deploy: add single-host cloud profile

2026-08-26 09:00:07 +08:00
parent 43239d38f9
commit 7b32b479f5
7 changed files with 290 additions and 0 deletions
@@ -0,0 +1,167 @@
+x-server-backend-environment: &server-backend-environment
+  APP_ENV: local
+  LOG_LEVEL: info
+  DATABASE_URL: postgres://voice:${POSTGRES_PASSWORD}@postgres:5432/voice_platform?sslmode=disable
+  REDIS_ADDR: redis:6379
+  REDIS_PASSWORD: ${REDIS_PASSWORD}
+  REDIS_DB: "0"
+  AUTH_ISSUER_URL: ${PUBLIC_ORIGIN}/realms/voice-local
+  AUTH_JWKS_URL: http://keycloak:8080/realms/voice-local/protocol/openid-connect/certs
+  AUTH_AUDIENCE: voice-platform-web
+  OTEL_EXPORTER_OTLP_ENDPOINT: ""
+  OBJECT_STORE_ENDPOINT: minio:9000
+  OBJECT_STORE_PUBLIC_ENDPOINT: ${PUBLIC_HOST}
+  OBJECT_STORE_ACCESS_KEY: ${MINIO_ACCESS_KEY}
+  OBJECT_STORE_SECRET_KEY: ${MINIO_SECRET_KEY}
+  OBJECT_STORE_EXPORT_BUCKET: private-exports
+  OBJECT_STORE_REGION: us-east-1
+  OBJECT_STORE_SECURE: "false"
+  CURSOR_SIGNING_SECRET: ${CURSOR_SIGNING_SECRET}
+  SHARE_TOKEN_SIGNING_SECRET: ${SHARE_TOKEN_SIGNING_SECRET}
+  EMBEDDING_PROVIDER: local
+  VOICE_PROVIDER: mock
+
+services:
+  otel-collector:
+    ports: !reset []
+
+  prometheus:
+    ports: !reset []
+
+  grafana:
+    ports: !reset []
+
+  postgres:
+    ports: !reset []
+    environment:
+      POSTGRES_DB: voice_platform
+      POSTGRES_USER: voice
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
+    restart: unless-stopped
+
+  redis:
+    ports: !reset []
+    command: ["redis-server", "--appendonly", "yes", "--requirepass", "${REDIS_PASSWORD}"]
+    healthcheck:
+      test: ["CMD", "redis-cli", "-a", "${REDIS_PASSWORD}", "ping"]
+    restart: unless-stopped
+
+  minio:
+    ports: !reset []
+    environment:
+      MINIO_ROOT_USER: ${MINIO_ACCESS_KEY}
+      MINIO_ROOT_PASSWORD: ${MINIO_SECRET_KEY}
+    restart: unless-stopped
+
+  keycloak:
+    ports: !reset []
+    command: ["start-dev", "--import-realm"]
+    environment:
+      KC_BOOTSTRAP_ADMIN_USERNAME: ${KEYCLOAK_ADMIN_USERNAME}
+      KC_BOOTSTRAP_ADMIN_PASSWORD: ${KEYCLOAK_ADMIN_PASSWORD}
+      KC_HOSTNAME: ${PUBLIC_ORIGIN}
+      KC_HTTP_ENABLED: "true"
+      KC_PROXY_HEADERS: xforwarded
+      JAVA_OPTS_KC_HEAP: -Xms128m -Xmx384m
+    volumes:
+      - ./deploy/keycloak:/opt/keycloak/data/import:ro
+      - keycloak-data:/opt/keycloak/data
+    restart: unless-stopped
+
+  migrate:
+    command:
+      - -path=/migrations
+      - -database=postgres://voice:${POSTGRES_PASSWORD}@postgres:5432/voice_platform?sslmode=disable
+      - up
+
+  seed:
+    environment:
+      PGPASSWORD: ${POSTGRES_PASSWORD}
+
+  api:
+    image: data-terminal-cloud-backend:${PLATFORM_BUILD_VERSION}
+    pull_policy: never
+    ports: !reset []
+    environment:
+      <<: *server-backend-environment
+      HTTP_ADDR: 0.0.0.0:8080
+      DEVICE_LOCAL_SECRET: ${DEVICE_LOCAL_SECRET}
+      RTC_TOKEN_SIGNING_SECRET: ${RTC_TOKEN_SIGNING_SECRET}
+      RTC_TOKEN_ISSUER: local
+      RTC_APP_ID: local-public-rtc-app
+    restart: unless-stopped
+
+  callbacks:
+    image: data-terminal-cloud-backend:${PLATFORM_BUILD_VERSION}
+    pull_policy: never
+    ports: !reset []
+    environment:
+      <<: *server-backend-environment
+      HTTP_ADDR: 0.0.0.0:8081
+      PROVIDER_CALLBACK_SECRET: ${PROVIDER_CALLBACK_SECRET}
+      RATE_LIMIT_RPS: "1000"
+      RATE_LIMIT_BURST: "1500"
+    restart: unless-stopped
+
+  worker:
+    image: data-terminal-cloud-backend:${PLATFORM_BUILD_VERSION}
+    pull_policy: never
+    ports: !reset []
+    environment:
+      <<: *server-backend-environment
+      HTTP_ADDR: 0.0.0.0:8082
+      MOCK_PROVIDER_BASE_URL: http://mock-provider:8083
+      MOCK_PROVIDER_API_KEY: ${MOCK_PROVIDER_API_KEY}
+      ALERT_WEBHOOK_URL: http://mock-alert-receiver:8084/webhooks/alerts
+      ALERT_WEBHOOK_SECRET: ${ALERT_WEBHOOK_SECRET}
+      CONTENT_GENERATOR: local
+      CONTENT_SAFETY_PROVIDER: local
+    restart: unless-stopped
+
+  mock-provider:
+    image: data-terminal-cloud-backend:${PLATFORM_BUILD_VERSION}
+    pull_policy: never
+    ports: !reset []
+    environment:
+      HTTP_ADDR: 0.0.0.0:8083
+      MOCK_PROVIDER_API_KEY: ${MOCK_PROVIDER_API_KEY}
+      MOCK_PROVIDER_CALLBACK_URL: http://callbacks:8081/callbacks/v1/vertc/voice-chat
+      PROVIDER_CALLBACK_SECRET: ${PROVIDER_CALLBACK_SECRET}
+      MOCK_PROVIDER_START_DELAY: 100ms
+      MOCK_PROVIDER_DUPLICATE_CALLBACKS: "2"
+    restart: unless-stopped
+
+  mock-alert-receiver:
+    image: data-terminal-cloud-backend:${PLATFORM_BUILD_VERSION}
+    pull_policy: never
+    ports: !reset []
+    environment:
+      HTTP_ADDR: 0.0.0.0:8084
+      ALERT_WEBHOOK_SECRET: ${ALERT_WEBHOOK_SECRET}
+    restart: unless-stopped
+
+  web:
+    image: data-terminal-cloud-web:${PLATFORM_BUILD_VERSION}
+    pull_policy: never
+    ports: !reset []
+    environment:
+      WEB_OIDC_AUTHORITY: ${PUBLIC_ORIGIN}/realms/voice-local
+      WEB_OIDC_CLIENT_ID: voice-platform-web
+    restart: unless-stopped
+
+  gateway:
+    image: nginx:1.30-alpine
+    ports:
+      - "80:80"
+    volumes:
+      - ./deploy/server/nginx.conf:/etc/nginx/conf.d/default.conf:ro
+    depends_on:
+      - api
+      - callbacks
+      - keycloak
+      - minio
+      - web
+    restart: unless-stopped
+
+volumes:
+  keycloak-data: