vh/esh-pfi-infrastructure
1
0
Fork 0
Code Issues 7 Pull Requests Actions Packages Projects Releases Wiki Activity

asset-engine: scaffold deploy stack on ana-docker

Browse Source 
Mirrors task-board's build-on-host pattern: elway playbook clones
vh/asset-engine into /opt/docker/build/, docker build, install compose +
seed .env, up -d, verify /health. No registry.

Internal-only tool — LAN port 8200 (bind 0.0.0.0) is primary; Traefik
labels additionally route asset-engine.phasefinal.com with TLS via the
anaprod cert resolver. DB and outputs are separate bind-mounts under
/opt/docker/conf/asset-engine/ so outputs/ can move volumes later
without touching DB state. INFERENCE_HOST defaults to 10.100.79.3
(irv-ml1 over WG). OIDC env seam is pre-allocated empty for v2.
This commit is contained in:
vh
2026-05-11 21:43:41 -07:00
parent f0d0d758d2
commit 116ed15875
5 changed files with 415 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
stacks/asset-engine/.env.example
+37
View File
@@ -0,0 +1,37 @@
# asset-engine stack tunables. Copy to `.env` on ana-docker before deploying.
#
# The deploy playbook seeds `.env` from this template on first run only —
# it won't clobber an existing `.env`.
# Image tag. Built locally from the asset-engine git repo by the playbook.
ASSET_ENGINE_IMAGE=asset-engine:local
# Host port exposing the FastAPI app (container listens on 8000 internally).
# Internal-only tool — LAN access on this port is the primary entry; the
# Traefik labels in compose.yaml additionally route the public hostname.
ASSET_ENGINE_PORT=8200
# Bind address for the host port. 0.0.0.0 = LAN-reachable (default for an
# internal-only tool). Flip to 127.0.0.1 only if you want to force all
# traffic through traefik.
ASSET_ENGINE_BIND=0.0.0.0
# Host paths for state. Container runs as uid 1000 — paths must be writable
# by that uid (mkdir'd by the playbook without sudo, so lkraven-owned when
# lkraven is uid 1000 on the host).
#
# DB lives separately from outputs so we can grow outputs/ onto a different
# volume later without restoring DB state on top of it.
ASSET_ENGINE_DB_DIR=/opt/docker/conf/asset-engine/db
ASSET_ENGINE_OUTPUTS_DIR=/opt/docker/conf/asset-engine/outputs
# Inference target. Default is irv-ml1 over WG. Override if the fleet's
# inference host moves.
INFERENCE_HOST=10.100.79.3
# OIDC seam — empty in v1 (auth is no-op). Populate when v2 forward-auth
# lands. Pre-allocated here so the surface is visible in the config file
# before code reads it.
OIDC_ISSUER=
OIDC_CLIENT_ID=
OIDC_CLIENT_SECRET=