halkyon/deploy/compose.maps.yaml

# The instance's own map for Halkyon Train (ADR 0030, D50), beside compose.train.yaml,
# which it needs: Protomaps' basemap cut for Europe, served by pmtiles as ordinary
# tiles, which Train's style (served by Train's server) draws. Switched on in .env:
#
#   COMPOSE_FILE=compose.learn.yaml:compose.train.yaml:compose.maps.yaml
#   MAP_KEY_SECRET=<openssl rand -hex 32>
#
# Only people signed in to Train get tiles: Caddy asks Train's server about the key
# each tile comes with before passing it on (sidecars/train-maps.caddy). Neither
# logs a tile, as what was asked shows the area viewed. The cut (some 45 GB, to be
# measured) is in ./maps/tiles, renewed monthly, owned by a user ID of its own, which
# no person, no other container and not the CI runner uses. Setting it up:
# sidecars/README.md, Train's map.

services:
  map-tiles:
    build:
      context: ..
      dockerfile: deploy/maps/Dockerfile
    image: halkyon-maps
    restart: unless-stopped
    user: "61178:61178"
    read_only: true
    volumes:
      - ./maps/tiles:/tiles:ro
    # Beside Caddy alone: no site of its own, no published port, no way out.
    networks:
      - tiles
    mem_limit: 512m
    # No log: a tile's address is where someone looked.
    logging:
      driver: none

  map-tiles-refresh:
    image: halkyon-maps
    restart: unless-stopped
    user: "61178:61178"
    read_only: true
    command: ["/app/tiles.sh"]
    environment:
      # `west,south,east,north`; Europe's.
      MAP_REGION: ${MAP_REGION:--25,35,45,75}
    volumes:
      - ./maps/tiles:/tiles
    # Out to Protomaps' builds on `downloads`, an ordinary bridge with a way out to
    # anywhere, shared with BRouter's segments and the search's downloads.
    networks:
      - downloads
    mem_limit: 512m
    logging:
      driver: journald

  train-server:
    environment:
      # The tiles as Caddy serves them, and the secret their keys are made with.
      MAP_TILES_URL: https://${TRAIN_DOMAIN}/tiles/europe/{z}/{x}/{y}.mvt
      SERVERPOD_PASSWORD_mapKeySecret: ${MAP_KEY_SECRET:?set MAP_KEY_SECRET in deploy/.env}

  caddy:
    volumes:
      - ./sidecars/train-maps.caddy:/etc/caddy/train/maps.caddy:ro
    networks:
      tiles: {}

networks:
  # Caddy and the tiles, without a way out.
  tiles:
    internal: true
  downloads: