feat: release v1.0.1 CADWorld 网站与 LeKiwi 智能抓放

集成同源 BYOK 会话隔离、精简模型设置、官方订阅入口和 HTTPS 发布运维；保留本地训练/调参与控制能力。同步 npm 版本及 CHANGELOG，记录公网真实 API 验收仍待用户凭据。
2026-09-24 09:57:41 +08:00
parent 3ad29356c9
commit f3a8a38acd
194 changed files with 32918 additions and 236 deletions
@@ -0,0 +1,58 @@
+name: cadworld-sim
+services:
+  decision:
+    image: cadworld-decision:${CADWORLD_RELEASE:?release tag required}
+    command:
+      - --website-origin
+      - https://cadworld-sim.robotquan.com
+      - --bind
+      - 0.0.0.0
+      - --trusted-proxy
+      - 172.30.88.1
+    ports:
+      - '127.0.0.1:8768:8768'
+    restart: unless-stopped
+    init: true
+    read_only: true
+    tmpfs:
+      - /tmp:rw,noexec,nosuid,size=268435456,mode=1777
+    cap_drop: [ALL]
+    security_opt: [no-new-privileges:true]
+    mem_limit: 2g
+    cpus: 2
+    pids_limit: 128
+    stop_grace_period: 20s
+    healthcheck:
+      test:
+        [
+          CMD,
+          python,
+          -c,
+          "import urllib.request; r=urllib.request.Request('http://127.0.0.1:8768/healthz',headers={'Host':'cadworld-sim.robotquan.com'}); urllib.request.urlopen(r,timeout=3).read()",
+        ]
+      interval: 15s
+      timeout: 5s
+      retries: 3
+      start_period: 15s
+    logging:
+      driver: json-file
+      options: { max-size: 5m, max-file: '3' }
+    networks: [cadworld]
+  certbot:
+    image: cadworld-certbot:locked
+    profiles: [maintenance]
+    volumes:
+      - /opt/1panel/apps/openresty/openresty/www/acme/cadworld-sim.robotquan.com:/var/www/acme
+      - /opt/1panel/apps/openresty/openresty/www/ssl/cadworld-sim.robotquan.com:/etc/letsencrypt
+    tmpfs:
+      - /var/lib/letsencrypt
+      - /var/log/letsencrypt
+    cap_drop: [ALL]
+    security_opt: [no-new-privileges:true]
+    networks: [cadworld]
+networks:
+  cadworld:
+    ipam:
+      config:
+        - subnet: 172.30.88.0/24
+          gateway: 172.30.88.1