姚章浩
b32755b35f
- scripts/backup_layout.sh：定义 $KB_BACKUP_ROOT/{target-kb-snapshots,rds-logical,es-snapshots,logs}
与 /etc/knowledge-governance/backup.env，任意主机跑同一份（测试云主机 → 未来生产云主机）
- scripts/es_kb_export.py：只读 scroll 导出目标库 ES 文档（gzip JSONL，_id/_source，可按 _id 重建）
- scripts/target_kb_snapshot.sh：留档改为 PG 行 + ES 文档两层；PULL_ES 默认 0（692 MB / 家用上行 19m40s，
留在目标主机，清单记 location=cloud:<host>:<path>）；挂载源与落点统一走 KB_BACKUP_ROOT
- scripts/logical-backup.sh：自管整库逻辑备份（pg_dump -Fd -j4 -Z6，按天轮转）
- internal/releasesnapshot：门禁要求 PG 与 ES 两层齐备（ES 计数 >0）；云侧留档核声明与哈希、
声明本地却缺失则 fail-closed；新增 3 条用例（共 10）
- cmd/guardcheck：用真实产物复核门禁判断
- docs：PRODUCTION_BACKUP_RECOVERY.md 重写（契约/RDS 控制台/恢复路径/边界）；P6 同步留档语义
39 lines
1.8 KiB
YAML
39 lines
1.8 KiB
YAML
# 发布链路的「数据面接线」override（不含任何门禁开关）
|
||
# 用法：docker compose -f compose.yaml -f compose.release-sim.yaml up -d api release-worker
|
||
# 叠加顺序：compose.yaml → 本文件（接线）→ compose.release-gates.yaml（门禁，须人工授权）
|
||
# 作用：
|
||
# 1) api 拿到生产 WeKnora 凭据引用 →「生产知识库绑定」能读真实生产库列表
|
||
# 2) release-worker 拿到发布配置、目标端点别名、归档卷（执行门禁关闭时不加载配置）
|
||
services:
|
||
api:
|
||
environment:
|
||
# 凭据只引用 0600 文件（值不入库、不回显）；appconfig 要求两者同时给出
|
||
PRODUCTION_WEKNORA_BASE_URL: https://weknora-test.dobot.cn
|
||
PRODUCTION_WEKNORA_API_KEY_FILE: /run/release-secrets/target_weknora_api_key
|
||
volumes:
|
||
- ./secrets/release-sim:/run/release-secrets:ro
|
||
|
||
release-worker:
|
||
environment:
|
||
RELEASE_CONFIG_FILE: /run/release-sim/release.sim.json
|
||
PRODUCTION_RELEASE_AUTHORIZER_REF: yaozhanghao
|
||
extra_hosts:
|
||
- "host.docker.internal:host-gateway"
|
||
- "prod-pg:host-gateway"
|
||
- "prod-es:host-gateway"
|
||
- "prod-weknora:host-gateway"
|
||
networks:
|
||
- default
|
||
- weknora-local
|
||
volumes:
|
||
- ./secrets/release-sim:/run/release-secrets:ro
|
||
- ./config/release.sim.json:/run/release-sim/release.sim.json:ro
|
||
- release-bundles:/var/lib/knowledge-governance/release-bundles
|
||
# 发布前快照留档目录（只读）：写目标库之前必须存在覆盖该库的新快照
|
||
# 备份目录契约：本地默认 ./backups，主机上设 KB_BACKUP_ROOT=/srv/kb-backups（见 scripts/backup_layout.sh）
|
||
- ${KB_BACKUP_ROOT:-./backups}/target-kb-snapshots:/var/lib/knowledge-governance/target-kb-snapshots:ro
|
||
read_only: false
|
||
|
||
volumes:
|
||
release-bundles:
|
||
name: knowledge-governance-release-bundles |