vh
e0d1c44137
The 2026-09-06 headscale cutover retired irv-ml1's wg0 tunnel IP 10.100.79.3 (now 10.6.110.50). Repointed all LIVE canonical refs to the DNS NAME so the next move can't re-break them: homepage.href/siteMonitor labels across 25 stack composes, load-bearing env defaults (asset-engine INFERENCE_HOST, open-webui AUDIO_TTS_OPENAI_API_BASE_URL, skaldsong SKALDSONG_TTS_BASE_URL, zonos-gateway ZONOS_URL, dia), homepage services.yaml manual cards (Voice Design Studio, IRV-ML1), and servers/irv-ml1/ssh-target. Updated the stale 'WG tunnel' comment to the mesh reality. Left as-is: README curl-examples and .env.example comments (docs), and historical mentions in CLAUDE.md/persistent-memory. NOTE: applying the label repoints to the RUNNING irv-ml1 containers needs a recreate per service (labels read at creation); deployed .env values are separate from these canonical defaults.
61 lines
2.8 KiB
YAML
61 lines
2.8 KiB
YAML
# asset-engine — control plane over PFI's inference fleet.
|
|
#
|
|
# FastAPI + HTMX/Shoelace UI. Reads the catalog at services.yaml (baked
|
|
# into the image at build time, drift-checked in CI against the copy
|
|
# at docs/asset-engine/services.yaml in this repo), routes requests to
|
|
# inference hosts (irv-ml1 over WG by default), persists Assets to a
|
|
# local SQLite WAL DB, stores generated blobs content-addressed under
|
|
# runtime/outputs/.
|
|
#
|
|
# Image is built on the host from the asset-engine git repo by the
|
|
# deploy playbook (`playbooks/deploy-asset-engine.yaml`), which clones
|
|
# into /opt/docker/build/asset-engine and runs `docker build -t
|
|
# asset-engine:local .` before installing this compose and bringing
|
|
# it up. No registry.
|
|
#
|
|
# Internal tooling — accessed directly on host:port over the LAN, does
|
|
# NOT traverse Traefik. State persists under /opt/docker/conf/asset-engine/
|
|
# {db,outputs,ssh} on the host — db/outputs are separate bind-mounts so
|
|
# outputs/ can move to a bigger volume later without touching DB state;
|
|
# ssh/ holds the dedicated keypair used to orchestrate irv-ml1 services.
|
|
#
|
|
# All tunables live in .env — edit that, not this file.
|
|
|
|
services:
|
|
asset-engine:
|
|
image: ${ASSET_ENGINE_IMAGE}
|
|
container_name: asset-engine
|
|
restart: unless-stopped
|
|
ports:
|
|
- "${ASSET_ENGINE_BIND:-0.0.0.0}:${ASSET_ENGINE_PORT}:8000"
|
|
environment:
|
|
# App always listens on 8000 internally; host port is the only knob.
|
|
- RUNTIME_DIR=/app/runtime
|
|
- DB_URL=sqlite:////app/runtime/db/asset_engine.db
|
|
- INFERENCE_HOST=${INFERENCE_HOST:-irv-ml1.nh3.internal}
|
|
# OIDC seam is empty in v1; populated in v2 when forward-auth lands.
|
|
- OIDC_ISSUER=${OIDC_ISSUER:-}
|
|
- OIDC_CLIENT_ID=${OIDC_CLIENT_ID:-}
|
|
- OIDC_CLIENT_SECRET=${OIDC_CLIENT_SECRET:-}
|
|
# Orchestration SSH paths inside the container.
|
|
- SSH_KEY_PATH=/app/runtime/ssh/id_ed25519
|
|
- SSH_KNOWN_HOSTS=/app/runtime/ssh/known_hosts
|
|
volumes:
|
|
- ${ASSET_ENGINE_DB_DIR}:/app/runtime/db
|
|
- ${ASSET_ENGINE_OUTPUTS_DIR}:/app/runtime/outputs
|
|
# Dedicated SSH key for orchestrating irv-ml1 services (up/down).
|
|
# Read-only; key is generated on the host, never crosses the network.
|
|
- ${ASSET_ENGINE_SSH_DIR}:/app/runtime/ssh:ro
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "python -c 'import urllib.request,sys; r=urllib.request.urlopen(\"http://127.0.0.1:8000/health\",timeout=3); sys.exit(0 if r.status==200 else 1)' || exit 1"]
|
|
interval: 30s
|
|
timeout: 5s
|
|
retries: 3
|
|
start_period: 30s
|
|
labels:
|
|
- homepage.group=AI - Gateways & Chat
|
|
- homepage.name=Asset Engine
|
|
- homepage.icon=mdi-tools
|
|
- homepage.description=Control plane over the PFI inference fleet
|
|
- homepage.href=http://10.250.50.70:${ASSET_ENGINE_PORT}
|