vee
127 lines
5.4 KiB
Markdown
Executable File
127 lines
5.4 KiB
Markdown
Executable File
# Fixed public deployment
|
||
|
||
The public demo is hosted directly on the server at
|
||
`https://511.kendeji.fun`. Caddy terminates HTTPS and proxies only to the
|
||
container port bound on `127.0.0.1:8511`; the application port is not exposed
|
||
to the public network.
|
||
|
||
The server layout is:
|
||
|
||
```text
|
||
/opt/511-project/
|
||
├── .env # OpenAI connection settings, mode 0600
|
||
├── .env.auth # Web authentication settings, mode 0600
|
||
├── deploy/server/
|
||
├── artifacts/runs/ # Persistent request artifacts
|
||
├── artifacts/user-presets/
|
||
├── artifacts/server/ # GSCU infrared catalog and server-side state
|
||
├── artifacts/tmp/ # Runtime gateway and calibration state
|
||
└── artifacts/self-repair/
|
||
```
|
||
|
||
Vehicle-specific user-created function modes are persisted from
|
||
`config/modes/vehicles/denza_n7/user/` into the otherwise read-only container.
|
||
|
||
Build and start the service:
|
||
|
||
```bash
|
||
cd /opt/511-project
|
||
mkdir -p \
|
||
artifacts/runs \
|
||
artifacts/user-presets \
|
||
artifacts/server \
|
||
artifacts/tmp \
|
||
artifacts/self-repair \
|
||
config/modes/vehicles/denza_n7/user
|
||
chown -R 10001:10001 \
|
||
artifacts/runs \
|
||
artifacts/user-presets \
|
||
artifacts/server \
|
||
artifacts/tmp \
|
||
artifacts/self-repair \
|
||
config/modes/vehicles/denza_n7/user
|
||
chmod 0700 \
|
||
artifacts/runs \
|
||
artifacts/user-presets \
|
||
artifacts/server \
|
||
artifacts/tmp \
|
||
artifacts/self-repair \
|
||
config/modes/vehicles/denza_n7/user
|
||
docker compose -f deploy/server/compose.yaml up -d --build
|
||
docker compose -f deploy/server/compose.yaml ps
|
||
```
|
||
|
||
镜像固定安装 `@openai/codex@0.150.0-alpha.8`。AI 助手使用命名卷
|
||
`codex_home` 保存 Codex 运行状态；生产环境优先通过只读环境注入
|
||
`OPENAI_API_KEY`。若使用 ChatGPT 账号认证，可在首次启动后进入容器完成
|
||
Codex 登录，再重启服务。不要把 `auth.json` 复制进镜像或提交到仓库。
|
||
|
||
```bash
|
||
docker compose -f deploy/server/compose.yaml exec web codex login status
|
||
curl -fsS http://127.0.0.1:8511/api/health
|
||
```
|
||
|
||
App Server 线程采用 `read-only` sandbox 和线程级 `approvalPolicy=never`，并关闭
|
||
内置 shell、统一执行器、浏览器和应用工具；因此命令执行或文件修改不能通过交互式
|
||
审批获得额外权限。Codex 子进程只继承启动及模型认证所需的环境变量。容器使用无特权
|
||
UID `10001` 和只读根文件系统。
|
||
|
||
唯一启用的 `n7_vehicle` MCP 服务将工具级
|
||
`default_tools_approval_mode=approve` 固定为 `approve`。这与
|
||
`approvalPolicy=never` 不矛盾：前者仅避免 App Server 对已经进入 N7Web 安全边界的
|
||
MCP 调用再发起一次当前嵌入式网页无法响应的审批，后者仍让 App Server 自身的命令和
|
||
文件权限失败关闭。MCP 只开放运行时能力目录查询和回环地址上的座舱执行桥，其中只有
|
||
执行桥有副作用。工具令牌绑定原始用户请求，结构化候选计划还会经过原文证据、能力
|
||
注册表、参数 Schema、执行模式、车辆硬件审批与安全策略校验；模型不能提交替代指令
|
||
或原始 CAN，`approve` 也不会绕过这些应用层门禁。审批字段语义见
|
||
[Codex App Server 官方文档](https://learn.chatgpt.com/docs/app-server) 与
|
||
[Codex 配置参考](https://learn.chatgpt.com/zh-Hans/docs/config-file/config-reference)。
|
||
|
||
Add `deploy/server/Caddyfile.example` to the host Caddyfile, validate, and
|
||
reload Caddy:
|
||
|
||
```bash
|
||
caddy validate --config /etc/caddy/Caddyfile
|
||
systemctl restart caddy
|
||
```
|
||
|
||
This host disables Caddy's admin endpoint, so `caddy reload` and
|
||
`systemctl reload caddy` cannot apply configuration. Validate first, then use a
|
||
service restart.
|
||
|
||
Operational checks:
|
||
|
||
```bash
|
||
curl -I https://511.kendeji.fun/
|
||
docker compose -f /opt/511-project/deploy/server/compose.yaml logs --tail=100
|
||
systemctl status caddy
|
||
```
|
||
|
||
Never place `.env`, `.env.auth`, API keys, login passwords, or SSH credentials
|
||
inside the image or source control. Updating the application uses the same
|
||
source synchronization followed by `docker compose ... up -d --build`.
|
||
|
||
## Public physical-bench gateway
|
||
|
||
When the physical T2G bench is attached to a separate trusted workstation,
|
||
Caddy may prefer a restricted reverse-SSH upstream on `127.0.0.1:18512` and
|
||
retain the container on `127.0.0.1:8511` as the unavailable-bench fallback.
|
||
The workstation service must use the same `.env.auth` as the public container;
|
||
the SSH key must be restricted to that single reverse-listen port and must not
|
||
be allowed to run remote commands.
|
||
|
||
Public physical execution uses a local-approval lease. A browser first submits
|
||
an access request, and the bench operator chooses one terminal at
|
||
`http://127.0.0.1:8000/hardware-control`. The decision API is restricted to
|
||
unproxied loopback traffic, so it cannot be used through the public domain or
|
||
the SSH tunnel. The approved terminal may run multiple tests; its lease is
|
||
revoked after 180 seconds without a physical test, on voluntary release, or by
|
||
the local operator. A process restart clears all leases and pending requests.
|
||
|
||
Inside the approved lease, the physical bench remains a process-wide
|
||
single-flight resource. A hardware action owns the bench from intent planning
|
||
through final physical feedback. Concurrent actions and passive physical-state
|
||
reads receive HTTP `409` (`hardware_busy`) with `Retry-After`; they never enter
|
||
the CAN path or wait to run later against stale position state. Dry-run and
|
||
simulated-hardware requests are not serialized by this action-level gate.
|