From 7ddde4e36507269bde5cd1e58835ee3a3dcbf06b Mon Sep 17 00:00:00 2001 From: stepan Date: Sun, 13 Sep 2026 13:47:31 +0300 Subject: [PATCH] =?UTF-8?q?=D0=A2=D1=80=D0=B5=D0=B9=D1=81=D0=B8=D0=BD?= =?UTF-8?q?=D0=B3=20OTLP=20=E2=80=94=20=D0=BE=D0=BF=D1=82-=D0=B8=D0=BD;=20?= =?UTF-8?q?storage-service=20=D0=B2=20prod?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - endpoint коллектора по умолчанию пуст: трейсы включаются только при заданном DEAL_OTEL_ENDPOINT; - storage-service добавлен в prod-compose (mTLS, OTel env, healthcheck); - node-exporter: убран rslave (несовместим с Docker Desktop). --- deploy/compose.dev.yml | 12 +++++----- deploy/compose.prod.yml | 51 ++++++++++++++++++++++++++++++++++++----- 2 files changed, 51 insertions(+), 12 deletions(-) diff --git a/deploy/compose.dev.yml b/deploy/compose.dev.yml index 57e9bfa..b4403eb 100644 --- a/deploy/compose.dev.yml +++ b/deploy/compose.dev.yml @@ -109,7 +109,7 @@ services: Storage__Minio__Bucket: deal-files Storage__Minio__Secure: "false" # Трейсинг OTel → коллектор профиля observability (без коллектора трейсы не экспортируются). - OTEL_EXPORTER_OTLP_ENDPOINT: ${DEAL_OTEL_ENDPOINT:-http://otel-collector:4317} + OTEL_EXPORTER_OTLP_ENDPOINT: ${DEAL_OTEL_ENDPOINT:-} OTEL_SERVICE_NAME: core ports: - "5080:5080" @@ -149,7 +149,7 @@ services: DEAL_TELEGRAM_SESSION_KEY: ${DEAL_TELEGRAM_SESSION_KEY:-ZmVkY2JhOTg3NjU0MzIxMGZlZGNiYTk4NzY1NDMyMTA=} DEAL_TELEGRAM_SESSION_DIR: /data/sessions DEAL_LOGS_DIR: /tmp/logs - OTEL_EXPORTER_OTLP_ENDPOINT: ${DEAL_OTEL_ENDPOINT:-http://otel-collector:4317} + OTEL_EXPORTER_OTLP_ENDPOINT: ${DEAL_OTEL_ENDPOINT:-} OTEL_SERVICE_NAME: telegram-service SERVICES__CORE__INGRESS: ${DEAL_CORE_INGRESS:-http://core:5082} ports: @@ -181,7 +181,7 @@ services: GRPC_PORT: "5102" DEAL_SERVICE_TOKEN: ${DEAL_SERVICE_TOKEN:-deal_dev_service_token} DEAL_LOGS_DIR: /tmp/logs - OTEL_EXPORTER_OTLP_ENDPOINT: ${DEAL_OTEL_ENDPOINT:-http://otel-collector:4317} + OTEL_EXPORTER_OTLP_ENDPOINT: ${DEAL_OTEL_ENDPOINT:-} OTEL_SERVICE_NAME: ai-service ports: - "5102:5102" @@ -210,7 +210,7 @@ services: DEAL_SERVICE_TOKEN: ${DEAL_SERVICE_TOKEN:-deal_dev_service_token} DEAL_ML_DATA_DIR: /data/ml # файлы моделей data/ml/.sqlite на volume deal_ml_data (Ruling 4/12) DEAL_LOGS_DIR: /tmp/logs - OTEL_EXPORTER_OTLP_ENDPOINT: ${DEAL_OTEL_ENDPOINT:-http://otel-collector:4317} + OTEL_EXPORTER_OTLP_ENDPOINT: ${DEAL_OTEL_ENDPOINT:-} OTEL_SERVICE_NAME: ml-service ports: - "5103:5103" @@ -242,7 +242,7 @@ services: DEAL_STORAGE_BUCKET: deal-attachments DEAL_STORAGE_SECURE: "false" DEAL_LOGS_DIR: /tmp/logs - OTEL_EXPORTER_OTLP_ENDPOINT: ${DEAL_OTEL_ENDPOINT:-http://otel-collector:4317} + OTEL_EXPORTER_OTLP_ENDPOINT: ${DEAL_OTEL_ENDPOINT:-} OTEL_SERVICE_NAME: storage-service ports: - "5104:5104" @@ -329,7 +329,7 @@ services: volumes: - /proc:/host/proc:ro - /sys:/host/sys:ro - - /:/host/root:ro,rslave + - /:/host/root:ro pid: host volumes: diff --git a/deploy/compose.prod.yml b/deploy/compose.prod.yml index 031153f..d4ee492 100644 --- a/deploy/compose.prod.yml +++ b/deploy/compose.prod.yml @@ -6,7 +6,7 @@ # Состав (всё в одной внутренней сети compose, наружу — ТОЛЬКО caddy :80/:443): # postgres, minio — хранилища БЕЗ host-портов (volume'ы); # core (:5080 HTTP + :5082 gRPC-ингресс), telegram-service (:5101), ai-service (:5102), -# ml-service (:5103) — процессы «Дейла»; mTLS-транспорт — по env Ruling 6 (см. ниже); +# ml-service (:5103), storage-service (:5104) — процессы «Дейла»; mTLS-транспорт — по env Ruling 6 (см. ниже); # caddy — edge: TLS-терминация, статика фронта, reverse_proxy /api → core. # observability (ПРОФИЛЬ `observability`) — современный стек: otel-collector (приём трейсов OTLP), # tempo (хранилище трейсов), loki/promtail (логи), prometheus (метрики), @@ -125,6 +125,7 @@ services: Services__Ai__Endpoint: ${DEAL_AI_ENDPOINT:-http://ai-service:5102} Services__Telegram__UseLocal: "false" Services__Telegram__Endpoint: ${DEAL_TELEGRAM_ENDPOINT:-http://telegram-service:5101} + Services__Storage__Endpoint: ${DEAL_STORAGE_SERVICE_ENDPOINT:-http://storage-service:5104} # Файлы — MinIO (внутренний http; TLS minio — вне этапа, при желании Storage__Minio__Secure=true # + endpoint https и сертификаты). Storage__Minio__Endpoint: minio:9000 @@ -133,7 +134,7 @@ services: Storage__Minio__Bucket: deal-files Storage__Minio__Secure: "false" # Трейсинг OTel → коллектор профиля observability; без коллектора трейсы не экспортируются. - OTEL_EXPORTER_OTLP_ENDPOINT: ${DEAL_OTEL_ENDPOINT:-http://otel-collector:4317} + OTEL_EXPORTER_OTLP_ENDPOINT: ${DEAL_OTEL_ENDPOINT:-} OTEL_SERVICE_NAME: core # mTLS внутреннего gRPC (Ruling 6; пути — /etc/deal/certs, см. volume ниже). DEAL_MTLS_ENABLED: ${DEAL_MTLS_ENABLED:-0} @@ -175,7 +176,7 @@ services: DEAL_TELEGRAM_SESSION_KEY: ${DEAL_TELEGRAM_SESSION_KEY:?DEAL_TELEGRAM_SESSION_KEY не задан (ключ AES-GCM сессий)} DEAL_TELEGRAM_SESSION_DIR: /data/sessions DEAL_LOGS_DIR: /tmp/logs - OTEL_EXPORTER_OTLP_ENDPOINT: ${DEAL_OTEL_ENDPOINT:-http://otel-collector:4317} + OTEL_EXPORTER_OTLP_ENDPOINT: ${DEAL_OTEL_ENDPOINT:-} OTEL_SERVICE_NAME: telegram-service SERVICES__CORE__INGRESS: ${DEAL_CORE_INGRESS:-http://core:5082} DEAL_MTLS_ENABLED: ${DEAL_MTLS_ENABLED:-0} @@ -206,7 +207,7 @@ services: GRPC_PORT: "5102" DEAL_SERVICE_TOKEN: ${DEAL_SERVICE_TOKEN:?DEAL_SERVICE_TOKEN не задан} DEAL_LOGS_DIR: /tmp/logs - OTEL_EXPORTER_OTLP_ENDPOINT: ${DEAL_OTEL_ENDPOINT:-http://otel-collector:4317} + OTEL_EXPORTER_OTLP_ENDPOINT: ${DEAL_OTEL_ENDPOINT:-} OTEL_SERVICE_NAME: ai-service DEAL_MTLS_ENABLED: ${DEAL_MTLS_ENABLED:-0} DEAL_MTLS_CA_PEM: /etc/deal/certs/ca.pem @@ -236,7 +237,7 @@ services: DEAL_SERVICE_TOKEN: ${DEAL_SERVICE_TOKEN:?DEAL_SERVICE_TOKEN не задан} DEAL_ML_DATA_DIR: /data/ml DEAL_LOGS_DIR: /tmp/logs - OTEL_EXPORTER_OTLP_ENDPOINT: ${DEAL_OTEL_ENDPOINT:-http://otel-collector:4317} + OTEL_EXPORTER_OTLP_ENDPOINT: ${DEAL_OTEL_ENDPOINT:-} OTEL_SERVICE_NAME: ml-service DEAL_MTLS_ENABLED: ${DEAL_MTLS_ENABLED:-0} DEAL_MTLS_CA_PEM: /etc/deal/certs/ca.pem @@ -254,6 +255,44 @@ services: retries: 10 restart: unless-stopped + # storage-service — общий gRPC-сервис данных (вложения источников), :5104. Бэкенд — MinIO. + # Без host-портов; защита — общий service-token (+ mTLS при DEAL_MTLS_ENABLED=1). + storage-service: + build: + context: .. + dockerfile: src/storage-service/Deal.Storage/Dockerfile + <<: *service-hardening + mem_limit: 512m + cpus: 1.0 + environment: + GRPC_PORT: "5104" + DEAL_SERVICE_TOKEN: ${DEAL_SERVICE_TOKEN:?DEAL_SERVICE_TOKEN не задан} + DEAL_STORAGE_ENDPOINT: minio:9000 + DEAL_STORAGE_ACCESS_KEY: ${MINIO_ROOT_USER:?MINIO_ROOT_USER не задан} + DEAL_STORAGE_SECRET_KEY: ${MINIO_ROOT_PASSWORD:?MINIO_ROOT_PASSWORD не задан} + DEAL_STORAGE_BUCKET: deal-attachments + DEAL_STORAGE_SECURE: "false" + DEAL_LOGS_DIR: /tmp/logs + OTEL_EXPORTER_OTLP_ENDPOINT: ${DEAL_OTEL_ENDPOINT:-} + OTEL_SERVICE_NAME: storage-service + DEAL_MTLS_ENABLED: ${DEAL_MTLS_ENABLED:-0} + DEAL_MTLS_CA_PEM: /etc/deal/certs/ca.pem + DEAL_MTLS_SERVER_CERT_PFX: /etc/deal/certs/storage-service-server.pfx + DEAL_MTLS_SERVER_CERT_PASSWORD: ${DEAL_MTLS_CERT_PASSWORD:-} + DEAL_MTLS_CLIENT_CERT_PFX: /etc/deal/certs/deal-client.pfx + DEAL_MTLS_CLIENT_CERT_PASSWORD: ${DEAL_MTLS_CERT_PASSWORD:-} + volumes: + - ${DEAL_CERTS_DIR:-./certs}:/etc/deal/certs:ro + depends_on: + minio: + condition: service_started + healthcheck: + test: ["CMD-SHELL", "if [ \"$$DEAL_MTLS_ENABLED\" = \"1\" ]; then /bin/grpc_health_probe -addr=localhost:5104 -tls -tls-ca-cert=/etc/deal/certs/ca.pem -tls-client-cert=/etc/deal/certs/deal-client.crt -tls-client-key=/etc/deal/certs/deal-client.key -tls-server-name=localhost; else /bin/grpc_health_probe -addr=localhost:5104; fi"] + interval: 5s + timeout: 3s + retries: 10 + restart: unless-stopped + # caddy — edge: наружу только :80/:443. TLS — плейсхолдер tls internal (см. Caddyfile: домен, # реальный сертификат/Cloudflare, CSP/HSTS). Статика — ../src/frontend/dist (СОБРАТЬ ДО up). caddy: @@ -398,7 +437,7 @@ services: volumes: - /proc:/host/proc:ro - /sys:/host/sys:ro - - /:/host/root:ro,rslave + - /:/host/root:ro pid: host restart: unless-stopped