Реализация на отдельных двух машинах с протестированным взаимодействием по проверке сообщений

2026-08-19 18:24:00 +03:00
parent bbef7a30c9
commit c7a80e7256
103 changed files with 3457 additions and 3725 deletions
@@ -7,19 +7,23 @@ RELEASE_VERSION=change-me-release
 LOG_LEVEL=INFO
 COMPOSE_PROJECT_NAME=han-chat

-# Immutable service images built by their owning modules.
-API_BACKEND_IMAGE=han-chat-api-backend:local
-MESSAGE_SAFETY_IMAGE=han-chat-message-safety:local
-BITRIX_LOCAL_APP_IMAGE=han-chat-bitrix-local-app:local
-BITRIX_SYNC_IMAGE=han-chat-bitrix-sync:local
-KEYCLOAK_IMAGE=han-chat-keycloak:local
-SMS_SERVICE_IMAGE=han-chat-sms-service:local
+# Immutable production images. Replace every example digest during release materialization.
+API_BACKEND_IMAGE=registry.example.ru/han-chat/api-backend@sha256:0000000000000000000000000000000000000000000000000000000000000000
+BITRIX_LOCAL_APP_IMAGE=registry.example.ru/han-chat/bitrix-local-app@sha256:0000000000000000000000000000000000000000000000000000000000000000
+FRONTEND_STATIC_IMAGE=registry.example.ru/han-chat/frontend-static@sha256:0000000000000000000000000000000000000000000000000000000000000000
+KEYCLOAK_IMAGE=registry.example.ru/han-chat/keycloak@sha256:0000000000000000000000000000000000000000000000000000000000000000
+NGINX_IMAGE=registry.example.ru/han-chat/nginx@sha256:0000000000000000000000000000000000000000000000000000000000000000
+OTEL_COLLECTOR_IMAGE=otel/opentelemetry-collector-contrib@sha256:0000000000000000000000000000000000000000000000000000000000000000
+OTEL_QUEUE_INIT_IMAGE=alpine@sha256:0000000000000000000000000000000000000000000000000000000000000000
+REDIS_IMAGE=registry.example.ru/han-chat/redis@sha256:0000000000000000000000000000000000000000000000000000000000000000
+SMS_SERVICE_IMAGE=registry.example.ru/han-chat/sms-service@sha256:0000000000000000000000000000000000000000000000000000000000000000
+TOOLBOX_IMAGE=curlimages/curl@sha256:0000000000000000000000000000000000000000000000000000000000000000

 # Managed PostgreSQL is external to Compose. Credential-bearing DSNs are secrets.
 HAN_PG_HOST=managed-pg.private.example
 HAN_PG_PORT=5433
 HAN_PG_DATABASE=han_chat
-PG_CA_HOST_PATH=/opt/han-chat/secrets/pg/ca.pem
+PG_CA_HOST_PATH=/etc/han/ca/managed-postgresql-ca.pem
 # PgBouncer session mode uses database-level search_path; runtime DSNs must not pass options/currentSchema.
 KEYCLOAK_DB_URL=jdbc:postgresql://managed-pg.private.example:5433/han_chat?sslmode=verify-full&sslrootcert=/run/secrets/pg-ca.pem
 KEYCLOAK_DB_SCHEMA=keycloak
@@ -33,8 +37,8 @@ PUBLIC_AUTH_URL=https://chat.example.ru/auth
 NGINX_HTTP_PORT=80
 NGINX_HTTPS_PORT=443
 NGINX_TLS_ENABLED=true
-NGINX_TLS_CERTIFICATE=/etc/letsencrypt/live/chat.example.ru/fullchain.pem
-NGINX_TLS_CERTIFICATE_KEY=/etc/letsencrypt/live/chat.example.ru/privkey.pem
+NGINX_TLS_CERTIFICATE=/run/tls/fullchain.pem
+NGINX_TLS_CERTIFICATE_KEY=/run/tls/privkey.pem
 NGINX_HSTS_MAX_AGE=31536000
 NGINX_CLIENT_MAX_BODY_SIZE=8m
 NGINX_RATE_LIMIT_API=60r/m
@@ -53,7 +57,7 @@ NGINX_MESSAGE_READ_TIMEOUT_SEC=330
 NGINX_TRUSTED_PROXY_CIDR=127.0.0.1/32
 TRUSTED_PROXY_CIDRS=172.16.0.0/12
 BITRIX_FRAME_ANCESTORS=https://*.bitrix24.ru
-S3_CONNECT_SRC=https://*.s3.ru-7.storage.selcloud.ru
+S3_CONNECT_SRC=https://*.s3.ru-6.storage.selcloud.ru

 FRONTEND_DEV_PROXY_ENABLED=false
 # При false значение не используется
@@ -85,20 +89,15 @@ IDGTL_SMS_CALLBACK_PUBLIC_URL=https://chat.example.ru/callbacks/idgtl/sms
 BITRIX_LOCAL_APP_BASE_URL=http://bitrix-local-app:8080
 BITRIX_API_INBOX_PATH=/internal/openlines/v1/inbox
 BITRIX_API_FORWARD_URL=http://api-backend:8000/internal/openlines/v1/inbox
-MESSAGE_SAFETY_URL=http://message-safety:8080
+MESSAGE_SAFETY_URL=https://processing.internal:8443
+# Docker extra_hosts mapping for VM2 private listener: <hostname>=<private-ip>.
+MESSAGE_SAFETY_EXTRA_HOST=processing.internal=192.168.0.4
+MESSAGE_SAFETY_CA_HOST_PATH=/etc/han/ca/vm2-internal-ca.pem
+MESSAGE_SAFETY_API_PREFIX=/internal/safety/v2
 MESSAGE_SAFETY_POST_TIMEOUT_SEC=5
 MESSAGE_SAFETY_TASK_POLL_INTERVAL_SEC=2
 MESSAGE_SAFETY_TASK_POLL_MAX_SEC=300
-MESSAGE_SAFETY_TASK_TTL_SEC=900
-MESSAGE_SAFETY_FILE_SCAN_TIMEOUT_SEC=60
-MESSAGE_SAFETY_RULES_VERSION=2026-01-01
-#Отключение синхронизации (при отключенной синхронизации параметры ниже не работают)
-BITRIX_SYNC_ENABLED=false
-BITRIX_SYNC_CRM_BASE_URL=https://example.bitrix24.ru
-BITRIX_SYNC_CONTACT_MAP_INTERVAL_SEC=60
-BITRIX_SYNC_CONTACT_UPDATE_INTERVAL_SEC=30
-BITRIX_SYNC_CRM_MAX_CONCURRENCY=2
-BITRIX_SYNC_CONTACT_LIST_BATCH_SIZE=50
+
 BITRIX_CLIENT_ID=change-me-client-id
 BITRIX_CONNECTOR_ID=han_mobile_app
 BITRIX_CONNECTOR_NAME=HAN Mobile App