From 79d2ee344c0e0e333afcd00fa979f2154ce9d677 Mon Sep 17 00:00:00 2001
From: Cheng Zhou <zhoucheng857@gmail.com>
Date: Mon, 22 Jun 2026 15:35:25 +0800
Subject: [PATCH] =?UTF-8?q?=E5=8A=A0=E5=9B=BA=E9=83=A8=E7=BD=B2=E9=85=8D?=
 =?UTF-8?q?=E7=BD=AE=E4=B8=8E=E6=95=8F=E6=84=9F=E8=B7=AF=E5=BE=84=E6=8B=A6?=
 =?UTF-8?q?=E6=88=AA?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .dockerignore       | 22 ++++++++++++++++++++++
 docker-compose.yaml |  4 ----
 nginx/nginx.conf    |  6 ++++++
 3 files changed, 28 insertions(+), 4 deletions(-)
 create mode 100644 .dockerignore

diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 00000000..2f52577e
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,22 @@
+.git
+.gitignore
+.worktrees
+.agents
+.claude
+.DS_Store
+.env
+.env.*
+**/.env
+**/.env.*
+pg_data
+tmp
+.install-logs
+.pytest_cache
+**/.pytest_cache
+**/__pycache__
+**/*.pyc
+frontend/node_modules
+frontend/dist
+backend/.coverage
+backend/.pytest_cache
+nginx/certs
diff --git a/docker-compose.yaml b/docker-compose.yaml
index 3f54f7a9..e13921c3 100755
--- a/docker-compose.yaml
+++ b/docker-compose.yaml
@@ -10,8 +10,6 @@ services:
     volumes:
       # 持久化数据到 Linux 本地，防止重启丢失
       - ./pg_data:/var/lib/postgresql/data
-    ports:
-      - "5432:5432"
     healthcheck:
       test: ["CMD-SHELL", "pg_isready -U ctms_user -d ctms_db"]
       interval: 5s
@@ -26,8 +24,6 @@ services:
       dockerfile: Dockerfile
     container_name: ctms_backend
     restart: always
-    ports:
-      - "8000:8000"
     environment:
       DATABASE_URL: postgresql+asyncpg://ctms_user:secret_password@db/ctms_db
       ENV: ${ENV:-development}
diff --git a/nginx/nginx.conf b/nginx/nginx.conf
index 644d6d7e..3198cdba 100644
--- a/nginx/nginx.conf
+++ b/nginx/nginx.conf
@@ -52,6 +52,12 @@ http {
             add_header Cache-Control "public, max-age=31536000, immutable" always;
         }
 
+        location ~* (^|/)(\.git|\.env($|[./_-])|wp-config\.php|config\.php|database\.yml|backup($|[._/-])) {
+            access_log off;
+            log_not_found off;
+            return 404;
+        }
+
         location /api/ {
             proxy_pass http://backend;
             proxy_set_header Host $host;