feature(satellite): add postgres vectorstore for call transcriptions

Author: Stell0

Containerfile

@@ -22,7 +22,7 @@ COPY imageroot /imageroot
 COPY --from=ui_builder /app/dist /ui
 ENTRYPOINT [ "/" ]
 LABEL org.nethserver.authorizations="traefik@any:fulladm node:fwadm,portsadm nethvoice-proxy@any:routeadm"
-LABEL org.nethserver.tcp-ports-demand="36"
+LABEL org.nethserver.tcp-ports-demand="37"
 LABEL org.nethserver.rootfull="0"
 LABEL org.nethserver.min-core="3.6.2-0"
 ARG REPOBASE=ghcr.io/nethserver
@@ -40,4 +40,5 @@ LABEL org.nethserver.images="${REPOBASE}/nethvoice-mariadb:${IMAGETAG} \
     ${REPOBASE}/nethvoice-reports-api:${IMAGETAG} \
     ${REPOBASE}/nethvoice-sftp:${IMAGETAG} \
     docker.io/library/eclipse-mosquitto:2 \
-    ${REPOBASE}/nethvoice-satellite:${IMAGETAG}"
+    ${REPOBASE}/nethvoice-satellite:${IMAGETAG}\
+    docker.io/pgvector/pgvector:0.8.1-pg18-trixie"

imageroot/actions/configure-module/80start_services

@@ -52,9 +52,12 @@ fi
 if [ "$SATELLITE_CALL_TRANSCRIPTION_ENABLED" = "True" ] || [ "$SATELLITE_VOICEMAIL_TRANSCRIPTION_ENABLED" = "True" ]; then
     systemctl --user enable --now satellite.service
     systemctl --user enable --now satellite-mqtt.service
+    systemctl --user enable --now satellite-pgsql.service
 else
     systemctl --user stop satellite.service
     systemctl --user disable satellite.service
     systemctl --user stop satellite-mqtt.service
     systemctl --user disable satellite-mqtt.service
+    systemctl --user stop satellite-pgsql.service
+    systemctl --user disable satellite-pgsql.service
 fi

imageroot/actions/create-module/05setenvs

@@ -150,6 +150,9 @@ agent.set_env('ASTERISK_RECORDING_SFTP_PORT', port_list[30])
 agent.set_env('ASTERISK_WS_PORT', port_list[31])
 agent.set_env('SATELLITE_MQTT_PORT', port_list[32])
 agent.set_env('SATELLITE_HTTP_PORT', port_list[33])
+agent.set_env('SATELLITE_PGSQL_USER', 'satellite')
+agent.set_env('SATELLITE_PGSQL_DB', 'satellite')
+agent.set_env('SATELLITE_PGSQL_PORT', str(port_list[36]))
 
 # Asterisk WSS
 agent.set_env('ASTERISK_WSS_PORT', port_list[34])
@@ -184,7 +187,8 @@ passwords = {
     "REPORTS_API_KEY": gen_password(),
     "REPORTS_SECRET": gen_password(),
     "SATELLITE_MQTT_PASSWORD": gen_password(),
-    "SATELLITE_ARI_PASSWORD": gen_password()
+    "SATELLITE_ARI_PASSWORD": gen_password(),
+    "SATELLITE_PGSQL_PASSWORD": gen_password()
 }
 
 agent.write_envfile("passwords.env", passwords)

imageroot/actions/restore-module/20copyenv

@@ -113,6 +113,8 @@ restore_envs = [
     'TIMEZONE',
     'TRAEFIK_HTTP2HTTPS',
     'USER_DOMAIN',
+    'SATELLITE_CALL_TRANSCRIPTION_ENABLED',
+    'SATELLITE_VOICEMAIL_TRANSCRIPTION_ENABLED',
 ]
 
 for env in restore_envs:

imageroot/actions/restore-module/23satellite_pg

@@ -0,0 +1,39 @@
+#!/bin/bash
+
+#
+# Copyright (C) 2025 Nethesis S.r.l.
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+
+set -e -o pipefail
+exec 1>&2 # Redirect any output to the journal (stderr)
+
+SATELLITE_PGSQL_PASSWORD=$(grep '^SATELLITE_PGSQL_PASSWORD=' ./passwords.env) && export "${SATELLITE_PGSQL_PASSWORD?}"
+
+mkdir -vp restore
+cat - >restore/satellite_postgresql_restore.sh <<'EOS'
+# Read dump file from standard input and restore all databases:
+psql -U postgres -f /tmp/satellite_postgresql.pg_dump
+ec=$?
+docker_temp_server_stop
+exit $ec
+EOS
+
+# Override the image /docker-entrypoint-initdb.d contents, to restore the
+# DB dump file. The container will be stopped at the end
+podman run \
+    --rm \
+    --interactive \
+    --network=none \
+    --volume=./restore:/docker-entrypoint-initdb.d/:Z \
+    --volume=satellite_pgdata:/var/lib/postgresql/data:Z \
+    --volume=./satellite_postgresql.pg_dump:/tmp/satellite_postgresql.pg_dump:Z \
+    --replace --name=restore_db \
+    --env POSTGRES_USER=${SATELLITE_PGSQL_USER} \
+    --env POSTGRES_PASSWORD=${SATELLITE_PGSQL_PASSWORD} \
+    --env TZ=UTC \
+    "${POSTGRES_IMAGE}"
+
+
+# If the restore is successful, clean up:
+rm -rfv restore/ postgresql.pg_dump

imageroot/bin/module-dump-state

@@ -57,3 +57,6 @@ if podman exec freepbx ls -alh /var/lib/asterisk/sounds/nethcti >/dev/null 2>&1;
     podman cp freepbx:/var/lib/asterisk/sounds/nethcti/. asterisk_backup/var/lib/asterisk/sounds/nethcti
 fi
 
+# satellite postgresql dump
+echo "Dumping Satellite PostgreSQL database"
+podman exec satellite-pgsql pg_dumpall -U postgres > satellite_postgresql.pg_dump

imageroot/etc/state-include.conf

@@ -8,6 +8,7 @@ volumes/pbooksources
 volumes/phonebookcsv
 volumes/post_scripts
 volumes/reports_config
+volumes/satellite_pgdata
 volumes/scripts
 volumes/spool
 volumes/tancredi

imageroot/systemd/user/satellite-pgsql.service

@@ -0,0 +1,35 @@
+[Unit]
+Description=Podman PostgreSQL service for Satellite
+
+[Service]
+Environment=PODMAN_SYSTEMD_UNIT=%n
+EnvironmentFile=%S/state/environment
+EnvironmentFile=%S/state/passwords.env
+WorkingDirectory=%S/state
+Restart=always
+TimeoutStopSec=70
+ExecStartPre=/bin/rm -f %t/satellite-pgsql.pid %t/satellite-pgsql.ctr-id
+# set password for PostgreSQL
+ExecStartPre=-runagent satellite-pgsql-gen-config
+ExecStart=/usr/bin/podman run --conmon-pidfile %t/satellite-pgsql.pid \
+	--cidfile %t/satellite-pgsql.ctr-id --cgroups=no-conmon \
+	--replace \
+	--detach \
+	--name=%N \
+	--volume=satellite_pgdata:/var/lib/postgresql/data:Z \
+	--network=host \
+	--env POSTGRES_PASSWORD=${SATELLITE_PGSQL_PASSWORD} \
+	--env POSTGRES_USER=${SATELLITE_PGSQL_USER} \
+	--env POSTGRES_DB=${SATELLITE_PGSQL_DB} \
+	--env PGPORT=${SATELLITE_PGSQL_PORT} \
+	--tz=${TIMEZONE} \
+	--network=host \
+	${PGVECTOR_IMAGE}
+
+ExecStop=/usr/bin/podman stop --ignore --cidfile %t/satellite-pgsql.ctr-id -t 10
+ExecStopPost=/usr/bin/podman rm --ignore -f --cidfile %t/satellite-pgsql.ctr-id
+PIDFile=%t/satellite-pgsql.pid
+Type=forking
+
+[Install]
+WantedBy=default.target

imageroot/systemd/user/satellite.service

@@ -1,11 +1,12 @@
 [Unit]
 Description=Satellite call transcription for NethVoice
-Requires=satellite-mqtt.service
-After=satellite-mqtt.service
+Requires=satellite-mqtt.service, satellite-pgsql.service
+After=satellite-mqtt.service, satellite-pgsql.service
 
 [Service]
 Environment=PODMAN_SYSTEMD_UNIT=%n
 EnvironmentFile=%S/state/environment
+EnvironmentFile=%S/state/passwords.env
 WorkingDirectory=%S/state
 Restart=always
 ExecStartPre=/bin/rm -f %t/satellite.pid %t/satellite.ctr-id
@@ -24,6 +25,13 @@ ExecStart=runagent /usr/bin/podman run \
     --env=MQTT_TOPIC_PREFIX=satellite \
     --env=MQTT_USERNAME=${SATELLITE_MQTT_USERNAME} \
     --env=HTTP_PORT=${SATELLITE_HTTP_PORT} \
+    --env=SATELLITE_ARI_PASSWORD=${SATELLITE_ARI_PASSWORD} \
+    --env=SATELLITE_MQTT_PASSWORD=${SATELLITE_MQTT_PASSWORD} \
+    --env=PGVECTOR_HOST=127.0.0.1 \
+    --env=PGVECTOR_PORT=${SATELLITE_PGSQL_PORT} \
+    --env=PGVECTOR_DB=${SATELLITE_PGSQL_DB} \
+    --env=PGVECTOR_USER=${SATELLITE_PGSQL_USER} \
+    --env=PGVECTOR_PASSWORD=${SATELLITE_PGSQL_PASSWORD} \
     --tz=${TIMEZONE} \
     --network=host \
     ${NETHVOICE_SATELLITE_IMAGE}

imageroot/update-module.d/10env

@@ -84,12 +84,22 @@ if os.getenv('SATELLITE_ARI_USERNAME') is None:
 if os.getenv('SATELLITE_MQTT_USERNAME') is None:
     agent.set_env('SATELLITE_MQTT_USERNAME', 'satellite')
 
+# Add Satellite PostgreSQL environment variables for updates
+if os.getenv('SATELLITE_PGSQL_PORT') is None:
+    agent.set_env('SATELLITE_PGSQL_PORT', os.environ['SATELLITE_PGSQL_PORT'])
+if os.getenv('SATELLITE_PGSQL_DB') is None:
+    agent.set_env('SATELLITE_PGSQL_DB', 'satellite')
+if os.getenv('SATELLITE_PGSQL_USER') is None:
+    agent.set_env('SATELLITE_PGSQL_USER', 'satellite')
+
 # Add satellite password for updates in passwords.env if not already set
 passwordsfile = agent.read_envfile("passwords.env")
 if not 'SATELLITE_MQTT_PASSWORD' in agent.read_envfile('passwords.env'):
     passwordsfile['SATELLITE_MQTT_PASSWORD'] = gen_password()
 if not 'SATELLITE_ARI_PASSWORD' in agent.read_envfile('passwords.env'):
     passwordsfile['SATELLITE_ARI_PASSWORD'] = gen_password()
+if not 'SATELLITE_PGSQL_PASSWORD' in agent.read_envfile('passwords.env'):
+    passwordsfile['SATELLITE_PGSQL_PASSWORD'] = gen_password()
 agent.write_envfile('passwords.env', passwordsfile)
 
 if os.getenv('NETHVOICE_MIDDLEWARE_V1_API_ENDPOINT') is None: