319 lines
12 KiB
YAML
319 lines
12 KiB
YAML
name: vignette-prod
|
|
|
|
# NAS 운영 전용 완결 스택이다. infra/docker-compose.yml의 로컬 개발 스택과 합치지 않는다.
|
|
# 외부 볼륨은 백업/격리 복구/휴먼 게이트를 통과한 뒤 운영자가 미리 생성해야 한다.
|
|
|
|
x-api-image: &api-image
|
|
image: ${VIGNETTE_NAS_API_IMAGE:?Immutable NAS API image reference is required}
|
|
|
|
x-web-image: &web-image
|
|
image: ${VIGNETTE_NAS_WEB_IMAGE:?Immutable NAS web image reference is required}
|
|
|
|
x-production-labels: &production-labels
|
|
com.vignette.owner: vignette
|
|
com.vignette.runtime-class: production
|
|
com.vignette.ssot-host: nas
|
|
com.vignette.stack: vignette-prod
|
|
|
|
services:
|
|
db:
|
|
image: ${VIGNETTE_NAS_POSTGRES_IMAGE:?Immutable NAS PostgreSQL image ID is required}
|
|
restart: unless-stopped
|
|
stop_grace_period: 1m
|
|
environment:
|
|
POSTGRES_USER: ${POSTGRES_USER:-vignette_owner}
|
|
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?NAS PostgreSQL owner password is required}
|
|
POSTGRES_DB: ${POSTGRES_DB:-vignette}
|
|
APP_DB_USER: ${APP_DB_USER:-vignette_app}
|
|
APP_DB_PASSWORD: ${APP_DB_PASSWORD:?NAS application DB password is required}
|
|
volumes:
|
|
- type: volume
|
|
source: pgdata
|
|
target: /var/lib/postgresql/data
|
|
- type: bind
|
|
source: ./db/init
|
|
target: /docker-entrypoint-initdb.d
|
|
read_only: true
|
|
healthcheck:
|
|
test:
|
|
- CMD-SHELL
|
|
- >-
|
|
PGPASSWORD=$${APP_DB_PASSWORD} psql -U $${APP_DB_USER} -d $${POSTGRES_DB}
|
|
-tAc "SELECT to_regclass('app.ci_regression_dag_node') IS NOT NULL"
|
|
| grep -qx t
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 12
|
|
start_period: 5m
|
|
labels:
|
|
<<: *production-labels
|
|
com.vignette.data-role: database-ssot
|
|
networks: [backend]
|
|
|
|
engine:
|
|
<<: *api-image
|
|
command:
|
|
- python
|
|
- -m
|
|
- uvicorn
|
|
- engine_gateway.gateway:app
|
|
- --host
|
|
- 0.0.0.0
|
|
- --port
|
|
- "9099"
|
|
restart: unless-stopped
|
|
stop_grace_period: 30s
|
|
environment:
|
|
OPENAI_API_KEY: ${OPENAI_API_KEY:?OpenAI key is required for the NAS engine}
|
|
OPENAI_BASE_URL: ${OPENAI_BASE_URL:-https://api.openai.com/v1}
|
|
OPENAI_ENGINE_MODEL: ${OPENAI_ENGINE_MODEL:?An approved OpenAI engine model is required}
|
|
OPENAI_ENGINE_MODELS: ${OPENAI_ENGINE_MODELS:-gpt-5.6-terra,gpt-5.6-luna,gpt-4.1}
|
|
ENGINE_GATEWAY_SHARED_SECRET: ${ENGINE_GATEWAY_SHARED_SECRET:?Gateway shared secret is required}
|
|
ENGINE_CAPABILITY_CACHE_TTL_SECONDS: ${ENGINE_CAPABILITY_CACHE_TTL_SECONDS:-1800}
|
|
ENGINE_READY_TTL_SECONDS: ${ENGINE_READY_TTL_SECONDS:-1800}
|
|
ENGINE_READY_FAILURE_TTL_SECONDS: ${ENGINE_READY_FAILURE_TTL_SECONDS:-30}
|
|
ENGINE_READY_TIMEOUT_SECONDS: ${ENGINE_READY_TIMEOUT_SECONDS:-45}
|
|
ENGINE_GENERATE_TIMEOUT_SECONDS: ${ENGINE_GENERATE_TIMEOUT_SECONDS:-300}
|
|
expose:
|
|
- "9099"
|
|
read_only: true
|
|
tmpfs:
|
|
- /tmp:rw,noexec,nosuid,size=128m
|
|
cap_drop: [ALL]
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
healthcheck:
|
|
test:
|
|
- CMD
|
|
- python
|
|
- -c
|
|
- >-
|
|
import json, urllib.request;
|
|
payload=json.load(urllib.request.urlopen('http://localhost:9099/health'));
|
|
assert payload.get('ok') is True
|
|
interval: 15s
|
|
timeout: 5s
|
|
retries: 8
|
|
start_period: 30s
|
|
labels:
|
|
<<: *production-labels
|
|
com.vignette.data-role: engine-ssot
|
|
networks: [backend, app-egress]
|
|
|
|
api:
|
|
<<: *api-image
|
|
restart: unless-stopped
|
|
stop_grace_period: 1m
|
|
# NAS 호스트 터널만 접근할 수 있도록 loopback에만 고정 바인딩한다.
|
|
ports:
|
|
- "127.0.0.1:18080:8000"
|
|
depends_on:
|
|
db: { condition: service_healthy }
|
|
engine: { condition: service_healthy }
|
|
environment:
|
|
ENVIRONMENT: prod
|
|
DATABASE_URL: postgresql://${APP_DB_USER:-vignette_app}:${APP_DB_PASSWORD:?NAS application DB password is required}@db:5432/${POSTGRES_DB:-vignette}
|
|
ENGINE_URL: http://engine:9099
|
|
ENGINE_MODE: openai
|
|
VIGNETTE_LIVE_CLIENT_PROVIDER: openai
|
|
ENGINE_GATEWAY_SHARED_SECRET: ${ENGINE_GATEWAY_SHARED_SECRET:?Gateway shared secret is required}
|
|
OPENAI_API_KEY: ${OPENAI_API_KEY:?OpenAI key is required for production voice and engine paths}
|
|
OPENAI_BASE_URL: ${OPENAI_BASE_URL:-https://api.openai.com/v1}
|
|
VIGNETTE_VOICE_STT_PROVIDER: openai
|
|
VIGNETTE_VOICE_TTS_PROVIDER: openai
|
|
SESSION_SECRET: ${SESSION_SECRET:?Production session secret is required}
|
|
VIGNETTE_RUPTURE_INTERNAL_TOKEN: ${VIGNETTE_RUPTURE_INTERNAL_TOKEN:?G3 token is required}
|
|
VIGNETTE_PRACTICE_INTERNAL_TOKEN: ${VIGNETTE_PRACTICE_INTERNAL_TOKEN:?G4 token is required}
|
|
VIGNETTE_CALIBRATION_TRANSFER_INTERNAL_TOKEN: ${VIGNETTE_CALIBRATION_TRANSFER_INTERNAL_TOKEN:?G5 token is required}
|
|
VIGNETTE_SUPERVISION_RESEARCH_INTERNAL_TOKEN: ${VIGNETTE_SUPERVISION_RESEARCH_INTERNAL_TOKEN:?G6 token is required}
|
|
VIGNETTE_MULTIMODAL_ALLIANCE_INTERNAL_TOKEN: ${VIGNETTE_MULTIMODAL_ALLIANCE_INTERNAL_TOKEN:?G7 token is required}
|
|
VIGNETTE_CONTINUOUS_IMPROVEMENT_INTERNAL_TOKEN: ${VIGNETTE_CONTINUOUS_IMPROVEMENT_INTERNAL_TOKEN:?G8 token is required}
|
|
VIGNETTE_CONTINUOUS_IMPROVEMENT_PRODUCER_ENABLED: ${VIGNETTE_CONTINUOUS_IMPROVEMENT_PRODUCER_ENABLED:-false}
|
|
VIGNETTE_CONTINUOUS_IMPROVEMENT_PRODUCER_INTERVAL_SECONDS: ${VIGNETTE_CONTINUOUS_IMPROVEMENT_PRODUCER_INTERVAL_SECONDS:-3600}
|
|
VIGNETTE_CONTINUOUS_IMPROVEMENT_PRODUCER_STARTUP_DELAY_SECONDS: ${VIGNETTE_CONTINUOUS_IMPROVEMENT_PRODUCER_STARTUP_DELAY_SECONDS:-30}
|
|
VIGNETTE_CONTINUOUS_IMPROVEMENT_PRODUCER_RETRY_DELAY_SECONDS: ${VIGNETTE_CONTINUOUS_IMPROVEMENT_PRODUCER_RETRY_DELAY_SECONDS:-300}
|
|
VIGNETTE_CONTINUOUS_IMPROVEMENT_PRODUCER_LEASE_TIMEOUT_SECONDS: ${VIGNETTE_CONTINUOUS_IMPROVEMENT_PRODUCER_LEASE_TIMEOUT_SECONDS:-1800}
|
|
VIGNETTE_CONTINUOUS_IMPROVEMENT_PRODUCER_ENGINE_TIMEOUT_SECONDS: ${VIGNETTE_CONTINUOUS_IMPROVEMENT_PRODUCER_ENGINE_TIMEOUT_SECONDS:-300}
|
|
VIGNETTE_CONTINUOUS_IMPROVEMENT_PRODUCER_BATCH_SIZE: ${VIGNETTE_CONTINUOUS_IMPROVEMENT_PRODUCER_BATCH_SIZE:-1}
|
|
VIGNETTE_CONTINUOUS_IMPROVEMENT_DRIFT_TRIGGER_ENABLED: ${VIGNETTE_CONTINUOUS_IMPROVEMENT_DRIFT_TRIGGER_ENABLED:-false}
|
|
VIGNETTE_CONTINUOUS_IMPROVEMENT_ROLLBACK_EXECUTOR_ENABLED: "false"
|
|
OAUTH_GOOGLE_CLIENT_ID: ${OAUTH_GOOGLE_CLIENT_ID:?Google OAuth client id is required}
|
|
OAUTH_GOOGLE_CLIENT_SECRET: ${OAUTH_GOOGLE_CLIENT_SECRET:?Google OAuth client secret is required}
|
|
OAUTH_REDIRECT_URI: ${OAUTH_REDIRECT_URI:-https://api-vignette.chanpaca.net/auth/callback}
|
|
AUTH_ALLOWED_EMAIL_DOMAINS: '${AUTH_ALLOWED_EMAIL_DOMAINS:-["hs.ac.kr","twentyoz.kr"]}'
|
|
AUTH_TEACHER_EMAILS: '${AUTH_TEACHER_EMAILS:-[]}'
|
|
AUTH_ADMIN_EMAILS: '${AUTH_ADMIN_EMAILS:-[]}'
|
|
AUTH_SUPER_ADMIN_EMAILS: '${AUTH_SUPER_ADMIN_EMAILS:?Super admin allowlist is required}'
|
|
AUTH_APPROVED_EMAILS: '${AUTH_APPROVED_EMAILS:-[]}'
|
|
AUTH_NEW_USER_DEFAULT_STATUS: pending
|
|
AUTH_DEV_LOGIN_ENABLED: "false"
|
|
AUTH_DEV_LOGIN_EXTRA_ORIGINS: '[]'
|
|
DEFAULT_AFFILIATION: ${DEFAULT_AFFILIATION:-}
|
|
AUTO_SEED_PERSONAS: "false"
|
|
ALLOW_SEED_PERSONA_FALLBACK: "false"
|
|
EVALUATOR_GOLDEN_FEWSHOT_ENABLED: ${EVALUATOR_GOLDEN_FEWSHOT_ENABLED:-false}
|
|
FRONTEND_BASE_URL: https://vignette.chanpaca.net
|
|
FRONTEND_ORIGIN_MAP: '${FRONTEND_ORIGIN_MAP:?Set FRONTEND_ORIGIN_MAP in the NAS secret environment}'
|
|
CORS_ORIGINS: '${CORS_ORIGINS:-["https://vignette.chanpaca.net","https://vignette-b1q.pages.dev"]}'
|
|
USER_UPLOAD_DIR: /app/uploads
|
|
NOTIFICATION_EMAIL_PROVIDER: ${NOTIFICATION_EMAIL_PROVIDER:-disabled}
|
|
NOTIFICATION_EMAIL_MAX_ATTEMPTS: ${NOTIFICATION_EMAIL_MAX_ATTEMPTS:-3}
|
|
NOTIFICATION_EMAIL_RETRY_SECONDS: ${NOTIFICATION_EMAIL_RETRY_SECONDS:-900}
|
|
SMTP_HOST: ${SMTP_HOST:-}
|
|
SMTP_PORT: ${SMTP_PORT:-587}
|
|
SMTP_USERNAME: ${SMTP_USERNAME:-}
|
|
SMTP_PASSWORD: ${SMTP_PASSWORD:-}
|
|
SMTP_FROM_EMAIL: ${SMTP_FROM_EMAIL:-}
|
|
SMTP_FROM_NAME: ${SMTP_FROM_NAME:-Vignette}
|
|
SMTP_STARTTLS: ${SMTP_STARTTLS:-true}
|
|
SMTP_SSL: ${SMTP_SSL:-false}
|
|
VIGNETTE_RUNTIME_CLASS: production
|
|
VIGNETTE_SSOT_HOST: nas
|
|
VIGNETTE_NAS_PGDATA_VOLUME: ${VIGNETTE_NAS_PGDATA_VOLUME:?Explicit NAS PostgreSQL volume name is required}
|
|
VIGNETTE_NAS_APIUPLOADS_VOLUME: ${VIGNETTE_NAS_APIUPLOADS_VOLUME:?Explicit NAS uploads volume name is required}
|
|
volumes:
|
|
- type: volume
|
|
source: apiuploads
|
|
target: /app/uploads
|
|
volume:
|
|
nocopy: true
|
|
read_only: true
|
|
tmpfs:
|
|
- /tmp:rw,noexec,nosuid,size=128m
|
|
cap_drop: [ALL]
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
healthcheck:
|
|
test:
|
|
- CMD
|
|
- python
|
|
- -c
|
|
- >-
|
|
import json, urllib.request;
|
|
payload=json.load(urllib.request.urlopen('http://localhost:8000/health'));
|
|
assert payload.get('status') == 'ok' and payload.get('db') is True and payload.get('engine') is True
|
|
interval: 30s
|
|
timeout: 10s
|
|
retries: 8
|
|
start_period: 2m
|
|
labels:
|
|
<<: *production-labels
|
|
com.vignette.data-role: api-ssot
|
|
networks: [backend, app-egress]
|
|
|
|
web:
|
|
<<: *web-image
|
|
restart: unless-stopped
|
|
depends_on:
|
|
api: { condition: service_healthy }
|
|
read_only: true
|
|
tmpfs:
|
|
- /tmp:rw,noexec,nosuid,size=16m
|
|
# nginx needs writable temporary paths while the root filesystem remains read-only.
|
|
- /var/cache/nginx:rw,noexec,nosuid,size=16m
|
|
- /var/run:rw,noexec,nosuid,size=1m
|
|
cap_drop: [ALL]
|
|
cap_add:
|
|
- NET_BIND_SERVICE
|
|
- CHOWN
|
|
- SETUID
|
|
- SETGID
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
labels:
|
|
<<: *production-labels
|
|
com.vignette.data-role: static-web-replica
|
|
networks: [backend]
|
|
|
|
private-proxy:
|
|
image: caddy@sha256:5f5c8640aae01df9654968d946d8f1a56c497f1dd5c5cda4cf95ab7c14d58648
|
|
restart: unless-stopped
|
|
depends_on:
|
|
web: { condition: service_started }
|
|
api: { condition: service_healthy }
|
|
ports:
|
|
- "${VIGNETTE_NAS_PRIVATE_BIND_ADDRESS:?Explicit NAS Tailnet or private bind address is required}:${VIGNETTE_NAS_PRIVATE_HTTP_PORT:-18088}:80"
|
|
volumes:
|
|
- type: bind
|
|
source: ./Caddyfile.nas
|
|
target: /etc/caddy/Caddyfile
|
|
read_only: true
|
|
read_only: true
|
|
tmpfs:
|
|
- /data:rw,noexec,nosuid,size=16m
|
|
- /config:rw,noexec,nosuid,size=16m
|
|
- /tmp:rw,noexec,nosuid,size=16m
|
|
cap_drop: [ALL]
|
|
cap_add:
|
|
- NET_BIND_SERVICE
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
labels:
|
|
<<: *production-labels
|
|
com.vignette.data-role: tailnet-private-validation
|
|
networks: [backend]
|
|
|
|
cloudflared:
|
|
image: cloudflare/cloudflared@sha256:d9ff527dc19799e24d3689058161fb01e752a24be1823577bae54c9c2489275f
|
|
profiles: [public-cutover-gate]
|
|
command:
|
|
- tunnel
|
|
- --no-autoupdate
|
|
- --config
|
|
- /etc/cloudflared/config.yml
|
|
- run
|
|
restart: unless-stopped
|
|
depends_on:
|
|
api: { condition: service_healthy }
|
|
volumes:
|
|
- type: bind
|
|
source: ${VIGNETTE_TUNNEL_CONFIG_PATH:?Rendered cloudflared config path is required}
|
|
target: /etc/cloudflared/config.yml
|
|
read_only: true
|
|
- type: volume
|
|
source: cloudflaredsecrets
|
|
target: /run/secrets
|
|
read_only: true
|
|
volume:
|
|
nocopy: true
|
|
read_only: true
|
|
tmpfs:
|
|
- /tmp:rw,noexec,nosuid,size=32m
|
|
cap_drop: [ALL]
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
labels:
|
|
<<: *production-labels
|
|
com.vignette.data-role: gated-public-edge
|
|
# API는 NAS loopback에만 열리고, 터널은 호스트 네트워크로 이를 호출한다.
|
|
# Docker 재시작 뒤에도 restart 정책으로 공개 연결을 자동 복구한다.
|
|
network_mode: host
|
|
|
|
volumes:
|
|
pgdata:
|
|
external: true
|
|
name: ${VIGNETTE_NAS_PGDATA_VOLUME:?Explicit NAS PostgreSQL volume name is required}
|
|
apiuploads:
|
|
external: true
|
|
name: ${VIGNETTE_NAS_APIUPLOADS_VOLUME:?Explicit NAS uploads volume name is required}
|
|
cloudflaredsecrets:
|
|
external: true
|
|
name: ${VIGNETTE_NAS_CLOUDFLARED_SECRETS_VOLUME:?Explicit NAS cloudflared secrets volume name is required}
|
|
|
|
networks:
|
|
backend:
|
|
name: vignette-prod-backend
|
|
driver: bridge
|
|
internal: true
|
|
labels:
|
|
<<: *production-labels
|
|
app-egress:
|
|
name: vignette-prod-app-egress
|
|
driver: bridge
|
|
labels:
|
|
<<: *production-labels
|
|
tunnel-egress:
|
|
name: vignette-prod-tunnel-egress
|
|
driver: bridge
|
|
labels:
|
|
<<: *production-labels
|