019766ab8d
The tailnet account changed (caslav.nedeljkovic@ to teamhaleight@, taild99fee.ts.net) and all device IPs were reassigned, breaking both inference-proxy suppliers' hardcoded backend addresses. - supplier-local: vuk llama.cpp 100.82.111.46 to 100.77.146.49. - supplier-openclaw: the openclaw gateway is now exposed via Tailscale Serve (David's reconfigure set gateway.tailscale.mode=serve, which forces bind=loopback). Switch OPENAI_BASE_URL from the old raw http endpoint to https://web-tools.taild99fee.ts.net, and pin that MagicDNS name to web-tools' tailnet IP (100.105.36.0) via extra_hosts (Serve's TLS cert is for the hostname, and containers don't inherit the host tailscale MagicDNS). - README: new account/IP table, Serve config (replaces the tailnet-bind section), reachability check (the old ACL blocker is gone), updated probe/runbook. Verified: authenticated turn to the Serve endpoint from inference-proxy returns a completion; vuk:8002 reachable from inference-proxy. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
100 lines
4.8 KiB
YAML
100 lines
4.8 KiB
YAML
# deploy/inference-proxy/docker-compose.supplier-local.yml — Supplier — MAINNET
|
|
# (local llama.cpp on `vuk` via tailscale — chat-session `llm.chat.v1`)
|
|
#
|
|
# Runs on the inference-proxy box (62.238.38.167), NOT the main marketplace
|
|
# box. The compute backend is a llama.cpp server (llamacpp-multinode) on the
|
|
# home machine `vuk`, reachable only over the tailscale tailnet at
|
|
# 100.77.146.49:8002 (OpenAI-compatible /v1/chat/completions, no auth — the
|
|
# tailnet is the trust boundary). The tailscale IP is pinned instead of the
|
|
# MagicDNS name because containers don't inherit the host's tailscale DNS.
|
|
# (Tailnet `taild99fee.ts.net`, account teamhaleight@; vuk's IP was
|
|
# 100.82.111.46 on the previous tailnet — update here if the tailnet changes.)
|
|
#
|
|
# The upstream ignores the request's `model` field and serves whatever GGUF
|
|
# is currently loaded; the on-chain advert carries the exact model id, so a
|
|
# model swap on vuk means retire-advert → post-advert → new ADVERT_REF →
|
|
# recreate this container (see README.md).
|
|
#
|
|
# Pre-flight:
|
|
# 1. DNS: mp-suppliers-local.vector.apexfusion.org → 62.238.38.167
|
|
# (individual DNS-only A record; letsencrypt HTTP-01 issuance needs the
|
|
# unproxied direct record)
|
|
# 2. supplier/.env.local written on host (chmod 600) with at minimum:
|
|
# SUPPLIER_PRIV_KEY_HEX, SUPPLIER_ADDRESS, SUPPLIER_PKH,
|
|
# SUPPLIER_PUB_KEY_HEX, OGMIOS_URL, NETWORK_ID=1,
|
|
# VECTOR_ZERO_TIME_MS, ESCROW_REF_UTXO, ADVERT_REF_UTXO, ADVERT_REF,
|
|
# LIVE_CHAIN=1
|
|
# (no OPENAI_API_KEY — vuk's endpoint is unauthenticated)
|
|
# 3. Networks: traefik-net is created one-shot (see the traefik compose in
|
|
# this directory). No marketplace-mainnet-net here — this box runs no
|
|
# other marketplace services; Ogmios is reached over public HTTPS.
|
|
|
|
name: marketplace-mainnet-supplier-local
|
|
|
|
services:
|
|
supplier:
|
|
build:
|
|
context: ../..
|
|
dockerfile: supplier/Dockerfile
|
|
container_name: marketplace-mainnet-supplier-local
|
|
restart: unless-stopped
|
|
env_file:
|
|
# Self-contained env for this supplier: wallet identity, ADVERT_REF,
|
|
# and the shared mainnet plumbing duplicated in full (NETWORK_ID,
|
|
# OGMIOS_URL, VECTOR_ZERO_TIME_MS, ref-script UTxOs, LIVE_CHAIN).
|
|
- path: ../../supplier/.env.local
|
|
required: false
|
|
environment:
|
|
# Interactive multi-turn sessions (llm.chat.v1). Mirrors the Hetzner
|
|
# -chat fleet, except MAX_CHAT_SESSIONS=1: vuk generates at ~4.5 tok/s
|
|
# on a single slot, so one session owns the rig at a time.
|
|
CAPABILITY_KIND: chat-session
|
|
CHAT_IDLE_TIMEOUT_MS: "900000"
|
|
CHAT_SETTLE_MODE: ticket
|
|
MAX_CHAT_SESSIONS: "1"
|
|
LLM_BACKEND: openai
|
|
# No /v1 suffix — supplier/src/openai.ts appends /v1/chat/completions.
|
|
# vuk's tailscale IP; see header for why not the MagicDNS name.
|
|
OPENAI_BASE_URL: http://100.77.146.49:8002
|
|
# ~4.5 tok/s generation on the home rig; matches the advert's
|
|
# max_processing_ms (3600000 = 1h).
|
|
OPENAI_TIMEOUT_MS: "3600000"
|
|
# OPENAI_MAX_TOKENS intentionally unset: no max_tokens forwarded
|
|
# upstream; llama.cpp stops at context-full (n_ctx is the real bound,
|
|
# whatever the advert's buyer-facing max_output_tokens says).
|
|
PORT: "8080"
|
|
# Enable LiveOgmiosProvider so submitTx/awaitTx actually broadcast.
|
|
LIVE_CHAIN: "1"
|
|
# NETWORK_ID and OGMIOS_URL intentionally not pinned here — they MUST
|
|
# come from the operator-provided supplier/.env.local on a mainnet host.
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "wget -qO- http://localhost:8080/healthz >/dev/null || exit 1"]
|
|
interval: 20s
|
|
timeout: 5s
|
|
retries: 3
|
|
start_period: 15s
|
|
networks:
|
|
- traefik-net
|
|
labels:
|
|
- "traefik.enable=true"
|
|
- "traefik.docker.network=traefik-net"
|
|
- "traefik.http.routers.mp-suppliers-local-mainnet.entrypoints=web"
|
|
- "traefik.http.routers.mp-suppliers-local-mainnet.rule=Host(`mp-suppliers-local.vector.apexfusion.org`)"
|
|
- "traefik.http.routers.mp-suppliers-local-mainnet.middlewares=mp-suppliers-local-mainnet-https"
|
|
- "traefik.http.middlewares.mp-suppliers-local-mainnet-https.redirectscheme.scheme=https"
|
|
- "traefik.http.middlewares.mp-suppliers-local-mainnet-https.redirectscheme.permanent=true"
|
|
- "traefik.http.routers.mp-suppliers-local-mainnet-tls.entrypoints=websecure"
|
|
- "traefik.http.routers.mp-suppliers-local-mainnet-tls.rule=Host(`mp-suppliers-local.vector.apexfusion.org`)"
|
|
- "traefik.http.routers.mp-suppliers-local-mainnet-tls.tls.certresolver=letsencrypt"
|
|
- "traefik.http.services.mp-suppliers-local-mainnet.loadbalancer.server.port=8080"
|
|
logging:
|
|
driver: json-file
|
|
options:
|
|
max-size: "10m"
|
|
max-file: "3"
|
|
|
|
networks:
|
|
traefik-net:
|
|
external: true
|
|
name: traefik-net
|