Deployment

2026-09-25 19:44:48 +03:00
parent 596adfdc09
commit 066bfb3c0b
24 changed files with 472 additions and 151 deletions
@@ -0,0 +1,18 @@
+FROM python:3.13-slim-trixie AS builder
+WORKDIR /build
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    gcc \
+    && rm -rf /var/lib/apt/lists/*
+COPY requirements.txt .
+RUN pip install --no-cache-dir  --target=/app/deps -r requirements.txt
+
+### Runtime
+FROM gcr.io/distroless/python3-debian13:nonroot
+WORKDIR /app
+COPY --from=builder /app/deps /app/deps
+ENV PYTHONPATH="/app/deps"
+ENV PYTHONUNBUFFERED=1
+COPY . .
+USER nonroot
+EXPOSE 8000
+CMD ["entrypoint.py"]
@@ -0,0 +1,29 @@
+pid_file = "/tmp/pidfile"
+
+vault {
+  address = "https://10.6.2.1:8200"
+  tls_skip_verify = true
+  retry {
+    num_retries = 5
+  }
+}
+
+auto_auth {
+  method "approle" {
+    mount_path = "auth/approle"
+    config = {
+      role_id_file_path                   = "/vault-auth/role_id"
+      secret_id_file_path                 = "/vault-auth/wrapped_secret_id"
+      secret_id_response_wrapping_path    = "auth/approle/role/triage_agent/secret-id"
+      remove_secret_id_file_after_reading = false
+    }
+  }
+  # sink не нужен, если приложению не требуется сам токен Vault
+}
+
+template {
+  source      = "/vault-template/template.ctmpl"
+  destination = "/vault-secrets/.env"
+  error_on_missing_key = true
+  perms = "0644"
+}
@@ -0,0 +1,48 @@
+volumes:
+  vault-secrets:
+    driver_opts:
+      type: tmpfs
+      device: tmpfs
+      o: "size=1m,mode=0777,uid=65532,gid=65532"
+  projects-data:
+
+services:
+  vault-agent:
+    image: hashicorp/vault:1.17
+    command: agent -config=/vault-agent/agent.hcl
+    cap_add:
+      - IPC_LOCK
+    volumes:
+      - ./agent.hcl:/vault-agent/agent.hcl:ro
+      - ./env_template.ctmpl:/vault-template/template.ctmpl:ro
+      - ./../role_id:/vault-auth/role_id:ro
+      - ./../wrapped_secret_id:/vault-auth/wrapped_secret_id:ro
+      - vault-secrets:/vault-secrets
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
+    networks:
+      - agent-net
+
+  api:
+    build:
+      context: ..
+      dockerfile: deployment/Dockerfile
+    ports:
+      - "8173:8000"
+    group_add:
+      - "100"
+    volumes:
+      - ./../projects-data:/projects
+      - vault-secrets:/vault-secrets
+    depends_on:
+      vault-agent:
+        condition: service_started
+    networks:
+      - agent-net
+
+networks:
+  agent-net:
+    driver: bridge
+    ipam:
+      config:
+        - subnet: 10.6.7.0/24
@@ -0,0 +1,10 @@
+{{ with secret "internal_secrets/data/agents" }}
+YOUTRACK_MCP_SERVER={{ .Data.data.youtrack_mcp_server }}
+YOUTRACK_MCP_TOKEN={{ .Data.data.youtrack_agent_mcp_token }}
+YOUTRACK_TRIAGE_AUTHOR={{ .Data.data.youtrack_triage_author }}
+
+LLM_ADDRESS={{ .Data.data.llm_address }}
+LLM_API_KEY={{ .Data.data.llm_api_key }}
+LLM_MODEL={{ .Data.data.llm_model }}
+
+{{ end }}
@@ -0,0 +1,36 @@
+#!/bin/bash
+set -euo pipefail
+
+: '
+vault write auth/approle/role/triage_agent \
+    token_policies="agent_policy" \
+    token_ttl=1h \
+    token_max_ttl=4h \
+    secret_id_ttl=24h \
+    token_bound_cidrs="10.6.0.0/16"
+'
+
+VAULT_ADDR="https://10.6.2.1:8200"
+if [ -z "${VAULT_TOKEN:-}" ]; then
+  read -r -s -p "VAULT_TOKEN: " VAULT_TOKEN
+  echo
+fi
+
+TARGET_DIR=${1:-'.'}
+
+ROLE_NAME="triage_agent"
+WRAP_TTL="600s"
+CONFIG=$(mktemp)
+chmod 600 "$CONFIG"
+trap 'rm -f "$CONFIG"' EXIT
+
+{
+  printf 'header = "X-Vault-Token: %s"\n' "$VAULT_TOKEN"
+  printf 'header = "X-Vault-Wrap-TTL: %s"\n' "$WRAP_TTL"
+} > "$CONFIG"
+
+curl -s -X POST -k -K "$CONFIG" \
+  "$VAULT_ADDR/v1/auth/approle/role/${ROLE_NAME}/secret-id" \
+  | jq -r '.wrap_info.token // .errors[0]' | tr -d '\n' > wrapped_secret_id
+
+