feat(deploy): add optional local pgvector profile

2026-07-12 01:42:37 +02:00
parent 3588a7749b
commit 0ca9783f61
6 changed files with 333 additions and 2 deletions
@@ -18,6 +18,18 @@ THT_VEC_REST_URL=
 THT_VEC_API_KEY=
 THT_VEC_WRITE_API_KEY=

+# Optional local-vector profile. Keep these secret files outside Git and readable by Docker.
+THT_VECTOR_DATABASE=thoth
+THT_VECTOR_MIGRATOR_USER=thoth_vector_migrator
+THT_VECTOR_READER_USER=thoth_vector_reader
+THT_VECTOR_WRITER_USER=thoth_vector_writer
+THT_VECTOR_READER_PASSWORD=
+THT_VECTOR_WRITER_PASSWORD=
+THT_VECTOR_BOOTSTRAP_PASSWORD_SECRET_FILE=/absolute/path/to/vector_bootstrap_password
+THT_VECTOR_MIGRATOR_PASSWORD_SECRET_FILE=/absolute/path/to/vector_migrator_password
+THT_VECTOR_READER_PASSWORD_SECRET_FILE=/absolute/path/to/vector_reader_password
+THT_VECTOR_WRITER_PASSWORD_SECRET_FILE=/absolute/path/to/vector_writer_password
+
 # External embeddings service
 THT_OLLAMA_URL=

@@ -0,0 +1,36 @@
+#!/bin/sh
+set -eu
+
+read_secret() {
+  value=$(cat "/run/secrets/$1")
+  if [ -z "$value" ] || printf '%s' "$value" | grep -q '[[:space:]]'; then
+    echo "$1 must be non-empty and contain no whitespace" >&2
+    exit 2
+  fi
+  printf '%s' "$value"
+}
+
+migrator_password=$(read_secret vector_migrator_password)
+reader_password=$(read_secret vector_reader_password)
+writer_password=$(read_secret vector_writer_password)
+
+psql --set=ON_ERROR_STOP=1 --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" \
+  --set=migrator_user="$THT_VECTOR_MIGRATOR_USER" \
+  --set=migrator_password="$migrator_password" \
+  --set=reader_user="$THT_VECTOR_READER_USER" \
+  --set=reader_password="$reader_password" \
+  --set=writer_user="$THT_VECTOR_WRITER_USER" \
+  --set=writer_password="$writer_password" <<'SQL'
+CREATE ROLE vector_reader NOLOGIN;
+CREATE ROLE vector_writer NOLOGIN;
+
+SELECT format('CREATE ROLE %I LOGIN PASSWORD %L CREATEROLE', :'migrator_user', :'migrator_password') \gexec
+SELECT format('CREATE ROLE %I LOGIN PASSWORD %L', :'reader_user', :'reader_password') \gexec
+SELECT format('CREATE ROLE %I LOGIN PASSWORD %L', :'writer_user', :'writer_password') \gexec
+SELECT format('GRANT vector_reader TO %I', :'reader_user') \gexec
+SELECT format('GRANT vector_writer TO %I', :'writer_user') \gexec
+SELECT format('ALTER DATABASE %I OWNER TO %I', current_database(), :'migrator_user') \gexec
+SELECT format('CREATE SCHEMA vectors AUTHORIZATION %I', :'migrator_user') \gexec
+REVOKE ALL ON SCHEMA vectors FROM PUBLIC;
+CREATE EXTENSION vector WITH SCHEMA vectors;
+SQL
@@ -0,0 +1,48 @@
+language: en
+
+dwh:
+  type: thoth_rest
+  database:
+    database: ${THT_DB_NAME}
+    schema: datawarehouse
+  endpoint:
+    base_url: ${THT_DWH_REST_URL}
+    api_key: ${THT_DWH_API_KEY}
+
+vectors:
+  type: pgvector_direct
+  reader:
+    host: vector-db
+    port: 5432
+    database: ${THT_VECTOR_DATABASE}
+    schema: vectors
+    user: ${THT_VECTOR_READER_USER}
+    password: ${THT_VECTOR_READER_PASSWORD}
+  writer:
+    host: vector-db
+    port: 5432
+    database: ${THT_VECTOR_DATABASE}
+    schema: vectors
+    user: ${THT_VECTOR_WRITER_USER}
+    password: ${THT_VECTOR_WRITER_PASSWORD}
+
+roots:
+  artifacts: artifacts
+  indexes: indexes
+  sessions: sessions
+
+evidence:
+  source_root: ${THT_DOCS_ROOT}
+  evidence_dir: evidence
+
+embeddings:
+  base_url: ${THT_OLLAMA_URL}
+  model: nomic-embed-text-v2-moe
+  dim: 768
+  batch_size: 32
+
+execution:
+  allow: [cte_test, explain, preview, aggregate, export]
+  max_preview_rows: 10
+  max_export_rows: 100000
+  statement_timeout_ms: 30000