Реализация на отдельных двух машинах с протестированным взаимодействием по проверке сообщений

VM1_app/codebase/backend/deployment/docker-compose.jobs.yml

@@ -32,8 +32,8 @@ x-api-job-environment: &api-job-environment
   KEYCLOAK_INTERNAL_URL: ${KEYCLOAK_INTERNAL_URL:-http://keycloak:8080/auth}
   KEYCLOAK_REALM: ${KEYCLOAK_REALM:-han-chat}
   KEYCLOAK_AUDIENCE: ${KEYCLOAK_AUDIENCE:-han-chat-api}
-  MESSAGE_SAFETY_URL: ${MESSAGE_SAFETY_URL}
-  MESSAGE_SAFETY_API_PREFIX: /internal/safety/v2
+  MESSAGE_SAFETY_URL: ${MESSAGE_SAFETY_URL:-https://processing.internal:8443}
+  MESSAGE_SAFETY_API_PREFIX: ${MESSAGE_SAFETY_API_PREFIX:-/internal/safety/v2}
   MESSAGE_SAFETY_CA_FILE: /run/config/message-safety-internal-ca.pem
   MESSAGE_SAFETY_POST_TIMEOUT_SEC: ${MESSAGE_SAFETY_POST_TIMEOUT_SEC:-5}
   MESSAGE_SAFETY_TASK_POLL_INTERVAL_SEC: ${MESSAGE_SAFETY_TASK_POLL_INTERVAL_SEC:-2}
@@ -46,9 +46,22 @@ x-api-job-environment: &api-job-environment
   SELECTEL_S3_BUCKET_QUARANTINE: ${SELECTEL_S3_BUCKET_QUARANTINE}
   TRUSTED_PROXY_CIDRS: ${TRUSTED_PROXY_CIDRS:-127.0.0.1/32}
 
+x-python-job-runtime: &python-job-runtime
+  read_only: true
+  tmpfs:
+    - /tmp:size=64m,mode=1777
+  cap_drop: ["ALL"]
+  security_opt: ["no-new-privileges:true"]
+  pids_limit: 128
+  mem_limit: 512m
+  cpus: 0.5
+  ulimits:
+    core: {soft: 0, hard: 0}
+
 services:
   migrate-api:
-    image: ${API_BACKEND_IMAGE:-han-chat-api-backend:local}
+    <<: *python-job-runtime
+    image: ${API_BACKEND_IMAGE:?API_BACKEND_IMAGE must be pinned by digest}
     profiles: ["ops"]
     environment:
       HAN_SECRET_VARS: DATABASE_URL
@@ -60,12 +73,10 @@ services:
       - ${PG_CA_HOST_PATH}:/run/secrets/pg-ca.pem:ro
     networks: [backend, egress]
     restart: "no"
-    security_opt: ["no-new-privileges:true"]
-    ulimits:
-      core: {soft: 0, hard: 0}
 
   migrate-bitrix-local:
-    image: ${BITRIX_LOCAL_APP_IMAGE:-han-chat-bitrix-local-app:local}
+    <<: *python-job-runtime
+    image: ${BITRIX_LOCAL_APP_IMAGE:?BITRIX_LOCAL_APP_IMAGE must be pinned by digest}
     profiles: ["ops"]
     environment:
       HAN_SECRET_VARS: BITRIX_DATABASE_URL
@@ -77,29 +88,10 @@ services:
       - ${PG_CA_HOST_PATH}:/run/secrets/pg-ca.pem:ro
     networks: [backend, egress]
     restart: "no"
-    security_opt: ["no-new-privileges:true"]
-    ulimits:
-      core: {soft: 0, hard: 0}
-
-  migrate-bitrix-sync:
-    image: ${BITRIX_SYNC_IMAGE:-han-chat-bitrix-sync:local}
-    profiles: ["ops"]
-    environment:
-      HAN_SECRET_VARS: BITRIX_SYNC_DATABASE_URL
-      BITRIX_SYNC_DATABASE_URL_FILE: /run/secrets/bitrix_sync_database_url
-    secrets:
-      - bitrix_sync_database_url
-    command: ["alembic", "upgrade", "head"]
-    volumes:
-      - ${PG_CA_HOST_PATH}:/run/secrets/pg-ca.pem:ro
-    networks: [backend, egress]
-    restart: "no"
-    security_opt: ["no-new-privileges:true"]
-    ulimits:
-      core: {soft: 0, hard: 0}
 
   migrate-sms:
-    image: ${SMS_SERVICE_IMAGE:-han-chat-sms-service:local}
+    <<: *python-job-runtime
+    image: ${SMS_SERVICE_IMAGE:?SMS_SERVICE_IMAGE must be pinned by digest}
     profiles: ["ops"]
     environment:
       HAN_SECRET_VARS: SMS_DATABASE_URL
@@ -111,12 +103,10 @@ services:
       - ${PG_CA_HOST_PATH}:/run/secrets/pg-ca.pem:ro
     networks: [backend, egress]
     restart: "no"
-    security_opt: ["no-new-privileges:true"]
-    ulimits:
-      core: {soft: 0, hard: 0}
 
   seed-settings:
-    image: ${API_BACKEND_IMAGE:-han-chat-api-backend:local}
+    <<: *python-job-runtime
+    image: ${API_BACKEND_IMAGE:?API_BACKEND_IMAGE must be pinned by digest}
     profiles: ["ops"]
     environment: *api-job-environment
     secrets: *api-job-secrets
@@ -133,15 +123,17 @@ services:
       - ./app-settings.production-like.yaml:/deployment/app-settings.production-like.yaml:ro
     networks: [backend, egress]
     restart: "no"
-    security_opt: ["no-new-privileges:true"]
-    ulimits:
-      core: {soft: 0, hard: 0}
 
   toolbox:
-    image: curlimages/curl:8.11.1
+    image: ${TOOLBOX_IMAGE:?TOOLBOX_IMAGE must be pinned by digest}
     profiles: ["ops"]
     entrypoint: ["sleep", "infinity"]
     networks: [backend, observability, egress]
     restart: "no"
+    read_only: true
+    tmpfs: ["/tmp:size=16m,mode=1777"]
     cap_drop: ["ALL"]
     security_opt: ["no-new-privileges:true"]
+    pids_limit: 32
+    mem_limit: 64m
+    cpus: 0.25