echo "Usage: CF_DNS_API_TOKEN=... ./deploy-client.sh example.com 'Client Name' 'cloudflare-tunnel-token'"
echo ""
echo "Example: ./deploy-client.sh client-a.com 'Client A Corporation' 'your-cloudflare-token'"
echo "CF_DNS_API_TOKEN: Cloudflare API token with Zone:DNS:Edit, used for certificates"
exit 1
fi
# Run from the template directory, wherever the script is called from
cd "$(dirname "$0")"
CLIENT_PREFIX=$(echo "$CLIENT_DOMAIN" | sed 's/[.-]//g' | tr '[:upper:]' '[:lower:]')
TIMESTAMP=$(date +%Y%m%d_%H%M%S)
echo "🚀 Deploying complete multi-tenant environment..."
echo "📋 Configuration:"
echo " Domain: $CLIENT_DOMAIN"
echo " Name: $CLIENT_NAME"
echo " Prefix: $CLIENT_PREFIX"
echo " Timestamp: $TIMESTAMP"
echo ""
# Create deployment directory
DEPLOY_DIR="../deployments/$CLIENT_DOMAIN"
mkdir -p "$DEPLOY_DIR"/{traefik,authentik,supabase,init,logs}
echo "📁 Created deployment directory structure"
# Copy template files
cp docker-compose.yml "$DEPLOY_DIR/"
cp -R traefik authentik supabase init "$DEPLOY_DIR/"
echo "📋 Copied configuration templates"
# Generate secure passwords and secrets
POSTGRES_PASSWORD=$(openssl rand -hex 16)
NOCODB_PASSWORD=$(openssl rand -hex 12)
SUPABASE_JWT_SECRET=$(openssl rand -hex 32)
AUTHENTIK_SECRET=$(openssl rand -hex 32)
echo "🔐 Generated secure credentials"
# Offset the localhost-only host ports per client (80/443 are not published at all)
PORT_OFFSET=$(($(echo "$CLIENT_PREFIX" | cksum | cut -f1 -d' ') % 1000))
TRAEFIK_DASHBOARD_PORT=$((8080 + PORT_OFFSET))
POSTGRES_PORT=$((5432 + PORT_OFFSET))
# Create comprehensive environment file (readable by the owner only)
umask 077
sed -e "s/CLIENT_NAME_PLACEHOLDER/$CLIENT_NAME/g" \
-e "s/CLIENT_DOMAIN_PLACEHOLDER/$CLIENT_DOMAIN/g" \
-e "s/CLIENT_PREFIX_PLACEHOLDER/$CLIENT_PREFIX/g" \
-e "s/CLIENT_NETWORK_PLACEHOLDER/${CLIENT_PREFIX}-network/g" \
-e "s/SECURE_PASSWORD_PLACEHOLDER/$POSTGRES_PASSWORD/g" \
-e "s/NOCODB_PASSWORD_PLACEHOLDER/$NOCODB_PASSWORD/g" \
-e "s/SUPABASE_JWT_PLACEHOLDER/$SUPABASE_JWT_SECRET/g" \
-e "s/AUTHENTIK_SECRET_PLACEHOLDER/$AUTHENTIK_SECRET/g" \
-e "s/CLOUDFLARE_TOKEN_PLACEHOLDER/$CLOUDFLARE_TOKEN/g" \
-e "s/CF_DNS_API_TOKEN_PLACEHOLDER/$CF_DNS_API_TOKEN/g" \
-e "s/^TRAEFIK_DASHBOARD_PORT=.*/TRAEFIK_DASHBOARD_PORT=$TRAEFIK_DASHBOARD_PORT/" \
-e "s/^POSTGRES_PORT=.*/POSTGRES_PORT=$POSTGRES_PORT/" \
.env.template > "$DEPLOY_DIR/.env"
echo "⚙️ Generated environment configuration"
# Create ACME file for Traefik SSL
touch "$DEPLOY_DIR/traefik/acme.json"
chmod 600 "$DEPLOY_DIR/traefik/acme.json"
# Initialize deployment
cd "$DEPLOY_DIR"
echo "🐋 Starting Docker containers..."
echo " This may take several minutes for first-time image downloads"
# Start all services (each waits for the database health check)
docker compose up -d
echo ""
echo "✅ Multi-tenant environment deployed successfully!"
echo ""
echo "🌐 Access URLs:"
echo " 🔧 Traefik Dashboard: http://localhost:$TRAEFIK_DASHBOARD_PORT/dashboard/"
echo " 🔀 Workflows (n8n): https://workflows.$CLIENT_DOMAIN"
echo " 🗄️ Database (NocoDB): https://database.$CLIENT_DOMAIN"
echo " 🔧 Backend (Supabase): https://backend.$CLIENT_DOMAIN"
echo " 🤖 AI (Ollama): https://ai.$CLIENT_DOMAIN"
echo " 🔐 Authentication: https://auth.$CLIENT_DOMAIN"
echo " 🔌 API Gateway: https://api.$CLIENT_DOMAIN"
echo " 🧪 Test Service: https://test.$CLIENT_DOMAIN"
echo ""
echo "📊 Container Status:"
docker compose ps
echo ""
echo "🔑 Generated credentials are stored in $DEPLOY_DIR/.env (mode 600)"
echo ""
echo "📝 Next Steps:"
echo " 1. In the Cloudflare tunnel, route *.${CLIENT_DOMAIN} to https://traefik:443 (No TLS Verify)"
echo " 2. Wait 2-3 minutes for all services to initialize"
echo " 3. Access services via the URLs above"
echo " 4. Configure SSO via auth.$CLIENT_DOMAIN if needed"
echo ""
echo "📚 Documentation: Visit tva.sg for setup guides and troubleshooting"
echo "💬 Support: Contact us via tva.sg/contact for assistance"
使用多租户栈
部署新客户环境
使用我们的完整脚本，创建新的客户环境非常简单：
# Set once per shell: Cloudflare API token with Zone:DNS:Edit (used for certificates)
export CF_DNS_API_TOKEN="your-cloudflare-dns-token"
# Deploy Client A with full enterprise stack
./deploy-client.sh client-a.com "Client A Corporation" "your-cloudflare-token"
# Deploy Client B with different domain
./deploy-client.sh client-b.org "Client B Industries" "your-cloudflare-token"
# Deploy Startup C
./deploy-client.sh startup-c.io "Startup C" "your-cloudflare-token"
每次部署都会创建：
- 专用 Docker 网络，包含 16 个容器
- 用于持久存储的独立数据卷
- 带健康监控的专属服务容器
- 独立的 Cloudflare 隧道配置
- 配备 SSL 证书的自定义域名路由
- 可随时启用的企业级 SSO 基础设施
管理多个环境
从一个集中位置监控所有客户环境：
# Check all running environments across clients
docker ps --format "table {{.Names}}\t{{.Status}}\t{{.Ports}}" | grep -E "(client|startup)"
# View comprehensive logs for specific client
cd deployments/client-a.com
docker compose logs -f --tail=50 n8n
# Health check all services for a client
docker compose ps
docker compose exec postgres pg_isready
# Restart specific services
docker compose restart nocodb supabase-studio
# Update all services to the image versions now pinned in docker-compose.yml
docker compose pull && docker compose up -d
深入了解容器架构
每个客户的完整 16 容器架构包括：
基础设施层（4 个容器）：
- cloudflare-tunnel：安全的外部连接
- traefik：支持自动 SSL 和服务发现的反向代理
- postgres：配备连接池的中央数据库
- whoami：健康监控和路由验证
应用层（7 个容器）：
- n8n：以 PostgreSQL 为后端的工作流自动化
- nocodb：无代码数据库界面
- supabase-studio：后端开发仪表盘
- supabase-meta：数据库内省服务
- supabase-auth：身份认证与用户管理
- supabase-rest：自动生成的 REST API
- supabase-realtime：实时订阅与更新
AI 与网关层（2 个容器）：
- ollama：支持 GPU 加速的本地 AI
- supabase-kong：支持速率限制和 CORS 的 API 网关
企业安全层（3 个容器）：
- authentik-server：SSO 身份认证服务器
- authentik-worker：后台任务与通知
- authentik-redis：会话管理与缓存
按客户需求扩展资源
根据客户需求和使用模式调整资源：
# High-performance client configuration (docker-compose.override.yml)
services:
n8n:
deploy:
resources:
limits:
cpus: '4.0'
memory: 8G
reservations:
cpus: '2.0'
memory: 4G
postgres:
command: postgres -c max_connections=200 -c shared_buffers=1GB -c effective_cache_size=3GB
deploy:
resources:
limits:
cpus: '2.0'
memory: 4G
reservations:
cpus: '1.0'
memory: 2G
ollama:
deploy:
resources:
limits:
memory: 32G
reservations:
memory: 16G
devices:
- driver: nvidia
count: 1
capabilities: [gpu]
为业务带来的实际收益
完全隔离的客户环境与企业级功能
每个客户都有一套完整的专属环境，包括企业级 SSO、AI 功能和完整的后端基础设施。数据、配置、定制内容和安全策略保持分离。一个客户环境中的应用层问题会局限于该环境，但由于所有客户共享同一台主机，CPU、内存或磁盘资源耗尽等主机层问题仍可能影响所有客户。这与我们为各客户单独部署 n8n 时实现的隔离效果类似。
快速接入客户，提供完整功能
新客户可在不到 10 分钟内启动完整的开发和自动化栈。部署脚本自动完成配置、凭据生成和服务初始化；Cloudflare DNS 记录和可选的 SSO 设置仍需通过简短的手动步骤完成。
可预测的企业级成本
完成初始配置后，除基础设施本身的费用外，不再产生按客户计收的托管费用。与按席位、工作流或 API 调用收费的 SaaS 方案不同，您为服务器支付固定费用，即可在其资源允许的范围内运行多个具备完整企业级功能的客户环境。
保持专业、一致的品牌形象
每个客户都有自己的品牌域名和专业子域名（workflows.client.com、auth.client.com 等），并可全面定制环境。无需使用削弱品牌形象的“powered by”页脚或共享界面。
n8n 集成：规模化的企业工作流自动化
这一组合的能力在此体现。正如我们之前介绍的自托管 n8n 工作流自动化方案，这套多租户配置为每个客户提供独立、完整的 n8n 实例，并与完整的企业服务栈集成。
每个客户都能构建复杂工作流，实现：
- 连接自己的数据库（NocoDB、Supabase PostgreSQL）
- 使用自己的 AI 模型（Ollama）进行智能自动化
- 通过企业 SSO（Authentik）进行身份认证
- 集成其特定业务工具和 API
- 在自己的隔离环境中处理数据
这一组合形成了功能强大的客户交付平台，让您能够：
- 快速部署标准化的自动化能力
- 按客户定制工作流，不影响其他客户
- 扩大服务交付规模，而无需让成本同比例增长
- 为每个客户保持完整的数据主权
- 提供基于 SSO 的访问控制，为安全与合规工作奠定基础
这一方法沿用了我们在 Windmill Docker 配置指南中采用的原则，并将其扩展为完整的多租户架构。
高级配置选项
通过 Authentik 实现企业 SSO
配置 Authentik 前向认证，在所有客户服务之间启用单点登录：
# Add to the authentik-server labels in docker-compose.yml
- "traefik.http.middlewares.auth-global.forwardauth.address=http://authentik-server:9000/outpost.goauthentik.io/auth/traefik"
- "traefik.http.middlewares.auth-global.forwardauth.trustForwardHeader=true"
- "traefik.http.middlewares.auth-global.forwardauth.authResponseHeaders=X-authentik-username,X-authentik-groups,X-authentik-email,X-authentik-name,X-authentik-uid"
随后更新服务标签，以使用该中间件：
labels:
- "traefik.http.routers.n8n.middlewares=auth-global"
- "traefik.http.routers.nocodb.middlewares=auth-global"
- "traefik.http.routers.supabase-studio.middlewares=auth-global"
添加向量数据库，扩展高级 AI 功能
通过 Qdrant 向量数据库增强 AI 能力：
qdrant:
image: qdrant/qdrant:v1.18.3
container_name: ${TENANT_PREFIX}-qdrant
environment:
QDRANT__SERVICE__HTTP_PORT: 6333
QDRANT__SERVICE__GRPC_PORT: 6334
volumes:
- qdrant_data:/qdrant/storage
networks:
- tenant
labels:
- "traefik.enable=true"
- "traefik.http.routers.qdrant.rule=Host(`vector.${CLIENT_DOMAIN}`)"
- "traefik.http.routers.qdrant.tls.certresolver=letsencrypt"
- "traefik.http.services.qdrant.loadbalancer.server.port=6333"
- "traefik.http.routers.qdrant.middlewares=${AUTH_MIDDLEWARE}"
# Also add qdrant_data: under the top-level volumes:
实现混合 AI 架构
为了获得最佳性能，可考虑将容器化 AI 与原生运行的 AI 相结合：
# Install Ollama natively on host for GPU acceleration
brew install ollama
# Configure containers to use native Ollama
# In docker-compose.yml, services can access via host.docker.internal:11434
n8n:
environment:
- OLLAMA_HOST=host.docker.internal:11434
这在 macOS 上尤为重要，因为 Docker Desktop 不支持在容器中使用 GPU，而原生运行的 Ollama 可直接使用 GPU 加速。在我们的配置中，这带来了约 5-6 倍的性能提升，其他服务则继续在容器中运行。
监控与可观测性栈
为每个客户添加全面的监控：
prometheus:
image: prom/prometheus:v3.13.1
container_name: ${TENANT_PREFIX}-prometheus
volumes:
- ./monitoring/prometheus.yml:/etc/prometheus/prometheus.yml
- prometheus_data:/prometheus
networks:
- tenant
labels:
- "traefik.enable=true"
- "traefik.http.routers.prometheus.rule=Host(`metrics.${CLIENT_DOMAIN}`)"
- "traefik.http.routers.prometheus.tls.certresolver=letsencrypt"
- "traefik.http.routers.prometheus.middlewares=${AUTH_MIDDLEWARE}"
grafana:
image: grafana/grafana:13.1.1
container_name: ${TENANT_PREFIX}-grafana
environment:
GF_SECURITY_ADMIN_PASSWORD: ${GRAFANA_PASSWORD}
GF_USERS_ALLOW_SIGN_UP: "false"
volumes:
- grafana_data:/var/lib/grafana
- ./monitoring/dashboards:/var/lib/grafana/dashboards
networks:
- tenant
labels:
- "traefik.enable=true"
- "traefik.http.routers.grafana.rule=Host(`monitoring.${CLIENT_DOMAIN}`)"
- "traefik.http.routers.grafana.tls.certresolver=letsencrypt"
- "traefik.http.routers.grafana.middlewares=${AUTH_MIDDLEWARE}"
# Also add prometheus_data: and grafana_data: under the top-level volumes:
常见问题与解决方法
“Service Unavailable”或 HTTP 502 错误
这通常意味着 Traefik 无法连接目标容器。请检查以下内容：
# Verify container is running and healthy
docker compose ps
docker compose logs traefik --tail=20
# Check container is on correct network
docker network ls
docker network inspect ${CLIENT_PREFIX}-network
# Verify Traefik labels are correct
docker compose config --services
DNS 解析问题
通配符 DNS 配置对子域名路由至关重要：
# Correct Cloudflare DNS configuration
*.client-a.com CNAME tunnel-uuid.cfargotunnel.com
*.client-b.org CNAME tunnel-uuid2.cfargotunnel.com
# Test DNS resolution
nslookup workflows.client-a.com
dig workflows.client-a.com
多客户环境中的资源耗尽
监控所有客户环境的资源使用情况：
# Check overall system resource usage
docker stats --no-stream
htop
# Check disk usage per client
du -sh deployments/*/
df -h
# Monitor container memory usage
docker stats --no-stream --format "table {{.Name}}\t{{.MemUsage}}"
数据库连接池耗尽
客户数量较多时，可能达到 PostgreSQL 的连接数上限。请为每套部署进行配置：
# Connect to client database
docker compose exec postgres psql -U postgres
-- Increase connection limit
ALTER SYSTEM SET max_connections = 300;
ALTER SYSTEM SET shared_buffers = '256MB';
ALTER SYSTEM SET effective_cache_size = '1GB';
-- Apply: effective_cache_size reloads, max_connections and shared_buffers need a restart
SELECT pg_reload_conf();
\q
# Restart PostgreSQL
docker compose restart postgres
Authentik SSO 配置问题
常见 SSO 配置问题及解决方法：
# Check Authentik containers are running
docker compose ps | grep authentik
# Verify database initialization
docker compose exec postgres psql -U postgres -d authentik -c "\dt"
# Check Authentik logs for startup issues
docker compose logs authentik-server --tail=50
# Get a recovery link to log in as admin if needed
docker compose exec authentik-worker ak create_recovery_key 10 akadmin
Cloudflare Tunnel 连接问题
排查隧道连接问题：
# Check tunnel status
docker compose logs cloudflare-tunnel --tail=20
# Verify tunnel configuration in Cloudflare dashboard
# Ensure wildcard routing: *.client-domain.com
# Test tunnel connectivity
curl -I https://test.client-domain.com
基础设施考量
为多客户环境规划基础设施容量
对于同时承载 10-15 个客户、每个客户运行完整 16 容器栈的典型配置：
最低要求：
- CPU：16-24 核（每个活跃的客户环境 2 核）
- RAM：64-128GB（每个客户 4-8GB，取决于 AI 使用量）
- 存储：2TB+ NVMe SSD（数据库、AI 模型和日志会随时间增长）
- 网络：千兆连接，确保客户访问及时响应
生产环境建议：
- 服务器：Hetzner CCX62 或同类配置（48 vCPU、192GB RAM）
- 存储：4TB NVMe，配备自动备份系统
- 网络：多条冗余连接
- 监控：配备告警的完整可观测性栈
多客户环境的备份策略
为每个客户实施自动备份：
#!/bin/bash
# backup-all-clients.sh - Comprehensive backup solution
set -euo pipefail
umask 077
BACKUP_DIR="/opt/backups"
BACKUP_DATE=$(date +%Y%m%d_%H%M%S)
# Path to development-stack/deployments
DEPLOYMENTS_DIR="/opt/development-stack/deployments"
mkdir -p "$BACKUP_DIR"
for client_dir in "$DEPLOYMENTS_DIR"/*/; do
CLIENT_DOMAIN=$(basename "$client_dir")
# Volume names start with the compose project name (TENANT_PREFIX in .env)
PROJECT=$(grep '^COMPOSE_PROJECT_NAME=' "$client_dir/.env" | cut -d= -f2)
echo "📦 Backing up client: $CLIENT_DOMAIN"
# Subshell: the cd applies to this client only; set -e stops the script on any failure
(
cd "$client_dir"
# Backup databases with compression
docker compose exec -T postgres pg_dumpall -U postgres | gzip > "${BACKUP_DIR}/${CLIENT_DOMAIN}_db_${BACKUP_DATE}.sql.gz"
# Backup persistent volumes
docker run --rm \
-v "${BACKUP_DIR}":/backup \
-v "${PROJECT}_n8n_data":/data/n8n:ro \
-v "${PROJECT}_nocodb_data":/data/nocodb:ro \
-v "${PROJECT}_ollama_data":/data/ollama:ro \
alpine:3.22 tar czf "/backup/${CLIENT_DOMAIN}_volumes_${BACKUP_DATE}.tar.gz" -C /data .
# Backup configuration files
tar czf "${BACKUP_DIR}/${CLIENT_DOMAIN}_config_${BACKUP_DATE}.tar.gz" \
docker-compose.yml .env traefik/ supabase/ authentik/ init/
)
echo "✅ Backup completed for $CLIENT_DOMAIN"
done
# Cleanup old backups (keep 30 days)
find "$BACKUP_DIR" -name "*.gz" -mtime +30 -delete
# Optional: Upload to cloud storage
# rclone sync "$BACKUP_DIR" s3:backup-bucket/multi-tenant/
生产环境安全加固
落实全面的安全最佳实践：
# Enhanced Traefik security configuration
traefik:
command:
- "--api.dashboard=true"
- "--ping=true"
- "--log.level=WARN"
- "--accesslog=true"
- "--providers.docker=true"
- "--providers.docker.network=${TENANT_NETWORK}"
- "--providers.docker.exposedbydefault=false"
- "--providers.docker.constraints=Label(`com.docker.compose.project`,`${TENANT_PREFIX}`)"
- "--entrypoints.web.address=:80"
- "--entrypoints.websecure.address=:443"
- "--entrypoints.websecure.asdefault=true"
- "--entrypoints.web.http.redirections.entrypoint.to=websecure"
- "--entrypoints.web.http.redirections.entrypoint.scheme=https"
- "--entrypoints.traefik.address=:8080"
- "--certificatesresolvers.letsencrypt.acme.email=${ADMIN_EMAIL}"
- "--certificatesresolvers.letsencrypt.acme.storage=/acme.json"
- "--certificatesresolvers.letsencrypt.acme.dnschallenge.provider=cloudflare"
labels:
# Security headers middleware
- "traefik.http.middlewares.security.headers.customRequestHeaders.X-Forwarded-Proto=https"
- "traefik.http.middlewares.security.headers.customResponseHeaders.X-Frame-Options=DENY"
- "traefik.http.middlewares.security.headers.customResponseHeaders.X-Content-Type-Options=nosniff"
- "traefik.http.middlewares.security.headers.customResponseHeaders.Strict-Transport-Security=max-age=31536000"
- "traefik.http.middlewares.security.headers.customResponseHeaders.Content-Security-Policy=default-src 'self'"
# Rate limiting middleware
- "traefik.http.middlewares.ratelimit.ratelimit.burst=100"
- "traefik.http.middlewares.ratelimit.ratelimit.average=50"
为所有客户服务应用安全中间件：
labels:
# Without SSO
- "traefik.http.routers.n8n.middlewares=security,ratelimit"
# With SSO enabled (AUTH_MIDDLEWARE=auth-global)
# - "traefik.http.routers.n8n.middlewares=security,ratelimit,auth-global"
成本分析：关键数字
传统 SaaS 成本（10 个具备完整功能的企业客户）
每个客户的月度费用：
- n8n Pro：每个客户 $50/月 = $500/月
- Supabase Pro：每个客户 $25/月 = $250/月
- 无代码平台（Airtable）：每个客户 $20/月 = $200/月
- 企业 SSO（Auth0）：每个客户 $23/月 = $230/月
- AI API 费用（OpenAI）：每个客户 $50/月 = $500/月
- 合计：$1,680/月 = $20,160/年
自托管多租户企业服务栈的成本
年度基础设施费用：
- 配备专用 vCPU 的云服务器（Hetzner CCX62）：$350/月 = $4,200/年
- 域名费用（10 个客户）：$120/年
- Cloudflare Pro（可选）：$240/年
- 合计：$4,560/年
每年节省：$15,600（成本降低 77%）
这些数字来自 2025 年 8 月的原始指南。截至 2026 年 10 月，Auth0 的 B2C Essentials 套餐起价为 $35/月，Hetzner 已不再列出 CCX62；其后继型号 CCX63 配备 48 vCPU 和 192 GB 内存，标价为 €853.99/月，不含增值税，包含一个主 IPv4 地址。作出决定前，请按当前价格重新计算两种方案。
此外，您还可获得：
- 完整的数据主权与隐私保护
- 不限范围的定制与白标能力
- 无供应商锁定或 SaaS 套餐速率限制
- 由您自行管理的安全与合规控制措施
- 提供转售服务的能力
- 对更新和功能的完整控制
这套配置提供的企业级功能，若通过 SaaS 订阅获取，通常成本会高得多。正如我们在 n8n 自托管分析中展示的成本优势，这进一步体现了该方案的价值。
从配置调整到运行决策
真正需要确认的，不只是平台能否完成配置，还包括团队能否说明责任归属、发现配置漂移、无需临时摸索即可恢复服务，并证明变更改善了预期结果。我们为每项配置变更配套负责人、基线、回滚路径和复核窗口，使一次性修复成为可持续的运维能力。生产变更记录应包含原因、已审查证据、准确范围，以及有权停止或撤销变更的人员。发布后，将约定指标与基线比较，并把结果保存在变更记录中。若没有预期改善，回滚是合理结果，而非失败；这种纪律比任何单项配置值更重要。同一记录还为下一位运维人员提供可信起点，使后续优化成为有测量依据的决策，而非新一轮猜测。