developer
17dc84082c
Completes P4 migration: Nexus API no longer reads openclaw.json. Changes: - AgentService: default path -> agents-sanitized.json - OpenClawGatewayClient: LoadAgentIdsFromConfig + GetAvailableModels both now read from agents-sanitized.json - compose.yaml: mount agents-sanitized.json instead of openclaw.json The deploy script (.gitea/scripts/deploy-nexus.sh) already generates agents-sanitized.json during deployment, extracting only the section (list + defaults) without gateway/auth/password secrets. DoD: - No read access to openclaw.json from Nexus API container - No uid-1654 ACL dependency for agent identity resolution - No secrets in agent responses or config files
133 lines
4.2 KiB
YAML
133 lines
4.2 KiB
YAML
name: nexus
|
|
services:
|
|
postgres:
|
|
image: postgres:17-alpine
|
|
restart: always
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
memory: 384M
|
|
reservations:
|
|
memory: 96M
|
|
environment:
|
|
POSTGRES_INITDB_ARGS: --data-checksums
|
|
POSTGRES_DB: ${POSTGRES_DB:-nexus}
|
|
POSTGRES_USER: ${POSTGRES_USER:-nexus}
|
|
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?Set POSTGRES_PASSWORD in .env}
|
|
volumes:
|
|
- nexus-postgres:/var/lib/postgresql/data
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-nexus} -d ${POSTGRES_DB:-nexus}"]
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 5
|
|
start_period: 30s
|
|
networks: [nexus]
|
|
logging:
|
|
driver: "json-file"
|
|
options:
|
|
max-size: "10m"
|
|
max-file: "3"
|
|
api:
|
|
build:
|
|
context: ./backend
|
|
args:
|
|
NEXUS_VERSION: ${NEXUS_VERSION:-dev}
|
|
NEXUS_GIT_SHA: ${NEXUS_GIT_SHA:-unknown}
|
|
restart: always
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
memory: 512M
|
|
reservations:
|
|
memory: 128M
|
|
environment:
|
|
ASPNETCORE_ENVIRONMENT: Production
|
|
ASPNETCORE_URLS: http://+:8080
|
|
ConnectionStrings__Nexus: Host=postgres;Port=5432;Database=${POSTGRES_DB:-nexus};Username=${POSTGRES_USER:-nexus};Password=${POSTGRES_PASSWORD}
|
|
Jwt__Key: ${JWT_KEY:?Set JWT_KEY in .env}
|
|
Jwt__Issuer: ${JWT_ISSUER:-nexus}
|
|
Jwt__Audience: ${JWT_AUDIENCE:-nexus-web}
|
|
Bootstrap__OwnerEmail: ${BOOTSTRAP_OWNER_EMAIL:?Set BOOTSTRAP_OWNER_EMAIL in .env}
|
|
# Initial owner password is generated once at first seed and then lives only in the DB.
|
|
Integrations__OpenClaw__BaseUrl: ${OPENCLAW_BASE_URL:-http://host.docker.internal:18789}
|
|
Integrations__OpenClaw__Token: ${OPENCLAW_GATEWAY_TOKEN:-}
|
|
Integrations__OpenClaw__Password: ${OPENCLAW_GATEWAY_PASSWORD:-}
|
|
Admin__ResetToken: ${Admin__ResetToken:-}
|
|
NexusApiKey: ${NEXUS_API_KEY:-}
|
|
extra_hosts:
|
|
- host.docker.internal:host-gateway
|
|
depends_on:
|
|
postgres:
|
|
condition: service_started
|
|
restart: true
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "wget --no-verbose --tries=1 --spider http://localhost:8080/health/live || exit 1"]
|
|
interval: 30s
|
|
timeout: 10s
|
|
retries: 3
|
|
start_period: 15s
|
|
volumes:
|
|
- /home/projekte_bao/openclaw/data/openclaw/agents-sanitized.json:/home/node/.openclaw/agents-sanitized.json:ro
|
|
- /home/projekte_bao/openclaw/data/openclaw/workspace-iris:/mnt/workspace-iris
|
|
- /home/projekte_bao/openclaw/data/openclaw/workspace-programmer:/mnt/workspace-programmer
|
|
- /home/projekte_bao/openclaw/data/openclaw/workspace-reviewer:/mnt/workspace-reviewer
|
|
- /home/projekte_bao/openclaw/data/openclaw/workspace-architekt:/mnt/workspace-architekt
|
|
- /home/projekte_bao/openclaw/data/openclaw/workspace-researcher:/mnt/workspace-researcher
|
|
- /home/projekte_bao/openclaw/data/openclaw/workspace-executor:/mnt/workspace-executor
|
|
networks:
|
|
- nexus
|
|
- openclaw_default
|
|
logging:
|
|
driver: "json-file"
|
|
options:
|
|
max-size: "10m"
|
|
max-file: "3"
|
|
web:
|
|
build:
|
|
context: ./frontend
|
|
args:
|
|
NEXUS_VERSION: ${NEXUS_VERSION:-dev}
|
|
NEXUS_GIT_SHA: ${NEXUS_GIT_SHA:-unknown}
|
|
restart: always
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
memory: 128M
|
|
reservations:
|
|
memory: 32M
|
|
labels:
|
|
- "traefik.enable=true"
|
|
- "traefik.http.routers.nexus.rule=Host(`nexus.noveria.net`)"
|
|
- "traefik.http.routers.nexus.tls=true"
|
|
- "traefik.http.routers.nexus.tls.certresolver=letsencrypt"
|
|
- "traefik.http.services.nexus.loadbalancer.server.port=80"
|
|
ports:
|
|
- "127.0.0.1:18880:80"
|
|
depends_on:
|
|
api:
|
|
condition: service_started
|
|
restart: true
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "curl -f http://localhost:80/ || exit 1"]
|
|
interval: 30s
|
|
timeout: 10s
|
|
retries: 3
|
|
start_period: 10s
|
|
networks:
|
|
- nexus
|
|
- proxy
|
|
logging:
|
|
driver: "json-file"
|
|
options:
|
|
max-size: "10m"
|
|
max-file: "3"
|
|
networks:
|
|
nexus:
|
|
openclaw_default:
|
|
external: true
|
|
proxy:
|
|
external: true
|
|
volumes:
|
|
nexus-postgres:
|