Трейсинг OTLP — опт-ин; storage-service в prod
- endpoint коллектора по умолчанию пуст: трейсы включаются только при заданном DEAL_OTEL_ENDPOINT; - storage-service добавлен в prod-compose (mTLS, OTel env, healthcheck); - node-exporter: убран rslave (несовместим с Docker Desktop).
This commit is contained in:
@@ -109,7 +109,7 @@ services:
|
||||
Storage__Minio__Bucket: deal-files
|
||||
Storage__Minio__Secure: "false"
|
||||
# Трейсинг OTel → коллектор профиля observability (без коллектора трейсы не экспортируются).
|
||||
OTEL_EXPORTER_OTLP_ENDPOINT: ${DEAL_OTEL_ENDPOINT:-http://otel-collector:4317}
|
||||
OTEL_EXPORTER_OTLP_ENDPOINT: ${DEAL_OTEL_ENDPOINT:-}
|
||||
OTEL_SERVICE_NAME: core
|
||||
ports:
|
||||
- "5080:5080"
|
||||
@@ -149,7 +149,7 @@ services:
|
||||
DEAL_TELEGRAM_SESSION_KEY: ${DEAL_TELEGRAM_SESSION_KEY:-ZmVkY2JhOTg3NjU0MzIxMGZlZGNiYTk4NzY1NDMyMTA=}
|
||||
DEAL_TELEGRAM_SESSION_DIR: /data/sessions
|
||||
DEAL_LOGS_DIR: /tmp/logs
|
||||
OTEL_EXPORTER_OTLP_ENDPOINT: ${DEAL_OTEL_ENDPOINT:-http://otel-collector:4317}
|
||||
OTEL_EXPORTER_OTLP_ENDPOINT: ${DEAL_OTEL_ENDPOINT:-}
|
||||
OTEL_SERVICE_NAME: telegram-service
|
||||
SERVICES__CORE__INGRESS: ${DEAL_CORE_INGRESS:-http://core:5082}
|
||||
ports:
|
||||
@@ -181,7 +181,7 @@ services:
|
||||
GRPC_PORT: "5102"
|
||||
DEAL_SERVICE_TOKEN: ${DEAL_SERVICE_TOKEN:-deal_dev_service_token}
|
||||
DEAL_LOGS_DIR: /tmp/logs
|
||||
OTEL_EXPORTER_OTLP_ENDPOINT: ${DEAL_OTEL_ENDPOINT:-http://otel-collector:4317}
|
||||
OTEL_EXPORTER_OTLP_ENDPOINT: ${DEAL_OTEL_ENDPOINT:-}
|
||||
OTEL_SERVICE_NAME: ai-service
|
||||
ports:
|
||||
- "5102:5102"
|
||||
@@ -210,7 +210,7 @@ services:
|
||||
DEAL_SERVICE_TOKEN: ${DEAL_SERVICE_TOKEN:-deal_dev_service_token}
|
||||
DEAL_ML_DATA_DIR: /data/ml # файлы моделей data/ml/<tenantId>.sqlite на volume deal_ml_data (Ruling 4/12)
|
||||
DEAL_LOGS_DIR: /tmp/logs
|
||||
OTEL_EXPORTER_OTLP_ENDPOINT: ${DEAL_OTEL_ENDPOINT:-http://otel-collector:4317}
|
||||
OTEL_EXPORTER_OTLP_ENDPOINT: ${DEAL_OTEL_ENDPOINT:-}
|
||||
OTEL_SERVICE_NAME: ml-service
|
||||
ports:
|
||||
- "5103:5103"
|
||||
@@ -242,7 +242,7 @@ services:
|
||||
DEAL_STORAGE_BUCKET: deal-attachments
|
||||
DEAL_STORAGE_SECURE: "false"
|
||||
DEAL_LOGS_DIR: /tmp/logs
|
||||
OTEL_EXPORTER_OTLP_ENDPOINT: ${DEAL_OTEL_ENDPOINT:-http://otel-collector:4317}
|
||||
OTEL_EXPORTER_OTLP_ENDPOINT: ${DEAL_OTEL_ENDPOINT:-}
|
||||
OTEL_SERVICE_NAME: storage-service
|
||||
ports:
|
||||
- "5104:5104"
|
||||
@@ -329,7 +329,7 @@ services:
|
||||
volumes:
|
||||
- /proc:/host/proc:ro
|
||||
- /sys:/host/sys:ro
|
||||
- /:/host/root:ro,rslave
|
||||
- /:/host/root:ro
|
||||
pid: host
|
||||
|
||||
volumes:
|
||||
|
||||
+45
-6
@@ -6,7 +6,7 @@
|
||||
# Состав (всё в одной внутренней сети compose, наружу — ТОЛЬКО caddy :80/:443):
|
||||
# postgres, minio — хранилища БЕЗ host-портов (volume'ы);
|
||||
# core (:5080 HTTP + :5082 gRPC-ингресс), telegram-service (:5101), ai-service (:5102),
|
||||
# ml-service (:5103) — процессы «Дейла»; mTLS-транспорт — по env Ruling 6 (см. ниже);
|
||||
# ml-service (:5103), storage-service (:5104) — процессы «Дейла»; mTLS-транспорт — по env Ruling 6 (см. ниже);
|
||||
# caddy — edge: TLS-терминация, статика фронта, reverse_proxy /api → core.
|
||||
# observability (ПРОФИЛЬ `observability`) — современный стек: otel-collector (приём трейсов OTLP),
|
||||
# tempo (хранилище трейсов), loki/promtail (логи), prometheus (метрики),
|
||||
@@ -125,6 +125,7 @@ services:
|
||||
Services__Ai__Endpoint: ${DEAL_AI_ENDPOINT:-http://ai-service:5102}
|
||||
Services__Telegram__UseLocal: "false"
|
||||
Services__Telegram__Endpoint: ${DEAL_TELEGRAM_ENDPOINT:-http://telegram-service:5101}
|
||||
Services__Storage__Endpoint: ${DEAL_STORAGE_SERVICE_ENDPOINT:-http://storage-service:5104}
|
||||
# Файлы — MinIO (внутренний http; TLS minio — вне этапа, при желании Storage__Minio__Secure=true
|
||||
# + endpoint https и сертификаты).
|
||||
Storage__Minio__Endpoint: minio:9000
|
||||
@@ -133,7 +134,7 @@ services:
|
||||
Storage__Minio__Bucket: deal-files
|
||||
Storage__Minio__Secure: "false"
|
||||
# Трейсинг OTel → коллектор профиля observability; без коллектора трейсы не экспортируются.
|
||||
OTEL_EXPORTER_OTLP_ENDPOINT: ${DEAL_OTEL_ENDPOINT:-http://otel-collector:4317}
|
||||
OTEL_EXPORTER_OTLP_ENDPOINT: ${DEAL_OTEL_ENDPOINT:-}
|
||||
OTEL_SERVICE_NAME: core
|
||||
# mTLS внутреннего gRPC (Ruling 6; пути — /etc/deal/certs, см. volume ниже).
|
||||
DEAL_MTLS_ENABLED: ${DEAL_MTLS_ENABLED:-0}
|
||||
@@ -175,7 +176,7 @@ services:
|
||||
DEAL_TELEGRAM_SESSION_KEY: ${DEAL_TELEGRAM_SESSION_KEY:?DEAL_TELEGRAM_SESSION_KEY не задан (ключ AES-GCM сессий)}
|
||||
DEAL_TELEGRAM_SESSION_DIR: /data/sessions
|
||||
DEAL_LOGS_DIR: /tmp/logs
|
||||
OTEL_EXPORTER_OTLP_ENDPOINT: ${DEAL_OTEL_ENDPOINT:-http://otel-collector:4317}
|
||||
OTEL_EXPORTER_OTLP_ENDPOINT: ${DEAL_OTEL_ENDPOINT:-}
|
||||
OTEL_SERVICE_NAME: telegram-service
|
||||
SERVICES__CORE__INGRESS: ${DEAL_CORE_INGRESS:-http://core:5082}
|
||||
DEAL_MTLS_ENABLED: ${DEAL_MTLS_ENABLED:-0}
|
||||
@@ -206,7 +207,7 @@ services:
|
||||
GRPC_PORT: "5102"
|
||||
DEAL_SERVICE_TOKEN: ${DEAL_SERVICE_TOKEN:?DEAL_SERVICE_TOKEN не задан}
|
||||
DEAL_LOGS_DIR: /tmp/logs
|
||||
OTEL_EXPORTER_OTLP_ENDPOINT: ${DEAL_OTEL_ENDPOINT:-http://otel-collector:4317}
|
||||
OTEL_EXPORTER_OTLP_ENDPOINT: ${DEAL_OTEL_ENDPOINT:-}
|
||||
OTEL_SERVICE_NAME: ai-service
|
||||
DEAL_MTLS_ENABLED: ${DEAL_MTLS_ENABLED:-0}
|
||||
DEAL_MTLS_CA_PEM: /etc/deal/certs/ca.pem
|
||||
@@ -236,7 +237,7 @@ services:
|
||||
DEAL_SERVICE_TOKEN: ${DEAL_SERVICE_TOKEN:?DEAL_SERVICE_TOKEN не задан}
|
||||
DEAL_ML_DATA_DIR: /data/ml
|
||||
DEAL_LOGS_DIR: /tmp/logs
|
||||
OTEL_EXPORTER_OTLP_ENDPOINT: ${DEAL_OTEL_ENDPOINT:-http://otel-collector:4317}
|
||||
OTEL_EXPORTER_OTLP_ENDPOINT: ${DEAL_OTEL_ENDPOINT:-}
|
||||
OTEL_SERVICE_NAME: ml-service
|
||||
DEAL_MTLS_ENABLED: ${DEAL_MTLS_ENABLED:-0}
|
||||
DEAL_MTLS_CA_PEM: /etc/deal/certs/ca.pem
|
||||
@@ -254,6 +255,44 @@ services:
|
||||
retries: 10
|
||||
restart: unless-stopped
|
||||
|
||||
# storage-service — общий gRPC-сервис данных (вложения источников), :5104. Бэкенд — MinIO.
|
||||
# Без host-портов; защита — общий service-token (+ mTLS при DEAL_MTLS_ENABLED=1).
|
||||
storage-service:
|
||||
build:
|
||||
context: ..
|
||||
dockerfile: src/storage-service/Deal.Storage/Dockerfile
|
||||
<<: *service-hardening
|
||||
mem_limit: 512m
|
||||
cpus: 1.0
|
||||
environment:
|
||||
GRPC_PORT: "5104"
|
||||
DEAL_SERVICE_TOKEN: ${DEAL_SERVICE_TOKEN:?DEAL_SERVICE_TOKEN не задан}
|
||||
DEAL_STORAGE_ENDPOINT: minio:9000
|
||||
DEAL_STORAGE_ACCESS_KEY: ${MINIO_ROOT_USER:?MINIO_ROOT_USER не задан}
|
||||
DEAL_STORAGE_SECRET_KEY: ${MINIO_ROOT_PASSWORD:?MINIO_ROOT_PASSWORD не задан}
|
||||
DEAL_STORAGE_BUCKET: deal-attachments
|
||||
DEAL_STORAGE_SECURE: "false"
|
||||
DEAL_LOGS_DIR: /tmp/logs
|
||||
OTEL_EXPORTER_OTLP_ENDPOINT: ${DEAL_OTEL_ENDPOINT:-}
|
||||
OTEL_SERVICE_NAME: storage-service
|
||||
DEAL_MTLS_ENABLED: ${DEAL_MTLS_ENABLED:-0}
|
||||
DEAL_MTLS_CA_PEM: /etc/deal/certs/ca.pem
|
||||
DEAL_MTLS_SERVER_CERT_PFX: /etc/deal/certs/storage-service-server.pfx
|
||||
DEAL_MTLS_SERVER_CERT_PASSWORD: ${DEAL_MTLS_CERT_PASSWORD:-}
|
||||
DEAL_MTLS_CLIENT_CERT_PFX: /etc/deal/certs/deal-client.pfx
|
||||
DEAL_MTLS_CLIENT_CERT_PASSWORD: ${DEAL_MTLS_CERT_PASSWORD:-}
|
||||
volumes:
|
||||
- ${DEAL_CERTS_DIR:-./certs}:/etc/deal/certs:ro
|
||||
depends_on:
|
||||
minio:
|
||||
condition: service_started
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "if [ \"$$DEAL_MTLS_ENABLED\" = \"1\" ]; then /bin/grpc_health_probe -addr=localhost:5104 -tls -tls-ca-cert=/etc/deal/certs/ca.pem -tls-client-cert=/etc/deal/certs/deal-client.crt -tls-client-key=/etc/deal/certs/deal-client.key -tls-server-name=localhost; else /bin/grpc_health_probe -addr=localhost:5104; fi"]
|
||||
interval: 5s
|
||||
timeout: 3s
|
||||
retries: 10
|
||||
restart: unless-stopped
|
||||
|
||||
# caddy — edge: наружу только :80/:443. TLS — плейсхолдер tls internal (см. Caddyfile: домен,
|
||||
# реальный сертификат/Cloudflare, CSP/HSTS). Статика — ../src/frontend/dist (СОБРАТЬ ДО up).
|
||||
caddy:
|
||||
@@ -398,7 +437,7 @@ services:
|
||||
volumes:
|
||||
- /proc:/host/proc:ro
|
||||
- /sys:/host/sys:ro
|
||||
- /:/host/root:ro,rslave
|
||||
- /:/host/root:ro
|
||||
pid: host
|
||||
restart: unless-stopped
|
||||
|
||||
|
||||
Reference in New Issue
Block a user