Files
aiagent/docker-compose.prod.yml

162 lines
5.1 KiB
YAML
Raw Normal View History

fix: 修复35个安全与功能缺陷,补全知识进化/数字孪生/行为采集模块 ## 安全修复 (12项) - Webhook接口添加全局Token认证,过滤敏感请求头 - 修复JWT Base64 padding公式,防止签名验证绕过 - 数据库密码/飞书Token从源码移除,改为环境变量 - 工作流引擎添加路径遍历防护 (_resolve_safe_path) - eval()添加模板长度上限检查 - 审批API添加认证依赖 - 前端v-html增强XSS转义,console.log仅开发模式输出 - 500错误不再暴露内部异常详情 ## Agent运行时修复 (7项) - 删除_inject_knowledge_context中未定义db变量的finally块 - 工具执行添加try/except保护,异常不崩溃Agent - LLM重试计入budget计数器 - self_review异常时passed=False - max_iterations截断标记success=False - 工具参数JSON解析失败时记录警告日志 - run()开始时重置_llm_invocations计数器 ## 配置与基础设施 - DEBUG默认False,SQL_ECHO独立配置项 - init_db()补全13个缺失模型导入 - 新增WEBHOOK_AUTH_TOKEN/SQL_ECHO配置项 - 新增.env.example模板文件 ## 前端修复 (12项) - 登录改用URLSearchParams替代FormData - 401拦截器通过Pinia store统一清理状态 - SSE流超时从60s延长至300s - final/error事件时清除streamTimeout - localStorage聊天记录添加24h TTL - safeParseArgCount替代模板中裸JSON.parse - fetchUser 401时同时清除user对象 ## 新增模块 - 知识进化: knowledge_extractor/retriever/tasks - 数字孪生: shadow_executor/comparison模型 - 行为采集: behavior_middleware/collector/fingerprint_engine - 代码审查: code_review_agent/document_review_agent - 反馈学习: feedback_learner - 瓶颈检测/优化引擎/成本估算/需求估算 - 速率限制器 (rate_limiter) - Alembic迁移 015-020 ## 文档 - 商业化落地计划 - 8篇docs文档 (架构/API/部署/开发/贡献等) - Docker Compose生产配置 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-05-10 19:50:20 +08:00
version: "3.8"
# 天工智能体平台 — 生产环境 Docker Compose
# 启动: docker compose -f docker-compose.prod.yml up -d
# 停止: docker compose -f docker-compose.prod.yml down
services:
# ─── MySQL ───────────────────────────────────────────────────
mysql:
image: mysql:8.0
container_name: aiagent-mysql
restart: always
environment:
MYSQL_ROOT_PASSWORD: ${MYSQL_ROOT_PASSWORD:-change-me}
MYSQL_DATABASE: agent_db
MYSQL_CHARSET: utf8mb4
MYSQL_COLLATION: utf8mb4_unicode_ci
ports:
- "3306:3306"
volumes:
- mysql_data:/var/lib/mysql
- ./backend/init.sql:/docker-entrypoint-initdb.d/init.sql:ro
healthcheck:
test: ["CMD", "mysqladmin", "ping", "-h", "localhost"]
interval: 10s
timeout: 5s
retries: 5
start_period: 30s
networks:
- aiagent-net
# ─── Redis ───────────────────────────────────────────────────
redis:
image: redis:7-alpine
container_name: aiagent-redis
restart: always
command: redis-server --appendonly yes --maxmemory 512mb --maxmemory-policy allkeys-lru
ports:
- "6379:6379"
volumes:
- redis_data:/data
healthcheck:
test: ["CMD", "redis-cli", "ping"]
interval: 10s
timeout: 3s
retries: 5
networks:
- aiagent-net
# ─── FastAPI 后端 ────────────────────────────────────────────
backend:
build:
context: ./backend
dockerfile: Dockerfile
container_name: aiagent-backend
restart: always
environment:
- DATABASE_URL=mysql+pymysql://root:${MYSQL_ROOT_PASSWORD:-change-me}@mysql:3306/agent_db?charset=utf8mb4
- REDIS_URL=redis://redis:6379/0
- JWT_SECRET_KEY=${JWT_SECRET_KEY:-prod-jwt-secret-change-me}
- SECRET_KEY=${SECRET_KEY:-prod-secret-change-me}
- CORS_ORIGINS=${CORS_ORIGINS:-http://localhost:8038,http://localhost:3000}
- OPENAI_API_KEY=${OPENAI_API_KEY:-}
- DEEPSEEK_API_KEY=${DEEPSEEK_API_KEY:-}
- EXTERNAL_URL=${EXTERNAL_URL:-http://localhost}
ports:
- "8037:8037"
depends_on:
mysql:
condition: service_healthy
redis:
condition: service_healthy
volumes:
- agent_workspaces:/app/agent_workspaces
- uploads:/app/uploads
- logs:/app/logs
healthcheck:
test: ["CMD", "curl", "-f", "http://localhost:8037/docs"]
interval: 30s
timeout: 10s
retries: 3
networks:
- aiagent-net
# ─── Celery Worker ───────────────────────────────────────────
celery-worker:
build:
context: ./backend
dockerfile: Dockerfile
container_name: aiagent-celery-worker
restart: always
command: celery -A app.core.celery_app worker --loglevel=info --concurrency=4
environment:
- DATABASE_URL=mysql+pymysql://root:${MYSQL_ROOT_PASSWORD:-change-me}@mysql:3306/agent_db?charset=utf8mb4
- REDIS_URL=redis://redis:6379/0
- JWT_SECRET_KEY=${JWT_SECRET_KEY:-prod-jwt-secret-change-me}
- SECRET_KEY=${SECRET_KEY:-prod-secret-change-me}
- OPENAI_API_KEY=${OPENAI_API_KEY:-}
- DEEPSEEK_API_KEY=${DEEPSEEK_API_KEY:-}
depends_on:
mysql:
condition: service_healthy
redis:
condition: service_healthy
volumes:
- agent_workspaces:/app/agent_workspaces
- uploads:/app/uploads
- logs:/app/logs
networks:
- aiagent-net
# ─── Celery Beat (定时调度) ──────────────────────────────────
celery-beat:
build:
context: ./backend
dockerfile: Dockerfile
container_name: aiagent-celery-beat
restart: always
command: celery -A app.core.celery_app beat --loglevel=info
environment:
- DATABASE_URL=mysql+pymysql://root:${MYSQL_ROOT_PASSWORD:-change-me}@mysql:3306/agent_db?charset=utf8mb4
- REDIS_URL=redis://redis:6379/0
- JWT_SECRET_KEY=${JWT_SECRET_KEY:-prod-jwt-secret-change-me}
- SECRET_KEY=${SECRET_KEY:-prod-secret-change-me}
depends_on:
mysql:
condition: service_healthy
redis:
condition: service_healthy
networks:
- aiagent-net
# ─── 前端 (Nginx) ───────────────────────────────────────────
frontend:
build:
context: ./frontend
dockerfile: Dockerfile
container_name: aiagent-frontend
restart: always
ports:
- "8038:80"
depends_on:
- backend
networks:
- aiagent-net
volumes:
mysql_data:
driver: local
redis_data:
driver: local
agent_workspaces:
driver: local
uploads:
driver: local
logs:
driver: local
networks:
aiagent-net:
driver: bridge