feat(map): add cache-first Cesium gateway and AMD egress

2026-07-16 02:23:56 +03:00
parent 59e9c92415
commit 7b55d887bc
31 changed files with 4956 additions and 167 deletions
@@ -0,0 +1,47 @@
+services:
+  dc-amd-proxy:
+    build:
+      context: .
+      dockerfile: Dockerfile
+    container_name: dc-amd-proxy
+    image: nodedc/dc-amd-proxy:local
+    restart: unless-stopped
+    # Preserve the real AMD source address for the one-time pairing request.
+    # The process itself binds only to the NAS LAN address below; this does not
+    # change NAS routes, VPN, DNS, Tailscale, or any other host service.
+    network_mode: host
+    environment:
+      PORT: "8790"
+      DC_AMD_PROXY_BIND_ADDRESS: ${DC_AMD_PROXY_BIND_ADDRESS:-172.22.0.222}
+      DC_AMD_CONNECTOR_HOST: ${DC_AMD_CONNECTOR_HOST:-172.22.0.183}
+      DC_AMD_CONNECTOR_PORT: ${DC_AMD_CONNECTOR_PORT:-8791}
+      DC_AMD_PAIR_ALLOWED_SOURCE: ${DC_AMD_PAIR_ALLOWED_SOURCE:-172.22.0.183}
+      DC_AMD_CONNECTOR_TOKEN_FILE: /var/lib/dc-amd-proxy/connector-access
+      DC_AMD_MAP_EGRESS_TOKEN_FILE: /run/nodedc-secrets/map-egress-proxy-token
+      DC_AMD_BODY_IDLE_TIMEOUT_SECONDS: ${DC_AMD_BODY_IDLE_TIMEOUT_SECONDS:-30}
+    volumes:
+      - type: bind
+        source: /volume1/docker/nodedc-platform/secrets/map-egress-proxy-token
+        target: /run/nodedc-secrets/map-egress-proxy-token
+        read_only: true
+      - type: bind
+        source: ./runtime
+        target: /var/lib/dc-amd-proxy
+    read_only: true
+    tmpfs:
+      - /tmp:rw,noexec,nosuid,size=8m
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+    healthcheck:
+      test:
+        - CMD-SHELL
+        - >
+          node -e "fetch('http://'+process.env.DC_AMD_PROXY_BIND_ADDRESS+':8790/healthz')
+          .then(r => process.exit(r.ok ? 0 : 1))
+          .catch(() => process.exit(1))"
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 10s