From 64ddfe8cae08ad3622a4c271bbb2aa619c0fb90d Mon Sep 17 00:00:00 2001
From: Zhou Weidong <502333560@qq.com>
Date: Wed, 21 Oct 2026 10:17:25 +0800
Subject: [PATCH] =?UTF-8?q?fix(deploy):=20=E7=AE=A1=E7=90=86=E7=AB=AF?=
 =?UTF-8?q?=E4=B8=8D=E5=86=8D=E6=A0=A1=E9=AA=8C=20/files/episode=20?=
 =?UTF-8?q?=E6=92=AD=E6=94=BE=E7=AD=BE=E5=90=8D?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

admin-api 镜像固定 prod profile，application-prod.yml 把 signature-required 硬编码为 true，导致管理端分集页直接播放裸媒资地址时被 MediaSignatureFilter 拦成 403，视频不显示。管理端仅内网访问，这里将 protected-prefixes 置空；公开的 app-api 仍保持签名校验。
---
 docker-compose.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/docker-compose.yml b/docker-compose.yml
index 3301837..72c8a1b 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -103,6 +103,9 @@ services:
       SPRING_SERVLET_MULTIPART_MAX_REQUEST_SIZE: "2GB"
       CORS_ALLOWED_ORIGINS: "http://localhost:3005,http://127.0.0.1:3005,http://39.162.50.99:3005,http://192.168.31.250:3005"
       DB_URL: ${DB_URL:-jdbc:postgresql://db:5432/${DB_NAME:-fruitshorts}}
+      # 管理端仅内网，页面上直接播放/下载裸媒资地址（不签播放签名），
+      # 因此这里不启用 /files/episode/** 的签名校验；公开的 app-api 仍保持开启。
+      FRUITSHORTS_MEDIA_PROTECTED_PREFIXES: ""
     ports:
       # docs/12-上线检查清单「管理端仅内网」：只对局域网开放；不在路由器做端口转发，公网访问不到
       - "8080:8080"