From d63c66f5eed95448f0d301f14c18c3f82623315e Mon Sep 17 00:00:00 2001 From: "tao.chen" <93983997+taochen-ct@users.noreply.github.com> Date: Fri, 31 Jul 2026 11:17:58 +0800 Subject: [PATCH] chore: update env variable --- default.conf | 20 ++++++++++++-------- docker-compose.yml | 39 ++++++++++++++++----------------------- 2 files changed, 28 insertions(+), 31 deletions(-) diff --git a/default.conf b/default.conf index 4f88aa9..ae62dd6 100644 --- a/default.conf +++ b/default.conf @@ -1,13 +1,15 @@ +# ---------------------------------------------------------------------------- +# NOTE: this file is mounted into the nginx container as a TEMPLATE. +# scripts/nginx-entrypoint.sh (mounted as /docker-entrypoint.sh) substitutes +# the single ${RUSTFS_ENDPOINT} placeholder at container start. The rendered +# output is written to /etc/nginx/conf.d/default.conf and execs nginx. +# ---------------------------------------------------------------------------- + map $http_upgrade $connection_upgrade { default upgrade; '' close; } -upstream rustfs_backend { - server 8.153.151.51:9000; - keepalive 64; -} - server { listen 80; server_name localhost; @@ -16,6 +18,9 @@ server { # 指定 Docker 内置 DNS 解析器，并设置 30 秒缓存 resolver 127.0.0.11 valid=30s ipv6=off; + # RustFS upstream — full URL passed through to proxy_pass below. + set $rustfs_backend "${RUSTFS_ENDPOINT}"; + location / { root /usr/share/nginx/html; # 前端静态文件存放在容器中的路径 index index.html index.htm; @@ -48,9 +53,8 @@ server { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; - # 转发至 RustFS - # 注意：如果 RustFS 内部接口也是 /storage/...，请把末尾的 / 去掉 - proxy_pass http://rustfs_backend/; + # 转发至 RustFS（$rustfs_endpoint 来自 set 指令；尾斜杠保留 location /storage/ 前缀剥离语义） + proxy_pass $rustfs_backend/; # HTTP/1.1 长连接支持 proxy_http_version 1.1; diff --git a/docker-compose.yml b/docker-compose.yml index 662bdb8..d76eaba 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -4,10 +4,17 @@ services: web: image: nginx:alpine restart: unless-stopped + # Architecture §2.2: this is the only service exposed to the host. The + # default.conf file is mounted as a template; scripts/nginx-entrypoint.sh + # parses ${RUSTFS_ENDPOINT} and writes the rendered config to + # /etc/nginx/conf.d/default.conf before exec'ing nginx. ports: - "${GATEWAY_PORT:-8888}:80" volumes: - - ./default.conf:/etc/nginx/conf.d/default.conf:ro + - ./default.conf:/etc/nginx/conf.d/default.conf.template:ro + - ./scripts/nginx-entrypoint.sh:/docker-entrypoint.sh:ro + environment: + RUSTFS_ENDPOINT: ${RUSTFS_ENDPOINT:-http://rustfs:9000} depends_on: - backend - runtime @@ -17,22 +24,19 @@ services: context: . dockerfile: backend/Dockerfile restart: unless-stopped + # No host port: architecture §2.2 — only Nginx is externally reachable. environment: DATABASE_URL: mysql+asyncmy://${MYSQL_USER:-model_platform}:${MYSQL_PASSWORD:-model_platform}@mysql:3306/${MYSQL_DATABASE:-model_platform}?charset=utf8mb4 JWT_SECRET: ${JWT_SECRET:-local-jwt-secret} RUNTIME_API_URL: http://runtime:8000 - RUNTIME_BASE_URL: http://runtime:8000 - RUSTFS_INTERNAL_ENDPOINT: http://rustfs:9000 + RUSTFS_ENDPOINT: ${RUSTFS_ENDPOINT:-http://rustfs:9000} RUSTFS_ACCESS_KEY: ${RUSTFS_ACCESS_KEY:-modelplatform} RUSTFS_SECRET_KEY: ${RUSTFS_SECRET_KEY:-modelplatformsecret} - RUSTFS_DEFAULT_BUCKET: model-platform WORKSPACE_ROOT: /workspace/workspaces volumes: - ./deploy/data/workspaces:/workspace/workspaces - ./backend:/app/backend:ro - ./common:/app/common:ro - ports: - - "${BACKEND_PORT:-8004}:8000" depends_on: - runtime @@ -47,16 +51,10 @@ services: - /dev/fuse:/dev/fuse security_opt: - apparmor:unconfined + # No host port: architecture §2.2 — only Nginx is externally reachable. environment: DATABASE_URL: mysql+asyncmy://${MYSQL_USER:-model_platform}:${MYSQL_PASSWORD:-model_platform}@mysql:3306/${MYSQL_DATABASE:-model_platform}?charset=utf8mb4 SERVICE_NAME: runtime-manager - REDIS_HOST: redis - REDIS_PORT: "6379" - REDIS_PASSWORD: ${REDIS_PASSWORD:-model_platform_redis} - FILE_LOCK_ENABLED: "false" - JUPYTER_INTERNAL_URL: http://jupyter:8888/jupyter/ - JUPYTER_PROXY_BASE_PATH: /jupyter/ - JUPYTER_TICKET_TTL_SECONDS: "300" WORKSPACES_ROOT: /workspace/workspaces PUBLIC_BASE_URL: http://runtime REMOTE_BUCKET: rustfs:workspaces @@ -64,7 +62,7 @@ services: RCLONE_CONFIG_RUSTFS_PROVIDER: Other RCLONE_CONFIG_RUSTFS_ACCESS_KEY_ID: ${RUSTFS_ACCESS_KEY:-modelplatform} RCLONE_CONFIG_RUSTFS_SECRET_ACCESS_KEY: ${RUSTFS_SECRET_KEY:-modelplatformsecret} - RCLONE_CONFIG_RUSTFS_ENDPOINT: http://rustfs:9000 + RCLONE_CONFIG_RUSTFS_ENDPOINT: ${RUSTFS_ENDPOINT:-http://rustfs:9000} RCLONE_CONFIG_RUSTFS_ENV_AUTH: "false" RCLONE_CONFIG_RUSTFS_FORCE_PATH_STYLE: "true" RCLONE_CONFIG_RUSTFS_REGION: other @@ -72,27 +70,22 @@ services: - ./deploy/data/workspaces:/workspace/workspaces - ./runtime:/app/runtime:ro - ./common:/app/common:ro - ports: - - "${RUNTIME_PORT:-8002}:8001" schedule: build: context: . dockerfile: schedule/Dockerfile restart: unless-stopped + # No host port: architecture §2.2 — only Nginx is externally reachable. environment: DATABASE_URL: mysql+asyncmy://${MYSQL_USER:-model_platform}:${MYSQL_PASSWORD:-model_platform}@mysql:3306/${MYSQL_DATABASE:-model_platform}?charset=utf8mb4 - REDIS_HOST: redis - REDIS_PORT: "6379" - REDIS_PASSWORD: ${REDIS_PASSWORD:-model_platform_redis} - RUSTFS_INTERNAL_ENDPOINT: http://rustfs:9000 + # schedule reads RUSTFS_ENDPOINT via schedule/service.py:build_object_store() + # (used by SchedulerService directly via boto3 — not via the storage client). + RUSTFS_ENDPOINT: ${RUSTFS_ENDPOINT:-http://rustfs:9000} RUSTFS_ACCESS_KEY: ${RUSTFS_ACCESS_KEY:-modelplatform} RUSTFS_SECRET_KEY: ${RUSTFS_SECRET_KEY:-modelplatformsecret} - STORAGE_API_URL: http://backend:8000 WORKSPACE_ROOT: /workspace/workspaces volumes: - ./deploy/data/workspaces:/workspace/workspaces - ports: - - "${SCHEDULE_PORT:-8013}:8000" depends_on: - backend