From 8ac1f97174e396e769fb2311dc34ccadade4b911 Mon Sep 17 00:00:00 2001 From: jbergner Date: Tue, 28 Jul 2026 05:42:22 +0200 Subject: [PATCH] deployment-update --- .env_local | 118 +++++++++++++++++++++++++++++++++++++++++++++ compose_local.yml | 43 +++++++++++++++++ docker-compose.yml | 21 ++++---- 3 files changed, 170 insertions(+), 12 deletions(-) create mode 100644 .env_local create mode 100644 compose_local.yml diff --git a/.env_local b/.env_local new file mode 100644 index 0000000..85b9663 --- /dev/null +++ b/.env_local @@ -0,0 +1,118 @@ +# Safe defaults: nothing is written until DRY_RUN=false. +DRY_RUN=false +LOG_LEVEL=info +HTTP_ADDR=:7080 +DATA_DIR=/app/data + +# Dashboard auth (required unless WEB_ALLOW_ANONYMOUS=true) +WEB_USERNAME=admin +WEB_PASSWORD=adminadminadmin +WEB_ALLOW_ANONYMOUS=false +KNOWLEDGE_WEB_EDIT_ENABLED=true + +# Optional GLPI webhook authentication. +# Configure GLPI to send the same secret as X-Webhook-Secret if your webhook supports custom headers. +WEBHOOK_SECRET=662fbeeff3fff7d204c75ef1ffd53704d5312be8169a13484c2fd4af169d729c + +# GLPI 11 High-Level API / OAuth2 password grant +GLPI_URL=https://glpi-test.hilden.de +GLPI_API_VERSION=v2.3 +GLPI_CLIENT_ID=662fbeeff3fff7d204c75ef1ffd53704d5312be8169a13484c2fd4af169d729c +GLPI_CLIENT_SECRET=8e380c592ce13527606f1fa81e01169d06b43be5ae975cb5e3b7de02e401932b +GLPI_USERNAME=ai +GLPI_PASSWORD=adminadminadmin +# Required before AUTO_REPLY=true; numeric GLPI user id of svc-ai-agent. +GLPI_AGENT_USER_ID=26 +# Keep false in production. Only useful for local test GLPI instances over plain HTTP. +GLPI_ALLOW_INSECURE_HTTP=false +# Fail-closed processing whitelist. GLPI status 1 is "New"; add more IDs only deliberately. +GLPI_ALLOWED_STATUS_IDS=1 +GLPI_POLL_INTERVAL=30s +GLPI_POLL_LIMIT=50 +# Optional server-side optimization; the agent still enforces GLPI_ALLOWED_STATUS_IDS itself. +# Verify filter syntax against /api.php/doc on your instance when changing it. +GLPI_TICKET_FILTER=status.id==1 +GLPI_TIMEOUT=20s + +# Ollama +#OLLAMA_URL=http://ollama:11434 +OLLAMA_URL=http://10.10.11.123:11434 +OLLAMA_MODEL=qwen3:8b +OLLAMA_EMBEDDING_MODEL=embeddinggemma +OLLAMA_TIMEOUT=10m +OLLAMA_NUM_PREDICT=768 +OLLAMA_JSON_RETRIES=1 +OLLAMA_KEEP_ALIVE=10m +OLLAMA_THINK=false +OLLAMA_MAX_CONCURRENT=1 + +# RAG / Knowledge +KNOWLEDGE_DIR=/app/knowledge +RAG_ENABLED=true +KNOWLEDGE_TOP_K=3 +KNOWLEDGE_MIN_SCORE=0.88 +CATEGORY_PROMPT_LIMIT=80 +# Fail-closed source policy. Only documents carrying one of these source labels are indexed/searched. +KNOWLEDGE_ALLOWED_SOURCES=internal-kb,glpi-kb,runbook,vendor-docs,resolved-tickets +# Must be a subset of KNOWLEDGE_ALLOWED_SOURCES. Set to "none" to disable source-based auto-replies. +KNOWLEDGE_AUTO_REPLY_SOURCES=internal-kb,glpi-kb,runbook + +# Communication policy for end-user replies. Auto-reply KB documents must carry matching metadata. +COMMUNICATION_LANGUAGE=de-DE +COMMUNICATION_STYLE=formal +COMMUNICATION_SALUTATION=Guten Tag, +COMMUNICATION_CLOSING=Mit freundlichen Grüßen +COMMUNICATION_SIGNATURE=IT-Service + + +# Read-only operational context. These sources never receive write access. +CONTEXT_ENABLED=true +CONTEXT_TIMEOUT=12s +# Minimum deterministic token-overlap score for an incident/outage to be treated as relevant to a ticket. +CONTEXT_RELEVANCE_MIN_SCORE=0.20 +# Safe defaults: missing context or a relevant central incident suppresses automatic end-user replies. +CONTEXT_BLOCK_AUTO_REPLY_ON_ERRORS=true +CONTEXT_BLOCK_AUTO_REPLY_ON_INCIDENT=true + +# GLPI Change Calendar. The route is checked against /api.php/doc.json at startup. +CHANGE_CALENDAR_ENABLED=true +GLPI_CHANGE_PATH=/Assistance/Change +GLPI_CHANGE_FILTER= +GLPI_CHANGE_LIMIT=100 +CHANGE_LOOKBACK=72h +CHANGE_LOOKAHEAD=24h + +# Active Major Incidents are modeled as GLPI Tickets selected by YOUR explicit filter. +# Enable only after validating the filter against your GLPI /api.php/doc / getting-started docs. +MAJOR_INCIDENTS_ENABLED=false +GLPI_MAJOR_INCIDENT_FILTER= +GLPI_MAJOR_INCIDENT_LIMIT=20 + +# Requester -> device context. Direct ticket-linked items are always reused; this optional lookup +# additionally searches assigned assets for each requester extracted from the ticket response. +USER_DEVICE_CONTEXT_ENABLED=true +GLPI_USER_DEVICE_PATHS=/Assets/Computer +GLPI_USER_DEVICE_FILTER_TEMPLATE=user.id=={{user_id}} +GLPI_USER_DEVICE_LIMIT=20 + +# Uptime Kuma (read-only). Recommended for internal systems: authenticated Prometheus /metrics. +UPTIME_KUMA_ENABLED=false +UPTIME_KUMA_URL=https://uptime.example.org +# metrics | status_page +UPTIME_KUMA_MODE=metrics +# Required in metrics mode. Uptime Kuma uses the API key as the HTTP Basic Auth password. +UPTIME_KUMA_API_KEY=CHANGE_ME +# Required only in status_page mode; comma-separated published Status Page slugs. +UPTIME_KUMA_STATUS_PAGES=it-services +UPTIME_KUMA_TIMEOUT=10s +UPTIME_KUMA_MAX_ISSUES=20 +UPTIME_KUMA_INCLUDE_MAINTENANCE=true + +# Policy gates +AUTO_CATEGORY=true +AUTO_REPLY=true +CATEGORY_CONFIDENCE=0.90 +REPLY_CONFIDENCE=0.97 + +QUEUE_SIZE=256 +WORKERS=2 diff --git a/compose_local.yml b/compose_local.yml new file mode 100644 index 0000000..56948ff --- /dev/null +++ b/compose_local.yml @@ -0,0 +1,43 @@ +services: + agent-data-init: + image: alpine:3.22 + user: 0:0 + command: + - sh + - -c + - | + mkdir -p /app/data + chown -R 65532:65532 /app/data + volumes: + - agent-data:/app/data + restart: no + agent: + image: git.send.nrw/sendnrw/glpi-ai-agent:latest + restart: unless-stopped + env_file: .env + ports: + - 7080:7080 + volumes: + - agent-data:/app/data + - ./knowledge:/app/knowledge:ro + depends_on: + ollama: + condition: service_started + security_opt: + - no-new-privileges:true + cap_drop: + - ALL + read_only: true + tmpfs: + - /tmp:size=64m,mode=1777 + ollama: + image: ollama/ollama:latest + restart: unless-stopped + volumes: + - ollama-data:/root/.ollama + # GPU users can add the appropriate device/runtime stanza for their platform. + +volumes: + agent-data: null + ollama-data: null +networks: {} diff --git a/docker-compose.yml b/docker-compose.yml index 6223562..c1d2c0a 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -1,19 +1,16 @@ services: agent-data-init: - build: - context: . - target: data-init - restart: "no" - user: "0:0" + image: alpine:3.22 + user: 0:0 + command: + - sh + - -c + - | + mkdir -p /app/data + chown -R 65532:65532 /app/data volumes: - agent-data:/app/data - security_opt: - - no-new-privileges:true - cap_drop: - - ALL - cap_add: - - CHOWN - - FOWNER + restart: no agent: build: .