feat(device-plane): add canonical Device Manager runtime

2026-08-10 22:00:59 +03:00
parent 1d1e9a96b3
commit 29ba5de92e
14 changed files with 1122 additions and 10 deletions
@@ -0,0 +1,76 @@
+services:
+  device-control-core:
+    environment:
+      DEVICE_MANAGEMENT_API_ENABLED: "true"
+      DEVICE_MANAGEMENT_CORE_TOKEN_FILE: /run/nodedc-secrets/management-core-token
+    volumes:
+      - type: bind
+        source: /volume1/docker/nodedc-device-plane/secrets/management-core-token
+        target: /run/nodedc-secrets/management-core-token
+        read_only: true
+        bind:
+          create_host_path: false
+
+  device-manager:
+    image: nodedc/device-manager:local
+    pull_policy: never
+    build:
+      context: ./services/device-manager
+    restart: unless-stopped
+    user: "1000:1000"
+    read_only: true
+    tmpfs:
+      - /tmp:size=16m,mode=1777
+    environment:
+      NODE_ENV: production
+      HOST: 0.0.0.0
+      PORT: "18122"
+      NODEDC_DEVICE_MANAGER_AUTH_REQUIRED: "true"
+      NODEDC_DEVICE_MANAGER_COOKIE_SECURE: "true"
+      NODEDC_DEVICE_MANAGER_LOCAL_PREVIEW: "false"
+      NODEDC_DEVICE_MANAGER_SERVICE_SLUG: device-core
+      NODEDC_LAUNCHER_BASE_URL: https://hub.nodedc.ru
+      NODEDC_LAUNCHER_INTERNAL_URL: http://launcher:5173
+      NODEDC_LAUNCHER_INTERNAL_TOKEN_FILE: /run/nodedc-secrets/device-core-internal-token
+      NODEDC_DEVICE_CORE_INTERNAL_URL: http://device-control-core:18120
+      NODEDC_DEVICE_CORE_TOKEN_FILE: /run/nodedc-secrets/management-core-token
+    volumes:
+      - type: bind
+        source: /volume1/docker/nodedc-platform/secrets/device-core-internal-token
+        target: /run/nodedc-secrets/device-core-internal-token
+        read_only: true
+        bind:
+          create_host_path: false
+      - type: bind
+        source: /volume1/docker/nodedc-device-plane/secrets/management-core-token
+        target: /run/nodedc-secrets/management-core-token
+        read_only: true
+        bind:
+          create_host_path: false
+    expose:
+      - "18122"
+    networks:
+      - device-plane-private
+      - platform-edge
+    depends_on:
+      device-control-core:
+        condition: service_healthy
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+    healthcheck:
+      test:
+        - CMD
+        - node
+        - -e
+        - fetch('http://127.0.0.1:18122/healthz').then(r=>r.json()).then(v=>{if(!v.ok||!v.authRequired||!v.deviceCoreConfigured)process.exit(1)}).catch(()=>process.exit(1))
+      interval: 10s
+      timeout: 5s
+      retries: 12
+      start_period: 10s
+
+networks:
+  platform-edge:
+    external: true
+    name: nodedc-platform_edge