d27dd0ffbb
Close 12 audit-driven platform-compliance gaps on a single branch. - D4 dispatch: app/integrations/dispatch_client.py participant `legacyhub`, emits LegacyhubDocumentIndexed + AssetDerivativeReady after the indexing commit (idempotent uuid5), http_inbox route (reindex/tombstone) with audit-based dedupe; docs/dispatch-contract.md. Celery+Redis stays intra-module. - D2 SSO: app/integrations/identity.py validates X-TeamHub-* + role/scope mapper; security.py adds trusted-header enforcement (AUTH_REQUIRE_IDENTITY) and a scope check on /search; docker-compose.teamhub.yml (external teamhub_net + internal db net, api not host-published); RUNBOOK network/firewall section. - Asset standard: SearchHit/Citation carry asset_id/owner_module; buckets renamed teamhub-legacyhub-* (+quarantine/tmp/exports); purge-by-asset_id with legal-hold guard (app/indexing/projection.py); OCR-markdown derivative event. - audit_log model + Alembic 0003 + record_audit on writes (same transaction). - Secret masking: app/common/json_logger.py recursive mask wired into structlog (+ensure_ascii=False); event payloads redacted before persistence. - Service X-API-Key mandatory on ingest endpoints (defence-in-depth). - Port: host API 8000->8050 (collision with SalesHUB/MailHUB resolved), container still listens on 8000. - Config: no plaintext secret defaults; fail-loud in non-dev (no value leak). - Docs drift: README PG 5440, layered-auth note, 5173 removed from CORS; ingest/folder gated by ENABLE_FOLDER_INGEST (410 by default). - ADRs: layers mapping, shared-core extraction, UI locale (RU-first). Tests: 78 passing (ruff, compileall, pytest, tsc, vite build, compose config). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
99 lines
2.6 KiB
Plaintext
99 lines
2.6 KiB
Plaintext
# ---- PRODUCTION TEMPLATE ----
|
|
# Copy to .env.prod and replace every PLACEHOLDER value.
|
|
# Never commit .env.prod.
|
|
# All values below are placeholders — rotation required before use.
|
|
|
|
# ==== PostgreSQL ====
|
|
POSTGRES_HOST=postgres
|
|
POSTGRES_PORT=5432
|
|
POSTGRES_DB=legacyhub
|
|
POSTGRES_USER=legacyhub_prod
|
|
POSTGRES_PASSWORD=__ROTATE_ME__
|
|
|
|
# ==== MinIO ====
|
|
MINIO_ENDPOINT=minio:9000
|
|
MINIO_ACCESS_KEY=__ROTATE_ME__
|
|
MINIO_SECRET_KEY=__ROTATE_ME__
|
|
MINIO_BUCKET_ORIGINALS=teamhub-legacyhub-originals
|
|
MINIO_BUCKET_DERIVED=teamhub-legacyhub-derived
|
|
MINIO_BUCKET_QUARANTINE=teamhub-legacyhub-quarantine
|
|
MINIO_BUCKET_TMP=teamhub-legacyhub-tmp
|
|
MINIO_BUCKET_EXPORTS=teamhub-legacyhub-exports
|
|
MINIO_SECURE=true
|
|
MINIO_REGION=us-east-1
|
|
|
|
# ==== OpenSearch (security plugin ON in prod overlay) ====
|
|
OPENSEARCH_HOST=opensearch
|
|
OPENSEARCH_PORT=9200
|
|
OPENSEARCH_USE_SSL=true
|
|
OPENSEARCH_VERIFY_CERTS=true
|
|
OPENSEARCH_USER=admin
|
|
OPENSEARCH_PASSWORD=__ROTATE_ME__
|
|
OPENSEARCH_INDEX_CHUNKS=legacy_chunks
|
|
OPENSEARCH_ADMIN_PASSWORD=__ROTATE_ME__
|
|
|
|
# ==== Qdrant ====
|
|
QDRANT_HOST=qdrant
|
|
QDRANT_PORT=6333
|
|
QDRANT_API_KEY=__ROTATE_ME__
|
|
QDRANT_COLLECTION_CHUNKS=legacy_chunks
|
|
|
|
# ==== Redis ====
|
|
REDIS_URL=redis://:__ROTATE_ME__@redis:6379/0
|
|
|
|
# ==== OCR ====
|
|
OCR_LANGUAGES=rus+eng
|
|
OCR_ENABLED=true
|
|
DOCLING_OCR_ENABLED=false
|
|
MAX_DOCUMENT_TIMEOUT_SECONDS=300
|
|
|
|
# ==== Embeddings / Reranker ====
|
|
EMBEDDING_MODEL=BAAI/bge-m3
|
|
EMBEDDING_DIM=1024
|
|
EMBEDDING_DEVICE=cuda
|
|
EMBEDDING_BATCH_SIZE=32
|
|
EMBEDDING_NORMALIZE=true
|
|
|
|
RERANKER_MODEL=BAAI/bge-reranker-v2-m3
|
|
RERANKER_DEVICE=cuda
|
|
RERANKER_ENABLED=true
|
|
RERANKER_BATCH_SIZE=32
|
|
|
|
# ==== Hybrid search ====
|
|
HYBRID_OPENSEARCH_TOP_K=50
|
|
HYBRID_QDRANT_TOP_K=50
|
|
HYBRID_RRF_K=60
|
|
RERANK_CANDIDATES=40
|
|
|
|
# ==== App ====
|
|
APP_ENV=prod
|
|
APP_LOG_LEVEL=INFO
|
|
APP_HOST=0.0.0.0
|
|
APP_PORT=8000
|
|
API_HOST_PORT=8050
|
|
APP_INPUT_DIR=/data/input
|
|
APP_WORK_DIR=/data/work
|
|
APP_API_PREFIX=/api/v1
|
|
|
|
# Comma-separated list of allowed origins. NEVER use * in production.
|
|
CORS_ALLOWED_ORIGINS=https://legacyhub.teamhub.example
|
|
|
|
# Mandatory in production. Use a long random value (e.g. `openssl rand -hex 32`).
|
|
API_KEY=__ROTATE_ME__
|
|
|
|
# Service-to-service key for participant ingest endpoints. Set a distinct value
|
|
# per participant; falls back to API_KEY when empty.
|
|
INGEST_API_KEY=__ROTATE_ME__
|
|
|
|
# Behind the gateway this must be true so the API rejects requests lacking
|
|
# trusted X-TeamHub-* identity headers.
|
|
AUTH_REQUIRE_IDENTITY=true
|
|
AUTH_APP_CODE=legacyhub
|
|
|
|
# ==== Dispatch (inter-module event bus, D4) ====
|
|
DISPATCH_ENABLED=true
|
|
DISPATCH_API_URL=http://dispatch-api:8000
|
|
DISPATCH_API_KEY=__ROTATE_ME__
|
|
DISPATCH_PARTICIPANT_CODE=legacyhub
|
|
DISPATCH_TIMEOUT_SECONDS=5
|