215 lines
15 KiB
YAML
215 lines
15 KiB
YAML
services:
|
|
contract-api-migrate:
|
|
image: ${CONTRACT_API_IMAGE:?CONTRACT_API_IMAGE must reference the immutable UAT candidate}
|
|
build: !reset null
|
|
|
|
contract-review-worker:
|
|
image: ${CONTRACT_API_IMAGE:?CONTRACT_API_IMAGE must reference the immutable UAT candidate}
|
|
build: !reset null
|
|
|
|
ai-platform-api-migrate:
|
|
image: ${AI_PLATFORM_API_IMAGE:?AI_PLATFORM_API_IMAGE must reference the immutable UAT candidate}
|
|
build: !reset null
|
|
|
|
ai-platform-prompt-assets-import:
|
|
image: ${AI_PLATFORM_API_IMAGE:?AI_PLATFORM_API_IMAGE must reference the immutable UAT candidate}
|
|
build: !reset null
|
|
|
|
ai-platform-api:
|
|
image: ${AI_PLATFORM_API_IMAGE:?AI_PLATFORM_API_IMAGE must reference the immutable UAT candidate}
|
|
build: !reset null
|
|
|
|
worker:
|
|
image: ${AI_WORKER_IMAGE:?AI_WORKER_IMAGE must reference the immutable UAT candidate}
|
|
build: !reset null
|
|
|
|
contract-web:
|
|
image: ${CONTRACT_WEB_IMAGE:?CONTRACT_WEB_IMAGE must reference the immutable UAT candidate}
|
|
build: !reset null
|
|
|
|
kms-gateway-aliyun:
|
|
image: ${KMS_GATEWAY_IMAGE:?KMS_GATEWAY_IMAGE must reference an immutable UAT image}
|
|
restart: unless-stopped
|
|
command: ["python", "-m", "uvicorn", "yuqei_kms_gateway.main:app", "--host", "0.0.0.0", "--port", "8102", "--ssl-keyfile", "/run/yuqei/tls/tls.key", "--ssl-certfile", "/run/yuqei/tls/tls.crt"]
|
|
environment:
|
|
YUQEI_KMS_GATEWAY_PROVIDER: aliyun
|
|
YUQEI_KMS_GATEWAY_AUTH_TOKEN_FILE: /run/yuqei/kms/service-token
|
|
YUQEI_KMS_GATEWAY_ALLOWED_KEY_IDS: ${UAT_ALIYUN_ENCRYPTION_KEY_ID:?required}
|
|
YUQEI_KMS_GATEWAY_ALLOWED_SIGNING_KEY_IDS: ${UAT_ALIYUN_EVIDENCE_KEY_ID:?required},${UAT_ALIYUN_WITNESS_KEY_ID:?required}
|
|
YUQEI_KMS_GATEWAY_ALIYUN_ENDPOINT: ${UAT_ALIYUN_KMS_ENDPOINT:?required}
|
|
YUQEI_KMS_GATEWAY_ALIYUN_CLIENT_KEY_FILE: /run/yuqei/kms/aliyun-client-key.json
|
|
YUQEI_KMS_GATEWAY_ALIYUN_CLIENT_KEY_PASSWORD_FILE: /run/yuqei/kms/aliyun-client-key-password
|
|
YUQEI_KMS_GATEWAY_ALIYUN_CA_FILE: /run/yuqei/kms/aliyun-ca.pem
|
|
volumes:
|
|
- ${UAT_ALIYUN_KMS_TOKEN_FILE:?required}:/run/yuqei/kms/service-token:ro
|
|
- ${UAT_ALIYUN_KMS_CLIENT_KEY_FILE:?required}:/run/yuqei/kms/aliyun-client-key.json:ro
|
|
- ${UAT_ALIYUN_KMS_CLIENT_KEY_PASSWORD_FILE:?required}:/run/yuqei/kms/aliyun-client-key-password:ro
|
|
- ${UAT_ALIYUN_KMS_PROVIDER_CA_FILE:?required}:/run/yuqei/kms/aliyun-ca.pem:ro
|
|
- ${UAT_ALIYUN_GATEWAY_TLS_CERT_FILE:?required}:/run/yuqei/tls/tls.crt:ro
|
|
- ${UAT_ALIYUN_GATEWAY_TLS_KEY_FILE:?required}:/run/yuqei/tls/tls.key:ro
|
|
- ${UAT_ALIYUN_GATEWAY_CA_FILE:?required}:/run/yuqei/tls/ca.pem:ro
|
|
read_only: true
|
|
tmpfs: [/tmp]
|
|
security_opt: [no-new-privileges:true]
|
|
healthcheck:
|
|
test: ["CMD", "python", "-c", "import json,ssl,urllib.request; c=ssl.create_default_context(cafile='/run/yuqei/tls/ca.pem'); d=json.load(urllib.request.urlopen('https://kms-gateway-aliyun:8102/health',context=c,timeout=5)); assert d['configured']"]
|
|
interval: 15s
|
|
timeout: 6s
|
|
retries: 8
|
|
|
|
kms-gateway-tencent:
|
|
image: ${KMS_GATEWAY_IMAGE:?KMS_GATEWAY_IMAGE must reference an immutable UAT image}
|
|
restart: unless-stopped
|
|
command: ["python", "-m", "uvicorn", "yuqei_kms_gateway.main:app", "--host", "0.0.0.0", "--port", "8102", "--ssl-keyfile", "/run/yuqei/tls/tls.key", "--ssl-certfile", "/run/yuqei/tls/tls.crt"]
|
|
environment:
|
|
YUQEI_KMS_GATEWAY_PROVIDER: tencentcloud
|
|
YUQEI_KMS_GATEWAY_AUTH_TOKEN_FILE: /run/yuqei/kms/service-token
|
|
YUQEI_KMS_GATEWAY_ALLOWED_KEY_IDS: ${UAT_TENCENT_ENCRYPTION_KEY_ID:?required}
|
|
YUQEI_KMS_GATEWAY_ALLOWED_SIGNING_KEY_IDS: ${UAT_TENCENT_EVIDENCE_KEY_ID:?required},${UAT_TENCENT_WITNESS_KEY_ID:?required}
|
|
YUQEI_KMS_GATEWAY_TENCENT_REGION: ${UAT_TENCENT_KMS_REGION:?required}
|
|
YUQEI_KMS_GATEWAY_TENCENT_ENDPOINT: ${UAT_TENCENT_KMS_ENDPOINT:-kms.tencentcloudapi.com}
|
|
YUQEI_KMS_GATEWAY_TENCENT_CREDENTIAL_FILE: /run/yuqei/kms/tencent-credential.json
|
|
volumes:
|
|
- ${UAT_TENCENT_KMS_TOKEN_FILE:?required}:/run/yuqei/kms/service-token:ro
|
|
- ${UAT_TENCENT_KMS_CREDENTIAL_FILE:?required}:/run/yuqei/kms/tencent-credential.json:ro
|
|
- ${UAT_TENCENT_GATEWAY_TLS_CERT_FILE:?required}:/run/yuqei/tls/tls.crt:ro
|
|
- ${UAT_TENCENT_GATEWAY_TLS_KEY_FILE:?required}:/run/yuqei/tls/tls.key:ro
|
|
- ${UAT_TENCENT_GATEWAY_CA_FILE:?required}:/run/yuqei/tls/ca.pem:ro
|
|
read_only: true
|
|
tmpfs: [/tmp]
|
|
security_opt: [no-new-privileges:true]
|
|
healthcheck:
|
|
test: ["CMD", "python", "-c", "import json,ssl,urllib.request; c=ssl.create_default_context(cafile='/run/yuqei/tls/ca.pem'); d=json.load(urllib.request.urlopen('https://kms-gateway-tencent:8102/health',context=c,timeout=5)); assert d['configured']"]
|
|
interval: 15s
|
|
timeout: 6s
|
|
retries: 8
|
|
|
|
evidence-witness-aliyun:
|
|
image: ${EVIDENCE_WITNESS_GATEWAY_IMAGE:?EVIDENCE_WITNESS_GATEWAY_IMAGE must reference an immutable UAT image}
|
|
restart: unless-stopped
|
|
command: ["python", "-m", "uvicorn", "yuqei_evidence_witness_gateway.main:app", "--host", "0.0.0.0", "--port", "8112", "--ssl-keyfile", "/run/yuqei/tls/tls.key", "--ssl-certfile", "/run/yuqei/tls/tls.crt"]
|
|
environment:
|
|
YUQEI_EVIDENCE_WITNESS_ENVIRONMENT: uat
|
|
YUQEI_EVIDENCE_WITNESS_PROVIDER: aliyun_oss_worm
|
|
YUQEI_EVIDENCE_WITNESS_AUTH_TOKEN_FILE: /run/yuqei/witness/inbound-token
|
|
YUQEI_EVIDENCE_WITNESS_STORAGE_CREDENTIAL_FILE: /run/yuqei/witness/storage-credential.json
|
|
YUQEI_EVIDENCE_WITNESS_STORAGE_BUCKET: ${UAT_ALIYUN_WITNESS_BUCKET:?required}
|
|
YUQEI_EVIDENCE_WITNESS_STORAGE_REGION: ${UAT_ALIYUN_WITNESS_REGION:?required}
|
|
YUQEI_EVIDENCE_WITNESS_STORAGE_ENDPOINT: ${UAT_ALIYUN_WITNESS_ENDPOINT:?required}
|
|
YUQEI_EVIDENCE_WITNESS_RETENTION_DAYS: ${UAT_WITNESS_RETENTION_DAYS:-365}
|
|
YUQEI_EVIDENCE_WITNESS_KMS_GATEWAY_ENDPOINT: https://kms-gateway-aliyun:8102
|
|
YUQEI_EVIDENCE_WITNESS_KMS_GATEWAY_AUTH_TOKEN_FILE: /run/yuqei/kms/service-token
|
|
YUQEI_EVIDENCE_WITNESS_KMS_GATEWAY_CA_FILE: /run/yuqei/kms/ca.pem
|
|
YUQEI_EVIDENCE_WITNESS_SIGNING_KEY_ID: ${UAT_ALIYUN_WITNESS_KEY_ID:?required}
|
|
YUQEI_EVIDENCE_WITNESS_SIGNING_KEY_VERSION: ${UAT_ALIYUN_WITNESS_KEY_VERSION:?required}
|
|
YUQEI_EVIDENCE_WITNESS_SIGNING_ALGORITHM: ${UAT_ALIYUN_WITNESS_ALGORITHM:-RSA_PSS_SHA_256}
|
|
volumes:
|
|
- ${UAT_ALIYUN_WITNESS_TOKEN_FILE:?required}:/run/yuqei/witness/inbound-token:ro
|
|
- ${UAT_ALIYUN_OSS_CREDENTIAL_FILE:?required}:/run/yuqei/witness/storage-credential.json:ro
|
|
- ${UAT_ALIYUN_KMS_TOKEN_FILE:?required}:/run/yuqei/kms/service-token:ro
|
|
- ${UAT_ALIYUN_GATEWAY_CA_FILE:?required}:/run/yuqei/kms/ca.pem:ro
|
|
- ${UAT_ALIYUN_WITNESS_TLS_CERT_FILE:?required}:/run/yuqei/tls/tls.crt:ro
|
|
- ${UAT_ALIYUN_WITNESS_TLS_KEY_FILE:?required}:/run/yuqei/tls/tls.key:ro
|
|
- ${UAT_ALIYUN_WITNESS_CA_FILE:?required}:/run/yuqei/tls/ca.pem:ro
|
|
read_only: true
|
|
tmpfs: [/tmp]
|
|
security_opt: [no-new-privileges:true]
|
|
depends_on:
|
|
kms-gateway-aliyun: { condition: service_healthy }
|
|
healthcheck:
|
|
test: ["CMD", "python", "-c", "import json,ssl,urllib.request,pathlib; t=pathlib.Path('/run/yuqei/witness/inbound-token').read_text().strip(); q=urllib.request.Request('https://evidence-witness-aliyun:8112/ready',headers={'Authorization':'Bearer '+t}); c=ssl.create_default_context(cafile='/run/yuqei/tls/ca.pem'); d=json.load(urllib.request.urlopen(q,context=c,timeout=10)); assert d['ready']"]
|
|
interval: 20s
|
|
timeout: 12s
|
|
retries: 8
|
|
|
|
evidence-witness-tencent:
|
|
image: ${EVIDENCE_WITNESS_GATEWAY_IMAGE:?EVIDENCE_WITNESS_GATEWAY_IMAGE must reference an immutable UAT image}
|
|
restart: unless-stopped
|
|
command: ["python", "-m", "uvicorn", "yuqei_evidence_witness_gateway.main:app", "--host", "0.0.0.0", "--port", "8112", "--ssl-keyfile", "/run/yuqei/tls/tls.key", "--ssl-certfile", "/run/yuqei/tls/tls.crt"]
|
|
environment:
|
|
YUQEI_EVIDENCE_WITNESS_ENVIRONMENT: uat
|
|
YUQEI_EVIDENCE_WITNESS_PROVIDER: tencent_cos_object_lock
|
|
YUQEI_EVIDENCE_WITNESS_AUTH_TOKEN_FILE: /run/yuqei/witness/inbound-token
|
|
YUQEI_EVIDENCE_WITNESS_STORAGE_CREDENTIAL_FILE: /run/yuqei/witness/storage-credential.json
|
|
YUQEI_EVIDENCE_WITNESS_STORAGE_BUCKET: ${UAT_TENCENT_WITNESS_BUCKET:?required}
|
|
YUQEI_EVIDENCE_WITNESS_STORAGE_REGION: ${UAT_TENCENT_WITNESS_REGION:?required}
|
|
YUQEI_EVIDENCE_WITNESS_STORAGE_ENDPOINT: ${UAT_TENCENT_WITNESS_ENDPOINT:?required}
|
|
YUQEI_EVIDENCE_WITNESS_RETENTION_DAYS: ${UAT_WITNESS_RETENTION_DAYS:-365}
|
|
YUQEI_EVIDENCE_WITNESS_KMS_GATEWAY_ENDPOINT: https://kms-gateway-tencent:8102
|
|
YUQEI_EVIDENCE_WITNESS_KMS_GATEWAY_AUTH_TOKEN_FILE: /run/yuqei/kms/service-token
|
|
YUQEI_EVIDENCE_WITNESS_KMS_GATEWAY_CA_FILE: /run/yuqei/kms/ca.pem
|
|
YUQEI_EVIDENCE_WITNESS_SIGNING_KEY_ID: ${UAT_TENCENT_WITNESS_KEY_ID:?required}
|
|
YUQEI_EVIDENCE_WITNESS_SIGNING_KEY_VERSION: ${UAT_TENCENT_WITNESS_KEY_VERSION:?required}
|
|
YUQEI_EVIDENCE_WITNESS_SIGNING_ALGORITHM: ${UAT_TENCENT_WITNESS_ALGORITHM:-RSA_PSS_SHA_256}
|
|
volumes:
|
|
- ${UAT_TENCENT_WITNESS_TOKEN_FILE:?required}:/run/yuqei/witness/inbound-token:ro
|
|
- ${UAT_TENCENT_COS_CREDENTIAL_FILE:?required}:/run/yuqei/witness/storage-credential.json:ro
|
|
- ${UAT_TENCENT_KMS_TOKEN_FILE:?required}:/run/yuqei/kms/service-token:ro
|
|
- ${UAT_TENCENT_GATEWAY_CA_FILE:?required}:/run/yuqei/kms/ca.pem:ro
|
|
- ${UAT_TENCENT_WITNESS_TLS_CERT_FILE:?required}:/run/yuqei/tls/tls.crt:ro
|
|
- ${UAT_TENCENT_WITNESS_TLS_KEY_FILE:?required}:/run/yuqei/tls/tls.key:ro
|
|
- ${UAT_TENCENT_WITNESS_CA_FILE:?required}:/run/yuqei/tls/ca.pem:ro
|
|
read_only: true
|
|
tmpfs: [/tmp]
|
|
security_opt: [no-new-privileges:true]
|
|
depends_on:
|
|
kms-gateway-tencent: { condition: service_healthy }
|
|
healthcheck:
|
|
test: ["CMD", "python", "-c", "import json,ssl,urllib.request,pathlib; t=pathlib.Path('/run/yuqei/witness/inbound-token').read_text().strip(); q=urllib.request.Request('https://evidence-witness-tencent:8112/ready',headers={'Authorization':'Bearer '+t}); c=ssl.create_default_context(cafile='/run/yuqei/tls/ca.pem'); d=json.load(urllib.request.urlopen(q,context=c,timeout=10)); assert d['ready']"]
|
|
interval: 20s
|
|
timeout: 12s
|
|
retries: 8
|
|
|
|
contract-api:
|
|
image: ${CONTRACT_API_IMAGE:?CONTRACT_API_IMAGE must reference the immutable UAT candidate}
|
|
build: !reset null
|
|
environment: &contract-evidence-trust-uat-environment
|
|
CONTRACT_API_ENVIRONMENT: staging
|
|
CONTRACT_API_RELIABLE_EVIDENCE_SIGNING_BACKEND: kms_gateway
|
|
CONTRACT_API_RELIABLE_EVIDENCE_SIGNING_ENDPOINT: https://kms-gateway-aliyun:8102
|
|
CONTRACT_API_RELIABLE_EVIDENCE_SIGNING_KEY_REFERENCE: ${UAT_ALIYUN_EVIDENCE_KEY_ID:?required}
|
|
CONTRACT_API_RELIABLE_EVIDENCE_SIGNING_KEY_VERSION: ${UAT_ALIYUN_EVIDENCE_KEY_VERSION:?required}
|
|
CONTRACT_API_RELIABLE_EVIDENCE_SIGNING_ALGORITHM: ${UAT_ALIYUN_EVIDENCE_ALGORITHM:-RSA_PSS_SHA_256}
|
|
CONTRACT_API_RELIABLE_EVIDENCE_EXTERNAL_TRUST_MODE: required
|
|
CONTRACT_API_RELIABLE_EVIDENCE_SIGNING_CREDENTIAL_FILE: /run/yuqei/uat/aliyun-kms-token
|
|
CONTRACT_API_RELIABLE_EVIDENCE_SIGNING_CA_FILE: /run/yuqei/uat/aliyun-kms-ca.pem
|
|
CONTRACT_API_RELIABLE_EVIDENCE_PROBE_TARGETS_JSON: >-
|
|
[{"name":"aliyun-kms-hangzhou","region":"${UAT_ALIYUN_KMS_REGION:-cn-hangzhou}","endpoint":"https://kms-gateway-aliyun:8102","credential_file":"/run/yuqei/uat/aliyun-kms-token","ca_file":"/run/yuqei/uat/aliyun-kms-ca.pem","key_reference":"${UAT_ALIYUN_EVIDENCE_KEY_ID}","key_version":"${UAT_ALIYUN_EVIDENCE_KEY_VERSION}","algorithm":"${UAT_ALIYUN_EVIDENCE_ALGORITHM:-RSA_PSS_SHA_256}"},{"name":"tencent-kms-guangzhou","region":"${UAT_TENCENT_KMS_REGION}","endpoint":"https://kms-gateway-tencent:8102","credential_file":"/run/yuqei/uat/tencent-kms-token","ca_file":"/run/yuqei/uat/tencent-kms-ca.pem","key_reference":"${UAT_TENCENT_EVIDENCE_KEY_ID}","key_version":"${UAT_TENCENT_EVIDENCE_KEY_VERSION}","algorithm":"${UAT_TENCENT_EVIDENCE_ALGORITHM:-RSA_PSS_SHA_256}"}]
|
|
CONTRACT_API_RELIABLE_EVIDENCE_ANCHOR_TARGETS_JSON: >-
|
|
[{"name":"aliyun-oss-worm-witness","region":"${UAT_ALIYUN_WITNESS_REGION}","endpoint":"https://evidence-witness-aliyun:8112","credential_file":"/run/yuqei/uat/aliyun-witness-token","ca_file":"/run/yuqei/uat/aliyun-witness-ca.pem","witness_public_key_file":"/run/yuqei/uat/aliyun-witness-public.pem","witness_algorithm":"${UAT_ALIYUN_WITNESS_ALGORITHM:-RSA_PSS_SHA_256}"},{"name":"tencent-cos-object-lock-witness","region":"${UAT_TENCENT_WITNESS_REGION}","endpoint":"https://evidence-witness-tencent:8112","credential_file":"/run/yuqei/uat/tencent-witness-token","ca_file":"/run/yuqei/uat/tencent-witness-ca.pem","witness_public_key_file":"/run/yuqei/uat/tencent-witness-public.pem","witness_algorithm":"${UAT_TENCENT_WITNESS_ALGORITHM:-RSA_PSS_SHA_256}"}]
|
|
volumes: &contract-evidence-trust-uat-volumes
|
|
- ${UAT_ALIYUN_KMS_TOKEN_FILE:?required}:/run/yuqei/uat/aliyun-kms-token:ro
|
|
- ${UAT_ALIYUN_GATEWAY_CA_FILE:?required}:/run/yuqei/uat/aliyun-kms-ca.pem:ro
|
|
- ${UAT_TENCENT_KMS_TOKEN_FILE:?required}:/run/yuqei/uat/tencent-kms-token:ro
|
|
- ${UAT_TENCENT_GATEWAY_CA_FILE:?required}:/run/yuqei/uat/tencent-kms-ca.pem:ro
|
|
- ${UAT_ALIYUN_WITNESS_TOKEN_FILE:?required}:/run/yuqei/uat/aliyun-witness-token:ro
|
|
- ${UAT_ALIYUN_WITNESS_CA_FILE:?required}:/run/yuqei/uat/aliyun-witness-ca.pem:ro
|
|
- ${UAT_ALIYUN_WITNESS_PUBLIC_KEY_FILE:?required}:/run/yuqei/uat/aliyun-witness-public.pem:ro
|
|
- ${UAT_TENCENT_WITNESS_TOKEN_FILE:?required}:/run/yuqei/uat/tencent-witness-token:ro
|
|
- ${UAT_TENCENT_WITNESS_CA_FILE:?required}:/run/yuqei/uat/tencent-witness-ca.pem:ro
|
|
- ${UAT_TENCENT_WITNESS_PUBLIC_KEY_FILE:?required}:/run/yuqei/uat/tencent-witness-public.pem:ro
|
|
depends_on:
|
|
kms-gateway-aliyun: { condition: service_healthy }
|
|
kms-gateway-tencent: { condition: service_healthy }
|
|
evidence-witness-aliyun: { condition: service_healthy }
|
|
evidence-witness-tencent: { condition: service_healthy }
|
|
|
|
contract-playbook-governance-worker:
|
|
image: ${CONTRACT_API_IMAGE:?CONTRACT_API_IMAGE must reference the immutable UAT candidate}
|
|
build: !reset null
|
|
environment: *contract-evidence-trust-uat-environment
|
|
volumes: *contract-evidence-trust-uat-volumes
|
|
depends_on:
|
|
kms-gateway-aliyun: { condition: service_healthy }
|
|
kms-gateway-tencent: { condition: service_healthy }
|
|
evidence-witness-aliyun: { condition: service_healthy }
|
|
evidence-witness-tencent: { condition: service_healthy }
|
|
|
|
volumes:
|
|
postgres-data:
|
|
name: ${POSTGRES_VOLUME_NAME:?POSTGRES_VOLUME_NAME must be UAT-scoped}
|
|
rustfs-data:
|
|
name: ${MINIO_VOLUME_NAME:?MINIO_VOLUME_NAME must be UAT-scoped}
|
|
contract-files:
|
|
name: ${CONTRACT_FILES_VOLUME_NAME:?CONTRACT_FILES_VOLUME_NAME must be UAT-scoped}
|