deployment-update

.env_local

@@ -0,0 +1,118 @@
+# Safe defaults: nothing is written until DRY_RUN=false.
+DRY_RUN=false
+LOG_LEVEL=info
+HTTP_ADDR=:7080
+DATA_DIR=/app/data
+
+# Dashboard auth (required unless WEB_ALLOW_ANONYMOUS=true)
+WEB_USERNAME=admin
+WEB_PASSWORD=adminadminadmin
+WEB_ALLOW_ANONYMOUS=false
+KNOWLEDGE_WEB_EDIT_ENABLED=true
+
+# Optional GLPI webhook authentication.
+# Configure GLPI to send the same secret as X-Webhook-Secret if your webhook supports custom headers.
+WEBHOOK_SECRET=662fbeeff3fff7d204c75ef1ffd53704d5312be8169a13484c2fd4af169d729c
+
+# GLPI 11 High-Level API / OAuth2 password grant
+GLPI_URL=https://glpi-test.hilden.de
+GLPI_API_VERSION=v2.3
+GLPI_CLIENT_ID=662fbeeff3fff7d204c75ef1ffd53704d5312be8169a13484c2fd4af169d729c
+GLPI_CLIENT_SECRET=8e380c592ce13527606f1fa81e01169d06b43be5ae975cb5e3b7de02e401932b
+GLPI_USERNAME=ai
+GLPI_PASSWORD=adminadminadmin
+# Required before AUTO_REPLY=true; numeric GLPI user id of svc-ai-agent.
+GLPI_AGENT_USER_ID=26
+# Keep false in production. Only useful for local test GLPI instances over plain HTTP.
+GLPI_ALLOW_INSECURE_HTTP=false
+# Fail-closed processing whitelist. GLPI status 1 is "New"; add more IDs only deliberately.
+GLPI_ALLOWED_STATUS_IDS=1
+GLPI_POLL_INTERVAL=30s
+GLPI_POLL_LIMIT=50
+# Optional server-side optimization; the agent still enforces GLPI_ALLOWED_STATUS_IDS itself.
+# Verify filter syntax against /api.php/doc on your instance when changing it.
+GLPI_TICKET_FILTER=status.id==1
+GLPI_TIMEOUT=20s
+
+# Ollama
+#OLLAMA_URL=http://ollama:11434
+OLLAMA_URL=http://10.10.11.123:11434
+OLLAMA_MODEL=qwen3:8b
+OLLAMA_EMBEDDING_MODEL=embeddinggemma
+OLLAMA_TIMEOUT=10m
+OLLAMA_NUM_PREDICT=768
+OLLAMA_JSON_RETRIES=1
+OLLAMA_KEEP_ALIVE=10m
+OLLAMA_THINK=false
+OLLAMA_MAX_CONCURRENT=1
+
+# RAG / Knowledge
+KNOWLEDGE_DIR=/app/knowledge
+RAG_ENABLED=true
+KNOWLEDGE_TOP_K=3
+KNOWLEDGE_MIN_SCORE=0.88
+CATEGORY_PROMPT_LIMIT=80
+# Fail-closed source policy. Only documents carrying one of these source labels are indexed/searched.
+KNOWLEDGE_ALLOWED_SOURCES=internal-kb,glpi-kb,runbook,vendor-docs,resolved-tickets
+# Must be a subset of KNOWLEDGE_ALLOWED_SOURCES. Set to "none" to disable source-based auto-replies.
+KNOWLEDGE_AUTO_REPLY_SOURCES=internal-kb,glpi-kb,runbook
+
+# Communication policy for end-user replies. Auto-reply KB documents must carry matching metadata.
+COMMUNICATION_LANGUAGE=de-DE
+COMMUNICATION_STYLE=formal
+COMMUNICATION_SALUTATION=Guten Tag,
+COMMUNICATION_CLOSING=Mit freundlichen Grüßen
+COMMUNICATION_SIGNATURE=IT-Service
+
+
+# Read-only operational context. These sources never receive write access.
+CONTEXT_ENABLED=true
+CONTEXT_TIMEOUT=12s
+# Minimum deterministic token-overlap score for an incident/outage to be treated as relevant to a ticket.
+CONTEXT_RELEVANCE_MIN_SCORE=0.20
+# Safe defaults: missing context or a relevant central incident suppresses automatic end-user replies.
+CONTEXT_BLOCK_AUTO_REPLY_ON_ERRORS=true
+CONTEXT_BLOCK_AUTO_REPLY_ON_INCIDENT=true
+
+# GLPI Change Calendar. The route is checked against /api.php/doc.json at startup.
+CHANGE_CALENDAR_ENABLED=true
+GLPI_CHANGE_PATH=/Assistance/Change
+GLPI_CHANGE_FILTER=
+GLPI_CHANGE_LIMIT=100
+CHANGE_LOOKBACK=72h
+CHANGE_LOOKAHEAD=24h
+
+# Active Major Incidents are modeled as GLPI Tickets selected by YOUR explicit filter.
+# Enable only after validating the filter against your GLPI /api.php/doc / getting-started docs.
+MAJOR_INCIDENTS_ENABLED=false
+GLPI_MAJOR_INCIDENT_FILTER=
+GLPI_MAJOR_INCIDENT_LIMIT=20
+
+# Requester -> device context. Direct ticket-linked items are always reused; this optional lookup
+# additionally searches assigned assets for each requester extracted from the ticket response.
+USER_DEVICE_CONTEXT_ENABLED=true
+GLPI_USER_DEVICE_PATHS=/Assets/Computer
+GLPI_USER_DEVICE_FILTER_TEMPLATE=user.id=={{user_id}}
+GLPI_USER_DEVICE_LIMIT=20
+
+# Uptime Kuma (read-only). Recommended for internal systems: authenticated Prometheus /metrics.
+UPTIME_KUMA_ENABLED=false
+UPTIME_KUMA_URL=https://uptime.example.org
+# metrics | status_page
+UPTIME_KUMA_MODE=metrics
+# Required in metrics mode. Uptime Kuma uses the API key as the HTTP Basic Auth password.
+UPTIME_KUMA_API_KEY=CHANGE_ME
+# Required only in status_page mode; comma-separated published Status Page slugs.
+UPTIME_KUMA_STATUS_PAGES=it-services
+UPTIME_KUMA_TIMEOUT=10s
+UPTIME_KUMA_MAX_ISSUES=20
+UPTIME_KUMA_INCLUDE_MAINTENANCE=true
+
+# Policy gates
+AUTO_CATEGORY=true
+AUTO_REPLY=true
+CATEGORY_CONFIDENCE=0.90
+REPLY_CONFIDENCE=0.97
+
+QUEUE_SIZE=256
+WORKERS=2

compose_local.yml

@@ -0,0 +1,43 @@
+services:
+  agent-data-init:
+    image: alpine:3.22
+    user: 0:0
+    command:
+      - sh
+      - -c
+      - |
+        mkdir -p /app/data
+        chown -R 65532:65532 /app/data
+    volumes:
+      - agent-data:/app/data
+    restart: no
+  agent:
+    image: git.send.nrw/sendnrw/glpi-ai-agent:latest
+    restart: unless-stopped
+    env_file: .env
+    ports:
+      - 7080:7080
+    volumes:
+      - agent-data:/app/data
+      - ./knowledge:/app/knowledge:ro
+    depends_on:
+      ollama:
+        condition: service_started
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+    read_only: true
+    tmpfs:
+      - /tmp:size=64m,mode=1777
+  ollama:
+    image: ollama/ollama:latest
+    restart: unless-stopped
+    volumes:
+      - ollama-data:/root/.ollama
+    # GPU users can add the appropriate device/runtime stanza for their platform.
+
+volumes:
+  agent-data: null
+  ollama-data: null
+networks: {}

docker-compose.yml

@@ -1,19 +1,16 @@
 services:
   agent-data-init:
-    build:
-      context: .
-      target: data-init
-    restart: "no"
-    user: "0:0"
+    image: alpine:3.22
+    user: 0:0
+    command:
+      - sh
+      - -c
+      - |
+        mkdir -p /app/data
+        chown -R 65532:65532 /app/data
     volumes:
       - agent-data:/app/data
-    security_opt:
-      - no-new-privileges:true
-    cap_drop:
-      - ALL
-    cap_add:
-      - CHOWN
-      - FOWNER
+    restart: no
 
   agent:
     build: .