phptits
0d6cd37579
- Monorepo: NestJS API (Fastify) + React web (antd/ProComponents) + shared packages - PostgreSQL/Prisma (unified resources, relations graph, audit, events, jobs) - Auth/RBAC/workspace isolation, credential vault (AES-256-GCM) - Servers/SSH, Docker discovery & lifecycle, Job Center - Websites & deployments (git provider credential clone, env, health verification) - Domains/DNS (Cloudflare adapter), certificates (TLS probe), monitoring - Automation (cron/event/webhook HMAC + notifications), AI Gateway, MCP (29 tools) - AI chat window (LLM function-calling + rules fallback, SSE streaming, approvals) - Notes: Vditor WYSIWYG markdown editor, non-blocking autosave - Tests: 35 unit/security tests; UI audit clean (desktop+mobile, deep links)
64 lines
3.7 KiB
Markdown
64 lines
3.7 KiB
Markdown
# DevOS v1 数据库文档
|
||
|
||
PostgreSQL 为系统记录源；Prisma 为 ORM。迁移位于 `prisma/migrations/`（基线 `20260908000000_init`）。
|
||
表名统一 snake_case（`@@map`）；列名为 camelCase（Prisma 默认）。
|
||
|
||
## 表清单
|
||
|
||
### 身份与租户
|
||
| 表 | 说明 |
|
||
| --- | --- |
|
||
| `users` | 平台用户（argon2id/scrypt 密码哈希） |
|
||
| `workspaces` | 租户/安全边界 |
|
||
| `workspace_members` | 用户-工作区关系 + 角色（OWNER/ADMIN/MEMBER/VIEWER），UNIQUE(workspaceId,userId) |
|
||
|
||
### 统一资源模型
|
||
| 表 | 说明 |
|
||
| --- | --- |
|
||
| `resources` | 资源身份/发现/状态公共字段（type/name/provider/status/metadata）；领域表经 `resourceId` 一对一关联 |
|
||
| `resource_relations` | 有向关系边（UNIQUE source+target+relationType），如 deployed_on / runs_container / has_domain / resolves_to / monitors / has_deployment |
|
||
|
||
索引：`workspaceId`、`(type,status)`、`(workspaceId,type)`、关系端点。
|
||
|
||
### 凭据与合规
|
||
| 表 | 说明 |
|
||
| --- | --- |
|
||
| `credentials` | AES-256-GCM 密文（`encryptedData` JSON：iv/tag/data，base64；AAD=workspaceId） |
|
||
| `audit_logs` | 每个变更一条：actorType/actorId/action/resource/riskLevel/status/requestId/ip/metadata（已脱敏）。索引 `(workspaceId,createdAt)`、`(resourceType,resourceId)` |
|
||
| `events` | 领域事件：eventType/resourceId/payload/correlationId。索引 `(eventType,createdAt)` |
|
||
| `jobs` | 异步任务状态机：PENDING→RUNNING→SUCCEEDED/FAILED/CANCELLED/DEAD；`attempts/maxAttempts/runAt`（指数退避），SKIP LOCKED 认领，15 分钟僵死回收。索引 `(status,runAt)` |
|
||
|
||
### 基础设施域
|
||
| 表 | 说明 |
|
||
| --- | --- |
|
||
| `servers` | SSH 目标（host/port/username/authType/provider("ssh"\|"local")/credentialId/osInfo/lastSeenAt） |
|
||
| `containers` | docker 发现结果（containerId/name/image/state/ports/labels）→ serverId |
|
||
| `websites` | 可部署应用（primaryDomain/serverId/repositoryUrl/deployType/port/healthPath/env） |
|
||
| `domains` | 域名 + provider（CLOUDFLARE/MANUAL）+ credentialId |
|
||
| `domain_records` | DNS 记录（UNIQUE domain+type+name+value；providerRecordId 为云侧 ID） |
|
||
| `deployments` | 部署执行（status QUEUED→RUNNING→…；trigger/progress/commit/config（branch、cancelRequested）/error）。索引 `(websiteId,createdAt)` |
|
||
| `deployment_logs` | 步骤日志行（seq 顺序）。索引 `(deploymentId,seq)` |
|
||
| `monitors` | 健康检查配置（kind/target/intervalSec/lastStatus/consecutiveFailures）。索引 `(enabled,lastCheckedAt)` |
|
||
| `monitor_results` | 检查结果历史（ok/status/latencyMs/error）。索引 `(monitorId,createdAt)` |
|
||
|
||
### 自动化与 AI
|
||
| 表 | 说明 |
|
||
| --- | --- |
|
||
| `automations` | Trigger（MANUAL/CRON/EVENT/WEBHOOK）+ triggerConfig + conditions + actions（JSON）+ lastTriggeredAt |
|
||
| `automation_runs` | 执行历史（status/stepIndex/logs/error/correlationId） |
|
||
| `ai_runs` | AI 运行：status（PLANNING→AWAITING_APPROVAL→RUNNING→SUCCEEDED/FAILED/REJECTED）、plan/toolCalls/verification JSON、riskLevel、approvedBy |
|
||
|
||
## 关键设计约束
|
||
|
||
1. **租户隔离**：所有领域表带 `workspaceId`；服务层查询一律带 workspace 谓词；守卫校验路径参数中的 workspaceId 成员资格。
|
||
2. **资源 ↔ 领域表**：领域行创建与 resources 行在同一个事务中；删除走 `onDelete: Cascade`。
|
||
3. **密文隔离**：明文机密只在内存短暂存在；`audit metadata` 与日志经 `maskSecrets()` 脱敏。
|
||
4. **事件追溯**：events/audit_logs/jobs 均记录 correlationId / requestId，贯穿 HTTP 与 worker。
|
||
|
||
## 迁移与种子
|
||
|
||
```bash
|
||
bunx prisma migrate deploy # 应用迁移
|
||
bun run prisma/seed.ts # 幂等种子：管理员 + Main Workspace（OWNER）
|
||
```
|