chore: checkpoint 第一版

2026-09-06 17:04:11 +08:00
parent a8cdec98d1
commit 0c2151ace9
659 changed files with 185855 additions and 554 deletions
@@ -1,4 +1,5 @@
 FROM golang:1.26.6-alpine AS build
+ARG GOPROXY=https://proxy.golang.org,direct
 WORKDIR /src
 COPY go.mod go.sum ./
 RUN go mod download
@@ -50,6 +50,17 @@ data:
  VOLC_RTC_BASE_URL: https://rtc.volcengineapi.com
  VOLC_RTC_REGION: cn-north-1
  VOLC_RTC_API_VERSION: "2024-12-01"
+  # Platform-owned product defaults. Devices receive these only through the
+  # signed provisioning/session control plane and cannot override them.
+  VOLC_HARDWARE_AGENT_BOT_ID: "replace-with-product-default-bot-id"
+  VOLC_HARDWARE_AGENT_TRANSPORT: "high_quality"
+  VOLC_HARDWARE_AGENT_MINIMUM_SDK_VERSION: "1.0.0"
+  VOLC_HARDWARE_PROVISIONING_ENABLED: "false"
+  VOLC_HARDWARE_INSTANCE_ID: ""
+  VOLC_HARDWARE_PRODUCT_KEY: ""
+  VOLC_HARDWARE_REGISTER_URL: https://iot-cn-shanghai.iot.volces.com/2021-12-14/DynamicRegister?Action=DynamicRegister&Version=2021-12-14
+  VOLC_HARDWARE_REGISTER_TIMEOUT: 10s
+  VOLC_HARDWARE_DEVICE_NAME_PREFIX: "dt-"
  CONTENT_GENERATOR: ark
  CONTENT_SAFETY_PROVIDER: managed_http
  CONTENT_SAFETY_ENDPOINT: https://content-safety.example.invalid/v1/classify
@@ -19,7 +19,7 @@ metadata:
 spec:
  provider: replace-with-installed-provider
  parameters:
-    objects: replace-with-provider-specific-rtc-app-key-cursor-share-and-device-credential-master-key
+    objects: replace-with-provider-specific-rtc-app-key-cursor-share-device-credential-master-key-volc-hardware-product-secret-and-volc-device-credential-master-key
 ---
 apiVersion: secrets-store.csi.x-k8s.io/v1
 kind: SecretProviderClass
@@ -6,6 +6,13 @@ metadata:
 spec:
  template:
    spec:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65532
+        runAsGroup: 65532
+        fsGroup: 65532
+        seccompProfile:
+          type: RuntimeDefault
      volumes:
        - $patch: replace
        - name: common-secrets
@@ -35,6 +42,13 @@ metadata:
 spec:
  template:
    spec:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65532
+        runAsGroup: 65532
+        fsGroup: 65532
+        seccompProfile:
+          type: RuntimeDefault
      volumes:
        - $patch: replace
        - name: common-secrets
@@ -58,6 +72,13 @@ metadata:
 spec:
  template:
    spec:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65532
+        runAsGroup: 65532
+        fsGroup: 65532
+        seccompProfile:
+          type: RuntimeDefault
      volumes:
        - $patch: replace
        - name: common-secrets
@@ -1,3 +1,4 @@
 FROM migrate/migrate:v4.18.3

-COPY migrations /migrations
+COPY --chown=65532:65532 migrations /migrations
+USER 65532:65532
@@ -2,6 +2,8 @@

 该配置用于单机公网演示，不是生产验收配置。只向公网发布HTTP 80和HTTPS 443；PostgreSQL、Redis、MinIO、Keycloak内部端口以及API/Worker端口均不映射到宿主机。当前阿里云演示机使用Let's Encrypt短期IP证书，`certbot-ip-renew.timer`负责自动续期。单机备份覆盖PostgreSQL、Redis、MinIO对象和当前Keycloak数据目录，并执行数据库级隔离恢复校验；五分钟健康检查覆盖部署模式、公网入口、OIDC、容器、模拟服务、备份、外部告警、证书、定时任务和磁盘。跨故障域备份、真实告警接收器、真实RTC、模型、内容安全和云KMS仍按阶段8验收清单执行。

+无法直接从Git拉取或需要冻结当前工作树时，可先在开发机执行`powershell -NoProfile -ExecutionPolicy Bypass -File .\scripts\build-server-deployment-bundle.ps1 -Version 0.76.0-rc.hardware1`，再用`powershell -NoProfile -ExecutionPolicy Bypass -File .\scripts\verify-server-deployment-bundle.ps1 -Archive .\.deploy-artifacts\data-terminal-cloud-0.76.0-rc.hardware1.zip`验证。归档包含`deploy-manifest.json`和`SHA256SUMS`，不会打包`.env`、设备/供应商密钥、本地运行目录、`node_modules`或构建缓存。上传服务器后必须再次核对归档侧车`.sha256`和包内清单，再覆盖候选目录；服务器现有`deploy/server/.env`及`/etc/data-terminal-cloud`密钥目录不得从归档替换。
+
 服务器至少需要Docker Engine 29与Compose 2.40。首次部署先生成权限为600的服务器专用配置：

 ```sh
@@ -30,6 +32,15 @@ docker compose -f compose.yaml -f deploy/server/compose.override.yaml \

 需要在演示机接入真实RTC、豆包语音和方舟摘要时，把凭据文件以`0600`权限放入`/etc/data-terminal-cloud/voice-runtime`，并在`deploy/server/.env`设置`RTC_TOKEN_ISSUER=volcengine`、`VOICE_PROVIDER=volcengine`、`RTC_APP_ID`、`CONTENT_GENERATOR`和`ARK_CONTENT_MODEL`。Compose只读挂载该目录，敏感值不进入源码、镜像或环境文件。

+切换火山硬件对话智能体时，维护中心逐台只需把`voice_runtime`设为`volc_hardware_agent`，不填写设备级Bot。平台代设备动态注册时，在`deploy/server/.env`设置`VOLC_HARDWARE_PROVISIONING_ENABLED=true`、`VOLC_HARDWARE_INSTANCE_ID`、`VOLC_HARDWARE_PRODUCT_KEY`、`VOLC_HARDWARE_AGENT_BOT_ID`、`VOLC_HARDWARE_AGENT_TRANSPORT`、`VOLC_HARDWARE_AGENT_MINIMUM_SDK_VERSION`、`VOLC_HARDWARE_PRODUCT_SECRET_FILE=/run/secrets/voice-runtime/volc-hardware-product-secret`和独立随机的`VOLC_HARDWARE_DEVICE_CREDENTIAL_MASTER_KEY`；将Product Secret以单行、`0600`权限写入`/etc/data-terminal-cloud/voice-runtime/volc-hardware-product-secret`。Product Secret不得进入`.env`、源码、镜像、数据库或设备。设备首次预配时，平台根据这些产品默认值自动创建火山绑定并调用DynamicRegister；火山从产品额度中分配License，平台只加密保存并下发本设备的一机一密Device Secret，不下发License明文。发布前必须验证平台代理注册、默认Bot绑定、每次会话上下文注入、`session.updated`确认后激活、`session_updated`存活上报、`stop_session`执行和最终字幕补传。
+
+```sh
+sudo install -d -m 0700 /etc/data-terminal-cloud/voice-runtime
+sudo sh -c 'umask 077; read -r product_secret; printf "%s" "$product_secret" > /etc/data-terminal-cloud/voice-runtime/volc-hardware-product-secret'
+```
+
+上面的`read`从终端读取，不要把真实Product Secret写进Shell历史。启用前确认默认Bot关联的产品与`VOLC_HARDWARE_PRODUCT_KEY`完全一致；Device Name由`dt-`加平台设备UUID稳定生成。密钥文件或产品默认配置缺失、格式错误时API拒绝启动，未启用时凭据接口明确返回`HARDWARE_AGENT_PROVISIONING_UNAVAILABLE`。
+
 设备HMAC密钥由`device_credential`表以AES-256-GCM密文保存。`deploy/server/.env`中的`DEVICE_CREDENTIAL_MASTER_KEY`只负责数据库密文的认证解密，不得写入数据库或设备；既有`DEVICE_LOCAL_SECRET`只用于首次部署升级时导入两台演示设备，确认数据库凭据记录完整后可移除。新增、轮换和吊销设备密钥使用后端镜像内的`/app/device-credential`维护命令，生成的设备明文密钥只显示一次。

 通话内记忆工具只通过网关精确开放`/internal/v1/tools/memory-search`，请求必须携带平台为当前通话签发的短期任务令牌。`MEMORY_TOOL_SIGNING_SECRET`必须是服务器独立随机密钥，不得与游标签名、分享签名或RTC密钥复用；网关不会开放其他`/internal`路径。
@@ -34,6 +34,7 @@ umask 077
  printf 'KEYCLOAK_ADMIN_PASSWORD=%s\n' "$(openssl rand -hex 24)"
  printf 'DEVICE_LOCAL_SECRET=%s\n' "$(openssl rand -hex 32)"
  printf 'DEVICE_CREDENTIAL_MASTER_KEY=%s\n' "$(openssl rand -hex 32)"
+  printf 'VOLC_HARDWARE_DEVICE_CREDENTIAL_MASTER_KEY=%s\n' "$(openssl rand -hex 32)"
  printf 'MODEL_CREDENTIAL_MASTER_KEY=%s\n' "$(openssl rand -hex 32)"
  printf 'RTC_TOKEN_SIGNING_SECRET=%s\n' "$(openssl rand -hex 32)"
  printf 'CURSOR_SIGNING_SECRET=%s\n' "$(openssl rand -hex 32)"
@@ -102,6 +102,16 @@ services:
      RTC_APP_ID: ${RTC_APP_ID:-local-public-rtc-app}
      RTC_APP_KEY: ""
      RTC_APP_KEY_FILE: ${RTC_APP_KEY_FILE:-/run/secrets/voice-runtime/rtc-app-key}
+      VOLC_HARDWARE_PROVISIONING_ENABLED: ${VOLC_HARDWARE_PROVISIONING_ENABLED:-false}
+      VOLC_HARDWARE_INSTANCE_ID: ${VOLC_HARDWARE_INSTANCE_ID:-}
+      VOLC_HARDWARE_PRODUCT_KEY: ${VOLC_HARDWARE_PRODUCT_KEY:-}
+      VOLC_HARDWARE_AGENT_BOT_ID: ${VOLC_HARDWARE_AGENT_BOT_ID:-}
+      VOLC_HARDWARE_AGENT_TRANSPORT: ${VOLC_HARDWARE_AGENT_TRANSPORT:-low_load}
+      VOLC_HARDWARE_AGENT_MINIMUM_SDK_VERSION: ${VOLC_HARDWARE_AGENT_MINIMUM_SDK_VERSION:-1.0.0}
+      VOLC_HARDWARE_PRODUCT_SECRET: ""
+      VOLC_HARDWARE_PRODUCT_SECRET_FILE: ${VOLC_HARDWARE_PRODUCT_SECRET_FILE:-}
+      VOLC_HARDWARE_DEVICE_CREDENTIAL_MASTER_KEY: ${VOLC_HARDWARE_DEVICE_CREDENTIAL_MASTER_KEY:-}
+      VOLC_HARDWARE_DEVICE_NAME_PREFIX: ${VOLC_HARDWARE_DEVICE_NAME_PREFIX:-dt-}
    volumes:
      - /etc/data-terminal-cloud/voice-runtime:/run/secrets/voice-runtime:ro
    restart: unless-stopped
@@ -1,4 +1,5 @@
 FROM node:24-alpine AS build
+ARG NPM_CONFIG_REGISTRY=https://registry.npmjs.org
 WORKDIR /src
 COPY web/package*.json ./
 RUN npm ci
@@ -15,6 +16,10 @@ LABEL org.opencontainers.image.version="${VERSION}" \
      org.opencontainers.image.created="${BUILD_TIME}"
 USER root
 RUN apk upgrade --no-cache
+# The image's IPv6 helper shells out to `apk manifest nginx` on every start.
+# On small production hosts that command can block even after the package
+# database is healthy. This deployment owns default.conf and does not need it.
+RUN rm -f /docker-entrypoint.d/10-listen-on-ipv6-by-default.sh
 COPY --chown=101:101 deploy/web.nginx.conf /etc/nginx/conf.d/default.conf
 COPY --chmod=755 --chown=101:101 deploy/web-runtime-config.sh /docker-entrypoint.d/40-runtime-config.sh
 COPY --chown=101:101 --from=build /src/dist /usr/share/nginx/html