姚章浩
f4e1ecc5f1
- artifact_fetch.py: 新增 dingtalk dws 取件器（adoc→doc export、axls→sheet 转换、其余→drive 直下），
ARTIFACT_DINGTALK_FETCHER=dws|auto|legacy 三级开关，auto 仅对可重试错误回落老路径；
平台侧判定（pick_suffix/SLIDES/magic/大小上限/sha256/spool/空壳检查）全部保留；
结果 JSON 字段不变（Go runner 用 DisallowUnknownFields 解析 stdout），取件器来源只写 stderr。
- axls_to_xlsx.py: 纯标准库 axls→xlsx（文本写入 sharedStrings 以通过空壳判定）。
- dws_error_map.py: dws 错误→平台 {ok,code,retryable,missing}；未分类错误默认不重试。
- Dockerfile: alpine 增加 gcompat/libc6-compat；dws v1.0.63 固定版本+sha256 校验；构建期 dws version 自检。
- compose.yaml: worker 增加 dws 环境与凭据挂载（DWS_HOME 方案，XDG_DATA_HOME 不被 dws 识别）。
- 测试: artifact_fetch_test 新增 11 项（路由/回落语义/契约字段锁定）；dws_error_map 17 断言。
- 实测: 真容器(--read-only --tmpfs --user 1000:1000) 端到端 adoc/axls/pdf 3/3 成功，docx sha 与平台基准一致。
216 lines
7.9 KiB
YAML
216 lines
7.9 KiB
YAML
name: knowledge-governance-p1
|
||
|
||
services:
|
||
postgres:
|
||
image: postgres:17-alpine
|
||
environment:
|
||
POSTGRES_DB: governance
|
||
POSTGRES_USER: governance
|
||
POSTGRES_PASSWORD_FILE: /run/secrets/postgres_password
|
||
secrets:
|
||
- postgres_password
|
||
volumes:
|
||
- governance-pgdata:/var/lib/postgresql/data
|
||
healthcheck:
|
||
test: ["CMD-SHELL", "pg_isready -U governance -d governance"]
|
||
interval: 5s
|
||
timeout: 3s
|
||
retries: 20
|
||
restart: unless-stopped
|
||
|
||
api:
|
||
build:
|
||
context: .
|
||
dockerfile: Dockerfile
|
||
command: ["/app/api"]
|
||
user: "${APP_UID:-1000}:${APP_GID:-1000}"
|
||
environment:
|
||
<<: &app-environment
|
||
DATABASE_URL: postgres://governance@postgres:5432/governance?sslmode=disable
|
||
PGPASSFILE: /run/secrets/pgpass
|
||
APP_ADDR: :8080
|
||
WORKER_POLL_INTERVAL: 1s
|
||
WORKER_LEASE_DURATION: 30s
|
||
WORKER_RETRY_DELAY: 5s
|
||
TEST_WEKNORA_BASE_URL: "${TEST_WEKNORA_BASE_URL:-}"
|
||
DINGTALK_LOGIN_SIDECAR_URL: "http://dingtalk-login:8091"
|
||
MINERU_BASE_URL: "${MINERU_BASE_URL:-}"
|
||
TEST_INTERNAL_WEKNORA_KB_ID: "${TEST_INTERNAL_WEKNORA_KB_ID:-1b52c140-2e18-4676-afc5-4c7d8d190a8c}"
|
||
TEST_EXTERNAL_WEKNORA_KB_ID: "${TEST_EXTERNAL_WEKNORA_KB_ID:-fd7db6aa-763a-46f1-84d2-ecc7c952a5ea}"
|
||
# P10 readiness probe reads the routing KB with the same scoped key.
|
||
TEST_WEKNORA_API_KEY_FILE: /run/secrets/test_weknora_api_key
|
||
TEST_WEKNORA_ALLOW_DOCKER_HTTP: "${TEST_WEKNORA_ALLOW_DOCKER_HTTP:-false}"
|
||
WORKER_LIVENESS_STALE_AFTER: "${WORKER_LIVENESS_STALE_AFTER:-2m}"
|
||
PRODUCTION_RELEASE_REQUESTS_ENABLED: ${PRODUCTION_RELEASE_REQUESTS_ENABLED:-false}
|
||
PRODUCTION_BACKUP_RESTORE_VERIFIED: ${PRODUCTION_BACKUP_RESTORE_VERIFIED:-false}
|
||
# Read-only probe of the production WeKnora endpoint; publishing keeps
|
||
# reading its target from RELEASE_CONFIG_FILE.
|
||
PRODUCTION_WEKNORA_BASE_URL: "${PRODUCTION_WEKNORA_BASE_URL:-}"
|
||
PRODUCTION_WEKNORA_API_KEY_FILE: "${PRODUCTION_WEKNORA_API_KEY_FILE:-}"
|
||
PRODUCTION_WEKNORA_ALLOW_DOCKER_HTTP: "${PRODUCTION_WEKNORA_ALLOW_DOCKER_HTTP:-false}"
|
||
secrets:
|
||
- pgpass
|
||
- test_weknora_api_key
|
||
depends_on:
|
||
postgres:
|
||
condition: service_healthy
|
||
healthcheck:
|
||
# P10: liveness only — a third-party outage must never restart the API.
|
||
test: ["CMD", "wget", "-qO-", "http://127.0.0.1:8080/livez"]
|
||
interval: 5s
|
||
timeout: 3s
|
||
retries: 20
|
||
read_only: true
|
||
tmpfs:
|
||
- /tmp
|
||
networks:
|
||
- default
|
||
- weknora-local
|
||
restart: unless-stopped
|
||
|
||
worker:
|
||
build:
|
||
context: .
|
||
dockerfile: Dockerfile
|
||
command: ["/app/worker"]
|
||
user: "${APP_UID:-1000}:${APP_GID:-1000}"
|
||
environment:
|
||
<<: *app-environment
|
||
WORKER_ID: worker-1
|
||
PP_SCAN_ENABLED: "${PP_SCAN_ENABLED:-false}"
|
||
PP_SCAN_ALLOWED_ROOT: "${PP_SCAN_CONTAINER_DATA_ROOT:-/home/zheromiku/dobot-portal-sync/data}"
|
||
PP_SCAN_LEDGER_PATH: "${PP_SCAN_CONTAINER_DATA_ROOT:-/home/zheromiku/dobot-portal-sync/data}/public-weknora-sync/state.jsonl"
|
||
PP_SCAN_MANIFEST_PATH: "${PP_SCAN_CONTAINER_DATA_ROOT:-/home/zheromiku/dobot-portal-sync/data}/public-documents/manifest.json"
|
||
TEST_WEKNORA_ENABLED: "${TEST_WEKNORA_ENABLED:-false}"
|
||
TEST_WEKNORA_ALLOW_DOCKER_HTTP: "${TEST_WEKNORA_ALLOW_DOCKER_HTTP:-false}"
|
||
TEST_WEKNORA_KB_ID: "${TEST_WEKNORA_KB_ID:-}"
|
||
TEST_WEKNORA_API_KEY_FILE: /run/secrets/test_weknora_api_key
|
||
GOVERNANCE_SPOOL_ROOT: /var/lib/governance/spool
|
||
INGESTION_SPOOL_ROOT: /var/lib/governance/ingestion
|
||
TEST_WEKNORA_HTTP_TIMEOUT: "${TEST_WEKNORA_HTTP_TIMEOUT:-60s}"
|
||
TEST_WEKNORA_POLL_INITIAL: "${TEST_WEKNORA_POLL_INITIAL:-10s}"
|
||
TEST_WEKNORA_POLL_MAX: "${TEST_WEKNORA_POLL_MAX:-60s}"
|
||
TEST_WEKNORA_STALLED_AFTER: "${TEST_WEKNORA_STALLED_AFTER:-30m}"
|
||
TEST_WEKNORA_MAX_UPLOAD_BYTES: "${TEST_WEKNORA_MAX_UPLOAD_BYTES:-52428800}"
|
||
TEST_ACCEPTANCE_POLICY_VERSION: "${TEST_ACCEPTANCE_POLICY_VERSION:-structural-v1}"
|
||
# DingTalk 取件走 dws（默认优先 dws，可重试失败回落老路径）：dws|auto|legacy
|
||
ARTIFACT_DINGTALK_FETCHER: "${ARTIFACT_DINGTALK_FETCHER:-auto}"
|
||
DWS_BIN: /usr/local/bin/dws
|
||
DWS_CONFIG_DIR: /data/dws
|
||
# dws 的文件型 keychain 在 $HOME/.local/share/dws-cli（XDG_DATA_HOME 不被识别），
|
||
# 仅给 dws 子进程换 HOME，不动整个 worker 的 HOME。
|
||
DWS_HOME: /data/home
|
||
DWS_DISABLE_KEYCHAIN: "1"
|
||
SSL_CERT_FILE: /etc/ssl/certs/ca-certificates.crt
|
||
secrets:
|
||
- pgpass
|
||
- test_weknora_api_key
|
||
volumes:
|
||
- ./spool:/var/lib/governance/spool:ro
|
||
- ./spool/ingestion:/var/lib/governance/ingestion
|
||
- "${PP_SCAN_HOST_DATA_ROOT:-/home/zheromiku/dobot-portal-sync/data}:${PP_SCAN_CONTAINER_DATA_ROOT:-/home/zheromiku/dobot-portal-sync/data}:ro"
|
||
- /home/zheromiku/dingtalk_kb_download:/sources/dingtalk:ro
|
||
# dws 凭据：与宿主共享同一份 state（refresh token 是轮换制，不能在两处各留一份）
|
||
- /home/zheromiku/.dws:/data/dws
|
||
# dws 的文件型 keychain：必须有 $HOME/.local/share/dws-cli，故挂到 DWS_HOME 下
|
||
- /home/zheromiku/.local/share/dws-cli:/data/home/.local/share/dws-cli
|
||
- /home/zheromiku/tmp/alist:/sources/alist:ro
|
||
- /home/zheromiku/dobot-portal-sync:/sources/pp:ro
|
||
- ./secrets/dingtalk_capture.json:/run/source-secrets/dingtalk_capture.json:ro
|
||
- ./secrets/alist_connections.xlsx:/run/source-secrets/alist_connections.xlsx:ro
|
||
- ./secrets/alist_api_token:/run/source-secrets/alist_api_token:ro
|
||
- ./secrets/pp_credentials.json:/run/source-secrets/pp_credentials.json:ro
|
||
networks:
|
||
- default
|
||
- weknora-local
|
||
depends_on:
|
||
postgres:
|
||
condition: service_healthy
|
||
read_only: true
|
||
tmpfs:
|
||
- /tmp
|
||
restart: unless-stopped
|
||
|
||
release-worker:
|
||
build:
|
||
context: .
|
||
dockerfile: Dockerfile
|
||
command: ["/app/release-worker"]
|
||
user: "${APP_UID:-1000}:${APP_GID:-1000}"
|
||
environment:
|
||
<<: *app-environment
|
||
WORKER_ID: release-worker-1
|
||
RELEASE_WORKER_ENABLED: "false"
|
||
RELEASE_CONFIG_FILE: ""
|
||
secrets:
|
||
- pgpass
|
||
depends_on:
|
||
postgres:
|
||
condition: service_healthy
|
||
read_only: true
|
||
tmpfs:
|
||
- /tmp
|
||
restart: unless-stopped
|
||
|
||
dingtalk-login:
|
||
# Chromium profile for DingTalk scan sessions. The bind-mounted secrets
|
||
# directory is rw ONLY here; the worker keeps reading the capture read-only.
|
||
build:
|
||
context: ./services/dingtalk-login
|
||
image: knowledge-governance-dingtalk-login:local
|
||
user: "${APP_UID:-1000}:${APP_GID:-1000}"
|
||
environment:
|
||
CAPTURE_FILE: /run/source-secrets/dingtalk_capture.json
|
||
DINGTALK_STATE_FILE: /sources/dingtalk/data/dingtalk-internal/inventory-state.json
|
||
VERIFY_SPACE: "${DINGTALK_VERIFY_SPACE:-9JOGO6332vlBnm4Q}"
|
||
QR_TTL_MS: "300000"
|
||
volumes:
|
||
- ./secrets:/run/source-secrets
|
||
- /home/zheromiku/dingtalk_kb_download:/sources/dingtalk
|
||
- dingtalk-chromium-profile:/profile
|
||
security_opt:
|
||
- no-new-privileges:true
|
||
tmpfs:
|
||
- /tmp
|
||
healthcheck:
|
||
test: ["CMD", "node", "-e", "require('http').get('http://127.0.0.1:8091/healthz',r=>process.exit(r.statusCode===200?0:1)).on('error',()=>process.exit(1))"]
|
||
interval: 10s
|
||
timeout: 5s
|
||
retries: 30
|
||
start_period: 15s
|
||
restart: unless-stopped
|
||
|
||
|
||
web:
|
||
build:
|
||
context: .
|
||
dockerfile: Dockerfile.web
|
||
ports:
|
||
- "8088:8080"
|
||
depends_on:
|
||
api:
|
||
condition: service_healthy
|
||
read_only: true
|
||
tmpfs:
|
||
- /tmp
|
||
- /var/cache/nginx
|
||
- /var/run
|
||
restart: unless-stopped
|
||
|
||
secrets:
|
||
postgres_password:
|
||
file: ./secrets/postgres_password
|
||
pgpass:
|
||
file: ./secrets/pgpass
|
||
test_weknora_api_key:
|
||
file: ./secrets/test_weknora_api_key
|
||
|
||
volumes:
|
||
governance-pgdata:
|
||
dingtalk-chromium-profile:
|
||
|
||
networks:
|
||
weknora-local:
|
||
external: true
|
||
name: weknora071full-network
|