chore: update env variable

docker-compose.yml

@@ -4,10 +4,17 @@ services:
   web:
     image: nginx:alpine
     restart: unless-stopped
+    # Architecture §2.2: this is the only service exposed to the host. The
+    # default.conf file is mounted as a template; scripts/nginx-entrypoint.sh
+    # parses ${RUSTFS_ENDPOINT} and writes the rendered config to
+    # /etc/nginx/conf.d/default.conf before exec'ing nginx.
     ports:
       - "${GATEWAY_PORT:-8888}:80"
     volumes:
-      - ./default.conf:/etc/nginx/conf.d/default.conf:ro
+      - ./default.conf:/etc/nginx/conf.d/default.conf.template:ro
+      - ./scripts/nginx-entrypoint.sh:/docker-entrypoint.sh:ro
+    environment:
+      RUSTFS_ENDPOINT: ${RUSTFS_ENDPOINT:-http://rustfs:9000}
     depends_on:
       - backend
       - runtime
@@ -17,22 +24,19 @@ services:
       context: .
       dockerfile: backend/Dockerfile
     restart: unless-stopped
+    # No host port: architecture §2.2 — only Nginx is externally reachable.
     environment:
       DATABASE_URL: mysql+asyncmy://${MYSQL_USER:-model_platform}:${MYSQL_PASSWORD:-model_platform}@mysql:3306/${MYSQL_DATABASE:-model_platform}?charset=utf8mb4
       JWT_SECRET: ${JWT_SECRET:-local-jwt-secret}
       RUNTIME_API_URL: http://runtime:8000
-      RUNTIME_BASE_URL: http://runtime:8000
-      RUSTFS_INTERNAL_ENDPOINT: http://rustfs:9000
+      RUSTFS_ENDPOINT: ${RUSTFS_ENDPOINT:-http://rustfs:9000}
       RUSTFS_ACCESS_KEY: ${RUSTFS_ACCESS_KEY:-modelplatform}
       RUSTFS_SECRET_KEY: ${RUSTFS_SECRET_KEY:-modelplatformsecret}
-      RUSTFS_DEFAULT_BUCKET: model-platform
       WORKSPACE_ROOT: /workspace/workspaces
     volumes:
       - ./deploy/data/workspaces:/workspace/workspaces
       - ./backend:/app/backend:ro
       - ./common:/app/common:ro
-    ports:
-      - "${BACKEND_PORT:-8004}:8000"
     depends_on:
       - runtime
 
@@ -47,16 +51,10 @@ services:
       - /dev/fuse:/dev/fuse
     security_opt:
       - apparmor:unconfined
+    # No host port: architecture §2.2 — only Nginx is externally reachable.
     environment:
       DATABASE_URL: mysql+asyncmy://${MYSQL_USER:-model_platform}:${MYSQL_PASSWORD:-model_platform}@mysql:3306/${MYSQL_DATABASE:-model_platform}?charset=utf8mb4
       SERVICE_NAME: runtime-manager
-      REDIS_HOST: redis
-      REDIS_PORT: "6379"
-      REDIS_PASSWORD: ${REDIS_PASSWORD:-model_platform_redis}
-      FILE_LOCK_ENABLED: "false"
-      JUPYTER_INTERNAL_URL: http://jupyter:8888/jupyter/
-      JUPYTER_PROXY_BASE_PATH: /jupyter/
-      JUPYTER_TICKET_TTL_SECONDS: "300"
       WORKSPACES_ROOT: /workspace/workspaces
       PUBLIC_BASE_URL: http://runtime
       REMOTE_BUCKET: rustfs:workspaces
@@ -64,7 +62,7 @@ services:
       RCLONE_CONFIG_RUSTFS_PROVIDER: Other
       RCLONE_CONFIG_RUSTFS_ACCESS_KEY_ID: ${RUSTFS_ACCESS_KEY:-modelplatform}
       RCLONE_CONFIG_RUSTFS_SECRET_ACCESS_KEY: ${RUSTFS_SECRET_KEY:-modelplatformsecret}
-      RCLONE_CONFIG_RUSTFS_ENDPOINT: http://rustfs:9000
+      RCLONE_CONFIG_RUSTFS_ENDPOINT: ${RUSTFS_ENDPOINT:-http://rustfs:9000}
       RCLONE_CONFIG_RUSTFS_ENV_AUTH: "false"
       RCLONE_CONFIG_RUSTFS_FORCE_PATH_STYLE: "true"
       RCLONE_CONFIG_RUSTFS_REGION: other
@@ -72,27 +70,22 @@ services:
       - ./deploy/data/workspaces:/workspace/workspaces
       - ./runtime:/app/runtime:ro
       - ./common:/app/common:ro
-    ports:
-      - "${RUNTIME_PORT:-8002}:8001"
 
   schedule:
     build:
       context: .
       dockerfile: schedule/Dockerfile
     restart: unless-stopped
+    # No host port: architecture §2.2 — only Nginx is externally reachable.
     environment:
       DATABASE_URL: mysql+asyncmy://${MYSQL_USER:-model_platform}:${MYSQL_PASSWORD:-model_platform}@mysql:3306/${MYSQL_DATABASE:-model_platform}?charset=utf8mb4
-      REDIS_HOST: redis
-      REDIS_PORT: "6379"
-      REDIS_PASSWORD: ${REDIS_PASSWORD:-model_platform_redis}
-      RUSTFS_INTERNAL_ENDPOINT: http://rustfs:9000
+      # schedule reads RUSTFS_ENDPOINT via schedule/service.py:build_object_store()
+      # (used by SchedulerService directly via boto3 — not via the storage client).
+      RUSTFS_ENDPOINT: ${RUSTFS_ENDPOINT:-http://rustfs:9000}
       RUSTFS_ACCESS_KEY: ${RUSTFS_ACCESS_KEY:-modelplatform}
       RUSTFS_SECRET_KEY: ${RUSTFS_SECRET_KEY:-modelplatformsecret}
-      STORAGE_API_URL: http://backend:8000
       WORKSPACE_ROOT: /workspace/workspaces
     volumes:
       - ./deploy/data/workspaces:/workspace/workspaces
-    ports:
-      - "${SCHEDULE_PORT:-8013}:8000"
     depends_on:
       - backend