whqreza
cb621ca5d0
Problem: the dashboard was Jev-centric; NLU/arbiter/fallback DeepSeek, STT
providers and the audio-enhancer were barely visible, and stored texts/voices
had no real access path.
Bot (additive; reply path untouched):
- nlu.result now records latency_ms + the DeepSeek usage tokens
- matching.arbitration/fallback.result fill the model + latency_ms columns
(payload unchanged; SQL coalesces column/payload so old rows still count)
- storage.py: MinIO dual-write layer — every voice (raw + denoised) and user
attachment is mirrored fire-and-forget into bucket bot-media; the blocking
minio SDK runs via asyncio.to_thread (senior-engineer review) so the event
loop is never stalled; empty MINIO_* env = layer off; bucket auto-created
- requirements: minio>=7.2
Backend (admin-gated, read-only):
- GET /bot-metrics/models — one record per model (jev, deepseek-nlu,
deepseek-arbiter, deepseek-fallback, audio-enhancer + dynamic per-provider
STT) with calls/ok-rate/p50/p95/tokens/last-seen + version-drift vs the pin
- GET /bot-metrics/models/{id}/daily — per-model daily calls/fails/tokens/p50
- GET /bot-metrics/stages — every stage tagged with its Persian pipeline
section (صوت/درک پیام/تطبیق/ابهام و انتخاب/پیشنویس)
- /traces now carries input_kind + a 120-char text excerpt (consensus →
input.text → first STT transcript)
- media serving: POST /media-url mints a short-lived HMAC URL (audio/a tags
cannot send Authorization); GET /media streams from MinIO bot-media with
the read-only ./bot/data mount as fallback for pre-MinIO files; hard ref
validation (voices|attachments only, no .., extension whitelist)
- router exempted from the global Bearer dependency (files.py pattern) —
every endpoint keeps its own require_role('admin')
Frontend /bot-monitor (RTL, recharts):
- four tabs: نمای کلی / مدلها (records table + per-model expandable daily
charts: calls/fails, tokens, p50) / بخشها (sections grouped) / پیامها
- message drawer rebuilt: inline <audio controls> for raw + denoised voice,
download links, every STT transcript + consensus side-by-side, user
attachments, then the event timeline
- terminology: «ترس» → «پروندهی پیام» with tooltips + a one-line legend
Grafana: bot-observability gains a «کارکرد مدلها» table (stage→model
mapping for legacy rows); the explorer gains a message text column.
Seed: real (tiny) ogg files written + mirrored to MinIO, NLU usage tokens,
column-level model/latency on matching events.
Verified locally: /models returns all 7 records incl. per-STT and NLU tokens;
media 200 via signed URL (MinIO) and 401 without; ../ and .py rejected (400);
disk fallback serves a legacy file; pm-role 403 on every new endpoint;
bucket auto-created with 14 mirrored objects; tsc + vite build clean;
Grafana re-provisions 24 panels.
80 lines
3.4 KiB
Bash
80 lines
3.4 KiB
Bash
# ============================================================
|
|
# ERP stack configuration — copy to .env and fill in real values.
|
|
# .env is git-ignored; NEVER commit real credentials.
|
|
# Local dev: cp .env.example .env (defaults work as-is)
|
|
# Production VPS: /srv/erp/.env with STRONG values for every entry —
|
|
# docker-compose.prod.yml refuses to boot without them.
|
|
# ============================================================
|
|
|
|
# --- Public hosts (production; local defaults live in docker-compose.yml) ---
|
|
APP_HOST=aramesh.bennu-api-bahrestan.ir
|
|
API_HOST=api.bennu-api-bahrestan.ir
|
|
AUTH_HOST=casdoor.bennu-api-bahrestan.ir
|
|
S3_HOST=s3.bennu-api-bahrestan.ir
|
|
STORAGE_HOST=storage.bennu-api-bahrestan.ir
|
|
|
|
# --- Traefik / Let's Encrypt ---
|
|
TRAEFIK_ACME_EMAIL=you@example.com
|
|
|
|
# --- Environment: "prod" enables the fail-fast startup checks in the API ---
|
|
ENVIRONMENT=prod
|
|
|
|
# --- PostgreSQL (app + Casdoor share the instance) ---
|
|
POSTGRES_PASSWORD=CHANGE_ME_strong_db_password
|
|
|
|
# --- MinIO object storage root credentials ---
|
|
MINIO_ROOT_USER=CHANGE_ME_minio_user
|
|
MINIO_ROOT_PASSWORD=CHANGE_ME_long_random_minio_password
|
|
|
|
# --- Casdoor OIDC application (must match the Casdoor application record) ---
|
|
CASDOOR_CLIENT_SECRET=CHANGE_ME_casdoor_client_secret
|
|
CASDOOR_ADMIN_PASSWORD=CHANGE_ME_casdoor_console_admin_password
|
|
|
|
# --- CORS: exact browser origins allowed to call the API (comma-separated) ---
|
|
CORS_ORIGINS=https://aramesh.bennu-api-bahrestan.ir
|
|
|
|
# --- Developer Mode (X-User-* header identity + login panel) ---
|
|
# MUST stay false in production. Only for local debugging without tokens.
|
|
DEV_LOGIN_ENABLED=false
|
|
|
|
# --- Deploy webhook (Gitea push → rebuild; see infra/deploy-webhook/) ---
|
|
GITEA_WEBHOOK_SECRET=CHANGE_ME_long_random_webhook_secret
|
|
|
|
# --- Backups (db-backup sidecar; see docker-compose.yml) ---
|
|
BACKUP_DIR=/srv/erp/backups
|
|
BACKUP_INTERVAL_SECONDS=86400
|
|
BACKUP_KEEP_DAYS=14
|
|
|
|
# --- Monitoring stack (see monitoring/README.md) ---
|
|
# API log format for Loki ingestion ("text" locally, "json" in production)
|
|
LOG_FORMAT=json
|
|
# GlitchTip (error tracking). GLITCHTIP_HOST must be a public DNS name —
|
|
# the browser SDK posts errors there.
|
|
GLITCHTIP_SECRET_KEY=CHANGE_ME_random_django_secret
|
|
GLITCHTIP_DOMAIN=https://errors.bennu-api-bahrestan.ir
|
|
GLITCHTIP_HOST=errors.bennu-api-bahrestan.ir
|
|
GLITCHTIP_DB_PASSWORD=CHANGE_ME_glitchtip_db_password
|
|
GLITCHTIP_FROM_EMAIL=noreply@bennu-api-bahrestan.ir
|
|
GLITCHTIP_EMAIL_URL=consolemail://
|
|
# Grafana (dashboards) — UI is loopback-only (:3001) unless you add Traefik labels
|
|
GRAFANA_ADMIN_PASSWORD=CHANGE_ME_grafana_password
|
|
GRAFANA_ROOT_URL=http://localhost:3001/
|
|
# Bot-observability datasource (Grafana → app Postgres, read-only role).
|
|
# The bot provisions the obs_reader role with this password at startup
|
|
# (empty = role skipped; datasource then can't connect).
|
|
PROCUREMENT_BOT_OBS_READER_PASSWORD=
|
|
OBS_READER_USER=obs_reader
|
|
# Bot media second copy in MinIO (bucket is auto-created; empty endpoint = off)
|
|
BOT_MINIO_ENDPOINT=minio:9000
|
|
BOT_MINIO_BUCKET=bot-media
|
|
# OpenPanel (product analytics) — client id/secret from the OpenPanel project
|
|
OPENPANEL_API_URL=http://openpanel-api:3333
|
|
OPENPANEL_CLIENT_ID=
|
|
OPENPANEL_CLIENT_SECRET=
|
|
# Public origin of the OpenPanel dashboard/API the BROWSER talks to
|
|
# (e.g. https://stats.bennu-api-bahrestan.ir — see monitoring/README.md)
|
|
OPENPANEL_PUBLIC_URL=
|
|
# Sentry/GlitchTip DSNs created in the GlitchTip UI after first boot
|
|
SENTRY_DSN_BACKEND=
|
|
SENTRY_DSN_FRONTEND=
|