clossers/didi-lot2-backend
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

livrare lot 2

Browse source
This commit is contained in:
EVOTECH IT SRL 2026-07-10 03:39:53 -07:00
commit 8ecc78e729
763 changed files with 164593 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

537
backend/services/gateway-auth-layer/didiKong/declarative/kong-cluster.yml Normal file
View file

@ -0,0 +1,537 @@
_format_version: "3.0"
_info:
select_tags:
- product:didi
- env:prod
defaults:
route:
# Routes accept both HTTP and HTTPS (matches cluster pattern for lege365/rafai/etc).
# HAProxy LB terminates TLS at edge, forwards HTTP to Kong DP — Kong must accept HTTP
# internally or it returns 426 "Please use HTTPS protocol".
protocols: [http, https]
# ============================================================
# DIDI tenant configuration for shared Kong cluster
# Cluster CP: 10.11.10.176:8001 | DP1: 10.11.10.177 | DP2: 10.11.10.178 | LB: 10.11.10.175
# Hosts: didi365.eu (public) + www.didi365.eu + localhost (internal alias)
# Upstreams: 10.11.10.12 (DIDI host) on exposed ports
# Plugins are applied per-service (NOT global) — cluster shared with lege365/rafai/biddie/notify
# ============================================================
# ============================================================
# CONSUMERS — JWT issuers preserved from local Kong (Keycloak realm didi-clients)
# ============================================================
consumers:
- username: didi-keycloak-users
custom_id: didi-keycloak-users
tags: [product:didi, env:prod]
jwt_secrets:
- algorithm: RS256
key: https://localhost/auth/realms/didi-clients
secret: 1qG51hpfTte1TGQzcAhKWjVkXsMWNIun
rsa_public_key: |-
-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAlpv0lfjAFPGV4hLK6jp6
EsVlxax2nPA9I2IzGwNUIK8AsKwC9qu+737jarsjewx3ya/0s1uDP0ilbdh+wEzW
Do/8jjWd0DxgTxMxCTS7DU07UZKXJWGc/Z+ansUPUcjqJ+uLTdu331z7ajK2FIZF
7yYH2WgjzApF6YSMx/dqybp/bdmBrvsPDGv1EJK4a72jV3P86WCW4ZDax2Qayw1t
iKnO3+o6xvyoVSMeVJbs9ArjpAldueMLfTZqYBSmWe/rlBSIMWYkKTSgS+pdakez
G71qs2RcSkI+GxlfJw0DJA8TfSjol6zc+EIUtAYG0pwwAqPB2PvkxMoDbL2UDkZE
/wIDAQAB
-----END PUBLIC KEY-----
- algorithm: RS256
key: https://didi365.eu/auth/realms/didi-clients
secret: IS8AJNbvC3taNROALc4bHslsZnSKELQD
rsa_public_key: |
-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAlpv0lfjAFPGV4hLK6jp6
EsVlxax2nPA9I2IzGwNUIK8AsKwC9qu+737jarsjewx3ya/0s1uDP0ilbdh+wEzW
Do/8jjWd0DxgTxMxCTS7DU07UZKXJWGc/Z+ansUPUcjqJ+uLTdu331z7ajK2FIZF
7yYH2WgjzApF6YSMx/dqybp/bdmBrvsPDGv1EJK4a72jV3P86WCW4ZDax2Qayw1t
iKnO3+o6xvyoVSMeVJbs9ArjpAldueMLfTZqYBSmWe/rlBSIMWYkKTSgS+pdakez
G71qs2RcSkI+GxlfJw0DJA8TfSjol6zc+EIUtAYG0pwwAqPB2PvkxMoDbL2UDkZE
/wIDAQAB
-----END PUBLIC KEY-----
# SSO cluster (sso.local) — added 2026-04-29 after migration la Keycloak SSO public.
# Same RSA public key (realm exported/imported from local with key preserved).
- algorithm: RS256
key: https://sso.local/realms/didi-clients
secret: lEyVoR2eXLgWmQQ5q6fZRbCkVJhSaTuB
rsa_public_key: |-
-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAlpv0lfjAFPGV4hLK6jp6
EsVlxax2nPA9I2IzGwNUIK8AsKwC9qu+737jarsjewx3ya/0s1uDP0ilbdh+wEzW
Do/8jjWd0DxgTxMxCTS7DU07UZKXJWGc/Z+ansUPUcjqJ+uLTdu331z7ajK2FIZF
7yYH2WgjzApF6YSMx/dqybp/bdmBrvsPDGv1EJK4a72jV3P86WCW4ZDax2Qayw1t
iKnO3+o6xvyoVSMeVJbs9ArjpAldueMLfTZqYBSmWe/rlBSIMWYkKTSgS+pdakez
G71qs2RcSkI+GxlfJw0DJA8TfSjol6zc+EIUtAYG0pwwAqPB2PvkxMoDbL2UDkZE
/wIDAQAB
-----END PUBLIC KEY-----
# Internal SSO host (used during transition; also kept for proxy fallback paths)
- algorithm: RS256
key: https://sso-admin.local/realms/didi-clients
secret: kPwQjA4nFsUzMxRyV8tDeBcGhJlOvIuS
rsa_public_key: |-
-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAlpv0lfjAFPGV4hLK6jp6
EsVlxax2nPA9I2IzGwNUIK8AsKwC9qu+737jarsjewx3ya/0s1uDP0ilbdh+wEzW
Do/8jjWd0DxgTxMxCTS7DU07UZKXJWGc/Z+ansUPUcjqJ+uLTdu331z7ajK2FIZF
7yYH2WgjzApF6YSMx/dqybp/bdmBrvsPDGv1EJK4a72jV3P86WCW4ZDax2Qayw1t
iKnO3+o6xvyoVSMeVJbs9ArjpAldueMLfTZqYBSmWe/rlBSIMWYkKTSgS+pdakez
G71qs2RcSkI+GxlfJw0DJA8TfSjol6zc+EIUtAYG0pwwAqPB2PvkxMoDbL2UDkZE
/wIDAQAB
-----END PUBLIC KEY-----
# didi-admins realm — admin-dashboard SPA auth (added 2026-05-04)
# Different RSA key than didi-clients (separate realm).
- algorithm: RS256
key: https://didi365.eu/auth/realms/didi-admins
secret: aDmInS001PuBlIcEdge2026May04PaSsKonGvErY
rsa_public_key: |-
-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAkcx2UE88P4j4XzWQ/bsd
0C69xZuxo/VXvhyKPj/t7u6ILIpD3/KL0sI0Ei4ZOlfjZ8PHmmEhWVwOYRCyhxgN
aq5EMk4MKmUJ0KZd6pixvufKp8ddnI/xKdUROLbdzEHSxP251uHUUCYzpsKYisZ7
t6UidWgDBDrcU42YsV4OggvPlvemtQKFawv0CpQ7BLhyTm2WUD4iq7H17OEI975i
ocC7Zqrk9itl2o0w8x9fSMOyMgsEafkVQ/KIuZA1/kKugtpG9eyYE49RFH7iQZd9
KmQow/XDxtKHfaLi1CEU4X2fHCThMWKdRQeK8N1n6qS+yanygcYJlUf8FKybgRxZ
NwIDAQAB
-----END PUBLIC KEY-----
- algorithm: RS256
key: https://sso.local/realms/didi-admins
secret: aDmInS002SsOcLuStEr2026May04PaSsKonGvErY
rsa_public_key: |-
-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAkcx2UE88P4j4XzWQ/bsd
0C69xZuxo/VXvhyKPj/t7u6ILIpD3/KL0sI0Ei4ZOlfjZ8PHmmEhWVwOYRCyhxgN
aq5EMk4MKmUJ0KZd6pixvufKp8ddnI/xKdUROLbdzEHSxP251uHUUCYzpsKYisZ7
t6UidWgDBDrcU42YsV4OggvPlvemtQKFawv0CpQ7BLhyTm2WUD4iq7H17OEI975i
ocC7Zqrk9itl2o0w8x9fSMOyMgsEafkVQ/KIuZA1/kKugtpG9eyYE49RFH7iQZd9
KmQow/XDxtKHfaLi1CEU4X2fHCThMWKdRQeK8N1n6qS+yanygcYJlUf8FKybgRxZ
NwIDAQAB
-----END PUBLIC KEY-----
- algorithm: RS256
key: https://sso-admin.local/realms/didi-admins
secret: aDmInS003LoCaLcLuStEr2026May04PaSsKonGv
rsa_public_key: |-
-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAkcx2UE88P4j4XzWQ/bsd
0C69xZuxo/VXvhyKPj/t7u6ILIpD3/KL0sI0Ei4ZOlfjZ8PHmmEhWVwOYRCyhxgN
aq5EMk4MKmUJ0KZd6pixvufKp8ddnI/xKdUROLbdzEHSxP251uHUUCYzpsKYisZ7
t6UidWgDBDrcU42YsV4OggvPlvemtQKFawv0CpQ7BLhyTm2WUD4iq7H17OEI975i
ocC7Zqrk9itl2o0w8x9fSMOyMgsEafkVQ/KIuZA1/kKugtpG9eyYE49RFH7iQZd9
KmQow/XDxtKHfaLi1CEU4X2fHCThMWKdRQeK8N1n6qS+yanygcYJlUf8FKybgRxZ
NwIDAQAB
-----END PUBLIC KEY-----
- algorithm: RS256
key: https://localhost/auth/realms/didi-admins
secret: aDmInS004DiDi11LoCaL2026May04PaSsKonGvE
rsa_public_key: |-
-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAkcx2UE88P4j4XzWQ/bsd
0C69xZuxo/VXvhyKPj/t7u6ILIpD3/KL0sI0Ei4ZOlfjZ8PHmmEhWVwOYRCyhxgN
aq5EMk4MKmUJ0KZd6pixvufKp8ddnI/xKdUROLbdzEHSxP251uHUUCYzpsKYisZ7
t6UidWgDBDrcU42YsV4OggvPlvemtQKFawv0CpQ7BLhyTm2WUD4iq7H17OEI975i
ocC7Zqrk9itl2o0w8x9fSMOyMgsEafkVQ/KIuZA1/kKugtpG9eyYE49RFH7iQZd9
KmQow/XDxtKHfaLi1CEU4X2fHCThMWKdRQeK8N1n6qS+yanygcYJlUf8FKybgRxZ
NwIDAQAB
-----END PUBLIC KEY-----
# ============================================================
# SERVICES (4 consolidated from 9 local) + ROUTES + PER-SERVICE PLUGINS
# ============================================================
services:
# ----------------------------------------------------------
# SERVICE 1: didi-agent-v3 (was: agent-api + agent-v3 + agent-v3-api)
# ----------------------------------------------------------
- name: didi-agent-v3
protocol: http
host: 10.11.10.12
port: 24803
retries: 5
connect_timeout: 60000
write_timeout: 660000
read_timeout: 660000
tags: [product:didi, env:prod, kind:api]
plugins:
- name: cors
tags: [product:didi, env:prod]
config:
# chrome-extension://* and moz-extension://* required for browser extension API
origins: [https://didi365.eu, https://www.didi365.eu, "chrome-extension://[a-z]+", "moz-extension://[a-z0-9-]+"]
methods: [GET, POST, PUT, DELETE, OPTIONS, PATCH]
# X-API-Key header required for extension auth
headers: [Accept, Authorization, Content-Type, X-Request-ID, X-API-Key]
exposed_headers: [X-Request-ID]
credentials: true
max_age: 3600
preflight_continue: false
- name: request-size-limiting
tags: [product:didi, env:prod]
config:
allowed_payload_size: 104857600
size_unit: bytes
require_content_length: false
- name: response-transformer
tags: [product:didi, env:prod]
config:
add:
headers: ["X-Gateway:DIDI-Kong-Cluster", "X-API-Version:2.0"]
remove:
headers: [Server, Via]
- name: correlation-id
tags: [product:didi, env:prod]
config:
header_name: X-Request-ID
generator: uuid
echo_downstream: true
routes:
# JWT-protected endpoints
- name: didi-agent-abort
paths: [/api/abort]
methods: [POST, OPTIONS]
hosts: &didi-hosts [didi365.eu, www.didi365.eu, localhost]
strip_path: false
preserve_host: true
tags: [product:didi, env:prod]
plugins:
- name: jwt
config: &jwt-config
key_claim_name: iss
claims_to_verify: [exp]
header_names: [authorization]
uri_param_names: [jwt]
run_on_preflight: true
secret_is_base64: false
maximum_expiration: 0
- name: didi-agent-admin-services
paths: [/api/v1/admin/services]
methods: [GET, OPTIONS]
hosts: *didi-hosts
strip_path: false
preserve_host: true
tags: [product:didi, env:prod]
plugins:
- name: jwt
config: *jwt-config
- name: didi-agent-analysis
paths: [/api/analysis]
hosts: *didi-hosts
strip_path: false
preserve_host: true
tags: [product:didi, env:prod]
plugins:
- name: jwt
config: *jwt-config
- name: didi-agent-analyze
paths: [/api/analyze]
methods: [POST, OPTIONS]
hosts: *didi-hosts
strip_path: false
preserve_host: true
tags: [product:didi, env:prod]
plugins:
- name: jwt
config: *jwt-config
- name: didi-agent-jobs
paths: [/api/v1/jobs]
methods: [GET, POST, DELETE, OPTIONS]
hosts: *didi-hosts
strip_path: false
preserve_host: true
tags: [product:didi, env:prod]
plugins:
- name: jwt
config: *jwt-config
- name: didi-agent-pipelines
paths: [/api/pipelines]
methods: [GET, OPTIONS]
hosts: *didi-hosts
strip_path: false
preserve_host: true
tags: [product:didi, env:prod]
plugins:
- name: jwt
config: *jwt-config
- name: didi-agent-progress
paths: [/api/progress]
hosts: *didi-hosts
strip_path: false
preserve_host: true
tags: [product:didi, env:prod]
plugins:
- name: jwt
config: *jwt-config
- name: didi-agent-sessions
paths: [/api/sessions]
methods: [GET, OPTIONS]
hosts: *didi-hosts
strip_path: false
preserve_host: true
tags: [product:didi, env:prod]
plugins:
- name: jwt
config: *jwt-config
- name: didi-agent-storage
paths: [/api/storage]
methods: [GET, POST, DELETE, OPTIONS]
hosts: *didi-hosts
strip_path: false
preserve_host: true
tags: [product:didi, env:prod]
plugins:
- name: jwt
config: *jwt-config
- name: didi-agent-subscriptions-v1
# Legacy v1 endpoint on agent-v3 (current v2 is on framework-api)
paths: [/api/v1/subscriptions]
methods: [GET, POST, DELETE, OPTIONS]
hosts: *didi-hosts
strip_path: false
preserve_host: true
tags: [product:didi, env:prod, legacy:v1]
plugins:
- name: jwt
config: *jwt-config
- name: didi-agent-upload
paths: [/api/upload]
methods: [POST, OPTIONS]
hosts: *didi-hosts
strip_path: false
preserve_host: true
tags: [product:didi, env:prod]
plugins:
- name: jwt
config: *jwt-config
# Public endpoints (no JWT)
- name: didi-agent-health
# Local had strip_path=true: /agent/health -> "/" on agent-v3 (root, returns 200)
paths: [/agent/health]
methods: [GET, OPTIONS]
hosts: *didi-hosts
strip_path: true
preserve_host: true
tags: [product:didi, env:prod, public:true]
- name: didi-agent-status
paths: [/api/status]
methods: [GET, OPTIONS]
hosts: *didi-hosts
strip_path: false
preserve_host: true
tags: [product:didi, env:prod, public:true]
- name: didi-agent-media-public
# Public media playback proxy (range-supported, served by agent-v3 itself)
paths: [/api/v3/media/file]
hosts: *didi-hosts
strip_path: false
preserve_host: true
tags: [product:didi, env:prod, public:true]
- name: didi-agent-v3-prefix
# Edge nginx forwards /agent-v3/* here. Local Kong stripped the prefix
# (e.g. /agent-v3/api/v3/health -> /api/v3/health on agent-v3).
# Local had JWT plugin on this route — preserved here to match security model.
paths: [/agent-v3]
hosts: *didi-hosts
strip_path: true
preserve_host: true
tags: [product:didi, env:prod]
plugins:
- name: jwt
config: *jwt-config
# Browser extension API endpoints — NO JWT (X-API-Key validated in agent-v3).
# All four routes share the same request-transformer pattern + rate-limit.
# Regex paths (~ prefix) with `$` anchor prevent /analyze matching /analyze-async.
- name: didi-agent-extension-analyze
# Sync analyze (legacy — small text only, hits Cloudflare 100s timeout otherwise)
paths: [~/agent-v3/api/v3/pipeline/extension/analyze$]
methods: [POST, OPTIONS]
hosts: *didi-hosts
strip_path: false
preserve_host: true
tags: [product:didi, env:prod, public:true, auth:api-key]
plugins:
- name: request-transformer
config:
replace:
uri: /api/v3/pipeline/extension/analyze
- name: rate-limiting
config: &ext-rate-limit
minute: 30
hour: 500
policy: local
limit_by: header
header_name: X-API-Key
fault_tolerant: true
hide_client_headers: false
error_code: 429
error_message: "API rate limit exceeded"
- name: didi-agent-extension-analyze-async
# Async dispatch — returns 202 + session_id (used by extension for all flows)
paths: [~/agent-v3/api/v3/pipeline/extension/analyze-async$]
methods: [POST, OPTIONS]
hosts: *didi-hosts
strip_path: false
preserve_host: true
tags: [product:didi, env:prod, public:true, auth:api-key]
plugins:
- name: request-transformer
config:
replace:
uri: /api/v3/pipeline/extension/analyze-async
- name: rate-limiting
config: *ext-rate-limit
- name: didi-agent-extension-upload
# Multipart media upload (screenshot/video) — multer expects "file" field
paths: [~/agent-v3/api/v3/pipeline/extension/upload$]
methods: [POST, OPTIONS]
hosts: *didi-hosts
strip_path: false
preserve_host: true
tags: [product:didi, env:prod, public:true, auth:api-key]
plugins:
- name: request-transformer
config:
replace:
uri: /api/v3/pipeline/extension/upload
- name: rate-limiting
config: *ext-rate-limit
- name: didi-agent-extension-status
# Polling endpoint with sessionId capture — rewrite preserves the UUID
paths: ['~/agent-v3/api/v3/pipeline/extension/status/(?<sid>[\w-]+)$']
methods: [GET, OPTIONS]
hosts: *didi-hosts
strip_path: false
preserve_host: true
tags: [product:didi, env:prod, public:true, auth:api-key]
plugins:
- name: request-transformer
config:
replace:
uri: /api/v3/pipeline/extension/status/$(uri_captures.sid)
- name: rate-limiting
config:
# Polling can hit this every 2s — bump per-minute limit
minute: 120
hour: 2000
policy: local
limit_by: header
header_name: X-API-Key
fault_tolerant: true
hide_client_headers: false
error_code: 429
error_message: "Polling rate limit exceeded"
# ----------------------------------------------------------
# SERVICE 2: didi-framework (was: framework-api + didi-framework)
# ----------------------------------------------------------
- name: didi-framework
protocol: http
host: 10.11.10.12
port: 3005
retries: 5
connect_timeout: 60000
write_timeout: 60000
read_timeout: 60000
tags: [product:didi, env:prod, kind:api]
plugins:
- name: cors
tags: [product:didi, env:prod]
config:
origins: [https://didi365.eu, https://www.didi365.eu]
methods: [GET, POST, PUT, DELETE, OPTIONS, PATCH]
headers: [Accept, Authorization, Content-Type, X-Request-ID]
exposed_headers: [X-Request-ID]
credentials: true
max_age: 3600
preflight_continue: false
- name: request-size-limiting
tags: [product:didi, env:prod]
config:
allowed_payload_size: 104857600
size_unit: bytes
require_content_length: false
- name: response-transformer
tags: [product:didi, env:prod]
config:
add:
headers: ["X-Gateway:DIDI-Kong-Cluster", "X-API-Version:2.0"]
remove:
headers: [Server, Via]
- name: correlation-id
tags: [product:didi, env:prod]
config:
header_name: X-Request-ID
generator: uuid
echo_downstream: true
routes:
- name: didi-framework-auth
paths: [/api/auth]
methods: [GET, POST, PUT, DELETE, OPTIONS]
hosts: *didi-hosts
strip_path: false
preserve_host: true
tags: [product:didi, env:prod]
plugins:
- name: jwt
config: *jwt-config
- name: didi-framework-auth-verify-email
# PUBLIC route — must beat /api/auth (JWT) on priority
paths: [/api/auth/verify-email]
methods: [GET, POST]
hosts: *didi-hosts
strip_path: false
preserve_host: true
regex_priority: 100
tags: [product:didi, env:prod, public:true]
- name: didi-framework-history
paths: [/api/history]
hosts: *didi-hosts
strip_path: false
preserve_host: true
tags: [product:didi, env:prod]
plugins:
- name: jwt
config: *jwt-config
- name: didi-framework-subscriptions
# Current /api/subscriptions endpoint (v2). Legacy /api/v1/subscriptions is on agent-v3.
paths: [/api/subscriptions]
methods: [GET, POST, DELETE, OPTIONS]
hosts: *didi-hosts
strip_path: false
preserve_host: true
tags: [product:didi, env:prod]
plugins:
- name: jwt
config: *jwt-config
- name: didi-framework-waitlist
# PUBLIC waitlist signup. Local Kong had this duplicated (one with JWT, one without).
# Keeping no-JWT version — public signup is correct behavior.
paths: [/api/waitlist]
methods: [GET, POST, DELETE, OPTIONS]
hosts: *didi-hosts
strip_path: false
preserve_host: true
tags: [product:didi, env:prod, public:true]
- name: didi-framework-direct
# Legacy /framework prefix — local had strip_path=true so /framework/api/X -> /api/X on framework
paths: [/framework]
hosts: *didi-hosts
strip_path: true
preserve_host: true
tags: [product:didi, env:prod]
# ----------------------------------------------------------
# NOTE: didi-admin NOT migrated — internal-only (VPN access to 10.11.10.12 directly).
# Will be revisited after admin nginx is replaced with simpler setup.
# ----------------------------------------------------------
# ----------------------------------------------------------
# NOTE: didi-keycloak service REMOVED 2026-04-29.
# DIDI now uses the external SSO cluster (https://sso.local/realms/didi-clients) directly
# — SPA goes browser→sso.local, no proxy through cluster Kong needed.
# JWT consumer didi-keycloak-users still validates tokens for SSO issuer.
# ----------------------------------------------------------

1321
backend/services/gateway-auth-layer/didiKong/declarative/kong-local-backup.yml Normal file
View file

File diff suppressed because it is too large Load diff

1829
backend/services/gateway-auth-layer/didiKong/declarative/kong.yml Normal file
View file

File diff suppressed because it is too large Load diff

1829
backend/services/gateway-auth-layer/didiKong/declarative/kong.yml.didi11-local Normal file
View file

File diff suppressed because it is too large Load diff

392
backend/services/gateway-auth-layer/didiKong/declarative/kong.yml.insecure-legacy Normal file
View file

@ -0,0 +1,392 @@
_format_version: "3.0"
_transform: true
# Service definitions for new architecture
services:
# Agent Service (NEW - replaces orchestration layer)
- name: agent-api
url: http://didi-agent:18789
retries: 3
connect_timeout: 120000
write_timeout: 660000
read_timeout: 660000
tags:
- agent
- analysis
# Legacy: Orchestrator API Service (to be removed after migration)
- name: orchestrator-api
url: http://orchestrationLayer-orchestrator:8000
retries: 5
connect_timeout: 60000
write_timeout: 60000
read_timeout: 60000
tags:
- orchestrator
- legacy
# Legacy: Analysis Service (to be removed after migration)
- name: analysis-api
url: http://orchestrationLayer-analysis:8004
retries: 3
connect_timeout: 120000
write_timeout: 120000
read_timeout: 120000
tags:
- analysis
- legacy
# didiAI Platform Gateway (external) - disabled, configure via DIDIAI_GATEWAY_URL env var
# - name: didiai-platform
# url: ${DIDIAI_GATEWAY_URL}
# retries: 3
# connect_timeout: 60000
# write_timeout: 60000
# read_timeout: 60000
# tags:
# - didiai
# - external
# Admin Dashboard
- name: admin-dashboard
url: http://didi-admin:80
retries: 3
connect_timeout: 30000
write_timeout: 30000
read_timeout: 30000
tags:
- ui
- dashboard
# Routes
routes:
# ============================================
# Agent Service Routes (NEW)
# ============================================
# Agent Health Check
- name: agent-health
service: agent-api
paths:
- /agent/health
strip_path: true
methods:
- GET
# Agent Status (detailed)
- name: agent-status
service: agent-api
paths:
- /agent/status
strip_path: false
methods:
- GET
# Agent Pipelines List
- name: agent-pipelines
service: agent-api
paths:
- /api/pipelines
strip_path: false
methods:
- GET
# Agent Analysis (non-streaming)
- name: agent-analyze
service: agent-api
paths:
- /api/analyze
strip_path: false
methods:
- POST
# Agent Session Status
- name: agent-sessions
service: agent-api
paths:
- /api/sessions
strip_path: false
methods:
- GET
# Agent File Upload
- name: agent-upload
service: agent-api
paths:
- /api/upload
strip_path: false
methods:
- POST
# Agent Abort Session
- name: agent-abort
service: agent-api
paths:
- /api/abort
strip_path: false
methods:
- POST
# ============================================
# Legacy Orchestrator Routes (to be removed)
# ============================================
# Orchestrator Routes
- name: orchestrator-catalog
service: orchestrator-api
paths:
- /api/v1/catalog
strip_path: false
methods:
- GET
- POST
- PUT
- DELETE
- name: orchestrator-pipelines
service: orchestrator-api
paths:
- /api/v1/pipelines
strip_path: false
methods:
- GET
- POST
- PUT
- DELETE
- PATCH
- name: orchestrator-runs
service: orchestrator-api
paths:
- /api/v1/runs
strip_path: false
methods:
- GET
- POST
- name: orchestrator-health
service: orchestrator-api
paths:
- /orchestrator/health
strip_path: true
methods:
- GET
# Analysis Service Routes
- name: analysis-health
service: analysis-api
paths:
- /analysis/health
strip_path: true
methods:
- GET
- name: analysis-stats
service: analysis-api
paths:
- /analysis/stats
strip_path: true
methods:
- GET
# didiAI Platform Routes (proxied) - disabled, enable when DIDIAI_GATEWAY_URL is configured
# - name: didiai-extractors
# service: didiai-platform
# paths:
# - /didiai/extractors
# strip_path: true
# methods:
# - POST
# - GET
#
# - name: didiai-models
# service: didiai-platform
# paths:
# - /didiai/models
# strip_path: true
# methods:
# - POST
# - GET
#
# - name: didiai-discovery
# service: didiai-platform
# paths:
# - /didiai/discovery
# strip_path: true
# methods:
# - GET
# Admin Dashboard Routes
- name: admin-ui
service: admin-dashboard
paths:
- /admin
strip_path: false
preserve_host: true
- name: admin-api
service: admin-dashboard
paths:
- /admin/api
strip_path: false
# Global Plugins
plugins:
# CORS Configuration
- name: cors
config:
origins:
- "http://localhost:3000"
- "http://localhost:3001"
- "http://localhost:8100"
- "*"
methods:
- GET
- POST
- PUT
- DELETE
- OPTIONS
- PATCH
headers:
- Accept
- Accept-Version
- Content-Length
- Content-MD5
- Content-Type
- Date
- Authorization
- X-Request-ID
exposed_headers:
- X-Auth-Token
- X-Request-ID
credentials: true
max_age: 3600
preflight_continue: false
# Rate Limiting (Global)
- name: rate-limiting
config:
minute: 100
hour: 2000
day: 10000
policy: local
fault_tolerant: true
hide_client_headers: false
limit_by: consumer
# Request ID Tracking
- name: correlation-id
config:
header_name: X-Request-ID
generator: uuid
echo_downstream: true
# Request Size Limiting (100MB for media files)
- name: request-size-limiting
config:
allowed_payload_size: 104857600
size_unit: bytes
require_content_length: false
# Response Headers
- name: response-transformer
config:
add:
headers:
- X-Gateway:DIDI-Kong
- X-API-Version:2.0
remove:
headers:
- Server
- Via
# Consumers for future authentication (consumer_groups not supported in Kong 3.4)
consumers: []
# Upstreams for load balancing (prepared for scaling)
upstreams:
# Agent Service Upstream (NEW)
- name: agent-upstream
algorithm: round-robin
slots: 10000
healthchecks:
active:
concurrency: 5
healthy:
http_statuses:
- 200
interval: 10
successes: 2
http_path: /health
timeout: 10
type: http
unhealthy:
http_failures: 3
http_statuses:
- 429
- 500
- 503
interval: 10
tcp_failures: 3
timeouts: 3
targets:
- target: didi-agent:18789
weight: 100
tags:
- agent
# Legacy: Orchestrator Upstream
- name: orchestrator-upstream
algorithm: round-robin
slots: 10000
healthchecks:
active:
concurrency: 10
healthy:
http_statuses:
- 200
- 302
interval: 5
successes: 3
http_path: /health
timeout: 5
type: http
unhealthy:
http_failures: 3
http_statuses:
- 429
- 500
- 503
interval: 5
tcp_failures: 3
timeouts: 3
targets:
- target: orchestrationLayer-orchestrator:8000
weight: 100
tags:
- orchestrator
- legacy
- name: analysis-upstream
algorithm: least-connections
slots: 10000
healthchecks:
active:
concurrency: 5
healthy:
http_statuses:
- 200
interval: 10
successes: 2
http_path: /health
timeout: 10
type: http
unhealthy:
http_failures: 5
interval: 10
timeouts: 5
targets:
- target: orchestrationLayer-analysis:8004
weight: 100
tags:
- analysis