feat(deploy): register managed platform runtime components

2026-07-16 02:25:31 +03:00
parent fedaf24098
commit 567f1550ab
29 changed files with 4413 additions and 40 deletions
@@ -142,6 +142,8 @@ services:
      AI_WORKSPACE_HUB_INTERNAL_URL: ${AI_WORKSPACE_HUB_INTERNAL_URL:-https://ai-hub.nodedc.ru}
      AI_WORKSPACE_HUB_TOKEN: ${AI_WORKSPACE_HUB_TOKEN:?ai workspace hub token required}
      AI_WORKSPACE_HUB_FALLBACK_URLS: ${AI_WORKSPACE_HUB_FALLBACK_URLS:-}
+      AI_WORKSPACE_ONTOLOGY_MCP_ENABLED: ${AI_WORKSPACE_ONTOLOGY_MCP_ENABLED:-true}
+      AI_WORKSPACE_ENTITLEMENT_ADAPTERS_JSON: ${AI_WORKSPACE_ENTITLEMENT_ADAPTERS_JSON:-}
      NDC_ONTOLOGY_LAUNCHER_BASE_URL: http://launcher:5173
    expose:
      - "18082"
@@ -154,6 +156,160 @@ services:
      - identity
      - engine

+  ontology-core:
+    image: nodedc/ontology-core:local
+    build:
+      context: ./ontology-core
+    restart: unless-stopped
+    env_file:
+      - ${NODEDC_SYNOLOGY_ENV_FILE:-.env.synology}
+    environment:
+      NODE_ENV: production
+      PORT: 18104
+      NODEDC_INTERNAL_ACCESS_TOKEN: ${NODEDC_INTERNAL_ACCESS_TOKEN:-}
+    expose:
+      - "18104"
+    ports:
+      - "${ONTOLOGY_CORE_HOST_BIND:-127.0.0.1:18104}:18104"
+    healthcheck:
+      test:
+        - CMD
+        - node
+        - -e
+        - "fetch('http://127.0.0.1:18104/healthz').then((response) => process.exit(response.ok ? 0 : 1)).catch(() => process.exit(1))"
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 10s
+    networks:
+      - engine
+
+  # The provider database is private. Gateway is the only component that can
+  # reach it; the host bind is loopback-only for audited operator diagnostics.
+  gelios-postgres:
+    image: ${GELIOS_TIMESCALE_IMAGE:-timescale/timescaledb-ha:pg16.14-ts2.28.2-all}
+    restart: unless-stopped
+    env_file:
+      - ${NODEDC_SYNOLOGY_ENV_FILE:-.env.synology}
+    environment:
+      POSTGRES_DB: ${GELIOS_PG_DB:-nodedc_gelios}
+      POSTGRES_USER: ${GELIOS_PG_USER:-nodedc_gelios}
+      POSTGRES_PASSWORD: ${GELIOS_PG_PASS:?gelios database password required}
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}"]
+      interval: 30s
+      timeout: 5s
+      retries: 5
+      start_period: 30s
+    volumes:
+      - gelios-database:/home/postgres/pgdata/data
+    networks:
+      - gelios-data
+
+  gelios-gateway:
+    image: nodedc/gelios-gateway:local
+    build:
+      context: ./gelios-gateway
+    restart: unless-stopped
+    env_file:
+      - ${NODEDC_SYNOLOGY_ENV_FILE:-.env.synology}
+    environment:
+      NODE_ENV: production
+      PORT: 18105
+      DATABASE_URL: ${GELIOS_DATABASE_URL:?gelios database URL required}
+      NODEDC_INTERNAL_ACCESS_TOKEN: ${NODEDC_INTERNAL_ACCESS_TOKEN:-}
+      GELIOS_TENANT_ID: ${GELIOS_TENANT_ID:?gelios tenant id required}
+      GELIOS_CONNECTION_ID: ${GELIOS_CONNECTION_ID:?gelios connection id required}
+      GELIOS_UNIT_SCOPE: ${GELIOS_UNIT_SCOPE:-allowlist}
+      GELIOS_ALLOWED_UNIT_IDS: ${GELIOS_ALLOWED_UNIT_IDS:-}
+      GELIOS_INTAKE_ENABLED: ${GELIOS_INTAKE_ENABLED:-false}
+      GELIOS_RAW_RETENTION_DAYS: ${GELIOS_RAW_RETENTION_DAYS:-14}
+      GELIOS_POSITION_STALE_AFTER_MS: ${GELIOS_POSITION_STALE_AFTER_MS:-300000}
+    expose:
+      - "18105"
+    ports:
+      - "${GELIOS_GATEWAY_HOST_BIND:-127.0.0.1:18105}:18105"
+    depends_on:
+      gelios-postgres:
+        condition: service_healthy
+    healthcheck:
+      test:
+        - CMD
+        - node
+        - -e
+        - "fetch('http://127.0.0.1:18105/healthz').then((response) => process.exit(response.ok ? 0 : 1)).catch(() => process.exit(1))"
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 15s
+    networks:
+      - engine
+      - gelios-data
+
+  # One private Platform gateway and one NAS-resident persistent cache serve
+  # every Foundry Application/Map Page instance. It is not published to a browser.
+  map-gateway:
+    image: nodedc/map-gateway:local
+    build:
+      context: ../../services/map-gateway
+    restart: unless-stopped
+    env_file:
+      - ${NODEDC_SYNOLOGY_ENV_FILE:-.env.synology}
+    environment:
+      NODE_ENV: production
+      PORT: 18103
+      # Optional legacy bootstrap. The canonical mutable value, when an
+      # authorized Foundry admin saves it, is the private NAS secret file
+      # inside MAP_CACHE_DIR and never a deploy artifact or browser env.
+      CESIUM_ION_TOKEN: ${CESIUM_ION_TOKEN:-}
+      # Runner-owned file mount; the secret itself is never an env value.
+      NODEDC_MAP_GATEWAY_ADMIN_SECRET_FILE: /run/nodedc-secrets/map-gateway-admin-secret
+      # DC AMD Proxy preserves the AMD workstation's VPN-only Cesium route.
+      # The fixed NAS LAN listener is authenticated by the same runner-managed
+      # file token; neither token is a browser or Foundry env.
+      MAP_GATEWAY_EGRESS_URL: http://172.22.0.222:8790
+      MAP_GATEWAY_EGRESS_PROXY_TOKEN_FILE: /run/nodedc-secrets/map-egress-proxy-token
+      CESIUM_ION_ASSET_ALLOWLIST: ${CESIUM_ION_ASSET_ALLOWLIST:-1,2,96188}
+      MAP_CACHE_DIR: /var/lib/nodedc-map-live-cache
+      MAP_OFFLINE_SNAPSHOT_DIR: /var/lib/nodedc-map-offline-snapshot
+      MAP_CACHE_MODE: ${MAP_CACHE_MODE:-readwrite}
+      MAP_CACHE_MAX_MB: ${MAP_CACHE_MAX_MB:-20480}
+      MAP_GATEWAY_ALLOW_ANONYMOUS: "false"
+      MAP_GATEWAY_TRUSTED_SUBJECT_HEADER: x-nodedc-user-id
+      MAP_GATEWAY_UPSTREAM_ALLOWLIST: ${MAP_GATEWAY_UPSTREAM_ALLOWLIST:-api.cesium.com,assets.ion.cesium.com,tile.openstreetmap.org,dev.virtualearth.net,ecn.t0.tiles.virtualearth.net,ecn.t1.tiles.virtualearth.net,ecn.t2.tiles.virtualearth.net,ecn.t3.tiles.virtualearth.net}
+      MAP_GATEWAY_LEGACY_CACHE_HOSTS: ${MAP_GATEWAY_LEGACY_CACHE_HOSTS:-}
+      MAP_GATEWAY_OFFLINE_PROVIDER_ALLOWLIST: ${MAP_GATEWAY_OFFLINE_PROVIDER_ALLOWLIST:-}
+    volumes:
+      - type: bind
+        source: ${MAP_LIVE_CACHE_HOST_DIR:-/volume1/docker/nodedc-platform/map-gateway/live-tile-cache}
+        target: /var/lib/nodedc-map-live-cache
+      - type: bind
+        source: ${MAP_OFFLINE_SNAPSHOT_HOST_DIR:-/volume1/docker/nodedc-platform/map-gateway/offline-snapshot}
+        target: /var/lib/nodedc-map-offline-snapshot
+        read_only: true
+      - type: bind
+        source: /volume1/docker/nodedc-platform/secrets/map-gateway-admin-secret
+        target: /run/nodedc-secrets/map-gateway-admin-secret
+        read_only: true
+      - type: bind
+        source: /volume1/docker/nodedc-platform/secrets/map-egress-proxy-token
+        target: /run/nodedc-secrets/map-egress-proxy-token
+        read_only: true
+    # Operator-only loopback binding for the root-owned deploy healthcheck.
+    # Foundry reaches the service over the private Docker network; browsers
+    # never receive this address.
+    ports:
+      - "${MAP_GATEWAY_HOST_BIND:-127.0.0.1:18103}:18103"
+    healthcheck:
+      test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:18103/healthz',{headers:{'x-nodedc-user-id':'healthcheck'}}).then((response)=>process.exit(response.ok?0:1)).catch(()=>process.exit(1))"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 15s
+    networks:
+      - engine
+      - map-egress
+
  ai-workspace-hub:
    image: nodedc/ai-workspace-hub:local
    build:
@@ -167,11 +323,15 @@ services:
      AI_WORKSPACE_HUB_TOKEN: ${AI_WORKSPACE_HUB_TOKEN:?ai workspace hub token required}
      NODEDC_INTERNAL_ACCESS_TOKEN: ${NODEDC_INTERNAL_ACCESS_TOKEN:-}
      NODEDC_AI_WORKSPACE_ASSISTANT_URL: http://ai-workspace-assistant:18082
+      NODEDC_ONTOLOGY_CORE_URL: http://ontology-core:18104
      AI_WORKSPACE_HUB_WS_PATH: /api/ai-workspace/hub
    expose:
      - "18081"
    ports:
      - "${AI_WORKSPACE_HUB_HOST_BIND:-0.0.0.0:18081}:18081"
+    depends_on:
+      ontology-core:
+        condition: service_healthy
    networks:
      - edge
      - engine
@@ -256,6 +416,11 @@ networks:
    name: ${NODEDC_ENGINE_DOCKER_NETWORK:-nodedc-demo_default}
  identity:
    internal: true
+  gelios-data:
+    internal: true
+  map-egress:
+    external: true
+    name: nodedc-map-egress

 volumes:
  authentik-database:
@@ -263,5 +428,6 @@ volumes:
  authentik-certs:
  notification-database:
  ai-workspace-database:
+  gelios-database:
  caddy-data:
  caddy-config: