vh
079c7b15e3
Three changes prepping infra for asset_engine's orchestration feature
(SSH-driven bring-up / bring-down of irv-ml1 inference services with
per-device VRAM gating, contract in vh/asset-engine commit 5a36f8c):
1. asset-engine compose + .env.example + playbook gain a read-only
bind-mount for /app/runtime/ssh — the dedicated ed25519 keypair
(generated on ana-docker, not in the repo) plus a pinned known_hosts
for irv-ml1's host fingerprint. Env vars SSH_KEY_PATH and
SSH_KNOWN_HOSTS are exposed for the app to consume.
2. docs/asset-engine/services.yaml gains a `lifecycle: { stack, vram_gb,
gpu_device_id }` block on each of 12 orchestratable irv-ml1 services
(kokoro, chatterbox, index-tts, qwen3-tts, cosyvoice, fish-s2,
kyutai-tts, vibevoice, voxtral, parakeet, stable-audio-open, ace-step).
VRAM numbers are estimates from model footprint at fp16 — tune from
real nvidia-smi measurements once the gate is live. comfyui and
kokoro-captioned are deliberately excluded (variable-VRAM and
shared-container respectively).
3. servers/irv-ml1/README.md docker-stacks table now lists all 13
inference stacks (was only dockge + agents + comfyui) with port +
GPU pinning columns.
Pubkey deployed to ~lkraven/.ssh/authorized_keys on irv-ml1;
end-to-end SSH from ana-docker → irv-ml1 verified with strict
host-key checking.
61 lines
2.7 KiB
YAML
61 lines
2.7 KiB
YAML
# asset-engine — control plane over PFI's inference fleet.
|
|
#
|
|
# FastAPI + HTMX/Shoelace UI. Reads the catalog at services.yaml (baked
|
|
# into the image at build time, drift-checked in CI against the copy
|
|
# at docs/asset-engine/services.yaml in this repo), routes requests to
|
|
# inference hosts (irv-ml1 over WG by default), persists Assets to a
|
|
# local SQLite WAL DB, stores generated blobs content-addressed under
|
|
# runtime/outputs/.
|
|
#
|
|
# Image is built on the host from the asset-engine git repo by the
|
|
# deploy playbook (`playbooks/deploy-asset-engine.yaml`), which clones
|
|
# into /opt/docker/build/asset-engine and runs `docker build -t
|
|
# asset-engine:local .` before installing this compose and bringing
|
|
# it up. No registry.
|
|
#
|
|
# Internal tooling — accessed directly on host:port over the LAN, does
|
|
# NOT traverse Traefik. State persists under /opt/docker/conf/asset-engine/
|
|
# {db,outputs,ssh} on the host — db/outputs are separate bind-mounts so
|
|
# outputs/ can move to a bigger volume later without touching DB state;
|
|
# ssh/ holds the dedicated keypair used to orchestrate irv-ml1 services.
|
|
#
|
|
# All tunables live in .env — edit that, not this file.
|
|
|
|
services:
|
|
asset-engine:
|
|
image: ${ASSET_ENGINE_IMAGE}
|
|
container_name: asset-engine
|
|
restart: unless-stopped
|
|
ports:
|
|
- "${ASSET_ENGINE_BIND:-0.0.0.0}:${ASSET_ENGINE_PORT}:8000"
|
|
environment:
|
|
# App always listens on 8000 internally; host port is the only knob.
|
|
- RUNTIME_DIR=/app/runtime
|
|
- DB_URL=sqlite:////app/runtime/db/asset_engine.db
|
|
- INFERENCE_HOST=${INFERENCE_HOST:-10.100.79.3}
|
|
# OIDC seam is empty in v1; populated in v2 when forward-auth lands.
|
|
- OIDC_ISSUER=${OIDC_ISSUER:-}
|
|
- OIDC_CLIENT_ID=${OIDC_CLIENT_ID:-}
|
|
- OIDC_CLIENT_SECRET=${OIDC_CLIENT_SECRET:-}
|
|
# Orchestration SSH paths inside the container.
|
|
- SSH_KEY_PATH=/app/runtime/ssh/id_ed25519
|
|
- SSH_KNOWN_HOSTS=/app/runtime/ssh/known_hosts
|
|
volumes:
|
|
- ${ASSET_ENGINE_DB_DIR}:/app/runtime/db
|
|
- ${ASSET_ENGINE_OUTPUTS_DIR}:/app/runtime/outputs
|
|
# Dedicated SSH key for orchestrating irv-ml1 services (up/down).
|
|
# Read-only; key is generated on the host, never crosses the network.
|
|
- ${ASSET_ENGINE_SSH_DIR}:/app/runtime/ssh:ro
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "python -c 'import urllib.request,sys; r=urllib.request.urlopen(\"http://127.0.0.1:8000/health\",timeout=3); sys.exit(0 if r.status==200 else 1)' || exit 1"]
|
|
interval: 30s
|
|
timeout: 5s
|
|
retries: 3
|
|
start_period: 30s
|
|
labels:
|
|
- homepage.group=AI Systems
|
|
- homepage.name=Asset Engine
|
|
- homepage.icon=mdi-tools
|
|
- homepage.description=Control plane over the PFI inference fleet
|
|
- homepage.href=http://10.250.50.70:${ASSET_ENGINE_PORT}
|