feat(ai-workspace): add local relay profiles

2026-06-20 12:54:19 +03:00
parent 2d5fef3948
commit 3526351b1b
28 changed files with 2959 additions and 77 deletions
@@ -171,6 +171,44 @@ TASKER_SYNC_SOURCE=1 ./infra/synology/deploy-current.sh

 Если emergency-fix был сделан прямо на Synology в этих env-файлах, перенести sanitized-значение в `.env.synology.example`/docs, а секрет оставить только в live env.

+## AI Hub relay-only deploy
+
+Для локального тестирования с внешней Codex-машиной нельзя деплоить Launcher, Engine, Ops, Authentik или Tasker. Единственная допустимая удалённая точка в этой схеме — `ai-workspace-hub`, потому что удалённый worker должен иметь публичный WebSocket/HTTP relay.
+
+С Mac, при смонтированном `/Volumes/docker`, синхронизировать только Hub source, compose и узкий apply-script:
+
+```bash
+cd /Users/dcconstructions/Downloads/mnt/NODEDC/platform
+NAS_ROOT=/Volumes/docker/nodedc-platform ./infra/synology/sync-ai-hub-relay.sh
+```
+
+На Synology применить только `ai-workspace-hub`:
+
+```bash
+ssh dctouch@100.109.216.21 'cd /volume1/docker/nodedc-platform/platform && sudo bash apply-ai-hub-relay.sh'
+```
+
+Этот путь намеренно делает только:
+
+- build `nodedc/ai-workspace-hub:local`;
+- `docker compose up -d --no-deps --force-recreate ai-workspace-hub`;
+- container health check;
+- проверку `/api/ai-workspace/hub/v1/assistant-relays/<relayId>/poll`;
+- public route check через `https://ai-hub.nodedc.ru`.
+
+Он не меняет `.env.synology`, не синхронизирует Launcher/Tasker/Ops source, не пересоздаёт Authentik, reverse-proxy, базы, storage или product containers.
+
+После успешного relay-only deploy локальная цепочка для теста должна быть такой:
+
+```text
+local Launcher/Engine/Ops/Auth/Assistant
+  -> deployed AI Hub relay: https://ai-hub.nodedc.ru
+  -> remote Codex worker
+  -> deployed AI Hub relay
+  -> local Assistant relay poll
+  -> local product services
+```
+
 ## Лёгкое обновление Hub / Launcher

 Для правок только в Launcher/BFF не пересоздавать Authentik, reverse-proxy, Tasker и Ops Agents:
@@ -0,0 +1,218 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+DOCKER_BIN="${DOCKER_BIN:-/usr/local/bin/docker}"
+PLATFORM_DIR="${PLATFORM_DIR:-/volume1/docker/nodedc-platform/platform}"
+ENV_FILE="${ENV_FILE:-${PLATFORM_DIR}/${NODEDC_SYNOLOGY_ENV_FILE:-.env.synology}}"
+COMPOSE_FILE="${COMPOSE_FILE:-${PLATFORM_DIR}/docker-compose.platform-http.yml}"
+HUB_DIR="${HUB_DIR:-${PLATFORM_DIR}/ai-workspace-hub}"
+RELAY_ID="${AI_WORKSPACE_ASSISTANT_ACTION_RELAY_ID:-local-dev}"
+PUBLIC_VERIFY_BASE_URL="${AI_WORKSPACE_HUB_VERIFY_BASE_URL:-https://ai-hub.nodedc.ru}"
+VERIFY_PUBLIC="${VERIFY_PUBLIC:-1}"
+
+if [[ ! -x "${DOCKER_BIN}" ]]; then
+  DOCKER_BIN="$(command -v docker)"
+fi
+
+read_env_value() {
+  local file="$1"
+  local key="$2"
+  awk -F= -v key="$key" '
+    $0 ~ "^[[:space:]]*#" { next }
+    $1 == key {
+      value = substr($0, index($0, "=") + 1)
+      gsub(/^[[:space:]]+|[[:space:]]+$/, "", value)
+      gsub(/^"|"$/, "", value)
+      print value
+      exit
+    }
+  ' "$file"
+}
+
+require_file() {
+  local path="$1"
+  local label="$2"
+  if [[ ! -f "${path}" ]]; then
+    echo "${label} missing: ${path}" >&2
+    exit 1
+  fi
+}
+
+require_dir() {
+  local path="$1"
+  local label="$2"
+  if [[ ! -d "${path}" ]]; then
+    echo "${label} missing: ${path}" >&2
+    exit 1
+  fi
+}
+
+show_container_debug() {
+  local container_id="$1"
+  echo "== ai-workspace-hub debug =="
+  "${DOCKER_BIN}" ps --filter "id=${container_id}" --format 'table {{.Names}}\t{{.Status}}\t{{.Ports}}' || true
+  echo "-- recent logs --"
+  "${DOCKER_BIN}" logs --tail 120 "${container_id}" || true
+}
+
+check_container_health() {
+  local container_id="$1"
+  "${DOCKER_BIN}" exec "${container_id}" node -e '
+fetch("http://127.0.0.1:18081/healthz")
+  .then(async (response) => {
+    const body = await response.text();
+    console.log(body);
+    process.exit(response.ok ? 0 : 1);
+  })
+  .catch(() => process.exit(2));
+'
+}
+
+check_container_relay_route() {
+  local container_id="$1"
+  "${DOCKER_BIN}" exec \
+    -e RELAY_ID="${RELAY_ID}" \
+    -e RELAY_TOKEN="${relay_token}" \
+    "${container_id}" \
+    node -e '
+const relayId = encodeURIComponent(process.env.RELAY_ID || "local-dev");
+const token = process.env.RELAY_TOKEN || "";
+fetch(`http://127.0.0.1:18081/api/ai-workspace/hub/v1/assistant-relays/${relayId}/poll`, {
+  method: "POST",
+  headers: {
+    authorization: `Bearer ${token}`,
+    accept: "application/json",
+    "content-type": "application/json",
+  },
+  body: JSON.stringify({ limit: 1, timeoutMs: 1 }),
+})
+  .then(async (response) => {
+    const text = await response.text();
+    if (response.status !== 200) {
+      console.error(`relay route failed: status=${response.status} body=${text.slice(0, 300)}`);
+      process.exit(1);
+    }
+    let payload = {};
+    try {
+      payload = JSON.parse(text);
+    } catch {}
+    console.log(JSON.stringify({
+      ok: payload.ok === true,
+      relayId: payload.relayId,
+      calls: Array.isArray(payload.calls) ? payload.calls.length : null,
+    }));
+  })
+  .catch((error) => {
+    console.error(error);
+    process.exit(2);
+  });
+'
+}
+
+echo "== ai hub relay preflight =="
+require_dir "${PLATFORM_DIR}" "Platform directory"
+require_dir "${HUB_DIR}" "AI Workspace Hub source directory"
+require_file "${ENV_FILE}" "Synology env file"
+require_file "${COMPOSE_FILE}" "Synology compose file"
+require_file "${HUB_DIR}/Dockerfile" "AI Workspace Hub Dockerfile"
+require_file "${HUB_DIR}/package.json" "AI Workspace Hub package.json"
+require_file "${HUB_DIR}/src/server.mjs" "AI Workspace Hub server"
+
+hub_token="${AI_WORKSPACE_HUB_TOKEN:-$(read_env_value "${ENV_FILE}" AI_WORKSPACE_HUB_TOKEN || true)}"
+internal_token="${NODEDC_INTERNAL_ACCESS_TOKEN:-$(read_env_value "${ENV_FILE}" NODEDC_INTERNAL_ACCESS_TOKEN || true)}"
+relay_token="${hub_token:-${internal_token}}"
+if [[ -z "${relay_token}" ]]; then
+  echo "No AI_WORKSPACE_HUB_TOKEN or NODEDC_INTERNAL_ACCESS_TOKEN found for relay verification." >&2
+  exit 1
+fi
+
+cd "${PLATFORM_DIR}"
+
+if ! "${DOCKER_BIN}" compose --env-file "${ENV_FILE}" -f "${COMPOSE_FILE}" config --services \
+  | grep -qx 'ai-workspace-hub'; then
+  echo "Compose service ai-workspace-hub is not available." >&2
+  exit 1
+fi
+
+echo "== build ai-workspace-hub only =="
+"${DOCKER_BIN}" compose \
+  --env-file "${ENV_FILE}" \
+  -f "${COMPOSE_FILE}" \
+  build ai-workspace-hub
+
+echo "== recreate ai-workspace-hub only =="
+"${DOCKER_BIN}" compose \
+  --env-file "${ENV_FILE}" \
+  -f "${COMPOSE_FILE}" \
+  up -d --no-deps --force-recreate ai-workspace-hub
+
+container_id="$(
+  "${DOCKER_BIN}" compose \
+    --env-file "${ENV_FILE}" \
+    -f "${COMPOSE_FILE}" \
+    ps -q ai-workspace-hub
+)"
+if [[ -z "${container_id}" ]]; then
+  echo "Cannot resolve ai-workspace-hub container id after apply." >&2
+  exit 1
+fi
+
+echo "== container health =="
+health_ok=0
+for attempt in $(seq 1 30); do
+  if check_container_health "${container_id}"; then
+    health_ok=1
+    break
+  fi
+  echo "ai-workspace-hub-not-ready attempt=${attempt}/30"
+  sleep 2
+done
+if [[ "${health_ok}" != "1" ]]; then
+  show_container_debug "${container_id}"
+  exit 1
+fi
+
+echo "== container relay route =="
+relay_ok=0
+for attempt in $(seq 1 10); do
+  if check_container_relay_route "${container_id}"; then
+    relay_ok=1
+    break
+  fi
+  echo "ai-workspace-hub-relay-not-ready attempt=${attempt}/10"
+  sleep 2
+done
+if [[ "${relay_ok}" != "1" ]]; then
+  show_container_debug "${container_id}"
+  exit 1
+fi
+
+if [[ "${VERIFY_PUBLIC}" == "1" ]]; then
+  if command -v curl >/dev/null 2>&1; then
+    echo "== public relay route =="
+    public_body="$(mktemp -t ai-hub-relay-public.XXXXXX)"
+    public_status="$(
+      curl -k -sS -m 20 \
+        -o "${public_body}" \
+        -w '%{http_code}' \
+        -X POST "${PUBLIC_VERIFY_BASE_URL%/}/api/ai-workspace/hub/v1/assistant-relays/${RELAY_ID}/poll" \
+        -H "Authorization: Bearer ${relay_token}" \
+        -H 'Accept: application/json' \
+        -H 'Content-Type: application/json' \
+        --data '{"limit":1,"timeoutMs":1}'
+    )"
+    if [[ "${public_status}" != "200" ]]; then
+      echo "public relay route failed: status=${public_status}" >&2
+      head -c 300 "${public_body}" >&2 || true
+      echo >&2
+      rm -f "${public_body}"
+      exit 1
+    fi
+    rm -f "${public_body}"
+    echo "public-relay-route-ok"
+  else
+    echo "curl is not available; skipped public relay route check."
+  fi
+fi
+
+echo "ai-hub-relay-apply-ok"
@@ -64,6 +64,14 @@ rsync -av "${RSYNC_METADATA_ARGS[@]}" --delete \
  "${PLATFORM_REPO}/services/ai-workspace-assistant/" \
  "${NAS_ROOT}/platform/ai-workspace-assistant/"

+mkdir -p "${NAS_ROOT}/platform/ai-workspace-assistant/ontology-core"
+rsync -av "${RSYNC_METADATA_ARGS[@]}" --delete \
+  --exclude='node_modules/' \
+  --exclude='.env' \
+  --exclude='.env.*' \
+  "${PLATFORM_REPO}/services/ontology-core/" \
+  "${NAS_ROOT}/platform/ai-workspace-assistant/ontology-core/"
+
 if [[ "${SYNC_AUTHENTIK_TEMPLATES}" == "1" ]]; then
  mkdir -p "${NAS_ROOT}/authentik/custom-templates"
  rsync -av "${RSYNC_METADATA_ARGS[@]}" --delete \
@@ -142,6 +142,7 @@ services:
      AI_WORKSPACE_HUB_INTERNAL_URL: ${AI_WORKSPACE_HUB_INTERNAL_URL:-https://ai-hub.nodedc.ru}
      AI_WORKSPACE_HUB_TOKEN: ${AI_WORKSPACE_HUB_TOKEN:?ai workspace hub token required}
      AI_WORKSPACE_HUB_FALLBACK_URLS: ${AI_WORKSPACE_HUB_FALLBACK_URLS:-}
+      NDC_ONTOLOGY_LAUNCHER_BASE_URL: http://launcher:5173
    expose:
      - "18082"
    ports:
@@ -165,6 +166,7 @@ services:
      PORT: 18081
      AI_WORKSPACE_HUB_TOKEN: ${AI_WORKSPACE_HUB_TOKEN:?ai workspace hub token required}
      NODEDC_INTERNAL_ACCESS_TOKEN: ${NODEDC_INTERNAL_ACCESS_TOKEN:-}
+      NODEDC_AI_WORKSPACE_ASSISTANT_URL: http://ai-workspace-assistant:18082
      AI_WORKSPACE_HUB_WS_PATH: /api/ai-workspace/hub
    expose:
      - "18081"
@@ -0,0 +1,56 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
+PLATFORM_REPO="$(cd -- "${SCRIPT_DIR}/../.." && pwd)"
+NAS_ROOT="${NAS_ROOT:-/Volumes/docker/nodedc-platform}"
+SSH_TARGET="${SSH_TARGET:-dctouch@100.109.216.21}"
+
+RSYNC_METADATA_ARGS=()
+if [[ "${RSYNC_PRESERVE_METADATA:-0}" != "1" ]]; then
+  RSYNC_METADATA_ARGS=(--no-times --no-perms --no-owner --no-group)
+fi
+
+if [[ ! -d "${NAS_ROOT}" ]]; then
+  echo "NAS_ROOT not found: ${NAS_ROOT}" >&2
+  echo "Set NAS_ROOT=/path/to/nodedc-platform when the Synology share is mounted elsewhere." >&2
+  exit 1
+fi
+
+if [[ ! -f "${PLATFORM_REPO}/infra/synology/docker-compose.platform-http.yml" ]]; then
+  echo "Synology compose is missing in local repo." >&2
+  exit 1
+fi
+
+if [[ ! -d "${PLATFORM_REPO}/services/ai-workspace-hub" ]]; then
+  echo "AI Workspace Hub source is missing in local repo." >&2
+  exit 1
+fi
+
+mkdir -p "${NAS_ROOT}/platform"
+
+rsync -av "${RSYNC_METADATA_ARGS[@]}" \
+  "${PLATFORM_REPO}/infra/synology/docker-compose.platform-http.yml" \
+  "${NAS_ROOT}/platform/docker-compose.platform-http.yml"
+
+rsync -av "${RSYNC_METADATA_ARGS[@]}" \
+  "${PLATFORM_REPO}/infra/synology/apply-ai-hub-relay.sh" \
+  "${NAS_ROOT}/platform/apply-ai-hub-relay.sh"
+
+mkdir -p "${NAS_ROOT}/platform/ai-workspace-hub"
+rsync -av "${RSYNC_METADATA_ARGS[@]}" --delete \
+  --exclude='node_modules/' \
+  --exclude='.env' \
+  --exclude='.env.*' \
+  "${PLATFORM_REPO}/services/ai-workspace-hub/" \
+  "${NAS_ROOT}/platform/ai-workspace-hub/"
+
+cat <<EOF
+
+AI Hub relay files synced to NAS mount.
+
+Apply only AI Workspace Hub on Synology:
+
+ssh ${SSH_TARGET} 'cd /volume1/docker/nodedc-platform/platform && sudo bash apply-ai-hub-relay.sh'
+
+EOF