Ubuntu
a668e1fca1
Backend (controller/heicode_agnet_session.go): - Add HEICODE_ROOT_EMAILS / HEICODE_ADMIN_EMAILS whitelists for JIT role assignment. Manager no longer trusts Agnet's role claim — admin / root is granted only by local config. - Default JIT-synced users to RoleCommonUser. - Promote-only role sync on every login (never demote). Frontend auth fixes: - login() no longer hard-codes id=1; preserves the real manager user id returned by /api/user/session/from-agnet so the New-Api-User header matches the cookie session. - After login, prefer local /api/user/self over Agnet /me so role / status reflect actual manager state (e.g. whitelist promotion). - lib/api.ts: scope 401 -> "Session expired" handling to identity endpoints only; admin-only 401 no longer resets the session. UI restructuring: - Default sidebar shows only Code delivery + Console + Personal, plus a single "System settings" entry for ROLE.ADMIN+. - system-settings workspace now hosts the full Tenant administration tree (Channels / Models / Subscriptions / Redemption codes / Tenants / Templates / Agents / Vendors / All usage logs) for ROLE.ADMIN+, with System Administration sub-tree gated to ROLE.SUPER_ADMIN. - Workspace switch triggers on admin paths (channels, users, templates, agents, subscriptions, models, redemption-codes) — not only /system-settings. - system-settings route now allows ROLE.ADMIN+ instead of root-only. Branding cleanup: - Drop orphan "NewAPI" i18n keys from web/default locales. - Rename web/default workspace package newapi-web -> heicode-web. Config: - docker-compose.azure-vm.yml exposes HEICODE_ROOT_EMAILS / HEICODE_ADMIN_EMAILS. VERSION: 1.1.0-default-user-role Made-with: Cursor
61 lines
2.4 KiB
YAML
61 lines
2.4 KiB
YAML
# Azure VM：只跑 heicode 容器；PostgreSQL / Redis 使用 Azure 托管实例。
|
|
# 代码更新：在 VM 上对完整 heicode 仓库 git pull，勿用 scp 同步源码（见仓库根 CLAUDE.md）。
|
|
# 容器产生的数据（/data 上传与持久文件、/app/logs）绑定到 VM 本地磁盘，避免仅用匿名卷导致难备份或重建丢失。
|
|
#
|
|
# 1. 在 VM 上准备目录（示例）
|
|
# export HEICODE_DATA_ROOT=/var/lib/heicode/heicode
|
|
# sudo mkdir -p "$HEICODE_DATA_ROOT"/{data,logs}
|
|
# sudo chown -R "$USER":"$USER" "$HEICODE_DATA_ROOT"
|
|
#
|
|
# 2. 在本目录放置 .env（勿提交仓库），至少包含由运维注入的：
|
|
# SQL_DSN=postgresql://...@heicode.postgres.database.azure.com:5432/heicode?sslmode=require
|
|
# REDIS_CONN_STRING=rediss://:...@heicode.redis.cache.windows.net:6380
|
|
# SESSION_SECRET=...
|
|
# （以及项目要求的其它密钥，见官方 heicode 文档）
|
|
#
|
|
# 3. 构建 Heicode 定制镜像时与本地 override 一致：
|
|
# docker compose -f docker-compose.azure-vm.yml -f docker-compose.override.yml --env-file .env up -d --build
|
|
# 4. 构建完成后删除悬空旧镜像层：sudo docker image prune -f
|
|
#
|
|
# 若只用上游镜像、无 override，可去掉第二个 -f 文件，并把下方 image 改为 calciumion/heicode:latest。
|
|
|
|
version: '3.4'
|
|
|
|
services:
|
|
heicode:
|
|
image: heicode-manager:local
|
|
build:
|
|
context: .
|
|
dockerfile: Dockerfile
|
|
container_name: heicode
|
|
restart: always
|
|
command: --log-dir /app/logs
|
|
ports:
|
|
- "3000:3000"
|
|
volumes:
|
|
- ${HEICODE_DATA_ROOT}/data:/data
|
|
- ${HEICODE_DATA_ROOT}/logs:/app/logs
|
|
env_file:
|
|
- .env
|
|
environment:
|
|
- TZ=Asia/Shanghai
|
|
- ERROR_LOG_ENABLED=true
|
|
- BATCH_UPDATE_ENABLED=true
|
|
- NODE_NAME=heicode-node-1
|
|
# 默认与 docs/integration/Heicode-登录接口对接文档.md §2.1 一致；覆盖仅用于非标准网关。
|
|
- HEICODE_AUTH_BASE_URL=${HEICODE_AUTH_BASE_URL:-https://apimtaiji.azure-api.net/api/mcp}
|
|
# Agnet 登录后 JIT 同步：邮箱命中以下白名单则自动提权
|
|
- HEICODE_ROOT_EMAILS=${HEICODE_ROOT_EMAILS:-}
|
|
- HEICODE_ADMIN_EMAILS=${HEICODE_ADMIN_EMAILS:-}
|
|
networks:
|
|
- heicode-network
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "wget -q -O - http://localhost:3000/api/status | grep -o '\"success\":\\s*true' || exit 1"]
|
|
interval: 30s
|
|
timeout: 10s
|
|
retries: 3
|
|
|
|
networks:
|
|
heicode-network:
|
|
driver: bridge
|