b2ec32c852
Production deployment now matches the host setup that already runs neuronetz.ai / neuro-landing: the gateway sits behind the jwilder nginx-proxy + acme-companion already on the host, instead of bundling its own Caddy sidecar. - docker-compose.yml: drop the Caddy service entirely. The gateway joins an external `proxy` Docker network (the same one neuronetz-web / neuronetz-www use) and advertises itself with VIRTUAL_HOST / VIRTUAL_PORT / LETSENCRYPT_HOST / LETSENCRYPT_EMAIL. nginx-proxy routes TLS-terminated traffic to it on the shared network; acme-companion handles Let's Encrypt issuance + renewal for api.neuronetz.ai automatically. NO host ports are published in this compose file anywhere — gateway, postgres, redis, ollama all stay unreachable from the host. Pinned container_names (neuronetz-gateway / -postgres / -redis / -ollama) for stable identification by nginx-proxy and ops scripts. - .env.example: add GATEWAY_VIRTUAL_HOST + LETSENCRYPT_EMAIL; flip the default GATEWAY_TRUSTED_PROXIES to `127.0.0.1,nginx-proxy`. - docs/DEPLOYMENT.md: the canonical path is now jwilder-proxy. Reorganized prerequisites + steps around it; documented adding HSTS and the other security headers via the nginx-proxy custom-config mechanism (/etc/nginx/vhost.d/<host>). The Caddy sidecar lives on as a documented alternative for hosts without jwilder-proxy (ops/caddy/Caddyfile.example is kept). The Ollama-never-exposed non-negotiable is unchanged.
71 lines
3.4 KiB
Plaintext
71 lines
3.4 KiB
Plaintext
# neuronetz-gateway — environment configuration (SPEC §7).
|
|
#
|
|
# Copy to `.env` and adjust. `.env` is gitignored and MUST NOT be committed.
|
|
# All values here are SAFE EXAMPLES — change every secret before any real deploy.
|
|
|
|
# ──────────────────────────── Service ────────────────────────────
|
|
GATEWAY_BIND_HOST=0.0.0.0
|
|
GATEWAY_BIND_PORT=8080
|
|
GATEWAY_LOG_LEVEL=INFO
|
|
GATEWAY_LOG_FORMAT=json # json|console
|
|
GATEWAY_REQUEST_ID_HEADER=X-Request-ID
|
|
GATEWAY_TRUSTED_PROXIES=127.0.0.1,nginx-proxy # for X-Forwarded-For
|
|
|
|
# ──────────── Public hostname (jwilder-proxy / acme-companion) ───────
|
|
# These are consumed by docker-compose.yml's gateway service so that the
|
|
# host's nginx-proxy stack routes TLS-terminated traffic for your domain.
|
|
# Mirrors the pattern used by neuro-landing.
|
|
GATEWAY_VIRTUAL_HOST=api.neuronetz.ai
|
|
LETSENCRYPT_EMAIL=admin@neuronetz.ai
|
|
|
|
# ──────────────────────────── Upstream ───────────────────────────
|
|
OLLAMA_BASE_URL=http://ollama:11434
|
|
OLLAMA_CONNECT_TIMEOUT_S=5
|
|
OLLAMA_READ_TIMEOUT_S=600
|
|
OLLAMA_MAX_CONNECTIONS=64
|
|
|
|
# ──────────────────────── Model discovery (§4.6) ─────────────────
|
|
MODEL_DISCOVERY_REFRESH_S=60
|
|
MODEL_DISCOVERY_CACHE_TTL_S=120
|
|
|
|
# ──────────────────────────── Database ───────────────────────────
|
|
# Compose builds DATABASE_URL from the POSTGRES_* parts below, but the gateway
|
|
# also accepts a full DATABASE_URL directly.
|
|
DATABASE_URL=postgresql+asyncpg://gateway:changeme@postgres:5432/neuronetz
|
|
DATABASE_POOL_SIZE=10
|
|
DATABASE_POOL_OVERFLOW=20
|
|
|
|
# Postgres container credentials (consumed by docker-compose).
|
|
POSTGRES_USER=gateway
|
|
POSTGRES_PASSWORD=changeme
|
|
POSTGRES_DB=neuronetz
|
|
|
|
# ──────────────────────────── Redis ──────────────────────────────
|
|
REDIS_URL=redis://redis:6379/0
|
|
REDIS_KEY_CACHE_TTL_S=60
|
|
|
|
# ────────────────── Limits (defaults; DB overrides) ──────────────
|
|
DEFAULT_RPM=60
|
|
DEFAULT_TPM=100000
|
|
DEFAULT_CONCURRENT=8
|
|
MAX_REQUEST_BODY_BYTES=262144
|
|
MAX_NUM_PREDICT=4096
|
|
|
|
# ──────────────────────────── Security ───────────────────────────
|
|
ARGON2_TIME_COST=3
|
|
ARGON2_MEMORY_COST_KIB=65536
|
|
ARGON2_PARALLELISM=4
|
|
AUTH_FAILURE_RATE_LIMIT_PER_IP_PER_MIN=20
|
|
|
|
# ──────────────────────────── Audit ──────────────────────────────
|
|
AUDIT_BUFFER_SIZE=1000
|
|
PROMPT_LOG_DEFAULT_RETENTION_DAYS=30
|
|
AUDIT_LOG_DEFAULT_RETENTION_DAYS=365
|
|
|
|
# ──────────────── Playground / API docs (prod-safe: OFF) ─────────
|
|
# Serve the playground HTML (owned by the docs agent) at /playground.
|
|
PLAYGROUND_ENABLED=false
|
|
PLAYGROUND_FILE=/app/playground/index.html
|
|
# Enable FastAPI's /docs + /openapi.json (default off in production).
|
|
DOCS_ENABLED=false
|