Проект разделен на два репозитория

2026-08-14 15:42:45 +03:00
parent e06a77ee1d
commit bbef7a30c9
521 changed files with 2597 additions and 2302 deletions
@@ -0,0 +1,147 @@
+x-api-job-secrets: &api-job-secrets
+  - api_database_url
+  - api_redis_url
+  - api_redis_realtime_url
+  - message_safety_service_token
+  - bitrix_local_app_internal_token
+  - bitrix_api_inbox_token
+  - keycloak_settings_bridge_token
+  - selectel_s3_access_key
+  - selectel_s3_secret_key
+  - cursor_hmac_secret
+
+x-api-job-environment: &api-job-environment
+  HAN_SECRET_VARS: >-
+    DATABASE_URL REDIS_URL REDIS_REALTIME_URL MESSAGE_SAFETY_SERVICE_TOKEN
+    BITRIX_LOCAL_APP_INTERNAL_TOKEN BITRIX_API_INBOX_TOKEN
+    KEYCLOAK_SETTINGS_BRIDGE_TOKEN SELECTEL_S3_ACCESS_KEY SELECTEL_S3_SECRET_KEY
+    CURSOR_HMAC_SECRET
+  DATABASE_URL_FILE: /run/secrets/api_database_url
+  REDIS_URL_FILE: /run/secrets/api_redis_url
+  REDIS_REALTIME_URL_FILE: /run/secrets/api_redis_realtime_url
+  MESSAGE_SAFETY_SERVICE_TOKEN_FILE: /run/secrets/message_safety_service_token
+  BITRIX_LOCAL_APP_INTERNAL_TOKEN_FILE: /run/secrets/bitrix_local_app_internal_token
+  BITRIX_API_INBOX_TOKEN_FILE: /run/secrets/bitrix_api_inbox_token
+  KEYCLOAK_SETTINGS_BRIDGE_TOKEN_FILE: /run/secrets/keycloak_settings_bridge_token
+  SELECTEL_S3_ACCESS_KEY_FILE: /run/secrets/selectel_s3_access_key
+  SELECTEL_S3_SECRET_KEY_FILE: /run/secrets/selectel_s3_secret_key
+  CURSOR_HMAC_SECRET_FILE: /run/secrets/cursor_hmac_secret
+  APP_ENV: ${APP_ENV:-production-like}
+  LOG_LEVEL: ${LOG_LEVEL:-INFO}
+  KEYCLOAK_PUBLIC_URL: ${KEYCLOAK_PUBLIC_URL}
+  KEYCLOAK_INTERNAL_URL: ${KEYCLOAK_INTERNAL_URL:-http://keycloak:8080/auth}
+  KEYCLOAK_REALM: ${KEYCLOAK_REALM:-han-chat}
+  KEYCLOAK_AUDIENCE: ${KEYCLOAK_AUDIENCE:-han-chat-api}
+  MESSAGE_SAFETY_URL: ${MESSAGE_SAFETY_URL}
+  MESSAGE_SAFETY_API_PREFIX: /internal/safety/v2
+  MESSAGE_SAFETY_CA_FILE: /run/config/message-safety-internal-ca.pem
+  MESSAGE_SAFETY_POST_TIMEOUT_SEC: ${MESSAGE_SAFETY_POST_TIMEOUT_SEC:-5}
+  MESSAGE_SAFETY_TASK_POLL_INTERVAL_SEC: ${MESSAGE_SAFETY_TASK_POLL_INTERVAL_SEC:-2}
+  MESSAGE_SAFETY_TASK_POLL_MAX_SEC: ${MESSAGE_SAFETY_TASK_POLL_MAX_SEC:-300}
+  BITRIX_LOCAL_APP_BASE_URL: ${BITRIX_LOCAL_APP_BASE_URL:-http://bitrix-local-app:8080}
+  BITRIX_LOCAL_APP_HTTP_TIMEOUT_SEC: ${BITRIX_LOCAL_APP_HTTP_TIMEOUT_SEC:-20}
+  SELECTEL_S3_ENDPOINT_URL: ${SELECTEL_S3_ENDPOINT_URL}
+  SELECTEL_S3_BUCKET_DOCUMENTS: ${SELECTEL_S3_BUCKET_DOCUMENTS}
+  SELECTEL_S3_BUCKET_ATTACHMENTS: ${SELECTEL_S3_BUCKET_ATTACHMENTS}
+  SELECTEL_S3_BUCKET_QUARANTINE: ${SELECTEL_S3_BUCKET_QUARANTINE}
+  TRUSTED_PROXY_CIDRS: ${TRUSTED_PROXY_CIDRS:-127.0.0.1/32}
+
+services:
+  migrate-api:
+    image: ${API_BACKEND_IMAGE:-han-chat-api-backend:local}
+    profiles: ["ops"]
+    environment:
+      HAN_SECRET_VARS: DATABASE_URL
+      DATABASE_URL_FILE: /run/secrets/api_database_url
+    secrets:
+      - api_database_url
+    command: ["alembic", "upgrade", "head"]
+    volumes:
+      - ${PG_CA_HOST_PATH}:/run/secrets/pg-ca.pem:ro
+    networks: [backend, egress]
+    restart: "no"
+    security_opt: ["no-new-privileges:true"]
+    ulimits:
+      core: {soft: 0, hard: 0}
+
+  migrate-bitrix-local:
+    image: ${BITRIX_LOCAL_APP_IMAGE:-han-chat-bitrix-local-app:local}
+    profiles: ["ops"]
+    environment:
+      HAN_SECRET_VARS: BITRIX_DATABASE_URL
+      BITRIX_DATABASE_URL_FILE: /run/secrets/bitrix_database_url
+    secrets:
+      - bitrix_database_url
+    command: ["alembic", "upgrade", "head"]
+    volumes:
+      - ${PG_CA_HOST_PATH}:/run/secrets/pg-ca.pem:ro
+    networks: [backend, egress]
+    restart: "no"
+    security_opt: ["no-new-privileges:true"]
+    ulimits:
+      core: {soft: 0, hard: 0}
+
+  migrate-bitrix-sync:
+    image: ${BITRIX_SYNC_IMAGE:-han-chat-bitrix-sync:local}
+    profiles: ["ops"]
+    environment:
+      HAN_SECRET_VARS: BITRIX_SYNC_DATABASE_URL
+      BITRIX_SYNC_DATABASE_URL_FILE: /run/secrets/bitrix_sync_database_url
+    secrets:
+      - bitrix_sync_database_url
+    command: ["alembic", "upgrade", "head"]
+    volumes:
+      - ${PG_CA_HOST_PATH}:/run/secrets/pg-ca.pem:ro
+    networks: [backend, egress]
+    restart: "no"
+    security_opt: ["no-new-privileges:true"]
+    ulimits:
+      core: {soft: 0, hard: 0}
+
+  migrate-sms:
+    image: ${SMS_SERVICE_IMAGE:-han-chat-sms-service:local}
+    profiles: ["ops"]
+    environment:
+      HAN_SECRET_VARS: SMS_DATABASE_URL
+      SMS_DATABASE_URL_FILE: /run/secrets/sms_database_url
+    secrets:
+      - sms_database_url
+    command: ["alembic", "upgrade", "head"]
+    volumes:
+      - ${PG_CA_HOST_PATH}:/run/secrets/pg-ca.pem:ro
+    networks: [backend, egress]
+    restart: "no"
+    security_opt: ["no-new-privileges:true"]
+    ulimits:
+      core: {soft: 0, hard: 0}
+
+  seed-settings:
+    image: ${API_BACKEND_IMAGE:-han-chat-api-backend:local}
+    profiles: ["ops"]
+    environment: *api-job-environment
+    secrets: *api-job-secrets
+    command:
+      - /bin/sh
+      - -ec
+      - >-
+        python -m app.cli.seed_settings
+        --file /deployment/app-settings.production-like.yaml
+        && python -m app.cli.validate_settings
+    volumes:
+      - ${PG_CA_HOST_PATH}:/run/secrets/pg-ca.pem:ro
+      - ${MESSAGE_SAFETY_CA_HOST_PATH}:/run/config/message-safety-internal-ca.pem:ro
+      - ./app-settings.production-like.yaml:/deployment/app-settings.production-like.yaml:ro
+    networks: [backend, egress]
+    restart: "no"
+    security_opt: ["no-new-privileges:true"]
+    ulimits:
+      core: {soft: 0, hard: 0}
+
+  toolbox:
+    image: curlimages/curl:8.11.1
+    profiles: ["ops"]
+    entrypoint: ["sleep", "infinity"]
+    networks: [backend, observability, egress]
+    restart: "no"
+    cap_drop: ["ALL"]
+    security_opt: ["no-new-privileges:true"]