feat: harden community production foundation through story 1.5

2026-08-14 00:21:59 +03:00
parent c30461cc92
commit f6fc2e5c9b
161 changed files with 16758 additions and 2515 deletions
@@ -16,6 +16,29 @@ services:
      timeout: 5s
      retries: 5

+  migrate:
+    image: ${CRANK_ADMIN_API_IMAGE:-crank/admin-api:dev}
+    build:
+      context: .
+      dockerfile: apps/admin-api/Dockerfile
+    command: ["crank-migrate", "apply"]
+    restart: "no"
+    environment:
+      POSTGRES_HOST: ${POSTGRES_HOST:-postgres}
+      POSTGRES_PORT: ${POSTGRES_PORT:-5432}
+      POSTGRES_DB: ${POSTGRES_DB:-crank}
+      POSTGRES_USER: ${POSTGRES_USER:-crank}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-crank}
+      CRANK_DATABASE_URL: ${CRANK_DATABASE_URL:-}
+      POSTGRES_MAX_CONNECTIONS: ${POSTGRES_MAX_CONNECTIONS:-20}
+      POSTGRES_MIN_CONNECTIONS: ${POSTGRES_MIN_CONNECTIONS:-2}
+      POSTGRES_ACQUIRE_TIMEOUT_MS: ${POSTGRES_ACQUIRE_TIMEOUT_MS:-5000}
+      POSTGRES_IDLE_TIMEOUT_MS: ${POSTGRES_IDLE_TIMEOUT_MS:-600000}
+      POSTGRES_MAX_LIFETIME_MS: ${POSTGRES_MAX_LIFETIME_MS:-1800000}
+    depends_on:
+      postgres:
+        condition: service_healthy
+
  admin-api:
    image: ${CRANK_ADMIN_API_IMAGE:-crank/admin-api:dev}
    build:
@@ -28,9 +51,38 @@ services:
      POSTGRES_DB: ${POSTGRES_DB:-crank}
      POSTGRES_USER: ${POSTGRES_USER:-crank}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-crank}
+      CRANK_DATABASE_URL: ${CRANK_DATABASE_URL:-}
+      POSTGRES_MAX_CONNECTIONS: ${POSTGRES_MAX_CONNECTIONS:-20}
+      POSTGRES_MIN_CONNECTIONS: ${POSTGRES_MIN_CONNECTIONS:-2}
+      POSTGRES_ACQUIRE_TIMEOUT_MS: ${POSTGRES_ACQUIRE_TIMEOUT_MS:-5000}
+      POSTGRES_IDLE_TIMEOUT_MS: ${POSTGRES_IDLE_TIMEOUT_MS:-600000}
+      POSTGRES_MAX_LIFETIME_MS: ${POSTGRES_MAX_LIFETIME_MS:-1800000}
      CRANK_STORAGE_ROOT: ${CRANK_STORAGE_ROOT:-/var/lib/crank/storage}
      CRANK_ADMIN_BIND: ${CRANK_ADMIN_BIND:-0.0.0.0:3001}
-      CRANK_LOG_LEVEL: ${CRANK_LOG_LEVEL:-info}
+      CRANK_ADMIN_RATE_LIMIT_RPS: ${CRANK_ADMIN_RATE_LIMIT_RPS:-30}
+      CRANK_ADMIN_RATE_LIMIT_BURST: ${CRANK_ADMIN_RATE_LIMIT_BURST:-60}
+      CRANK_RUNTIME_MAX_CONCURRENT_UNARY: ${CRANK_RUNTIME_MAX_CONCURRENT_UNARY:-64}
+      CRANK_CACHE_BACKEND: ${CRANK_CACHE_BACKEND:-memory}
+      CRANK_CACHE_URL: ${CRANK_CACHE_URL:-}
+      CRANK_ENVIRONMENT: ${CRANK_ENVIRONMENT:-development}
+      CRANK_LOG_LEVEL: ${CRANK_LOG_LEVEL:-}
+      CRANK_SENTRY_DSN: ${CRANK_SENTRY_DSN:-}
+      CRANK_METRICS_ENABLED: ${CRANK_METRICS_ENABLED:-true}
+      CRANK_ADMIN_METRICS_BIND: ${CRANK_ADMIN_METRICS_BIND:-127.0.0.1:9464}
+      CRANK_METRICS_BEARER_TOKEN: ${CRANK_METRICS_BEARER_TOKEN:-}
+      CRANK_INVOCATION_LOG_RETENTION_DAYS: ${CRANK_INVOCATION_LOG_RETENTION_DAYS:-30}
+      OTEL_EXPORTER_OTLP_ENDPOINT: ${OTEL_EXPORTER_OTLP_ENDPOINT:-}
+      OTEL_EXPORTER_OTLP_TRACES_ENDPOINT: ${OTEL_EXPORTER_OTLP_TRACES_ENDPOINT:-}
+      OTEL_EXPORTER_OTLP_PROTOCOL: ${OTEL_EXPORTER_OTLP_PROTOCOL:-http/protobuf}
+      OTEL_EXPORTER_OTLP_TRACES_PROTOCOL: ${OTEL_EXPORTER_OTLP_TRACES_PROTOCOL:-}
+      OTEL_EXPORTER_OTLP_TIMEOUT: ${OTEL_EXPORTER_OTLP_TIMEOUT:-10000}
+      OTEL_EXPORTER_OTLP_TRACES_TIMEOUT: ${OTEL_EXPORTER_OTLP_TRACES_TIMEOUT:-}
+      OTEL_EXPORTER_OTLP_HEADERS: ${OTEL_EXPORTER_OTLP_HEADERS:-}
+      OTEL_EXPORTER_OTLP_TRACES_HEADERS: ${OTEL_EXPORTER_OTLP_TRACES_HEADERS:-}
+      OTEL_BSP_MAX_QUEUE_SIZE: ${OTEL_BSP_MAX_QUEUE_SIZE:-2048}
+      OTEL_BSP_MAX_EXPORT_BATCH_SIZE: ${OTEL_BSP_MAX_EXPORT_BATCH_SIZE:-512}
+      OTEL_BSP_SCHEDULE_DELAY: ${OTEL_BSP_SCHEDULE_DELAY:-5000}
+      OTEL_BSP_EXPORT_TIMEOUT: ${OTEL_BSP_EXPORT_TIMEOUT:-30000}
      CRANK_MASTER_KEY: ${CRANK_MASTER_KEY}
      CRANK_BASE_URL: ${CRANK_BASE_URL:-http://localhost:3000}
      CRANK_SESSION_SECRET: ${CRANK_SESSION_SECRET}
@@ -45,6 +97,8 @@ services:
      CRANK_OUTBOUND_DENIED_HOSTS: ${CRANK_OUTBOUND_DENIED_HOSTS:-}
      CRANK_OUTBOUND_MAX_RESPONSE_BYTES: ${CRANK_OUTBOUND_MAX_RESPONSE_BYTES:-4194304}
    depends_on:
+      migrate:
+        condition: service_completed_successfully
      postgres:
        condition: service_healthy
    volumes:
@@ -69,20 +123,48 @@ services:
      POSTGRES_DB: ${POSTGRES_DB:-crank}
      POSTGRES_USER: ${POSTGRES_USER:-crank}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-crank}
-      CRANK_STORAGE_ROOT: ${CRANK_STORAGE_ROOT:-/var/lib/crank/storage}
+      CRANK_DATABASE_URL: ${CRANK_DATABASE_URL:-}
+      POSTGRES_MAX_CONNECTIONS: ${POSTGRES_MAX_CONNECTIONS:-20}
+      POSTGRES_MIN_CONNECTIONS: ${POSTGRES_MIN_CONNECTIONS:-2}
+      POSTGRES_ACQUIRE_TIMEOUT_MS: ${POSTGRES_ACQUIRE_TIMEOUT_MS:-5000}
+      POSTGRES_IDLE_TIMEOUT_MS: ${POSTGRES_IDLE_TIMEOUT_MS:-600000}
+      POSTGRES_MAX_LIFETIME_MS: ${POSTGRES_MAX_LIFETIME_MS:-1800000}
      CRANK_MCP_BIND: ${CRANK_MCP_BIND:-0.0.0.0:3002}
      CRANK_MCP_REFRESH_MS: ${CRANK_MCP_REFRESH_MS:-5000}
-      CRANK_LOG_LEVEL: ${CRANK_LOG_LEVEL:-info}
+      CRANK_MCP_RATE_LIMIT_RPS: ${CRANK_MCP_RATE_LIMIT_RPS:-60}
+      CRANK_MCP_RATE_LIMIT_BURST: ${CRANK_MCP_RATE_LIMIT_BURST:-120}
+      CRANK_RUNTIME_MAX_CONCURRENT_UNARY: ${CRANK_RUNTIME_MAX_CONCURRENT_UNARY:-64}
+      CRANK_RUNTIME_MAX_CONCURRENT_SESSIONS: ${CRANK_RUNTIME_MAX_CONCURRENT_SESSIONS:-16}
+      CRANK_CACHE_BACKEND: ${CRANK_CACHE_BACKEND:-memory}
+      CRANK_CACHE_URL: ${CRANK_CACHE_URL:-}
+      CRANK_ENVIRONMENT: ${CRANK_ENVIRONMENT:-development}
+      CRANK_LOG_LEVEL: ${CRANK_LOG_LEVEL:-}
+      CRANK_SENTRY_DSN: ${CRANK_SENTRY_DSN:-}
+      CRANK_METRICS_ENABLED: ${CRANK_METRICS_ENABLED:-true}
+      CRANK_MCP_METRICS_BIND: ${CRANK_MCP_METRICS_BIND:-127.0.0.1:9465}
+      CRANK_METRICS_BEARER_TOKEN: ${CRANK_METRICS_BEARER_TOKEN:-}
+      OTEL_EXPORTER_OTLP_ENDPOINT: ${OTEL_EXPORTER_OTLP_ENDPOINT:-}
+      OTEL_EXPORTER_OTLP_TRACES_ENDPOINT: ${OTEL_EXPORTER_OTLP_TRACES_ENDPOINT:-}
+      OTEL_EXPORTER_OTLP_PROTOCOL: ${OTEL_EXPORTER_OTLP_PROTOCOL:-http/protobuf}
+      OTEL_EXPORTER_OTLP_TRACES_PROTOCOL: ${OTEL_EXPORTER_OTLP_TRACES_PROTOCOL:-}
+      OTEL_EXPORTER_OTLP_TIMEOUT: ${OTEL_EXPORTER_OTLP_TIMEOUT:-10000}
+      OTEL_EXPORTER_OTLP_TRACES_TIMEOUT: ${OTEL_EXPORTER_OTLP_TRACES_TIMEOUT:-}
+      OTEL_EXPORTER_OTLP_HEADERS: ${OTEL_EXPORTER_OTLP_HEADERS:-}
+      OTEL_EXPORTER_OTLP_TRACES_HEADERS: ${OTEL_EXPORTER_OTLP_TRACES_HEADERS:-}
+      OTEL_BSP_MAX_QUEUE_SIZE: ${OTEL_BSP_MAX_QUEUE_SIZE:-2048}
+      OTEL_BSP_MAX_EXPORT_BATCH_SIZE: ${OTEL_BSP_MAX_EXPORT_BATCH_SIZE:-512}
+      OTEL_BSP_SCHEDULE_DELAY: ${OTEL_BSP_SCHEDULE_DELAY:-5000}
+      OTEL_BSP_EXPORT_TIMEOUT: ${OTEL_BSP_EXPORT_TIMEOUT:-30000}
      CRANK_MASTER_KEY: ${CRANK_MASTER_KEY}
      CRANK_BASE_URL: ${CRANK_BASE_URL:-http://localhost:3000}
      CRANK_OUTBOUND_ALLOWED_HOSTS: ${CRANK_OUTBOUND_ALLOWED_HOSTS:-}
      CRANK_OUTBOUND_DENIED_HOSTS: ${CRANK_OUTBOUND_DENIED_HOSTS:-}
      CRANK_OUTBOUND_MAX_RESPONSE_BYTES: ${CRANK_OUTBOUND_MAX_RESPONSE_BYTES:-4194304}
    depends_on:
+      migrate:
+        condition: service_completed_successfully
      postgres:
        condition: service_healthy
-    volumes:
-      - artifact_storage:${CRANK_STORAGE_ROOT:-/var/lib/crank/storage}
    ports:
      - "${CRANK_PUBLISH_BIND:-127.0.0.1}:3002:3002"
    healthcheck: