fix: close deployment decoupling review

2026-08-05 07:52:32 +02:00
parent 5d037e97c4
commit 09834d5cd4
45 changed files with 1082 additions and 791 deletions
@@ -1,13 +0,0 @@
-# Optional override for an HTTPS Git remote. Both source paths are required absolute paths to
-# existing operator-managed files; neither file content belongs in the base Compose example.
-services:
-  core:
-    environment:
-      GIT_CONFIG_COUNT: "2"
-      GIT_CONFIG_KEY_0: credential.helper
-      GIT_CONFIG_VALUE_0: store --file=/run/secrets/workspace-registry-git-credentials
-      GIT_CONFIG_KEY_1: http.sslCAInfo
-      GIT_CONFIG_VALUE_1: /run/secrets/workspace-registry-git-ca
-    volumes:
-      - ${THT_WORKSPACE_GIT_CREDENTIALS_FILE:?set THT_WORKSPACE_GIT_CREDENTIALS_FILE}:/run/secrets/workspace-registry-git-credentials:ro
-      - ${THT_WORKSPACE_GIT_CA_FILE:?set THT_WORKSPACE_GIT_CA_FILE}:/run/secrets/workspace-registry-git-ca:ro
@@ -1,9 +0,0 @@
-# Optional override for an SSH Git remote. Source paths are required absolute operator-managed
-# files. Host-key checking remains strict; do not add a fallback known-hosts or key mount.
-services:
-  core:
-    environment:
-      GIT_SSH_COMMAND: ssh -i /run/secrets/workspace-registry-git-ssh-key -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes -o UserKnownHostsFile=/run/secrets/workspace-registry-git-known-hosts
-    volumes:
-      - ${THT_WORKSPACE_GIT_SSH_KEY_FILE:?set THT_WORKSPACE_GIT_SSH_KEY_FILE}:/run/secrets/workspace-registry-git-ssh-key:ro
-      - ${THT_WORKSPACE_GIT_KNOWN_HOSTS_FILE:?set THT_WORKSPACE_GIT_KNOWN_HOSTS_FILE}:/run/secrets/workspace-registry-git-known-hosts:ro
@@ -1,39 +0,0 @@
-# Standalone local registry example. Copy to an untracked operator directory and set the absolute
-# THT_SOURCE_ROOT in .env. Add only the selected Git transport override from this directory.
-name: thothii-workspace-registry-local
-
-services:
-  core:
-    image: thothii-core:local
-    build:
-      context: ${THT_SOURCE_ROOT:?set THT_SOURCE_ROOT to the absolute ThothII source checkout}
-      dockerfile: docker/core.Dockerfile
-    env_file:
-      - path: ${THT_WORKSPACE_BINDINGS_ENV_FILE:?set THT_WORKSPACE_BINDINGS_ENV_FILE to an absolute THT_WS bindings file}
-        required: true
-    environment:
-      HOST: 0.0.0.0
-      PORT: "8787"
-      AUTH_MODE: none
-      THT_SESSION_STORAGE: local
-      THT_HOME: /data/local-home
-      SETTINGS_FILE: /data/settings/settings.json
-      THT_HARNESS_DIR: /app/harness
-      THT_BIN: /opt/venv/bin/tht
-      THT_WORKSPACE_REGISTRY_ROOT: /data/workspace-registry
-      THT_WORKSPACE_GIT_REMOTE: ${THT_WORKSPACE_GIT_REMOTE:-ssh://git@git.example.invalid/platform/thoth-workspaces.git}
-      THT_WORKSPACE_GIT_BRANCH: ${THT_WORKSPACE_GIT_BRANCH:-main}
-      THT_WORKSPACE_INSTALLATION_ID: ${THT_WORKSPACE_INSTALLATION_ID:-local-laptop}
-      THT_WORKSPACE_GIT_AUTHOR_NAME: ${THT_WORKSPACE_GIT_AUTHOR_NAME:-Thoth Workspace Registry}
-      THT_WORKSPACE_GIT_AUTHOR_EMAIL: ${THT_WORKSPACE_GIT_AUTHOR_EMAIL:-thoth-workspace-registry@localhost}
-      THT_WORKSPACE_SECRET_ROOTS: /run/secrets
-    ports:
-      - "127.0.0.1:8787:8787"
-    volumes:
-      - thoth-local-data:/data
-      - workspace-registry:/data/workspace-registry
-    restart: "no"
-
-volumes:
-  thoth-local-data: {}
-  workspace-registry: {}
@@ -1,60 +0,0 @@
-# Server registry example. Copy to a reviewed, untracked operator directory and set absolute host
-# paths and Git values in .env. Add a selected Git transport override from this directory.
-name: thothii-workspace-registry-server
-
-services:
-  core:
-    image: thothii-core:local
-    build:
-      context: ${THT_SOURCE_ROOT:?set THT_SOURCE_ROOT to the absolute ThothII source checkout}
-      dockerfile: docker/core.Dockerfile
-    env_file:
-      - path: ${THT_WORKSPACE_BINDINGS_ENV_FILE:?set THT_WORKSPACE_BINDINGS_ENV_FILE to an absolute THT_WS bindings file}
-        required: true
-    environment:
-      HOST: 0.0.0.0
-      PORT: "8787"
-      AUTH_MODE: upstream
-      THOTH_PUBLIC_EXPOSURE: "true"
-      THT_SESSION_STORAGE: postgres
-      THT_CONFIG: /app/harness/workspaces/server-sessions.yaml
-      THT_SESSION_DB_HOST: ${THT_SESSION_DB_HOST:?set THT_SESSION_DB_HOST}
-      THT_SESSION_DB_PORT: ${THT_SESSION_DB_PORT:-5432}
-      THT_SESSION_DB_NAME: ${THT_SESSION_DB_NAME:?set THT_SESSION_DB_NAME}
-      THT_SESSION_RUNTIME_USER: ${THT_SESSION_RUNTIME_USER:?set THT_SESSION_RUNTIME_USER}
-      THT_SESSION_RUNTIME_PASSWORD_FILE: /run/secrets/session_runtime_password
-      THT_SESSION_DB_SSLMODE: ${THT_SESSION_DB_SSLMODE:-verify-full}
-      THT_SESSION_DB_SSLROOTCERT: /run/secrets/session_ca.pem
-      THT_HARNESS_DIR: /app/harness
-      THT_BIN: /opt/venv/bin/tht
-      SETTINGS_FILE: /data/settings/settings.json
-      THT_WORKSPACE_REGISTRY_ROOT: /data/workspace-registry
-      THT_WORKSPACE_GIT_REMOTE: ${THT_WORKSPACE_GIT_REMOTE:-ssh://git@git.example.invalid/platform/thoth-workspaces.git}
-      THT_WORKSPACE_GIT_BRANCH: ${THT_WORKSPACE_GIT_BRANCH:-main}
-      THT_WORKSPACE_INSTALLATION_ID: ${THT_WORKSPACE_INSTALLATION_ID:-production-1}
-      THT_WORKSPACE_GIT_AUTHOR_NAME: ${THT_WORKSPACE_GIT_AUTHOR_NAME:-Thoth Workspace Registry}
-      THT_WORKSPACE_GIT_AUTHOR_EMAIL: ${THT_WORKSPACE_GIT_AUTHOR_EMAIL:-thoth-workspace-registry@localhost}
-      THT_WORKSPACE_SECRET_ROOTS: /run/secrets
-    volumes:
-      - ${THT_HOST_DATA_ROOT:-/srv/thothii/data}:/data
-      - ${THT_WORKSPACE_REGISTRY_HOST_PATH:-/srv/thothii/workspace-registry}:/data/workspace-registry
-      - ${THT_SERVER_WORKSPACE_CONFIG:?set THT_SERVER_WORKSPACE_CONFIG}:/app/harness/workspaces/server-sessions.yaml:ro
-    secrets:
-      - source: session_runtime_password
-        target: session_runtime_password
-      - source: session_ca
-        target: session_ca.pem
-    networks:
-      - upstream
-    restart: unless-stopped
-
-networks:
-  upstream:
-    external: true
-    name: ${THT_UPSTREAM_NETWORK:-thothii-upstream}
-
-secrets:
-  session_runtime_password:
-    file: ${THT_SESSION_RUNTIME_PASSWORD_SOURCE:?set THT_SESSION_RUNTIME_PASSWORD_SOURCE}
-  session_ca:
-    file: ${THT_SESSION_CA_SOURCE:?set THT_SESSION_CA_SOURCE}
@@ -1,13 +1,13 @@
 # Copy to an untracked operator file. This file contains only non-secret THT_WS_* bindings.
 # Every *_FILE value is a container path supplied by the generated local connector override.
-THT_WS_PSD_CLINICAL_DWH_TRANSPORT=postgres_direct
-THT_WS_PSD_CLINICAL_DWH_HOST=dwh.internal.example
-THT_WS_PSD_CLINICAL_DWH_PORT=5432
-THT_WS_PSD_CLINICAL_DWH_USER=thoth_reader
-THT_WS_PSD_CLINICAL_DWH_PASSWORD_FILE=/run/secrets/psd-clinical-dwh-password
-THT_WS_PSD_CLINICAL_VECTOR_TRANSPORT=pgvector_direct
-THT_WS_PSD_CLINICAL_VECTOR_HOST=vector.internal.example
-THT_WS_PSD_CLINICAL_VECTOR_PORT=5432
-THT_WS_PSD_CLINICAL_VECTOR_USER=thoth_vector_reader
-THT_WS_PSD_CLINICAL_VECTOR_PASSWORD_FILE=/run/secrets/psd-clinical-vector-password
-THT_WS_PSD_CLINICAL_EMBEDDING_BASE_URL=https://embeddings.internal.example
+THT_WS_NORTH_STAR_RESEARCH_DWH_TRANSPORT=postgres_direct
+THT_WS_NORTH_STAR_RESEARCH_DWH_HOST=dwh.internal.example
+THT_WS_NORTH_STAR_RESEARCH_DWH_PORT=5432
+THT_WS_NORTH_STAR_RESEARCH_DWH_USER=thoth_reader
+THT_WS_NORTH_STAR_RESEARCH_DWH_PASSWORD_FILE=/run/secrets/north-star-research-dwh-password
+THT_WS_NORTH_STAR_RESEARCH_VECTOR_TRANSPORT=pgvector_direct
+THT_WS_NORTH_STAR_RESEARCH_VECTOR_HOST=vector.internal.example
+THT_WS_NORTH_STAR_RESEARCH_VECTOR_PORT=5432
+THT_WS_NORTH_STAR_RESEARCH_VECTOR_USER=thoth_vector_reader
+THT_WS_NORTH_STAR_RESEARCH_VECTOR_PASSWORD_FILE=/run/secrets/north-star-research-vector-password
+THT_WS_NORTH_STAR_RESEARCH_EMBEDDING_BASE_URL=https://embeddings.internal.example