devops
f4bee442db
- Mount agents-sanitized.json (agents key only, no secrets) instead of full openclaw.json - Update AgentService default path from /home/node/.openclaw/openclaw.json to /etc/nexus/agents-sanitized.json - Add AgentConfigPath env var to compose for explicit path configuration - Generate sanitized file in deploy-nexus.sh before each deploy using Python extraction - Add agents-sanitized.json to .gitignore Eliminates the fragile ACL on openclaw.json (uid 1654) that causes 500 errors on the Board endpoint when lost.
143 lines
4.5 KiB
YAML
143 lines
4.5 KiB
YAML
name: nexus
|
|
services:
|
|
postgres:
|
|
image: postgres:17-alpine
|
|
# WAL-Archivierung bleibt deaktiviert, bis ein verwaltetes Off-Server-Ziel
|
|
# mit Retention und Restore-Test existiert. Ein lokales Endlosarchiv ist
|
|
# kein Backup und kann bei Fehlern pg_wal ungebremst wachsen lassen.
|
|
command:
|
|
- postgres
|
|
- -c
|
|
- archive_mode=off
|
|
- -c
|
|
- archive_command=
|
|
restart: always
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
memory: 384M
|
|
reservations:
|
|
memory: 96M
|
|
environment:
|
|
POSTGRES_INITDB_ARGS: --data-checksums
|
|
POSTGRES_DB: ${POSTGRES_DB:-nexus}
|
|
POSTGRES_USER: ${POSTGRES_USER:-nexus}
|
|
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?Set POSTGRES_PASSWORD in .env}
|
|
volumes:
|
|
- nexus-postgres:/var/lib/postgresql/data
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-nexus} -d ${POSTGRES_DB:-nexus}"]
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 5
|
|
start_period: 30s
|
|
networks: [nexus]
|
|
logging:
|
|
driver: "json-file"
|
|
options:
|
|
max-size: "10m"
|
|
max-file: "3"
|
|
api:
|
|
build:
|
|
context: ./backend
|
|
args:
|
|
NEXUS_VERSION: ${NEXUS_VERSION:-dev}
|
|
NEXUS_GIT_SHA: ${NEXUS_GIT_SHA:-unknown}
|
|
restart: always
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
memory: 512M
|
|
reservations:
|
|
memory: 128M
|
|
environment:
|
|
ASPNETCORE_ENVIRONMENT: Production
|
|
ASPNETCORE_URLS: http://+:8080
|
|
ConnectionStrings__Nexus: Host=postgres;Port=5432;Database=${POSTGRES_DB:-nexus};Username=${POSTGRES_USER:-nexus};Password=${POSTGRES_PASSWORD}
|
|
Jwt__Key: ${JWT_KEY:?Set JWT_KEY in .env}
|
|
Jwt__Issuer: ${JWT_ISSUER:-nexus}
|
|
Jwt__Audience: ${JWT_AUDIENCE:-nexus-web}
|
|
Bootstrap__OwnerEmail: ${BOOTSTRAP_OWNER_EMAIL:?Set BOOTSTRAP_OWNER_EMAIL in .env}
|
|
# Initial owner password is generated once at first seed and then lives only in the DB.
|
|
Integrations__OpenClaw__BaseUrl: ${OPENCLAW_BASE_URL:-http://openclaw-gateway-bao:18789}
|
|
Integrations__OpenClaw__Token: ${OPENCLAW_GATEWAY_TOKEN:-}
|
|
Integrations__OpenClaw__Password: ${OPENCLAW_GATEWAY_PASSWORD:-}
|
|
Admin__ResetToken: ${Admin__ResetToken:-}
|
|
NexusApiKey: ${NEXUS_API_KEY:-}
|
|
AgentConfigPath: /etc/nexus/agents-sanitized.json
|
|
extra_hosts:
|
|
- host.docker.internal:host-gateway
|
|
depends_on:
|
|
postgres:
|
|
condition: service_healthy
|
|
restart: true
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "wget --no-verbose --tries=1 --spider http://localhost:8080/health/live || exit 1"]
|
|
interval: 30s
|
|
timeout: 10s
|
|
retries: 3
|
|
start_period: 15s
|
|
volumes:
|
|
- /home/projekte_bao/openclaw/data/openclaw/agents-sanitized.json:/etc/nexus/agents-sanitized.json:ro
|
|
- /home/projekte_bao/openclaw/data/openclaw/workspace-iris:/mnt/workspace-iris
|
|
- /home/projekte_bao/openclaw/data/openclaw/workspace-programmer:/mnt/workspace-programmer
|
|
- /home/projekte_bao/openclaw/data/openclaw/workspace-reviewer:/mnt/workspace-reviewer
|
|
- /home/projekte_bao/openclaw/data/openclaw/workspace-architekt:/mnt/workspace-architekt
|
|
- /home/projekte_bao/openclaw/data/openclaw/workspace-researcher:/mnt/workspace-researcher
|
|
- /home/projekte_bao/openclaw/data/openclaw/workspace-executor:/mnt/workspace-executor
|
|
networks:
|
|
- nexus
|
|
- openclaw_default
|
|
logging:
|
|
driver: "json-file"
|
|
options:
|
|
max-size: "10m"
|
|
max-file: "3"
|
|
web:
|
|
build:
|
|
context: ./frontend
|
|
args:
|
|
NEXUS_VERSION: ${NEXUS_VERSION:-dev}
|
|
NEXUS_GIT_SHA: ${NEXUS_GIT_SHA:-unknown}
|
|
restart: always
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
memory: 128M
|
|
reservations:
|
|
memory: 32M
|
|
labels:
|
|
- "traefik.enable=true"
|
|
- "traefik.http.routers.nexus.rule=Host(`nexus.noveria.net`)"
|
|
- "traefik.http.routers.nexus.tls=true"
|
|
- "traefik.http.routers.nexus.tls.certresolver=letsencrypt"
|
|
- "traefik.http.services.nexus.loadbalancer.server.port=80"
|
|
ports:
|
|
- "127.0.0.1:18880:80"
|
|
depends_on:
|
|
api:
|
|
condition: service_healthy
|
|
restart: true
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "curl -f http://localhost:80/ || exit 1"]
|
|
interval: 30s
|
|
timeout: 10s
|
|
retries: 3
|
|
start_period: 10s
|
|
networks:
|
|
- nexus
|
|
- proxy
|
|
logging:
|
|
driver: "json-file"
|
|
options:
|
|
max-size: "10m"
|
|
max-file: "3"
|
|
networks:
|
|
nexus:
|
|
openclaw_default:
|
|
external: true
|
|
proxy:
|
|
external: true
|
|
volumes:
|
|
nexus-postgres:
|