chore: update env variable

default.conf

@@ -1,13 +1,15 @@
+# ----------------------------------------------------------------------------
+# NOTE: this file is mounted into the nginx container as a TEMPLATE.
+# scripts/nginx-entrypoint.sh (mounted as /docker-entrypoint.sh) substitutes
+# the single ${RUSTFS_ENDPOINT} placeholder at container start. The rendered
+# output is written to /etc/nginx/conf.d/default.conf and execs nginx.
+# ----------------------------------------------------------------------------
+
 map $http_upgrade $connection_upgrade {
     default upgrade;
     ''      close;
 }
 
-upstream rustfs_backend {
-    server 8.153.151.51:9000;
-    keepalive 64;
-}
-
 server {
     listen 80;
     server_name localhost;
@@ -16,6 +18,9 @@ server {
     # 指定 Docker 内置 DNS 解析器，并设置 30 秒缓存
     resolver 127.0.0.11 valid=30s ipv6=off;
 
+    # RustFS upstream — full URL passed through to proxy_pass below.
+    set $rustfs_backend "${RUSTFS_ENDPOINT}";
+
     location / {
         root   /usr/share/nginx/html;       # 前端静态文件存放在容器中的路径
         index  index.html index.htm;
@@ -48,9 +53,8 @@ server {
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header X-Forwarded-Proto $scheme;
 
-        # 转发至 RustFS
+        # 转发至 RustFS（$rustfs_endpoint 来自 set 指令；尾斜杠保留 location /storage/ 前缀剥离语义）
-        # 注意：如果 RustFS 内部接口也是 /storage/...，请把末尾的 / 去掉
+        proxy_pass $rustfs_backend/;
-        proxy_pass http://rustfs_backend/;
 
         # HTTP/1.1 长连接支持
         proxy_http_version 1.1;

docker-compose.yml

@@ -4,10 +4,17 @@ services:
   web:
     image: nginx:alpine
     restart: unless-stopped
+    # Architecture §2.2: this is the only service exposed to the host. The
+    # default.conf file is mounted as a template; scripts/nginx-entrypoint.sh
+    # parses ${RUSTFS_ENDPOINT} and writes the rendered config to
+    # /etc/nginx/conf.d/default.conf before exec'ing nginx.
     ports:
       - "${GATEWAY_PORT:-8888}:80"
     volumes:
-      - ./default.conf:/etc/nginx/conf.d/default.conf:ro
+      - ./default.conf:/etc/nginx/conf.d/default.conf.template:ro
+      - ./scripts/nginx-entrypoint.sh:/docker-entrypoint.sh:ro
+    environment:
+      RUSTFS_ENDPOINT: ${RUSTFS_ENDPOINT:-http://rustfs:9000}
     depends_on:
       - backend
       - runtime
@@ -17,22 +24,19 @@ services:
       context: .
       dockerfile: backend/Dockerfile
     restart: unless-stopped
+    # No host port: architecture §2.2 — only Nginx is externally reachable.
     environment:
       DATABASE_URL: mysql+asyncmy://${MYSQL_USER:-model_platform}:${MYSQL_PASSWORD:-model_platform}@mysql:3306/${MYSQL_DATABASE:-model_platform}?charset=utf8mb4
       JWT_SECRET: ${JWT_SECRET:-local-jwt-secret}
       RUNTIME_API_URL: http://runtime:8000
-      RUNTIME_BASE_URL: http://runtime:8000
+      RUSTFS_ENDPOINT: ${RUSTFS_ENDPOINT:-http://rustfs:9000}
-      RUSTFS_INTERNAL_ENDPOINT: http://rustfs:9000
       RUSTFS_ACCESS_KEY: ${RUSTFS_ACCESS_KEY:-modelplatform}
       RUSTFS_SECRET_KEY: ${RUSTFS_SECRET_KEY:-modelplatformsecret}
-      RUSTFS_DEFAULT_BUCKET: model-platform
       WORKSPACE_ROOT: /workspace/workspaces
     volumes:
       - ./deploy/data/workspaces:/workspace/workspaces
       - ./backend:/app/backend:ro
       - ./common:/app/common:ro
-    ports:
-      - "${BACKEND_PORT:-8004}:8000"
     depends_on:
       - runtime
 
@@ -47,16 +51,10 @@ services:
       - /dev/fuse:/dev/fuse
     security_opt:
       - apparmor:unconfined
+    # No host port: architecture §2.2 — only Nginx is externally reachable.
     environment:
       DATABASE_URL: mysql+asyncmy://${MYSQL_USER:-model_platform}:${MYSQL_PASSWORD:-model_platform}@mysql:3306/${MYSQL_DATABASE:-model_platform}?charset=utf8mb4
       SERVICE_NAME: runtime-manager
-      REDIS_HOST: redis
-      REDIS_PORT: "6379"
-      REDIS_PASSWORD: ${REDIS_PASSWORD:-model_platform_redis}
-      FILE_LOCK_ENABLED: "false"
-      JUPYTER_INTERNAL_URL: http://jupyter:8888/jupyter/
-      JUPYTER_PROXY_BASE_PATH: /jupyter/
-      JUPYTER_TICKET_TTL_SECONDS: "300"
       WORKSPACES_ROOT: /workspace/workspaces
       PUBLIC_BASE_URL: http://runtime
       REMOTE_BUCKET: rustfs:workspaces
@@ -64,7 +62,7 @@ services:
       RCLONE_CONFIG_RUSTFS_PROVIDER: Other
       RCLONE_CONFIG_RUSTFS_ACCESS_KEY_ID: ${RUSTFS_ACCESS_KEY:-modelplatform}
       RCLONE_CONFIG_RUSTFS_SECRET_ACCESS_KEY: ${RUSTFS_SECRET_KEY:-modelplatformsecret}
-      RCLONE_CONFIG_RUSTFS_ENDPOINT: http://rustfs:9000
+      RCLONE_CONFIG_RUSTFS_ENDPOINT: ${RUSTFS_ENDPOINT:-http://rustfs:9000}
       RCLONE_CONFIG_RUSTFS_ENV_AUTH: "false"
       RCLONE_CONFIG_RUSTFS_FORCE_PATH_STYLE: "true"
       RCLONE_CONFIG_RUSTFS_REGION: other
@@ -72,27 +70,22 @@ services:
       - ./deploy/data/workspaces:/workspace/workspaces
       - ./runtime:/app/runtime:ro
       - ./common:/app/common:ro
-    ports:
-      - "${RUNTIME_PORT:-8002}:8001"
 
   schedule:
     build:
       context: .
       dockerfile: schedule/Dockerfile
     restart: unless-stopped
+    # No host port: architecture §2.2 — only Nginx is externally reachable.
     environment:
       DATABASE_URL: mysql+asyncmy://${MYSQL_USER:-model_platform}:${MYSQL_PASSWORD:-model_platform}@mysql:3306/${MYSQL_DATABASE:-model_platform}?charset=utf8mb4
-      REDIS_HOST: redis
+      # schedule reads RUSTFS_ENDPOINT via schedule/service.py:build_object_store()
-      REDIS_PORT: "6379"
+      # (used by SchedulerService directly via boto3 — not via the storage client).
-      REDIS_PASSWORD: ${REDIS_PASSWORD:-model_platform_redis}
+      RUSTFS_ENDPOINT: ${RUSTFS_ENDPOINT:-http://rustfs:9000}
-      RUSTFS_INTERNAL_ENDPOINT: http://rustfs:9000
       RUSTFS_ACCESS_KEY: ${RUSTFS_ACCESS_KEY:-modelplatform}
       RUSTFS_SECRET_KEY: ${RUSTFS_SECRET_KEY:-modelplatformsecret}
-      STORAGE_API_URL: http://backend:8000
       WORKSPACE_ROOT: /workspace/workspaces
     volumes:
       - ./deploy/data/workspaces:/workspace/workspaces
-    ports:
-      - "${SCHEDULE_PORT:-8013}:8000"
     depends_on:
       - backend