Initial project import

2026-08-14 09:40:51 +03:00
parent 00040e5ce4
commit d7099bf80d
146 changed files with 30509 additions and 1055 deletions
@@ -5,3 +5,24 @@
 Здесь будут находиться compose-файлы, env-шаблоны и инструкции для запуска GPU-сервисов.

 Секреты должны передаваться через окружение, секрет-хранилище или настройки хоста, но не через git.
+
+Для 1C-адаптера `adapter-1c-audit` запускается рядом с REST-сервисом и раз в
+15 минут записывает безопасную сводку журнала в том `adapter-1c-data`:
+`/data/adapter-audit-reports/latest.json`. Период задаётся
+`ONEC_ADAPTER_AUDIT_INTERVAL_SECONDS`; журнал не содержит BSL-текстов,
+SQL-полезной нагрузки или секретов.
+
+Безопасное обновление полного 1C-стека выполняется из корня репозитория:
+
+```powershell
+powershell -NoProfile -ExecutionPolicy Bypass -File scripts\deploy_1c_adapter_stack.ps1 -SkipVerify
+```
+
+Этот каталог предназначен только для GPU-нагрузок. SQL-адаптер 1С и MCP
+разворачиваются на `docker.cin.su` из `core/deploy/docker/adapter-1c/` и
+`core/deploy/docker/adapter-1c-mcp/`. После обновления проверьте REST
+`http://docker.cin.su:8011/health?base_id=upo_test` и MCP
+`http://docker.cin.su:8021/health`.
+
+CPU-only endpoint эмбеддингов для актуального поиска по коду 1С находится в
+`embeddings/`; он разворачивается на GPU-хосте, но намеренно не резервирует GPU.
@@ -1,3 +1,5 @@
+# Legacy location. Deploy the REST SQL adapter from
+# core/deploy/docker/adapter-1c/compose.yaml to docker.cin.su.
 name: adapter-1c

 services:
@@ -8,6 +10,7 @@ services:
    image: ${ADAPTER_1C_IMAGE:-adapter-1c-rest:latest}
    container_name: ${ADAPTER_1C_CONTAINER_NAME:-adapter-1c-rest}
    restart: unless-stopped
+    stop_grace_period: 5m
    ports:
      - "${ADAPTER_1C_HOST_PORT:-8011}:8011"
    volumes:
@@ -19,6 +22,20 @@ services:
      ONEC_ADAPTER_ALLOW_UNAUTHENTICATED_ADMIN: ${ONEC_ADAPTER_ALLOW_UNAUTHENTICATED_ADMIN:-true}
      ONEC_SQL_BASES_JSON: ${ONEC_SQL_BASES_JSON:-}
      ONEC_SQL_BASES_JSON_FILE: ${ONEC_SQL_BASES_JSON_FILE:-/data/onec-sql-bases.json}
+      ONEC_ADAPTER_CACHE_DB: ${ONEC_ADAPTER_CACHE_DB:-/data/adapter-cache.sqlite}
+      ONEC_ADAPTER_STATE_DB: ${ONEC_ADAPTER_STATE_DB:-/data/adapter-cache.sqlite}
+      ONEC_ADAPTER_JOB_STORE: ${ONEC_ADAPTER_JOB_STORE:-/data/adapter-jobs.json}
+      ONEC_REPOSITORY_STATE_FILE: ${ONEC_REPOSITORY_STATE_FILE:-/data/onec-repository-locks.json}
+      ONEC_ADAPTER_BACKUP_DIR: ${ONEC_ADAPTER_BACKUP_DIR:-/data/adapter-apply-backups}
+      ONEC_CONFIGURATION_ACTIVATION_STATE_FILE: ${ONEC_CONFIGURATION_ACTIVATION_STATE_FILE:-/data/onec-configuration-activation-requests.json}
+      ONEC_CONFIGURATION_ACTIVATION_REQUEST_TTL_SECONDS: ${ONEC_CONFIGURATION_ACTIVATION_REQUEST_TTL_SECONDS:-1800}
+      ONEC_ADAPTER_JOB_TIMEOUT_SECONDS: ${ONEC_ADAPTER_JOB_TIMEOUT_SECONDS:-240}
+      ONEC_ADAPTER_FULL_TIMEOUT_SECONDS: ${ONEC_ADAPTER_FULL_TIMEOUT_SECONDS:-600}
+      ONEC_ADAPTER_SECTION_TIMEOUT_SECONDS: ${ONEC_ADAPTER_SECTION_TIMEOUT_SECONDS:-180}
+      ONEC_ADAPTER_JOB_PROCESS_ISOLATION: ${ONEC_ADAPTER_JOB_PROCESS_ISOLATION:-true}
+      ONEC_ADAPTER_JOB_MEMORY_LIMIT_MB: ${ONEC_ADAPTER_JOB_MEMORY_LIMIT_MB:-0}
+      ONEC_ADAPTER_JOB_CPU_LIMIT_SECONDS: ${ONEC_ADAPTER_JOB_CPU_LIMIT_SECONDS:-0}
+      ONEC_ADAPTER_DEBUG_DIAGNOSTICS: ${ONEC_ADAPTER_DEBUG_DIAGNOSTICS:-false}
      ONEC_INFOBASE_USER_ADMIN_BASES_JSON: ${ONEC_INFOBASE_USER_ADMIN_BASES_JSON:-}
      ONEC_INFOBASE_USER_ADMIN_BASES_JSON_FILE: ${ONEC_INFOBASE_USER_ADMIN_BASES_JSON_FILE:-/data/onec-infobase-user-admin.json}
      ONEC_INFOBASE_USER_ADMIN_TOKEN_UPO_TEST: ${ONEC_INFOBASE_USER_ADMIN_TOKEN_UPO_TEST:-}
@@ -28,5 +45,21 @@ services:
      ONEC_REPOSITORY_REQUEST_TTL_SECONDS: ${ONEC_REPOSITORY_REQUEST_TTL_SECONDS:-86400}
      ONEC_REPOSITORY_CONFIRMATION_TTL_SECONDS: ${ONEC_REPOSITORY_CONFIRMATION_TTL_SECONDS:-7200}

+  adapter-1c-audit:
+    image: ${ADAPTER_1C_IMAGE:-adapter-1c-rest:latest}
+    container_name: ${ADAPTER_1C_AUDIT_CONTAINER_NAME:-adapter-1c-audit}
+    restart: unless-stopped
+    depends_on:
+      - adapter-1c-rest
+    volumes:
+      - adapter-1c-data:/data
+    environment:
+      ONEC_ADAPTER_AUDIT_INTERVAL_SECONDS: ${ONEC_ADAPTER_AUDIT_INTERVAL_SECONDS:-900}
+    command: >-
+      sh -c 'mkdir -p /data/adapter-audit-reports;
+      while true; do python /app/analyze_audit.py --log /data/adapter-audit.jsonl > /data/adapter-audit-reports/latest.json.tmp
+      && mv /data/adapter-audit-reports/latest.json.tmp /data/adapter-audit-reports/latest.json;
+      sleep "$${ONEC_ADAPTER_AUDIT_INTERVAL_SECONDS}"; done'
+
 volumes:
  adapter-1c-data:
@@ -0,0 +1,18 @@
+# CPU-only OpenAI-compatible embedding endpoint for 1C code search.
+# The model cache is persistent on docker-gpu; no credentials are required.
+
+EMBEDDING_CONTAINER_NAME=llm-qwen3-embedding
+EMBEDDING_IMAGE=ghcr.io/ggml-org/llama.cpp@sha256:3e8914c1aab600a330ada97c10fb5fb02ff1c15ac39f2ece218db125cf54594e
+EMBEDDING_HOST_PORT=8082
+EMBEDDING_HF_REPO=Qwen/Qwen3-Embedding-0.6B-GGUF:Q8_0
+EMBEDDING_SERVED_MODEL_NAME=qwen3-embedding-0.6b
+EMBEDDING_CTX_SIZE=8192
+EMBEDDING_BATCH_SIZE=1024
+EMBEDDING_UBATCH_SIZE=1024
+EMBEDDING_THREADS=12
+EMBEDDING_PARALLEL=1
+EMBEDDING_CPU_LIMIT=8.0
+EMBEDDING_MEMORY_LIMIT=4G
+
+# Windows path on docker-gpu.cin.su, mounted into the Linux container.
+HOST_LLAMA_CACHE_DIR=Z:/LLM/models/cache/llama.cpp
@@ -0,0 +1,51 @@
+name: llm-embeddings
+
+services:
+  qwen3-embedding:
+    image: ${EMBEDDING_IMAGE:-ghcr.io/ggml-org/llama.cpp@sha256:3e8914c1aab600a330ada97c10fb5fb02ff1c15ac39f2ece218db125cf54594e}
+    container_name: ${EMBEDDING_CONTAINER_NAME:-llm-qwen3-embedding}
+    restart: unless-stopped
+    ports:
+      - "${EMBEDDING_HOST_PORT:-8082}:8080"
+    volumes:
+      - ${HOST_LLAMA_CACHE_DIR:-Z:/LLM/models/cache/llama.cpp}:/root/.cache/llama.cpp
+    command:
+      - --host
+      - 0.0.0.0
+      - --port
+      - "8080"
+      - --hf-repo
+      - ${EMBEDDING_HF_REPO:-Qwen/Qwen3-Embedding-0.6B-GGUF:Q8_0}
+      - --alias
+      - ${EMBEDDING_SERVED_MODEL_NAME:-qwen3-embedding-0.6b}
+      - --embedding
+      - --pooling
+      - last
+      - --ctx-size
+      - ${EMBEDDING_CTX_SIZE:-8192}
+      - --batch-size
+      - ${EMBEDDING_BATCH_SIZE:-1024}
+      - --ubatch-size
+      - ${EMBEDDING_UBATCH_SIZE:-1024}
+      - --threads
+      - ${EMBEDDING_THREADS:-12}
+      - --parallel
+      - ${EMBEDDING_PARALLEL:-1}
+      - --n-gpu-layers
+      - "0"
+    healthcheck:
+      test:
+        - CMD
+        - curl
+        - --fail
+        - --silent
+        - http://localhost:8080/health
+      interval: 10s
+      timeout: 5s
+      retries: 30
+      start_period: 10m
+    deploy:
+      resources:
+        limits:
+          cpus: ${EMBEDDING_CPU_LIMIT:-8.0}
+          memory: ${EMBEDDING_MEMORY_LIMIT:-4G}