# 云测试发布执行器（governance release-executor）配置样例
#
# 这份文件不含任何真实凭据：值全是占位符。真实文件放在云测试主机的
# /srv/knowledge-governance/release-executor.env，权限 0600、属主 root，
# 由父在目标机本地填写（不要把生产凭据拷过来）。
#
# 角色是这个部署的核心：release-executor 只消费 library.sync / library.restore /
# library.recover / library.baseline，不起 scheduler、不接封存 agent、不碰 QA/测试/
# 目录刷新队列 —— 那些归本机那个 capture 角色。
LIBRARY_WORKER_ROLE=release-executor
WORKER_ID=kgtest-release-executor

# ---- 治理库：SSH 反向 Unix socket；host 必须是目录 ----
# 凭据由目标机 0600 governance.pgpass 只读挂载；不得直接复制本机无密码 URL。
DATABASE_URL=postgres://<user>@/<governance_db>?host=/run/kgtest-pg&port=5432&sslmode=disable
PGPASSFILE=/run/secrets/governance_pgpass

# ---- 目标：云测试 WeKnora ----
LIBRARY_PRODUCTION_DATABASE_URL=postgres://<user>:<password>@pgm-wz9ohr9gk919pr1q.pg.rds.aliyuncs.com:5432/weknora_test?sslmode=require
LIBRARY_PRODUCTION_ELASTIC_URL=http://elasticsearch:9200
LIBRARY_PRODUCTION_INDEX=weknora_test_chunks
LIBRARY_PRODUCTION_TENANT_ID=<tenant_id>
LIBRARY_PRODUCTION_KB_INTERNAL=<internal_kb_uuid>
# 对外库没有对应目标时留空：API 侧不会给 external 建发布作业。
# LIBRARY_PRODUCTION_KB_EXTERNAL=
LIBRARY_PRODUCTION_S3_PROVIDER=oss
LIBRARY_PRODUCTION_S3_ENDPOINT=https://oss-cn-shenzhen.aliyuncs.com
LIBRARY_PRODUCTION_S3_REGION=cn-shenzhen
LIBRARY_PRODUCTION_S3_BUCKET=dobot-weknora-test
LIBRARY_PRODUCTION_S3_ACCESS_KEY=<oss_access_key>
LIBRARY_PRODUCTION_S3_SECRET_KEY=<oss_secret_key>
LIBRARY_EMBEDDING_MODEL=<embedding_model>
LIBRARY_EMBEDDING_DIMENSION=1024

# ---- 维护目标：同机的 weknora-test-v071 容器组 ----
LIBRARY_TARGET_INSTANCE=weknora-test-v071-app
LIBRARY_TARGET_PROJECT=weknora-test-v071
LIBRARY_TARGET_WRITERS=app
# 项目里每个服务都必须声明成写入者或"不是写入者 + 原因"，否则窗口会拒绝开。
LIBRARY_TARGET_NON_WRITERS=frontend=UI only; no knowledge writes,elasticsearch=index store; not an initiator,redis=queue/cache store; not an initiator,neo4j=graph store; release path refuses graph writes,docreader=parse worker; driven by app only,ingress=TCP ingress gate which only drains and forwards
LIBRARY_TARGET_DOCKER_SOCKET=/var/run/docker.sock
# 入口 URL 用 docker 网络里的闸门服务名：执行器与闸门同项目网络，
# 而闸门在宿主机发布的是同一个 8080（拓扑校验比对的就是这个端口）。
LIBRARY_TARGET_INGRESS_URL=http://ingress:8080/health
LIBRARY_TARGET_INGRESS_SERVICE=ingress
LIBRARY_TARGET_INGRESS_DRAIN_FILE=/gate-state/drain.json
LIBRARY_TARGET_REDIS_ADDR=redis:6379
LIBRARY_TARGET_REDIS_DB=0
LIBRARY_TARGET_JOURNAL_ROOT=/var/lib/knowledge-governance/target-journal

# ---- 归档：本机 ip 封存 → 包 → 云端导入到这里 ----
LIBRARY_ARCHIVE_ROOT=/var/lib/knowledge-governance/library
LIBRARY_CAPACITY_BUDGET_BYTES=53687091200

# 不接封存 agent（封存仍在本机由既有 systemd user unit 提供）。
LIBRARY_AGENT_SOCKET=

# ---- 写目标的两道闸口 ----
# 这两个开关只是"本进程允许写"的部署声明；真正的授权是治理库里与快照绑定的
# release 授权行。任何一道为 false，发布会在维护窗口之前被拒绝。
PRODUCTION_RELEASE_REQUESTS_ENABLED=true
PRODUCTION_BACKUP_RESTORE_VERIFIED=true
# ---- 快照搬运（本机 API + capture worker 侧配置；执行器不消费这组变量）----
# 只写在这里作对照：真正的 LIBRARY_HANDOFF_* 配在**本机** api/worker 容器，
# 执行器只需要 LIBRARY_ARCHIVE_ROOT 与 BUNDLE_DIR 对应的宿主机目录存在。
# LIBRARY_HANDOFF_SSH_CONFIG=/run/secrets/backup-host/ssh_config
# LIBRARY_HANDOFF_TARGET=weknora-test
# LIBRARY_HANDOFF_EXECUTOR=kgtest-release-executor
# LIBRARY_HANDOFF_BUNDLE_DIR=/srv/knowledge-governance/bundles
# LIBRARY_HANDOFF_REMOTE_ARCHIVE=/var/lib/knowledge-governance/library
# LIBRARY_HANDOFF_STAGING_DIR=/var/lib/knowledge-governance/handoff-staging