feat(foundry): productionize Cesium Map Page and platform runtime

2026-07-16 02:25:58 +03:00
parent 1a2ca8c82c
commit 5e8c1cc3fc
41 changed files with 6977 additions and 179 deletions
@@ -0,0 +1,71 @@
+services:
+  nodedc-module-foundry:
+    build:
+      context: ..
+      dockerfile: Dockerfile
+    image: nodedc/module-foundry:local
+    restart: unless-stopped
+    env_file:
+      - ../.env
+    environment:
+      NODE_ENV: production
+      HOST: 0.0.0.0
+      PORT: 3333
+      FOUNDRY_RUNTIME_DIR: /var/lib/nodedc-module-foundry
+      NODEDC_FOUNDRY_AUTH_REQUIRED: "true"
+      NODEDC_FOUNDRY_SERVICE_SLUG: module-foundry
+      NODEDC_LAUNCHER_BASE_URL: ${NODEDC_LAUNCHER_BASE_URL:?set NODEDC_LAUNCHER_BASE_URL in .env}
+      NODEDC_LAUNCHER_INTERNAL_URL: ${NODEDC_LAUNCHER_INTERNAL_URL:?set NODEDC_LAUNCHER_INTERNAL_URL in .env}
+      NODEDC_INTERNAL_ACCESS_TOKEN: ${NODEDC_INTERNAL_ACCESS_TOKEN:?set the existing NODE.DC internal access value in .env}
+      # Runner-owned file mount. The secret signs private Gateway requests but
+      # never becomes a Foundry env value or browser-visible setting.
+      NODEDC_MAP_GATEWAY_ADMIN_SECRET_FILE: /run/nodedc-secrets/map-gateway-admin-secret
+      # Browser traffic stays same-origin through Foundry; this private address
+      # is used only by the Foundry server.
+      NODEDC_MAP_GATEWAY_INTERNAL_URL: ${NODEDC_MAP_GATEWAY_INTERNAL_URL:-http://map-gateway:18103}
+      # Platform EDP is never addressed by a browser. A page binding resolves
+      # its own opaque reader grant from the read-only directory below.
+      NODEDC_EXTERNAL_DATA_PLANE_INTERNAL_URL: ${NODEDC_EXTERNAL_DATA_PLANE_INTERNAL_URL:-http://external-data-plane:18106}
+      NODEDC_EXTERNAL_DATA_PLANE_READER_GRANTS_DIR: /run/nodedc-secrets/external-data-plane-reader-grants
+      # Long-lived L2 credentials are separate revocable workload grants. The
+      # directory contains only hashed grant records; opaque values stay in
+      # Engine credentials and never enter Foundry env or application state.
+      NODEDC_FOUNDRY_BINDING_GRANTS_DIR: /run/nodedc-secrets/foundry-binding-grants
+      NODEDC_FOUNDRY_COOKIE_SECURE: "true"
+    ports:
+      - "${FOUNDRY_HOST_BIND:-172.22.0.222:9920}:3333"
+    volumes:
+      - nodedc-module-foundry-runtime:/var/lib/nodedc-module-foundry
+      - type: bind
+        source: /volume1/docker/nodedc-platform/secrets/map-gateway-admin-secret
+        target: /run/nodedc-secrets/map-gateway-admin-secret
+        read_only: true
+      - type: bind
+        source: /volume1/docker/nodedc-platform/secrets/external-data-plane-reader-grants
+        target: /run/nodedc-secrets/external-data-plane-reader-grants
+        read_only: true
+        bind:
+          create_host_path: false
+      - type: bind
+        source: /volume1/docker/nodedc-platform/secrets/foundry-binding-grants
+        target: /run/nodedc-secrets/foundry-binding-grants
+        read_only: true
+        bind:
+          create_host_path: false
+    networks:
+      - platform-engine
+    healthcheck:
+      test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:3333/healthz').then((response) => process.exit(response.ok ? 0 : 1)).catch(() => process.exit(1))"]
+      interval: 20s
+      timeout: 5s
+      retries: 5
+      start_period: 20s
+
+volumes:
+  nodedc-module-foundry-runtime:
+    name: nodedc-module-foundry-runtime
+
+networks:
+  platform-engine:
+    external: true
+    name: ${NODEDC_ENGINE_DOCKER_NETWORK:-nodedc-demo_default}