Grok version

architectory/arch-04-settings-and-content.md

@@ -85,7 +85,7 @@ Managed PostgreSQL **поднимается до** развёртывания п
 | Группа | Ключи |
 |---|---|
 | Auth | `auth.phone.enabled`, `auth.password.enabled` |
-| OTP (продукт) | `otp.phone.max_send_attempts_per_24h`, `otp.phone.min_seconds_between_attempts` |
+| OTP (продукт; потребитель — Keycloak SPI, не api-backend) | `otp.phone.max_send_attempts_per_24h`, `otp.phone.min_seconds_between_attempts` |
 | Оператор | `operator.call.phone` |
 | Consent | `consent.personal_data.*`, `consent.user_agreement.*`, `consent.marketing.*` |
 | Файлы чата | `chat.attachments.*` |
@@ -118,7 +118,7 @@ chat.attachments.allowed_mime_types=image/jpeg,image/png,image/webp,image/heic,i
 chat.attachments.disallowed_extensions=svg,doc,docx,xls,xlsx,csv
 chat.attachments.max_size_mb=5
 chat.attachments.storage=selectel_s3
-chat.attachments.upload_mode=backend_controlled_upload
+chat.attachments.upload_mode=presigned_put
 chat.attachments.safety_scan_required=true
 
 rate_limit.message_send.per_user=30/minute
@@ -196,9 +196,14 @@ KEYCLOAK_OTP_MOCK_ENABLED=true
 KEYCLOAK_OTP_MOCK_CODE=1234
 
 # =============================================================================
-# Redis
+# Redis (I4: раздельные DB index)
 # =============================================================================
+# /0 — api-backend: rate limits, idempotency
+# /1 — api-backend realtime/coordination (опционально; можно совместить с /0)
+# /2 — message-safety: verdict cache / workers
 REDIS_URL=redis://redis:6379/0
+REDIS_REALTIME_URL=redis://redis:6379/1
+MESSAGE_SAFETY_REDIS_URL=redis://redis:6379/2
 
 # =============================================================================
 # Service tokens (internal API) — все переменные только в backend/.env
@@ -211,15 +216,21 @@ BITRIX_API_FORWARD_TOKEN=change-me
 BITRIX_SYNC_SERVICE_TOKEN=change-me
 
 # =============================================================================
-# api-backend (интеграции)
+# api-backend (интеграции + resilience I2)
 # =============================================================================
 BITRIX_LOCAL_APP_BASE_URL=http://bitrix-local-app:8080
 BITRIX_API_INBOX_PATH=/internal/openlines/v1/inbox
 MESSAGE_SAFETY_URL=http://message-safety:8080
+MESSAGE_SAFETY_CIRCUIT_FAILURE_THRESHOLD=5
+MESSAGE_SAFETY_CIRCUIT_OPEN_SEC=30
+BITRIX_LOCAL_APP_CIRCUIT_FAILURE_THRESHOLD=5
+BITRIX_LOCAL_APP_CIRCUIT_OPEN_SEC=30
+BITRIX_LOCAL_APP_HTTP_TIMEOUT_SEC=10
 
 # =============================================================================
 # bitrix-sync
 # =============================================================================
+BITRIX_SYNC_ENABLED=true
 BITRIX_SYNC_CRM_BASE_URL=https://han0107.bitrix24.ru
 BITRIX_SYNC_CRM_WEBHOOK_URL=change-me
 BITRIX_SYNC_CONTACT_MAP_INTERVAL_SEC=60
@@ -243,6 +254,7 @@ BITRIX_APPLICATION_TOKEN=change-me
 # =============================================================================
 # message-safety (technical)
 # =============================================================================
+# POST check timeout; poll interval/max — бюджет sync-wait внутри POST .../messages (G4)
 MESSAGE_SAFETY_POST_TIMEOUT_SEC=5
 MESSAGE_SAFETY_TASK_POLL_INTERVAL_SEC=2
 MESSAGE_SAFETY_TASK_POLL_MAX_SEC=300
@@ -280,10 +292,17 @@ OTEL_EXPORTER_OTLP_ENDPOINT=http://otel-collector:4317
 ## Namespace переменных Bitrix
 
 - `bitrix-local-app`: `BITRIX_CLIENT_*`, `BITRIX_CONNECTOR_*`, `BITRIX_PUBLIC_BASE_URL`, `BITRIX_DATABASE_URL`, `BITRIX_API_FORWARD_URL`, `BITRIX_APPLICATION_TOKEN` + service tokens.
-- `api-backend`: `BITRIX_LOCAL_APP_BASE_URL`, `MESSAGE_SAFETY_URL` + service tokens; **бизнес-настройки** — из `app_settings`.
-- `bitrix-sync`: `BITRIX_SYNC_*`, `BITRIX_SYNC_WEBHOOK_TOKEN`, `BITRIX_SYNC_SERVICE_TOKEN`.
+- `api-backend`: `BITRIX_LOCAL_APP_BASE_URL`, `MESSAGE_SAFETY_URL`, circuit/timeout vars, Redis `/0`/`/1` + service tokens; **бизнес-настройки** — из `app_settings`. OTP counters **не** ведёт.
+- `bitrix-sync`: `BITRIX_SYNC_ENABLED`, `BITRIX_SYNC_*`, `BITRIX_SYNC_WEBHOOK_TOKEN`, `BITRIX_SYNC_SERVICE_TOKEN`.
 - `bitrix-sync` не читает `BITRIX_CLIENT_ID` / `BITRIX_CLIENT_SECRET`.
 
+### `BITRIX_SYNC_ENABLED`
+
+| Значение | Поведение |
+|---|---|
+| `true` (default) | `bitrix-sync` обрабатывает `sync_queue` и принимает CRM webhook |
+| `false` | синхронизация с Bitrix24 CRM не выполняется (сервис не стартует или no-op); чат Open Lines через `bitrix-local-app` **не** затрагивается |
+
 ## Разрешённые типы файлов чата (MVP)
 
 Источник значений — ключи **`app_settings`** (раздел «Seed MVP»). Остальные arch-* **ссылаются сюда**.