Files

OG T 7478dc0254 feat(phase6-9): Complete modular architecture and Agent Teams

Phase 6.4 - Modular Architecture:
- Add lewooogo-brain adapters for LLM providers
- Add lewooogo-data dual memory (Redis + PostgreSQL)
- Implement consensus engine for multi-agent decisions
- Add incident memory service for historical context

Phase 9 - Agent Teams (Claude Agent SDK):
- Add base agent class with Claude Sonnet 4 integration
- Implement action planner, blast radius, and security agents
- Add agent API endpoints and proposal workflow
- Integrate ADR-009 OpenClaw Agent Teams architecture

DevOps & CI/CD:
- Add GitHub Actions CI/CD workflows (ci.yaml, cd.yaml)
- Add pre-commit hooks and secrets baseline
- Add docker-compose for local development
- Update Kubernetes network policies

Frontend Improvements:
- Add auto-healing error boundary component
- Update i18n messages for agent features
- Enhance dual-state incident card with execution feedback

Documentation:
- Add 7 ADRs covering MCP, design system, architecture decisions
- Update ARCHITECTURE_MEMORY.md with modular design
- Add GLOBAL_RULES.md and SOUL.md for project identity

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

2026-03-23 18:40:36 +08:00

18 KiB

Raw Blame History

AWOOOI 部署拓撲與服務位置定義

版本: v1.0 建立日期: 2026-03-20 負責人: CIO 強制等級: 絕對遵守

概述

每個服務必須明確定義其部署位置：

Host (主機直裝): 直接安裝在主機上的服務
Docker: 使用 Docker / Docker Compose 運行的容器
K3s: 部署在 K3s 叢集中的 Pod

四主機部署總覽

┌─────────────────────────────────────────────────────────────────────────────┐
│                           AWOOOI 部署拓撲圖                                  │
└─────────────────────────────────────────────────────────────────────────────┘

┌─────────────────────────┐    ┌─────────────────────────┐
│   192.168.0.110         │    │   192.168.0.112         │
│   DevOps 金庫           │    │   Kali Security         │
├─────────────────────────┤    ├─────────────────────────┤
│ [Docker]                │    │ [Docker]                │
│  ├─ Harbor :5000        │    │  └─ Scanner API :8080   │
│  └─ GH Runner           │    │                         │
└─────────────────────────┘    └─────────────────────────┘
           │                              │
           └──────────────┬───────────────┘
                          │
                          ▼
┌─────────────────────────────────────────────────────────────────────────────┐
│                         192.168.0.188                                        │
│                         AI + Web 中心 (Gateway)                              │
├─────────────────────────────────────────────────────────────────────────────┤
│ [Host 直裝]                                                                  │
│  ├─ Nginx (SSL Gateway) :443                                                │
│  └─ PostgreSQL :5432                                                        │
│                                                                              │
│ [Docker]                                                                     │
│  ├─ Ollama :11434                                                           │
│  ├─ ClawBot AWOOOI :8089                                                    │
│  ├─ ClawBot Legacy :8088 (凍結)                                             │
│  ├─ Redis Stack :6380                                                       │
│  └─ SigNoz :3301                                                            │
└─────────────────────────────────────────────────────────────────────────────┘
                          │
                          │ Nginx Proxy
                          ▼
┌─────────────────────────────────────────────────────────────────────────────┐
│                     K3s 叢集 (192.168.0.120 + 121)                           │
├─────────────────────────────────────────────────────────────────────────────┤
│ [K3s - awoooi-prod Namespace]                                               │
│  ├─ awoooi-web (Frontend) → NodePort :32335                                 │
│  ├─ awoooi-api (Backend)  → NodePort :32334                                 │
│  └─ (未來擴充服務)                                                           │
│                                                                              │
│ [K3s - wooo-aiops Namespace] (凍結)                                         │
│  ├─ Legacy Frontend → NodePort :31235                                       │
│  └─ Legacy API      → NodePort :31234                                       │
└─────────────────────────────────────────────────────────────────────────────┘

服務部署位置詳細定義

192.168.0.110 (DevOps 金庫)

服務	部署方式	Port	說明
Harbor	Docker	5000	映像倉庫，Project: `awoooi/`
GitHub Runner	Docker	-	CI/CD 執行器，Label: `awoooi-runner`

# docker-compose.yaml (110)
services:
  harbor:
    image: goharbor/harbor:v2.x
    ports:
      - "5000:5000"
    volumes:
      - /data/harbor:/data

  gh-runner:
    image: myoung34/github-runner:latest
    labels:
      - "awoooi-runner"

192.168.0.112 (Kali Security)

服務	部署方式	Port	說明
Scanner API	Docker	8080	安全掃描 API，Header: `X-Source: awoooi`

# docker-compose.yaml (112)
services:
  scanner-api:
    image: kali-scanner:latest
    ports:
      - "8080:8080"
    environment:
      - ALLOWED_SOURCES=awoooi,wooo-aiops

192.168.0.188 (AI + Web 中心)

服務	部署方式	Port	說明
Nginx	Host 直裝	443	SSL Gateway，路由分流
PostgreSQL	Host 直裝	5432	主資料庫
Ollama	Docker	11434	本地 LLM 推理
ClawBot AWOOOI	Docker	8089	AI Agent (新)
ClawBot Legacy	Docker	8088	AI Agent (舊，凍結)
Redis Stack	Docker	6380	快取 + 向量搜尋
SigNoz	Docker	3301	APM / 觀測平台

Nginx (Host 直裝)

# 安裝方式
sudo apt install nginx
sudo systemctl enable nginx

# 配置檔位置
/etc/nginx/conf.d/awoooi-prod.conf

PostgreSQL (Host 直裝)

# 安裝方式
sudo apt install postgresql-15
sudo systemctl enable postgresql

# 資料庫
awoooi_prod  # AWOOOI 專用
wooo_aiops   # Legacy (凍結)

Docker 服務

# docker-compose.yaml (188)
services:
  ollama:
    image: ollama/ollama:latest
    ports:
      - "11434:11434"
    volumes:
      - /data/ollama:/root/.ollama
    deploy:
      resources:
        reservations:
          devices:
            - capabilities: [gpu]

  clawbot-awoooi:
    image: 192.168.0.110:5000/awoooi/clawbot:latest
    ports:
      - "8089:8089"
    environment:
      - OLLAMA_URL=http://localhost:11434
      - REDIS_URL=redis://localhost:6380/10

  clawbot-legacy:
    image: 192.168.0.110:5000/wooo-aiops/clawbot:frozen
    ports:
      - "8088:8088"
    # 凍結版本，不再更新

  redis-stack:
    image: redis/redis-stack:latest
    ports:
      - "6380:6379"
    volumes:
      - /data/redis:/data

  signoz:
    image: signoz/signoz:latest
    ports:
      - "3301:3301"

192.168.0.120 / 121 (K3s 叢集)

節點	角色	說明
192.168.0.120	Master	K3s 控制平面 + Worker
192.168.0.121	Worker	HA 備援節點

K3s Namespace 定義

Namespace	用途	狀態
`awoooi-prod`	AWOOOI 正式環境	Active
`wooo-aiops`	Legacy 系統	凍結

AWOOOI 服務 (K3s)

服務	Deployment	Service	NodePort
Frontend	awoooi-web	awoooi-web-svc	32335
Backend	awoooi-api	awoooi-api-svc	32334

# k8s/awoooi-prod/03-deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: awoooi-web
  namespace: awoooi-prod
spec:
  replicas: 2
  selector:
    matchLabels:
      app: awoooi-web
  template:
    metadata:
      labels:
        app: awoooi-web
    spec:
      containers:
        - name: web
          image: 192.168.0.110:5000/awoooi/web:${IMAGE_TAG}
          ports:
            - containerPort: 3000
          resources:
            requests:
              cpu: "100m"
              memory: "256Mi"
            limits:
              cpu: "500m"
              memory: "512Mi"

---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: awoooi-api
  namespace: awoooi-prod
spec:
  replicas: 2
  selector:
    matchLabels:
      app: awoooi-api
  template:
    metadata:
      labels:
        app: awoooi-api
    spec:
      containers:
        - name: api
          image: 192.168.0.110:5000/awoooi/api:${IMAGE_TAG}
          ports:
            - containerPort: 8000
          env:
            - name: DATABASE_URL
              valueFrom:
                secretKeyRef:
                  name: awoooi-secrets
                  key: DATABASE_URL
            - name: REDIS_URL
              value: "redis://192.168.0.188:6380/10"
            - name: OLLAMA_URL
              value: "http://192.168.0.188:11434"
            - name: CLAWBOT_URL
              value: "http://192.168.0.188:8089"
          resources:
            requests:
              cpu: "200m"
              memory: "512Mi"
            limits:
              cpu: "1"
              memory: "1Gi"

環境對照表 (最終版)

環境	用途	域名	部署位置
Dev	本機開發	`localhost:3000`	開發者本機
Prod	正式環境	`awoooi.wooo.work`	K3s (awoooi-prod)

⚠️ 無 UAT 環境: 測試驗收在 Dev 完成後直接部署 Prod

網路流量走向

用戶 (Internet)
       │
       ▼
┌─────────────────────────────────────────────────────────────────┐
│ Cloudflare (CDN + WAF)                                          │
└─────────────────────────────────────────────────────────────────┘
       │
       ▼ HTTPS :443
┌─────────────────────────────────────────────────────────────────┐
│ 192.168.0.188 - Nginx (Host 直裝)                               │
│ server_name: awoooi.wooo.work                               │
└─────────────────────────────────────────────────────────────────┘
       │
       ├──────────────────────────────────────┐
       │                                      │
       ▼ /api/* → :32334                      ▼ /* → :32335
┌─────────────────────┐              ┌─────────────────────┐
│ awoooi-api (K3s)    │              │ awoooi-web (K3s)    │
│ 120:32334, 121:32334│              │ 120:32335, 121:32335│
└─────────────────────┘              └─────────────────────┘
       │
       ├─────────────────────────────────────────────────┐
       │                    │                            │
       ▼                    ▼                            ▼
┌─────────────┐    ┌─────────────┐              ┌─────────────┐
│ PostgreSQL  │    │ Redis       │              │ Ollama      │
│ 188:5432    │    │ 188:6380    │              │ 188:11434   │
│ (Host)      │    │ (Docker)    │              │ (Docker)    │
└─────────────┘    └─────────────┘              └─────────────┘
                                                       │
                                                       ▼
                                               ┌─────────────┐
                                               │ ClawBot     │
                                               │ 188:8089    │
                                               │ (Docker)    │
                                               └─────────────┘

部署位置決策原則

服務類型	建議部署方式	原因
Gateway (Nginx)	Host 直裝	SSL 終止、效能關鍵
資料庫 (PostgreSQL)	Host 直裝	資料持久性、備份策略
AI 服務 (Ollama)	Docker	GPU 資源管理、版本切換
應用服務 (Web/API)	K3s	水平擴展、滾動更新
快取 (Redis)	Docker	簡易管理、資料可失
監控 (SigNoz)	Docker	獨立運行、不影響業務

K8s 資源配置

Namespace 資源配額

# k8s/awoooi-prod/01-namespace-quota.yaml
apiVersion: v1
kind: Namespace
metadata:
  name: awoooi-prod
  labels:
    environment: prod
    system: awoooi
---
apiVersion: v1
kind: ResourceQuota
metadata:
  name: awoooi-prod-quota
  namespace: awoooi-prod
spec:
  hard:
    requests.cpu: "4"
    requests.memory: 8Gi
    limits.cpu: "8"
    limits.memory: 16Gi
    pods: "20"

零信任網路策略

# k8s/awoooi-prod/02-network-policy.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: prod-isolation-policy
  namespace: awoooi-prod
spec:
  podSelector: {}
  policyTypes:
    - Ingress
    - Egress
  ingress:
    # 僅允許來自 Nginx Gateway (188) 的流量
    - from:
        - ipBlock:
            cidr: 192.168.0.188/32
      ports:
        - protocol: TCP
          port: 3000
        - protocol: TCP
          port: 8000
  egress:
    # 允許訪問 188 主機服務
    - to:
        - ipBlock:
            cidr: 192.168.0.188/32
      ports:
        - protocol: TCP
          port: 5432   # PostgreSQL
        - protocol: TCP
          port: 6380   # Redis
        - protocol: TCP
          port: 11434  # Ollama
        - protocol: TCP
          port: 8089   # ClawBot
    # 允許訪問 112 安全掃描
    - to:
        - ipBlock:
            cidr: 192.168.0.112/32
      ports:
        - protocol: TCP
          port: 8080
    # 允許 DNS
    - to:
        - namespaceSelector: {}
          podSelector:
            matchLabels:
              k8s-app: kube-dns
      ports:
        - protocol: UDP
          port: 53

Nginx 正式環境路由

# /etc/nginx/conf.d/awoooi-prod.conf

upstream awoooi_prod_api {
    server 192.168.0.120:32334;
    server 192.168.0.121:32334;
    keepalive 32;
}

upstream awoooi_prod_web {
    server 192.168.0.120:32335;
    server 192.168.0.121:32335;
    keepalive 16;
}

server {
    listen 443 ssl http2;
    server_name awoooi.wooo.work;

    ssl_certificate /etc/nginx/ssl/awoooi.crt;
    ssl_certificate_key /etc/nginx/ssl/awoooi.key;

    # 系統標識
    proxy_set_header X-System "awoooi-prod";

    # SSE 串流優化 (關鍵！)
    location ~ ^/api/v1/(agent|dashboard)/stream {
        proxy_pass http://awoooi_prod_api;
        proxy_buffering off;
        proxy_read_timeout 3600s;
        proxy_send_timeout 3600s;
        proxy_set_header Connection '';
        proxy_http_version 1.1;
        chunked_transfer_encoding on;
        proxy_set_header X-Accel-Buffering no;
    }

    # 一般 API
    location /api/ {
        proxy_pass http://awoooi_prod_api;
        proxy_http_version 1.1;
        proxy_set_header Connection "keep-alive";
    }

    # 前端
    location / {
        proxy_pass http://awoooi_prod_web;
        proxy_http_version 1.1;
    }

    # 共用 Headers
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
}

服務啟動順序

1. 192.168.0.188 (Host 服務)
   └─ systemctl start nginx
   └─ systemctl start postgresql

2. 192.168.0.188 (Docker 服務)
   └─ docker-compose up -d redis-stack
   └─ docker-compose up -d ollama
   └─ docker-compose up -d clawbot-awoooi
   └─ docker-compose up -d signoz

3. 192.168.0.110 (DevOps)
   └─ docker-compose up -d harbor
   └─ docker-compose up -d gh-runner

4. 192.168.0.112 (Security)
   └─ docker-compose up -d scanner-api

5. 192.168.0.120/121 (K3s)
   └─ kubectl apply -f k8s/awoooi-prod/

驗證清單

# 1. 驗證 Host 服務
systemctl status nginx
systemctl status postgresql
psql -U postgres -c "SELECT 1"

# 2. 驗證 Docker 服務 (188)
docker ps | grep -E "(ollama|clawbot|redis|signoz)"
curl http://localhost:11434/api/tags
curl http://localhost:8089/health
redis-cli -p 6380 PING

# 3. 驗證 K3s 服務
kubectl get pods -n awoooi-prod
kubectl get svc -n awoooi-prod
curl http://192.168.0.120:32334/health
curl http://192.168.0.120:32335

# 4. 驗證 Nginx 路由
curl -k https://awoooi.wooo.work/api/health
curl -k https://awoooi.wooo.work/

變更記錄

日期	版本	變更	作者
2026-03-20	v1.0	初版建立，明確定義部署位置	CIO

此文件由 CIO 維護，所有服務部署必須遵守此拓撲定義。

18 KiB Raw Blame History Unescape Escape

AWOOOI 部署拓撲與服務位置定義

概述

四主機部署總覽

服務部署位置詳細定義

192.168.0.110 (DevOps 金庫)

192.168.0.112 (Kali Security)

192.168.0.188 (AI + Web 中心)

Nginx (Host 直裝)

PostgreSQL (Host 直裝)

Docker 服務

192.168.0.120 / 121 (K3s 叢集)

K3s Namespace 定義

AWOOOI 服務 (K3s)

環境對照表 (最終版)

網路流量走向

部署位置決策原則

K8s 資源配置

Namespace 資源配額

零信任網路策略

Nginx 正式環境路由

服務啟動順序

驗證清單

變更記錄

18 KiB

Raw Blame History