Initial commit: breakpilot-compliance - Compliance SDK Platform
Services: Admin-Compliance, Backend-Compliance, AI-Compliance-SDK, Consent-SDK, Developer-Portal, PCA-Platform, DSMS Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Benjamin Boenisch
328
breakpilot-compliance-sdk/hardware/mac-studio/docker-compose.yml
Normal file
328
breakpilot-compliance-sdk/hardware/mac-studio/docker-compose.yml
Normal file
@@ -0,0 +1,328 @@
|
||||
# BreakPilot Compliance SDK - Mac Studio Deployment
|
||||
# Hardware: Mac Studio M2 Ultra, 512GB RAM
|
||||
# LLM: Qwen 2.5 40B via Ollama
|
||||
# Enterprise/Airgapped deployment
|
||||
|
||||
version: '3.8'
|
||||
|
||||
services:
|
||||
# =============================================================================
|
||||
# API Gateway (HA with load balancing)
|
||||
# =============================================================================
|
||||
api-gateway:
|
||||
image: ghcr.io/breakpilot/compliance-sdk-gateway:latest
|
||||
build:
|
||||
context: ../../services/api-gateway
|
||||
dockerfile: Dockerfile
|
||||
deploy:
|
||||
replicas: 2
|
||||
resources:
|
||||
limits:
|
||||
cpus: '4'
|
||||
memory: 8G
|
||||
ports:
|
||||
- "443:8080"
|
||||
- "80:8080"
|
||||
environment:
|
||||
- ENVIRONMENT=production
|
||||
- PORT=8080
|
||||
- DATABASE_URL=postgres://breakpilot:${DB_PASSWORD:-breakpilot}@postgres:5432/compliance
|
||||
- REDIS_URL=redis://redis:6379
|
||||
- JWT_SECRET=${JWT_SECRET}
|
||||
- COMPLIANCE_ENGINE_URL=http://compliance-engine:8081
|
||||
- RAG_SERVICE_URL=http://rag-service:8082
|
||||
- SECURITY_SCANNER_URL=http://security-scanner:8083
|
||||
- MINIO_ENDPOINT=minio:9000
|
||||
- MINIO_ACCESS_KEY=${MINIO_ACCESS_KEY:-breakpilot}
|
||||
- MINIO_SECRET_KEY=${MINIO_SECRET_KEY}
|
||||
depends_on:
|
||||
- postgres
|
||||
- redis
|
||||
- compliance-engine
|
||||
- rag-service
|
||||
restart: unless-stopped
|
||||
networks:
|
||||
- compliance-net
|
||||
healthcheck:
|
||||
test: ["CMD", "wget", "-q", "--spider", "http://localhost:8080/health"]
|
||||
interval: 10s
|
||||
timeout: 5s
|
||||
retries: 5
|
||||
|
||||
# =============================================================================
|
||||
# Compliance Engine (HA)
|
||||
# =============================================================================
|
||||
compliance-engine:
|
||||
image: ghcr.io/breakpilot/compliance-engine:latest
|
||||
build:
|
||||
context: ../../services/compliance-engine
|
||||
dockerfile: Dockerfile
|
||||
deploy:
|
||||
replicas: 2
|
||||
resources:
|
||||
limits:
|
||||
cpus: '2'
|
||||
memory: 4G
|
||||
environment:
|
||||
- ENVIRONMENT=production
|
||||
- PORT=8081
|
||||
- DATABASE_URL=postgres://breakpilot:${DB_PASSWORD:-breakpilot}@postgres:5432/compliance
|
||||
depends_on:
|
||||
- postgres
|
||||
restart: unless-stopped
|
||||
networks:
|
||||
- compliance-net
|
||||
|
||||
# =============================================================================
|
||||
# RAG Service (High memory for large models)
|
||||
# =============================================================================
|
||||
rag-service:
|
||||
image: ghcr.io/breakpilot/rag-service:latest
|
||||
build:
|
||||
context: ../../services/rag-service
|
||||
dockerfile: Dockerfile
|
||||
deploy:
|
||||
resources:
|
||||
limits:
|
||||
cpus: '8'
|
||||
memory: 32G
|
||||
environment:
|
||||
- ENVIRONMENT=production
|
||||
- PORT=8082
|
||||
- QDRANT_URL=http://qdrant:6333
|
||||
- OLLAMA_URL=http://host.docker.internal:11434
|
||||
- EMBEDDING_MODEL=bge-m3
|
||||
- LLM_MODEL=qwen2.5:40b
|
||||
depends_on:
|
||||
- qdrant
|
||||
restart: unless-stopped
|
||||
networks:
|
||||
- compliance-net
|
||||
extra_hosts:
|
||||
- "host.docker.internal:host-gateway"
|
||||
|
||||
# =============================================================================
|
||||
# Security Scanner
|
||||
# =============================================================================
|
||||
security-scanner:
|
||||
image: ghcr.io/breakpilot/security-scanner:latest
|
||||
build:
|
||||
context: ../../services/security-scanner
|
||||
dockerfile: Dockerfile
|
||||
deploy:
|
||||
resources:
|
||||
limits:
|
||||
cpus: '4'
|
||||
memory: 8G
|
||||
environment:
|
||||
- ENVIRONMENT=production
|
||||
- PORT=8083
|
||||
volumes:
|
||||
- /var/run/docker.sock:/var/run/docker.sock:ro
|
||||
- scan-data:/app/scans
|
||||
restart: unless-stopped
|
||||
networks:
|
||||
- compliance-net
|
||||
|
||||
# =============================================================================
|
||||
# PostgreSQL Database (High Performance)
|
||||
# =============================================================================
|
||||
postgres:
|
||||
image: postgres:16-alpine
|
||||
deploy:
|
||||
resources:
|
||||
limits:
|
||||
cpus: '4'
|
||||
memory: 16G
|
||||
environment:
|
||||
- POSTGRES_USER=breakpilot
|
||||
- POSTGRES_PASSWORD=${DB_PASSWORD}
|
||||
- POSTGRES_DB=compliance
|
||||
- POSTGRES_INITDB_ARGS=--encoding=UTF-8 --lc-collate=en_US.utf8 --lc-ctype=en_US.utf8
|
||||
command:
|
||||
- "postgres"
|
||||
- "-c"
|
||||
- "max_connections=200"
|
||||
- "-c"
|
||||
- "shared_buffers=4GB"
|
||||
- "-c"
|
||||
- "effective_cache_size=12GB"
|
||||
- "-c"
|
||||
- "maintenance_work_mem=1GB"
|
||||
- "-c"
|
||||
- "checkpoint_completion_target=0.9"
|
||||
- "-c"
|
||||
- "wal_buffers=64MB"
|
||||
- "-c"
|
||||
- "random_page_cost=1.1"
|
||||
volumes:
|
||||
- postgres-data:/var/lib/postgresql/data
|
||||
- ../mac-mini/init-db.sql:/docker-entrypoint-initdb.d/init.sql:ro
|
||||
- ./pg-backup:/backup
|
||||
ports:
|
||||
- "5432:5432"
|
||||
restart: unless-stopped
|
||||
networks:
|
||||
- compliance-net
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "pg_isready -U breakpilot"]
|
||||
interval: 10s
|
||||
timeout: 5s
|
||||
retries: 5
|
||||
|
||||
# =============================================================================
|
||||
# Redis Cluster
|
||||
# =============================================================================
|
||||
redis:
|
||||
image: redis:7-alpine
|
||||
deploy:
|
||||
resources:
|
||||
limits:
|
||||
cpus: '2'
|
||||
memory: 4G
|
||||
command: redis-server --appendonly yes --maxmemory 3gb --maxmemory-policy allkeys-lru
|
||||
volumes:
|
||||
- redis-data:/data
|
||||
ports:
|
||||
- "6379:6379"
|
||||
restart: unless-stopped
|
||||
networks:
|
||||
- compliance-net
|
||||
healthcheck:
|
||||
test: ["CMD", "redis-cli", "ping"]
|
||||
interval: 10s
|
||||
timeout: 5s
|
||||
retries: 5
|
||||
|
||||
# =============================================================================
|
||||
# Qdrant Vector Database (High Performance)
|
||||
# =============================================================================
|
||||
qdrant:
|
||||
image: qdrant/qdrant:v1.12.1
|
||||
deploy:
|
||||
resources:
|
||||
limits:
|
||||
cpus: '4'
|
||||
memory: 32G
|
||||
volumes:
|
||||
- qdrant-data:/qdrant/storage
|
||||
- ./qdrant-config.yaml:/qdrant/config/production.yaml:ro
|
||||
ports:
|
||||
- "6333:6333"
|
||||
- "6334:6334"
|
||||
restart: unless-stopped
|
||||
networks:
|
||||
- compliance-net
|
||||
environment:
|
||||
- QDRANT__SERVICE__GRPC_PORT=6334
|
||||
|
||||
# =============================================================================
|
||||
# MinIO Object Storage (HA)
|
||||
# =============================================================================
|
||||
minio:
|
||||
image: minio/minio:latest
|
||||
deploy:
|
||||
resources:
|
||||
limits:
|
||||
cpus: '2'
|
||||
memory: 8G
|
||||
command: server /data --console-address ":9001"
|
||||
environment:
|
||||
- MINIO_ROOT_USER=${MINIO_ACCESS_KEY:-breakpilot}
|
||||
- MINIO_ROOT_PASSWORD=${MINIO_SECRET_KEY}
|
||||
volumes:
|
||||
- minio-data:/data
|
||||
ports:
|
||||
- "9000:9000"
|
||||
- "9001:9001"
|
||||
restart: unless-stopped
|
||||
networks:
|
||||
- compliance-net
|
||||
healthcheck:
|
||||
test: ["CMD", "curl", "-f", "http://localhost:9000/minio/health/live"]
|
||||
interval: 30s
|
||||
timeout: 20s
|
||||
retries: 3
|
||||
|
||||
# =============================================================================
|
||||
# Backup Service
|
||||
# =============================================================================
|
||||
backup:
|
||||
image: postgres:16-alpine
|
||||
environment:
|
||||
- PGHOST=postgres
|
||||
- PGUSER=breakpilot
|
||||
- PGPASSWORD=${DB_PASSWORD}
|
||||
- PGDATABASE=compliance
|
||||
volumes:
|
||||
- ./pg-backup:/backup
|
||||
- ./backup.sh:/backup.sh:ro
|
||||
entrypoint: ["/bin/sh", "-c", "while true; do /backup.sh; sleep 86400; done"]
|
||||
depends_on:
|
||||
- postgres
|
||||
restart: unless-stopped
|
||||
networks:
|
||||
- compliance-net
|
||||
|
||||
# =============================================================================
|
||||
# Monitoring (Prometheus + Grafana)
|
||||
# =============================================================================
|
||||
prometheus:
|
||||
image: prom/prometheus:v2.48.0
|
||||
volumes:
|
||||
- ./prometheus.yml:/etc/prometheus/prometheus.yml:ro
|
||||
- prometheus-data:/prometheus
|
||||
command:
|
||||
- '--config.file=/etc/prometheus/prometheus.yml'
|
||||
- '--storage.tsdb.path=/prometheus'
|
||||
- '--storage.tsdb.retention.time=30d'
|
||||
ports:
|
||||
- "9090:9090"
|
||||
restart: unless-stopped
|
||||
networks:
|
||||
- compliance-net
|
||||
|
||||
grafana:
|
||||
image: grafana/grafana:10.2.2
|
||||
environment:
|
||||
- GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_PASSWORD:-admin}
|
||||
- GF_INSTALL_PLUGINS=grafana-clock-panel,grafana-piechart-panel
|
||||
volumes:
|
||||
- grafana-data:/var/lib/grafana
|
||||
- ./grafana-dashboards:/etc/grafana/provisioning/dashboards:ro
|
||||
ports:
|
||||
- "3000:3000"
|
||||
depends_on:
|
||||
- prometheus
|
||||
restart: unless-stopped
|
||||
networks:
|
||||
- compliance-net
|
||||
|
||||
# =============================================================================
|
||||
# Maintenance Agent
|
||||
# =============================================================================
|
||||
maintenance-agent:
|
||||
image: ghcr.io/breakpilot/maintenance-agent:latest
|
||||
environment:
|
||||
- BREAKPILOT_API_KEY=${MAINTENANCE_API_KEY:-}
|
||||
- DEVICE_ID=${DEVICE_ID:-mac-studio-001}
|
||||
- DEVICE_TYPE=mac-studio
|
||||
volumes:
|
||||
- /var/run/docker.sock:/var/run/docker.sock:ro
|
||||
- ./:/app/deployment:ro
|
||||
restart: unless-stopped
|
||||
networks:
|
||||
- compliance-net
|
||||
|
||||
networks:
|
||||
compliance-net:
|
||||
driver: bridge
|
||||
|
||||
volumes:
|
||||
postgres-data:
|
||||
redis-data:
|
||||
qdrant-data:
|
||||
minio-data:
|
||||
scan-data:
|
||||
prometheus-data:
|
||||
grafana-data:
|
||||
253
breakpilot-compliance-sdk/hardware/mac-studio/setup.sh
Normal file
253
breakpilot-compliance-sdk/hardware/mac-studio/setup.sh
Normal file
@@ -0,0 +1,253 @@
|
||||
#!/bin/bash
|
||||
# BreakPilot Compliance SDK - Mac Studio Setup Script
|
||||
# Hardware: Mac Studio M2 Ultra, 512GB RAM
|
||||
# Enterprise/Airgapped deployment
|
||||
|
||||
set -e
|
||||
|
||||
echo "=============================================="
|
||||
echo "BreakPilot Compliance SDK - Mac Studio Setup"
|
||||
echo "Enterprise Edition"
|
||||
echo "=============================================="
|
||||
|
||||
# Check prerequisites
|
||||
check_prerequisites() {
|
||||
echo "Checking prerequisites..."
|
||||
|
||||
# Check Docker
|
||||
if ! command -v docker &> /dev/null; then
|
||||
echo "Error: Docker is not installed"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Check memory
|
||||
TOTAL_MEM=$(sysctl -n hw.memsize)
|
||||
TOTAL_MEM_GB=$((TOTAL_MEM / 1024 / 1024 / 1024))
|
||||
|
||||
if [ "$TOTAL_MEM_GB" -lt 256 ]; then
|
||||
echo "Warning: This setup is optimized for 512GB RAM"
|
||||
echo "Current memory: ${TOTAL_MEM_GB}GB"
|
||||
read -p "Continue anyway? (y/N) " -n 1 -r
|
||||
echo
|
||||
if [[ ! $REPLY =~ ^[Yy]$ ]]; then
|
||||
exit 1
|
||||
fi
|
||||
fi
|
||||
|
||||
# Check Ollama
|
||||
if ! command -v ollama &> /dev/null; then
|
||||
echo "Installing Ollama..."
|
||||
curl -fsSL https://ollama.com/install.sh | sh
|
||||
fi
|
||||
|
||||
echo "Prerequisites OK"
|
||||
}
|
||||
|
||||
# Configure Docker for enterprise
|
||||
configure_docker() {
|
||||
echo "Configuring Docker for enterprise deployment..."
|
||||
|
||||
echo ""
|
||||
echo "Please ensure Docker Desktop is configured with:"
|
||||
echo " - Memory: 256 GB (recommended)"
|
||||
echo " - CPUs: 20+ (recommended)"
|
||||
echo " - Disk: 500 GB (minimum)"
|
||||
echo ""
|
||||
read -p "Press Enter when Docker is configured..."
|
||||
}
|
||||
|
||||
# Install LLM models
|
||||
install_models() {
|
||||
echo "Installing LLM models..."
|
||||
|
||||
# Pull embedding model
|
||||
echo "Pulling embedding model (bge-m3)..."
|
||||
ollama pull bge-m3
|
||||
|
||||
# Pull main LLM (larger model for Mac Studio)
|
||||
echo "Pulling Qwen 2.5 40B (this will take a while)..."
|
||||
ollama pull qwen2.5:40b
|
||||
|
||||
echo "Models installed successfully"
|
||||
}
|
||||
|
||||
# Create environment file
|
||||
create_env_file() {
|
||||
echo "Creating environment file..."
|
||||
|
||||
if [ -f .env ]; then
|
||||
echo ".env file already exists"
|
||||
read -p "Overwrite? (y/N) " -n 1 -r
|
||||
echo
|
||||
if [[ ! $REPLY =~ ^[Yy]$ ]]; then
|
||||
return
|
||||
fi
|
||||
fi
|
||||
|
||||
# Generate strong secrets
|
||||
JWT_SECRET=$(openssl rand -hex 64)
|
||||
DB_PASSWORD=$(openssl rand -hex 32)
|
||||
MINIO_SECRET=$(openssl rand -hex 32)
|
||||
GRAFANA_PASSWORD=$(openssl rand -base64 24)
|
||||
|
||||
cat > .env << EOF
|
||||
# BreakPilot Compliance SDK - Enterprise Environment Configuration
|
||||
# Mac Studio M2 Ultra
|
||||
# Generated on $(date)
|
||||
|
||||
# Database
|
||||
DB_PASSWORD=${DB_PASSWORD}
|
||||
|
||||
# JWT (64 bytes for enterprise)
|
||||
JWT_SECRET=${JWT_SECRET}
|
||||
|
||||
# MinIO
|
||||
MINIO_ACCESS_KEY=breakpilot
|
||||
MINIO_SECRET_KEY=${MINIO_SECRET}
|
||||
|
||||
# Grafana
|
||||
GRAFANA_PASSWORD=${GRAFANA_PASSWORD}
|
||||
|
||||
# Maintenance
|
||||
MAINTENANCE_API_KEY=
|
||||
DEVICE_ID=mac-studio-$(hostname | tr '[:upper:]' '[:lower:]')
|
||||
EOF
|
||||
|
||||
chmod 600 .env
|
||||
echo ".env file created with secure permissions"
|
||||
}
|
||||
|
||||
# Create supporting files
|
||||
create_config_files() {
|
||||
echo "Creating configuration files..."
|
||||
|
||||
# Qdrant config
|
||||
cat > qdrant-config.yaml << 'EOF'
|
||||
storage:
|
||||
storage_path: /qdrant/storage
|
||||
snapshots_path: /qdrant/snapshots
|
||||
|
||||
service:
|
||||
host: 0.0.0.0
|
||||
http_port: 6333
|
||||
grpc_port: 6334
|
||||
|
||||
cluster:
|
||||
enabled: false
|
||||
|
||||
telemetry_disabled: true
|
||||
|
||||
optimizers_config:
|
||||
default_segment_number: 8
|
||||
max_segment_size_kb: 204800
|
||||
memmap_threshold_kb: 51200
|
||||
indexing_threshold_kb: 20000
|
||||
EOF
|
||||
|
||||
# Prometheus config
|
||||
cat > prometheus.yml << 'EOF'
|
||||
global:
|
||||
scrape_interval: 15s
|
||||
evaluation_interval: 15s
|
||||
|
||||
scrape_configs:
|
||||
- job_name: 'prometheus'
|
||||
static_configs:
|
||||
- targets: ['localhost:9090']
|
||||
|
||||
- job_name: 'api-gateway'
|
||||
static_configs:
|
||||
- targets: ['api-gateway:8080']
|
||||
|
||||
- job_name: 'compliance-engine'
|
||||
static_configs:
|
||||
- targets: ['compliance-engine:8081']
|
||||
|
||||
- job_name: 'rag-service'
|
||||
static_configs:
|
||||
- targets: ['rag-service:8082']
|
||||
|
||||
- job_name: 'postgres'
|
||||
static_configs:
|
||||
- targets: ['postgres:5432']
|
||||
|
||||
- job_name: 'redis'
|
||||
static_configs:
|
||||
- targets: ['redis:6379']
|
||||
EOF
|
||||
|
||||
# Backup script
|
||||
cat > backup.sh << 'EOF'
|
||||
#!/bin/sh
|
||||
DATE=$(date +%Y%m%d_%H%M%S)
|
||||
pg_dump -Fc compliance > /backup/compliance_${DATE}.dump
|
||||
find /backup -name "*.dump" -mtime +7 -delete
|
||||
echo "Backup completed: compliance_${DATE}.dump"
|
||||
EOF
|
||||
chmod +x backup.sh
|
||||
|
||||
# Create directories
|
||||
mkdir -p pg-backup grafana-dashboards
|
||||
|
||||
echo "Configuration files created"
|
||||
}
|
||||
|
||||
# Start services
|
||||
start_services() {
|
||||
echo "Starting services..."
|
||||
|
||||
docker compose up -d
|
||||
|
||||
echo "Waiting for services to be ready..."
|
||||
sleep 30
|
||||
|
||||
# Check health
|
||||
echo "Checking service health..."
|
||||
docker compose ps
|
||||
}
|
||||
|
||||
# Print summary
|
||||
print_summary() {
|
||||
echo ""
|
||||
echo "=============================================="
|
||||
echo "Enterprise Setup Complete!"
|
||||
echo "=============================================="
|
||||
echo ""
|
||||
echo "Services:"
|
||||
echo " API Gateway: https://localhost"
|
||||
echo " PostgreSQL: localhost:5432"
|
||||
echo " Redis: localhost:6379"
|
||||
echo " Qdrant: localhost:6333"
|
||||
echo " MinIO Console: http://localhost:9001"
|
||||
echo " Prometheus: http://localhost:9090"
|
||||
echo " Grafana: http://localhost:3000"
|
||||
echo ""
|
||||
echo "LLM Models (via Ollama on host):"
|
||||
echo " Embedding: bge-m3"
|
||||
echo " Chat: qwen2.5:40b (Enterprise)"
|
||||
echo ""
|
||||
echo "Security:"
|
||||
echo " - All secrets stored in .env (chmod 600)"
|
||||
echo " - Database backups: daily, 7-day retention"
|
||||
echo " - Monitoring: Prometheus + Grafana"
|
||||
echo ""
|
||||
echo "Commands:"
|
||||
echo " Start: docker compose up -d"
|
||||
echo " Stop: docker compose down"
|
||||
echo " Logs: docker compose logs -f [service]"
|
||||
echo " Backup: docker compose exec backup /backup.sh"
|
||||
echo ""
|
||||
}
|
||||
|
||||
# Main
|
||||
main() {
|
||||
check_prerequisites
|
||||
configure_docker
|
||||
install_models
|
||||
create_env_file
|
||||
create_config_files
|
||||
start_services
|
||||
print_summary
|
||||
}
|
||||
|
||||
main "$@"
|
||||
Reference in New Issue
Block a user