init

2026-07-30 08:45:38 +08:00
commit 25b24ac4cd
1333 changed files with 170092 additions and 0 deletions
@@ -0,0 +1,5 @@
+# Deployment
+
+`server/` 保存当前固定公网演示的 Docker Compose 与 Caddy 配置，`docker/`
+记录容器约束，`k8s/` 保存后续生产编排资源。部署必须把 API、任务执行器和
+Web 分离权限；只有执行器进程可访问硬件 CAN 设备。
@@ -0,0 +1,7 @@
+# Docker
+
+当前单域演示的生产镜像和 Compose 编排位于
+[`../server/`](../server/README.md)。镜像中不内置 API Key、认证材料、审批
+token 或未授权 DBC；运行时通过服务器上的私密环境文件注入。
+
+后续拆分 API、worker 和 Web 时，只有硬件执行器容器可以挂载 CAN 设备。
@@ -0,0 +1,4 @@
+# Kubernetes
+
+后续放置 Deployment、Service、Secret 引用、NetworkPolicy 和硬件 worker 调度约束。普通 API/Web Pod 不挂载 CAN 设备。
+
@@ -0,0 +1,3 @@
+511.kendeji.fun:443 {
+	reverse_proxy 127.0.0.1:8511
+}
@@ -0,0 +1,22 @@
+FROM python:3.12-slim-bookworm
+
+ENV PYTHONDONTWRITEBYTECODE=1 \
+    PYTHONUNBUFFERED=1 \
+    PIP_DISABLE_PIP_VERSION_CHECK=1 \
+    PYTHONPATH=/app/src:/app/domains/seat/src
+
+WORKDIR /app
+
+COPY pyproject.toml ./
+COPY src ./src
+COPY apps ./apps
+COPY config ./config
+COPY contracts ./contracts
+COPY domains ./domains
+COPY platforms ./platforms
+
+RUN python -m pip install --no-cache-dir ".[llm]"
+
+EXPOSE 8000
+
+CMD ["python", "-m", "cognitive_agent.server", "--host", "0.0.0.0", "--port", "8000"]
@@ -0,0 +1,51 @@
+# Fixed public deployment
+
+The public demo is hosted directly on the server at
+`https://511.kendeji.fun`. Caddy terminates HTTPS and proxies only to the
+container port bound on `127.0.0.1:8511`; the application port is not exposed
+to the public network.
+
+The server layout is:
+
+```text
+/opt/511-project/
+├── .env                 # OpenAI connection settings, mode 0600
+├── .env.auth            # Web authentication settings, mode 0600
+├── deploy/server/
+├── artifacts/runs/      # Persistent request artifacts
+└── artifacts/user-presets/
+```
+
+Build and start the service:
+
+```bash
+cd /opt/511-project
+chown -R root:root artifacts/runs artifacts/user-presets
+chmod 0700 artifacts/runs artifacts/user-presets
+docker compose -f deploy/server/compose.yaml up -d --build
+docker compose -f deploy/server/compose.yaml ps
+```
+
+Add `deploy/server/Caddyfile.example` to the host Caddyfile, validate, and
+reload Caddy:
+
+```bash
+caddy validate --config /etc/caddy/Caddyfile
+systemctl restart caddy
+```
+
+This host disables Caddy's admin endpoint, so `caddy reload` and
+`systemctl reload caddy` cannot apply configuration. Validate first, then use a
+service restart.
+
+Operational checks:
+
+```bash
+curl -I https://511.kendeji.fun/
+docker compose -f /opt/511-project/deploy/server/compose.yaml logs --tail=100
+systemctl status caddy
+```
+
+Never place `.env`, `.env.auth`, API keys, login passwords, or SSH credentials
+inside the image or source control. Updating the application uses the same
+source synchronization followed by `docker compose ... up -d --build`.
@@ -0,0 +1,50 @@
+name: cognitive-agent-511
+
+services:
+  web:
+    build:
+      context: ../..
+      dockerfile: deploy/server/Dockerfile
+    image: cognitive-agent-511:latest
+    container_name: cognitive-agent-511
+    restart: unless-stopped
+    init: true
+    env_file:
+      - path: ../../.env
+        format: raw
+      - path: ../../.env.auth
+        format: raw
+    environment:
+      HOST: 0.0.0.0
+      PORT: "8000"
+      PYTHONDONTWRITEBYTECODE: "1"
+      PYTHONUNBUFFERED: "1"
+      PYTHONPATH: /app/src:/app/domains/seat/src
+    ports:
+      - "127.0.0.1:8511:8000"
+    volumes:
+      - ../../artifacts/runs:/app/artifacts/runs
+      - ../../artifacts/user-presets:/app/artifacts/user-presets
+    read_only: true
+    tmpfs:
+      - /tmp:size=64m,mode=1777
+    cap_drop:
+      - ALL
+    security_opt:
+      - no-new-privileges:true
+    pids_limit: 256
+    healthcheck:
+      test:
+        - CMD
+        - python
+        - -c
+        - import urllib.request; urllib.request.urlopen("http://127.0.0.1:8000/login", timeout=3)
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 20s
+    logging:
+      driver: json-file
+      options:
+        max-size: 10m
+        max-file: "3"