Ịwụnye Quire na Docker Compose

Nke a bụ ngwaahịa zuru oke n’otu họst: LMS, ọrụ ndabere ya, ọrụ ozi ozugbo na idezi ọnụ, na ọrụ nhọrọ ọ bụla n’azụ profaịlụ. Nhazi ahụ dị na docs/architecture/23-ops.md ngalaba 2.

Ebumnobi ndị ọzọ: Vercel na Cloudflare Workers na-agba naanị ọkwa weebụ. Mmelite dị na upgrade.md, na ndabere na mmega iweghachi na backup-restore.md.

Ihe ị chọrọ

• Docker Engine 27 ma ọ bụ nke ọhụrụ na Compose plugin 2.30 ma ọ bụ nke ọhụrụ.
• 4 CPU cores na 8 GB ebe nchekwa maka stack ndabara; 8 cores na 16 GB na --profile full (naanị ClamAV na-ejide ihe dịka 1.5 GB nke mbinye aka).
• Aha DNS maka ọkwa weebụ na nke abụọ maka ọdịnaya anaghị atụkwasị obi. Ha ga-abụrịrị họst dị iche: ngwugwu SCORM na HTML ebugoro na-agba na origin ọdịnaya ka ha ghara ịgụ kuki LMS.
• Maka nnwale mpaghara, lvh.me na *.localhost na-atụ aka na 127.0.0.1, nke bụ ihe docker/.env.example na-eji. Ọrụ proxy nke stack na-enye ha abụọ site na https na certificate authority mpaghara, ya mere ọ dịghị ihe ọzọ a na-awụnye (lee “TLS”).
• Ports 80 na 443 nweere onwe na họst (QUIRE_PROXY_HTTP_PORT na QUIRE_PROXY_HTTPS_PORT na-ebugharị ha).

Mbido mbụ

QUIRE_APP_ORIGIN=https://learn.example.org \
QUIRE_CONTENT_ORIGIN=https://content.example-content.org \
QUIRE_SETUP_ADMIN_EMAIL=you@example.org \
  docker/scripts/init-env.sh
docker compose -f docker/compose.yaml up -d --build
docker compose -f docker/compose.yaml logs init

docker/scripts/init-env.sh na-ede docker/.env site na docker/.env.example na nzuzo ọ bụla emepụtara (okwuntughe nchekwa data, igodo mbinye aka na igodo ukwu, ụzọ igodo mmalite ọdịnaya) na igodo mbinye aka checkpoint nyocha na docker/secrets/audit-signing-key.pem, nke Compose na-agbanye na workers dịka nzuzo. Ọ chọrọ naanị sh, awk na openssl, ọ na-ajụ idegharị docker/.env dị adị. Detuo faịlụ abụọ ahụ pụọ na họst: na-enweghị QUIRE_MASTER_KEY nchekwa data eweghachiri enweghị ike iwepu nzuzo na nzere echekwara ya. Iji mejupụta faịlụ n’aka kama, cp docker/.env.example docker/.env; nke faịlụ na-ekwu otu esi emepụta nzuzo ọ bụla.

Origin abụọ ahụ ga-abụrịrị https: ọrụ ọdịnaya na-ajụ http nkịtị na mmepụta, ha agaghị ekerịta domain edebanyere. Ọrụ proxy na-akwụsị TLS maka ha abụọ (lee “TLS”); init-env.sh na-ajụ origin http://.

Stack na-amalite n’usoro edoziri, nzọụkwụ ọ bụla na-echere nke bu ya ụzọ:

1. postgres aghọọ ahụike. Na mmalite mbụ script init ya (docker/postgres/init/90-passwords.sh) na-atọ okwuntughe ọrụ anọ.
2. migrate na-etinye mbugharị ọ bụla ma na-ebupụta queue ọrụ na nchekwa data njikwa na na nchekwa data tenant raara onwe ya ọ bụla, na-enyocha na ha niile kwenyere, emesịa pụọ (docs/ops/upgrade.md). Mbugharị na-agba na mmalite ọ bụla ma bụ idempotent, ya mere mmelite bụ image ọhụrụ na ịmalitegharị.
3. init (apps/web/src/first-run.ts) na-edekọ nchekwa data ngwa n’okpuru QUIRE_DATABASE_ID na, mgbe QUIRE_SETUP_ADMIN_EMAIL atọrọ, na-emepụta otu mbụ na onye nchịkwa ya. A na-ebipụta adreesị nbanye na okwuntughe emepụtara otu ugboro, na docker compose logs init.
4. web, content, worker, scheduler, collab na centrifugo na-amalite.
5. proxy na-amalite ozugbo web na content dị ahụike.

Mepee https://demo. na-esote domain ngwa gị (log init na-ebipụta adreesị nbanye kpọmkwem), wee banye. Na nrụnye mpaghara, tụkwasị certificate authority nke proxy obi nke mbụ (lee “TLS”). Gbanwee okwuntughe emepụtara na /account/security.

Usoro amalitere na-enweghị nzuzo achọrọ na-ajụ ịmalite ma kpọọ ntọala na-efu na log ya. Ọ dịghị ihe na-amalite ọkara ahaziri.

Ọrụ na profaịlụ

--profile full na-amalite ọrụ nhọrọ ọ bụla ma e wezụga backup na h5p. Malite otu na docker compose -f docker/compose.yaml --profile scan up -d. Na-enweghị ọrụ nhọrọ Quire ka na-arụ ọrụ ma kwuo ihe na-efu: enweghị nyocha pụtara a na-echekwa nbugo na-enyochaghị ya a gwara onye nchịkwa; enweghị Gotenberg pụtara faịlụ na-enye nbudata kama nlele; enweghị transcoder pụtara vidiyo na-akpọ dịka faịlụ mbụ.

Image ndị ọzọ ọ bụla na ọrụ ikike ya dị na docker/third-party-containers.yaml.

Ijikọ onye na-enye H5P

Quire anaghị etinye ma ọ bụ buga runtime H5P ma ọ bụ sidecar (ADR 0019). Ọ bụrụ na ị na-eji H5P, nye ndenye aha hosted nke gị ma ọ bụ rụọ H5P nke onwe gị iche site na Quire. Debanye onye na-enye ahụ dịka ngwaọrụ mpụga LTI 1.3 ma tinye ọdịnaya ya na nkuzi dịka ihe omume ngwaọrụ. Quire na-agbanwe akara na ọganihu ihe omume/akara site na LTI Assignment and Grade Services (AGS). Ọ bụrụ na onye na-enye eziga nkwupụta xAPI, hazie nke ahụ iche maka ụlọ ahịa nkwupụta xAPI nke Quire; mgbanwe akara/ọganihu AGS anaghị eziga nkwupụta xAPI. Mbubata Moodle na-akọ ihe omume H5P dịka chọrọ njikọ ngwaọrụ LTI. Onye na-enye na-anọgide na-ahụ maka runtime H5P ya, ide, ụlọ akụ ọdịnaya na akụkọ mgbalị.

Iji gbaa nke onwe gị na họst a, tọọ QUIRE_H5P_IMAGE na image ya ma malite profaịlụ h5p. Compose na-ebipụta ya na QUIRE_H5P_PORT (8090) ma debe data ya na volum h5p-data; image, na ọrụ ndị na-abịa na ya, na-anọgide nke gị.

Ntọala

Usoro ọ bụla na-agụ docker/.env. Template, docker/.env.example, na-edepụta ntọala ọ bụla na ndabara ya. Otu:

Adreesị

Nzuzo

Debe otu QUIRE_MASTER_KEY n’ebe ọzọ na-abụghị họst a. Nchekwa data eweghachiri na-enweghị ya enweghị ike iwepu nzuzo na nzere o ji.

Nchekwa data

A na-etinye okwuntughe ọrụ naanị mgbe emepụtara volum nchekwa data nke mbụ. Iji gbanwee otu emesịa, jiri ALTER ROLE emesịa melite URL dakọtara.

A na-eji QUIRE_REPORT_DATABASE_URL maka nchekwa data anụ ahụ DATABASE_URL kpọrọ. Maka nchekwa data anụ ahụ ọ bụla ọzọ edebanyere, tọọ URL njikọ quire_report nke ya na gburugburu weebụ na worker, emesịa tinye aha mgbanwe na mpaghara Reporting environment variable nke nchekwa data ahụ dịka env:NAME. Nrụtụ aka ga-atụ aka na otu nchekwa data dịka njikọ ngwa ya, ọ kacha mma nnomi ọgụgụ ya. Elu akụkọ ọ bụla na-eso tenant na njikọ akụkọ nchekwa data nke ya: onye wuo akụkọ na akụkọ echekwara, nnyefe ahaziri, mbupụ akụkọ, analytics, log nyocha, akụrụngwa nyocha REST na ọchụchọ nyocha onye enyemaka. Ọ dịghị nke ha na-agbaziri URL akụkọ nchekwa data ọzọ. Mgbe nchekwa data enweghị njikọ akụkọ, akụkọ nkịtị na-agba na njikọ ngwa nke nchekwa data ahụ n’onwe ya, ebe analytics na ọgụgụ nyocha ọ bụla na-ajụ ma kwuo ya, n’ihi na ọrụ ngwa enweghị ike ịgụ ụzọ nyocha.

Drivers

Uru driver nke mwepụta a enweghị a na-ajụ mgbe ọkwa weebụ malitere, na-akpọ ntọala, kama iji nwayọ dochie ya na ndabara.

Onyonyo

Peeji na-arịọ onyonyo na nha anọ edoziri site na /api/files/{id}/image/{size}, nke na-enyocha otu nnweta dịka faịlụ n’onwe ya emesịa tụgharịa na ọrụ onyonyo. Otu ọ bụla nwere ike ịrịọ ụzọ onyonyo na nha ọhụrụ QUIRE_IMAGE_SPECS_PER_HOUR (ndabara 2000) n’otu elekere; nha emepụtarala n’elekere ahụ agụghị. Jiri valkey ma ọ bụ postgres maka QUIRE_CACHE_DRIVER na ihe karịrị otu akpa weebụ, ka oke jide gafee ha.

Cloudflare Images na-edebe otu nke ya nke mbụ ọ bụla o nyere. Mgbe ehichapụrụ faịlụ, worker na-ehichapụ mbipụta ahụ tupu mbụ.

Queue

Ọrụ ndabere na-eji pg-boss n’otu nchekwa data Postgres, ya mere enweghị ọrụ queue ịgba na ọ dịghị ihe ịhazi. A na-etinye ọrụ n’ahịrị n’otu transaction dịka mgbanwe kpatara ha, ya mere crash enweghị ike tufuo otu ma ọ bụ zipu otu ugboro abụọ. QUIRE_QUEUE_DRIVER bụ pgboss ebe a, ndabara ya; vercel na cloudflare na-ebugharị naanị nnyefe ngosi na webhook dị mfe na queue nke platform n’onwe ya, ntuziaka Vercel na Cloudflare na-akọwa ha na otu ọkwa weebụ ha si etinye n’ahịrị.

Email

Tọọ otu n’ime:

• QUIRE_EMAIL_PROVIDER_CONFIG: ihe JSON na-akpọ onye na-enye HTTP na nzere ya, dịka {"provider":"postmark","token":"..."}. Postmark, Amazon SES, Mailgun, SendGrid na Resend ka akwadoro.
• QUIRE_SMTP_URL: smtp://user:password@host:587. Nke a ebumnobi naanị; nke ebumnobi serverless na-egbochi SMTP.

QUIRE_MAIL_FROM bụ onye zitere. Maka ịnwale Quire, malite profaịlụ devmail, tọọ QUIRE_SMTP_URL=smtp://mailpit:1025, ma gụọ mail na http://localhost:8025.

Ọrụ nhọrọ

Nleba anya

OTEL_EXPORTER_OTLP_ENDPOINT na-akpọ onye nchịkọta usoro ọ bụla na-ezigara traces na metrics; na profaịlụ observability ọ bụ http://otelcol:4318, docker/otel-collector.yaml bụ ebe ị na-etinye exporter maka backend gị. Ọkwa weebụ, worker, scheduler, content na collab usoro na-ebupụ spans site na OTLP/HTTP (arịrịọ weebụ, transaction nchekwa data tenant, ọrụ worker na oku na-apụ) mgbe atọrọ ya, na metrics na otu endpoint kwa nkeji (OTEL_METRICS_EXPORTER=none na-agbanyụ ha). OTEL_TRACES_SAMPLER_ARG na-atọ oke traces echekwara. Logs na-aga na standard output na LOG_LEVEL, Compose na-atụgharị ha. Traces anaghị ebu data onwe.

Ọpụpụ mpaghara (EU data residency)

QUIRE_REGION=eu na-ekwu na stack na-enye otu European Union. Nke worker na-ejide arịrịọ na-apụ ọ bụla emere maka otu a tụkwasịrị na EU na allowlist (21-compliance.md ngalaba 8.1). Allowlist bụ họst nke ọrụ ahaziri na-ekwupụta maka mpaghara (endpoint nchekwa, onye na-enye email, onye na-enye vidiyo hosted, ebumnobi nchekwa nke otu, ndị na-enye AI na akaụntụ email), họst nke ọrụ ọ bụla n’okpuru derogation na-arụ ọrụ, na họst ị depụtara na QUIRE_EGRESS_ALLOW_HOSTS. A na-ajụ arịrịọ na họst ọha ọ bụla ọzọ tupu eziga ya, a na-ede ọjụjụ na ụzọ nyocha otu dịka privacy/egress_refused, a na-edepụta ya n’okpuru Compliance, Data residency.

Otu UK na US anaghị ejide na ndepụta họst; ha na-edobe nlele mpaghara ọrụ. Tọọ ndepụta na worker; ibe admin na-agụ ya na weebụ ọkwa igosi allowlist, ya mere tinye ya na docker/.env, nke ọrụ ọ bụla na-agụ.

Nlele ngwa na-enye njehie doro anya na ndenye nyocha, ọ abụghịkwa nkwa: koodu nwere ike ịdị njọ. Nkwa bụ netwọk. Compose anaghị mmanye ya maka gị. Maka stack mpaghara, tinye ọrụ worker na web na netwọk internal: true nke naanị ụzọ ọpụpụ ya bụ proxy ọpụpụ (dịka ọmụmaatụ Squid ma ọ bụ akpa tinyproxy) nke na-ekwe otu họst dịka QUIRE_EGRESS_ALLOW_HOSTS gbakwunyere họst nke ọrụ ahaziri gị, ma tọọ HTTPS_PROXY maka ọrụ ndị ahụ. Ibe residency na-edepụta kpọmkwem họst ngwa na-ekwe, ya mere enwere ike ịtụnyere ndepụta abụọ ahụ.

Ahụike

docker compose -f docker/compose.yaml ps na-egosi ahụike ọrụ ọ bụla.

TLS

Ọrụ proxy (Caddy, Apache-2.0, docker/caddy/Caddyfile) bụ akụkụ nke stack ndabara. Ọ na-aza na ports 80 na 443 ma na-ebugharị:

init-env.sh na-enweta QUIRE_PROXY_APP_HOST, QUIRE_PROXY_CONTENT_HOST, QUIRE_PROXY_HTTPS_PORT, QUIRE_COLLAB_URL na IMGPROXY_URL site na abụọ origins, ya mere ha enweghị ike ịgbasa. Dezie ha ọnụ ọ bụrụ na ị gbanwee origin n’aka.

Asambodo na-eso QUIRE_PROXY_TLS:

• internal (ndabara): certificate authority nke Caddy n’onwe ya, maka localhost, *.localhost na lvh.me. Tụkwasị mgbọrọgwụ ya obi otu ugboro, emesịa chọgharị:

  docker compose -f docker/compose.yaml cp \
    proxy:/data/caddy/pki/authorities/local/root.crt ./quire-local-ca.crt

  Tinye quire-local-ca.crt na ụlọ ahịa ntụkwasị obi sistemụ ma ọ bụ ihe nchọgharị. curl na-ewere ya na --cacert.

• Adreesị email: asambodo ACME akpaka (Let’s Encrypt, emesịa ZeroSSL) maka hostnames ezigbo. DNS maka origins abụọ na họst tenant ọ bụla ga-atụ aka ebe a, ports 80 na 443 ga-enwerịrị ike iru site na ịntanetị.

A na-enye họst tenant mgbe achọrọ, na nleta mbụ, naanị mgbe web gosipụtara na aha bụ nke nrụnye a (/tls-allowed, ajụrụ na netwọk Compose). Ọ dịghị mkpa asambodo wildcard ma ọ bụ plugin onye na-enye DNS, onye ọbịbịa na-atụ aka aha na họst enweghị ike ime ka ọ rịọ asambodo. Asambodo na authority mpaghara bi na volum caddy-data; debe ndabere ya na ndị ọzọ ọ bụrụ na ị na-eji internal.

Web kwere X-Forwarded-For site na proxy naanị: proxy nwere adreesị edoziri (QUIRE_PROXY_ADDRESS, ndabara 172.29.64.10) na subnet edoziri (QUIRE_COMPOSE_SUBNET), QUIRE_TRUSTED_PROXY_CIDRS na-akpọ adreesị ahụ. Ọ bụrụ na subnet na-adakọ na netwọk na họst, gbanwee ha abụọ wee gbaa docker compose down tupu up.

N’azụ reverse proxy nke gị

Iji jiri load balancer ma ọ bụ proxy ị na-agba kama, hapụ proxy pụọ (docker compose up -d --scale proxy=0) ma kwụsị TLS n’ihu web (8080), content (8081), collab (1234, websocket) na centrifugo (8000, websocket). Tọọ adreesị ọha na QUIRE_APP_ORIGIN, QUIRE_CONTENT_ORIGIN na QUIRE_COLLAB_URL (wss://), na oke adreesị proxy gị na QUIRE_TRUSTED_PROXY_CIDRS.

Nchọpụta nsogbu

• init na-apụ na “QUIRE_DATABASE_ID is not a UUID”: tọọ ya na uuidgen.
• web na-amalitegharị na “did not start on compose”: log na-edepụta ntọala ọ bụla ọ na-enweghị ike ịsọpụrụ na ihe iji kama.
• Ịgbanwe okwuntughe ọrụ na .env mgbe mmalite mbụ emeghị ihe ọ bụla: nke script init na-agba otu ugboro. Jiri ALTER ROLE.
• Nbugo na-ada na njehie nyocha ebe CLAMAV_URL atọrọ: ClamAV na-ebudata mbinye aka ya na mmalite mbụ, nke na-ewe nkeji ole na ole.