9b5e5b5710
Add an "API Keys" page to the buyer SPA (marketplace.vector.apexfusion.org) that mints a custodial gateway API key by POSTing directly to the gateway's public /signup, then shows the key once + deposit address + a base_url/curl usage snippet. Page lives behind the SPA's existing operator login; per-user registration is a later feature. Gateway: - GATEWAY_CORS_ORIGINS env -> corsOrigins allowlist; corsMiddleware echoes Access-Control-* only for allowlisted Origins, answers OPTIONS preflight 204, no credentials. Empty allowlist = CORS off (default safe). Buyer: - GATEWAY_PUBLIC_URL env -> injected into __BUYER_BOOT__.gatewayUrl (only in the authenticated boot block). SPA resolveGatewayUrl() falls back to deriving "api." + location.host so the post-login-no-reload case (boot block absent) still works. - New ApiKeys page + /api-keys route + nav link. Deploy (mainnet compose): gateway GATEWAY_CORS_ORIGINS and buyer GATEWAY_PUBLIC_URL set to the marketplace/api hosts. NOTE: both images must be REBUILT (gateway runs tsx from copied source; buyer SPA is vite-built at image build) — an env-only recreate would silently ship the old code. Typecheck + vite build clean; 205 tests pass. Adversarial multi-agent review (4 dimensions, per-finding verification) surfaced only the rebuild-required deploy note above; no code/security defects. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
71 lines
2.6 KiB
YAML
71 lines
2.6 KiB
YAML
# deploy/mainnet/docker-compose.buyer.yml — Buyer (Express + Vite UI) — MAINNET
|
|
#
|
|
# Brought up on vector-marketplace at https://marketplace.vector.apexfusion.org.
|
|
# Operator login is gated by BUYER_PASSWORD + SESSION_SECRET (see buyer/.env).
|
|
#
|
|
# Code-level mainnet safety (env-gate / wallet allowlist / MAINNET=1 flag,
|
|
# tracked in ARCHITECTURE.md §9 #5) is still a separate open follow-up.
|
|
|
|
name: marketplace-mainnet-buyer
|
|
|
|
services:
|
|
buyer:
|
|
build:
|
|
context: ../..
|
|
dockerfile: buyer/Dockerfile
|
|
container_name: marketplace-mainnet-buyer
|
|
restart: unless-stopped
|
|
env_file:
|
|
- path: ../../buyer/.env
|
|
required: false
|
|
environment:
|
|
INDEXER_URL: http://marketplace-mainnet-indexer:8090
|
|
BUYER_PORT: "8070"
|
|
# PiperTTS demo (Path B): direct-proxy target for /v1/synth-speech. Piper is
|
|
# private on marketplace-mainnet-net (no public host), so use internal DNS.
|
|
# Without this the demo TTS tile 503s ("booted without TTS_PIPER_BASE_URL").
|
|
TTS_PIPER_BASE_URL: http://marketplace-mainnet-tts-piper:8000
|
|
# Pin the archive dir so it lands on the persistent volume below — keeps
|
|
# the response archive + PDF job store (past summaries) across container
|
|
# recreation/redeploys.
|
|
ARCHIVE_DIR: /repo/data/archive
|
|
# Public base URL of the OpenAI gateway, surfaced to the SPA boot block so
|
|
# the "API Keys" page can POST cross-origin to ${gatewayUrl}/signup. The
|
|
# gateway must CORS-allow https://marketplace.vector.apexfusion.org (see
|
|
# GATEWAY_CORS_ORIGINS in docker-compose.gateway.yml).
|
|
GATEWAY_PUBLIC_URL: https://api.marketplace.vector.apexfusion.org
|
|
# NETWORK_ID intentionally not pinned — see supplier compose comment.
|
|
volumes:
|
|
- buyer-mainnet-archive:/repo/data/archive
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "wget -qO- http://localhost:8070/healthz >/dev/null || exit 1"]
|
|
interval: 20s
|
|
timeout: 5s
|
|
retries: 3
|
|
start_period: 15s
|
|
networks:
|
|
- marketplace-mainnet-net
|
|
- traefik-net
|
|
labels:
|
|
- "traefik.enable=true"
|
|
- "traefik.docker.network=traefik-net"
|
|
- "traefik.http.routers.mp-buyer-mainnet.entrypoints=web"
|
|
- "traefik.http.routers.mp-buyer-mainnet.rule=Host(`marketplace.vector.apexfusion.org`)"
|
|
- "traefik.http.services.mp-buyer-mainnet.loadbalancer.server.port=8070"
|
|
logging:
|
|
driver: json-file
|
|
options:
|
|
max-size: "10m"
|
|
max-file: "3"
|
|
|
|
networks:
|
|
marketplace-mainnet-net:
|
|
external: true
|
|
name: marketplace-mainnet-net
|
|
traefik-net:
|
|
external: true
|
|
name: traefik-net
|
|
|
|
volumes:
|
|
buyer-mainnet-archive:
|