음성 재생과 운영 배포 정리

This commit is contained in:
Yun Chan 2026-06-28 12:18:20 +09:00
parent 8ed185ce6c
commit ac7db95542
1020 changed files with 46863 additions and 2175 deletions

View file

@ -1,15 +1,19 @@
# Vignette infra env (예시). cp .env.example .env 후 값 채우기
POSTGRES_USER=vignette_owner
ENVIRONMENT=prod
POSTGRES_USER=vignette_owner
POSTGRES_PASSWORD=change-me
POSTGRES_DB=vignette
APP_DB_USER=vignette_app
APP_DB_PASSWORD=change-me-app
INSTALL_RAG=false
USER_UPLOAD_DIR=/app/uploads
SESSION_SECRET=change-me-random
AUTH_ALLOWED_EMAIL_DOMAINS=["hs.ac.kr","twentyoz.kr"]
AUTH_TEACHER_EMAILS=[]
AUTH_ADMIN_EMAILS=[]
AUTH_SUPER_ADMIN_EMAILS=["yunchan@twentyoz.kr","hoonjungkoo@hs.ac.kr"]
AUTH_APPROVED_EMAILS=[]
AUTH_NEW_USER_DEFAULT_STATUS=pending
AUTH_DEV_LOGIN_ENABLED=false
AUTH_DEV_LOGIN_EXTRA_ORIGINS=[]
DEFAULT_AFFILIATION=

View file

@ -1,3 +1,8 @@
# infra
Docker Compose: web · api · postgres(pgvector) · voice-gateway. chanpaca.net 외부노출.
Docker Compose: web · api · postgres(pgvector) · Caddy proxy.
- API 이미지는 저장소 루트 컨텍스트에서 빌드한다. `data/personas` 같은 런타임 입력을 컨테이너 안 `/app` 기준으로 찾기 때문이다.
- 엔진 게이트웨이는 compose 밖 호스트 프로세스로 두고, API는 `ENGINE_URL`로 호출한다.
- RAG 임베딩/리랭커 의존성은 API 이미지 build arg `INSTALL_RAG=true`일 때만 설치한다. 기본 이미지는 슬림 모드이며 RAG 모델 미설정 시 앱이 명시적으로 degraded 처리한다.
- 배포 전 루트에서 `python scripts/check-deploy-preflight.py --env-file infra/.env`를 실행한다. DB까지 검증할 때는 API app-role `DATABASE_URL`을 넘기고 `--require-app-role`을 붙인다.

View file

@ -31,10 +31,31 @@ CREATE TABLE IF NOT EXISTS app.app_user (
CHECK (role IN ('learner','instructor','admin')),
cohort TEXT, -- 교수자 담당 코호트 매칭
is_active BOOLEAN NOT NULL DEFAULT TRUE,
account_status TEXT NOT NULL DEFAULT 'approved'
CHECK (account_status IN ('pending','approved','suspended')),
admin_access BOOLEAN NOT NULL DEFAULT FALSE,
affiliation TEXT NOT NULL DEFAULT '',
legal_name TEXT NOT NULL DEFAULT '',
department TEXT NOT NULL DEFAULT '',
grade_level TEXT NOT NULL DEFAULT '',
phone TEXT NOT NULL DEFAULT '',
contact_address TEXT NOT NULL DEFAULT '',
nickname TEXT NOT NULL DEFAULT '',
self_introduction TEXT NOT NULL DEFAULT '',
avatar_url TEXT NOT NULL DEFAULT '',
consent_at TIMESTAMPTZ, -- 사전동의 하드게이트(IRB)
profile_completed_at TIMESTAMPTZ,
terms_agreed_at TIMESTAMPTZ,
privacy_agreed_at TIMESTAMPTZ,
terms_version TEXT NOT NULL DEFAULT '',
privacy_version TEXT NOT NULL DEFAULT '',
last_seen_at TIMESTAMPTZ NOT NULL DEFAULT now(),
updated_at TIMESTAMPTZ NOT NULL DEFAULT now(),
created_at TIMESTAMPTZ NOT NULL DEFAULT now()
);
CREATE INDEX IF NOT EXISTS idx_app_user_cohort ON app.app_user(cohort);
CREATE INDEX IF NOT EXISTS idx_app_user_account_status
ON app.app_user(account_status, last_seen_at DESC);
-- =============================================================================
@ -59,6 +80,7 @@ CREATE TABLE IF NOT EXISTS app.persona_card (
affect_baseline JSONB NOT NULL, -- {...,suicide_ideation_stage} hard상한=3
ccd JSONB NOT NULL, -- Patient-Ψ 8요소 (★직접발화 금지 R4)
dsm5_dimensional JSONB NOT NULL, -- criteria_behavior_matrix (진단명 비노출)
triggers JSONB NOT NULL DEFAULT '{}'::jsonb, -- 역린·상담자 금기·강한 반응 양상
source_provenance TEXT NOT NULL, -- '0615 합성변형'
is_synthetic BOOLEAN NOT NULL DEFAULT TRUE,
created_by UUID REFERENCES app.app_user(user_id),
@ -160,6 +182,19 @@ CREATE TABLE IF NOT EXISTS app.sessions (
CREATE INDEX IF NOT EXISTS idx_sessions_case ON app.sessions(case_id, session_no);
CREATE INDEX IF NOT EXISTS idx_sessions_learner ON app.sessions(learner_id);
-- 교수자 회기 검토 상태. 임상 루브릭/채점과 분리된 회기 단위 작업 상태다.
CREATE TABLE IF NOT EXISTS app.session_review_status (
session_id UUID PRIMARY KEY REFERENCES app.sessions(id) ON DELETE CASCADE,
reviewer_id UUID REFERENCES app.app_user(user_id),
status TEXT NOT NULL DEFAULT 'pending'
CHECK (status IN ('pending','viewed','closed')),
note TEXT NOT NULL DEFAULT '',
reviewed_at TIMESTAMPTZ,
updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
);
CREATE INDEX IF NOT EXISTS idx_session_review_status_status
ON app.session_review_status(status, updated_at DESC);
-- =============================================================================
-- 4. 발화 (MASTERPLAN §3.2 + 설계서 §3.3 연속성 컬럼) — ② EPISODIC 원자단위

View file

@ -83,6 +83,7 @@ CREATE INDEX IF NOT EXISTS idx_chunk_trgm ON kb.chunk
-- 정보비대칭 사전필터
CREATE INDEX IF NOT EXISTS idx_chunk_visible ON kb.chunk USING gin (visible_to);
CREATE INDEX IF NOT EXISTS idx_chunk_route ON kb.chunk (kb_kind, sensitivity);
CREATE INDEX IF NOT EXISTS idx_chunk_source ON kb.chunk (source_id);
-- =============================================================================
-- 4. KB 검색 로그 (환각측정·캐시검증, 람다 cost.json 차용, 설계서 §3.7)

View file

@ -263,6 +263,27 @@ CREATE POLICY p_supervisor_comment_insert ON app.supervisor_comment FOR INSERT W
OR app.current_role_name() IN ('admin','instructor')
);
-- ── session_review_status: 교수자 회기 단위 작업 상태. 학습자 직접 열람 없음 ──
ALTER TABLE app.session_review_status ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS p_session_review_status_select ON app.session_review_status;
CREATE POLICY p_session_review_status_select ON app.session_review_status FOR SELECT USING (
app.current_role_name() IN ('admin','instructor')
);
DROP POLICY IF EXISTS p_session_review_status_insert ON app.session_review_status;
CREATE POLICY p_session_review_status_insert ON app.session_review_status FOR INSERT WITH CHECK (
app.current_role_name() IN ('admin','instructor')
);
DROP POLICY IF EXISTS p_session_review_status_update ON app.session_review_status;
CREATE POLICY p_session_review_status_update ON app.session_review_status FOR UPDATE USING (
app.current_role_name() IN ('admin','instructor')
) WITH CHECK (
app.current_role_name() IN ('admin','instructor')
);
DROP POLICY IF EXISTS p_session_review_status_delete ON app.session_review_status;
CREATE POLICY p_session_review_status_delete ON app.session_review_status FOR DELETE USING (
app.current_role_name() IN ('admin','instructor')
);
ALTER TABLE app.alternative_utterance ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS p_alternative_utterance_select ON app.alternative_utterance;
CREATE POLICY p_alternative_utterance_select ON app.alternative_utterance FOR SELECT USING (

View file

@ -3,12 +3,43 @@
ALTER TABLE app.app_user
ADD COLUMN IF NOT EXISTS affiliation TEXT NOT NULL DEFAULT '',
ADD COLUMN IF NOT EXISTS legal_name TEXT NOT NULL DEFAULT '',
ADD COLUMN IF NOT EXISTS department TEXT NOT NULL DEFAULT '',
ADD COLUMN IF NOT EXISTS grade_level TEXT NOT NULL DEFAULT '',
ADD COLUMN IF NOT EXISTS phone TEXT NOT NULL DEFAULT '',
ADD COLUMN IF NOT EXISTS contact_address TEXT NOT NULL DEFAULT '',
ADD COLUMN IF NOT EXISTS nickname TEXT NOT NULL DEFAULT '',
ADD COLUMN IF NOT EXISTS self_introduction TEXT NOT NULL DEFAULT '',
ADD COLUMN IF NOT EXISTS avatar_url TEXT NOT NULL DEFAULT '',
ADD COLUMN IF NOT EXISTS profile_completed_at TIMESTAMPTZ,
ADD COLUMN IF NOT EXISTS terms_agreed_at TIMESTAMPTZ,
ADD COLUMN IF NOT EXISTS privacy_agreed_at TIMESTAMPTZ,
ADD COLUMN IF NOT EXISTS terms_version TEXT NOT NULL DEFAULT '',
ADD COLUMN IF NOT EXISTS privacy_version TEXT NOT NULL DEFAULT '',
ADD COLUMN IF NOT EXISTS last_seen_at TIMESTAMPTZ NOT NULL DEFAULT now(),
ADD COLUMN IF NOT EXISTS account_status TEXT NOT NULL DEFAULT 'approved',
ADD COLUMN IF NOT EXISTS admin_access BOOLEAN NOT NULL DEFAULT FALSE,
ADD COLUMN IF NOT EXISTS updated_at TIMESTAMPTZ NOT NULL DEFAULT now();
ALTER TABLE app.app_user
ALTER COLUMN affiliation SET DEFAULT '';
DO $$
BEGIN
IF NOT EXISTS (
SELECT 1 FROM pg_constraint
WHERE conname = 'app_user_account_status_check'
AND conrelid = 'app.app_user'::regclass
) THEN
ALTER TABLE app.app_user
ADD CONSTRAINT app_user_account_status_check
CHECK (account_status IN ('pending','approved','suspended'));
END IF;
END $$;
CREATE INDEX IF NOT EXISTS idx_app_user_account_status
ON app.app_user(account_status, last_seen_at DESC);
CREATE TABLE IF NOT EXISTS app.auth_session (
sid_hash TEXT PRIMARY KEY,
user_id UUID NOT NULL REFERENCES app.app_user(user_id) ON DELETE CASCADE,
@ -43,6 +74,96 @@ CREATE TABLE IF NOT EXISTS app.admin_engine_config (
updated_at TIMESTAMPTZ
);
CREATE TABLE IF NOT EXISTS app.admin_health_event (
id BIGSERIAL PRIMARY KEY,
observed_at TIMESTAMPTZ NOT NULL DEFAULT now(),
overall_status TEXT NOT NULL CHECK (overall_status IN ('ok','degraded','down')),
environment TEXT NOT NULL,
engine_mode TEXT NOT NULL,
service_key TEXT NOT NULL,
service_name TEXT NOT NULL,
service_status TEXT NOT NULL CHECK (service_status IN ('ok','degraded','down')),
detail TEXT NOT NULL DEFAULT '',
metric TEXT NOT NULL DEFAULT '',
load REAL NOT NULL DEFAULT 0.0 CHECK (load >= 0.0 AND load <= 1.0),
captured_by UUID REFERENCES app.app_user(user_id)
);
CREATE INDEX IF NOT EXISTS idx_admin_health_event_observed
ON app.admin_health_event(observed_at DESC, service_key);
CREATE TABLE IF NOT EXISTS app.support_ticket (
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
reporter_id UUID REFERENCES app.app_user(user_id) ON DELETE SET NULL,
reporter_email TEXT NOT NULL,
reporter_name TEXT NOT NULL,
reporter_role TEXT NOT NULL,
category TEXT NOT NULL DEFAULT 'other' CHECK (
category IN (
'account_access',
'session_review',
'voice_browser',
'content_scenario',
'safety',
'other'
)
),
priority TEXT NOT NULL DEFAULT 'normal' CHECK (priority IN ('low','normal','high','urgent')),
status TEXT NOT NULL DEFAULT 'open' CHECK (
status IN ('open','triaged','in_progress','resolved','closed')
),
subject TEXT NOT NULL,
body TEXT NOT NULL,
source_path TEXT NOT NULL DEFAULT '',
assigned_group TEXT NOT NULL DEFAULT '',
resolution_note TEXT NOT NULL DEFAULT '',
created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
updated_at TIMESTAMPTZ NOT NULL DEFAULT now(),
resolved_at TIMESTAMPTZ,
last_activity_at TIMESTAMPTZ NOT NULL DEFAULT now()
);
CREATE INDEX IF NOT EXISTS idx_support_ticket_status_priority
ON app.support_ticket(status, priority, updated_at DESC);
CREATE INDEX IF NOT EXISTS idx_support_ticket_reporter
ON app.support_ticket(reporter_id, created_at DESC);
ALTER TABLE app.admin_health_event ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS p_admin_health_event_select ON app.admin_health_event;
DROP POLICY IF EXISTS p_admin_health_event_insert ON app.admin_health_event;
CREATE POLICY p_admin_health_event_select
ON app.admin_health_event FOR SELECT
USING (app.current_role_name() = 'admin');
CREATE POLICY p_admin_health_event_insert
ON app.admin_health_event FOR INSERT
WITH CHECK (app.current_role_name() = 'admin');
ALTER TABLE app.support_ticket ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS p_support_ticket_select ON app.support_ticket;
DROP POLICY IF EXISTS p_support_ticket_insert ON app.support_ticket;
DROP POLICY IF EXISTS p_support_ticket_update ON app.support_ticket;
DROP POLICY IF EXISTS p_support_ticket_delete ON app.support_ticket;
CREATE POLICY p_support_ticket_select
ON app.support_ticket FOR SELECT
USING (
app.current_role_name() = 'admin'
OR reporter_id = app.current_uid()
);
CREATE POLICY p_support_ticket_insert
ON app.support_ticket FOR INSERT
WITH CHECK (
app.current_role_name() = 'admin'
OR reporter_id = app.current_uid()
);
CREATE POLICY p_support_ticket_update
ON app.support_ticket FOR UPDATE
USING (app.current_role_name() = 'admin')
WITH CHECK (app.current_role_name() = 'admin');
CREATE POLICY p_support_ticket_delete
ON app.support_ticket FOR DELETE
USING (app.current_role_name() = 'admin');
ALTER TABLE app.sessions
ADD COLUMN IF NOT EXISTS runtime_case_id UUID,
ADD COLUMN IF NOT EXISTS persona_code TEXT,

View file

@ -128,3 +128,162 @@ CREATE POLICY p_case_worksheet_delete
AND s.learner_id = app.current_uid()
)
);
-- Live coaching interventions delivered during a session.
CREATE TABLE IF NOT EXISTS app.live_coach_events (
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
session_id UUID NOT NULL REFERENCES app.sessions(id) ON DELETE CASCADE,
turn_seq INT NOT NULL CHECK (turn_seq >= 1),
stage TEXT NOT NULL,
learner_text_excerpt TEXT,
client_reply_excerpt TEXT,
payload JSONB NOT NULL DEFAULT '{}'::jsonb,
created_at TIMESTAMPTZ NOT NULL DEFAULT now()
);
CREATE INDEX IF NOT EXISTS idx_live_coach_events_session_turn
ON app.live_coach_events(session_id, turn_seq, created_at);
ALTER TABLE app.live_coach_events ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS p_live_coach_events_select ON app.live_coach_events;
DROP POLICY IF EXISTS p_live_coach_events_insert ON app.live_coach_events;
CREATE POLICY p_live_coach_events_select
ON app.live_coach_events FOR SELECT USING (
app.current_role_name() IN ('admin','instructor')
OR EXISTS (
SELECT 1 FROM app.sessions s
WHERE s.id = app.live_coach_events.session_id
AND s.learner_id = app.current_uid()
)
);
CREATE POLICY p_live_coach_events_insert
ON app.live_coach_events FOR INSERT WITH CHECK (
EXISTS (
SELECT 1 FROM app.sessions s
WHERE s.id = app.live_coach_events.session_id
AND s.learner_id = app.current_uid()
)
);
-- Public share cards for learner-owned session reviews. Payload is intentionally
-- a sanitized preview, not the transcript or worksheet raw source.
CREATE TABLE IF NOT EXISTS app.session_share_link (
session_id UUID PRIMARY KEY REFERENCES app.sessions(id) ON DELETE CASCADE,
created_by UUID NOT NULL REFERENCES app.app_user(user_id),
token_hash TEXT NOT NULL UNIQUE,
payload JSONB NOT NULL,
created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
updated_at TIMESTAMPTZ NOT NULL DEFAULT now(),
revoked_at TIMESTAMPTZ
);
CREATE INDEX IF NOT EXISTS idx_session_share_token_active
ON app.session_share_link(token_hash)
WHERE revoked_at IS NULL;
ALTER TABLE app.session_share_link ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS p_session_share_select ON app.session_share_link;
DROP POLICY IF EXISTS p_session_share_insert ON app.session_share_link;
DROP POLICY IF EXISTS p_session_share_update ON app.session_share_link;
DROP POLICY IF EXISTS p_session_share_delete ON app.session_share_link;
CREATE POLICY p_session_share_select
ON app.session_share_link FOR SELECT USING (
app.is_ai_context()
OR app.current_role_name() IN ('admin','instructor')
OR EXISTS (
SELECT 1 FROM app.sessions s
WHERE s.id = app.session_share_link.session_id
AND s.learner_id = app.current_uid()
)
);
CREATE POLICY p_session_share_insert
ON app.session_share_link FOR INSERT WITH CHECK (
app.is_ai_context()
OR (
created_by = app.current_uid()
AND EXISTS (
SELECT 1 FROM app.sessions s
WHERE s.id = app.session_share_link.session_id
AND s.learner_id = app.current_uid()
)
)
);
CREATE POLICY p_session_share_update
ON app.session_share_link FOR UPDATE USING (
app.is_ai_context()
OR EXISTS (
SELECT 1 FROM app.sessions s
WHERE s.id = app.session_share_link.session_id
AND s.learner_id = app.current_uid()
)
) WITH CHECK (
app.is_ai_context()
OR (
created_by = app.current_uid()
AND EXISTS (
SELECT 1 FROM app.sessions s
WHERE s.id = app.session_share_link.session_id
AND s.learner_id = app.current_uid()
)
)
);
CREATE POLICY p_session_share_delete
ON app.session_share_link FOR DELETE USING (
app.is_ai_context()
OR EXISTS (
SELECT 1 FROM app.sessions s
WHERE s.id = app.session_share_link.session_id
AND s.learner_id = app.current_uid()
)
);
-- Learner-owned history archive state. This is display state only; session,
-- turn, review, share, research, and audit evidence remain intact.
CREATE TABLE IF NOT EXISTS app.session_archive_state (
session_id UUID PRIMARY KEY REFERENCES app.sessions(id) ON DELETE CASCADE,
learner_id UUID NOT NULL REFERENCES app.app_user(user_id),
archived_at TIMESTAMPTZ NOT NULL DEFAULT now(),
updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
);
CREATE INDEX IF NOT EXISTS idx_session_archive_learner
ON app.session_archive_state(learner_id, archived_at DESC);
ALTER TABLE app.session_archive_state ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS p_session_archive_select ON app.session_archive_state;
DROP POLICY IF EXISTS p_session_archive_insert ON app.session_archive_state;
DROP POLICY IF EXISTS p_session_archive_update ON app.session_archive_state;
DROP POLICY IF EXISTS p_session_archive_delete ON app.session_archive_state;
CREATE POLICY p_session_archive_select
ON app.session_archive_state FOR SELECT USING (
app.current_role_name() IN ('admin','instructor')
OR learner_id = app.current_uid()
);
CREATE POLICY p_session_archive_insert
ON app.session_archive_state FOR INSERT WITH CHECK (
learner_id = app.current_uid()
AND EXISTS (
SELECT 1 FROM app.sessions s
WHERE s.id = app.session_archive_state.session_id
AND s.learner_id = app.current_uid()
)
);
CREATE POLICY p_session_archive_update
ON app.session_archive_state FOR UPDATE USING (
learner_id = app.current_uid()
) WITH CHECK (
learner_id = app.current_uid()
AND EXISTS (
SELECT 1 FROM app.sessions s
WHERE s.id = app.session_archive_state.session_id
AND s.learner_id = app.current_uid()
)
);
CREATE POLICY p_session_archive_delete
ON app.session_archive_state FOR DELETE USING (
learner_id = app.current_uid()
);

View file

@ -22,8 +22,10 @@ services:
api:
build:
context: ../apps/api
dockerfile: Dockerfile
context: ..
dockerfile: apps/api/Dockerfile
args:
INSTALL_RAG: ${INSTALL_RAG:-false}
restart: unless-stopped
depends_on:
db: { condition: service_healthy }
@ -35,7 +37,6 @@ services:
ANTHROPIC_API_KEY: ${ANTHROPIC_API_KEY:-}
OPENAI_API_KEY: ${OPENAI_API_KEY:?set in .env}
OPENAI_BASE_URL: ${OPENAI_BASE_URL:-https://api.openai.com/v1}
RAG_EMBED_URL: http://rag:8080
SESSION_SECRET: ${SESSION_SECRET:?set in .env}
OAUTH_GOOGLE_CLIENT_ID: ${OAUTH_GOOGLE_CLIENT_ID:?set in .env}
OAUTH_GOOGLE_CLIENT_SECRET: ${OAUTH_GOOGLE_CLIENT_SECRET:?set in .env}
@ -52,8 +53,11 @@ services:
FRONTEND_BASE_URL: ${FRONTEND_BASE_URL:-https://vignette.chanpaca.net}
FRONTEND_ORIGIN_MAP: '${FRONTEND_ORIGIN_MAP:-{"api-vignette.chanpaca.net":"https://vignette.chanpaca.net","api-vnet.18ka.net":"https://vnet.18ka.net"}}'
CORS_ORIGINS: '${CORS_ORIGINS:-["https://vignette.chanpaca.net","https://vnet.18ka.net","https://vignette-b1q.pages.dev"]}'
USER_UPLOAD_DIR: ${USER_UPLOAD_DIR:-/app/uploads}
extra_hosts:
- "host.docker.internal:host-gateway"
volumes:
- apiuploads:/app/uploads
healthcheck:
test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8000/health')"]
interval: 15s
@ -71,18 +75,6 @@ services:
depends_on: [api]
networks: [vignette]
rag:
build:
context: ../apps/api
dockerfile: Dockerfile.rag
restart: unless-stopped
environment:
EMBED_MODEL: BAAI/bge-m3
RERANK_MODEL: BAAI/bge-reranker-v2-m3
volumes:
- ragmodels:/models
networks: [vignette]
proxy:
image: caddy:2-alpine
restart: unless-stopped
@ -97,7 +89,7 @@ services:
volumes:
pgdata:
ragmodels:
apiuploads:
caddydata:
networks: