89 lines
4.6 KiB
YAML
89 lines
4.6 KiB
YAML
services:
|
|
nodedc-module-foundry:
|
|
build:
|
|
context: ..
|
|
dockerfile: Dockerfile
|
|
image: nodedc/module-foundry:local
|
|
restart: unless-stopped
|
|
env_file:
|
|
- ../.env
|
|
environment:
|
|
NODE_ENV: production
|
|
HOST: 0.0.0.0
|
|
PORT: 3333
|
|
FOUNDRY_RUNTIME_DIR: /var/lib/nodedc-module-foundry
|
|
NODEDC_FOUNDRY_AUTH_REQUIRED: "true"
|
|
NODEDC_FOUNDRY_SERVICE_SLUG: module-foundry
|
|
NODEDC_LAUNCHER_BASE_URL: ${NODEDC_LAUNCHER_BASE_URL:?set NODEDC_LAUNCHER_BASE_URL in .env}
|
|
NODEDC_LAUNCHER_INTERNAL_URL: ${NODEDC_LAUNCHER_INTERNAL_URL:?set NODEDC_LAUNCHER_INTERNAL_URL in .env}
|
|
NODEDC_INTERNAL_ACCESS_TOKEN: ${NODEDC_INTERNAL_ACCESS_TOKEN:?set the existing NODE.DC internal access value in .env}
|
|
# Ontology remains an internal read-only MCP. The external Codex receives
|
|
# a separate nodedc_ontology entry whose traffic is authenticated by the
|
|
# Foundry agent gateway and forwarded with the server-only platform token.
|
|
NODEDC_ONTOLOGY_CORE_URL: ${NODEDC_ONTOLOGY_CORE_URL:-http://ontology-core:18104}
|
|
# Runner-owned file mount. The secret signs private Gateway requests but
|
|
# never becomes a Foundry env value or browser-visible setting.
|
|
NODEDC_MAP_GATEWAY_ADMIN_SECRET_FILE: /run/nodedc-secrets/map-gateway-admin-secret
|
|
# Browser traffic stays same-origin through Foundry; this private address
|
|
# is used only by the Foundry server.
|
|
NODEDC_MAP_GATEWAY_INTERNAL_URL: ${NODEDC_MAP_GATEWAY_INTERNAL_URL:-http://map-gateway:18103}
|
|
# Platform EDP is never addressed by a browser. A page binding resolves
|
|
# its own opaque reader grant from the read-only directory below.
|
|
NODEDC_EXTERNAL_DATA_PLANE_INTERNAL_URL: ${NODEDC_EXTERNAL_DATA_PLANE_INTERNAL_URL:-http://external-data-plane:18106}
|
|
NODEDC_EXTERNAL_DATA_PLANE_READER_GRANTS_DIR: /run/nodedc-secrets/external-data-plane-reader-grants
|
|
# Foundry has a separate managed-provisioner identity. The private key
|
|
# signs digest-only reader-grant plan/ensure requests and is never used
|
|
# by Engine, n8n, a browser, MCP input or application state.
|
|
NODEDC_EXTERNAL_DATA_PLANE_FOUNDRY_PROVISIONER_PRIVATE_KEY_FILE: /run/nodedc-secrets/foundry-edp-managed-provisioner/private-key.pem
|
|
NODEDC_EXTERNAL_DATA_PLANE_FOUNDRY_PROVISIONER_SERVICE_ID: ${NODEDC_EXTERNAL_DATA_PLANE_FOUNDRY_PROVISIONER_SERVICE_ID:-nodedc-module-foundry}
|
|
NODEDC_EXTERNAL_DATA_PLANE_FOUNDRY_PROVISIONER_KEY_ID: ${NODEDC_EXTERNAL_DATA_PLANE_FOUNDRY_PROVISIONER_KEY_ID:-foundry-edp-managed-provisioner-v1}
|
|
NODEDC_EXTERNAL_DATA_PLANE_FOUNDRY_PROVISIONER_AUDIENCE: ${NODEDC_EXTERNAL_DATA_PLANE_FOUNDRY_PROVISIONER_AUDIENCE:-nodedc-external-data-plane.managed-provisioning.v1}
|
|
# Long-lived L2 credentials are separate revocable workload grants. The
|
|
# directory contains only hashed grant records; opaque values stay in
|
|
# Engine credentials and never enter Foundry env or application state.
|
|
NODEDC_FOUNDRY_BINDING_GRANTS_DIR: /run/nodedc-secrets/foundry-binding-grants
|
|
NODEDC_FOUNDRY_COOKIE_SECURE: "true"
|
|
ports:
|
|
- "${FOUNDRY_HOST_BIND:-172.22.0.222:9920}:3333"
|
|
volumes:
|
|
- nodedc-module-foundry-runtime:/var/lib/nodedc-module-foundry
|
|
- type: bind
|
|
source: /volume1/docker/nodedc-platform/secrets/map-gateway-admin-secret
|
|
target: /run/nodedc-secrets/map-gateway-admin-secret
|
|
read_only: true
|
|
- type: bind
|
|
source: /volume1/docker/nodedc-platform/secrets/external-data-plane-reader-grants
|
|
target: /run/nodedc-secrets/external-data-plane-reader-grants
|
|
read_only: true
|
|
bind:
|
|
create_host_path: false
|
|
- type: bind
|
|
source: /volume1/docker/nodedc-platform/secrets/foundry-binding-grants
|
|
target: /run/nodedc-secrets/foundry-binding-grants
|
|
read_only: true
|
|
bind:
|
|
create_host_path: false
|
|
- type: bind
|
|
source: /volume1/docker/nodedc-platform/secrets/foundry-edp-managed-provisioner/private-key.pem
|
|
target: /run/nodedc-secrets/foundry-edp-managed-provisioner/private-key.pem
|
|
read_only: true
|
|
bind:
|
|
create_host_path: false
|
|
networks:
|
|
- platform-engine
|
|
healthcheck:
|
|
test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:3333/healthz').then((response) => process.exit(response.ok ? 0 : 1)).catch(() => process.exit(1))"]
|
|
interval: 20s
|
|
timeout: 5s
|
|
retries: 5
|
|
start_period: 20s
|
|
|
|
volumes:
|
|
nodedc-module-foundry-runtime:
|
|
name: nodedc-module-foundry-runtime
|
|
|
|
networks:
|
|
platform-engine:
|
|
external: true
|
|
name: ${NODEDC_ENGINE_DOCKER_NETWORK:-nodedc-demo_default}
|