diff --git a/playbooks/deploy-asset-engine.yaml b/playbooks/deploy-asset-engine.yaml index df6dce3..cc76a4e 100644 --- a/playbooks/deploy-asset-engine.yaml +++ b/playbooks/deploy-asset-engine.yaml @@ -13,7 +13,6 @@ # # Prereqs on the target host: # - Docker + docker compose plugin -# - `traefik-net` docker network (external) # - Target user (lkraven) has git SSH access to gitea.phasefinal.com # — either SSH key authorized in gitea, or the repo is HTTPS-reachable # if you swap `repo_url` below. @@ -128,9 +127,3 @@ verify: - name: /health body reports status=ok shell: curl -sf http://localhost:{{ host_port }}/health | grep -q '"status"[[:space:]]*:[[:space:]]*"ok"' changed_when: "false" - - - name: Container is in the traefik-net network - # `traefik-net` has a dash, so it's not accessible via Go template dot - # syntax — JSON-encode the networks map and grep for the key instead. - shell: docker inspect asset-engine --format '{{json .NetworkSettings.Networks}}' | grep -q traefik-net - changed_when: "false" diff --git a/stacks/asset-engine/.env.example b/stacks/asset-engine/.env.example index aeff25e..1ce05c7 100644 --- a/stacks/asset-engine/.env.example +++ b/stacks/asset-engine/.env.example @@ -7,13 +7,10 @@ ASSET_ENGINE_IMAGE=asset-engine:local # Host port exposing the FastAPI app (container listens on 8000 internally). -# Internal-only tool — LAN access on this port is the primary entry; the -# Traefik labels in compose.yaml additionally route the public hostname. +# Internal tooling, LAN-only — this port is the only entry point. No Traefik. ASSET_ENGINE_PORT=8200 -# Bind address for the host port. 0.0.0.0 = LAN-reachable (default for an -# internal-only tool). Flip to 127.0.0.1 only if you want to force all -# traffic through traefik. +# Bind address for the host port. 0.0.0.0 = LAN-reachable. ASSET_ENGINE_BIND=0.0.0.0 # Host paths for state. Container runs as uid 1000 — paths must be writable diff --git a/stacks/asset-engine/README.md b/stacks/asset-engine/README.md index 550e3db..39c1e74 100644 --- a/stacks/asset-engine/README.md +++ b/stacks/asset-engine/README.md @@ -7,8 +7,7 @@ over WG by default), and persists generated assets to a local SQLite DB + content-addressed blob store. **Server:** ana-docker -**Hostname (TLS):** `asset-engine.phasefinal.com` (TLS via Traefik / `anaprod` cert resolver) -**LAN port:** `10.250.50.70:8200` (configurable via `.env`) +**URL:** `http://10.250.50.70:8200` (configurable via `.env`) **Upstream repo:** [vh/asset-engine](https://gitea.phasefinal.com/vh/asset-engine) **Image:** `asset-engine:local` — built on the host from the git repo by the deploy playbook. Not pulled from a registry. @@ -55,14 +54,11 @@ scripts/elway ana-docker --playbook playbooks/deploy-asset-engine.yaml --var ref ## Network model -Internal-only tool, two entry points: - -- **LAN**, default: `http://10.250.50.70:8200` — container port 8000 - published on the host, bound to 0.0.0.0 (configurable via - `ASSET_ENGINE_BIND` / `ASSET_ENGINE_PORT`). -- **TLS hostname**: `https://asset-engine.phasefinal.com` — Traefik on - ana-docker terminates TLS and forwards to the container over the - `traefik-net` docker network on port 8000. +Internal tooling, LAN-only. Container port 8000 is published on the host +at `0.0.0.0:8200` (configurable via `ASSET_ENGINE_BIND` / +`ASSET_ENGINE_PORT`); access is direct via `http://10.250.50.70:8200`. +No Traefik, no TLS terminator, no public hostname. If we later need +TLS or external access, that's a separate decision. `INFERENCE_HOST` defaults to `10.100.79.3` (irv-ml1 over WG). Override in `.env` if the fleet's inference topology moves. diff --git a/stacks/asset-engine/compose.yaml b/stacks/asset-engine/compose.yaml index d3a2229..a12979f 100644 --- a/stacks/asset-engine/compose.yaml +++ b/stacks/asset-engine/compose.yaml @@ -13,9 +13,10 @@ # asset-engine:local .` before installing this compose and bringing # it up. No registry. # -# State persists under /opt/docker/conf/asset-engine/{db,outputs} on -# the host — separate bind-mounts so outputs/ can move to a bigger -# volume later without touching DB state. +# Internal tooling — accessed directly on host:port over the LAN, does +# NOT traverse Traefik. State persists under /opt/docker/conf/asset-engine/ +# {db,outputs} on the host — separate bind-mounts so outputs/ can move +# to a bigger volume later without touching DB state. # # All tunables live in .env — edit that, not this file. @@ -44,23 +45,9 @@ services: timeout: 5s retries: 3 start_period: 30s - networks: - - tnet labels: - - traefik.enable=true - - traefik.http.routers.asset-engine.rule=Host(`asset-engine.phasefinal.com`) - - traefik.http.routers.asset-engine.entrypoints=websecure - - traefik.http.routers.asset-engine.tls=true - - traefik.http.routers.asset-engine.tls.certresolver=anaprod - - traefik.http.routers.asset-engine.middlewares=crowdsec@file - - traefik.http.services.asset-engine.loadbalancer.server.port=8000 - homepage.group=AI Systems - homepage.name=Asset Engine - homepage.icon=mdi-tools - homepage.description=Control plane over the PFI inference fleet - - homepage.href=https://asset-engine.phasefinal.com - -networks: - tnet: - name: traefik-net - external: true + - homepage.href=http://10.250.50.70:${ASSET_ENGINE_PORT}