수정본

2026-03-27 14:47:49 +09:00
parent 844ee8944f
commit c818810667
25 changed files with 2708 additions and 266 deletions
--- a/deploy/docker-compose.infra.yml
+++ b/deploy/docker-compose.infra.yml
@@ -0,0 +1,56 @@
+# Gitea + Jenkins CI/CD 인프라 (NAS 최초 1회 실행)
+# 사용법: cd deploy && docker-compose -f docker-compose.infra.yml up -d
+
+services:
+  gitea:
+    image: gitea/gitea:latest
+    container_name: gitea
+    environment:
+      - TZ=Asia/Seoul
+      - GITEA__database__DB_TYPE=sqlite3
+      - GITEA__server__ROOT_URL=${GITEA_URL:-http://nas-ip:3001}
+      - GITEA__server__HTTP_PORT=3000
+      - GITEA__server__SSH_DISABLED=true
+    volumes:
+      - gitea_data:/data
+    ports:
+      - "3001:3000"
+    restart: unless-stopped
+    networks:
+      - cicd-network
+    deploy:
+      resources:
+        limits:
+          memory: 256M
+
+  jenkins:
+    image: jenkins/jenkins:lts-jdk17
+    container_name: jenkins
+    environment:
+      - TZ=Asia/Seoul
+      - JAVA_OPTS=-Xmx512m -Xms256m
+    volumes:
+      - jenkins_data:/var/jenkins_home
+      # Docker-in-Docker: 호스트 Docker 소켓 공유
+      - /var/run/docker.sock:/var/run/docker.sock
+    ports:
+      - "8080:8080"
+      - "50000:50000"
+    restart: unless-stopped
+    networks:
+      - cicd-network
+    deploy:
+      resources:
+        limits:
+          memory: 1G
+    # Jenkins에서 docker 명령 사용을 위한 그룹 설정
+    # NAS에서 docker.sock 권한: sudo chown root:docker /var/run/docker.sock
+    user: root
+
+volumes:
+  gitea_data:
+  jenkins_data:
+
+networks:
+  cicd-network:
+    driver: bridge
--- a/deploy/nginx-reverse-proxy.conf
+++ b/deploy/nginx-reverse-proxy.conf
@@ -0,0 +1,68 @@
+# Synology 역방향 프록시 대신 직접 Nginx를 쓸 경우
+# docker-compose.yml에 nginx 서비스 추가 후 이 설정 사용
+#
+# Synology DSM → 제어판 → 로그인 포털 → 고급 → 역방향 프록시 로 설정하는 게 더 간편.
+# 그 경우 이 파일은 불필요.
+#
+# Synology 역방향 프록시 설정:
+#   stock.your-domain.com (HTTPS 443)
+#     → Location /api     → http://localhost:8000
+#     → Location /ws      → http://localhost:8000 (WebSocket)
+#     → Location /        → http://localhost:3000
+
+upstream backend {
+    server backend:8000;
+}
+
+upstream frontend {
+    server frontend:80;
+}
+
+server {
+    listen 80;
+    server_name stock.your-domain.com;
+    return 301 https://$host$request_uri;
+}
+
+server {
+    listen 443 ssl http2;
+    server_name stock.your-domain.com;
+
+    # Synology에서 발급한 Let's Encrypt 인증서 경로
+    ssl_certificate     /etc/ssl/certs/your-cert.pem;
+    ssl_certificate_key /etc/ssl/private/your-key.pem;
+
+    # Security headers
+    add_header X-Frame-Options DENY;
+    add_header X-Content-Type-Options nosniff;
+    add_header X-XSS-Protection "1; mode=block";
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+
+    # API
+    location /api/ {
+        proxy_pass http://backend/api/;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_read_timeout 120s;
+    }
+
+    # WebSocket
+    location /ws {
+        proxy_pass http://backend/ws;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_read_timeout 86400s;
+    }
+
+    # Frontend
+    location / {
+        proxy_pass http://frontend/;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+    }
+}
--- a/deploy/setup-nas.sh
+++ b/deploy/setup-nas.sh
@@ -0,0 +1,134 @@
+#!/bin/bash
+# ============================================================
+# Synology DS1517 초기 설정 스크립트
+# 사용법: ssh admin@nas-ip 에서 실행
+#   chmod +x setup-nas.sh && ./setup-nas.sh
+# ============================================================
+
+set -e
+
+DEPLOY_DIR="/volume1/docker/autostock"
+INFRA_DIR="/volume1/docker/cicd"
+BACKUP_DIR="/volume1/docker/autostock/backups"
+
+echo "============================================"
+echo " Auto-Stock NAS 배포 환경 초기 설정"
+echo " NAS: Synology DS1517 (16GB)"
+echo "============================================"
+
+# 1. 디렉토리 생성
+echo "[1/6] 디렉토리 생성..."
+sudo mkdir -p ${DEPLOY_DIR}
+sudo mkdir -p ${INFRA_DIR}
+sudo mkdir -p ${BACKUP_DIR}
+sudo mkdir -p ${DEPLOY_DIR}/logs
+
+# 2. CI/CD 인프라 시작 (Gitea + Jenkins)
+echo "[2/6] CI/CD 인프라 시작..."
+if [ -f "${INFRA_DIR}/docker-compose.infra.yml" ]; then
+    cd ${INFRA_DIR}
+    docker compose -f docker-compose.infra.yml up -d
+else
+    echo "  >> docker-compose.infra.yml을 ${INFRA_DIR}에 복사하세요"
+    echo "  >> 그 후 다시 실행하거나: cd ${INFRA_DIR} && docker compose -f docker-compose.infra.yml up -d"
+fi
+
+# 3. Jenkins Docker 소켓 권한
+echo "[3/6] Docker 소켓 권한 설정..."
+sudo chmod 666 /var/run/docker.sock 2>/dev/null || true
+
+# 4. .env 템플릿 생성
+echo "[4/6] .env 템플릿 생성..."
+if [ ! -f "${DEPLOY_DIR}/.env" ]; then
+    cat > ${DEPLOY_DIR}/.env << 'ENVEOF'
+# ============================================================
+# Auto-Stock 프로덕션 환경변수 (NAS)
+# 이 파일은 Git에 커밋하지 마세요!
+# ============================================================
+
+# === Database ===
+POSTGRES_USER=autostock
+POSTGRES_PASSWORD=CHANGE_ME_STRONG_PASSWORD
+POSTGRES_DB=autostock
+DATABASE_URL=postgresql+asyncpg://autostock:CHANGE_ME_STRONG_PASSWORD@postgres:5432/autostock
+
+# === Redis ===
+REDIS_PASSWORD=CHANGE_ME_REDIS_PASSWORD
+REDIS_URL=redis://:CHANGE_ME_REDIS_PASSWORD@redis:6379/0
+
+# === RabbitMQ ===
+RABBITMQ_DEFAULT_USER=autostock
+RABBITMQ_DEFAULT_PASS=CHANGE_ME_RABBITMQ_PASSWORD
+RABBITMQ_URL=amqp://autostock:CHANGE_ME_RABBITMQ_PASSWORD@rabbitmq:5672/
+
+# === AI Provider (claude + hybrid haiku/sonnet) ===
+AI_PROVIDER=claude
+HYBRID_AI_ENABLED=true
+ANTHROPIC_API_KEY=sk-ant-xxx
+CLAUDE_MODEL=claude-sonnet-4-6-20250514
+CLAUDE_HAIKU_MODEL=claude-haiku-4-5-20251001
+GEMINI_API_KEY=
+GEMINI_MODEL=gemini-2.0-flash
+
+# === KIS API (virtual/real 전환: KIS_MODE만 변경) ===
+KIS_MODE=virtual
+KIS_VIRTUAL_APP_KEY=
+KIS_VIRTUAL_APP_SECRET=
+KIS_VIRTUAL_ACCOUNT_NO=
+KIS_VIRTUAL_URL=https://openapivts.koreainvestment.com:29443
+KIS_REAL_APP_KEY=
+KIS_REAL_APP_SECRET=
+KIS_REAL_ACCOUNT_NO=
+KIS_REAL_URL=https://openapi.koreainvestment.com:9443
+
+# === Server ===
+BACKEND_HOST=0.0.0.0
+BACKEND_PORT=8000
+MCP_SERVER_HOST=0.0.0.0
+MCP_SERVER_PORT=8001
+SECRET_KEY=CHANGE_ME_64_CHARS_RANDOM_STRING
+API_KEY=CHANGE_ME_API_KEY
+MCP_API_KEY=CHANGE_ME_MCP_API_KEY
+
+# === Frontend ===
+VITE_API_URL=https://your-domain.com/api
+VITE_WS_URL=wss://your-domain.com/ws
+
+# === Features ===
+AUTO_TRADE_ENABLED=true
+DAY_TRADE_ENABLED=true
+US_TRADING_ENABLED=false
+KIS_WS_ENABLED=true
+TOKEN_SAVE_MODE=true
+LOG_LEVEL=INFO
+DEBUG=false
+
+# === Telegram ===
+TELEGRAM_BOT_TOKEN=
+TELEGRAM_CHAT_ID=
+ENVEOF
+    echo "  >> ${DEPLOY_DIR}/.env 생성 완료 — 반드시 비밀번호를 변경하세요!"
+else
+    echo "  >> .env 이미 존재 — 스킵"
+fi
+
+# 5. Synology 방화벽 포트 안내
+echo "[5/6] 필요한 포트 (Synology 제어판 → 방화벽):"
+echo "  - 3001: Gitea (Git 웹 UI)"
+echo "  - 8080: Jenkins (CI/CD 웹 UI)"
+echo "  - 3000: Frontend (Nginx → 역방향 프록시 권장)"
+echo "  - 8000: Backend API (내부 전용)"
+echo "  - 8001: MCP Server (내부 전용)"
+
+# 6. 완료
+echo "[6/6] 설정 완료!"
+echo ""
+echo "다음 단계:"
+echo "  1. ${DEPLOY_DIR}/.env 비밀번호 변경"
+echo "  2. Gitea 접속: http://nas-ip:3001 → 저장소 생성"
+echo "  3. Jenkins 접속: http://nas-ip:8080 → 파이프라인 설정"
+echo "  4. Gitea에 push → Jenkins 자동 빌드/배포"
+echo ""
+echo "첫 수동 배포:"
+echo "  cd ${DEPLOY_DIR}"
+echo "  docker compose --env-file .env up -d"