feat(deploy): add optional local pgvector profile

2026-07-12 01:42:37 +02:00
parent 3588a7749b
commit 0ca9783f61
6 changed files with 333 additions and 2 deletions
@@ -0,0 +1,112 @@
+#!/bin/sh
+set -eu
+
+cd "$(dirname "$0")/.."
+
+smoke_project=${SMOKE_PROJECT:-"thothii-vector-smoke-$(date +%s)-$$"}
+keep_resources=${KEEP_SMOKE_RESOURCES:-0}
+secret_dir=$(mktemp -d)
+marker="local-vector-$smoke_project"
+
+case "$smoke_project" in
+  thothii)
+    echo "SMOKE_PROJECT=thothii is reserved for the operator stack" >&2
+    exit 2
+    ;;
+  ""|*[!a-z0-9_-]*|[!a-z0-9]*)
+    echo "invalid SMOKE_PROJECT: use lowercase letters, digits, hyphens, or underscores" >&2
+    exit 2
+    ;;
+esac
+
+for secret in bootstrap migrator reader writer; do
+  password="smoke-${secret}-${smoke_project}"
+  printf '%s' "$password" >"$secret_dir/$secret"
+  chmod 0600 "$secret_dir/$secret"
+done
+
+export THT_VECTOR_BOOTSTRAP_PASSWORD_SECRET_FILE="$secret_dir/bootstrap"
+export THT_VECTOR_MIGRATOR_PASSWORD_SECRET_FILE="$secret_dir/migrator"
+export THT_VECTOR_READER_PASSWORD_SECRET_FILE="$secret_dir/reader"
+export THT_VECTOR_WRITER_PASSWORD_SECRET_FILE="$secret_dir/writer"
+export THT_VECTOR_READER_PASSWORD="smoke-reader-${smoke_project}"
+export THT_VECTOR_WRITER_PASSWORD="smoke-writer-${smoke_project}"
+
+compose() {
+  docker compose --project-name "$smoke_project" --profile local-vector "$@"
+}
+
+cleanup() {
+  if [ "$keep_resources" = "1" ]; then
+    echo "Keeping smoke resources for project $smoke_project (KEEP_SMOKE_RESOURCES=1)." >&2
+  else
+    compose down --volumes >/dev/null 2>&1 || true
+  fi
+  rm -rf "$secret_dir"
+}
+trap cleanup EXIT HUP INT TERM
+
+probe_vector() {
+  compose exec -T core /opt/venv/bin/python - "$marker" <<'PY'
+import hashlib
+import os
+import sys
+
+from tht.adapters.vector.pgvector import PgVectorStore
+from tht.config import DatabaseConfig
+from tht.ports.vector import VectorWriteRecord
+from tht.vectorstore.records import VectorRecord
+
+marker = sys.argv[1]
+database = "thoth"
+host = "vector-db"
+
+def credential(role: str) -> DatabaseConfig:
+    return DatabaseConfig(
+        host=host,
+        port=5432,
+        database=database,
+        schema="vectors",
+        user=f"thoth_vector_{role}",
+        password=os.environ[f"THT_VECTOR_{role.upper()}_PASSWORD"],
+    )
+
+store = PgVectorStore(credential("reader"), credential("writer"), expected_dimension=768)
+health = store.health()
+assert health.ok, health
+assert health.read_reachable is True and health.write_reachable is True, health
+
+record = VectorRecord(
+    id=marker,
+    kind="memory",
+    ref=marker,
+    title="Local vector persistence smoke",
+    content=marker,
+    metadata={"smoke": True},
+)
+embedding = [1.0] + [0.0] * 767
+store.upsert(
+    "memory",
+    [VectorWriteRecord(record, embedding, hashlib.sha256(marker.encode()).hexdigest())],
+)
+hits = store.search(["memory"], embedding, limit=1, kinds=["memory"])
+assert hits and hits[0].id == marker, hits
+print(f"role health, upsert, and search passed for {marker}")
+PY
+}
+
+compose config --quiet
+services=$(compose config --services)
+printf '%s\n' "$services" | grep -qx vector-db
+printf '%s\n' "$services" | grep -qx vector-migrate
+
+compose up --build --wait vector-migrate core
+migration_status=$(compose run --rm --no-deps vector-migrate)
+printf '%s\n' "$migration_status" | grep -q '"pending": \[\]'
+probe_vector
+
+compose restart vector-db core
+compose up --wait vector-db core
+probe_vector
+
+echo "Local pgvector migration, least-privilege roles, search, and restart persistence passed."