0b8a271270
All checks were successful
CD Pipeline / workflow-shape (push) Successful in 1s
CD Pipeline / cancel-stale-cd (push) Has been skipped
CD Pipeline / tests (push) Successful in 2m36s
CD Pipeline / build-and-deploy (push) Successful in 7m2s
CD Pipeline / post-deploy-checks (push) Successful in 1m53s
205 lines
9.9 KiB
YAML
205 lines
9.9 KiB
YAML
# AWOOOI 正式環境 ConfigMap
|
||
# 負責人: CIO
|
||
# 版本: v1.4
|
||
# 日期: 2026-05-03 (台北時區)
|
||
# 變更: ADR-110 Ollama GCP 三層容災架構（GCP-A → GCP-B → Local HDD）
|
||
|
||
apiVersion: v1
|
||
kind: ConfigMap
|
||
metadata:
|
||
name: awoooi-config
|
||
namespace: awoooi-prod
|
||
data:
|
||
# 環境標識
|
||
ENVIRONMENT: "prod"
|
||
SYSTEM_NAME: "awoooi"
|
||
|
||
# 服務端點 (非機密)
|
||
# 2026-04-16 ogt + Claude Sonnet 4.6: 改指向 111（GPU 機，RTX）
|
||
# 188 = CPU-only Ollama，推理極慢（>60s）；111 有 GPU，avg 10s
|
||
# 2026-05-25 Codex: keep ADR-110 production policy visible and ordered.
|
||
# High-volume callers use short endpoint cooldowns when GCP-A/B are down,
|
||
# but health/status must still show GCP-A -> GCP-B -> 111 before Gemini.
|
||
OLLAMA_URL: "http://192.168.0.110:11435"
|
||
OLLAMA_SECONDARY_URL: "http://192.168.0.110:11436"
|
||
OLLAMA_FALLBACK_URL: "http://192.168.0.110:11437"
|
||
OPENCLAW_URL: "http://192.168.0.188:8088"
|
||
KALI_SCANNER_URL: "http://192.168.0.112:8080"
|
||
SIGNOZ_URL: "http://192.168.0.188:3301"
|
||
LANGFUSE_URL: "http://192.168.0.110:3100"
|
||
# 2026-04-01 Claude Code: 開啟 Langfuse LLMOps 追蹤 (Phase 15.1 key 已注入 K8s Secret)
|
||
LANGFUSE_ENABLED: "true"
|
||
|
||
# OTEL 可觀測性 (P0 核心神經)
|
||
# 2026-03-31 ogt: 修正為 gRPC endpoint (Python SDK 使用 grpc exporter)
|
||
# HTTP: 24318, gRPC: 24317
|
||
OTEL_ENABLED: "true"
|
||
OTEL_EXPORTER_OTLP_ENDPOINT: "http://192.168.0.188:24317"
|
||
OTEL_SERVICE_NAME: "awoooi-api"
|
||
|
||
# 應用配置
|
||
LOG_LEVEL: "INFO"
|
||
# JSON array 格式 (pydantic-settings 要求)
|
||
# 正式域名優先，本機開發備用
|
||
CORS_ORIGINS: '["https://awoooi.wooo.work","http://localhost:3000","http://localhost:3001"]'
|
||
# 2026-07-01 Codex: production DB role `awoooi` currently has CONNECTION
|
||
# LIMIT 2. Keep API/worker pools single-connection until the role budget is
|
||
# raised and verified, otherwise rollout startup can exhaust PostgreSQL.
|
||
DATABASE_POOL_SIZE: "1"
|
||
DATABASE_MAX_OVERFLOW: "0"
|
||
DATABASE_POOL_TIMEOUT_SECONDS: "5"
|
||
|
||
# AI 配置 (JSON array 格式 for pydantic-settings)
|
||
# 2026-04-16 ogt + Claude Sonnet 4.6: 修正 fallback 順序 — 本地 GPU Ollama(111) 第一
|
||
# ollama(111 GPU) → nvidia(NIM) → gemini → claude
|
||
# 111 有 RTX GPU，avg 10s；nvidia NIM 外部 API；gemini/claude 雲端備援
|
||
AI_FALLBACK_ORDER: '["ollama","nvidia","gemini","claude"]'
|
||
AI_CACHE_TTL: "3600"
|
||
|
||
# ============================================================================
|
||
# Phase 24: AI Provider Registry (ADR-052)
|
||
# 2026-04-02 ogt: 絞殺者開關 — false=舊路徑(安全), true=新 AIRouter
|
||
# 2026-04-02 ogt: B2 觀察期啟動，改為 true (48h, 截止 2026-04-04 18:40 台北)
|
||
# 回滾: kubectl set env deployment/awoooi-api -n awoooi-prod USE_AI_ROUTER=false
|
||
# ============================================================================
|
||
USE_AI_ROUTER: "true"
|
||
ALERT_AI_ALLOW_CLOUD_FALLBACK: "true"
|
||
ALERT_AI_ENFORCE_OLLAMA_FIRST: "true"
|
||
ALERT_OLLAMA_MODEL: "qwen3:14b"
|
||
OLLAMA_HEALTH_CHECK_MODEL: "gemma3:4b"
|
||
OLLAMA_EMBEDDING_MODEL: "bge-m3:latest"
|
||
OPENCLAW_DEFAULT_MODEL: "qwen2.5:7b-instruct"
|
||
OPENCLAW_TIMEOUT: "120"
|
||
OLLAMA_DIAGNOSE_TIMEOUT_SECONDS: "300"
|
||
INCIDENT_LLM_TIMEOUT_SECONDS: "360"
|
||
AGENT_DEBATE_GLOBAL_TIMEOUT_SEC: "420"
|
||
AGENT_DIAGNOSTICIAN_TIMEOUT_SEC: "100"
|
||
AGENT_SOLVER_TIMEOUT_SEC: "80"
|
||
# ADR-105 P1: OpenClaw Agent Loop shadow canary.
|
||
# 只給 read-only MCP tools，使用本地 Ollama，結果只附加 metadata 不改決策。
|
||
# 回滾: kubectl set env deployment/awoooi-api -n awoooi-prod ENABLE_OPENCLAW_AGENT_LOOP_SHADOW=false
|
||
ENABLE_OPENCLAW_AGENT_LOOP_SHADOW: "true"
|
||
OPENCLAW_AGENT_LOOP_MAX_ITERATIONS: "2"
|
||
|
||
# ============================================================================
|
||
# Phase 22: OpenClaw + Nemotron 協作 (ADR-044)
|
||
# 2026-03-31 ogt: 統帥需求 - @tsenyangbot 對話 + Incident 雙軌
|
||
# 2026-04-12 ogt: 停用 Nemotron 協作 — Ollama 111 tool_call 60s×2 timeout
|
||
# > asyncio.wait_for 30s 先觸發 → expert_system fallback → confidence=0.0
|
||
# ADR-044 暫停，待 Ollama 穩定後重啟
|
||
# ============================================================================
|
||
ENABLE_NEMOTRON_COLLABORATION: "false"
|
||
NEMOTRON_TIMEOUT_SECONDS: "55"
|
||
NEMOTRON_ASYNC_UPDATE: "true"
|
||
|
||
# ============================================================================
|
||
# Phase 22 P1: Shadow Mode 解除 - 開放低風險自動執行 (2026-04-01 ogt)
|
||
# 條件: risk_level=low AND confidence≥90% AND trust_score≥5 AND playbook_success≥95%
|
||
# ============================================================================
|
||
SHADOW_MODE_ENABLED: "false"
|
||
SHADOW_MODE_LOG_ONLY: "false"
|
||
# The former API-owned polling rule is superseded_by=global_product_governance_v2.
|
||
# 188/OpenClaw owns getUpdates. A second poller receives Telegram 409 and
|
||
# can consume commands before the Agent99 bridge records a receipt.
|
||
TELEGRAM_ENABLE_POLLING: "false"
|
||
|
||
# ============================================================================
|
||
# 2026-04-03 ogt: SRE 戰情室群組三頭政治 (Triumvirate ADR-053)
|
||
# OPENCLAW_BOT_TOKEN / NEMOTRON_BOT_TOKEN 在 Secrets 中配置
|
||
# ============================================================================
|
||
SRE_GROUP_CHAT_ID: "-1003711974679"
|
||
# 2026-07-10 Codex: Agent99 direct SRE relay. Alertmanager still lands in
|
||
# AWOOI API first; the sanitized bridge then POSTs to 99 so Agent99 can queue
|
||
# allowlisted recovery and write evidence/KM. Optional relay token stays in
|
||
# Secret/env only; no token value is stored here.
|
||
AGENT99_SRE_ALERT_RELAY_URL: "http://192.168.0.99:8787/agent99/sre-alert/"
|
||
AGENT99_SRE_ALERT_RELAY_TIMEOUT_SECONDS: "3"
|
||
|
||
# 快取 TTL (秒)
|
||
CACHE_TTL_DASHBOARD: "300"
|
||
CACHE_TTL_HOST_STATUS: "30"
|
||
CACHE_TTL_AI_RESPONSE: "3600"
|
||
|
||
# ============================================================================
|
||
# Phase 10: Sentry Self-Hosted (192.168.0.110:9000)
|
||
# 2026-03-27: 首席架構師審查 - 補齊遺漏配置
|
||
# ============================================================================
|
||
SENTRY_URL: "http://192.168.0.110:9000"
|
||
SENTRY_ORG: "awoooi"
|
||
SENTRY_PROJECT_API: "awoooi-api"
|
||
SENTRY_PROJECT_WEB: "awoooi-web"
|
||
# Note: SENTRY_DSN 在 Secrets 中配置 (含認證 token)
|
||
|
||
# 2026-04-06 Claude Code: Sprint 3 — ansible:// 白名單 (Security Fix A2)
|
||
ANSIBLE_PLAYBOOK_WHITELIST: "restart_docker_service.yml,vacuum_postgres.yml,clear_redis_cache.yml"
|
||
ANSIBLE_CONTROL_NODE_HOST: "192.168.0.188"
|
||
ANSIBLE_CONTROL_NODE_USER: "ollama"
|
||
ANSIBLE_PLAYBOOKS_PATH: "~/openclaw-v5/ansible/playbooks"
|
||
|
||
# 2026-04-09 Claude Sonnet 4.6: K3s ClusterIP 10.43.0.1 在 Pod 內 Connection Refused
|
||
# in-cluster config 讀到 10.43.0.1，但 iptables/kube-proxy 沒把流量導到實際 API server
|
||
# 用此 URL 覆蓋 host，讓 executor 直接打 K3s API server node IP
|
||
K8S_API_SERVER_URL: "https://192.168.0.120:6443"
|
||
|
||
# MCP Phase 2a (2026-04-11 Claude Sonnet 4.6): SSH MCP 啟用
|
||
# SSH_MCP_ENABLED=true 需確認 ssh-mcp-key Secret 已建立且 188 已加 authorized_keys
|
||
SSH_MCP_ENABLED: "true"
|
||
SSH_MCP_KNOWN_HOSTS_FILE: "/etc/ssh-mcp/known_hosts"
|
||
# 2026-04-27 Claude Sonnet 4.6: 授權主機告警 SSH 自動執行白名單
|
||
# 根因：SSH_MCP_ALLOWED_HOSTS 未設定 → _ssh_execute() 攔截 → 主機告警全部降級人工審核
|
||
# 四台主機：110(DevOps金庫/wooo), 120(K3s-1/wooo), 121(K3s-2/wooo), 188(AI中心/ollama)
|
||
SSH_MCP_ALLOWED_HOSTS: "192.168.0.110,192.168.0.120,192.168.0.121,192.168.0.188"
|
||
SSH_MCP_HOST_USERS: "192.168.0.188=ollama"
|
||
# 2026-04-28 Claude Sonnet 4.6: Wave 2 B3 — LLM 動態 Telegram 按鈕正式啟用
|
||
# B2 dispatch_llm_action + B3 keyboard + B4 la:{short_id} handler 全部就緒
|
||
USE_LLM_DYNAMIC_BUTTONS: "true"
|
||
# MCP Phase 3 (2026-04-11 Claude Sonnet 4.6): ArgoCD + Sentry MCP 啟用
|
||
# ARGOCD_API_TOKEN 在 Secrets 中配置
|
||
ARGOCD_MCP_ENABLED: "true"
|
||
# 2026-04-14 Claude Sonnet 4.6: 改指向 121 — node 120 kube-proxy 對 30443 有路由 bug
|
||
# 測試結果: 120:30443 → 000(FAIL), 121:30443 → 405(ArgoCD 正常), VIP:30443 → 000(經由120故障)
|
||
ARGOCD_URL: "https://192.168.0.121:30443"
|
||
SENTRY_MCP_ENABLED: "true"
|
||
# Prometheus server 在 110:9090 (非 188)
|
||
PROMETHEUS_URL: "http://192.168.0.110:9090"
|
||
PROMETHEUS_MULTIPROC_DIR: "/tmp/awoooi-prometheus-multiproc"
|
||
|
||
# ============================================================================
|
||
# AIOps Phase 1-6 Feature Flags (2026-04-15 ogt: 全開，資料先全寫入 DB)
|
||
# ============================================================================
|
||
AIOPS_P1_ENABLED: "true"
|
||
AIOPS_P1_PRE_DECISION_INVESTIGATOR: "true"
|
||
AIOPS_P1_POST_EXECUTION_VERIFIER: "true"
|
||
AIOPS_P2_ENABLED: "true"
|
||
AIOPS_P2_CRITIC_ENABLED: "true"
|
||
AIOPS_P2_AGENT_TIMEOUT_SEC: "15"
|
||
AIOPS_P3_ENABLED: "true"
|
||
AIOPS_P3_EVOLVER_ENABLED: "true"
|
||
AIOPS_P3_FINETUNE_EXPORT: "true"
|
||
AIOPS_P3_KNOWLEDGE_DECAY: "true"
|
||
AIOPS_P4_ENABLED: "true"
|
||
AIOPS_P4_DYNAMIC_BASELINE: "true"
|
||
AIOPS_P4_LOG_ANOMALY: "true"
|
||
AIOPS_P4_TREND_PREDICTOR: "true"
|
||
AIOPS_P4_PROACTIVE_INSPECTOR: "true"
|
||
# 2026-04-16 Claude Sonnet 4.6: 解除 shadow mode — 真實主動監控啟用
|
||
# 原因: baseline_anomalies/trend_breaches 皆 0，且 proactive_inspector 只寫 _last_report
|
||
# 行為改變: ProactiveAlert.shadow_mode=false → PreDecisionInvestigator 讀取後可觸發 Incident
|
||
AIOPS_P4_SHADOW_MODE: "false"
|
||
AIOPS_P5_ENABLED: "true"
|
||
AIOPS_P5_BLAST_RADIUS_CHECK: "true"
|
||
AIOPS_P5_GITOPS_PR: "false"
|
||
AIOPS_P5_DRY_RUN_ENFORCED: "true"
|
||
AIOPS_P6_ENABLED: "true"
|
||
AIOPS_P6_GOVERNANCE_ENABLED: "true"
|
||
AIOPS_P6_SELF_DEMOTION: "true"
|
||
AIOPS_P6_OFFLINE_REPLAY: "true"
|
||
AIOPS_P6_KB_ROT_CLEANER: "true"
|
||
AIOPS_P6_TRUST_DRIFT_DETECTOR: "true"
|
||
# 2026-04-25 ogt + Claude Sonnet 4.6: Hermes × 12-Agent 整合（ADR-093/094/095）
|
||
# 2026-04-25 ogt: HERMES_NL_ENABLED 開啟 — polling 路徑已接入 @tsenyangbot @mention → Hermes NL
|
||
# 2026-04-25 ogt: 全切群組 — 所有告警轉 SRE 戰情室 (TG_GROUP_CUTOVER 正式啟用)
|
||
TG_GROUP_CUTOVER: "true"
|
||
HERMES_NL_ENABLED: "true"
|
||
ENABLE_12AGENT_CONSENSUS: "false"
|