From 94749b12ac66e4b97c21c4d90bf57abc41046324 Mon Sep 17 00:00:00 2001
From: shaw <shaw-wei@foxmail.com>
Date: Sat, 27 Dec 2025 21:14:08 +0800
Subject: [PATCH] =?UTF-8?q?chore:=20=E8=B0=83=E6=95=B4deploy=E8=AF=B4?=
 =?UTF-8?q?=E6=98=8E=E4=BB=A5=E5=8F=8A=E5=8F=96=E6=B6=88postgres=E7=AB=AF?=
 =?UTF-8?q?=E5=8F=A3=E6=9A=B4=E9=9C=B2?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 deploy/README.md          | 24 ++++++++++++++++++++++++
 deploy/docker-compose.yml |  4 ++--
 2 files changed, 26 insertions(+), 2 deletions(-)

diff --git a/deploy/README.md b/deploy/README.md
index 5b127fc1..86f88f19 100644
--- a/deploy/README.md
+++ b/deploy/README.md
@@ -281,6 +281,30 @@ To change after installation:
    sudo systemctl restart sub2api
    ```
 
+#### Gemini OAuth Configuration
+
+If you need to use AI Studio OAuth for Gemini accounts, add the OAuth client credentials to the systemd service file:
+
+1. Edit the service file:
+   ```bash
+   sudo nano /etc/systemd/system/sub2api.service
+   ```
+
+2. Add your OAuth credentials in the `[Service]` section (after the existing `Environment=` lines):
+   ```ini
+   Environment=GEMINI_OAUTH_CLIENT_ID=your-client-id.apps.googleusercontent.com
+   Environment=GEMINI_OAUTH_CLIENT_SECRET=GOCSPX-your-client-secret
+   ```
+
+3. Reload and restart:
+   ```bash
+   sudo systemctl daemon-reload
+   sudo systemctl restart sub2api
+   ```
+
+> **Note:** Code Assist OAuth does not require any configuration - it uses the built-in Gemini CLI client.
+> See the [Gemini OAuth Configuration](#gemini-oauth-configuration) section above for detailed setup instructions.
+
 #### Application Configuration
 
 The main config file is at `/etc/sub2api/config.yaml` (created by Setup Wizard).
diff --git a/deploy/docker-compose.yml b/deploy/docker-compose.yml
index 4e2de67f..9e10ec54 100644
--- a/deploy/docker-compose.yml
+++ b/deploy/docker-compose.yml
@@ -121,8 +121,8 @@ services:
       timeout: 5s
       retries: 5
       start_period: 10s
-    ports:
-      - 5433:5432
+    # 注意：不暴露端口到宿主机，应用通过内部网络连接
+    # 如需调试，可临时添加：ports: ["127.0.0.1:5433:5432"]
 
   # ===========================================================================
   # Redis Cache