seon
7ce2dc68fe
WP-12(실험 설계서 6장) vm/ai-env: apply.sh(시크릿 4종을 Secret Manager에서 파일로, 미등록이면
성능 저하 모드로 기동), compose(agent 8080·hitl 8081·rag-db pgvector 0.8.7-pg16), ai.env(Discord
서버 Selfheal Lab 1557424985793101824, approvals 1557425140302872698, escalation 1557425282363691048,
OPENAI_MODEL gpt-6.1-sol 후보), 프롬프트 3종, 러너북 11종(조치별·토폴로지·3층 절차).
WP-15(실험 설계서 4.1·4.3): apps/alloy.yaml(Alloy Helm 1.13.0 DaemonSet, 클러스터링으로 KSM·Argo CD·
cadvisor 스크랩 분산, demo 등 파드 로그 → Loki), apps/kube-state-metrics.yaml(Helm 8.6.0).
legacy-api compose에 Alloy 사이드카(up{job="legacy-api"}, 컨테이너 로그). DB VM은
vm/postgres-common/alloy.sh로 apt 설치 + prometheus.exporter.postgres(pg_replication_lag_seconds)
+ custom query pg_is_wal_replay_paused + PostgreSQL 로그.
vm/harness/apply.sh: 준비 대기 루프의 curl에 || true(러너 재기동 순간 curl 56으로 중단되던 문제,
2026-10-08 harness-sync 실측).
24 lines
1.4 KiB
Bash
Executable File
24 lines
1.4 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# legacy-api VM (GCP MIG instance). Idempotent: run at first boot by the startup script and again by `make vm-sync`.
|
|
# 1) DB password from Secret Manager via the VM service account (metadata token; no key files, design 6.11)
|
|
# 2) docker compose up with the pinned image tag
|
|
# 3) Alloy sidecar (WP-15): metrics + logs to the observability VM; INSTANCE = this VM's name for the instance label
|
|
set -euo pipefail
|
|
cd "$(dirname "$0")"
|
|
PROJECT="$(curl -sf -H 'Metadata-Flavor: Google' http://metadata.google.internal/computeMetadata/v1/project/project-id)"
|
|
command -v jq >/dev/null || { apt-get update -qq && apt-get install -y -qq jq >/dev/null; }
|
|
TOKEN="$(curl -sf -H 'Metadata-Flavor: Google' 'http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token' | jq -r .access_token)"
|
|
DB_PASSWORD="$(curl -sf -H "Authorization: Bearer ${TOKEN}" \
|
|
"https://secretmanager.googleapis.com/v1/projects/${PROJECT}/secrets/selfheal-db-password/versions/latest:access" \
|
|
| jq -r .payload.data | base64 -d || true)"
|
|
unset TOKEN
|
|
ENV_FILE=/opt/selfheal/legacy-api.env
|
|
umask 077
|
|
{
|
|
printf 'DB_DSN=postgres://app:%s@10.20.0.20:5432/app?sslmode=require\n' "${DB_PASSWORD}"
|
|
printf 'INSTANCE=%s\n' "$(hostname)"
|
|
} > "$ENV_FILE"
|
|
unset DB_PASSWORD
|
|
docker compose --env-file "$ENV_FILE" -f compose.yaml up -d --pull always --remove-orphans
|
|
docker compose --env-file "$ENV_FILE" -f compose.yaml ps
|