Te whakaturanga i te Quire ma te Docker Compose

Ko tēnei te produk katoa i tētahi pūrere kotahi: te LMS, ā rātou mahi i muri, ngā ratonga whakatika tūturu me te mahi ngātahi, me ia ratonga kōwhiria kei raro i tētahi profile. Ko te hoahoa te docs/architecture/23-ops.md wāhanga 2.

Ētahi atu wāhi whakaturanga: ke Vercel me ngā Cloudflare Workers e mahi ana ki te wāhanga ipurangi anake. Kei upgrade.md ngā whakahou, ā, kei backup-restore.md ngā pupuniBackup me te whakamātau whakahoki.

He aha e hiahiatia ana

• Docker Engine 27 rānei i muri mai, me te pūtukunga Compose 2.30 rānei i muri mai.
• 4 ngā pū CPU me te 8 GB memoe mō te kōpae tūtohu; 8 pū me te 16 GB me te --profile full (ko te ClamAV anake ka pupuri i te 1.5 GB tata ngā tohu).
• He ingoa DNS mō te wāhanga ipurangi me tētahi atu mō te ihirangi kāore e whakawhirinaki. Me rerekē ō rātou wāhi whakaturanga: ka tū ngā kete SCORM me ngā HTML kua tuku i te pū o te ihirangi, kia kore rātou e pānui i ngā cookie o te LMS.
• Mō te whakamātau ā-rohe, e tū ana te lvh.me me te *.localhost ki te 127.0.0.1, ko ia te mea e whakamahia ana e te docker/.env.example. Ka tuku te ratonga proxy ōna ake i ērua ma te https me tētahi mana tiwhikete ā-rohe, nō reira kāore tētahi atu e whakaturia (tirohia “TLS”).
• Ngā poro 80 me 443 wātea i te pūrere (QUIRE_PROXY_HTTP_PORT me te QUIRE_PROXY_HTTPS_PORT e neke ana i a rātou).

Te tīmata tuatahi

QUIRE_APP_ORIGIN=https://learn.example.org \
QUIRE_CONTENT_ORIGIN=https://content.example-content.org \
QUIRE_SETUP_ADMIN_EMAIL=you@example.org \
  docker/scripts/init-env.sh
docker compose -f docker/compose.yaml up -d --build
docker compose -f docker/compose.yaml logs init

docker/scripts/init-env.sh ka tuhi docker/.env mai i te docker/.env.example me ia kupu tūmataiti e hangaia ana (ngā kupuhipa pūtaka, ngā kī tā me ngā kī matua, te kōpui kī whakataka ihirangi) me te kī tā tuhipoka arotake i te docker/secrets/audit-signing-key.pem, e whakauru ana te Compose ki ngā kai mahi hei kupu tūmataiti. He hiahiatia anake i a ia te sh, te awk me te openssl, ā, ka ārai ia te whakakapi i tētahi docker/.env kua tū kē. Tāruatia ērua kōnae i waho o te pūrere: me te kore te QUIRE_MASTER_KEY, kāore e taea e tētahi pūtaka kua whakahoki te wehenga i ōna tohu whakamanatanga kua kohia. Mēnā ka whai te tuhinga i te ringa i tōna wā, cp docker/.env.example docker/.env; ka kōrerotia e te kōnae te āhua hanga ia kupu tūmataiti.

Me ērua ngā pū he https: ka ārai te ratonga ihirangi i te http tūturu i te wāhanga whakaputanga, ā, me kore rātou e tohono i tētahi rohe e taea te rēhita. Ka tū te TLS i te ratonga proxy mō ērua (tirohia “TLS”); ka ārai te init-env.sh i tētahi pū http://.

Ka tīmata te kōpae i te tātari tūturu, ā, ka tatari ia kaupapa i tērā i mua i a ia:

1. Ka noho ora te postgres. I te tīmata tuatahi ka tautuhi tana pūmanawa init (docker/postgres/init/90-passwords.sh) i ngā kupuhipa ē whā o ngā tūwāhi.
2. migrate ka whakamahia ia whakawhiti kaupapa, ā, ka whakatīmata te rārangi tatari i te pūtaka whakahaere me ia pūtaka motuhake o te wāhanga, ka tātaritia te ōrite o ē rātou whakataunga, kātia ka wehea (docs/ops/upgrade.md). Ka tū ngā whakawhiti i ia tīmata kia ōrite, nō reira ko te whakahou tētahi whakaahua hou me te tīmata anō.
3. init (apps/web/src/first-run.ts) ka tuhipoka te pūtaka taupānga i raro i te QUIRE_DATABASE_ID, ā, i te wā tautuhia ana te QUIRE_SETUP_ADMIN_EMAIL, ka hanga te tuatahi rōpū me tana kaiwhakahaere. Ka tāia te wāhi hono mai me tētahi kupuhipa e hangaia ana kotahi wā, i te rārangi pūrongo docker compose logs init.
4. web, content, worker, scheduler, collab me te centrifugo ka tīmata.
5. Ka tīmata te proxy i te wā ora te web me te content.

Tuwherahia te https://demo. i muri i tō ingoa taupānga (ka tāia te wāhi hono mai tino tika i te rārangi pūrongo init), ā, hono atu. I te whakaturanga ā-rohe, whakawhirinaki tuatahi i te mana tiwhikete o te proxy (tirohia “TLS”). Hurihia te kupuhipa e hangaia ana i te /account/security.

Te pū e tīmata ana me te kore kupu tūmataiti e hiahiatia ana ka ārai ia te tīmata, ā, ka whakaatuhia i tana rārangi pūrongo te tautuhinga kāore. Kāore e tīmata tētahi mea i te waenganui whakaturanga.

Ngā ratonga me ngā profile

Ka tīmata te --profile full ia ratonga kōwhiria katoa engari te backup me te h5p. Tīmata tētahi ma te docker compose -f docker/compose.yaml --profile scan up -d. Me te kore ratonga kōwhiria, ka mahi tonu a Quire, ā, ka kōrerotia te mea kāore: me te kai tiro, ka kohia ngā tuku kāore kua tirohia, ā, ka whakamōhiohia te kaiwhakahaere; me te Gotenberg, ka tuku ngā kōnae i te tukunga ehara i te tiro mua; me te kai whakawhiti, ka whakatangihia te ataata i te kōnae ōna ake.

Ka tuhia ia whakaahua tuatoru me ōna utu raihana i te docker/third-party-containers.yaml.

Te hono i tētahi kaiwhakarato H5P

Kāore e whakakō a Quire rānei e tuku i tētahi pū mahi H5P rānei pū tautoko (ADR 0019). Mēnā ka whakamahia koe i te H5P, tukua tō ake H5P kua tuku rānei whakahaerea tō ake H5P e noho ana i motuhake i waho o a Quire. Rēhitatia tērā kaiwhakarato hei rākau o waho LTI 1.3, ā, tāpiritia tana ihirangi ki ngā akoranga hei mahi rākau. Ka whakawhiti a Quire ngā tohu me te whakapae ako me te whakapae aromatawai ma te LTI Assignment and Grade Services (AGS). Mēnā ka tuku hoki te kaiwhakarato i ngā kōrero xAPI, tautuhia tēnei motuhake mō te kohinga kōrero xAPI o Quire; kāore te whakawhiti tohu me te whakapae AGS e tuku i ngā kōrero xAPI. Ka whakaatuhia ngā mahi H5P i ngā whakaurunga Moodle hei mea e hiahiatia ana tētahi hono rākau LTI. Ka noho tonu te kaiwhakarato te mea e mana ana i tana pū mahi H5P, tana hanga, tana pātengi ihirangi me tana whakapapa whakamātau.

Kia tū tō ake H5P e whakahaeretia ana e koe i tēnei pūrere, tautuhia te QUIRE_H5P_IMAGE ki tōna whakaahua, ā, tīmata te profile h5p. Ka tukua te Compose i a ia i te QUIRE_H5P_PORT (8090), ā, ka noho ōna raraunga i te volume h5p-data; ko tō ake te whakaahua, me ē utu e tae mai ana i a ia.

Ngā tautuhinga

Ka pānui ia pū te docker/.env. Ko te tauira, te docker/.env.example, he rārangi ia i ia tautuhinga me tana uara tūtohu. Ngā rōpū:

Ngā wāhi

Ngā kupu tūmataiti

Pupuritia tētahi tārua o te QUIRE_MASTER_KEY i tētahi wāhi kē i tēnei pūrere. Kāore e taea e tētahi pūtaka kua whakahoki te wehenga i ēna tohu whakamanatanga e pupuri ana ia me te kore ia.

Te pūtaka

Ka tautuhia ngā kupuhipa tūwāhi i te wā anake ka hanga te wāhi pupunga pūtaka tuatahi. Kia huri i tētahi i muri mai, whakamahia te ALTER ROLE, kātia ka whakahou te URL whakarite.

Ka whakamahia te QUIRE_REPORT_DATABASE_URL mō te pūtaka ā-tinana e tautuhia ana e te DATABASE_URL. Mō ia pūtaka motuhake rēhita atu, tautuhia tōna ake quire_report wāhi hono i ngā taiao o web me te worker, kātia ka tāropia te ingoa i te āpure Te tautuhinga taiao pūrongo o tēnei pūtaka ma te env:NAME. Me tū te tohunga ki te tahi pūtaka me tana hono taupānga, i tōna tino pai ko tana tārua pānui. Ka tae ia wāhanga pūrongo ki te hono pūrongo o te pūtaka ōna ake o te wāhanga: te kaihanga pūrongo me ngā pūrongo kua tiakina, ngā tuku takotahi, ngā tāruatanga pūrongo, ngā tatauranga, te rārangi arotake, ngā rauemi arotake REST me te rapu arotake o te kaiwhāwhina. Kāore tētahi o rātou e whakauru i te hono pūrongo o tētahi atu pūtaka. I te wā kāore hono pūrongo tētahi pūtaka, ka tū ngā pūrongo tūmatanui i te hono taupānga ōna ake o tētahi pūtaka, engari ka ārai ngā tatauranga me ia pānui arotake, ā, ka kōrerotia tēnei, i te mea kāore e taea e te tūwāhi taupānga te pānui i te ara arotake.

Ngā kaiwhakarato

Ka ārai ia uara kaiwhakarato kāore e ārahi ana te whakaputanga nei i te wā tīmata o te wāhanga ipurangi, me te tohu te tautuhinga, ehara i te whakakapia i te tūtohu i te pōuri.

Ngā whakaahua

Ka tono ngā whārangi i ngā whakaahua i ē whā rahinga tūturu ma te /api/files/{id}/image/{size}, e tātaritia ana te whakaae kotahi me te kōnae tēnei a ia, kātia ka whakawhiritia ki te ratonga whakaahua. Ka āea te whā i ia rā te tono i ē tauira whakaahua hou me te rahinga QUIRE_IMAGE_SPECS_PER_HOUR (tūtohu 2000) ia haora; kāore e tata ngā rahinga kua hanga kē i tērā haora. Whakamahia te valkey rānei te postgres mō te QUIRE_CACHE_DRIVER me te tino maha ipupā web, kia noho te ārahi i waenga i a rātou.

Ka noho a Cloudflare Images i tōna ake tārua o ia whakaahua tūturu e tuku ana. I te wā mukua tētahi kōnae, ka mukua e te kai mahi tērā tārua i mua i te tūturu.

Te rārangi tatari

Ka whakamahia ngā mahi i muri te pg-boss i te tahi pūtaka PostgreSQL, nō reira kāore he ratonga rārangi tatari te tīmata me te mea te tautuhinga. Ka tukuhia ngā mahi i te tahi whakawhitinga me te huringa i tū ai rātou, nō reira kāore e taea i tētahi raru te ngaro i tētahi rānei te tuku i a ia rua wā. Ko te QUIRE_QUEUE_DRIVER ko te pgboss i konei, ko tana tūtohu; ko te vercel me te cloudflare ka neke anake i ngā whakamōhiotanga māmā me ngā tuku webhook ki te rārangi tatari ōna ake o te pū, ā, ka ārahitia ēnei e ngā aratohu Vercel me Cloudflare, ā, te āhua e tukuhia ai e ō rātou wāhanga ipurangi.

Īmēra

Tautuhia tētahi o ēnei:

• QUIRE_EMAIL_PROVIDER_CONFIG: tētahi āhuatanga JSON e tohu ana tētahi kaiwhakarato HTTP me ōna tohu whakamanatanga, pērēi i te {"provider":"postmark","token":"..."}. Ka tautokotia te Postmark, te Amazon SES, te Mailgun, te SendGrid me te Resend.
• QUIRE_SMTP_URL: smtp://user:password@host:587. Tēnei wāhi anake; ka ārai ē atu wāhi i te SMTP.

Ko te QUIRE_MAIL_FROM te kaiwhakawhiti. Mō te whakamātau i a Quire, tīmata te profile devmail, tautuhia te QUIRE_SMTP_URL=smtp://mailpit:1025, ā, pānuitia te īmēra i te http://localhost:8025.

Ngā ratonga kōwhiria

Te aroturuki

Ko te OTEL_EXPORTER_OTLP_ENDPOINT te tohu o te kaiwhakohi e tukuna ana ia pū ngā mātātai me ngā ōrongotau ki a ia; me te profile observability ko te http://otelcol:4318, ā, ko te docker/otel-collector.yaml te wāhi e tāpiritia ana te kaiwhakawhaki mō tō pūhokihoki. Ka tuku ngā wāhanga ipurangi, te kai mahi, te kaiwhakarite, te ihirangi me te collab i ngā taki ma te OTLP/HTTP (ngā tono ipurangi, ngā whakawhinga pūtaka wāhanga, ngā mahi kai mahi me ngā karenga whakawāhi) i te wā tautuhia, ā, ngā ōrongotau ki te tahi wāhi ia meneti (OTEL_METRICS_EXPORTER=none ka whakawāhia rātou). Ko te OTEL_TRACES_SAMPLER_ARG te tautuhinga o te wehenga mātātai e pupuria ana. Ka tukuna ngā rārangi ki te tuku tūturu i te LOG_LEVEL, ā, ka hurihuri te Compose i a rātou. Kāore e kawe ngā mātātai i tētahi raraunga tangata.

Te tukunga ā-rohe (te noho raraunga UE)

Ko te QUIRE_REGION=eu te kōrero he rōpū Uniana Ūropē e tuku ana te kōpae. Ka ārahi i muri i tēnei te kai mahi ia tono whakawāhi e mahia ana mō tētahi rōpū e pūmau ana ki te UE ki tētahi rārangi whakaae (21-compliance.md wāhanga 8.1). Ko te rārangi whakaae ngā kaiwāhi e whakaatura ana ngā ratonga e tautuhia ana mō tēnei rohe (te wāhi kohinga, te kaiwhakarato īmēra, tētahi kaiwhakarato ataata tuku, ngā wāhi kohinga ōna ake o te rōpū, ngā kaiwhakarato AI me te pūkete īmēra), ngā kaiwāhi o ia ratonga i raro i tētahi whakarara tūturu, me ngā kaiwāhi e tuhia ana e koe i te QUIRE_EGRESS_ALLOW_HOSTS. Ka āraihia ia tono ki tētahi atu kaiwāhi tūmatanui i mua i te tukuna, ka tuhia te ārai ki te ara arotake o te rōpū ma te privacy/egress_refused, ā, ka tuhia ia i raro i te Whakaaetanga, te Noho raraunga.

Kāore e āraihia ē rōpū UK me US ki tētahi rārangi kaiwāhi; ka noho tonu rātou i ngā tātaritanga rohe ratonga. Tautuhia te rārangi i te kai mahi; ka pānui te whārangi whakahaere i a ia i te wāhanga ipurangi kia whakaatuhia te rārangi whakaae, nō reira tāropia ia i te docker/.env, e pānui ana ia ratonga.

Ka tuku te tātaritanga taupānga i tētahi hapa mārama me tētahi tuhipoka arotake, ā, ehara i te tūpono: ka āea te waehere te hē. Ko te tūpono ko te kupenga. Kāore e whakarite te Compose i tēnei mō a koe. Mō tētahi kōpae ā-rohe, whakarite ngā ratonga worker me web ki tētahi kupenga internal: true, ā, kāore he ara whakawāhi engari tētahi proxy tukunga (hei tauira tētahi ipupā Squid rānei tinyproxy) e whakaae ana i ngā tahi kaiwāhi me te QUIRE_EGRESS_ALLOW_HOSTS me ē kaiwāhi o ō ratonga e tautuhia ana, ā, tautuhia te HTTPS_PROXY mō ērā ratonga. Ka tuhia i te whārangi noho raraunga ngā kaiwāhi tino tika e whakaaetia ana e te taupānga, kia taea te whakatauranga i ē rārangi e rua.

Te hauora

Ka whakaatuhia te docker compose -f docker/compose.yaml ps te hauora o ia ratonga.

TLS

Ko te ratonga proxy (te Caddy, Apache-2.0, docker/caddy/Caddyfile) he wāhanga o te kōpae tūtohu. Ka whakautu ia i ngā poro 80 me 443, ā, ka tohutohu:

Ka whakaputanga te init-env.sh i te QUIRE_PROXY_APP_HOST, te QUIRE_PROXY_CONTENT_HOST, te QUIRE_PROXY_HTTPS_PORT, te QUIRE_COLLAB_URL me te IMGPROXY_URL mai i ē pū e rua, nō reira kāore e taea te wehenga i a rātou. Whakatikaina rātou ngātahi mēnā ka huri koe i tētahi pū i te ringa.

Ka whai ngā tiwhikete i te QUIRE_PROXY_TLS:

• internal (te tūtohu): te mana tiwhikete ōna ake o te Caddy, mō te localhost, te *.localhost me te lvh.me. Whakawhirinaki tō pūhono tuatahi, kātia, ā, tirohia:

  docker compose -f docker/compose.yaml cp \
    proxy:/data/caddy/pki/authorities/local/root.crt ./quire-local-ca.crt

  Tāpiritia te quire-local-ca.crt ki te pūrunga whakawhirinaki o te pūrere rānei o te pūhukapuka. Ka āea te curl te tango i a ia ma te --cacert.

• Tētahi wāhi īmēra: ngā tiwhikete ACME ā-oto (Let’s Encrypt, kātia te ZeroSSL) mō ngā ingoa kaiwāhi tūturu. Me tū te DNS mō ē pū e rua me ia kaiwāhi wāhanga ki konei, ā, me taea te tae mai ki ngā poro 80 me 443 mai i te ipurangi.

Ka tukua ngā kaiwāhi wāhanga i te wā tonoa, i te tiro tuatahi, ā, i te wā anake e whakaaea ana e te ipurangi ko tōna ingoa te tū tika ki tēnei whakaturanga (/tls-allowed, e pātaihia ana i te kupenga Compose). Kāore e hiahiatia tētahi tiwhikete whakawhiti rānei tētahi pūwāea DNS, ā, kāore e taea e tētahi kāore e mōhio ana e tū tētahi ingoa ki te pūrere te tono i ngā tiwhikete. Kei te volume caddy-data ngā tiwhikete me te mana ā-rohe; tārua rātou me ē atu mēnā ka whakamahia koe i te internal.

Ka whakaaetia e te proxy anake te X-Forwarded-For o te web: he wāhi tūturu te proxy (QUIRE_PROXY_ADDRESS, tūtohu 172.29.64.10) i tētahi tapa subnet (QUIRE_COMPOSE_SUBNET), ā, ko te QUIRE_TRUSTED_PROXY_CIDRS te tohu i tērā wāhi. Mēnā ka tukutahi te subnet me tētahi kupenga i te pūrere, hurihia ērua, ā, whakatēngia te docker compose down i mua i te up.

I muri i tō ake proxy whakamuri

Mō te whakamahi i tētahi kai wehenga rānei proxy kua tū kē i tō mana, waiho i waho te proxy (docker compose up -d --scale proxy=0), ā, whakakore i te TLS i mua i te web (8080), te content (8081), te collab (1234, websocket) me te centrifugo (8000, websocket). Tautuhia ngā wāhi tūmatanui i te QUIRE_APP_ORIGIN, te QUIRE_CONTENT_ORIGIN me te QUIRE_COLLAB_URL (wss://), ā, te tawāhi o tō proxy i te QUIRE_TRUSTED_PROXY_CIDRS.

Te rapu i ngā raru

• Ka wehea te init me te “QUIRE_DATABASE_ID is not a UUID”: tautuhia ia ma te uuidgen.
• Ka tīmata anō te web me te “did not start on compose”: ka tuhia i te rārangi ia tautuhinga kāore e taea te ārahi, me te mea e whakamahia ana i tōna place.
• Kāore e mahi te huri kupuhipa tūwāhi i te .env i muri i te tīmata tuatahi: ka tū te pūmanawa init kotahi wā. Whakamahia te ALTER ROLE.
• Ka rahua ngā tuku me tētahi hapa tiro i te wā tautuhia te CLAMAV_URL: ka tukua te ClamAV ōna tohu i te tīmata tuatahi, ā, ka tae tēnei i te tahi meneti.