codegraph/
├── docker-compose.yml
├── docker-compose.override.yml  # Локальные настройки
├── .env                         # Переменные окружения
├── config.yaml                  # Конфигурация приложения
└── data/
    ├── postgres/                # PostgreSQL данные
    ├── duckdb/                  # DuckDB файлы
    └── gocpg/                   # GoCPG workspace

version: '3.8'

services:
  # ==========================================================================
  # CodeGraph API Server
  # ==========================================================================
  api:
    build:
      context: .
      dockerfile: Dockerfile
    image: codegraph:latest
    container_name: codegraph-api
    restart: unless-stopped
    ports:
      - "8000:8000"
    environment:
      - DATABASE_URL=postgresql+asyncpg://postgres:${POSTGRES_PASSWORD}@postgres:5432/codegraph
      - API_JWT_SECRET=${API_JWT_SECRET}
      - GIGACHAT_AUTH_KEY=${GIGACHAT_AUTH_KEY}
      - SECURITY_ENABLED=true
      - DLP_ENABLED=true
      - SIEM_ENABLED=${SIEM_ENABLED:-false}
      - VAULT_ENABLED=${VAULT_ENABLED:-false}
    volumes:
      - ./config.yaml:/app/config.yaml:ro
      - ./data/duckdb:/app/data/duckdb
    depends_on:
      postgres:
        condition: service_healthy
      gocpg:
        condition: service_started
    networks:
      - codegraph-network
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8000/api/v1/health"]
      interval: 30s
      timeout: 10s
      retries: 3

  # ==========================================================================
  # PostgreSQL Database
  # ==========================================================================
  postgres:
    image: postgres:16-alpine
    container_name: codegraph-postgres
    restart: unless-stopped
    environment:
      - POSTGRES_USER=postgres
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
      - POSTGRES_DB=codegraph
    volumes:
      - ./data/postgres:/var/lib/postgresql/data
      - ./init.sql:/docker-entrypoint-initdb.d/init.sql:ro
    networks:
      - codegraph-network
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres"]
      interval: 10s
      timeout: 5s
      retries: 5

  # ==========================================================================
  # GoCPG CPG Generator
  # ==========================================================================
  gocpg:
    image: codegraph/gocpg:latest
    container_name: codegraph-gocpg
    restart: unless-stopped
    volumes:
      - ./data/gocpg:/workspace
    networks:
      - codegraph-network

networks:
  codegraph-network:
    driver: bridge

# =============================================================================
# CodeGraph Environment Variables
# =============================================================================

# PostgreSQL
POSTGRES_PASSWORD=<secure-password-here>

# JWT Authentication
API_JWT_SECRET=<64-char-random-string>
API_ADMIN_USERNAME=admin
API_ADMIN_PASSWORD=<secure-admin-password>

# LLM Providers
# GigaChat (Сбер)
GIGACHAT_AUTH_KEY=<base64-encoded-credentials>
# Yandex AI Studio (необязательно)
YANDEX_AI_API_KEY=<your-yandex-api-key>
YANDEX_AI_FOLDER_ID=<your-yandex-folder-id>

# Security Features
SECURITY_ENABLED=true
DLP_ENABLED=true
SIEM_ENABLED=false
VAULT_ENABLED=false

# SIEM (если включён)
SIEM_SYSLOG_HOST=siem.company.com
SIEM_SYSLOG_PORT=514

# Vault (если включён)
VAULT_ADDR=https://vault.company.com:8200
VAULT_TOKEN=<vault-token>

# Создание .env файла
cp .env.example .env
# Редактирование переменных
nano .env

# Запуск всех сервисов
docker compose up -d

# Проверка статуса
docker compose ps

# Просмотр логов
docker compose logs -f api

# Инициализация базы данных
docker compose exec api python -m alembic upgrade head

# Создание администратора
docker compose exec api python -m scripts.create_admin

┌─────────────────────────────────────────────────────────────────────────────┐
│                           KUBERNETES CLUSTER                                 │
├─────────────────────────────────────────────────────────────────────────────┤
│                                                                             │
│  ┌─────────────────────────────────────────────────────────────────────┐   │
│  │                         INGRESS CONTROLLER                           │   │
│  │                     (nginx / traefik / istio)                        │   │
│  │                                                                       │   │
│  │  api.codegraph.company.com ────────────────► codegraph-api:8000     │   │
│  └─────────────────────────────────────────────────────────────────────┘   │
│                                       │                                     │
│                                       ▼                                     │
│  ┌─────────────────────────────────────────────────────────────────────┐   │
│  │                    CODEGRAPH NAMESPACE                               │   │
│  │                                                                       │   │
│  │  ┌───────────────────┐  ┌───────────────────┐  ┌─────────────────┐  │   │
│  │  │  codegraph-api    │  │  codegraph-api    │  │  codegraph-api  │  │   │
│  │  │  (replica 1)      │  │  (replica 2)      │  │  (replica 3)    │  │   │
│  │  │                   │  │                   │  │                 │  │   │
│  │  │  CPU: 2           │  │  CPU: 2           │  │  CPU: 2         │  │   │
│  │  │  RAM: 4Gi         │  │  RAM: 4Gi         │  │  RAM: 4Gi       │  │   │
│  │  └───────────────────┘  └───────────────────┘  └─────────────────┘  │   │
│  │            │                    │                      │             │   │
│  │            └────────────────────┼──────────────────────┘             │   │
│  │                                 │                                    │   │
│  │                                 ▼                                    │   │
│  │  ┌───────────────────────────────────────────────────────────────┐  │   │
│  │  │                      SERVICES                                  │  │   │
│  │  │                                                                │  │   │
│  │  │  ┌─────────────┐  ┌─────────────┐  ┌─────────────────────┐   │  │   │
│  │  │  │ PostgreSQL  │  │   GoCPG     │  │   HashiCorp Vault   │   │  │   │
│  │  │  │ (StatefulSet)│  │ (StatefulSet)│  │   (External)       │   │  │   │
│  │  │  │             │  │             │  │                     │   │  │   │
│  │  │  │ PVC: 100Gi  │  │ PVC: 50Gi   │  │                     │   │  │   │
│  │  │  └─────────────┘  └─────────────┘  └─────────────────────┘   │  │   │
│  │  │                                                                │  │   │
│  │  └───────────────────────────────────────────────────────────────┘  │   │
│  │                                                                       │   │
│  └─────────────────────────────────────────────────────────────────────┘   │
│                                                                             │
└─────────────────────────────────────────────────────────────────────────────┘

# namespace.yaml
apiVersion: v1
kind: Namespace
metadata:
  name: codegraph
  labels:
    name: codegraph
    istio-injection: enabled  # Если используется Istio
---
# configmap.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: codegraph-config
  namespace: codegraph
data:
  config.yaml: |
    domain:
      name: postgresql
      auto_activate: true

    api:
      host: "0.0.0.0"
      port: 8000
      workers: 4

    security:
      enabled: true
      dlp:
        enabled: true
        pre_request:
          enabled: true
          default_action: "WARN"
        post_response:
          enabled: true
          default_action: "MASK"
      siem:
        enabled: true
        syslog:
          enabled: true
          host: "siem-syslog.security.svc.cluster.local"
          port: 514
      vault:
        enabled: true
        url: "http://vault.vault.svc.cluster.local:8200"
        auth_method: "kubernetes"
        kubernetes:
          role: "codegraph"

# secrets.yaml
apiVersion: v1
kind: Secret
metadata:
  name: codegraph-secrets
  namespace: codegraph
type: Opaque
stringData:
  DATABASE_URL: "postgresql+asyncpg://postgres:password@postgres:5432/codegraph"
  API_JWT_SECRET: "<64-char-random-string>"
  GIGACHAT_AUTH_KEY: "<base64-credentials>"
---
# Для production используйте External Secrets Operator + Vault
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: codegraph-vault-secrets
  namespace: codegraph
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: vault-backend
    kind: ClusterSecretStore
  target:
    name: codegraph-secrets
  data:
    - secretKey: DATABASE_URL
      remoteRef:
        key: codegraph/database
        property: url
    - secretKey: API_JWT_SECRET
      remoteRef:
        key: codegraph/api
        property: jwt_secret
    - secretKey: GIGACHAT_AUTH_KEY
      remoteRef:
        key: codegraph/llm
        property: gigachat_credentials

# deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: codegraph-api
  namespace: codegraph
  labels:
    app: codegraph
    component: api
spec:
  replicas: 3
  selector:
    matchLabels:
      app: codegraph
      component: api
  template:
    metadata:
      labels:
        app: codegraph
        component: api
      annotations:
        prometheus.io/scrape: "true"
        prometheus.io/port: "8000"
        prometheus.io/path: "/api/v1/metrics"
    spec:
      serviceAccountName: codegraph
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
        fsGroup: 1000

      containers:
        - name: api
          image: codegraph:latest
          imagePullPolicy: Always
          ports:
            - containerPort: 8000
              name: http
          envFrom:
            - secretRef:
                name: codegraph-secrets
          env:
            - name: SECURITY_ENABLED
              value: "true"
            - name: SIEM_ENABLED
              value: "true"
            - name: VAULT_ENABLED
              value: "true"
          volumeMounts:
            - name: config
              mountPath: /app/config.yaml
              subPath: config.yaml
            - name: duckdb-data
              mountPath: /app/data/duckdb
          resources:
            requests:
              cpu: "1"
              memory: "2Gi"
            limits:
              cpu: "2"
              memory: "4Gi"
          livenessProbe:
            httpGet:
              path: /api/v1/health/live
              port: 8000
            initialDelaySeconds: 30
            periodSeconds: 10
          readinessProbe:
            httpGet:
              path: /api/v1/health/ready
              port: 8000
            initialDelaySeconds: 5
            periodSeconds: 5
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop:
                - ALL

      volumes:
        - name: config
          configMap:
            name: codegraph-config
        - name: duckdb-data
          persistentVolumeClaim:
            claimName: codegraph-duckdb-pvc

      affinity:
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
            - weight: 100
              podAffinityTerm:
                labelSelector:
                  matchLabels:
                    app: codegraph
                topologyKey: kubernetes.io/hostname

# service.yaml
apiVersion: v1
kind: Service
metadata:
  name: codegraph-api
  namespace: codegraph
spec:
  type: ClusterIP
  ports:
    - port: 8000
      targetPort: 8000
      protocol: TCP
      name: http
  selector:
    app: codegraph
    component: api
---
# ingress.yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: codegraph-ingress
  namespace: codegraph
  annotations:
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
    nginx.ingress.kubernetes.io/proxy-body-size: "50m"
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
spec:
  ingressClassName: nginx
  tls:
    - hosts:
        - api.codegraph.company.com
      secretName: codegraph-tls
  rules:
    - host: api.codegraph.company.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: codegraph-api
                port:
                  number: 8000

# hpa.yaml
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: codegraph-api-hpa
  namespace: codegraph
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: codegraph-api
  minReplicas: 3
  maxReplicas: 10
  metrics:
    - type: Resource
      resource:
        name: cpu
        target:
          type: Utilization
          averageUtilization: 70
    - type: Resource
      resource:
        name: memory
        target:
          type: Utilization
          averageUtilization: 80
  behavior:
    scaleDown:
      stabilizationWindowSeconds: 300
      policies:
        - type: Percent
          value: 10
          periodSeconds: 60
    scaleUp:
      stabilizationWindowSeconds: 0
      policies:
        - type: Percent
          value: 100
          periodSeconds: 15

# networkpolicy.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: codegraph-network-policy
  namespace: codegraph
spec:
  podSelector:
    matchLabels:
      app: codegraph
  policyTypes:
    - Ingress
    - Egress
  ingress:
    # Разрешить трафик от ingress controller
    - from:
        - namespaceSelector:
            matchLabels:
              name: ingress-nginx
      ports:
        - protocol: TCP
          port: 8000
    # Разрешить трафик от Prometheus
    - from:
        - namespaceSelector:
            matchLabels:
              name: monitoring
      ports:
        - protocol: TCP
          port: 8000
  egress:
    # PostgreSQL
    - to:
        - podSelector:
            matchLabels:
              app: postgres
      ports:
        - protocol: TCP
          port: 5432
    # Vault
    - to:
        - namespaceSelector:
            matchLabels:
              name: vault
      ports:
        - protocol: TCP
          port: 8200
    # SIEM (Syslog)
    - to:
        - namespaceSelector:
            matchLabels:
              name: security
      ports:
        - protocol: UDP
          port: 514
    # LLM APIs (GigaChat, Yandex AI, OpenAI)
    - to:
        - ipBlock:
            cidr: 0.0.0.0/0
      ports:
        - protocol: TCP
          port: 443
    # DNS
    - to:
        - namespaceSelector: {}
          podSelector:
            matchLabels:
              k8s-app: kube-dns
      ports:
        - protocol: UDP
          port: 53

┌────────────────────────────────────────────────────────────────────────┐
│                        ИЗОЛИРОВАННАЯ СРЕДА                             │
│                                                                        │
│  ┌─────────────────────────────────────────────────────────────────┐   │
│  │                        БЕЗ ДОСТУПА К ИНТЕРНЕТУ                  │   │
│  │                                                                 │   │
│  │  ┌─────────────┐  ┌─────────────┐  ┌─────────────────────────┐  │   │
│  │  │ CodeGraph   │  │ Local LLM   │  │  Local Container        │  │   │
│  │  │ API         │  │ (llama.cpp) │  │  Registry               │  │   │
│  │  │             │──│             │  │                         │  │   │
│  │  │ DLP: ON     │  │             │  │  registry.local:5000    │  │   │
│  │  │ SIEM: ON    │  │             │  │                         │  │   │
│  │  │ Vault: ON   │  │             │  │                         │  │   │
│  │  └─────────────┘  └─────────────┘  └─────────────────────────┘  │   │
│  │                                                                 │   │
│  └─────────────────────────────────────────────────────────────────┘   │
│                                                                        │
│                           БЕЗ ВНЕШНИХ LLM API                          │
│                           ВСЕ ДАННЫЕ ОСТАЮТСЯ ЛОКАЛЬНО                 │
│                                                                        │
└────────────────────────────────────────────────────────────────────────┘

# config.yaml для изолированной среды
llm:
  # Использовать локальный LLM вместо GigaChat
  provider: "local"

  # Онлайн-режим: Qwen3-235B через Yandex AI Studio
  yandex:
    model: "qwen3-235b"

  # Офлайн-режим: Локальная модель через переменную окружения QWEN3_MODEL_PATH
  local:
    # Путь к модели (перенесена на носителе или задана через QWEN3_MODEL_PATH)
    model_path: "${QWEN3_MODEL_PATH:-/models/model.gguf}"
    n_ctx: 8192
    n_gpu_layers: -1  # Все слои на GPU
    n_batch: 512
    n_threads: 8

security:
  enabled: true

  # DLP работает локально
  dlp:
    enabled: true
    webhook:
      enabled: false  # Нет внешних вебхуков

  # SIEM — локальный сервер
  siem:
    enabled: true
    syslog:
      enabled: true
      host: "siem.local"
      port: 514

  # Vault — локальный экземпляр
  vault:
    enabled: true
    url: "http://vault.local:8200"
    auth_method: "approle"

#!/bin/bash
# prepare-airgapped.sh — запустить на машине с интернетом

# 1. Скачать Docker образы
docker pull codegraph:latest
docker pull postgres:16-alpine
docker pull codegraph/gocpg:latest
docker pull hashicorp/vault:1.15

# 2. Сохранить образы в tar
docker save codegraph:latest postgres:16-alpine \
  codegraph/gocpg:latest hashicorp/vault:1.15 \
  | gzip > codegraph-images.tar.gz

# 3. Скачать LLM модель
wget https://huggingface.co/company/-32B-GGUF/resolve/main/-32B-Q4_K_M.gguf

# 4. Скачать Python зависимости
pip download -d ./packages -r requirements.txt

# 5. Упаковать всё
tar -czvf codegraph-airgapped-bundle.tar.gz \
  codegraph-images.tar.gz \
  model.gguf \
  packages/ \
  config/ \
  scripts/

#!/bin/bash
# install-airgapped.sh — запустить в изолированной среде

# 1. Распаковать бандл
tar -xzvf codegraph-airgapped-bundle.tar.gz

# 2. Загрузить Docker образы
gunzip -c codegraph-images.tar.gz | docker load

# 3. Установить Python зависимости из локального кеша
pip install --no-index --find-links=./packages -r requirements.txt

# 4. Скопировать модель
cp model.gguf /models/

# 5. Запустить сервисы
docker compose -f docker-compose.airgapped.yml up -d

# Nginx Ingress с TLS 1.3
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: codegraph-ingress
  annotations:
    nginx.ingress.kubernetes.io/ssl-protocols: "TLSv1.3"
    nginx.ingress.kubernetes.io/ssl-ciphers: "TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256"
    nginx.ingress.kubernetes.io/configuration-snippet: |
      add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
      add_header X-Content-Type-Options "nosniff" always;
      add_header X-Frame-Options "DENY" always;
      add_header X-XSS-Protection "1; mode=block" always;

# PodSecurityPolicy / Pod Security Admission
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  name: codegraph-restricted
spec:
  privileged: false
  runAsUser:
    rule: MustRunAsNonRoot
  seLinux:
    rule: RunAsAny
  fsGroup:
    rule: RunAsAny
  volumes:
    - 'configMap'
    - 'emptyDir'
    - 'projected'
    - 'secret'
    - 'downwardAPI'
    - 'persistentVolumeClaim'
  hostNetwork: false
  hostIPC: false
  hostPID: false
  readOnlyRootFilesystem: true
  allowPrivilegeEscalation: false
  requiredDropCapabilities:
    - ALL

# EncryptionConfiguration для etcd
apiVersion: apiserver.config.k8s.io/v1
kind: EncryptionConfiguration
resources:
  - resources:
      - secrets
    providers:
      - aescbc:
          keys:
            - name: key1
              secret: <base64-encoded-32-byte-key>
      - identity: {}

apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  name: codegraph-monitor
  namespace: codegraph
spec:
  selector:
    matchLabels:
      app: codegraph
  endpoints:
    - port: http
      path: /api/v1/metrics
      interval: 30s

apiVersion: monitoring.coreos.com/v1
kind: PrometheusRule
metadata:
  name: codegraph-alerts
  namespace: codegraph
spec:
  groups:
    - name: codegraph
      rules:
        - alert: CodeGraphHighErrorRate
          expr: rate(http_requests_total{status=~"5.."}[5m]) > 0.1
          for: 5m
          labels:
            severity: critical
          annotations:
            summary: "High error rate on CodeGraph API"

        - alert: CodeGraphDLPHighBlockRate
          expr: rate(dlp_blocks_total[5m]) / rate(llm_requests_total[5m]) > 0.2
          for: 10m
          labels:
            severity: warning
          annotations:
            summary: "DLP blocking more than 20% of requests"

        - alert: CodeGraphPodNotReady
          expr: kube_pod_status_ready{namespace="codegraph", condition="true"} == 0
          for: 5m
          labels:
            severity: critical
          annotations:
            summary: "CodeGraph pod not ready"

#!/bin/bash
# backup-postgres.sh

BACKUP_DIR="/backups/postgres"
DATE=$(date +%Y%m%d_%H%M%S)
NAMESPACE="codegraph"

# Создать резервное копирование
kubectl exec -n $NAMESPACE postgres-0 -- \
  pg_dump -U postgres codegraph | gzip > $BACKUP_DIR/codegraph_$DATE.sql.gz

# Удалить старые резервные копии (старше 30 дней)
find $BACKUP_DIR -name "*.sql.gz" -mtime +30 -delete

#!/bin/bash
# backup-duckdb.sh

BACKUP_DIR="/backups/duckdb"
DATE=$(date +%Y%m%d_%H%M%S)

# Копировать файлы DuckDB
kubectl cp codegraph/codegraph-api-0:/app/data/duckdb $BACKUP_DIR/duckdb_$DATE

# Сжать
tar -czvf $BACKUP_DIR/duckdb_$DATE.tar.gz -C $BACKUP_DIR duckdb_$DATE
rm -rf $BACKUP_DIR/duckdb_$DATE

# Обновление образа с нулевым простоем
kubectl set image deployment/codegraph-api \
  api=codegraph:v2.0.0 \
  -n codegraph

# Мониторинг rollout
kubectl rollout status deployment/codegraph-api -n codegraph

# Откат при проблемах
kubectl rollout undo deployment/codegraph-api -n codegraph

# Запуск миграций Alembic
kubectl exec -n codegraph deployment/codegraph-api -- \
  python -m alembic upgrade head

# Проверка текущей версии
kubectl exec -n codegraph deployment/codegraph-api -- \
  python -m alembic current