Трейсинг OTLP — опт-ин; storage-service в prod

- endpoint коллектора по умолчанию пуст: трейсы включаются только при
  заданном DEAL_OTEL_ENDPOINT;
- storage-service добавлен в prod-compose (mTLS, OTel env, healthcheck);
- node-exporter: убран rslave (несовместим с Docker Desktop).

deploy/compose.dev.yml

@@ -109,7 +109,7 @@ services:
       Storage__Minio__Bucket: deal-files
       Storage__Minio__Secure: "false"
       # Трейсинг OTel → коллектор профиля observability (без коллектора трейсы не экспортируются).
-      OTEL_EXPORTER_OTLP_ENDPOINT: ${DEAL_OTEL_ENDPOINT:-http://otel-collector:4317}
+      OTEL_EXPORTER_OTLP_ENDPOINT: ${DEAL_OTEL_ENDPOINT:-}
       OTEL_SERVICE_NAME: core
     ports:
       - "5080:5080"
@@ -149,7 +149,7 @@ services:
       DEAL_TELEGRAM_SESSION_KEY: ${DEAL_TELEGRAM_SESSION_KEY:-ZmVkY2JhOTg3NjU0MzIxMGZlZGNiYTk4NzY1NDMyMTA=}
       DEAL_TELEGRAM_SESSION_DIR: /data/sessions
       DEAL_LOGS_DIR: /tmp/logs
-      OTEL_EXPORTER_OTLP_ENDPOINT: ${DEAL_OTEL_ENDPOINT:-http://otel-collector:4317}
+      OTEL_EXPORTER_OTLP_ENDPOINT: ${DEAL_OTEL_ENDPOINT:-}
       OTEL_SERVICE_NAME: telegram-service
       SERVICES__CORE__INGRESS: ${DEAL_CORE_INGRESS:-http://core:5082}
     ports:
@@ -181,7 +181,7 @@ services:
       GRPC_PORT: "5102"
       DEAL_SERVICE_TOKEN: ${DEAL_SERVICE_TOKEN:-deal_dev_service_token}
       DEAL_LOGS_DIR: /tmp/logs
-      OTEL_EXPORTER_OTLP_ENDPOINT: ${DEAL_OTEL_ENDPOINT:-http://otel-collector:4317}
+      OTEL_EXPORTER_OTLP_ENDPOINT: ${DEAL_OTEL_ENDPOINT:-}
       OTEL_SERVICE_NAME: ai-service
     ports:
       - "5102:5102"
@@ -210,7 +210,7 @@ services:
       DEAL_SERVICE_TOKEN: ${DEAL_SERVICE_TOKEN:-deal_dev_service_token}
       DEAL_ML_DATA_DIR: /data/ml   # файлы моделей data/ml/<tenantId>.sqlite на volume deal_ml_data (Ruling 4/12)
       DEAL_LOGS_DIR: /tmp/logs
-      OTEL_EXPORTER_OTLP_ENDPOINT: ${DEAL_OTEL_ENDPOINT:-http://otel-collector:4317}
+      OTEL_EXPORTER_OTLP_ENDPOINT: ${DEAL_OTEL_ENDPOINT:-}
       OTEL_SERVICE_NAME: ml-service
     ports:
       - "5103:5103"
@@ -242,7 +242,7 @@ services:
       DEAL_STORAGE_BUCKET: deal-attachments
       DEAL_STORAGE_SECURE: "false"
       DEAL_LOGS_DIR: /tmp/logs
-      OTEL_EXPORTER_OTLP_ENDPOINT: ${DEAL_OTEL_ENDPOINT:-http://otel-collector:4317}
+      OTEL_EXPORTER_OTLP_ENDPOINT: ${DEAL_OTEL_ENDPOINT:-}
       OTEL_SERVICE_NAME: storage-service
     ports:
       - "5104:5104"
@@ -329,7 +329,7 @@ services:
     volumes:
       - /proc:/host/proc:ro
       - /sys:/host/sys:ro
-      - /:/host/root:ro,rslave
+      - /:/host/root:ro
     pid: host
 
 volumes:

deploy/compose.prod.yml

@@ -6,7 +6,7 @@
 # Состав (всё в одной внутренней сети compose, наружу — ТОЛЬКО caddy :80/:443):
 #   postgres, minio            — хранилища БЕЗ host-портов (volume'ы);
 #   core (:5080 HTTP + :5082 gRPC-ингресс), telegram-service (:5101), ai-service (:5102),
-#   ml-service (:5103)         — процессы «Дейла»; mTLS-транспорт — по env Ruling 6 (см. ниже);
+#   ml-service (:5103), storage-service (:5104)   — процессы «Дейла»; mTLS-транспорт — по env Ruling 6 (см. ниже);
 #   caddy                      — edge: TLS-терминация, статика фронта, reverse_proxy /api → core.
 #   observability (ПРОФИЛЬ `observability`) — современный стек: otel-collector (приём трейсов OTLP),
 #                                tempo (хранилище трейсов), loki/promtail (логи), prometheus (метрики),
@@ -125,6 +125,7 @@ services:
       Services__Ai__Endpoint: ${DEAL_AI_ENDPOINT:-http://ai-service:5102}
       Services__Telegram__UseLocal: "false"
       Services__Telegram__Endpoint: ${DEAL_TELEGRAM_ENDPOINT:-http://telegram-service:5101}
+      Services__Storage__Endpoint: ${DEAL_STORAGE_SERVICE_ENDPOINT:-http://storage-service:5104}
       # Файлы — MinIO (внутренний http; TLS minio — вне этапа, при желании Storage__Minio__Secure=true
       # + endpoint https и сертификаты).
       Storage__Minio__Endpoint: minio:9000
@@ -133,7 +134,7 @@ services:
       Storage__Minio__Bucket: deal-files
       Storage__Minio__Secure: "false"
       # Трейсинг OTel → коллектор профиля observability; без коллектора трейсы не экспортируются.
-      OTEL_EXPORTER_OTLP_ENDPOINT: ${DEAL_OTEL_ENDPOINT:-http://otel-collector:4317}
+      OTEL_EXPORTER_OTLP_ENDPOINT: ${DEAL_OTEL_ENDPOINT:-}
       OTEL_SERVICE_NAME: core
       # mTLS внутреннего gRPC (Ruling 6; пути — /etc/deal/certs, см. volume ниже).
       DEAL_MTLS_ENABLED: ${DEAL_MTLS_ENABLED:-0}
@@ -175,7 +176,7 @@ services:
       DEAL_TELEGRAM_SESSION_KEY: ${DEAL_TELEGRAM_SESSION_KEY:?DEAL_TELEGRAM_SESSION_KEY не задан (ключ AES-GCM сессий)}
       DEAL_TELEGRAM_SESSION_DIR: /data/sessions
       DEAL_LOGS_DIR: /tmp/logs
-      OTEL_EXPORTER_OTLP_ENDPOINT: ${DEAL_OTEL_ENDPOINT:-http://otel-collector:4317}
+      OTEL_EXPORTER_OTLP_ENDPOINT: ${DEAL_OTEL_ENDPOINT:-}
       OTEL_SERVICE_NAME: telegram-service
       SERVICES__CORE__INGRESS: ${DEAL_CORE_INGRESS:-http://core:5082}
       DEAL_MTLS_ENABLED: ${DEAL_MTLS_ENABLED:-0}
@@ -206,7 +207,7 @@ services:
       GRPC_PORT: "5102"
       DEAL_SERVICE_TOKEN: ${DEAL_SERVICE_TOKEN:?DEAL_SERVICE_TOKEN не задан}
       DEAL_LOGS_DIR: /tmp/logs
-      OTEL_EXPORTER_OTLP_ENDPOINT: ${DEAL_OTEL_ENDPOINT:-http://otel-collector:4317}
+      OTEL_EXPORTER_OTLP_ENDPOINT: ${DEAL_OTEL_ENDPOINT:-}
       OTEL_SERVICE_NAME: ai-service
       DEAL_MTLS_ENABLED: ${DEAL_MTLS_ENABLED:-0}
       DEAL_MTLS_CA_PEM: /etc/deal/certs/ca.pem
@@ -236,7 +237,7 @@ services:
       DEAL_SERVICE_TOKEN: ${DEAL_SERVICE_TOKEN:?DEAL_SERVICE_TOKEN не задан}
       DEAL_ML_DATA_DIR: /data/ml
       DEAL_LOGS_DIR: /tmp/logs
-      OTEL_EXPORTER_OTLP_ENDPOINT: ${DEAL_OTEL_ENDPOINT:-http://otel-collector:4317}
+      OTEL_EXPORTER_OTLP_ENDPOINT: ${DEAL_OTEL_ENDPOINT:-}
       OTEL_SERVICE_NAME: ml-service
       DEAL_MTLS_ENABLED: ${DEAL_MTLS_ENABLED:-0}
       DEAL_MTLS_CA_PEM: /etc/deal/certs/ca.pem
@@ -254,6 +255,44 @@ services:
       retries: 10
     restart: unless-stopped
 
+  # storage-service — общий gRPC-сервис данных (вложения источников), :5104. Бэкенд — MinIO.
+  # Без host-портов; защита — общий service-token (+ mTLS при DEAL_MTLS_ENABLED=1).
+  storage-service:
+    build:
+      context: ..
+      dockerfile: src/storage-service/Deal.Storage/Dockerfile
+    <<: *service-hardening
+    mem_limit: 512m
+    cpus: 1.0
+    environment:
+      GRPC_PORT: "5104"
+      DEAL_SERVICE_TOKEN: ${DEAL_SERVICE_TOKEN:?DEAL_SERVICE_TOKEN не задан}
+      DEAL_STORAGE_ENDPOINT: minio:9000
+      DEAL_STORAGE_ACCESS_KEY: ${MINIO_ROOT_USER:?MINIO_ROOT_USER не задан}
+      DEAL_STORAGE_SECRET_KEY: ${MINIO_ROOT_PASSWORD:?MINIO_ROOT_PASSWORD не задан}
+      DEAL_STORAGE_BUCKET: deal-attachments
+      DEAL_STORAGE_SECURE: "false"
+      DEAL_LOGS_DIR: /tmp/logs
+      OTEL_EXPORTER_OTLP_ENDPOINT: ${DEAL_OTEL_ENDPOINT:-}
+      OTEL_SERVICE_NAME: storage-service
+      DEAL_MTLS_ENABLED: ${DEAL_MTLS_ENABLED:-0}
+      DEAL_MTLS_CA_PEM: /etc/deal/certs/ca.pem
+      DEAL_MTLS_SERVER_CERT_PFX: /etc/deal/certs/storage-service-server.pfx
+      DEAL_MTLS_SERVER_CERT_PASSWORD: ${DEAL_MTLS_CERT_PASSWORD:-}
+      DEAL_MTLS_CLIENT_CERT_PFX: /etc/deal/certs/deal-client.pfx
+      DEAL_MTLS_CLIENT_CERT_PASSWORD: ${DEAL_MTLS_CERT_PASSWORD:-}
+    volumes:
+      - ${DEAL_CERTS_DIR:-./certs}:/etc/deal/certs:ro
+    depends_on:
+      minio:
+        condition: service_started
+    healthcheck:
+      test: ["CMD-SHELL", "if [ \"$$DEAL_MTLS_ENABLED\" = \"1\" ]; then /bin/grpc_health_probe -addr=localhost:5104 -tls -tls-ca-cert=/etc/deal/certs/ca.pem -tls-client-cert=/etc/deal/certs/deal-client.crt -tls-client-key=/etc/deal/certs/deal-client.key -tls-server-name=localhost; else /bin/grpc_health_probe -addr=localhost:5104; fi"]
+      interval: 5s
+      timeout: 3s
+      retries: 10
+    restart: unless-stopped
+
   # caddy — edge: наружу только :80/:443. TLS — плейсхолдер tls internal (см. Caddyfile: домен,
   # реальный сертификат/Cloudflare, CSP/HSTS). Статика — ../src/frontend/dist (СОБРАТЬ ДО up).
   caddy:
@@ -398,7 +437,7 @@ services:
     volumes:
       - /proc:/host/proc:ro
       - /sys:/host/sys:ro
-      - /:/host/root:ro,rslave
+      - /:/host/root:ro
     pid: host
     restart: unless-stopped