busya
18b9f2e94e
Restore LLM_CA_CERT_URLS support for corporate PKI HTTP cert delivery. Downloaded certificates are installed into the llm/ CA category and share the same system trust + NSS import path as CERTS_PATH-mounted certs. Changes: - certs.sh: add download_llm_ca_certs with HTTP-only curl policy, PEM/DER handling, retries, llm/ storage, hash symlinks for llm+custom - backend/agent entrypoints: run download before install_all_certs - compose/env/docs: expose LLM_CA_CERT_URLS again and update ADR-0009 - integration tests: cover PEM/DER/CER, invalid certs, non-HTTP skips, query-string filenames, private/server skips, empty inputs, combined LLM_CA_CERT_URLS + CERTS_PATH channels, and NSS imports Verified: - 194 passed, 1 skipped integration tests - full backend container smoke passed with testcontainers PostgreSQL - docker bundle rebuilt for 0.5.0
84 lines
2.5 KiB
YAML
84 lines
2.5 KiB
YAML
services:
|
|
db:
|
|
image: ${POSTGRES_IMAGE:-postgres:16-alpine}
|
|
restart: unless-stopped
|
|
environment:
|
|
POSTGRES_DB: ss_tools
|
|
POSTGRES_USER: postgres
|
|
POSTGRES_PASSWORD: postgres
|
|
ports:
|
|
- "${POSTGRES_HOST_PORT:-5432}:5432"
|
|
volumes:
|
|
- postgres_data:/var/lib/postgresql/data
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U postgres -d ss_tools"]
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 10
|
|
|
|
backend:
|
|
build:
|
|
context: .
|
|
dockerfile: docker/backend.Dockerfile
|
|
restart: unless-stopped
|
|
env_file:
|
|
- ./backend/.env
|
|
depends_on:
|
|
db:
|
|
condition: service_healthy
|
|
environment:
|
|
POSTGRES_URL: postgresql+psycopg2://postgres:postgres@db:5432/ss_tools
|
|
DATABASE_URL: postgresql+psycopg2://postgres:postgres@db:5432/ss_tools
|
|
TASKS_DATABASE_URL: postgresql+psycopg2://postgres:postgres@db:5432/ss_tools
|
|
AUTH_DATABASE_URL: postgresql+psycopg2://postgres:postgres@db:5432/ss_tools
|
|
BACKEND_PORT: 8000
|
|
INITIAL_ADMIN_CREATE: ${INITIAL_ADMIN_CREATE:-false}
|
|
INITIAL_ADMIN_USERNAME: ${INITIAL_ADMIN_USERNAME:-admin}
|
|
INITIAL_ADMIN_PASSWORD: ${INITIAL_ADMIN_PASSWORD:-}
|
|
FEATURES__DATASET_REVIEW: ${FEATURES__DATASET_REVIEW:-true}
|
|
FEATURES__HEALTH_MONITOR: ${FEATURES__HEALTH_MONITOR:-true}
|
|
LLM_CA_CERT_URLS: ${LLM_CA_CERT_URLS:-}
|
|
ports:
|
|
- "${BACKEND_HOST_PORT:-8001}:8000"
|
|
volumes:
|
|
- ./storage:/app/storage
|
|
- ${CERTS_PATH:-./certs}:/opt/certs:ro
|
|
|
|
agent:
|
|
build:
|
|
context: .
|
|
dockerfile: docker/Dockerfile.agent
|
|
restart: unless-stopped
|
|
depends_on:
|
|
db:
|
|
condition: service_healthy
|
|
backend:
|
|
condition: service_started
|
|
environment:
|
|
LLM_API_KEY: ${LLM_API_KEY:-}
|
|
LLM_BASE_URL: ${LLM_BASE_URL:-https://api.openai.com/v1}
|
|
LLM_MODEL: ${LLM_MODEL:-gpt-4o}
|
|
FASTAPI_URL: http://backend:8000
|
|
AUTH_SECRET_KEY: ${AUTH_SECRET_KEY:?Set AUTH_SECRET_KEY in .env}
|
|
SERVICE_JWT: ${SERVICE_JWT:-agent-service-secret}
|
|
DATABASE_URL: postgresql+psycopg2://postgres:postgres@db:5432/ss_tools
|
|
GRADIO_SERVER_PORT: 7860
|
|
LLM_CA_CERT_URLS: ${LLM_CA_CERT_URLS:-}
|
|
ports:
|
|
- "7860" # internal only, proxied through nginx
|
|
volumes:
|
|
- ${CERTS_PATH:-./certs}:/opt/certs:ro
|
|
|
|
frontend:
|
|
build:
|
|
context: .
|
|
dockerfile: docker/frontend.Dockerfile
|
|
restart: unless-stopped
|
|
depends_on:
|
|
- backend
|
|
ports:
|
|
- "${FRONTEND_HOST_PORT:-8000}:80"
|
|
|
|
volumes:
|
|
postgres_data:
|