AdrianoDev
a1110c8ecb
#2 Env switch safety: - mcp_common/environment.py: nuova consistency_check() che previene switch accidentali a mainnet. Solleva EnvironmentMismatchError se resolved=mainnet senza creds["environment"]="mainnet" esplicito, o se declared/resolved mismatch. Override via STRICT_MAINNET=false. - Wirato in app_factory.run_exchange_main al boot. - 6 nuovi test consistency. #3 Audit log persistence: - mcp_common/audit.py: TimedRotatingFileHandler aggiuntivo se env AUDIT_LOG_FILE settato. Rotation midnight UTC, retention 30gg default (AUDIT_LOG_BACKUP_DAYS). Format JSONL con SecretsFilter. - docker-compose.prod.yml: bind mount /var/log/cerbero-mcp + env AUDIT_LOG_FILE per i 4 servizi exchange (write endpoints). - 2 nuovi test file sink. #1 Deploy script: - scripts/deploy.sh: idempotente, fa docker login + clone/pull repo + copia secrets chmod 600 + crea .env + setup audit dir + pull image + up + smoke test pubblico HTTPS. - DEPLOYMENT.md aggiornato: sezioni 2 (script), 3 (safety mainnet), 4 (audit log query), renumber sezioni successive. Test: 488/488 verdi. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
206 lines
7.0 KiB
YAML
206 lines
7.0 KiB
YAML
# docker-compose.prod.yml — deploy su VPS produzione.
|
|
#
|
|
# Differenze vs docker-compose.yml (dev):
|
|
# - Niente `build:`, solo `image:` dal registry Gitea.
|
|
# - Tag `latest` (Watchtower polla per nuove versioni).
|
|
# - Aggiunge servizio `watchtower` che auto-aggiorna i container etichettati
|
|
# `com.centurylinklabs.watchtower.enable=true` quando il tag latest cambia.
|
|
# - Auth registry: `docker login git.tielogic.xyz` una sola volta sull'host
|
|
# (Watchtower legge ~/.docker/config.json bind-mounted in /config.json).
|
|
#
|
|
# Uso sul VPS:
|
|
# docker login git.tielogic.xyz
|
|
# docker compose -f docker-compose.prod.yml --env-file .env up -d
|
|
#
|
|
# Override variabili in `.env` accanto al compose:
|
|
# ACME_EMAIL=adrianodalpastro@tielogic.com
|
|
# WRITE_ALLOWLIST="127.0.0.1/32 ::1/128 172.16.0.0/12"
|
|
# GATEWAY_HTTP_PORT=80
|
|
# GATEWAY_HTTPS_PORT=443
|
|
# IMAGE_TAG=latest # o sha-XXXXXXX per pin specifico
|
|
|
|
networks:
|
|
internal:
|
|
driver: bridge
|
|
|
|
volumes:
|
|
caddy-data:
|
|
caddy-config:
|
|
|
|
secrets:
|
|
deribit_credentials:
|
|
file: ./secrets/deribit.json
|
|
hyperliquid_wallet:
|
|
file: ./secrets/hyperliquid.json
|
|
bybit_credentials:
|
|
file: ./secrets/bybit.json
|
|
alpaca_credentials:
|
|
file: ./secrets/alpaca.json
|
|
macro_credentials:
|
|
file: ./secrets/macro.json
|
|
sentiment_credentials:
|
|
file: ./secrets/sentiment.json
|
|
core_token:
|
|
file: ./secrets/core.token
|
|
observer_token:
|
|
file: ./secrets/observer.token
|
|
|
|
x-common-security: &common-security
|
|
cap_drop: [ALL]
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
restart: unless-stopped
|
|
networks: [internal]
|
|
labels:
|
|
com.centurylinklabs.watchtower.enable: "true"
|
|
volumes:
|
|
- ${AUDIT_LOG_DIR:-/var/log/cerbero-mcp}:/var/log/cerbero-mcp:rw
|
|
|
|
x-image-prefix: &image_prefix git.tielogic.xyz/adriano/cerbero-mcp
|
|
|
|
services:
|
|
gateway:
|
|
image: ${IMAGE_PREFIX:-git.tielogic.xyz/adriano/cerbero-mcp}/gateway:${IMAGE_TAG:-latest}
|
|
restart: unless-stopped
|
|
networks: [internal]
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
labels:
|
|
com.centurylinklabs.watchtower.enable: "true"
|
|
ports:
|
|
- "${GATEWAY_HTTP_PORT:-80}:80"
|
|
- "${GATEWAY_HTTPS_PORT:-443}:443"
|
|
environment:
|
|
ACME_EMAIL: ${ACME_EMAIL:-adrianodalpastro@tielogic.com}
|
|
WRITE_ALLOWLIST: ${WRITE_ALLOWLIST:-127.0.0.1/32 ::1/128 172.16.0.0/12}
|
|
volumes:
|
|
- ./gateway/Caddyfile:/etc/caddy/Caddyfile:ro
|
|
- ./gateway/public:/srv:ro
|
|
- caddy-data:/data
|
|
- caddy-config:/config
|
|
depends_on:
|
|
mcp-deribit: { condition: service_healthy }
|
|
mcp-hyperliquid: { condition: service_healthy }
|
|
mcp-bybit: { condition: service_healthy }
|
|
mcp-alpaca: { condition: service_healthy }
|
|
mcp-macro: { condition: service_healthy }
|
|
mcp-sentiment: { condition: service_healthy }
|
|
healthcheck:
|
|
test: ["CMD", "wget", "-q", "--spider", "http://localhost/"]
|
|
interval: 30s
|
|
timeout: 5s
|
|
retries: 3
|
|
|
|
mcp-deribit:
|
|
image: ${IMAGE_PREFIX:-git.tielogic.xyz/adriano/cerbero-mcp}/mcp-deribit:${IMAGE_TAG:-latest}
|
|
<<: *common-security
|
|
user: "1000:1000"
|
|
read_only: true
|
|
tmpfs:
|
|
- /tmp:rw,size=64M,mode=1777
|
|
secrets: [deribit_credentials, core_token, observer_token]
|
|
environment:
|
|
CREDENTIALS_FILE: /run/secrets/deribit_credentials
|
|
CORE_TOKEN_FILE: /run/secrets/core_token
|
|
OBSERVER_TOKEN_FILE: /run/secrets/observer_token
|
|
DERIBIT_TESTNET: "${DERIBIT_TESTNET:-true}"
|
|
ROOT_PATH: /mcp-deribit
|
|
AUDIT_LOG_FILE: /var/log/cerbero-mcp/deribit.audit.jsonl
|
|
|
|
mcp-hyperliquid:
|
|
image: ${IMAGE_PREFIX:-git.tielogic.xyz/adriano/cerbero-mcp}/mcp-hyperliquid:${IMAGE_TAG:-latest}
|
|
<<: *common-security
|
|
user: "1000:1000"
|
|
read_only: true
|
|
tmpfs:
|
|
- /tmp:rw,size=64M,mode=1777
|
|
secrets: [hyperliquid_wallet, core_token, observer_token]
|
|
environment:
|
|
HYPERLIQUID_WALLET_FILE: /run/secrets/hyperliquid_wallet
|
|
CORE_TOKEN_FILE: /run/secrets/core_token
|
|
OBSERVER_TOKEN_FILE: /run/secrets/observer_token
|
|
HYPERLIQUID_TESTNET: "${HYPERLIQUID_TESTNET:-true}"
|
|
ROOT_PATH: /mcp-hyperliquid
|
|
AUDIT_LOG_FILE: /var/log/cerbero-mcp/hyperliquid.audit.jsonl
|
|
|
|
mcp-bybit:
|
|
image: ${IMAGE_PREFIX:-git.tielogic.xyz/adriano/cerbero-mcp}/mcp-bybit:${IMAGE_TAG:-latest}
|
|
<<: *common-security
|
|
user: "1000:1000"
|
|
read_only: true
|
|
tmpfs:
|
|
- /tmp:rw,size=64M,mode=1777
|
|
secrets: [bybit_credentials, core_token, observer_token]
|
|
environment:
|
|
BYBIT_CREDENTIALS_FILE: /run/secrets/bybit_credentials
|
|
CORE_TOKEN_FILE: /run/secrets/core_token
|
|
OBSERVER_TOKEN_FILE: /run/secrets/observer_token
|
|
BYBIT_TESTNET: "${BYBIT_TESTNET:-true}"
|
|
ROOT_PATH: /mcp-bybit
|
|
AUDIT_LOG_FILE: /var/log/cerbero-mcp/bybit.audit.jsonl
|
|
PORT: "9019"
|
|
|
|
mcp-alpaca:
|
|
image: ${IMAGE_PREFIX:-git.tielogic.xyz/adriano/cerbero-mcp}/mcp-alpaca:${IMAGE_TAG:-latest}
|
|
<<: *common-security
|
|
user: "1000:1000"
|
|
read_only: true
|
|
tmpfs:
|
|
- /tmp:rw,size=64M,mode=1777
|
|
secrets: [alpaca_credentials, core_token, observer_token]
|
|
environment:
|
|
ALPACA_CREDENTIALS_FILE: /run/secrets/alpaca_credentials
|
|
CORE_TOKEN_FILE: /run/secrets/core_token
|
|
OBSERVER_TOKEN_FILE: /run/secrets/observer_token
|
|
ALPACA_PAPER: "${ALPACA_PAPER:-true}"
|
|
ROOT_PATH: /mcp-alpaca
|
|
AUDIT_LOG_FILE: /var/log/cerbero-mcp/alpaca.audit.jsonl
|
|
PORT: "9020"
|
|
|
|
mcp-macro:
|
|
image: ${IMAGE_PREFIX:-git.tielogic.xyz/adriano/cerbero-mcp}/mcp-macro:${IMAGE_TAG:-latest}
|
|
<<: *common-security
|
|
user: "1000:1000"
|
|
read_only: true
|
|
tmpfs:
|
|
- /tmp:rw,size=64M,mode=1777
|
|
secrets: [macro_credentials, core_token, observer_token]
|
|
environment:
|
|
MACRO_CREDENTIALS_FILE: /run/secrets/macro_credentials
|
|
CORE_TOKEN_FILE: /run/secrets/core_token
|
|
OBSERVER_TOKEN_FILE: /run/secrets/observer_token
|
|
ROOT_PATH: /mcp-macro
|
|
|
|
mcp-sentiment:
|
|
image: ${IMAGE_PREFIX:-git.tielogic.xyz/adriano/cerbero-mcp}/mcp-sentiment:${IMAGE_TAG:-latest}
|
|
<<: *common-security
|
|
user: "1000:1000"
|
|
read_only: true
|
|
tmpfs:
|
|
- /tmp:rw,size=64M,mode=1777
|
|
secrets: [sentiment_credentials, core_token, observer_token]
|
|
environment:
|
|
SENTIMENT_CREDENTIALS_FILE: /run/secrets/sentiment_credentials
|
|
CORE_TOKEN_FILE: /run/secrets/core_token
|
|
OBSERVER_TOKEN_FILE: /run/secrets/observer_token
|
|
ROOT_PATH: /mcp-sentiment
|
|
|
|
# ========================================================
|
|
# WATCHTOWER — auto-update container con label enable=true
|
|
# ========================================================
|
|
watchtower:
|
|
image: containrrr/watchtower:latest
|
|
restart: unless-stopped
|
|
networks: [internal]
|
|
volumes:
|
|
- /var/run/docker.sock:/var/run/docker.sock
|
|
- ${HOME}/.docker/config.json:/config.json:ro
|
|
environment:
|
|
WATCHTOWER_LABEL_ENABLE: "true"
|
|
WATCHTOWER_CLEANUP: "true"
|
|
WATCHTOWER_POLL_INTERVAL: "${WATCHTOWER_POLL_INTERVAL:-300}"
|
|
WATCHTOWER_INCLUDE_RESTARTING: "false"
|
|
WATCHTOWER_NOTIFICATIONS_LEVEL: info
|
|
WATCHTOWER_LOG_LEVEL: info
|
|
command: --interval ${WATCHTOWER_POLL_INTERVAL:-300}
|