69 lines
3.3 KiB
YAML
69 lines
3.3 KiB
YAML
|
service:
|
||
|
|
name: ai-cluster
|
||
|
|
owner_node: solaria
|
||
|
|
exposure: tailscale-internal
|
||
|
|
dependencies:
|
||
|
|
- mosquitto
|
||
|
|
- redis
|
||
|
|
ports:
|
||
|
|
- container: 8000
|
||
|
|
host: 8000
|
||
|
|
protocol: tcp
|
||
|
|
bind: 100.100.231.104 # SOLARIA Tailscale IP — NPM@VPS proxies here
|
||
|
|
service: openclaw
|
||
|
|
- container: 1883
|
||
|
|
host: 1883
|
||
|
|
protocol: tcp
|
||
|
|
bind: 100.100.231.104 # SOLARIA Tailscale IP
|
||
|
|
service: mosquitto
|
||
|
|
healthcheck:
|
||
|
|
type: http
|
||
|
|
endpoint: http://100.100.231.104:8000/health
|
||
|
|
interval: 30s
|
||
|
|
timeout: 10s
|
||
|
|
retries: 3
|
||
|
|
restart_policy: unless-stopped
|
||
|
|
persistence:
|
||
|
|
paths:
|
||
|
|
- /opt/homelab/config/ai-cluster/mosquitto # mosquitto.conf + acl + passwd (passwd is node-local)
|
||
|
|
- volume:redis_data
|
||
|
|
runtime:
|
||
|
|
env_file: /opt/homelab/config/ai-cluster/.env
|
||
|
|
env_vars:
|
||
|
|
- MQTT_USERNAME
|
||
|
|
- MQTT_PASSWORD
|
||
|
|
- GATEWAY_BASE_URL
|
||
|
|
notes:
|
||
|
|
- "Target node is SOLARIA. The stack still runs on the VPS at
|
||
|
|
/home/dockeruser/docker/ai-cluster/ outside GitOps; this manifest is the
|
||
|
|
authored target, cutover is NOT done. See CUTOVER.md."
|
||
|
|
- "Images are built on the node from src/ — nothing is pulled from a registry.
|
||
|
|
Build contexts: src/openclaw (openclaw), src/worker (codex-worker,
|
||
|
|
planner-worker, service-ops-worker via three Dockerfiles)."
|
||
|
|
- "The VPS directory also contains codex-worker/worker.py — a 609-byte prototype
|
||
|
|
using `requests` (not in any requirements.txt), with no Dockerfile and no
|
||
|
|
compose reference. It is dead code, not a second build context, and was
|
||
|
|
deliberately not carried into src/. The real codex-worker builds from
|
||
|
|
src/worker/Dockerfile."
|
||
|
|
- "telegram-bot is NOT part of this stack: the service exists in the VPS compose
|
||
|
|
file but no container runs. src/openclaw/telegram_bot.py is still shipped
|
||
|
|
because openclaw/Dockerfile COPYs it into the openclaw image (the build
|
||
|
|
fails without it); Dockerfile.telegram + requirements-telegram.txt are kept
|
||
|
|
so the service can be re-enabled later without another recon round."
|
||
|
|
- "GATEWAY_BASE_URL must be an IP, not `piha`. Tailscale DNS is disabled on
|
||
|
|
SOLARIA (`tailscale dns status` → 'Tailscale DNS: disabled'), so neither
|
||
|
|
`piha` nor `piha.tailedf7b1.ts.net` resolves. Verified 2026-07-27 that bare
|
||
|
|
`piha` does not resolve on the VPS either — the original default
|
||
|
|
http://piha:8080 was already dead there. Default is now
|
||
|
|
http://100.108.208.3:8080 (port confirmed open from SOLARIA)."
|
||
|
|
- "AGENT_ID values stay `vps-dev-1` / `vps-planner-1` / `vps-service-ops-1` after
|
||
|
|
the move. They are MQTT routing targets, not hostnames — renaming them breaks
|
||
|
|
any producer addressing a specific agent. Rename is a separate coordinated change."
|
||
|
|
- "service-ops-worker mounts /var/run/docker.sock read-write. On SOLARIA that means
|
||
|
|
it can restart any container on the node, including ollama and other GPU
|
||
|
|
workloads — a wider blast radius than on the VPS. Its allowlist
|
||
|
|
(is_allowed_command) limits it to ps/inspect/logs/restart, but this is worth a
|
||
|
|
security review before cutover."
|
||
|
|
- "mem_limits live in hosts/solaria/runtime/ai-cluster/docker-compose.override.yml,
|
||
|
|
sized from measured RSS on the VPS (workers 7-10 MiB, openclaw 25 MiB)."
|