72 lines
3.2 KiB
YAML
72 lines
3.2 KiB
YAML
services:
|
|
nodedc-module-foundry:
|
|
build:
|
|
context: ..
|
|
dockerfile: Dockerfile
|
|
image: nodedc/module-foundry:local
|
|
restart: unless-stopped
|
|
env_file:
|
|
- ../.env
|
|
environment:
|
|
NODE_ENV: production
|
|
HOST: 0.0.0.0
|
|
PORT: 3333
|
|
FOUNDRY_RUNTIME_DIR: /var/lib/nodedc-module-foundry
|
|
NODEDC_FOUNDRY_AUTH_REQUIRED: "true"
|
|
NODEDC_FOUNDRY_SERVICE_SLUG: module-foundry
|
|
NODEDC_LAUNCHER_BASE_URL: ${NODEDC_LAUNCHER_BASE_URL:?set NODEDC_LAUNCHER_BASE_URL in .env}
|
|
NODEDC_LAUNCHER_INTERNAL_URL: ${NODEDC_LAUNCHER_INTERNAL_URL:?set NODEDC_LAUNCHER_INTERNAL_URL in .env}
|
|
NODEDC_INTERNAL_ACCESS_TOKEN: ${NODEDC_INTERNAL_ACCESS_TOKEN:?set the existing NODE.DC internal access value in .env}
|
|
# Runner-owned file mount. The secret signs private Gateway requests but
|
|
# never becomes a Foundry env value or browser-visible setting.
|
|
NODEDC_MAP_GATEWAY_ADMIN_SECRET_FILE: /run/nodedc-secrets/map-gateway-admin-secret
|
|
# Browser traffic stays same-origin through Foundry; this private address
|
|
# is used only by the Foundry server.
|
|
NODEDC_MAP_GATEWAY_INTERNAL_URL: ${NODEDC_MAP_GATEWAY_INTERNAL_URL:-http://map-gateway:18103}
|
|
# Platform EDP is never addressed by a browser. A page binding resolves
|
|
# its own opaque reader grant from the read-only directory below.
|
|
NODEDC_EXTERNAL_DATA_PLANE_INTERNAL_URL: ${NODEDC_EXTERNAL_DATA_PLANE_INTERNAL_URL:-http://external-data-plane:18106}
|
|
NODEDC_EXTERNAL_DATA_PLANE_READER_GRANTS_DIR: /run/nodedc-secrets/external-data-plane-reader-grants
|
|
# Long-lived L2 credentials are separate revocable workload grants. The
|
|
# directory contains only hashed grant records; opaque values stay in
|
|
# Engine credentials and never enter Foundry env or application state.
|
|
NODEDC_FOUNDRY_BINDING_GRANTS_DIR: /run/nodedc-secrets/foundry-binding-grants
|
|
NODEDC_FOUNDRY_COOKIE_SECURE: "true"
|
|
ports:
|
|
- "${FOUNDRY_HOST_BIND:-172.22.0.222:9920}:3333"
|
|
volumes:
|
|
- nodedc-module-foundry-runtime:/var/lib/nodedc-module-foundry
|
|
- type: bind
|
|
source: /volume1/docker/nodedc-platform/secrets/map-gateway-admin-secret
|
|
target: /run/nodedc-secrets/map-gateway-admin-secret
|
|
read_only: true
|
|
- type: bind
|
|
source: /volume1/docker/nodedc-platform/secrets/external-data-plane-reader-grants
|
|
target: /run/nodedc-secrets/external-data-plane-reader-grants
|
|
read_only: true
|
|
bind:
|
|
create_host_path: false
|
|
- type: bind
|
|
source: /volume1/docker/nodedc-platform/secrets/foundry-binding-grants
|
|
target: /run/nodedc-secrets/foundry-binding-grants
|
|
read_only: true
|
|
bind:
|
|
create_host_path: false
|
|
networks:
|
|
- platform-engine
|
|
healthcheck:
|
|
test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:3333/healthz').then((response) => process.exit(response.ok ? 0 : 1)).catch(() => process.exit(1))"]
|
|
interval: 20s
|
|
timeout: 5s
|
|
retries: 5
|
|
start_period: 20s
|
|
|
|
volumes:
|
|
nodedc-module-foundry-runtime:
|
|
name: nodedc-module-foundry-runtime
|
|
|
|
networks:
|
|
platform-engine:
|
|
external: true
|
|
name: ${NODEDC_ENGINE_DOCKER_NETWORK:-nodedc-demo_default}
|