feat(ops): W4-B single-container packaging, DATA_DIR, backup/restore
- DATA_DIR (/data: agent-sessions, backups, exports, tmp); entrypoint chowns it to PUID/PGID then drops privileges via gosu; /app binary stays root read-only - compile with --allow-read --allow-write so mounted library roots are writable - preflight: DATA_DIR/session dir must be writable (fatal); enabled library roots and downloader path mappings checked read/write (warn + audit) - --role export-mappings (mapping manifest JSON, --compare row counts) and --role read-only-on (automation.readOnlyReconcile=true + audit) - scripts/backup.sh (pg_dump custom + mappings + agent sessions, SHA256SUMS, BACKUP_KEEP rotation) and scripts/restore.sh (checksum, refuses with live connections, psql single-transaction replay compatible with PG16, read-only reconcile on, row-count verification) - compose: app + postgres only, data volume, env example with key generation - docs: runbook deploy.md, backup-restore.md with verification record Co-Authored-By: Claude Opus 5.5 <[email protected]>
This commit is contained in:
rootandClaude Opus 5.5 committed
1 parent
8c6a922cfb
commit
34e8751b45
18 files changed
+918
-43
No files matched your search
+83
-19
@@ -2,20 +2,36 @@ import { parseArgs } from "node:util";
|
||||
import { createDb, migrateToLatest } from "@umt/db";
|
||||
import { migrateEngineSchema } from "@umt/tasks";
|
||||
import denoJson from "../deno.json" with { type: "json" };
|
||||
import { loadConfig } from "./config.ts";
|
||||
import { DATA_SUBDIRS, dataPaths, loadConfig } from "./config.ts";
|
||||
import { bootstrap } from "./context.ts";
|
||||
import { createApp } from "./http/app.ts";
|
||||
import { PgEventBus } from "./http/sse-pg.ts";
|
||||
import { createLogger } from "./logger.ts";
|
||||
import { SERVER_MODULES } from "./modules/index.ts";
|
||||
import { runPreflight } from "./preflight.ts";
|
||||
import { diffCounts, enableReadOnlyReconcile, exportMappings, type MappingExport, writeMappingExport } from "./ops.ts";
|
||||
import { auditStorageWarnings, checkStorage, loadMountedPaths, runPreflight } from "./preflight.ts";
|
||||
import { startWorker } from "./worker/index.ts";
|
||||
|
||||
// api/worker/all 是常驻角色;migrate/preflight/probe 是容器入口脚本用的一次性子命令
|
||||
const Roles = ["api", "worker", "all", "migrate", "preflight", "probe"] as const;
|
||||
// api/worker/all 是常驻角色;其余是容器入口 / 备份恢复脚本用的一次性子命令:
|
||||
// migrate | preflight | probe
|
||||
// export-mappings --out <file.json> [--compare <基准清单.json>] 映射清单导出(可与基准比行数)
|
||||
// read-only-on [--reason <文本>] 打开 automation.readOnlyReconcile
|
||||
const Roles = ["api", "worker", "all", "migrate", "preflight", "probe", "export-mappings", "read-only-on"] as const;
|
||||
type Role = (typeof Roles)[number];
|
||||
const OneShot = ["migrate", "preflight", "export-mappings", "read-only-on"] as const;
|
||||
type OneShotRole = (typeof OneShot)[number];
|
||||
const isOneShot = (r: Role): r is OneShotRole => (OneShot as readonly Role[]).includes(r);
|
||||
|
||||
const { values } = parseArgs({ args: Deno.args, options: { role: { type: "string", default: "all" } }, strict: true });
|
||||
const { values } = parseArgs({
|
||||
args: Deno.args,
|
||||
options: {
|
||||
role: { type: "string", default: "all" },
|
||||
out: { type: "string" },
|
||||
compare: { type: "string" },
|
||||
reason: { type: "string" },
|
||||
},
|
||||
strict: true,
|
||||
});
|
||||
const role = values.role as Role;
|
||||
if (!Roles.includes(role)) {
|
||||
console.error(`--role 必须是 ${Roles.join("|")}`);
|
||||
@@ -42,28 +58,20 @@ try {
|
||||
Deno.exit(2);
|
||||
}
|
||||
|
||||
// 运行期写入统一落在 DATA_DIR;Agent 会话目录经环境变量传给 agent 模块(它只读 AGENT_SESSION_DIR)
|
||||
const paths = dataPaths(config);
|
||||
Deno.env.set("AGENT_SESSION_DIR", paths.sessionDir);
|
||||
|
||||
const logger = createLogger({
|
||||
level: config.LOG_LEVEL,
|
||||
pretty: config.NODE_ENV === "development" && Deno.stdout.isTerminal(),
|
||||
});
|
||||
const db = createDb({ connectionString: config.DATABASE_URL });
|
||||
|
||||
if (role === "migrate" || role === "preflight") {
|
||||
if (isOneShot(role)) {
|
||||
let code = 0;
|
||||
try {
|
||||
if (role === "migrate") {
|
||||
const { results } = await migrateToLatest(db);
|
||||
for (const r of results ?? []) logger.info({ migration: r.migrationName, status: r.status }, "migration");
|
||||
logger.info({ applied: results?.length ?? 0 }, "迁移完成");
|
||||
// 任务引擎自己的表(openworkflow schema);api/worker 进程启动时不再迁移
|
||||
await migrateEngineSchema(config.DATABASE_URL);
|
||||
logger.info("任务引擎迁移完成");
|
||||
} else {
|
||||
const problems = await runPreflight({ config, db });
|
||||
for (const p of problems) logger.error({ check: p.check }, p.message);
|
||||
if (problems.length) code = 1;
|
||||
else logger.info("启动自检通过");
|
||||
}
|
||||
code = await runOneShot(role);
|
||||
} catch (err) {
|
||||
logger.error({ err }, `${role} 失败`);
|
||||
code = 1;
|
||||
@@ -73,6 +81,62 @@ if (role === "migrate" || role === "preflight") {
|
||||
Deno.exit(code);
|
||||
}
|
||||
|
||||
async function runOneShot(r: OneShotRole): Promise<number> {
|
||||
switch (r) {
|
||||
case "migrate": {
|
||||
const { results } = await migrateToLatest(db);
|
||||
for (const m of results ?? []) logger.info({ migration: m.migrationName, status: m.status }, "migration");
|
||||
logger.info({ applied: results?.length ?? 0 }, "迁移完成");
|
||||
// 任务引擎自己的表(openworkflow schema);api/worker 进程启动时不再迁移
|
||||
await migrateEngineSchema(config.DATABASE_URL);
|
||||
logger.info("任务引擎迁移完成");
|
||||
return 0;
|
||||
}
|
||||
case "preflight": {
|
||||
const problems = await runPreflight({ config, db });
|
||||
// 库/下载目录由用户挂载:不可读写只告警(并写审计),不阻止启动;数据目录不可写才阻止
|
||||
const mounts = problems.some((p) => p.check === "db") ? [] : await loadMountedPaths(db);
|
||||
const storage = await checkStorage({ ...paths, subdirs: DATA_SUBDIRS, mounts });
|
||||
problems.push(...storage.problems);
|
||||
for (const w of storage.warnings) {
|
||||
logger.warn({ kind: w.kind, id: w.id, path: w.path }, `挂载路径不可用: ${w.name} ${w.reason}`);
|
||||
}
|
||||
await auditStorageWarnings(db, storage.warnings).catch((err) => logger.warn({ err }, "存储告警写审计失败"));
|
||||
for (const p of problems) logger.error({ check: p.check }, p.message);
|
||||
if (problems.length) return 1;
|
||||
logger.info(
|
||||
{
|
||||
dataDir: paths.dataDir,
|
||||
sessionDir: paths.sessionDir,
|
||||
mounts: mounts.length,
|
||||
warnings: storage.warnings.length,
|
||||
},
|
||||
"启动自检通过",
|
||||
);
|
||||
return 0;
|
||||
}
|
||||
case "export-mappings": {
|
||||
const out = values.out ?? `${paths.exportsDir}/mappings-${new Date().toISOString().replace(/[:.]/g, "-")}.json`;
|
||||
const data = await exportMappings(db, denoJson.version);
|
||||
await writeMappingExport(out, data);
|
||||
logger.info({ out, counts: data.counts }, "映射清单已导出");
|
||||
if (!values.compare) return 0;
|
||||
const base = JSON.parse(await Deno.readTextFile(values.compare)) as MappingExport;
|
||||
const diff = diffCounts(base.counts, data.counts);
|
||||
if (diff.length) {
|
||||
logger.error({ diff }, "映射清单行数与基准不一致");
|
||||
return 3;
|
||||
}
|
||||
logger.info({ compare: values.compare }, "映射清单行数与基准一致");
|
||||
return 0;
|
||||
}
|
||||
case "read-only-on":
|
||||
await enableReadOnlyReconcile(db, values.reason ?? "restore");
|
||||
logger.info("已打开只读对账模式 automation.readOnlyReconcile=true");
|
||||
return 0;
|
||||
}
|
||||
}
|
||||
|
||||
// SSE 总线:sse_event 表 + LISTEN/NOTIFY,api 与 worker 分进程时事件互相可见
|
||||
let bus: PgEventBus;
|
||||
try {
|
||||
|
||||
Reference in new issue
Block a user