From 95b83bc70a58356becc19e88ea413178616d3630 Mon Sep 17 00:00:00 2001 From: sim Date: Sat, 7 Nov 2026 23:43:58 +0100 Subject: [PATCH] deploy: ai-app in Rollout-Skripte fuer Host 131 aufnehmen sync: ai-app.env-Grundgeruest. provision-secrets: Rolle ai_app, DB ai_app_tenant, Listen-Adresse. apply: Build, Binaries ai-app/ai-migrate, Migrationen, Unit, Start. healthcheck und selfheal um ai-app erweitert. Co-Authored-By: Claude Sonnet 5.5 --- deploy/rollout-131-apply.sh | 36 +++++++++++++++++------ deploy/rollout-131-healthcheck.sh | 4 +++ deploy/rollout-131-provision-secrets.sh | 38 +++++++++++++++++++++++++ deploy/rollout-131-selfheal.sh | 19 +++++++++---- deploy/rollout-131-sync.sh | 6 ++++ 5 files changed, 89 insertions(+), 14 deletions(-) diff --git a/deploy/rollout-131-apply.sh b/deploy/rollout-131-apply.sh index bb334f01..1cae5e75 100644 --- a/deploy/rollout-131-apply.sh +++ b/deploy/rollout-131-apply.sh @@ -20,6 +20,7 @@ REPO_DIR="${NEXARCH_ROLLOUT_REPO_DIR:-/root/nexarch-code}" ENV_DIR=/etc/nexarch DMS_INSTALL_DIR="${NEXARCH_DMS_INSTALL_DIR:-/opt/nexarch-dms}" CONNECT_INSTALL_DIR="${NEXARCH_CONNECT_INSTALL_DIR:-/opt/nexarch-connect}" +AI_INSTALL_DIR="${NEXARCH_AI_INSTALL_DIR:-/opt/nexarch-ai}" DMS_STORAGE_DIR="${NEXARCH_DMS_STORAGE_DIR:-/var/lib/nexarch-dms/storage}" DMS_STAGING_DIR="${NEXARCH_DMS_STAGING_DIR:-/var/lib/nexarch-dms/staging}" SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" @@ -50,10 +51,18 @@ require_set() { return 0 } -echo "== 1. Pruefe die 5 echten TODO-Werte ==" +echo "== 1. Pruefe die echten TODO-Werte ==" missing=0 require_set "$ENV_DIR/connect-app.env" NEXARCH_CONNECT_APP_LISTEN_ADDR || missing=1 require_set "$ENV_DIR/connect-app.env" NEXARCH_CONNECT_APP_TENANT_DSN || missing=1 +require_set "$ENV_DIR/ai-app.env" NEXARCH_AI_APP_LISTEN_ADDR || missing=1 +require_set "$ENV_DIR/ai-app.env" NEXARCH_AI_APP_TENANT_DSN || missing=1 +require_set "$ENV_DIR/ai-app.env" NEXARCH_AI_APP_SERVICE_TOKEN || missing=1 +if ! require_set "$ENV_DIR/ai-app.env" NEXARCH_AI_APP_POLICY_URL 2>/dev/null \ + && ! grep -q '^NEXARCH_AI_APP_POLICY_DISABLED=1' "$ENV_DIR/ai-app.env" 2>/dev/null; then + echo "OFFEN: NEXARCH_AI_APP_POLICY_URL (mit _POLICY_SERVICE_TOKEN) oder NEXARCH_AI_APP_POLICY_DISABLED=1 in $ENV_DIR/ai-app.env" >&2 + missing=1 +fi require_set "$ENV_DIR/dms-app.env" NEXARCH_DMS_APP_CORE_SERVICE_TOKEN || missing=1 require_set "$ENV_DIR/dms-app.env" NEXARCH_DMS_APP_KEK_CLIENT_ID || missing=1 require_set "$ENV_DIR/dms-app.env" NEXARCH_DMS_APP_KEK_CLIENT_SECRET || missing=1 @@ -63,10 +72,10 @@ if [ "$missing" -eq 1 ]; then echo "Trage die fehlenden Werte von Hand in die genannten Dateien ein und starte das Skript erneut." >&2 exit 1 fi -echo "Alle 5 TODO-Werte sind gesetzt." +echo "Alle TODO-Werte sind gesetzt." echo "== 2. Build (falls rollout-131-sync.sh das noch nicht getan hat) ==" -for mod in dms connect; do +for mod in dms connect ai; do if [ -f "$REPO_DIR/$mod/go.mod" ]; then ( cd "$REPO_DIR/$mod" && go build ./... && go vet ./... ) echo "gebaut/verifiziert: $mod" @@ -77,14 +86,16 @@ for mod in dms connect; do done echo "== 3. Binaries kopieren ==" -mkdir -p "$DMS_INSTALL_DIR/bin" "$CONNECT_INSTALL_DIR/bin" +mkdir -p "$DMS_INSTALL_DIR/bin" "$CONNECT_INSTALL_DIR/bin" "$AI_INSTALL_DIR/bin" ( cd "$REPO_DIR/dms" && go build -o "$DMS_INSTALL_DIR/bin/dms-app" ./cmd/app ) ( cd "$REPO_DIR/dms" && go build -o "$DMS_INSTALL_DIR/bin/dms-worker" ./cmd/worker ) ( cd "$REPO_DIR/connect" && go build -o "$CONNECT_INSTALL_DIR/bin/connect-app" ./cmd/connect-app ) -echo "Binaries liegen unter ${DMS_INSTALL_DIR}/bin und ${CONNECT_INSTALL_DIR}/bin." +( cd "$REPO_DIR/ai" && go build -o "$AI_INSTALL_DIR/bin/ai-app" ./cmd/ai-app ) +( cd "$REPO_DIR/ai" && go build -o "$AI_INSTALL_DIR/bin/ai-migrate" ./cmd/migrate ) +echo "Binaries liegen unter ${DMS_INSTALL_DIR}/bin, ${CONNECT_INSTALL_DIR}/bin und ${AI_INSTALL_DIR}/bin." if id nexarch >/dev/null 2>&1; then - chown -R nexarch:nexarch "$DMS_INSTALL_DIR" "$CONNECT_INSTALL_DIR" + chown -R nexarch:nexarch "$DMS_INSTALL_DIR" "$CONNECT_INSTALL_DIR" "$AI_INSTALL_DIR" else echo "WARNUNG: Systembenutzer 'nexarch' existiert nicht -- Units werden trotzdem als User=nexarch geschrieben (wie bei Core/Archive ueblich), legen den Benutzer aber nicht an. Falls er fehlt, vor dem Start anlegen: useradd --system --no-create-home --shell /usr/sbin/nologin nexarch" >&2 fi @@ -129,7 +140,15 @@ else echo "${ENV_DIR}/dms-worker.env existiert bereits -- wird nicht ueberschrieben." fi +echo "== 5b. AI-Migrationen anwenden ==" +AI_DSN="$(grep '^NEXARCH_AI_APP_TENANT_DSN=' "$ENV_DIR/ai-app.env" | head -n1 | cut -d= -f2-)" +NEXARCH_AI_APP_TENANT_DSN="$AI_DSN" "$AI_INSTALL_DIR/bin/ai-migrate" "$REPO_DIR/ai/migrations" +unset AI_DSN + echo "== 6. systemd-Units installieren ==" +sed -e "s#__INSTALL_DIR__#${AI_INSTALL_DIR}#g" \ + "$SCRIPT_DIR/systemd/nexarch-ai-app.service.tmpl" > /etc/systemd/system/nexarch-ai-app.service + sed -e "s#__INSTALL_DIR__#${CONNECT_INSTALL_DIR}#g" \ "$SCRIPT_DIR/systemd/nexarch-connect-app.service.tmpl" > /etc/systemd/system/nexarch-connect-app.service @@ -142,7 +161,7 @@ sed -e "s#__INSTALL_DIR__#${DMS_INSTALL_DIR}#g" \ -e "s#__STORAGE_DIR__#${DMS_STORAGE_DIR}#g" \ "$SCRIPT_DIR/systemd/nexarch-dms-worker.service.tmpl" > /etc/systemd/system/nexarch-dms-worker.service -echo "Units geschrieben: nexarch-connect-app, nexarch-dms-app, nexarch-dms-worker" +echo "Units geschrieben: nexarch-ai-app, nexarch-connect-app, nexarch-dms-app, nexarch-dms-worker" echo "== 7. daemon-reload ==" systemctl daemon-reload @@ -167,7 +186,8 @@ if [ "$ok" -ne 1 ]; then fi echo "account-api liefert /auth/module-jwks." -echo "== 9. connect-app, dms-app, dms-worker aktivieren und starten ==" +echo "== 9. ai-app, connect-app, dms-app, dms-worker aktivieren und starten ==" +systemctl enable --now nexarch-ai-app.service systemctl enable --now nexarch-connect-app.service systemctl enable --now nexarch-dms-app.service systemctl enable --now nexarch-dms-worker.service diff --git a/deploy/rollout-131-healthcheck.sh b/deploy/rollout-131-healthcheck.sh index b66fe31a..1986266a 100755 --- a/deploy/rollout-131-healthcheck.sh +++ b/deploy/rollout-131-healthcheck.sh @@ -37,6 +37,7 @@ DMS_APP_ADDR=$(listen_addr "$ENV_DIR/dms-app.env" NEXARCH_DMS_APP_LISTEN_ADDR "1 DMS_WORKER_METRICS_ADDR=$(listen_addr "$ENV_DIR/dms-worker.env" NEXARCH_DMS_WORKER_METRICS_ADDR "127.0.0.1:8601") DMS_KOSIT_ADDR=$(listen_addr "$ENV_DIR/dms-worker.env" NEXARCH_DMS_WORKER_KOSIT_ADDR "127.0.0.1:8610") CONNECT_APP_ADDR=$(listen_addr "$ENV_DIR/connect-app.env" NEXARCH_CONNECT_APP_LISTEN_ADDR "127.0.0.1:9500") +AI_APP_ADDR=$(listen_addr "$ENV_DIR/ai-app.env" NEXARCH_AI_APP_LISTEN_ADDR "127.0.0.1:8900") echo "== Core (bereits laufend erwartet) ==" check "nexarch-core" "http://127.0.0.1:8080/healthz" @@ -53,6 +54,9 @@ check "dms-kosit-sidecar" "http://${DMS_KOSIT_ADDR}/healthz" echo "== Connect (Erstinstallation durch diesen Rollout) ==" check "connect-app" "http://${CONNECT_APP_ADDR}/healthz" +echo "== AI ==" +check "ai-app" "http://${AI_APP_ADDR}/healthz" + echo echo "Hinweis: Adressen werden aus den echten Env-Dateien gelesen" echo "(NEXARCH_*_LISTEN_ADDR); ohne gesetzten Wert greift der Platzhalter aus" diff --git a/deploy/rollout-131-provision-secrets.sh b/deploy/rollout-131-provision-secrets.sh index 8ada0958..71845ba8 100755 --- a/deploy/rollout-131-provision-secrets.sh +++ b/deploy/rollout-131-provision-secrets.sh @@ -13,6 +13,7 @@ set -euo pipefail CONNECT_ENV=/etc/nexarch/connect-app.env DMS_ENV=/etc/nexarch/dms-app.env CORE_ENV=/etc/nexarch/core.env +AI_ENV=/etc/nexarch/ai-app.env if [ ! -f "$CONNECT_ENV" ] || [ ! -f "$DMS_ENV" ] || [ ! -f "$CORE_ENV" ]; then echo "Abbruch: eine der Env-Dateien fehlt ($CONNECT_ENV, $DMS_ENV, $CORE_ENV)." >&2 @@ -50,6 +51,42 @@ else echo "Uebersprungen: NEXARCH_CONNECT_APP_LISTEN_ADDR ist schon gesetzt." fi +echo +echo "== 1b. AI-DB (Rolle + Datenbank) ==" +if [ ! -f "$AI_ENV" ]; then + echo "Uebersprungen: $AI_ENV fehlt (rollout-131-sync.sh zuerst ausfuehren)." +else + if grep -q '^NEXARCH_AI_APP_TENANT_DSN=.*TODO' "$AI_ENV" 2>/dev/null || ! grep -q '^NEXARCH_AI_APP_TENANT_DSN=' "$AI_ENV"; then + PW=$(openssl rand -hex 20) + sudo -u postgres psql -v ON_ERROR_STOP=1 <> "$AI_ENV" + echo "OK: NEXARCH_AI_APP_TENANT_DSN gesetzt." + else + echo "Uebersprungen: NEXARCH_AI_APP_TENANT_DSN ist schon gesetzt." + fi + if grep -q '^NEXARCH_AI_APP_LISTEN_ADDR=.*TODO' "$AI_ENV" 2>/dev/null || ! grep -q '^NEXARCH_AI_APP_LISTEN_ADDR=' "$AI_ENV"; then + sed -i '/^NEXARCH_AI_APP_LISTEN_ADDR=/d' "$AI_ENV" + echo "NEXARCH_AI_APP_LISTEN_ADDR=127.0.0.1:8900" >> "$AI_ENV" + echo "OK: NEXARCH_AI_APP_LISTEN_ADDR gesetzt (127.0.0.1:8900)." + else + echo "Uebersprungen: NEXARCH_AI_APP_LISTEN_ADDR ist schon gesetzt." + fi + echo "OFFEN: NEXARCH_AI_APP_SERVICE_TOKEN und Policy-Anbindung (POLICY_URL/_POLICY_SERVICE_TOKEN oder POLICY_DISABLED=1) setzt der Betreiber von Hand." +fi + echo echo "== 2. KEK-Client fuer DMS registrieren ==" if grep -q '^NEXARCH_DMS_APP_KEK_CLIENT_ID=.*TODO' "$DMS_ENV" 2>/dev/null; then @@ -135,3 +172,4 @@ echo echo "== Zusammenfassung ==" grep -c TODO "$CONNECT_ENV" | xargs -I{} echo "connect-app.env: {} offene TODOs" grep -c TODO "$DMS_ENV" | xargs -I{} echo "dms-app.env: {} offene TODOs" +[ -f "$AI_ENV" ] && { grep -c TODO "$AI_ENV" | xargs -I{} echo "ai-app.env: {} offene TODOs" || true; } diff --git a/deploy/rollout-131-selfheal.sh b/deploy/rollout-131-selfheal.sh index 34b519b2..d0d61838 100755 --- a/deploy/rollout-131-selfheal.sh +++ b/deploy/rollout-131-selfheal.sh @@ -17,10 +17,12 @@ REPO_DIR="${NEXARCH_ROLLOUT_REPO_DIR:-/root/nexarch-code}" ENV_DIR=/etc/nexarch DMS_INSTALL_DIR="${NEXARCH_DMS_INSTALL_DIR:-/opt/nexarch-dms}" CONNECT_INSTALL_DIR="${NEXARCH_CONNECT_INSTALL_DIR:-/opt/nexarch-connect}" +AI_INSTALL_DIR="${NEXARCH_AI_INSTALL_DIR:-/opt/nexarch-ai}" DMS_STORAGE_DIR="${NEXARCH_DMS_STORAGE_DIR:-/var/lib/nexarch-dms/storage}" DMS_STAGING_DIR="${NEXARCH_DMS_STAGING_DIR:-/var/lib/nexarch-dms/staging}" CONNECT_ENV="$ENV_DIR/connect-app.env" DMS_ENV="$ENV_DIR/dms-app.env" +AI_ENV="$ENV_DIR/ai-app.env" CORE_ENV="$ENV_DIR/core.env" MAX_ATTEMPTS=10 @@ -93,7 +95,7 @@ while [ "$attempt" -lt "$MAX_ATTEMPTS" ]; do fi for pair in "$CONNECT_ENV:NEXARCH_CONNECT_APP_TENANT_DSN" "$CONNECT_ENV:NEXARCH_CONNECT_APP_LISTEN_ADDR" \ - "$DMS_ENV:NEXARCH_DMS_APP_CORE_SERVICE_TOKEN" "$DMS_ENV:NEXARCH_DMS_APP_KEK_CLIENT_ID" "$DMS_ENV:NEXARCH_DMS_APP_KEK_CLIENT_SECRET"; do + "$AI_ENV:NEXARCH_AI_APP_TENANT_DSN" "$AI_ENV:NEXARCH_AI_APP_LISTEN_ADDR" "$AI_ENV:NEXARCH_AI_APP_SERVICE_TOKEN" "$DMS_ENV:NEXARCH_DMS_APP_CORE_SERVICE_TOKEN" "$DMS_ENV:NEXARCH_DMS_APP_KEK_CLIENT_ID" "$DMS_ENV:NEXARCH_DMS_APP_KEK_CLIENT_SECRET"; do f="${pair%%:*}"; n="${pair#*:}" if is_open "$f" "$n"; then blockers+=("${n} in ${f} ist weiterhin offen -- braucht einen externen Wert, den nur der Nutzer kennt (kein Konfigurationsfehler, den dieses Skript loesen darf).") @@ -125,7 +127,7 @@ while [ "$attempt" -lt "$MAX_ATTEMPTS" ]; do done log "== Zielverzeichnisse pruefen ==" - for d in "$DMS_INSTALL_DIR/bin" "$CONNECT_INSTALL_DIR/bin" "$DMS_STORAGE_DIR" "$DMS_STAGING_DIR"; do + for d in "$DMS_INSTALL_DIR/bin" "$CONNECT_INSTALL_DIR/bin" "$AI_INSTALL_DIR/bin" "$DMS_STORAGE_DIR" "$DMS_STAGING_DIR"; do if [ ! -d "$d" ]; then mkdir -p "$d" log "repariert: Verzeichnis $d angelegt." @@ -133,13 +135,15 @@ while [ "$attempt" -lt "$MAX_ATTEMPTS" ]; do fi done if id nexarch >/dev/null 2>&1; then - chown -R nexarch:nexarch "$DMS_INSTALL_DIR" "$CONNECT_INSTALL_DIR" "$DMS_STORAGE_DIR" "$DMS_STAGING_DIR" 2>/dev/null || true + chown -R nexarch:nexarch "$DMS_INSTALL_DIR" "$CONNECT_INSTALL_DIR" "$AI_INSTALL_DIR" "$DMS_STORAGE_DIR" "$DMS_STAGING_DIR" 2>/dev/null || true fi log "== Binaries pruefen (nachbauen falls sie fehlen) ==" for triple in "$DMS_INSTALL_DIR/bin/dms-app:$REPO_DIR/dms:./cmd/app" \ "$DMS_INSTALL_DIR/bin/dms-worker:$REPO_DIR/dms:./cmd/worker" \ - "$CONNECT_INSTALL_DIR/bin/connect-app:$REPO_DIR/connect:./cmd/connect-app"; do + "$CONNECT_INSTALL_DIR/bin/connect-app:$REPO_DIR/connect:./cmd/connect-app" \ + "$AI_INSTALL_DIR/bin/ai-app:$REPO_DIR/ai:./cmd/ai-app" \ + "$AI_INSTALL_DIR/bin/ai-migrate:$REPO_DIR/ai:./cmd/migrate"; do bin="${triple%%:*}"; rest="${triple#*:}"; moddir="${rest%%:*}"; pkg="${rest#*:}" if [ ! -x "$bin" ]; then if [ -f "$moddir/go.mod" ]; then @@ -190,7 +194,7 @@ while [ "$attempt" -lt "$MAX_ATTEMPTS" ]; do fi log "== systemd-Unit-Dateien pruefen (nur Datei-Kopie, kein systemctl) ==" - for unit in nexarch-connect-app nexarch-dms-app nexarch-dms-worker; do + for unit in nexarch-ai-app nexarch-connect-app nexarch-dms-app nexarch-dms-worker; do tmpl="$SCRIPT_DIR/systemd/${unit}.service.tmpl" dest="/etc/systemd/system/${unit}.service" if [ ! -f "$tmpl" ]; then @@ -199,6 +203,9 @@ while [ "$attempt" -lt "$MAX_ATTEMPTS" ]; do fi if [ ! -f "$dest" ] || grep -q '__INSTALL_DIR__\|__STORAGE_DIR__\|__STAGING_DIR__' "$dest" 2>/dev/null; then case "$unit" in + nexarch-ai-app) + sed -e "s#__INSTALL_DIR__#${AI_INSTALL_DIR}#g" "$tmpl" > "$dest" + ;; nexarch-connect-app) sed -e "s#__INSTALL_DIR__#${CONNECT_INSTALL_DIR}#g" "$tmpl" > "$dest" ;; @@ -234,7 +241,7 @@ if [ "$ready" -eq 1 ]; then echo " systemctl daemon-reload" echo " systemctl restart nexarch-account-api" echo " sleep 3 && curl -sf http://127.0.0.1:8099/auth/module-jwks && echo OK" - echo " systemctl enable --now nexarch-connect-app nexarch-dms-app nexarch-dms-worker" + echo " systemctl enable --now nexarch-ai-app nexarch-connect-app nexarch-dms-app nexarch-dms-worker" echo " $SCRIPT_DIR/rollout-131-healthcheck.sh" echo echo "(Alternativ deckt deploy/rollout-131-apply.sh genau diese Schritte in einem Lauf ab.)" diff --git a/deploy/rollout-131-sync.sh b/deploy/rollout-131-sync.sh index 32a70876..dcf8e63d 100644 --- a/deploy/rollout-131-sync.sh +++ b/deploy/rollout-131-sync.sh @@ -67,6 +67,12 @@ echo "-- connect-app.env (neu, Connect API-02) --" ensure_var "$ENV_DIR/connect-app.env" NEXARCH_CONNECT_APP_LISTEN_ADDR "z.B. 127.0.0.1:9500" ensure_var "$ENV_DIR/connect-app.env" NEXARCH_CONNECT_APP_TENANT_DSN "Postgres-DSN fuer den Connect-Mandanten" +echo "-- ai-app.env (neu, ENG-10) --" +ensure_var "$ENV_DIR/ai-app.env" NEXARCH_AI_APP_LISTEN_ADDR "z.B. 127.0.0.1:8900" +ensure_var "$ENV_DIR/ai-app.env" NEXARCH_AI_APP_TENANT_DSN "Postgres-DSN fuer die AI-Datenbank" +ensure_var "$ENV_DIR/ai-app.env" NEXARCH_AI_APP_SERVICE_TOKEN "Token, das alle Aufrufer im Header X-Service-Token senden -- muss zu den Aufrufern passen" +ensure_var "$ENV_DIR/ai-app.env" NEXARCH_AI_APP_POLICY_URL "policy-api-Adresse fuer die Rechtepruefung der Suche (alternativ NEXARCH_AI_APP_POLICY_DISABLED=1 als Uebergang)" + echo "-- dms-app.env (Ergaenzungen aus dieser Session gehaerteter Konfiguration) --" # Pflicht zum Start ueberhaupt (TENANT_DSN/TENANT_SLUG waren auf 131 bei der # Bestandsaufnahme bereits gesetzt, hier nur zur Vollstaendigkeit abgesichert): -- 2.47.3