#!/bin/bash
# 空白的 Ubuntu 22.04 使用。不要在已经跑着业务的 prod102 上再执行。
set -eu
export DEBIAN_FRONTEND=noninteractive

if [ "$(hostname)" = "prod102" ] && [ -f /root/.kube/config ]; then
  echo "prod102 上已经有集群。这份脚本是给空机器的，停在这里。"
  exit 1
fi

apt-get update
apt-get install -y ca-certificates curl gnupg python3

apt-get install -y nvidia-driver-550
if ! nvidia-smi >/dev/null 2>&1; then
  echo "驱动已安装。重启后再继续，直到 nvidia-smi 能看到 NVIDIA H20。"
  exit 0
fi

curl -fsSL https://nvidia.github.io/libnvidia-container/gpgkey \
  | gpg --dearmor --yes -o /usr/share/keyrings/nvidia-container-toolkit-keyring.gpg
curl -fsSL https://nvidia.github.io/libnvidia-container/stable/deb/nvidia-container-toolkit.list \
  | sed 's#deb https://#deb [signed-by=/usr/share/keyrings/nvidia-container-toolkit-keyring.gpg] https://#g' \
  > /etc/apt/sources.list.d/nvidia-container-toolkit.list
apt-get update
apt-get install -y nvidia-container-toolkit=1.17.8-1

modprobe br_netfilter || true
cat > /etc/modules-load.d/k8s.conf << 'EOF'
br_netfilter
EOF
cat > /etc/sysctl.d/k8s.conf << 'EOF'
net.bridge.bridge-nf-call-iptables = 1
net.bridge.bridge-nf-call-ip6tables = 1
net.ipv4.ip_forward = 1
EOF
sysctl --system >/dev/null

mkdir -p /usr/cluster/models /usr/cluster/docker /opt/new-api/data /opt/new-api/logs \
  /usr/cluster/dify/xinference /usr/cluster/server-status /usr/cluster/llm-nav \
  /usr/cluster/observability/metrics
ln -sfn /usr/cluster/models /models
echo PREP_OK

#!/bin/bash
# 空白机器安装 Docker 28.0.1。数据放在 /usr/cluster，默认运行时用 nvidia。
# 不要在已经跑着业务的 prod102 上执行。
set -eu
export DEBIAN_FRONTEND=noninteractive

if [ "$(hostname)" = "prod102" ] && [ -S /var/run/docker.sock ]; then
  echo "prod102 上 Docker 已经在跑。这份脚本是给空机器的，停在这里。"
  exit 1
fi

install -m 0755 -d /etc/apt/keyrings
curl -fsSL https://download.docker.com/linux/ubuntu/gpg \
  | gpg --dearmor --yes -o /etc/apt/keyrings/docker.gpg
echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu jammy stable" \
  > /etc/apt/sources.list.d/docker.list
apt-get update
ver=$(apt-cache madison docker-ce | awk '/28.0.1/{print $3; exit}')
if [ -z "$ver" ]; then
  echo "apt 里没有 docker-ce 28.0.1"
  exit 1
fi
apt-get install -y "docker-ce=$ver" "docker-ce-cli=$ver" containerd.io

mkdir -p /usr/cluster/docker /etc/docker
cat > /etc/docker/daemon.json << 'EOF'
{
  "data-root": "/usr/cluster/docker",
  "exec-opts": ["native.cgroupdriver=systemd"],
  "default-runtime": "nvidia",
  "runtimes": {
    "nvidia": {
      "path": "nvidia-container-runtime"
    }
  },
  "registry-mirrors": [
    "https://docker.1ms.run",
    "https://docker.xuanyuan.me",
    "https://docker.m.daocloud.io",
    "https://hub-mirror.c.163.com"
  ]
}
EOF
systemctl enable docker
systemctl restart docker
docker info --format 'root={{.DockerRootDir}} cgroup={{.CgroupDriver}} runtime={{.DefaultRuntime}}'
echo DOCKER_OK

root=/usr/cluster/docker cgroup=systemd runtime=nvidia

#!/bin/bash
# 把 Qwen3.6-27B 下到 /models。目录里已有 ModelScope 的 configuration.json
# 和 Hugging Face 模型卡。不要在权重已经齐的机器上再下一份。
set -eu
if [ -f /models/Qwen3.6-27B/config.json ]; then
  echo "权重已在 /models/Qwen3.6-27B"
  exit 0
fi
mkdir -p /usr/cluster/models
ln -sfn /usr/cluster/models /models
pip3 install -U modelscope
modelscope download --model Qwen/Qwen3.6-27B --local_dir /models/Qwen3.6-27B
test -f /models/Qwen3.6-27B/config.json
echo MODEL_OK

#!/bin/bash
# 空白机器安装 Kubernetes 1.37.1 单节点。
# 运行时是 cri-dockerd 0.4.8，网络是本机网桥。不要再装 Flannel。
# 不要在已经跑着业务的 prod102 上执行。
set -eu
export DEBIAN_FRONTEND=noninteractive
export KUBECONFIG=/root/.kube/config

if [ "$(hostname)" = "prod102" ] && [ -f /etc/kubernetes/admin.conf ]; then
  echo "prod102 上控制面已经在。这份脚本是给空机器的，停在这里。"
  exit 1
fi

KVER=1.37.1-1.1
IMG_REPO=registry.aliyuncs.com/google_containers
WORKDIR=/usr/cluster/k8s
mkdir -p "$WORKDIR" /etc/cni/net.d /opt/cni/bin

echo "=== cri-dockerd 0.4.8 ==="
if ! /usr/local/bin/cri-dockerd --version 2>/dev/null | grep -q '0.4.8'; then
  curl -fL --retry 3 -o "$WORKDIR/cri-dockerd-0.4.8.amd64.tgz" \
    https://github.com/Mirantis/cri-dockerd/releases/download/v0.4.8/cri-dockerd-0.4.8.amd64.tgz
  tar -xzf "$WORKDIR/cri-dockerd-0.4.8.amd64.tgz" -C "$WORKDIR"
  install -m 0755 "$WORKDIR/cri-dockerd/cri-dockerd" /usr/local/bin/cri-dockerd
fi
if [ ! -f /lib/systemd/system/cri-docker.service ] && [ ! -f /etc/systemd/system/cri-docker.service ]; then
  cat > /etc/systemd/system/cri-docker.socket << 'EOF'
[Unit]
Description=CRI Docker Socket for the API
PartOf=cri-docker.service

[Socket]
ListenStream=%t/cri-dockerd.sock
SocketMode=0660
SocketUser=root
SocketGroup=root

[Install]
WantedBy=sockets.target
EOF
  cat > /etc/systemd/system/cri-docker.service << 'EOF'
[Unit]
Description=CRI Interface for Docker Application Container Engine
After=network-online.target docker.service
Wants=network-online.target
Requires=cri-docker.socket

[Service]
Type=notify
ExecStart=/usr/local/bin/cri-dockerd --container-runtime-endpoint fd://
ExecReload=/bin/kill -s HUP $MAINPID
TimeoutSec=0
RestartSec=2
Restart=always
Delegate=yes
KillMode=process

[Install]
WantedBy=multi-user.target
EOF
fi
systemctl mask cri-dockerd.service >/dev/null 2>&1 || true
systemctl daemon-reload
systemctl enable cri-docker.socket cri-docker.service

echo "=== pause 镜像，写在 kubeadm init 之前 ==="
docker pull "$IMG_REPO/pause:3.10.2"
docker tag "$IMG_REPO/pause:3.10.2" registry.k8s.io/pause:3.10
mkdir -p /etc/systemd/system/cri-docker.service.d
cat > /etc/systemd/system/cri-docker.service.d/pause.conf << 'EOF'
[Service]
ExecStart=
ExecStart=/usr/local/bin/cri-dockerd --container-runtime-endpoint fd:// --pod-infra-container-image=registry.aliyuncs.com/google_containers/pause:3.10.2
EOF
systemctl daemon-reload
systemctl restart cri-docker.socket
systemctl restart cri-docker.service

echo "=== kubeadm 1.37.1 ==="
install -d -m 0755 /etc/apt/keyrings
curl -fsSL https://mirrors.aliyun.com/kubernetes-new/core/stable/v1.37/deb/Release.key \
  | gpg --dearmor --yes -o /etc/apt/keyrings/kubernetes-apt-keyring.gpg
cat > /etc/apt/sources.list.d/kubernetes.list << 'EOF'
deb [signed-by=/etc/apt/keyrings/kubernetes-apt-keyring.gpg] https://mirrors.aliyun.com/kubernetes-new/core/stable/v1.37/deb/ /
EOF
apt-get update
systemctl stop kubelet || true
systemctl disable kubelet || true
apt-get install -y -o Dpkg::Options::=--force-confnew \
  kubelet="$KVER" kubeadm="$KVER" kubectl="$KVER" conntrack socat
apt-mark hold kubelet kubeadm kubectl
systemctl unmask kubelet || true

cat > "$WORKDIR/kubeadm-config.yaml" << 'EOF'
apiVersion: kubeadm.k8s.io/v1beta4
kind: InitConfiguration
localAPIEndpoint:
  advertiseAddress: 10.0.1.47
  bindPort: 6443
nodeRegistration:
  criSocket: unix:///run/cri-dockerd.sock
  imagePullPolicy: IfNotPresent
  name: prod102
  kubeletExtraArgs:
    - name: node-ip
      value: 10.0.1.47
---
apiVersion: kubeadm.k8s.io/v1beta4
kind: ClusterConfiguration
kubernetesVersion: v1.37.1
imageRepository: registry.aliyuncs.com/google_containers
controlPlaneEndpoint: 10.0.1.47:6443
networking:
  podSubnet: 10.244.0.0/16
  serviceSubnet: 10.96.0.0/12
apiServer:
  certSANs:
    - 10.0.1.47
    - prod102
  extraArgs:
    - name: bind-address
      value: 10.0.1.47
EOF

echo "=== 网桥，写在 init 之前，节点才能 Ready ==="
cat > /etc/cni/net.d/10-bridge.conflist << 'EOF'
{
  "cniVersion": "1.0.0",
  "name": "k8s-pod-network",
  "plugins": [
    {
      "type": "bridge",
      "bridge": "cni0",
      "isGateway": true,
      "ipMasq": true,
      "promiscMode": true,
      "ipam": {
        "type": "host-local",
        "ranges": [[{"subnet": "10.244.0.0/24"}]],
        "routes": [{"dst": "0.0.0.0/0"}]
      }
    },
    {
      "type": "portmap",
      "capabilities": {"portMappings": true}
    }
  ]
}
EOF

kubeadm config images pull --config "$WORKDIR/kubeadm-config.yaml"
kubeadm init --config "$WORKDIR/kubeadm-config.yaml" --ignore-preflight-errors=FileExisting-tc
mkdir -p /root/.kube
cp /etc/kubernetes/admin.conf /root/.kube/config
chmod 600 /root/.kube/config
systemctl restart kubelet
kubectl taint nodes prod102 node-role.kubernetes.io/control-plane:NoSchedule- || true
kubectl wait --for=condition=Ready node/prod102 --timeout=180s
kubectl get nodes -o wide
echo INSTALL_OK

#!/bin/bash
# 空白机器上创建命名空间和工作负载。不要在现网 prod102 上执行。
set -eu
export KUBECONFIG=/root/.kube/config
ROOT=$(cd "$(dirname "$0")/.." && pwd)

if kubectl get deploy -n llm vllm >/dev/null 2>&1; then
  echo "llm/vllm 已经在。这份脚本是给空集群的，停在这里。"
  exit 1
fi

kubectl apply -f "$ROOT/config/namespaces.yaml"
kubectl apply -f "$ROOT/config/llm.yaml"
kubectl apply -f "$ROOT/config/observability.yaml"
kubectl apply -f "$ROOT/config/dify-nginx.yaml"
echo APPLY_OK
echo "Dify 和 Langfuse 的其余工作负载见本文的服务表。数据库口令在 config/数据库口令.env。"
echo "Langfuse 加密密钥和 Redis 口令不要写进仓库，在服务器上生成后做成 Secret。"

apiVersion: v1
kind: Namespace
metadata:
  name: llm
---
apiVersion: v1
kind: Namespace
metadata:
  name: dify
---
apiVersion: v1
kind: Namespace
metadata:
  name: langfuse
---
apiVersion: v1
kind: Namespace
metadata:
  name: observability

apiVersion: apps/v1
kind: Deployment
metadata:
  name: vllm
  namespace: llm
  labels:
    app: vllm
spec:
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app: vllm
  template:
    metadata:
      labels:
        app: vllm
    spec:
      nodeName: prod102
      enableServiceLinks: false
      hostAliases:
        - ip: 10.0.1.47
          hostnames: ["host.docker.internal"]
      containers:
        - name: vllm
          image: docker.m.daocloud.io/vllm/vllm-openai:latest
          imagePullPolicy: IfNotPresent
          command: ["vllm", "serve"]
          args:
            - /model
            - --trust-remote-code
            - --dtype
            - bfloat16
            - --tensor-parallel-size
            - "1"
            - --enable-auto-tool-choice
            - --tool-call-parser
            - qwen3_xml
            - --reasoning-parser
            - qwen3
            - --max-model-len
            - "65536"
            - --gpu-memory-utilization
            - "0.70"
            - --max-num-seqs
            - "8"
            - --served-model-name
            - qwen3.6-27b
            - --enable-prefix-caching
            - --host
            - 0.0.0.0
            - --port
            - "8000"
          env:
            - name: HF_HUB_OFFLINE
              value: "1"
            - name: NVIDIA_VISIBLE_DEVICES
              value: all
            - name: NVIDIA_DRIVER_CAPABILITIES
              value: all
          ports:
            - containerPort: 8000
              hostPort: 8000
          volumeMounts:
            - name: model
              mountPath: /model
            - name: dshm
              mountPath: /dev/shm
      volumes:
        - name: model
          hostPath:
            path: /models/Qwen3.6-27B
            type: Directory
        - name: dshm
          emptyDir:
            medium: Memory
            sizeLimit: 8Gi
---
apiVersion: v1
kind: Service
metadata:
  name: vllm
  namespace: llm
spec:
  selector:
    app: vllm
  ports:
    - name: p8000
      port: 8000
      targetPort: 8000
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: xinference
  namespace: llm
  labels:
    app: xinference
spec:
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app: xinference
  template:
    metadata:
      labels:
        app: xinference
    spec:
      nodeName: prod102
      enableServiceLinks: false
      containers:
        - name: xinference
          image: xprobe/xinference:latest
          imagePullPolicy: IfNotPresent
          command: ["xinference-local", "-H", "0.0.0.0", "--log-level", "info"]
          env:
            - name: XINFERENCE_HOME
              value: /data
            - name: XINFERENCE_MODEL_SRC
              value: modelscope
            - name: NVIDIA_VISIBLE_DEVICES
              value: all
            - name: NVIDIA_DRIVER_CAPABILITIES
              value: all
          ports:
            - containerPort: 9997
              hostPort: 9997
          volumeMounts:
            - name: data
              mountPath: /data
      volumes:
        - name: data
          hostPath:
            path: /usr/cluster/dify/xinference
            type: DirectoryOrCreate
---
apiVersion: v1
kind: Service
metadata:
  name: xinference
  namespace: llm
spec:
  selector:
    app: xinference
  ports:
    - name: p9997
      port: 9997
      targetPort: 9997
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: new-api
  namespace: llm
  labels:
    app: new-api
spec:
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app: new-api
  template:
    metadata:
      labels:
        app: new-api
    spec:
      nodeName: prod102
      enableServiceLinks: false
      containers:
        - name: new-api
          image: calciumion/new-api:latest
          imagePullPolicy: IfNotPresent
          command: ["/new-api"]
          args: ["--log-dir", "/app/logs"]
          ports:
            - containerPort: 3000
              hostPort: 3000
          volumeMounts:
            - name: data
              mountPath: /data
            - name: logs
              mountPath: /app/logs
      volumes:
        - name: data
          hostPath:
            path: /opt/new-api/data
            type: DirectoryOrCreate
        - name: logs
          hostPath:
            path: /opt/new-api/logs
            type: DirectoryOrCreate
---
apiVersion: v1
kind: Service
metadata:
  name: new-api
  namespace: llm
spec:
  selector:
    app: new-api
  ports:
    - name: p3000
      port: 3000
      targetPort: 3000
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: nav
  namespace: llm
  labels:
    app: nav
spec:
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app: nav
  template:
    metadata:
      labels:
        app: nav
    spec:
      nodeName: prod102
      containers:
        - name: nav
          image: nginx:latest
          imagePullPolicy: IfNotPresent
          command: ["/docker-entrypoint.sh"]
          args: ["nginx", "-g", "daemon off;"]
          ports:
            - containerPort: 80
              hostPort: 8090
          volumeMounts:
            - name: html
              mountPath: /usr/share/nginx/html
      volumes:
        - name: html
          hostPath:
            path: /usr/cluster/llm-nav
            type: DirectoryOrCreate
---
apiVersion: v1
kind: Service
metadata:
  name: nav
  namespace: llm
spec:
  selector:
    app: nav
  ports:
    - name: p80
      port: 80
      targetPort: 80

apiVersion: apps/v1
kind: Deployment
metadata:
  name: prometheus
  namespace: observability
  labels:
    app: prometheus
spec:
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app: prometheus
  template:
    metadata:
      labels:
        app: prometheus
    spec:
      nodeName: prod102
      enableServiceLinks: false
      containers:
        - name: prometheus
          image: prom/prometheus:v3.2.1
          imagePullPolicy: IfNotPresent
          command: ["/bin/prometheus"]
          args:
            - --config.file=/etc/prometheus/prometheus.yml
            - --storage.tsdb.path=/prometheus
            - --storage.tsdb.retention.time=15d
          ports:
            - containerPort: 9090
              hostPort: 9090
          volumeMounts:
            - name: config
              mountPath: /etc/prometheus/prometheus.yml
              subPath: prometheus.yml
            - name: data
              mountPath: /prometheus
      volumes:
        - name: config
          hostPath:
            path: /usr/cluster/observability/metrics/prometheus.yml
            type: File
        - name: data
          hostPath:
            path: /usr/cluster/docker/volumes/observability_prometheus_data/_data
            type: DirectoryOrCreate
---
apiVersion: v1
kind: Service
metadata:
  name: prometheus
  namespace: observability
spec:
  selector:
    app: prometheus
  ports:
    - name: p9090
      port: 9090
      targetPort: 9090
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: grafana
  namespace: observability
  labels:
    app: grafana
spec:
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app: grafana
  template:
    metadata:
      labels:
        app: grafana
    spec:
      nodeName: prod102
      enableServiceLinks: false
      containers:
        - name: grafana
          image: grafana/grafana:11.5.2
          imagePullPolicy: IfNotPresent
          command: ["/run.sh"]
          env:
            - name: GF_SECURITY_ADMIN_USER
              value: admin
            - name: GF_SECURITY_ADMIN_PASSWORD
              value: Gf-gpu-2026
            - name: GF_SERVER_ROOT_URL
              value: http://10.0.1.47:3001
          ports:
            - containerPort: 3000
              hostPort: 3001
          volumeMounts:
            - name: datasources
              mountPath: /etc/grafana/provisioning/datasources
            - name: dashboards-prov
              mountPath: /etc/grafana/provisioning/dashboards
            - name: dashboards
              mountPath: /var/lib/grafana/dashboards
            - name: data
              mountPath: /var/lib/grafana
      volumes:
        - name: datasources
          hostPath:
            path: /usr/cluster/observability/metrics/grafana/provisioning/datasources
            type: Directory
        - name: dashboards-prov
          hostPath:
            path: /usr/cluster/observability/metrics/grafana/provisioning/dashboards
            type: Directory
        - name: dashboards
          hostPath:
            path: /usr/cluster/observability/metrics/grafana/dashboards
            type: Directory
        - name: data
          hostPath:
            path: /usr/cluster/docker/volumes/observability_grafana_data/_data
            type: DirectoryOrCreate
---
apiVersion: v1
kind: Service
metadata:
  name: grafana
  namespace: observability
spec:
  selector:
    app: grafana
  ports:
    - name: p3000
      port: 3000
      targetPort: 3000
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: dcgm-exporter
  namespace: observability
  labels:
    app: dcgm-exporter
spec:
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app: dcgm-exporter
  template:
    metadata:
      labels:
        app: dcgm-exporter
    spec:
      nodeName: prod102
      enableServiceLinks: false
      containers:
        - name: dcgm-exporter
          image: nvidia/dcgm-exporter:3.3.8-3.6.0-ubuntu22.04
          imagePullPolicy: IfNotPresent
          command: ["/usr/local/dcgm/dcgm-exporter-entrypoint.sh"]
          env:
            - name: NVIDIA_VISIBLE_DEVICES
              value: all
            - name: NVIDIA_DRIVER_CAPABILITIES
              value: all
          ports:
            - containerPort: 9400
              hostPort: 9400
---
apiVersion: v1
kind: Service
metadata:
  name: dcgm-exporter
  namespace: observability
spec:
  selector:
    app: dcgm-exporter
  ports:
    - name: p9400
      port: 9400
      targetPort: 9400

apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx
  namespace: dify
  labels:
    app: nginx
spec:
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      nodeName: prod102
      enableServiceLinks: false
      containers:
        - name: nginx
          image: nginx:latest
          imagePullPolicy: IfNotPresent
          command: ["sh", "-c"]
          args:
            - "cp /docker-entrypoint-mount.sh /docker-entrypoint.sh && sed -i 's/\\r$//' /docker-entrypoint.sh && chmod +x /docker-entrypoint.sh && /docker-entrypoint.sh"
          ports:
            - containerPort: 80
              hostPort: 8088
            - containerPort: 443
              hostPort: 18443
          volumeMounts:
            - name: entry
              mountPath: /docker-entrypoint-mount.sh
            - name: confd
              mountPath: /etc/nginx/conf.d
            - name: nginx-conf
              mountPath: /etc/nginx/nginx.conf.template
            - name: proxy-conf
              mountPath: /etc/nginx/proxy.conf.template
            - name: https-conf
              mountPath: /etc/nginx/https.conf.template
            - name: ssl
              mountPath: /etc/ssl
            - name: certbot-conf
              mountPath: /etc/letsencrypt
            - name: certbot-live
              mountPath: /etc/letsencrypt/live
            - name: certbot-www
              mountPath: /var/www/html
      volumes:
        - name: entry
          hostPath:
            path: /usr/cluster/dify/src/docker/nginx/docker-entrypoint.sh
            type: File
        - name: confd
          hostPath:
            path: /usr/cluster/dify/src/docker/nginx/conf.d
            type: Directory
        - name: nginx-conf
          hostPath:
            path: /usr/cluster/dify/src/docker/nginx/nginx.conf.template
            type: File
        - name: proxy-conf
          hostPath:
            path: /usr/cluster/dify/src/docker/nginx/proxy.conf.template
            type: File
        - name: https-conf
          hostPath:
            path: /usr/cluster/dify/src/docker/nginx/https.conf.template
            type: File
        - name: ssl
          hostPath:
            path: /usr/cluster/dify/src/docker/nginx/ssl
            type: Directory
        - name: certbot-conf
          hostPath:
            path: /usr/cluster/dify/src/docker/volumes/certbot/conf
            type: DirectoryOrCreate
        - name: certbot-live
          hostPath:
            path: /usr/cluster/dify/src/docker/volumes/certbot/conf/live
            type: DirectoryOrCreate
        - name: certbot-www
          hostPath:
            path: /usr/cluster/dify/src/docker/volumes/certbot/www
            type: DirectoryOrCreate
---
apiVersion: v1
kind: Service
metadata:
  name: nginx
  namespace: dify
spec:
  selector:
    app: nginx
  ports:
    - name: p80
      port: 80
      targetPort: 80
    - name: p443
      port: 443
      targetPort: 443

kubectl -n llm exec deploy/xinference -- pip install -i https://pypi.tuna.tsinghua.edu.cn/simple sentence-transformers

POST http://10.0.1.47:9997/v1/models?wait_ready=true
{
  "model_name": "bge-m3",
  "model_type": "embedding",
  "n_gpu": 1,
  "download_hub": "modelscope"
}

POST http://10.0.1.47:9997/v1/models?wait_ready=true
{
  "model_name": "bge-reranker-v2-m3",
  "model_type": "rerank",
  "n_gpu": 1,
  "download_hub": "modelscope"
}

/app/api/.venv/lib/python3.12/site-packages/dify_trace_langfuse/langfuse_trace.py

SSRF_PROXY_ALLOW_PRIVATE_IPS=172.17.0.0/16,10.0.0.0/8

#!/bin/bash
# 在宿主机安装 getServerStatus。它不是容器，端口 8777。
# 不要停掉现网上已经 active 的 server-status。
set -eu
if systemctl is-active --quiet server-status; then
  echo "server-status 已在运行"
  exit 0
fi
ROOT=$(cd "$(dirname "$0")/.." && pwd)
mkdir -p /usr/cluster/server-status
cp "$ROOT/config/server-status/app.py" /usr/cluster/server-status/app.py
cp "$ROOT/config/server-status/server-status.service" /etc/systemd/system/server-status.service
systemctl daemon-reload
systemctl enable server-status
systemctl restart server-status
curl -fsS "http://127.0.0.1:8777/server/status?server_name=gpu-server-01"
echo
echo STATUS_OK

#!/usr/bin/env python3
"""作业 1 的模拟服务器状态接口。operationId 对应 Langfuse 里的 getServerStatus。"""
import json
from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
from urllib.parse import parse_qs, urlparse


class Handler(BaseHTTPRequestHandler):
    def do_GET(self):
        parsed = urlparse(self.path)
        if parsed.path == "/health":
            self._send({"status": "ok"})
            return
        if parsed.path == "/server/status":
            name = (parse_qs(parsed.query).get("server_name") or ["unknown"])[0]
            self._send(
                {
                    "server": name,
                    "cpu": "45%",
                    "memory": "62%",
                    "gpu_util": "78%",
                    "gpu_memory": "18.2/24 GB",
                }
            )
            return
        self.send_response(404)
        self.end_headers()

    def _send(self, payload):
        body = json.dumps(payload, ensure_ascii=False).encode()
        self.send_response(200)
        self.send_header("Content-Type", "application/json")
        self.send_header("Content-Length", str(len(body)))
        self.end_headers()
        self.wfile.write(body)

    def log_message(self, fmt, *args):
        print("%s - %s" % (self.address_string(), fmt % args), flush=True)


if __name__ == "__main__":
    ThreadingHTTPServer(("0.0.0.0", 8777), Handler).serve_forever()

# 可以写进文档的数据库口令。Redis 口令、Langfuse 加密密钥不在这里。
DIFY_POSTGRES_USER=postgres
DIFY_POSTGRES_PASSWORD=difyai123456
DIFY_POSTGRES_DB=dify
PGVECTOR_PASSWORD=difyai123456
LANGFUSE_POSTGRES_USER=postgres
LANGFUSE_POSTGRES_PASSWORD=ebb9cb3a5365bc5ffd41349860dc48c8
LANGFUSE_POSTGRES_DB=postgres
CLICKHOUSE_USER=clickhouse
CLICKHOUSE_PASSWORD=b5e2a69b99ac76c35f7f8d5742ce2ea6
CLICKHOUSE_DB=default

sk-C0P9V9kwPfXDvQCfaVzSLCJRUmioNmxYud1uqsLXkBqZTFxK

#!/usr/bin/env python3
"""记录工作区模型注册。对话走 New-API 的 dify-gateway，向量和重排走 Xinference。

现网已经注册过。再跑一次如果返回 Can't add same credential，停下来即可。
不要创建第二把名为 dify-gateway 的令牌。
"""
import json
import urllib.request

DIFY = "http://127.0.0.1:8088"
NEW_API = "http://10.0.1.47:3000/v1"
XINFERENCE = "http://10.0.1.47:9997"
GATEWAY_KEY = "sk-C0P9V9kwPfXDvQCfaVzSLCJRUmioNmxYud1uqsLXkBqZTFxK"

llm = {
    "model": "qwen3.6-27b",
    "model_type": "llm",
    "credentials": {
        "mode": "chat",
        "context_size": "65536",
        "max_tokens_to_sample": "8192",
        "function_calling_type": "tool_call",
        "stream_function_calling": "supported",
        "display_name": "qwen3.6-27b",
        "endpoint_url": NEW_API,
        "api_key": GATEWAY_KEY,
    },
}
embedding = {
    "model": "bge-m3",
    "model_type": "text-embedding",
    "credentials": {
        "server_url": XINFERENCE,
        "model_uid": "bge-m3",
    },
}
rerank = {
    "model": "bge-reranker-v2-m3",
    "model_type": "rerank",
    "credentials": {
        "server_url": XINFERENCE,
        "model_uid": "bge-reranker-v2-m3",
    },
}


def show(title, body):
    print(title)
    print(json.dumps(body, ensure_ascii=False, indent=2))


show("对话模型", llm)
show("向量模型", embedding)
show("重排模型", rerank)
print("保存：POST /console/api/workspaces/current/model-providers/<provider>/models/credentials")
print("供应商：langgenius/openai_api_compatible/openai_api_compatible")
print("供应商：langgenius/xinference/xinference")
print("然后把这三项设成工作区默认模型。")

http://10.0.1.47:8088/agent/gQPVqCdcyKoW82iZ

#!/usr/bin/env python3
"""合同知识库和 Agent 提示词。合同原文不在仓库里，先在页面上传。

现网知识库 id 是 71042108-5f9a-4856-a0db-4359e8e7fa98。
空白环境上传后用接口返回的新 id，不要拿这个旧 id 再索引一份。
"""
DATASET_NAME = "阿里云合同条款"
PROVIDER = "langgenius/xinference/xinference"
SYSTEM_PROMPT = """# 角色
你是【阿里云框架合同解析智能Agent】，服务采购、IT、法务。只解析阿里云框架协议、服务条款、补充协议、订单、账单、SLA、免责、费用、终止、数据安全。其他问题请用户找对应负责人。

# 检索
需要合同原文时，调用一次 knowledge_base_search：set_name 为「Retrieval 1」，query 只用条款主题加关键词。
本轮对话已经引用过该条款原文时，直接作答。
没有命中时，只回复：【知识库未检索到本合同相关条款，请查阅原件或咨询法务/阿里云客户经理】。

# 作答
结论必须带章节或条款号，并摘一句原文。立场是甲方。框架与订单或补充协议冲突时，写明以订单/补充协议为准。
一问一答只答所问：加粗结论、一句原文、风险色标、一条建议。
用户要求总结或报告时，输出三块：【核心信息摘要】【关键条款清单】【风险清单与建议】。报告优先看：主体与期限、计费与最低消费、SLA 与赔付上限、数据与保密、责任上限与间接损失、终止与数据留存、管辖与单方变更。
🔴高风险：责任上限过低、免除重大损失、数据迁出限制、无 SLA 赔付、自动续费无提前告知、单方变更条款。
🟡中风险：表述模糊、期限不清、流程繁琐、赔付条件苛刻。
🟢低风险：常规商业条款。
每条风险包含：原文摘抄、风险说明、我方建议。
只做条款解读、提取、对比、风险识别和摘要。签署结论留给法务。
每次回复末尾加：本内容仅为合同条款辅助解析，不构成法律意见，合同签署前务必由公司法务最终审核。
只有用户要求总结或报告时，最后再问：是否需要整理成精简关键条款清单？"""

retrieval_model = {
    "search_method": "hybrid_search",
    "reranking_enable": True,
    "reranking_mode": "reranking_model",
    "reranking_model": {
        "reranking_provider_name": PROVIDER,
        "reranking_model_name": "bge-reranker-v2-m3",
    },
    "top_k": 4,
    "score_threshold_enabled": False,
    "weights": {
        "weight_type": "customized",
        "vector_setting": {
            "vector_weight": 0.7,
            "embedding_provider_name": PROVIDER,
            "embedding_model_name": "bge-m3",
        },
        "keyword_setting": {"keyword_weight": 0.3},
    },
}

init_body = {
    "name": DATASET_NAME,
    "indexing_technique": "high_quality",
    "doc_form": "text_model",
    "doc_language": "Chinese",
    "embedding_model": "bge-m3",
    "embedding_model_provider": PROVIDER,
    "process_rule": {"mode": "automatic"},
    "retrieval_model": retrieval_model,
}

knowledge_set = {
    "id": "retrieval-1",
    "name": "Retrieval 1",
    "description": "阿里云框架合同原文及附件",
    "query": {"mode": "generated_query"},
    "retrieval": {
        "mode": "multiple",
        "top_k": 4,
        "reranking_mode": "reranking_model",
        "reranking_enable": True,
        "reranking_model": {"provider": PROVIDER, "model": "bge-reranker-v2-m3"},
    },
    "metadata_filtering": {"mode": "disabled"},
}

print("系统提示词字数", len(SYSTEM_PROMPT))
print("创建知识库 POST /console/api/datasets/init")
print("查询模式用 generated_query。user_query 会在页面打开时查固定句子。")
print("保存草稿 PUT /console/api/agent/<id>/composer ，save_strategy=save_to_current_version")
print("发布 POST /console/api/agent/<id>/publish")