Step 15: 部署运维 —— 生产就绪¶

# docker-compose.yml
version: '3.8'

services:
  # ───────────────────────────────────────────────────────
  # NuClaw Agent 服务
  # ───────────────────────────────────────────────────────
  nuclaw:
    build:
      context: .
      dockerfile: Dockerfile
      # 构建参数
      args:
        - BUILD_TYPE=Release
    image: nuclaw:latest
    container_name: nuclaw-agent

    # 端口映射
    ports:
      - "8080:8080"    # HTTP 接口
      - "9090:9090"    # Metrics 接口

    # 环境变量
    environment:
      - OPENAI_API_KEY=${OPENAI_API_KEY}
      - LOG_LEVEL=info

    # 数据持久化
    volumes:
      - ./data:/app/data
      - ./logs:/app/logs
      - ./config:/app/config:ro  # 只读挂载

    # 资源限制
    deploy:
      resources:
        limits:
          cpus: '2'
          memory: 2G
        reservations:
          cpus: '0.5'
          memory: 512M

    # 重启策略
    restart: unless-stopped

    # 健康检查
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8080/health"]
      interval: 30s
      timeout: 3s
      retries: 3

    # 网络
    networks:
      - nuclaw-network

    # 依赖（启动顺序）
    depends_on:
      - redis
      - vector-db

  # ───────────────────────────────────────────────────────
  # Redis（会话存储）
  # ───────────────────────────────────────────────────────
  redis:
    image: redis:7-alpine
    container_name: nuclaw-redis
    volumes:
      - redis-data:/data
    networks:
      - nuclaw-network
    restart: unless-stopped

  # ───────────────────────────────────────────────────────
  # Chroma（向量数据库）
  # ───────────────────────────────────────────────────────
  vector-db:
    image: chromadb/chroma:latest
    container_name: nuclaw-chroma
    volumes:
      - chroma-data:/chroma/chroma
    networks:
      - nuclaw-network
    restart: unless-stopped

  # ───────────────────────────────────────────────────────
  # Prometheus（监控）
  # ───────────────────────────────────────────────────────
  prometheus:
    image: prom/prometheus:latest
    container_name: nuclaw-prometheus
    ports:
      - "9091:9090"
    volumes:
      - ./monitoring/prometheus.yml:/etc/prometheus/prometheus.yml:ro
      - prometheus-data:/prometheus
    command:
      - '--config.file=/etc/prometheus/prometheus.yml'
      - '--storage.tsdb.path=/prometheus'
    networks:
      - nuclaw-network
    restart: unless-stopped

  # ───────────────────────────────────────────────────────
  # Grafana（可视化）
  # ───────────────────────────────────────────────────────
  grafana:
    image: grafana/grafana:latest
    container_name: nuclaw-grafana
    ports:
      - "3000:3000"
    volumes:
      - grafana-data:/var/lib/grafana
      - ./monitoring/grafana/dashboards:/etc/grafana/provisioning/dashboards:ro
    environment:
      - GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_PASSWORD}
    networks:
      - nuclaw-network
    restart: unless-stopped

# 数据卷定义
volumes:
  redis-data:
  chroma-data:
  prometheus-data:
  grafana-data:

# 网络定义
networks:
  nuclaw-network:
    driver: bridge

# .github/workflows/ci-cd.yml
name: CI/CD Pipeline

on:
  push:
    branches: [main, develop]
    tags: ['v*']
  pull_request:
    branches: [main]

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

jobs:
  # ═══════════════════════════════════════════════════════
  # 阶段 1：构建与测试
  # ═══════════════════════════════════════════════════════
  build-and-test:
    runs-on: ubuntu-22.04

    steps:
      # 检出代码
      - name: Checkout
        uses: actions/checkout@v4

      # 缓存依赖（加速构建）
      - name: Cache dependencies
        uses: actions/cache@v3
        with:
          path: |
            ~/.ccache
            build/_deps
          key: ${{ runner.os }}-deps-${{ hashFiles('**/CMakeLists.txt') }}

      # 安装编译依赖
      - name: Install dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y \
            build-essential cmake ccache \
            libboost-all-dev libssl-dev libsqlite3-dev

      # 编译
      - name: Build
        run: |
          mkdir -p build
          cd build
          cmake .. \
            -DCMAKE_BUILD_TYPE=Release \
            -DCMAKE_CXX_COMPILER_LAUNCHER=ccache
          make -j$(nproc)

      # 运行测试
      - name: Test
        run: |
          cd build
          ctest --output-on-failure --parallel $(nproc)

      # 代码质量检查（可选）
      - name: Lint
        run: |
          # 运行 clang-tidy, cppcheck 等
          echo "Running static analysis..."

  # ═══════════════════════════════════════════════════════
  # 阶段 2：构建镜像
  # ═══════════════════════════════════════════════════════
  build-image:
    needs: build-and-test
    runs-on: ubuntu-22.04
    permissions:
      contents: read
      packages: write

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      # 登录容器仓库
      - name: Login to Registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      # 提取元数据（标签）
      - name: Extract metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            type=ref,event=branch
            type=semver,pattern={{version}}
            type=sha,prefix=,suffix=,format=short

      # 构建并推送镜像
      - name: Build and push
        uses: docker/build-push-action@v5
        with:
          context: .
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

  # ═══════════════════════════════════════════════════════
  # 阶段 3：部署（仅主分支和标签）
  # ═══════════════════════════════════════════════════════
  deploy:
    needs: build-image
    runs-on: ubuntu-22.04
    if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v')
    environment: production  # 需要人工审批

    steps:
      - name: Deploy to server
        run: |
          echo "Deploying image ${{ steps.meta.outputs.tags }}"
          # SSH 到服务器执行部署脚本
          # 或使用 Kubernetes API
          # 或调用云服务商 API

# 日志配置
logging:
  driver: "json-file"
  options:
    max-size: "100m"
    max-file: "3"
    labels: "service,environment"
    tags: "{{.ImageName}}/{{.Name}}/{{.ID}}"

# 或使用集中式日志
driver: "fluentd"
options:
  fluentd-address: "localhost:24224"
  tag: "docker.nuclaw"