Docker bilan o'rnatish: bitta buyruq bilan butun tizim

            internet / ofis tarmog'i
                     │  faqat 443 (HTTPS)
                ┌────┴────┐
                │  nginx  │  TLS, statik fayllar, so'rov chegaralari, xavfsizlik sarlavhalari
                └────┬────┘
                     │  ichki tarmoq (tashqaridan ko'rinmaydi)
   ┌─────────────────┼───────────────────────────────┐
   │  web (Django + gunicorn)   signal (signal_yubor) │
   │  db (Postgres, doimiy volume)                    │
   │  mediamtx (RTSP)  ◄── kameralar                  │
   │  tahlilchi (GPU: YOLO + ByteTrack)               │
   └──────────────────────────────────────────────────┘

# Docker ga faqat obrazlarga kerakli fayllar yuboriladi (kitob papkasida gigabaytlab dataset bor)
*
!loyiha/
!kod/oqim.py
!kod/19_soxta_kamera.py
!kod/20_tahlilchi.py
!kod/20_soxta_telegram.py
!weights/yolo11n.pt
**/__pycache__

FROM python:3.12.13-slim
ENV PYTHONDONTWRITEBYTECODE=1 PYTHONUNBUFFERED=1
RUN pip install --no-cache-dir "Django==5.2.17" "psycopg[binary]==3.3.3" "gunicorn==26.2.0"
RUN useradd --create-home --uid 10001 ilova && mkdir -p /app/static && chown ilova /app/static
WORKDIR /app
COPY loyiha/ /app/
USER ilova
EXPOSE 8000

FROM ultralytics/ultralytics:8.4.17
RUN pip install --no-cache-dir "lap==0.5.13"
RUN useradd --create-home --uid 10001 ilova
WORKDIR /app
COPY --chown=ilova kod/oqim.py kod/19_soxta_kamera.py kod/20_tahlilchi.py /app/kod/
COPY --chown=ilova weights/yolo11n.pt /app/weights/
USER ilova

worker_processes auto;
events { worker_connections 1024; }

http {
    include /etc/nginx/mime.types;
    server_tokens off;
    access_log /dev/stdout;
    error_log /dev/stderr warn;

    limit_req_zone $binary_remote_addr zone=panel:10m rate=5r/s;
    limit_req_zone $binary_remote_addr zone=api:10m rate=20r/s;
    limit_req_status 429;

    upstream django { server web:8000; }

    server {
        listen 80;
        return 301 https://$host$request_uri;
    }

    server {
        listen 443 ssl;
        http2 on;
        ssl_certificate     /etc/nginx/certs/server.crt;
        ssl_certificate_key /etc/nginx/certs/server.key;
        ssl_protocols TLSv1.2 TLSv1.3;
        client_max_body_size 64k;

        add_header Strict-Transport-Security "max-age=31536000" always;
        add_header X-Content-Type-Options nosniff always;
        add_header X-Frame-Options DENY always;
        add_header Referrer-Policy same-origin always;

        location /static/ { alias /srv/static/; expires 7d; }

        location /api/ {
            limit_req zone=api burst=40 nodelay;
            proxy_pass http://django;
            include /etc/nginx/proxy.conf;
        }
        location / {
            limit_req zone=panel burst=20 nodelay;
            proxy_pass http://django;
            include /etc/nginx/proxy.conf;
        }
    }
}

proxy_set_header Host $http_host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto https;
proxy_read_timeout 30s;
proxy_hide_header Strict-Transport-Security;       # bu sarlavhalarni Django ham qo'yadi — ikki marta yuborilmasin
proxy_hide_header X-Content-Type-Options;
proxy_hide_header X-Frame-Options;
proxy_hide_header Referrer-Policy;

logLevel: warn
rtsp: true
rtspTransports: [tcp]
rtspAddress: :8554
rtmp: false
hls: false
webrtc: false
srt: false
moq: false
api: false
metrics: false
pprof: false
playback: false
authInternalUsers:
  - user: kamera                # parol: MTX_AUTHINTERNALUSERS_0_PASS
    pass: ALMASHTIRILADI
    permissions:
      - action: publish
  - user: tahlil                # parol: MTX_AUTHINTERNALUSERS_1_PASS
    pass: ALMASHTIRILADI
    permissions:
      - action: read
paths:
  all_others:

name: yolo-kitob

x-umumiy: &umumiy
  restart: unless-stopped
  security_opt: ["no-new-privileges:true"]
  logging:
    driver: json-file
    options: {max-size: "10m", max-file: "3"}

services:
  db:
    <<: *umumiy
    image: postgres:16.13-alpine
    environment:
      POSTGRES_USER: kitob
      POSTGRES_DB: kuzatuv
      POSTGRES_PASSWORD: ${PG_PAROL:?.env da PG_PAROL yo'q}
    volumes: [pgdata:/var/lib/postgresql/data]
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U kitob -d kuzatuv"]
      interval: 3s
      retries: 20

  web:
    <<: *umumiy
    build: {context: .., dockerfile: deploy/web.Dockerfile}
    image: yolo-kitob-web:1
    environment:
      DJANGO_SECRET_KEY: ${DJANGO_SECRET_KEY:?}
      DJANGO_HTTPS: "1"
      DJANGO_ALLOWED_HOSTS: "127.0.0.1,localhost,web"
      PG_HOST: db
      PG_PAROL: ${PG_PAROL:?}
      ISHCHI_TOKENLAR: ${ISHCHI_TOKEN:?}
    command: >-
      sh -c "python manage.py migrate --noinput && python manage.py collectstatic --noinput -v 0 &&
      exec gunicorn kuzatuv.wsgi --bind 0.0.0.0:8000 --workers 3 --worker-tmp-dir /dev/shm --access-logfile -"
    volumes: [static:/app/static]
    read_only: true
    tmpfs: [/tmp]
    depends_on: {db: {condition: service_healthy}}
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8000/api/salomatlik/', timeout=3)"]
      interval: 3s
      retries: 30

  signal:
    <<: *umumiy
    image: yolo-kitob-web:1
    environment:
      DJANGO_SECRET_KEY: ${DJANGO_SECRET_KEY:?}
      PG_HOST: db
      PG_PAROL: ${PG_PAROL:?}
      TELEGRAM_TOKEN: ${TELEGRAM_TOKEN:?}
      TELEGRAM_CHAT: ${TELEGRAM_CHAT:?}
      TELEGRAM_API: http://telegram:18081                # sinov; haqiqiy botda bu qatorni olib tashlang
    command: python manage.py signal_yubor
    read_only: true
    depends_on: {web: {condition: service_healthy}}

  telegram:
    <<: *umumiy
    profiles: [sinov]
    image: yolo-kitob-web:1
    environment:
      TELEGRAM_TOKEN: ${TELEGRAM_TOKEN:?}
    command: python /kod/20_soxta_telegram.py --manzil 0.0.0.0 --jurnal /tmp/xabarlar.jsonl
    volumes: ["../kod/20_soxta_telegram.py:/kod/20_soxta_telegram.py:ro"]
    read_only: true
    tmpfs: [/tmp]

  nginx:
    <<: *umumiy
    image: nginx:1.29.5-alpine
    ports: ["127.0.0.1:18443:443", "127.0.0.1:18088:80"]
    volumes:
      - ./nginx.conf:/etc/nginx/nginx.conf:ro
      - ./proxy.conf:/etc/nginx/proxy.conf:ro
      - ./certs:/etc/nginx/certs:ro
      - static:/srv/static:ro
    depends_on: {web: {condition: service_healthy}}

  mediamtx:
    <<: *umumiy
    image: bluenviron/mediamtx:1.21.1
    volumes: ["./mediamtx.yml:/mediamtx.yml:ro"]
    environment:
      MTX_AUTHINTERNALUSERS_0_PASS: ${KAMERA_PAROL:?}
      MTX_AUTHINTERNALUSERS_1_PASS: ${TAHLIL_PAROL:?}
    ports: ["127.0.0.1:18554:8554"]

  tahlilchi:
    <<: *umumiy
    build: {context: .., dockerfile: deploy/tahlilchi.Dockerfile}
    image: yolo-kitob-tahlilchi:1
    environment:
      RTSP_ASOS: rtsp://tahlil:${TAHLIL_PAROL:?}@mediamtx:8554/
      ISHCHI_TOKEN: ${ISHCHI_TOKEN:?}
    command: python kod/20_tahlilchi.py --kameralar k1,k2 --api http://web:8000/api/hodisalar/ --model weights/yolo11n.pt --vaqt-kodi
    depends_on: {web: {condition: service_healthy}, mediamtx: {condition: service_started}}
    deploy:
      resources:
        reservations:
          devices: [{driver: nvidia, count: all, capabilities: [gpu]}]

volumes:
  pgdata:
  static:

# deploy/.env — faqat serverda, faqat egasi o'qiy oladi (chmod 600). Git ga qo'shilmaydi.
# Har bir qiymat — uzun tasodifiy satr: python -c "import secrets; print(secrets.token_urlsafe(32))"
DJANGO_SECRET_KEY=
PG_PAROL=
ISHCHI_TOKEN=
KAMERA_PAROL=
TAHLIL_PAROL=
TELEGRAM_TOKEN=
TELEGRAM_CHAT=

import json
import os
import re
import secrets
import signal
import subprocess
import sys
import time
import urllib.error
import urllib.request
from pathlib import Path

import pandas as pd
import psycopg

sys.path.insert(0, "kod")
from tizim import jarayon, postgres

ILDIZ = Path.cwd()                                                        # kitob papkasining mutlaq yo'li
DEPLOY = Path("deploy")
DC = ["docker", "compose", "-f", str(ILDIZ / DEPLOY / "docker-compose.yml"), "--profile", "sinov"]

def dc(*buyruq, **kw):
    try:
        return subprocess.run([*DC, *buyruq], capture_output=True, text=True, cwd=ILDIZ, **kw)
    finally:
        os.chdir(ILDIZ)                                                   # WSL eslatmasiga qarang (pastda)

sirlar = {k: secrets.token_urlsafe(32) for k in ("DJANGO_SECRET_KEY", "PG_PAROL", "ISHCHI_TOKEN", "KAMERA_PAROL", "TAHLIL_PAROL")}
sirlar["TELEGRAM_TOKEN"] = f"{secrets.randbelow(10 ** 9)}:{secrets.token_urlsafe(24)}"
sirlar["TELEGRAM_CHAT"] = "-1001234567890"
env_fayl = DEPLOY / ".env"
env_fayl.write_text("".join(f"{k}={v}\n" for k, v in sirlar.items()))
env_fayl.chmod(0o600)

sertifikat = DEPLOY / "certs"
sertifikat.mkdir(exist_ok=True)
subprocess.run(["openssl", "req", "-x509", "-newkey", "rsa:2048", "-nodes", "-days", "30", "-subj", "/CN=localhost",
                "-addext", "subjectAltName=DNS:localhost,IP:127.0.0.1",
                "-keyout", str(sertifikat / "server.key"), "-out", str(sertifikat / "server.crt")], check=True, capture_output=True)
print("sirlar:", sorted(sirlar), "| sertifikat:", sorted(p.name for p in sertifikat.iterdir()))

t0 = time.time()
r = dc("build")
print(f"docker compose build: {time.time() - t0:.0f} s, xato: {r.returncode != 0}")
obrazlar = subprocess.run(["docker", "images", "--format", "{{.Repository}}:{{.Tag}}\t{{.Size}}"], capture_output=True, text=True).stdout
show(pd.DataFrame([q.split("\t") for q in obrazlar.splitlines() if re.match(r"(yolo-kitob|postgres:16.13|nginx:1.29.5|bluenviron|ultralytics/ultralytics:8.4.17)", q)],
                  columns=["obraz", "hajmi"]))

t0 = time.time()
dc("up", "-d")
while True:
    holat = [json.loads(q) for q in dc("ps", "--format", "json").stdout.splitlines()]
    tayyor = all(h["State"] == "running" and h.get("Health", "") in ("", "healthy") for h in holat)
    if tayyor or time.time() - t0 > 180:
        break
    time.sleep(1)
print(f"up -d dan hamma xizmat tayyor bo'lguncha: {time.time() - t0:.0f} s")
show(pd.DataFrame([{"xizmat": h["Service"], "holat": h["State"], "salomatlik": h.get("Health") or "-",
                    "portlar": h.get("Publishers") and ", ".join(f"{p['URL']}:{p['PublishedPort']}->{p['TargetPort']}"
                                                                 for p in h["Publishers"] if p["PublishedPort"]) or "-"} for h in holat]))

import ssl

tls = ssl.create_default_context(cafile=str(sertifikat / "server.crt"))
ASOS = "https://127.0.0.1:18443"

class YonaltirmaslikUchun(urllib.request.HTTPRedirectHandler):
    def redirect_request(self, *a, **kw):
        return None

ochuvchi = urllib.request.build_opener(YonaltirmaslikUchun, urllib.request.HTTPSHandler(context=tls))

def sorov(url, data=None, sarlavha=None):
    try:
        with ochuvchi.open(urllib.request.Request(url, data=data, headers=sarlavha or {}), timeout=10) as r:
            return r.status, dict(r.headers)
    except urllib.error.HTTPError as e:
        return e.code, dict(e.headers)

qatorlar = []
kod, h = sorov(f"{ASOS}/api/salomatlik/")
qatorlar.append({"tekshiruv": "API salomatlik (HTTPS)", "javob": kod, "izoh": "server: " + h.get("Server", "-")})
kod, h = sorov("http://127.0.0.1:18088/panel/")
qatorlar.append({"tekshiruv": "HTTP -> HTTPS", "javob": kod, "izoh": h.get("Location", "-")})
kod, h = sorov(f"{ASOS}/panel/")
qatorlar.append({"tekshiruv": "panel, kirishsiz", "javob": kod, "izoh": h.get("Location", "-")})
kod, h = sorov(f"{ASOS}/api/hodisalar/", data=b"x" * 70_000, sarlavha={"Authorization": "Bearer xato"})
qatorlar.append({"tekshiruv": "70 KB so'rov", "javob": kod, "izoh": "Django ga yetmaydi"})
kod, h = sorov(f"{ASOS}/api/hodisalar/", data=b"{}", sarlavha={"Authorization": "Bearer xato", "Content-Type": "application/json"})
qatorlar.append({"tekshiruv": "noto'g'ri token", "javob": kod, "izoh": "Django javobi"})
show(pd.DataFrame(qatorlar))
print("xavfsizlik sarlavhalari:", {k: v for k, v in sorov(f"{ASOS}/api/salomatlik/")[1].items()
                                   if k in ("Strict-Transport-Security", "X-Content-Type-Options", "X-Frame-Options", "Referrer-Policy")})

kodlar = [sorov(f"{ASOS}/panel/login/")[0] for _ in range(60)]
print("panel: 60 ta ketma-ket so'rov ->", {k: kodlar.count(k) for k in sorted(set(kodlar))})

def sql(so_rov):
    r = dc("exec", "-T", "db", "psql", "-U", "kitob", "-d", "kuzatuv", "-At", "-F", "|", "-c", so_rov)
    return [q.split("|") for q in r.stdout.strip().splitlines() if q]

kamera = [sys.executable, "kod/19_soxta_kamera.py", "--url", f"rtsp://kamera:{sirlar['KAMERA_PAROL']}@127.0.0.1:18554/", "--soni", "2"]
with jarayon(kamera):
    time.sleep(40)
show(pd.DataFrame(sql("select tur, signal, count(*) from hodisalar_hodisa group by 1, 2 order by 1, 2"), columns=["tur", "signal", "hodisalar"]))
kech = sql("select tur, percentile_cont(0.5) within group (order by extract(epoch from yaratildi - vaqt)), "
           "percentile_cont(0.5) within group (order by extract(epoch from yuborildi - vaqt)) from hodisalar_hodisa "
           "where tur in ('chiziq', 'zona') group by 1")
show(pd.DataFrame([{"tur": t, "kadr → baza, s (median)": round(float(a), 2), "kadr → Telegram, s (median)": round(float(b), 2) if b else None}
                   for t, a, b in kech]))
gpu = dc("exec", "-T", "tahlilchi", "python", "-c", "import torch; print(torch.cuda.get_device_name(0))").stdout.strip()
print("tahlilchi konteyneri ko'rgan GPU:", gpu)

def salomat():
    try:
        return sorov(f"{ASOS}/api/salomatlik/")[0] == 200
    except OSError:
        return False

hodisalar = int(sql("select count(*) from hodisalar_hodisa")[0][0])
dc("exec", "-T", "web", "sh", "-c", "kill -TERM 1")                        # gunicorn — konteynerning 1-jarayoni
t0 = time.time()
while salomat() and time.time() - t0 < 10:
    time.sleep(0.1)
yiqildi = time.time()
while not salomat() and time.time() - t0 < 120:
    time.sleep(0.2)
tiklandi = time.time()
qayta = json.loads(subprocess.run(["docker", "inspect", "yolo-kitob-web-1"], capture_output=True, text=True).stdout)[0]["RestartCount"]
print(f"web jarayoni to'xtatildi: {yiqildi - t0:.1f} s dan keyin API javob bermadi, yana {tiklandi - yiqildi:.1f} s dan keyin tiklandi "
      f"(Docker qayta ishga tushirishlari: {qayta})")

dc("down")                                                                 # konteynerlar o'chiriladi, volume qoladi
dc("up", "-d", "--wait")
print("down + up: hodisalar oldin", hodisalar, "| keyin", sql("select count(*) from hodisalar_hodisa")[0][0])

zaxira = Path("out/zaxira/kuzatuv.sql")
zaxira.parent.mkdir(parents=True, exist_ok=True)
zaxira.write_text(dc("exec", "-T", "db", "pg_dump", "-U", "kitob", "--no-owner", "kuzatuv").stdout)
with postgres(port=25433, nom="yolo-kitob-tiklash") as pg:
    tiklash = subprocess.run(["psql", "-h", pg["PG_HOST"], "-p", pg["PG_PORT"], "-U", "kitob", "-d", "kuzatuv", "-q", "-f", str(zaxira)],
                             env={**os.environ, "PGPASSWORD": pg["PG_PAROL"]}, capture_output=True, text=True)
    with psycopg.connect(host=pg["PG_HOST"], port=pg["PG_PORT"], user="kitob", password=pg["PG_PAROL"], dbname="kuzatuv") as db:
        tiklangan = db.execute("select count(*) from hodisalar_hodisa").fetchone()[0]
print(f"zaxira: {zaxira.stat().st_size // 1024} KB | yangi bazaga tiklandi: {tiklangan} hodisa (asl bazada {hodisalar}), xatolar: {tiklash.returncode}")

statlar = subprocess.run(["docker", "stats", "--no-stream", "--format", "{{.Name}}\t{{.MemUsage}}\t{{.CPUPerc}}"], capture_output=True, text=True).stdout
show(pd.DataFrame([q.split("\t") for q in statlar.splitlines() if q.startswith("yolo-kitob")], columns=["konteyner", "xotira", "CPU"]))

dc("down", "-v")
env_fayl.unlink()
for f in sertifikat.iterdir():
    f.unlink()
sertifikat.rmdir()
zaxira.unlink()
qoldi = subprocess.run(["docker", "ps", "-a", "--filter", "name=yolo-kitob", "--format", "{{.Names}}"], capture_output=True, text=True).stdout.split()
print("qolgan konteynerlar:", qoldi, "| .env bormi:", env_fayl.exists())