mirror of
https://github.com/hoshikawa2/deploy_langfuse_oci.git
synced 2026-07-09 17:14:22 +00:00
first commit
This commit is contained in:
103
src/create_secrets.sh
Normal file
103
src/create_secrets.sh
Normal file
@@ -0,0 +1,103 @@
|
||||
#!/bin/bash
|
||||
set -ex
|
||||
|
||||
echo "🔐 Criando secrets no OCI Vault..."
|
||||
|
||||
# =========================
|
||||
# ⚙️ CONFIG
|
||||
# =========================
|
||||
|
||||
export COMPARTMENT_ID="ocid1.compartment.oc1..aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
|
||||
export VAULT_ID="ocid1.vault.oc1.iad.aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
|
||||
export KEY_ID="ocid1.key.oc1.iad.aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
|
||||
export PREFIX="langfuse"
|
||||
|
||||
# =========================
|
||||
# 🔑 SENHAS
|
||||
# =========================
|
||||
|
||||
# Senha comum simples
|
||||
if [ -z "$COMMON_SECRET" ]; then
|
||||
echo "🔑 Gerando COMMON_SECRET..."
|
||||
COMMON_SECRET=$(openssl rand -base64 32 | tr -d '\n')
|
||||
fi
|
||||
|
||||
# ENCRYPTION_KEY precisa:
|
||||
# - 64 chars
|
||||
# - hexadecimal
|
||||
# - 256 bits
|
||||
if [ -z "$ENCRYPTION_KEY" ]; then
|
||||
echo "🔐 Gerando ENCRYPTION_KEY..."
|
||||
ENCRYPTION_KEY=$(openssl rand -hex 32)
|
||||
fi
|
||||
|
||||
echo "👉 COMMON_SECRET: $COMMON_SECRET"
|
||||
echo "👉 ENCRYPTION_KEY: $ENCRYPTION_KEY"
|
||||
|
||||
# =========================
|
||||
# 🔧 FUNÇÃO
|
||||
# =========================
|
||||
|
||||
create_secret() {
|
||||
|
||||
local name=$1
|
||||
local value=$2
|
||||
|
||||
echo "📦 Criando secret: $name"
|
||||
|
||||
local base64_value
|
||||
base64_value=$(printf "%s" "$value" | base64 | tr -d '\n')
|
||||
|
||||
oci vault secret create-base64 \
|
||||
--compartment-id "$COMPARTMENT_ID" \
|
||||
--vault-id "$VAULT_ID" \
|
||||
--key-id "$KEY_ID" \
|
||||
--secret-name "$name" \
|
||||
--secret-content-content "$base64_value" \
|
||||
--query 'data.id' \
|
||||
--raw-output
|
||||
}
|
||||
|
||||
# =========================
|
||||
# 🔥 CRIAR SECRETS
|
||||
# =========================
|
||||
|
||||
DB_SECRET=$(create_secret "${PREFIX}-db-password" "$COMMON_SECRET")
|
||||
|
||||
REDIS_SECRET=$(create_secret "${PREFIX}-redis" "$COMMON_SECRET")
|
||||
|
||||
CLICKHOUSE_SECRET=$(create_secret "${PREFIX}-clickhouse" "$COMMON_SECRET")
|
||||
|
||||
NEXTAUTH_SECRET=$(create_secret "${PREFIX}-nextauth" "$COMMON_SECRET")
|
||||
|
||||
# 👇 SOMENTE ESTA KEY TEM FORMATO ESPECIAL
|
||||
ENCRYPTION_SECRET=$(create_secret "${PREFIX}-encryption" "$ENCRYPTION_KEY")
|
||||
|
||||
SALT_SECRET=$(create_secret "${PREFIX}-salt" "$COMMON_SECRET")
|
||||
|
||||
OCI_ACCESS_SECRET=$(create_secret "${PREFIX}-oci-access" "$COMMON_SECRET")
|
||||
|
||||
OCI_SECRET_SECRET=$(create_secret "${PREFIX}-oci-secret" "$COMMON_SECRET")
|
||||
|
||||
# =========================
|
||||
# 📤 OUTPUT
|
||||
# =========================
|
||||
|
||||
echo ""
|
||||
echo "✅ Secrets criados com sucesso!"
|
||||
echo ""
|
||||
|
||||
echo "export OCI_SECRET_DB=$DB_SECRET"
|
||||
echo "export OCI_SECRET_REDIS=$REDIS_SECRET"
|
||||
echo "export OCI_SECRET_CLICKHOUSE=$CLICKHOUSE_SECRET"
|
||||
echo "export OCI_SECRET_NEXTAUTH=$NEXTAUTH_SECRET"
|
||||
echo "export OCI_SECRET_ENCRYPTION=$ENCRYPTION_SECRET"
|
||||
echo "export OCI_SECRET_SALT=$SALT_SECRET"
|
||||
echo "export OCI_SECRET_OCI_ACCESS=$OCI_ACCESS_SECRET"
|
||||
echo "export OCI_SECRET_OCI_SECRET=$OCI_SECRET_SECRET"
|
||||
|
||||
echo ""
|
||||
echo "💡 Salve isso no seu pipeline ou env.sh"
|
||||
591
src/final.yaml
Normal file
591
src/final.yaml
Normal file
@@ -0,0 +1,591 @@
|
||||
apiVersion: storage.k8s.io/v1
|
||||
kind: StorageClass
|
||||
metadata:
|
||||
name: oci-bv-high-performance
|
||||
provisioner: blockvolume.csi.oraclecloud.com
|
||||
parameters:
|
||||
vpusPerGB: "20"
|
||||
attachment-type: "paravirtualized"
|
||||
volumeBindingMode: WaitForFirstConsumer
|
||||
allowVolumeExpansion: true
|
||||
reclaimPolicy: Delete
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: langfuse-db-pvc
|
||||
namespace: langfuse
|
||||
spec:
|
||||
accessModes: ["ReadWriteOnce"]
|
||||
storageClassName: oci-bv-high-performance
|
||||
resources:
|
||||
requests:
|
||||
storage: 50Gi
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: langfuse-db
|
||||
namespace: langfuse
|
||||
spec:
|
||||
replicas: 1
|
||||
strategy:
|
||||
type: Recreate
|
||||
selector:
|
||||
matchLabels:
|
||||
app: langfuse-db
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: langfuse-db
|
||||
spec:
|
||||
imagePullSecrets:
|
||||
- name: ocirsecret
|
||||
containers:
|
||||
- name: langfuse-db
|
||||
image: iad.ocir.io/xxxxxxxxxx/postgres:15
|
||||
ports:
|
||||
- containerPort: 5432
|
||||
env:
|
||||
- name: POSTGRES_USER
|
||||
value: "langfuse"
|
||||
- name: POSTGRES_PASSWORD
|
||||
value: "langfuse123"
|
||||
- name: POSTGRES_DB
|
||||
value: "langfuse"
|
||||
- name: PGDATA
|
||||
value: "/var/lib/postgresql/data/pgdata"
|
||||
resources:
|
||||
requests:
|
||||
cpu: "50m"
|
||||
memory: "2Gi"
|
||||
limits:
|
||||
cpu: "512m"
|
||||
memory: "3Gi"
|
||||
volumeMounts:
|
||||
- name: db-data
|
||||
mountPath: /var/lib/postgresql/data
|
||||
volumes:
|
||||
- name: db-data
|
||||
persistentVolumeClaim:
|
||||
claimName: langfuse-db-pvc
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: langfuse-db
|
||||
namespace: langfuse
|
||||
spec:
|
||||
type: NodePort
|
||||
selector:
|
||||
app: langfuse-db
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 5432
|
||||
targetPort: 5432
|
||||
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: langfuse-redis
|
||||
namespace: langfuse
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: langfuse-redis
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: langfuse-redis
|
||||
spec:
|
||||
imagePullSecrets:
|
||||
- name: ocirsecret
|
||||
containers:
|
||||
- name: redis
|
||||
image: iad.ocir.io/xxxxxxxxxxx/redis:7.2
|
||||
command: ["redis-server", "--requirepass", "redis123"]
|
||||
ports:
|
||||
- containerPort: 6379
|
||||
resources:
|
||||
requests:
|
||||
cpu: "50m"
|
||||
memory: "2Gi"
|
||||
limits:
|
||||
cpu: "512m"
|
||||
memory: "3Gi"
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: langfuse-redis
|
||||
namespace: langfuse
|
||||
spec:
|
||||
type: NodePort
|
||||
selector:
|
||||
app: langfuse-redis
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 6379
|
||||
targetPort: 6379
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: StatefulSet
|
||||
metadata:
|
||||
name: langfuse-clickhouse
|
||||
namespace: langfuse
|
||||
spec:
|
||||
serviceName: langfuse-clickhouse
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: langfuse-clickhouse
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: langfuse-clickhouse
|
||||
spec:
|
||||
imagePullSecrets:
|
||||
- name: ocirsecret
|
||||
containers:
|
||||
- name: clickhouse
|
||||
image: iad.ocir.io/xxxxxxxxxxxx/clickhouse:23.8
|
||||
ports:
|
||||
- containerPort: 8123
|
||||
- containerPort: 9000
|
||||
resources:
|
||||
requests:
|
||||
cpu: "2"
|
||||
memory: "8Gi"
|
||||
limits:
|
||||
cpu: "4"
|
||||
memory: "16Gi"
|
||||
volumeMounts:
|
||||
- name: data
|
||||
mountPath: /var/lib/clickhouse
|
||||
env:
|
||||
- name: CLICKHOUSE_DB
|
||||
value: "default"
|
||||
|
||||
- name: CLICKHOUSE_USER
|
||||
value: "default"
|
||||
|
||||
- name: CLICKHOUSE_PASSWORD
|
||||
value: "clickhouse123"
|
||||
|
||||
- name: CLICKHOUSE_DEFAULT_ACCESS_MANAGEMENT
|
||||
value: "1"
|
||||
volumeClaimTemplates:
|
||||
- metadata:
|
||||
name: data
|
||||
spec:
|
||||
accessModes: ["ReadWriteOnce"]
|
||||
storageClassName: oci-bv-high-performance
|
||||
resources:
|
||||
requests:
|
||||
storage: 200Gi
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: langfuse-clickhouse
|
||||
namespace: langfuse
|
||||
spec:
|
||||
selector:
|
||||
app: langfuse-clickhouse
|
||||
ports:
|
||||
- name: http
|
||||
port: 8123
|
||||
- name: native
|
||||
port: 9000
|
||||
---
|
||||
# ===== LANGFUSE APPLICATION =====
|
||||
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: langfuse
|
||||
namespace: langfuse
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: langfuse
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: langfuse
|
||||
spec:
|
||||
imagePullSecrets:
|
||||
- name: ocirsecret
|
||||
|
||||
initContainers:
|
||||
|
||||
- name: wait-for-postgres
|
||||
image: busybox
|
||||
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- |
|
||||
until nc -z langfuse-db 5432; do
|
||||
echo "⏳ Waiting for PostgreSQL..."
|
||||
sleep 2
|
||||
done
|
||||
|
||||
- name: wait-for-redis
|
||||
image: busybox
|
||||
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- |
|
||||
until nc -z langfuse-redis 6379; do
|
||||
echo "⏳ Waiting for Redis..."
|
||||
sleep 2
|
||||
done
|
||||
|
||||
- name: wait-for-clickhouse
|
||||
image: busybox
|
||||
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- |
|
||||
until nc -z langfuse-clickhouse 9000; do
|
||||
echo "⏳ Waiting for ClickHouse..."
|
||||
sleep 2
|
||||
done
|
||||
containers:
|
||||
- name: langfuse
|
||||
image: iad.ocir.io/xxxxxxxxxxxx/langfuse:3.1.0
|
||||
ports:
|
||||
- containerPort: 3000
|
||||
env:
|
||||
- name: DATABASE_URL
|
||||
value: "postgresql://langfuse:langfuse123@langfuse-db:5432/langfuse"
|
||||
- name: NEXTAUTH_SECRET
|
||||
value: "nextauth-secret-123"
|
||||
- name: SALT
|
||||
value: "salt-secret-123"
|
||||
- name: ENCRYPTION_KEY
|
||||
value: "ea58fe36914e38ec5d52657c928d3e8350ff1513e1930e0fd306dce6422bf87d"
|
||||
- name: NEXTAUTH_URL
|
||||
value: https://langfuse.seudominio.com
|
||||
- name: TELEMETRY_ENABLED
|
||||
value: "false"
|
||||
- name: CLICKHOUSE_URL
|
||||
value: "http://langfuse-clickhouse:8123"
|
||||
- name: CLICKHOUSE_USER
|
||||
value: "default"
|
||||
- name: CLICKHOUSE_PASSWORD
|
||||
value: "clickhouse123"
|
||||
- name: CLICKHOUSE_CLUSTER_ENABLED
|
||||
value: "false"
|
||||
- name: CLICKHOUSE_MIGRATION_URL
|
||||
value: "clickhouse://langfuse-clickhouse:9000"
|
||||
- name: REDIS_HOST
|
||||
value: "langfuse-redis"
|
||||
- name: REDIS_PORT
|
||||
value: "6379"
|
||||
- name: REDIS_AUTH
|
||||
value: "redis123"
|
||||
# ===== OCI OBJECT STORAGE (EVENTS) =====
|
||||
- name: LANGFUSE_USE_OCI_NATIVE_OBJECT_STORAGE
|
||||
value: "true"
|
||||
- name: LANGFUSE_OCI_AUTH_TYPE
|
||||
value: "instance_principal"
|
||||
- name: LANGFUSE_S3_EVENT_UPLOAD_BUCKET
|
||||
value: "langfuse-events"
|
||||
|
||||
- name: LANGFUSE_S3_EVENT_UPLOAD_REGION
|
||||
value: "us-ashburn-1"
|
||||
|
||||
- name: LANGFUSE_S3_EVENT_UPLOAD_ENDPOINT
|
||||
value: "https://xxxxxxxxxxx.compat.objectstorage.us-ashburn-1.oraclecloud.com"
|
||||
|
||||
# - name: LANGFUSE_S3_EVENT_UPLOAD_ACCESS_KEY_ID
|
||||
# valueFrom:
|
||||
# secretKeyRef:
|
||||
# name: langfuse-secret
|
||||
# key: oci-access-key
|
||||
#
|
||||
# - name: LANGFUSE_S3_EVENT_UPLOAD_SECRET_ACCESS_KEY
|
||||
# valueFrom:
|
||||
# secretKeyRef:
|
||||
# name: langfuse-secret
|
||||
# key: oci-secret-key
|
||||
|
||||
- name: LANGFUSE_S3_EVENT_UPLOAD_FORCE_PATH_STYLE
|
||||
value: "true"
|
||||
|
||||
# ===== EXPORT =====
|
||||
- name: LANGFUSE_S3_BATCH_EXPORT_ENABLED
|
||||
value: "true"
|
||||
|
||||
- name: LANGFUSE_S3_BATCH_EXPORT_BUCKET
|
||||
value: "langfuse-exports"
|
||||
|
||||
- name: LANGFUSE_S3_BATCH_EXPORT_REGION
|
||||
value: "us-ashburn-1"
|
||||
|
||||
- name: LANGFUSE_S3_BATCH_EXPORT_ENDPOINT
|
||||
value: "https://xxxxxxxxxxxx.compat.objectstorage.us-ashburn-1.oraclecloud.com"
|
||||
|
||||
# - name: LANGFUSE_S3_BATCH_EXPORT_ACCESS_KEY_ID
|
||||
# valueFrom:
|
||||
# secretKeyRef:
|
||||
# name: langfuse-secret
|
||||
# key: oci-access-key
|
||||
#
|
||||
# - name: LANGFUSE_S3_BATCH_EXPORT_SECRET_ACCESS_KEY
|
||||
# valueFrom:
|
||||
# secretKeyRef:
|
||||
# name: langfuse-secret
|
||||
# key: oci-secret-key
|
||||
|
||||
- name: LANGFUSE_S3_BATCH_EXPORT_FORCE_PATH_STYLE
|
||||
value: "true"
|
||||
resources:
|
||||
requests:
|
||||
cpu: "50m"
|
||||
memory: "2Gi"
|
||||
limits:
|
||||
cpu: "512m"
|
||||
memory: "3Gi"
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /api/public/health
|
||||
port: 3000
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 15
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /api/public/health
|
||||
port: 3000
|
||||
initialDelaySeconds: 15
|
||||
periodSeconds: 10
|
||||
|
||||
---
|
||||
# ===== LANGFUSE WORKER =====
|
||||
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: langfuse-worker
|
||||
namespace: langfuse
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: langfuse-worker
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: langfuse-worker
|
||||
spec:
|
||||
imagePullSecrets:
|
||||
- name: ocirsecret
|
||||
|
||||
initContainers:
|
||||
|
||||
- name: wait-for-postgres
|
||||
image: busybox
|
||||
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- |
|
||||
until nc -z langfuse-db 5432; do
|
||||
echo "⏳ Waiting for PostgreSQL..."
|
||||
sleep 2
|
||||
done
|
||||
|
||||
- name: wait-for-redis
|
||||
image: busybox
|
||||
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- |
|
||||
until nc -z langfuse-redis 6379; do
|
||||
echo "⏳ Waiting for Redis..."
|
||||
sleep 2
|
||||
done
|
||||
|
||||
- name: wait-for-clickhouse
|
||||
image: busybox
|
||||
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- |
|
||||
until nc -z langfuse-clickhouse 9000; do
|
||||
echo "⏳ Waiting for ClickHouse..."
|
||||
sleep 2
|
||||
done
|
||||
containers:
|
||||
- name: worker
|
||||
image: iad.ocir.io/xxxxxxxxxxxx/langfuse-worker:3.1.0
|
||||
env:
|
||||
- name: DATABASE_URL
|
||||
value: "postgresql://langfuse:langfuse123@langfuse-db:5432/langfuse"
|
||||
- name: ENCRYPTION_KEY
|
||||
value: "ea58fe36914e38ec5d52657c928d3e8350ff1513e1930e0fd306dce6422bf87d"
|
||||
- name: CLICKHOUSE_URL
|
||||
value: "http://langfuse-clickhouse:8123"
|
||||
- name: CLICKHOUSE_USER
|
||||
value: "default"
|
||||
- name: CLICKHOUSE_PASSWORD
|
||||
value: "clickhouse123"
|
||||
- name: CLICKHOUSE_CLUSTER_ENABLED
|
||||
value: "false"
|
||||
- name: CLICKHOUSE_MIGRATION_URL
|
||||
value: "clickhouse://langfuse-clickhouse:9000"
|
||||
- name: REDIS_HOST
|
||||
value: "langfuse-redis"
|
||||
- name: REDIS_PORT
|
||||
value: "6379"
|
||||
- name: REDIS_AUTH
|
||||
value: "redis123"
|
||||
# ===== OCI OBJECT STORAGE (EVENTS) =====
|
||||
- name: LANGFUSE_USE_OCI_NATIVE_OBJECT_STORAGE
|
||||
value: "true"
|
||||
- name: LANGFUSE_OCI_AUTH_TYPE
|
||||
value: "instance_principal"
|
||||
- name: LANGFUSE_S3_EVENT_UPLOAD_BUCKET
|
||||
value: "langfuse-events"
|
||||
|
||||
- name: LANGFUSE_S3_EVENT_UPLOAD_REGION
|
||||
value: "us-ashburn-1"
|
||||
|
||||
- name: LANGFUSE_S3_EVENT_UPLOAD_ENDPOINT
|
||||
value: "https://xxxxxxxxx.compat.objectstorage.us-ashburn-1.oraclecloud.com"
|
||||
|
||||
# - name: LANGFUSE_S3_EVENT_UPLOAD_ACCESS_KEY_ID
|
||||
# valueFrom:
|
||||
# secretKeyRef:
|
||||
# name: langfuse-secret
|
||||
# key: oci-access-key
|
||||
#
|
||||
# - name: LANGFUSE_S3_EVENT_UPLOAD_SECRET_ACCESS_KEY
|
||||
# valueFrom:
|
||||
# secretKeyRef:
|
||||
# name: langfuse-secret
|
||||
# key: oci-secret-key
|
||||
|
||||
- name: LANGFUSE_S3_EVENT_UPLOAD_FORCE_PATH_STYLE
|
||||
value: "true"
|
||||
|
||||
# ===== EXPORT =====
|
||||
- name: LANGFUSE_S3_BATCH_EXPORT_ENABLED
|
||||
value: "true"
|
||||
|
||||
- name: LANGFUSE_S3_BATCH_EXPORT_BUCKET
|
||||
value: "langfuse-exports"
|
||||
|
||||
- name: LANGFUSE_S3_BATCH_EXPORT_REGION
|
||||
value: "us-ashburn-1"
|
||||
|
||||
- name: LANGFUSE_S3_BATCH_EXPORT_ENDPOINT
|
||||
value: "https://xxxxxxxxxxx.compat.objectstorage.us-ashburn-1.oraclecloud.com"
|
||||
|
||||
# - name: LANGFUSE_S3_BATCH_EXPORT_ACCESS_KEY_ID
|
||||
# valueFrom:
|
||||
# secretKeyRef:
|
||||
# name: langfuse-secret
|
||||
# key: oci-access-key
|
||||
#
|
||||
# - name: LANGFUSE_S3_BATCH_EXPORT_SECRET_ACCESS_KEY
|
||||
# valueFrom:
|
||||
# secretKeyRef:
|
||||
# name: langfuse-secret
|
||||
# key: oci-secret-key
|
||||
|
||||
- name: LANGFUSE_S3_BATCH_EXPORT_FORCE_PATH_STYLE
|
||||
value: "true"
|
||||
resources:
|
||||
requests:
|
||||
cpu: "50m"
|
||||
memory: "2Gi"
|
||||
limits:
|
||||
cpu: "512m"
|
||||
memory: "3Gi"
|
||||
---
|
||||
# ===== LANGFUSE SERVICE =====
|
||||
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: langfuse-web
|
||||
namespace: langfuse
|
||||
annotations:
|
||||
service.beta.kubernetes.io/oci-load-balancer-internal: "true"
|
||||
oci.oraclecloud.com/healthcheck-path: "/api/public/health"
|
||||
oci.oraclecloud.com/healthcheck-port: "3000"
|
||||
spec:
|
||||
type: LoadBalancer
|
||||
selector:
|
||||
app: langfuse
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 80
|
||||
targetPort: 3000
|
||||
---
|
||||
# ===== LANGFUSE HPA - HORIZONTAL POD AUTOSCALER =====
|
||||
|
||||
apiVersion: autoscaling/v2
|
||||
kind: HorizontalPodAutoscaler
|
||||
metadata:
|
||||
name: langfuse-hpa
|
||||
spec:
|
||||
scaleTargetRef:
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
name: langfuse
|
||||
minReplicas: 2
|
||||
maxReplicas: 10
|
||||
metrics:
|
||||
- type: Resource
|
||||
resource:
|
||||
name: cpu
|
||||
target:
|
||||
type: Utilization
|
||||
averageUtilization: 70
|
||||
---
|
||||
# ===== WORKER - AUTOSCALER =====
|
||||
apiVersion: autoscaling/v2
|
||||
kind: HorizontalPodAutoscaler
|
||||
metadata:
|
||||
name: langfuse-worker-hpa
|
||||
spec:
|
||||
scaleTargetRef:
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
name: langfuse-worker
|
||||
minReplicas: 2
|
||||
maxReplicas: 10
|
||||
metrics:
|
||||
- type: Resource
|
||||
resource:
|
||||
name: cpu
|
||||
target:
|
||||
type: Utilization
|
||||
averageUtilization: 70
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: langfuse-lb
|
||||
namespace: langfuse
|
||||
annotations:
|
||||
service.beta.kubernetes.io/oci-load-balancer-shape: "flexible"
|
||||
oci.oraclecloud.com/healthcheck-path: "/api/public/health"
|
||||
spec:
|
||||
type: LoadBalancer
|
||||
selector:
|
||||
app: langfuse
|
||||
ports:
|
||||
- port: 80
|
||||
targetPort: 3000
|
||||
591
src/langfuse_dest.yaml
Normal file
591
src/langfuse_dest.yaml
Normal file
@@ -0,0 +1,591 @@
|
||||
apiVersion: storage.k8s.io/v1
|
||||
kind: StorageClass
|
||||
metadata:
|
||||
name: oci-bv-high-performance
|
||||
provisioner: blockvolume.csi.oraclecloud.com
|
||||
parameters:
|
||||
vpusPerGB: "20"
|
||||
attachment-type: "paravirtualized"
|
||||
volumeBindingMode: WaitForFirstConsumer
|
||||
allowVolumeExpansion: true
|
||||
reclaimPolicy: Delete
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: ${APP_NAME}-db-pvc
|
||||
namespace: ${K8S_NAMESPACE}
|
||||
spec:
|
||||
accessModes: ["ReadWriteOnce"]
|
||||
storageClassName: oci-bv-high-performance
|
||||
resources:
|
||||
requests:
|
||||
storage: 50Gi
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: ${APP_NAME}-db
|
||||
namespace: ${K8S_NAMESPACE}
|
||||
spec:
|
||||
replicas: 1
|
||||
strategy:
|
||||
type: Recreate
|
||||
selector:
|
||||
matchLabels:
|
||||
app: ${APP_NAME}-db
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: ${APP_NAME}-db
|
||||
spec:
|
||||
imagePullSecrets:
|
||||
- name: ocirsecret
|
||||
containers:
|
||||
- name: ${APP_NAME}-db
|
||||
image: ${IMAGE_REPOSITORY}/postgres:${POSTGRES_TAG}
|
||||
ports:
|
||||
- containerPort: 5432
|
||||
env:
|
||||
- name: POSTGRES_USER
|
||||
value: "langfuse"
|
||||
- name: POSTGRES_PASSWORD
|
||||
value: "${DB_PASSWORD}"
|
||||
- name: POSTGRES_DB
|
||||
value: "langfuse"
|
||||
- name: PGDATA
|
||||
value: "/var/lib/postgresql/data/pgdata"
|
||||
resources:
|
||||
requests:
|
||||
cpu: "50m"
|
||||
memory: "2Gi"
|
||||
limits:
|
||||
cpu: "512m"
|
||||
memory: "3Gi"
|
||||
volumeMounts:
|
||||
- name: db-data
|
||||
mountPath: /var/lib/postgresql/data
|
||||
volumes:
|
||||
- name: db-data
|
||||
persistentVolumeClaim:
|
||||
claimName: ${APP_NAME}-db-pvc
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: ${APP_NAME}-db
|
||||
namespace: ${K8S_NAMESPACE}
|
||||
spec:
|
||||
type: NodePort
|
||||
selector:
|
||||
app: ${APP_NAME}-db
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 5432
|
||||
targetPort: 5432
|
||||
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: ${APP_NAME}-redis
|
||||
namespace: ${K8S_NAMESPACE}
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: ${APP_NAME}-redis
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: ${APP_NAME}-redis
|
||||
spec:
|
||||
imagePullSecrets:
|
||||
- name: ocirsecret
|
||||
containers:
|
||||
- name: redis
|
||||
image: ${IMAGE_REPOSITORY}/redis:${REDIS_TAG}
|
||||
command: ["redis-server", "--requirepass", "${REDIS_AUTH}"]
|
||||
ports:
|
||||
- containerPort: 6379
|
||||
resources:
|
||||
requests:
|
||||
cpu: "50m"
|
||||
memory: "2Gi"
|
||||
limits:
|
||||
cpu: "512m"
|
||||
memory: "3Gi"
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: ${APP_NAME}-redis
|
||||
namespace: ${K8S_NAMESPACE}
|
||||
spec:
|
||||
type: NodePort
|
||||
selector:
|
||||
app: ${APP_NAME}-redis
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 6379
|
||||
targetPort: 6379
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: StatefulSet
|
||||
metadata:
|
||||
name: ${APP_NAME}-clickhouse
|
||||
namespace: ${K8S_NAMESPACE}
|
||||
spec:
|
||||
serviceName: ${APP_NAME}-clickhouse
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: ${APP_NAME}-clickhouse
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: ${APP_NAME}-clickhouse
|
||||
spec:
|
||||
imagePullSecrets:
|
||||
- name: ocirsecret
|
||||
containers:
|
||||
- name: clickhouse
|
||||
image: ${IMAGE_REPOSITORY}/clickhouse:${CLICKHOUSE_TAG}
|
||||
ports:
|
||||
- containerPort: 8123
|
||||
- containerPort: 9000
|
||||
resources:
|
||||
requests:
|
||||
cpu: "2"
|
||||
memory: "8Gi"
|
||||
limits:
|
||||
cpu: "4"
|
||||
memory: "16Gi"
|
||||
volumeMounts:
|
||||
- name: data
|
||||
mountPath: /var/lib/clickhouse
|
||||
env:
|
||||
- name: CLICKHOUSE_DB
|
||||
value: "default"
|
||||
|
||||
- name: CLICKHOUSE_USER
|
||||
value: "default"
|
||||
|
||||
- name: CLICKHOUSE_PASSWORD
|
||||
value: "${CLICKHOUSE_PASSWORD}"
|
||||
|
||||
- name: CLICKHOUSE_DEFAULT_ACCESS_MANAGEMENT
|
||||
value: "1"
|
||||
volumeClaimTemplates:
|
||||
- metadata:
|
||||
name: data
|
||||
spec:
|
||||
accessModes: ["ReadWriteOnce"]
|
||||
storageClassName: oci-bv-high-performance
|
||||
resources:
|
||||
requests:
|
||||
storage: 200Gi
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: ${APP_NAME}-clickhouse
|
||||
namespace: ${K8S_NAMESPACE}
|
||||
spec:
|
||||
selector:
|
||||
app: ${APP_NAME}-clickhouse
|
||||
ports:
|
||||
- name: http
|
||||
port: 8123
|
||||
- name: native
|
||||
port: 9000
|
||||
---
|
||||
# ===== LANGFUSE APPLICATION =====
|
||||
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: ${APP_NAME}
|
||||
namespace: ${K8S_NAMESPACE}
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: ${APP_NAME}
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: ${APP_NAME}
|
||||
spec:
|
||||
imagePullSecrets:
|
||||
- name: ocirsecret
|
||||
|
||||
initContainers:
|
||||
|
||||
- name: wait-for-postgres
|
||||
image: busybox
|
||||
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- |
|
||||
until nc -z ${APP_NAME}-db 5432; do
|
||||
echo "⏳ Waiting for PostgreSQL..."
|
||||
sleep 2
|
||||
done
|
||||
|
||||
- name: wait-for-redis
|
||||
image: busybox
|
||||
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- |
|
||||
until nc -z ${APP_NAME}-redis 6379; do
|
||||
echo "⏳ Waiting for Redis..."
|
||||
sleep 2
|
||||
done
|
||||
|
||||
- name: wait-for-clickhouse
|
||||
image: busybox
|
||||
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- |
|
||||
until nc -z ${APP_NAME}-clickhouse 9000; do
|
||||
echo "⏳ Waiting for ClickHouse..."
|
||||
sleep 2
|
||||
done
|
||||
containers:
|
||||
- name: ${APP_NAME}
|
||||
image: ${IMAGE_REPOSITORY}/langfuse:${IMAGE_TAG}
|
||||
ports:
|
||||
- containerPort: 3000
|
||||
env:
|
||||
- name: DATABASE_URL
|
||||
value: "${DATABASE_URL}"
|
||||
- name: NEXTAUTH_SECRET
|
||||
value: "${NEXTAUTH_SECRET}"
|
||||
- name: SALT
|
||||
value: "${SALT}"
|
||||
- name: ENCRYPTION_KEY
|
||||
value: "${ENCRYPTION_KEY}"
|
||||
- name: NEXTAUTH_URL
|
||||
value: ${NEXTAUTH_URL}
|
||||
- name: TELEMETRY_ENABLED
|
||||
value: "false"
|
||||
- name: CLICKHOUSE_URL
|
||||
value: "http://${APP_NAME}-clickhouse:8123"
|
||||
- name: CLICKHOUSE_USER
|
||||
value: "default"
|
||||
- name: CLICKHOUSE_PASSWORD
|
||||
value: "${CLICKHOUSE_PASSWORD}"
|
||||
- name: CLICKHOUSE_CLUSTER_ENABLED
|
||||
value: "false"
|
||||
- name: CLICKHOUSE_MIGRATION_URL
|
||||
value: "clickhouse://${APP_NAME}-clickhouse:9000"
|
||||
- name: REDIS_HOST
|
||||
value: "${APP_NAME}-redis"
|
||||
- name: REDIS_PORT
|
||||
value: "6379"
|
||||
- name: REDIS_AUTH
|
||||
value: "${REDIS_AUTH}"
|
||||
# ===== OCI OBJECT STORAGE (EVENTS) =====
|
||||
- name: LANGFUSE_USE_OCI_NATIVE_OBJECT_STORAGE
|
||||
value: "true"
|
||||
- name: LANGFUSE_OCI_AUTH_TYPE
|
||||
value: "instance_principal"
|
||||
- name: LANGFUSE_S3_EVENT_UPLOAD_BUCKET
|
||||
value: "langfuse-events"
|
||||
|
||||
- name: LANGFUSE_S3_EVENT_UPLOAD_REGION
|
||||
value: "${OCI_REGION}"
|
||||
|
||||
- name: LANGFUSE_S3_EVENT_UPLOAD_ENDPOINT
|
||||
value: "https://${OCI_NAMESPACE}.compat.objectstorage.${OCI_REGION}.oraclecloud.com"
|
||||
|
||||
# - name: LANGFUSE_S3_EVENT_UPLOAD_ACCESS_KEY_ID
|
||||
# valueFrom:
|
||||
# secretKeyRef:
|
||||
# name: langfuse-secret
|
||||
# key: oci-access-key
|
||||
#
|
||||
# - name: LANGFUSE_S3_EVENT_UPLOAD_SECRET_ACCESS_KEY
|
||||
# valueFrom:
|
||||
# secretKeyRef:
|
||||
# name: langfuse-secret
|
||||
# key: oci-secret-key
|
||||
|
||||
- name: LANGFUSE_S3_EVENT_UPLOAD_FORCE_PATH_STYLE
|
||||
value: "true"
|
||||
|
||||
# ===== EXPORT =====
|
||||
- name: LANGFUSE_S3_BATCH_EXPORT_ENABLED
|
||||
value: "true"
|
||||
|
||||
- name: LANGFUSE_S3_BATCH_EXPORT_BUCKET
|
||||
value: "langfuse-exports"
|
||||
|
||||
- name: LANGFUSE_S3_BATCH_EXPORT_REGION
|
||||
value: "${OCI_REGION}"
|
||||
|
||||
- name: LANGFUSE_S3_BATCH_EXPORT_ENDPOINT
|
||||
value: "https://${OCI_NAMESPACE}.compat.objectstorage.${OCI_REGION}.oraclecloud.com"
|
||||
|
||||
# - name: LANGFUSE_S3_BATCH_EXPORT_ACCESS_KEY_ID
|
||||
# valueFrom:
|
||||
# secretKeyRef:
|
||||
# name: langfuse-secret
|
||||
# key: oci-access-key
|
||||
#
|
||||
# - name: LANGFUSE_S3_BATCH_EXPORT_SECRET_ACCESS_KEY
|
||||
# valueFrom:
|
||||
# secretKeyRef:
|
||||
# name: langfuse-secret
|
||||
# key: oci-secret-key
|
||||
|
||||
- name: LANGFUSE_S3_BATCH_EXPORT_FORCE_PATH_STYLE
|
||||
value: "true"
|
||||
resources:
|
||||
requests:
|
||||
cpu: "50m"
|
||||
memory: "2Gi"
|
||||
limits:
|
||||
cpu: "512m"
|
||||
memory: "3Gi"
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /api/public/health
|
||||
port: 3000
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 15
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /api/public/health
|
||||
port: 3000
|
||||
initialDelaySeconds: 15
|
||||
periodSeconds: 10
|
||||
|
||||
---
|
||||
# ===== LANGFUSE WORKER =====
|
||||
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: ${APP_NAME}-worker
|
||||
namespace: ${K8S_NAMESPACE}
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: ${APP_NAME}-worker
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: ${APP_NAME}-worker
|
||||
spec:
|
||||
imagePullSecrets:
|
||||
- name: ocirsecret
|
||||
|
||||
initContainers:
|
||||
|
||||
- name: wait-for-postgres
|
||||
image: busybox
|
||||
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- |
|
||||
until nc -z ${APP_NAME}-db 5432; do
|
||||
echo "⏳ Waiting for PostgreSQL..."
|
||||
sleep 2
|
||||
done
|
||||
|
||||
- name: wait-for-redis
|
||||
image: busybox
|
||||
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- |
|
||||
until nc -z ${APP_NAME}-redis 6379; do
|
||||
echo "⏳ Waiting for Redis..."
|
||||
sleep 2
|
||||
done
|
||||
|
||||
- name: wait-for-clickhouse
|
||||
image: busybox
|
||||
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- |
|
||||
until nc -z ${APP_NAME}-clickhouse 9000; do
|
||||
echo "⏳ Waiting for ClickHouse..."
|
||||
sleep 2
|
||||
done
|
||||
containers:
|
||||
- name: worker
|
||||
image: ${IMAGE_REPOSITORY}/langfuse-worker:${IMAGE_TAG}
|
||||
env:
|
||||
- name: DATABASE_URL
|
||||
value: "${DATABASE_URL}"
|
||||
- name: ENCRYPTION_KEY
|
||||
value: "${ENCRYPTION_KEY}"
|
||||
- name: CLICKHOUSE_URL
|
||||
value: "http://${APP_NAME}-clickhouse:8123"
|
||||
- name: CLICKHOUSE_USER
|
||||
value: "default"
|
||||
- name: CLICKHOUSE_PASSWORD
|
||||
value: "${CLICKHOUSE_PASSWORD}"
|
||||
- name: CLICKHOUSE_CLUSTER_ENABLED
|
||||
value: "false"
|
||||
- name: CLICKHOUSE_MIGRATION_URL
|
||||
value: "clickhouse://${APP_NAME}-clickhouse:9000"
|
||||
- name: REDIS_HOST
|
||||
value: "${APP_NAME}-redis"
|
||||
- name: REDIS_PORT
|
||||
value: "6379"
|
||||
- name: REDIS_AUTH
|
||||
value: "${REDIS_AUTH}"
|
||||
# ===== OCI OBJECT STORAGE (EVENTS) =====
|
||||
- name: LANGFUSE_USE_OCI_NATIVE_OBJECT_STORAGE
|
||||
value: "true"
|
||||
- name: LANGFUSE_OCI_AUTH_TYPE
|
||||
value: "instance_principal"
|
||||
- name: LANGFUSE_S3_EVENT_UPLOAD_BUCKET
|
||||
value: "langfuse-events"
|
||||
|
||||
- name: LANGFUSE_S3_EVENT_UPLOAD_REGION
|
||||
value: "${OCI_REGION}"
|
||||
|
||||
- name: LANGFUSE_S3_EVENT_UPLOAD_ENDPOINT
|
||||
value: "https://${OCI_NAMESPACE}.compat.objectstorage.${OCI_REGION}.oraclecloud.com"
|
||||
|
||||
# - name: LANGFUSE_S3_EVENT_UPLOAD_ACCESS_KEY_ID
|
||||
# valueFrom:
|
||||
# secretKeyRef:
|
||||
# name: langfuse-secret
|
||||
# key: oci-access-key
|
||||
#
|
||||
# - name: LANGFUSE_S3_EVENT_UPLOAD_SECRET_ACCESS_KEY
|
||||
# valueFrom:
|
||||
# secretKeyRef:
|
||||
# name: langfuse-secret
|
||||
# key: oci-secret-key
|
||||
|
||||
- name: LANGFUSE_S3_EVENT_UPLOAD_FORCE_PATH_STYLE
|
||||
value: "true"
|
||||
|
||||
# ===== EXPORT =====
|
||||
- name: LANGFUSE_S3_BATCH_EXPORT_ENABLED
|
||||
value: "true"
|
||||
|
||||
- name: LANGFUSE_S3_BATCH_EXPORT_BUCKET
|
||||
value: "langfuse-exports"
|
||||
|
||||
- name: LANGFUSE_S3_BATCH_EXPORT_REGION
|
||||
value: "${OCI_REGION}"
|
||||
|
||||
- name: LANGFUSE_S3_BATCH_EXPORT_ENDPOINT
|
||||
value: "https://${OCI_NAMESPACE}.compat.objectstorage.${OCI_REGION}.oraclecloud.com"
|
||||
|
||||
# - name: LANGFUSE_S3_BATCH_EXPORT_ACCESS_KEY_ID
|
||||
# valueFrom:
|
||||
# secretKeyRef:
|
||||
# name: langfuse-secret
|
||||
# key: oci-access-key
|
||||
#
|
||||
# - name: LANGFUSE_S3_BATCH_EXPORT_SECRET_ACCESS_KEY
|
||||
# valueFrom:
|
||||
# secretKeyRef:
|
||||
# name: langfuse-secret
|
||||
# key: oci-secret-key
|
||||
|
||||
- name: LANGFUSE_S3_BATCH_EXPORT_FORCE_PATH_STYLE
|
||||
value: "true"
|
||||
resources:
|
||||
requests:
|
||||
cpu: "50m"
|
||||
memory: "2Gi"
|
||||
limits:
|
||||
cpu: "512m"
|
||||
memory: "3Gi"
|
||||
---
|
||||
# ===== LANGFUSE SERVICE =====
|
||||
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: langfuse-web
|
||||
namespace: ${K8S_NAMESPACE}
|
||||
annotations:
|
||||
service.beta.kubernetes.io/oci-load-balancer-internal: "true"
|
||||
oci.oraclecloud.com/healthcheck-path: "/api/public/health"
|
||||
oci.oraclecloud.com/healthcheck-port: "3000"
|
||||
spec:
|
||||
type: LoadBalancer
|
||||
selector:
|
||||
app: ${APP_NAME}
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 80
|
||||
targetPort: 3000
|
||||
---
|
||||
# ===== LANGFUSE HPA - HORIZONTAL POD AUTOSCALER =====
|
||||
|
||||
apiVersion: autoscaling/v2
|
||||
kind: HorizontalPodAutoscaler
|
||||
metadata:
|
||||
name: ${APP_NAME}-hpa
|
||||
spec:
|
||||
scaleTargetRef:
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
name: ${APP_NAME}
|
||||
minReplicas: 2
|
||||
maxReplicas: 10
|
||||
metrics:
|
||||
- type: Resource
|
||||
resource:
|
||||
name: cpu
|
||||
target:
|
||||
type: Utilization
|
||||
averageUtilization: 70
|
||||
---
|
||||
# ===== WORKER - AUTOSCALER =====
|
||||
apiVersion: autoscaling/v2
|
||||
kind: HorizontalPodAutoscaler
|
||||
metadata:
|
||||
name: langfuse-worker-hpa
|
||||
spec:
|
||||
scaleTargetRef:
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
name: ${APP_NAME}-worker
|
||||
minReplicas: 2
|
||||
maxReplicas: 10
|
||||
metrics:
|
||||
- type: Resource
|
||||
resource:
|
||||
name: cpu
|
||||
target:
|
||||
type: Utilization
|
||||
averageUtilization: 70
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: ${APP_NAME}-lb
|
||||
namespace: ${K8S_NAMESPACE}
|
||||
annotations:
|
||||
service.beta.kubernetes.io/oci-load-balancer-shape: "flexible"
|
||||
oci.oraclecloud.com/healthcheck-path: "/api/public/health"
|
||||
spec:
|
||||
type: LoadBalancer
|
||||
selector:
|
||||
app: ${APP_NAME}
|
||||
ports:
|
||||
- port: 80
|
||||
targetPort: 3000
|
||||
81
src/mirror_images.sh
Normal file
81
src/mirror_images.sh
Normal file
@@ -0,0 +1,81 @@
|
||||
#!/bin/bash
|
||||
set -e
|
||||
|
||||
# =========================
|
||||
|
||||
# ⚙️ CONFIG
|
||||
|
||||
# =========================
|
||||
|
||||
export REGION="iad"
|
||||
export TENANCY_NAMESPACE="aaaaaaaaa"
|
||||
export REGISTRY="${REGION}.ocir.io/${TENANCY_NAMESPACE}"
|
||||
|
||||
# Tags fixas (produção)
|
||||
|
||||
export LANGFUSE_TAG="3.1.0"
|
||||
export CLICKHOUSE_TAG="23.8"
|
||||
export REDIS_TAG="7.2"
|
||||
export POSTGRES_TAG="15"
|
||||
|
||||
echo "🔐 Login no OCI Registry..."
|
||||
docker login ${REGION}.ocir.io
|
||||
|
||||
# =========================
|
||||
|
||||
# 🟢 LANGFUSE (API)
|
||||
|
||||
# =========================
|
||||
|
||||
echo "📦 Langfuse..."
|
||||
docker pull langfuse/langfuse:${LANGFUSE_TAG}
|
||||
docker tag langfuse/langfuse:${LANGFUSE_TAG} ${REGISTRY}/langfuse:${LANGFUSE_TAG}
|
||||
docker push ${REGISTRY}/langfuse:${LANGFUSE_TAG}
|
||||
|
||||
# =========================
|
||||
# 🟢 LANGFUSE WORKER
|
||||
# =========================
|
||||
|
||||
echo "📦 Langfuse Worker..."
|
||||
|
||||
docker pull langfuse/langfuse-worker:${LANGFUSE_TAG}
|
||||
|
||||
docker tag langfuse/langfuse-worker:${LANGFUSE_TAG} \
|
||||
${REGISTRY}/langfuse-worker:${LANGFUSE_TAG}
|
||||
|
||||
docker push ${REGISTRY}/langfuse-worker:${LANGFUSE_TAG}
|
||||
|
||||
# =========================
|
||||
|
||||
# 🟣 CLICKHOUSE
|
||||
|
||||
# =========================
|
||||
|
||||
echo "📦 ClickHouse..."
|
||||
docker pull clickhouse/clickhouse-server:${CLICKHOUSE_TAG}
|
||||
docker tag clickhouse/clickhouse-server:${CLICKHOUSE_TAG} ${REGISTRY}/clickhouse:${CLICKHOUSE_TAG}
|
||||
docker push ${REGISTRY}/clickhouse:${CLICKHOUSE_TAG}
|
||||
|
||||
# =========================
|
||||
|
||||
# 🔴 REDIS
|
||||
|
||||
# =========================
|
||||
|
||||
echo "📦 Redis..."
|
||||
docker pull redis:${REDIS_TAG}
|
||||
docker tag redis:${REDIS_TAG} ${REGISTRY}/redis:${REDIS_TAG}
|
||||
docker push ${REGISTRY}/redis:${REDIS_TAG}
|
||||
|
||||
# =========================
|
||||
|
||||
# 🟡 POSTGRES (OPCIONAL)
|
||||
|
||||
# =========================
|
||||
|
||||
echo "📦 Postgres..."
|
||||
docker pull postgres:${POSTGRES_TAG}
|
||||
docker tag postgres:${POSTGRES_TAG} ${REGISTRY}/postgres:${POSTGRES_TAG}
|
||||
docker push ${REGISTRY}/postgres:${POSTGRES_TAG}
|
||||
|
||||
echo "✅ Todas as imagens foram transferidas com sucesso!"
|
||||
236
src/set_var.sh
Normal file
236
src/set_var.sh
Normal file
@@ -0,0 +1,236 @@
|
||||
#!/bin/bash
|
||||
set -ex
|
||||
|
||||
echo "========================================"
|
||||
echo "🚀 INICIANDO DEPLOY LANGFUSE"
|
||||
echo "========================================"
|
||||
|
||||
# =========================
|
||||
|
||||
# 🔐 CONFIG SECRETS (OCIDs)
|
||||
|
||||
# =========================
|
||||
|
||||
echo ""
|
||||
echo "🔐 Etapa 1: Configurando OCIDs dos secrets..."
|
||||
|
||||
export OCI_SECRET_OCI_SECRET="ocid1.vaultsecret.oc1.iad.xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
|
||||
export OCI_SECRET_OCI_ACCESS="ocid1.vaultsecret.oc1.iad.xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
|
||||
|
||||
export OCI_SECRET_SALT="ocid1.vaultsecret.oc1.iad.xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
|
||||
export OCI_SECRET_ENCRYPTION="ocid1.vaultsecret.oc1.iad.xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
|
||||
export OCI_SECRET_NEXTAUTH="ocid1.vaultsecret.oc1.iad.xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
|
||||
|
||||
export OCI_SECRET_CLICKHOUSE="ocid1.vaultsecret.oc1.iad.xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
|
||||
export OCI_SECRET_REDIS="ocid1.vaultsecret.oc1.iad.xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
|
||||
export OCI_SECRET_DB="ocid1.vaultsecret.oc1.iad.xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
|
||||
|
||||
export OCI_NAMESPACE="xxxxxxxxxxx"
|
||||
|
||||
echo "✅ OCIDs carregados"
|
||||
|
||||
# =========================
|
||||
|
||||
# ⚙️ CONFIG OCI
|
||||
|
||||
# =========================
|
||||
|
||||
echo ""
|
||||
echo "⚙️ Etapa 2: Configuração OCI..."
|
||||
|
||||
export OCI_PROFILE=DEFAULT
|
||||
export OCI_REGION=us-ashburn-1
|
||||
|
||||
echo "✔️ Profile: $OCI_PROFILE"
|
||||
echo "✔️ Region: $OCI_REGION"
|
||||
|
||||
# =========================
|
||||
|
||||
# 📦 REGISTRY
|
||||
|
||||
# =========================
|
||||
|
||||
echo ""
|
||||
echo "📦 Etapa 3: Configurando registry..."
|
||||
|
||||
export REGION="iad"
|
||||
export TENANCY_NAMESPACE=${OCI_NAMESPACE}
|
||||
export REGISTRY="${REGION}.ocir.io/${TENANCY_NAMESPACE}"
|
||||
|
||||
echo "✔️ Registry: $REGISTRY"
|
||||
|
||||
# =========================
|
||||
|
||||
# 🧩 DEPLOY CONFIG
|
||||
|
||||
# =========================
|
||||
|
||||
echo ""
|
||||
echo "🧩 Etapa 4: Configuração do deploy..."
|
||||
|
||||
export APP_NAME="langfuse"
|
||||
export K8S_NAMESPACE="langfuse"
|
||||
|
||||
export IMAGE_REPOSITORY="${REGISTRY}"
|
||||
export IMAGE_TAG="3.1.0"
|
||||
|
||||
export CLICKHOUSE_TAG="23.8"
|
||||
export REDIS_TAG="7.2"
|
||||
export POSTGRES_TAG="15"
|
||||
|
||||
echo "✔️ App: $APP_NAME"
|
||||
echo "✔️ Namespace: $K8S_NAMESPACE"
|
||||
echo "✔️ Image: $IMAGE_REPOSITORY:$IMAGE_TAG"
|
||||
|
||||
# =========================
|
||||
|
||||
# 🌐 URL
|
||||
|
||||
# =========================
|
||||
|
||||
echo ""
|
||||
echo "🌐 Etapa 5: URL..."
|
||||
|
||||
export NEXTAUTH_URL="https://langfuse.seudominio.com"
|
||||
|
||||
echo "✔️ URL: $NEXTAUTH_URL"
|
||||
|
||||
# =========================
|
||||
|
||||
# 🔐 FUNÇÃO SECRET
|
||||
|
||||
# =========================
|
||||
|
||||
get_secret() {
|
||||
local secret_ocid=$1
|
||||
|
||||
echo "🔎 Buscando secret: $secret_ocid" >&2
|
||||
|
||||
oci secrets secret-bundle get \
|
||||
--secret-id "$secret_ocid" \
|
||||
--query 'data."secret-bundle-content".content' \
|
||||
--raw-output | base64 --decode
|
||||
}
|
||||
# =========================
|
||||
|
||||
# 🔥 CARREGAR SECRETS
|
||||
|
||||
# =========================
|
||||
|
||||
echo ""
|
||||
echo "🔐 Etapa 6: Carregando secrets do OCI..."
|
||||
|
||||
export DB_PASSWORD=$(get_secret "$OCI_SECRET_DB")
|
||||
export DATABASE_URL="postgresql://langfuse:${DB_PASSWORD}@${APP_NAME}-db:5432/langfuse"
|
||||
echo "✔️ DATABASE_URL carregado"
|
||||
|
||||
export REDIS_AUTH=$(get_secret "$OCI_SECRET_REDIS")
|
||||
echo "✔️ REDIS_AUTH carregado"
|
||||
|
||||
export CLICKHOUSE_PASSWORD=$(get_secret "$OCI_SECRET_CLICKHOUSE")
|
||||
echo "✔️ CLICKHOUSE_PASSWORD carregado"
|
||||
|
||||
export NEXTAUTH_SECRET=$(get_secret "$OCI_SECRET_NEXTAUTH")
|
||||
echo "✔️ NEXTAUTH_SECRET carregado"
|
||||
|
||||
|
||||
export ENCRYPTION_KEY=$(get_secret "$OCI_SECRET_ENCRYPTION" | tr -d '\r\n')
|
||||
|
||||
# Corrige automaticamente caso a key esteja inválida
|
||||
if ! [[ "$ENCRYPTION_KEY" =~ ^[a-fA-F0-9]{64}$ ]]; then
|
||||
echo "⚠️ ENCRYPTION_KEY inválida no Vault. Gerando automaticamente..."
|
||||
|
||||
ENCRYPTION_KEY=$(openssl rand -hex 32)
|
||||
|
||||
echo "🔐 Nova ENCRYPTION_KEY:"
|
||||
echo "$ENCRYPTION_KEY"
|
||||
fi
|
||||
|
||||
echo "✔️ ENCRYPTION_KEY carregado"
|
||||
|
||||
export SALT=$(get_secret "$OCI_SECRET_SALT")
|
||||
echo "✔️ SALT carregado"
|
||||
|
||||
# =========================
|
||||
|
||||
# ⚡ REDIS
|
||||
|
||||
# =========================
|
||||
|
||||
echo ""
|
||||
echo "⚡ Etapa 7: Config Redis..."
|
||||
|
||||
export REDIS_HOST="${APP_NAME}-redis"
|
||||
export REDIS_PORT="6379"
|
||||
|
||||
echo "✔️ Redis: $REDIS_HOST:$REDIS_PORT"
|
||||
|
||||
# =========================
|
||||
|
||||
# 📊 CLICKHOUSE
|
||||
|
||||
# =========================
|
||||
|
||||
echo ""
|
||||
echo "📊 Etapa 8: Config ClickHouse..."
|
||||
|
||||
export CLICKHOUSE_URL="http://${APP_NAME}-clickhouse:8123"
|
||||
export CLICKHOUSE_USER="default"
|
||||
export CLICKHOUSE_MIGRATION_URL="clickhouse://${APP_NAME}-clickhouse:9000"
|
||||
export CLICKHOUSE_CLUSTER_ENABLED="false"
|
||||
|
||||
echo "✔️ ClickHouse: $CLICKHOUSE_URL"
|
||||
|
||||
# =========================
|
||||
|
||||
# ☁️ OBJECT STORAGE
|
||||
|
||||
# =========================
|
||||
|
||||
echo ""
|
||||
echo "☁️ Etapa 9: Config OCI Object Storage..."
|
||||
|
||||
export LANGFUSE_S3_EVENT_UPLOAD_BUCKET="langfuse-events"
|
||||
export LANGFUSE_S3_EVENT_UPLOAD_REGION="${OCI_REGION}"
|
||||
export LANGFUSE_S3_EVENT_UPLOAD_ENDPOINT="https://${OCI_NAMESPACE}.compat.objectstorage.${OCI_REGION}.oraclecloud.com"
|
||||
export LANGFUSE_USE_OCI_NATIVE_OBJECT_STORAGE="true"
|
||||
echo "✔️ Bucket eventos: $LANGFUSE_S3_EVENT_UPLOAD_BUCKET"
|
||||
|
||||
# =========================
|
||||
|
||||
# 🚀 DEPLOY
|
||||
|
||||
# =========================
|
||||
|
||||
echo ""
|
||||
echo "🚀 Etapa 10: Aplicando Kubernetes..."
|
||||
|
||||
echo "📄 Preview YAML (primeiras linhas):"
|
||||
envsubst < langfuse_dest.yaml | head -n 20
|
||||
|
||||
echo ""
|
||||
echo "📦 Aplicando..."
|
||||
|
||||
echo ""
|
||||
echo "📄 Gerando YAML final..."
|
||||
|
||||
envsubst < langfuse_dest.yaml > final.yaml
|
||||
|
||||
echo ""
|
||||
echo "📄 Preview:"
|
||||
head -n 20 final.yaml
|
||||
|
||||
echo ""
|
||||
echo "🔍 Validando YAML..."
|
||||
|
||||
kubectl apply --dry-run=client -f final.yaml
|
||||
|
||||
echo ""
|
||||
echo "📦 Aplicando..."
|
||||
|
||||
# kubectl apply -f final.yaml
|
||||
|
||||
echo ""
|
||||
echo "========================================"
|
||||
echo "🎯 DEPLOY FINALIZADO COM SUCESSO!"
|
||||
echo "========================================"
|
||||
81
src/update_secret.sh
Normal file
81
src/update_secret.sh
Normal file
@@ -0,0 +1,81 @@
|
||||
#!/bin/bash
|
||||
set -ex
|
||||
|
||||
echo "🔐 Atualizando secrets no OCI Vault..."
|
||||
|
||||
# =========================
|
||||
# ⚙️ CONFIG
|
||||
# =========================
|
||||
|
||||
export OCI_SECRET_OCI_SECRET="ocid1.vaultsecret.oc1.iad.xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
|
||||
export OCI_SECRET_OCI_ACCESS="ocid1.vaultsecret.oc1.iad.xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
|
||||
|
||||
export OCI_SECRET_SALT="ocid1.vaultsecret.oc1.iad.xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
|
||||
export OCI_SECRET_ENCRYPTION="ocid1.vaultsecret.oc1.iad.xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
|
||||
export OCI_SECRET_NEXTAUTH="ocid1.vaultsecret.oc1.iad.xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
|
||||
|
||||
export OCI_SECRET_CLICKHOUSE="ocid1.vaultsecret.oc1.iad.xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
|
||||
export OCI_SECRET_REDIS="ocid1.vaultsecret.oc1.iad.xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
|
||||
export OCI_SECRET_DB="ocid1.vaultsecret.oc1.iad.xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
|
||||
|
||||
# =========================
|
||||
# 🔑 VALORES
|
||||
# =========================
|
||||
|
||||
DB_PASSWORD="langfuse123"
|
||||
|
||||
REDIS_PASSWORD="redis123"
|
||||
|
||||
CLICKHOUSE_PASSWORD="clickhouse123"
|
||||
|
||||
NEXTAUTH_SECRET_VALUE="nextauth-secret-123"
|
||||
|
||||
SALT_VALUE="salt-secret-123"
|
||||
|
||||
# ⚠️ OBRIGATÓRIO:
|
||||
# 64 chars hex / 256 bits
|
||||
ENCRYPTION_KEY=$(openssl rand -hex 32)
|
||||
|
||||
echo "🔐 ENCRYPTION_KEY gerada:"
|
||||
echo "$ENCRYPTION_KEY"
|
||||
|
||||
# =========================
|
||||
# 🔧 FUNÇÃO UPDATE
|
||||
# =========================
|
||||
|
||||
update_secret() {
|
||||
|
||||
local secret_ocid=$1
|
||||
local value=$2
|
||||
|
||||
echo "🔄 Atualizando secret: $secret_ocid"
|
||||
|
||||
local base64_value
|
||||
base64_value=$(printf "%s" "$value" | base64 | tr -d '\n')
|
||||
|
||||
oci vault secret update-base64 \
|
||||
--secret-id "$secret_ocid" \
|
||||
--secret-content-content "$base64_value"
|
||||
}
|
||||
|
||||
# =========================
|
||||
# 🔥 UPDATE
|
||||
# =========================
|
||||
|
||||
update_secret "$OCI_SECRET_DB" "$DB_PASSWORD"
|
||||
|
||||
update_secret "$OCI_SECRET_REDIS" "$REDIS_PASSWORD"
|
||||
|
||||
update_secret "$OCI_SECRET_CLICKHOUSE" "$CLICKHOUSE_PASSWORD"
|
||||
|
||||
update_secret "$OCI_SECRET_NEXTAUTH" "$NEXTAUTH_SECRET_VALUE"
|
||||
|
||||
update_secret "$OCI_SECRET_ENCRYPTION" "$ENCRYPTION_KEY"
|
||||
|
||||
update_secret "$OCI_SECRET_SALT" "$SALT_VALUE"
|
||||
|
||||
echo ""
|
||||
echo "✅ Secrets atualizados com sucesso!"
|
||||
echo ""
|
||||
echo "👉 ENCRYPTION_KEY usada:"
|
||||
echo "$ENCRYPTION_KEY"
|
||||
Reference in New Issue
Block a user