phptits
0d6cd37579
- Monorepo: NestJS API (Fastify) + React web (antd/ProComponents) + shared packages - PostgreSQL/Prisma (unified resources, relations graph, audit, events, jobs) - Auth/RBAC/workspace isolation, credential vault (AES-256-GCM) - Servers/SSH, Docker discovery & lifecycle, Job Center - Websites & deployments (git provider credential clone, env, health verification) - Domains/DNS (Cloudflare adapter), certificates (TLS probe), monitoring - Automation (cron/event/webhook HMAC + notifications), AI Gateway, MCP (29 tools) - AI chat window (LLM function-calling + rules fallback, SSE streaming, approvals) - Notes: Vditor WYSIWYG markdown editor, non-blocking autosave - Tests: 35 unit/security tests; UI audit clean (desktop+mobile, deep links)
120 lines
1.8 KiB
Markdown
120 lines
1.8 KiB
Markdown
# DevOS v1 Database Schema
|
|
|
|
## 1. Persistence Strategy
|
|
PostgreSQL is the system of record. Prisma is the initial ORM.
|
|
|
|
## 2. Core Tables
|
|
|
|
Recommended initial tables:
|
|
- users
|
|
- workspaces
|
|
- workspace_members
|
|
- resources
|
|
- resource_relations
|
|
- projects
|
|
- project_resources
|
|
- credentials
|
|
- audit_logs
|
|
- events
|
|
- jobs
|
|
- deployments
|
|
- servers
|
|
- websites
|
|
- domains
|
|
- containers
|
|
- monitors
|
|
|
|
## 3. Resource Table
|
|
|
|
Conceptual schema:
|
|
|
|
```text
|
|
resources
|
|
- id
|
|
- workspace_id
|
|
- type
|
|
- name
|
|
- provider
|
|
- status
|
|
- metadata_json
|
|
- created_at
|
|
- updated_at
|
|
```
|
|
|
|
Use a typed domain table when the resource has substantial operational state; use `resources` for identity, discovery and graph-level common fields.
|
|
|
|
## 4. Resource Relations
|
|
|
|
```text
|
|
resource_relations
|
|
- id
|
|
- workspace_id
|
|
- source_resource_id
|
|
- target_resource_id
|
|
- relation_type
|
|
- metadata_json
|
|
- created_at
|
|
```
|
|
|
|
This allows the resource graph to evolve without embedding every relationship into one giant table.
|
|
|
|
## 5. Credential Storage
|
|
Store encrypted credential payloads separately from general resource metadata.
|
|
|
|
```text
|
|
credentials
|
|
- id
|
|
- workspace_id
|
|
- type
|
|
- provider
|
|
- encrypted_data
|
|
- metadata_json
|
|
- created_at
|
|
- updated_at
|
|
```
|
|
|
|
The application must never log decrypted credential material.
|
|
|
|
## 6. Audit Log
|
|
|
|
```text
|
|
audit_logs
|
|
- id
|
|
- workspace_id
|
|
- actor_type
|
|
- actor_id
|
|
- action
|
|
- resource_type
|
|
- resource_id
|
|
- risk_level
|
|
- status
|
|
- request_id
|
|
- metadata_json
|
|
- created_at
|
|
```
|
|
|
|
## 7. Event
|
|
|
|
```text
|
|
events
|
|
- id
|
|
- workspace_id
|
|
- event_type
|
|
- resource_id
|
|
- payload_json
|
|
- correlation_id
|
|
- created_at
|
|
```
|
|
|
|
## 8. Indexing
|
|
At minimum index:
|
|
- workspace_id
|
|
- resource type/status
|
|
- resource relation endpoints
|
|
- event type + created_at
|
|
- audit workspace + created_at
|
|
- deployment website/project + created_at
|
|
- jobs status + scheduled_at
|
|
|
|
Exact migrations should be generated from the implementation model and reviewed before production.
|