Files
Agent-System/docker-compose.main.yml
T
weichen 2772c9e526 feat(security): complete P0 release blocking remediation
Unify auth middleware and remove X-User-ID trust, add project_members
authorization, sandbox workspaces via resolver, and admin-only reconcile
by run_id. Introduce goose migrations with startup schema gate, fail closed
when DB unavailable outside explicit ALLOW_IN_MEMORY, bundle web/dist in
app Dockerfile, and remove frontend pseudo-login fallback.
2026-09-11 16:04:53 +00:00

133 lines
4.4 KiB
YAML

# =============================================================================
# 主分支/生产环境编排 (Main Branch Production Environment)
# 特性:
# 1. 独占系统业务库 (5435:5432) 与专属高稳定性数据卷
# 2. 独占生产对话记录、工作区及审计日志目录 (./data/main)
# 3. 共享连接知识库服务 (shuimu-kb-shared:5432)
# =============================================================================
name: agent-main
services:
system-db:
image: pgvector/pgvector:pg16
container_name: shuimu-system-pg-main
command: ["postgres", "-c", "shared_buffers=512MB", "-c", "max_connections=300"]
environment:
POSTGRES_USER: ${SYSTEM_DB_USER:-app}
POSTGRES_PASSWORD: ${SYSTEM_DB_PASSWORD:-prod_highly_secure_db_pass}
POSTGRES_DB: ${SYSTEM_DB_NAME:-agent_system_main}
ports:
- "127.0.0.1:${SYSTEM_DB_PUBLISH_PORT:-5435}:5432"
volumes:
- main-system-pgdata:/var/lib/postgresql/data
- ./deploy/postgres/goose/00001_baseline.sql:/docker-entrypoint-initdb.d/01-init.sql:ro
healthcheck:
test: ["CMD-SHELL", "pg_isready -U ${SYSTEM_DB_USER:-app} -d ${SYSTEM_DB_NAME:-agent_system_main}"]
interval: 5s
timeout: 5s
retries: 20
restart: always
networks:
- main-net
cursor-agent:
image: alpine:latest
container_name: shuimu-cursor-agent-main
command: ["sh", "-c", "echo 'Main/Prod Agent Runner is running' && sleep infinity"]
environment:
CURSOR_RUNNER_ADDR: ":18767"
DATA_DIR: /app/data/workspaces
ports:
- "127.0.0.1:${CURSOR_RUNNER_PORT:-18767}:18767"
volumes:
- ./data/main/workspaces:/app/data/workspaces
restart: always
networks:
- main-net
pi-agent:
build:
context: .
dockerfile: deploy/pi-agent/Dockerfile
image: shuimu-pi-agent:main
container_name: shuimu-pi-agent-main
environment:
PORT: 18867
DATA_DIR: /app/data/workspaces
MINIMAX_ENDPOINT_URL: ${MINIMAX_ENDPOINT_URL:-https://api.minimaxi.com/v1}
MINIMAX_API_KEY: ${MINIMAX_API_KEY:-}
MINIMAX_MODEL_ID: ${MINIMAX_MODEL_ID:-MiniMax-M3}
MINIMAX_API_TYPE: ${MINIMAX_API_TYPE:-openai-compatible}
MINIMAX_PROVIDER: minimax
TAVILY_API_KEYS: ${TAVILY_API_KEYS:-}
TAVILY_API_KEY: ${TAVILY_API_KEY:-}
ports:
- "127.0.0.1:${PI_AGENT_RUNNER_PORT:-18867}:18867"
volumes:
- ./data/main/workspaces:/app/data/workspaces
- ./data/main/agent_sessions:/root/.pi/agent/sessions
tmpfs:
- /tmp
healthcheck:
test: ["CMD-SHELL", "curl -f http://127.0.0.1:18867/health || exit 1"]
interval: 10s
timeout: 5s
retries: 5
restart: always
networks:
- main-net
app:
build:
context: .
dockerfile: deploy/app/Dockerfile
container_name: shuimu-agent-app-main
depends_on:
system-db:
condition: service_healthy
environment:
ENV: prod
HTTP_ADDR: ":${HTTP_PORT:-8000}"
HTTP_PORT: "${HTTP_PORT:-8000}"
HTTP_HOST: "0.0.0.0"
AGENT_BACKEND: ${AGENT_BACKEND:-pi-agent}
DATA_DIR: /app/data
# 独占生产业务与对话库
APP_DB_DSN: postgres://${SYSTEM_DB_USER:-app}:${SYSTEM_DB_PASSWORD:-prod_highly_secure_db_pass}@system-db:5432/${SYSTEM_DB_NAME:-agent_system_main}?sslmode=disable
# 共享知识库
POSTGRES_SHARED_KB_DSN: postgres://${KB_DB_USER:-regkb}:${KB_DB_PASSWORD:-shared_kb_secret_pass}@shuimu-kb-shared:5432/${KB_DB_NAME:-regulations}?sslmode=disable
CURSOR_RUNNER_URL: http://cursor-agent:18767
PI_AGENT_RUNNER_URL: http://pi-agent:18867
AUX_FILE_DSN: file:/var/lib/feishu/outbox_main.db?_journal_mode=WAL&_busy_timeout=5000
ports:
- "${APP_PUBLISH_HOST:-0.0.0.0}:${HTTP_PORT:-8000}:${HTTP_PORT:-8000}"
healthcheck:
test: ["CMD", "curl", "-fsS", "http://127.0.0.1:${HTTP_PORT:-8000}/api/v1/health"]
interval: 10s
timeout: 5s
retries: 6
start_period: 20s
volumes:
# 独占生产对话记录与环境数据
- ./data/main:/app/data
- main-aux-sqlite-data:/var/lib/feishu
- ./.regulations:/app/.regulations:ro
restart: always
networks:
- main-net
- shared-net
networks:
main-net:
name: chat-agent-main-net
driver: bridge
shared-net:
name: chat-agent-shared-net
external: true
volumes:
main-system-pgdata:
name: agent-main-system-pgdata
main-aux-sqlite-data:
name: agent-main-aux-sqlite-data