feat(server): 工程骨架后端——上传 → 解析 → 清单最小链路
- core：配置（prod 拒绝默认密钥 / dev 短信 / 假模型）、租户事务 + 行级安全策略、 problem+json 错误码、信封加密与签名下载、对象存储、事务内入队、Valkey stream 事件流、权限点 - identity：手机号 HMAC 存储、注册、登录（挤下线需确认，API3）、服务端会话 - billing：额度流水只追加，预扣 / 结算 / 退回，一笔预扣只有一个结局 - document：分片上传、按文件头识别格式、Gotenberg 转换、文字层与稳定句子编号 - checklist：标注规则识别、模型抽取、三道校验、标注类条款规则兜底、重跑对齐 - ai：提示词注册表（extract.substantive v1 来自 S4 v2）、假模型、OpenAI 兼容供应商、ai_call 流水 - 迁移：data-model 基线、套餐、Procrastinate、会话状态函数 - 测试 30 个：租户隔离、额度、失败退回、对象加密、契约一致性 - Compose（含 migrate）、镜像、CI Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
YANG JIANKUAN
84
deploy/compose/compose.yaml
Normal file
84
deploy/compose/compose.yaml
Normal file
@@ -0,0 +1,84 @@
|
||||
# 本地开发与 SaaS 内测期的编排（T4）。
|
||||
# 只起依赖： docker compose -f deploy/compose/compose.yaml up -d postgres valkey gotenberg
|
||||
# 全部起来： docker compose -f deploy/compose/compose.yaml --profile app up -d --build
|
||||
# 端口只绑 127.0.0.1；生产环境的密钥从环境变量注入，不写在这里。
|
||||
name: bid-doctor
|
||||
|
||||
services:
|
||||
postgres:
|
||||
image: postgres:16-alpine
|
||||
environment:
|
||||
POSTGRES_USER: bd_owner
|
||||
POSTGRES_PASSWORD: ${BD_PG_OWNER_PASSWORD:-dev-owner}
|
||||
POSTGRES_DB: bid_doctor
|
||||
BD_APP_PASSWORD: ${BD_PG_APP_PASSWORD:-dev-app}
|
||||
ports: ["127.0.0.1:${BD_PG_PORT:-54329}:5432"]
|
||||
volumes:
|
||||
- pgdata:/var/lib/postgresql/data
|
||||
- ./postgres/init-roles.sh:/docker-entrypoint-initdb.d/10-roles.sh:ro
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "pg_isready -U bd_owner -d bid_doctor"]
|
||||
interval: 2s
|
||||
retries: 30
|
||||
|
||||
valkey:
|
||||
image: valkey/valkey:8-alpine
|
||||
command: ["valkey-server", "--save", "", "--appendonly", "no"] # 只存丢了也没关系的数据（AR4）
|
||||
ports: ["127.0.0.1:${BD_VALKEY_PORT:-63799}:6379"]
|
||||
healthcheck:
|
||||
test: ["CMD", "valkey-cli", "ping"]
|
||||
interval: 2s
|
||||
retries: 30
|
||||
|
||||
gotenberg:
|
||||
image: gotenberg/gotenberg:8
|
||||
command:
|
||||
- gotenberg
|
||||
- --api-timeout=240s
|
||||
- --libreoffice-restart-after=50
|
||||
# 转换服务不应访问外网（架构 §3.5）。本地开发要从宿主机访问它，所以放在默认网络；
|
||||
# 生产编排（Helm / 生产 compose）用网络策略禁止它的出口流量。
|
||||
ports: ["127.0.0.1:${BD_GOTENBERG_PORT:-3109}:3000"]
|
||||
|
||||
migrate:
|
||||
profiles: [app]
|
||||
image: bid-doctor-server
|
||||
build: { context: ../.., dockerfile: deploy/docker/server.Dockerfile }
|
||||
command: ["bid-doctor", "migrate"]
|
||||
env_file: [{ path: ../../.env, required: false }]
|
||||
environment:
|
||||
BD_MIGRATE_DATABASE_URL: postgresql+psycopg://bd_owner:${BD_PG_OWNER_PASSWORD:-dev-owner}@postgres:5432/bid_doctor
|
||||
depends_on:
|
||||
postgres: { condition: service_healthy }
|
||||
|
||||
api:
|
||||
profiles: [app]
|
||||
image: bid-doctor-server
|
||||
command: ["bid-doctor", "api", "--host", "0.0.0.0", "--port", "8000"]
|
||||
env_file: [{ path: ../../.env, required: false }]
|
||||
environment: &app-env
|
||||
BD_DATABASE_URL: postgresql+psycopg://bd_app:${BD_PG_APP_PASSWORD:-dev-app}@postgres:5432/bid_doctor
|
||||
BD_MIGRATE_DATABASE_URL: postgresql+psycopg://bd_owner:${BD_PG_OWNER_PASSWORD:-dev-owner}@postgres:5432/bid_doctor
|
||||
BD_VALKEY_URL: redis://valkey:6379/0
|
||||
BD_GOTENBERG_URL: http://gotenberg:3000
|
||||
BD_STORAGE_DIR: /data/objects
|
||||
ports: ["127.0.0.1:${BD_API_PORT:-8009}:8000"]
|
||||
volumes: [objects:/data/objects]
|
||||
depends_on:
|
||||
migrate: { condition: service_completed_successfully }
|
||||
valkey: { condition: service_healthy }
|
||||
|
||||
worker:
|
||||
profiles: [app]
|
||||
image: bid-doctor-server
|
||||
command: ["bid-doctor", "worker"]
|
||||
env_file: [{ path: ../../.env, required: false }]
|
||||
environment: *app-env
|
||||
volumes: [objects:/data/objects]
|
||||
depends_on:
|
||||
migrate: { condition: service_completed_successfully }
|
||||
valkey: { condition: service_healthy }
|
||||
|
||||
volumes:
|
||||
pgdata: {}
|
||||
objects: {}
|
||||
9
deploy/compose/postgres/init-roles.sh
Executable file
9
deploy/compose/postgres/init-roles.sh
Executable file
@@ -0,0 +1,9 @@
|
||||
#!/bin/sh
|
||||
# 数据库角色（data-model §2.4）：bd_owner 建表和迁移；bd_app 给 api / worker，受行级安全策略约束；
|
||||
# bd_auth 不登录，只拥有登录前查会话的两个函数。只在数据卷第一次初始化时执行。
|
||||
set -eu
|
||||
psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" <<SQL
|
||||
CREATE ROLE bd_app LOGIN PASSWORD '${BD_APP_PASSWORD}';
|
||||
CREATE ROLE bd_auth NOLOGIN BYPASSRLS;
|
||||
GRANT CONNECT ON DATABASE ${POSTGRES_DB} TO bd_app;
|
||||
SQL
|
||||
24
deploy/docker/server.Dockerfile
Normal file
24
deploy/docker/server.Dockerfile
Normal file
@@ -0,0 +1,24 @@
|
||||
# api 和 worker 共用的镜像（T2：同一套代码、两种进程，T4：同一批镜像两种编排）。
|
||||
# docker build -f deploy/docker/server.Dockerfile -t bid-doctor-server .
|
||||
# TODO(AR7)：私有化交付时核心包用 Nuitka 编译，提示词加密。
|
||||
FROM python:3.13-slim AS build
|
||||
COPY --from=ghcr.io/astral-sh/uv:0.12.20 /uv /usr/local/bin/uv
|
||||
ENV UV_COMPILE_BYTECODE=1 UV_LINK_MODE=copy UV_PROJECT_ENVIRONMENT=/app/.venv
|
||||
WORKDIR /src
|
||||
COPY pyproject.toml uv.lock .python-version ./
|
||||
COPY server/pyproject.toml server/
|
||||
RUN uv sync --frozen --no-dev --no-install-workspace --package bid-doctor
|
||||
COPY server server
|
||||
RUN uv sync --frozen --no-dev --package bid-doctor --no-editable
|
||||
|
||||
FROM python:3.13-slim
|
||||
RUN useradd --system --uid 10001 bd
|
||||
COPY --from=build /app/.venv /app/.venv
|
||||
COPY server/alembic.ini /app/server/alembic.ini
|
||||
COPY server/migrations /app/server/migrations
|
||||
COPY prompts /app/prompts
|
||||
ENV PATH=/app/.venv/bin:$PATH BD_PROMPTS_DIR=/app/prompts PYTHONUNBUFFERED=1
|
||||
WORKDIR /app/server
|
||||
USER bd
|
||||
EXPOSE 8000
|
||||
CMD ["bid-doctor", "api", "--host", "0.0.0.0", "--port", "8000"]
|
||||
Reference in New Issue
Block a user