fix: close deployment decoupling review

2026-08-05 07:52:32 +02:00
parent 5d037e97c4
commit 09834d5cd4
45 changed files with 1082 additions and 791 deletions
@@ -33,3 +33,6 @@ services:
      - thoth_data:/data
      - ./deploy/workspaces:/app/harness/workspaces:ro
    restart: "no"
+
+volumes:
+  thoth_data:
@@ -9,6 +9,8 @@ services:
      - ${THT_DATA_ROOT:?set THT_DATA_ROOT}:/data
      - ${THT_PI_STATE_ROOT:?set THT_PI_STATE_ROOT}:/home/thoth/.pi
      - ${PI_AUTH_FILE:?set PI_AUTH_FILE}:/home/thoth/.pi/agent/auth.json:ro
+      - ./deploy/pi/models.json:/home/thoth/.pi/agent/models.json:ro
+      - ./deploy/pi/settings.json:/home/thoth/.pi/agent/settings.json:ro
      - ${THT_WORKSPACE_REGISTRY_ROOT:?set THT_WORKSPACE_REGISTRY_ROOT}:/data/workspace-registry
    restart: unless-stopped

@@ -20,7 +20,7 @@ services:
      - source: session_ca
        target: session_ca.pem
    volumes:
-      - ./deploy/workspaces:/app/harness/workspaces:ro
+      - ${THT_SERVER_WORKSPACE_CONFIG:?set THT_SERVER_WORKSPACE_CONFIG}:/app/harness/workspaces/server-sessions.yaml:ro

  # Run manually during the maintenance window. It is not a dependency of core,
  # so the application never gains the schema-changing migrator credential.
@@ -1,40 +0,0 @@
-# Deprecated compatibility template; it is not loaded by Docker Compose automatically.
-# New installations must copy ../.env.example to ../.env and run
-# `docker compose up --build -d` from the repository root. Keep this file only for
-# staged upgrades that still invoke `--env-file deploy/env.example` explicitly.
-# Never put secret values in this file.
-
-COMPOSE_FILE=compose.yaml
-COMPOSE_PROFILES=
-THT_SECRETS_FILE=deploy/secrets/thothii.secrets
-
-PI_PROVIDER=
-PI_MODEL=
-PI_THINKING=
-MAX_PI_PROCESSES=4
-AUTH_MODE=none
-
-# User-owned session storage. Keep local for the loopback-only development stack.
-# The server-session overlay requires every THT_SESSION_* value below.
-THT_SESSION_STORAGE=local
-THT_SESSION_DB_HOST=
-THT_SESSION_DB_PORT=5432
-THT_SESSION_DB_NAME=
-THT_SESSION_RUNTIME_USER=
-THT_SESSION_RUNTIME_PASSWORD_SOURCE=
-THT_SESSION_MIGRATOR_USER=
-THT_SESSION_MIGRATOR_PASSWORD_SOURCE=
-THT_SESSION_DB_SSLMODE=verify-full
-THT_SESSION_CA_SOURCE=
-
-THT_DB_NAME=
-THT_DWH_REST_URL=
-THT_VEC_REST_URL=
-THT_OLLAMA_URL=
-THT_DOCS_ROOT=/data/workspaces/example/evidence-source
-
-THT_VECTOR_DATABASE=thoth
-THT_VECTOR_BOOTSTRAP_USER=postgres
-THT_VECTOR_MIGRATOR_USER=thoth_vector_migrator
-THT_VECTOR_READER_USER=thoth_vector_reader
-THT_VECTOR_WRITER_USER=thoth_vector_writer
@@ -4,6 +4,7 @@ THOTH_HTTP_PORT=8080
 THOTH_CORE_HTTP_PORT=8787
 MAX_PI_PROCESSES=4
 PI_AUTH_FILE=/absolute/path/to/pi-auth.json
+THT_SECRETS_FILE=/absolute/path/to/thothii.secrets

 THT_WORKSPACE_GIT_REMOTE=https://git.example.invalid/platform/thoth-workspaces.git
 THT_WORKSPACE_GIT_BRANCH=main
@@ -4,10 +4,12 @@ THOTH_SERVER_BIND=127.0.0.1
 THOTH_HTTP_PORT=8080
 MAX_PI_PROCESSES=4
 PI_AUTH_FILE=/absolute/path/to/pi-auth.json
+THT_SECRETS_FILE=/absolute/path/to/thothii.secrets

 THT_DATA_ROOT=/srv/thothii/data
 THT_PI_STATE_ROOT=/srv/thothii/pi-state
 THT_WORKSPACE_REGISTRY_ROOT=/srv/thothii/workspace-registry
+THT_SERVER_WORKSPACE_CONFIG=/absolute/path/to/server-sessions.yaml
 THT_WORKSPACE_GIT_REMOTE=https://git.example.invalid/platform/thoth-workspaces.git
 THT_WORKSPACE_GIT_BRANCH=main
 THT_WORKSPACE_GIT_AUTHOR_NAME="Thoth Workspace Registry"
@@ -19,3 +21,14 @@ THT_VEC_REST_URL=https://vector.example.invalid
 THT_VEC_WRITE_REST_URL=https://vector-write.example.invalid
 THT_OLLAMA_URL=https://embeddings.example.invalid
 THT_LLM_URL=https://llm.example.invalid
+
+# Public server session storage. Values are endpoints, roles, or protected source-file paths.
+THT_SESSION_DB_HOST=sessions-db.example.invalid
+THT_SESSION_DB_PORT=5432
+THT_SESSION_DB_NAME=thoth_sessions
+THT_SESSION_RUNTIME_USER=thoth_sessions_app
+THT_SESSION_MIGRATOR_USER=thoth_sessions_migrate
+THT_SESSION_DB_SSLMODE=verify-full
+THT_SESSION_RUNTIME_PASSWORD_SOURCE=/absolute/path/to/session-runtime-password
+THT_SESSION_MIGRATOR_PASSWORD_SOURCE=/absolute/path/to/session-migrator-password
+THT_SESSION_CA_SOURCE=/absolute/path/to/session-ca.pem
@@ -12,7 +12,7 @@ The file uses strict `KEY=VALUE` lines (comments and blank lines are allowed). T
 keys are `THT_MODEL_API_KEY`, `THT_DWH_API_KEY`, `THT_VEC_API_KEY`,
 `THT_VEC_WRITE_API_KEY`, and the four `THT_VECTOR_*_PASSWORD` role passwords. Values must be
 non-empty and contain no whitespace. Do not put secrets in the root `.env`, workspace YAML,
-URLs, logs, or `docker compose config` output.
+URLs, logs, or rendered Compose output.

 Compose mounts the bundle read-only as `/run/secrets/thothii.secrets`. The host file must be a
 regular non-symlink file with mode `0600` or `0400`; Docker's normal `0444` mode is accepted
@@ -20,7 +20,9 @@ only for the runtime mount beneath `/run/secrets`. The core runs as UID 10001. V
 without printing its contents:

 ```sh
-docker compose run --rm core sh -c 'id && test -r /run/secrets/thothii.secrets'
+docker compose --env-file deploy/env/local.env \
+  -f compose.yaml -f deploy/compose.local.yaml \
+  run --rm core sh -c 'id && test -r /run/secrets/thothii.secrets'
 ```

 A private CA PEM chain is not a bundle value: PEM whitespace is rejected by the strict parser.
@@ -31,9 +33,10 @@ Compose files intentionally do not create this mount.
 ## Migration from separate secret files

 Older installations used `THT_*_SECRET_FILE` variables and one file per value. Migrate by
-copying each value to its bundle key, validating with `docker compose config --quiet`, and only
+copying each value to its bundle key, validating with the complete base+profile command, and only
 then deleting the old files. The old variables remain a compatibility path for staged upgrades,
-but the documented and tested default is `THT_SECRETS_FILE=deploy/secrets/thothii.secrets`.
+but the documented and tested default is an absolute `THT_SECRETS_FILE` path to the protected
+bundle.

 The local-vector bootstrap rotation helper still accepts an old/new password file as its
 maintenance interface. Run it only with files protected by `0600`, then copy the resulting
@@ -1,33 +0,0 @@
-# ThothII core — env di runtime (compose env_file).
-# Copiare in deploy/thothii.env e completare. NON committare thothii.env.
-
-# --- DWH (direct, ruolo read-only su schema datawarehouse) ---
-THT_DB_HOST=host.docker.internal
-THT_DB_PORT=5438
-THT_DB_NAME=postgres
-THT_DB_USER=thoth_dwh_reader
-THT_DB_PASSWORD=__CHANGE_ME__
-
-# --- Vector (direct, ruolo read+write su schema vectors; stessa istanza del DWH) ---
-THT_VEC_HOST=host.docker.internal
-THT_VEC_PORT=5438
-THT_VEC_USER=thoth_vector_rw
-THT_VEC_PASSWORD=__CHANGE_ME__
-
-# --- Embeddings (Ollama sull'host, modello nomic-embed-text-v2-moe) ---
-THT_OLLAMA_URL=http://host.docker.internal:11434
-
-# --- Backend ---
-AUTH_MODE=none                 # none | mock | oidc (upstream auth is enforced at the proxy boundary)
-MAX_PI_PROCESSES=4
-THT_DEV_EVIDENCE_HOST_PATH=/absolute/path/to/evidence
-
-# --- Git-backed workspace registry (no secret values belong in this file) ---
-THT_WORKSPACE_REGISTRY_ROOT=/data/workspace-registry
-THT_WORKSPACE_GIT_BRANCH=main
-THT_WORKSPACE_INSTALLATION_ID=server
-# THT_WORKSPACE_GIT_REMOTE=ssh://git@your-git-host/your-org/thoth-workspaces.git
-# THT_WORKSPACE_GIT_CREDENTIALS_FILE=/absolute/path/to/git-credentials
-# THT_WORKSPACE_GIT_CA_FILE=/absolute/path/to/git-ca.pem
-# THT_WORKSPACE_GIT_SSH_KEY_FILE=/absolute/path/to/git-ssh-key
-# THT_WORKSPACE_GIT_KNOWN_HOSTS_FILE=/absolute/path/to/git-known-hosts