build(train): Train's server and BRouter deployable beside the instance (ADR 0030, D46)
deploy/compose.train.yaml adds Train's server at train.halkyon.eu, a member of Learn's register, with its database halkyon_train in the instance's PostgreSQL, and BRouter beside it alone (v1.7.10, checked by SHA-256, no log), its segments of the operator's region kept current monthly. Nothing changes until deploy/.env names the compose file: redeploy.sh and backup.sh take Train in only then, and the operator's steps are in sidecars/README.md. restic now forgets snapshots grouped by host alone, so adding Train's dump leaves no group behind for good. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
This commit is contained in:
parent
781576726a
commit
a8f7c26e69
GPG key ID:
07F6FCF405488B64
1 changed files with 483 additions and 36 deletions
114
deploy/compose.train.yaml
Normal file
114
deploy/compose.train.yaml
Normal file
|
|
@ -0,0 +1,114 @@
|
|||
# Halkyon Train's server beside the instance (ADR 0030, D46), with the BRouter that
|
||||
# plans its routes (D11, D44). Switched on in .env, with Train's domain and secrets:
|
||||
#
|
||||
# COMPOSE_FILE=compose.yaml:compose.train.yaml
|
||||
# TRAIN_DOMAIN=train.halkyon.eu
|
||||
#
|
||||
# Train is a member of the instance's register, which Learn's server holds (ADR 0016):
|
||||
# one account a person, signing in through the register, the shared INSTANCE_SECRET
|
||||
# on every call between them, which reach each other on the instance's own networks
|
||||
# alone. Its database is `halkyon_train` in the instance's PostgreSQL, under a role of
|
||||
# its own that can't connect to Learn's. BRouter has no site and no sign-in: only
|
||||
# Train's server reaches it, on a network of their own, and asks it nothing that is
|
||||
# logged. Its segments (Europe's, about 3.3 GB) are in ./brouter/segments, which the
|
||||
# refresher keeps current monthly, owned by a user ID of their own, which no person,
|
||||
# no other container and not the CI runner uses. Setting it up: sidecars/README.md.
|
||||
|
||||
services:
|
||||
train-server:
|
||||
build:
|
||||
context: ..
|
||||
dockerfile: apps/train/halkyon_train_server/Dockerfile
|
||||
image: halkyon-train-server
|
||||
restart: unless-stopped
|
||||
# As Learn's: migrations at every start (redeploy.sh has applied them before).
|
||||
command: ["--apply-migrations"]
|
||||
environment:
|
||||
SERVERPOD_DATABASE_PASSWORD: ${TRAIN_POSTGRES_PASSWORD:?set TRAIN_POSTGRES_PASSWORD in deploy/.env}
|
||||
SERVERPOD_PASSWORD_serverSideSessionKeyHashPepper: ${TRAIN_SESSION_KEY_HASH_PEPPER:?set TRAIN_SESSION_KEY_HASH_PEPPER in deploy/.env}
|
||||
# The register (ADR 0016): Learn's web server, on the instance's own network,
|
||||
# and the secret every call between them carries.
|
||||
ACCOUNT_REGISTER_URL: http://server:8082/
|
||||
SERVERPOD_PASSWORD_instanceSecret: ${INSTANCE_SECRET:?set INSTANCE_SECRET in deploy/.env}
|
||||
# Caddy, as for Learn's server (compose.yaml).
|
||||
TRUSTED_PROXIES: 172.30.80.2 fd4a:6c6b:7e80::2
|
||||
SOURCE_URL: ${SOURCE_URL:-}
|
||||
DATA_LOCATION: ${DATA_LOCATION:-}
|
||||
BACKUP_LOCATION: ${BACKUP_LOCATION:-}
|
||||
# Routes (D44), from the BRouter below.
|
||||
BROUTER_URL: http://brouter:17777/
|
||||
# The Loop's firmware through the instance (D40): on unless `off`.
|
||||
LOOP_FIRMWARE_RELAY: ${LOOP_FIRMWARE_RELAY:-}
|
||||
# The map source (D22); empty: OpenFreeMap.
|
||||
MAP_STYLE_URL: ${MAP_STYLE_URL:-}
|
||||
MAP_SOURCE_NAME: ${MAP_SOURCE_NAME:-}
|
||||
MAP_ATTRIBUTION: ${MAP_ATTRIBUTION:-}
|
||||
MAP_ABOUT_URL: ${MAP_ABOUT_URL:-}
|
||||
networks:
|
||||
- default
|
||||
- edge
|
||||
- routing
|
||||
depends_on:
|
||||
postgres:
|
||||
condition: service_healthy
|
||||
logging:
|
||||
driver: journald
|
||||
|
||||
brouter:
|
||||
build:
|
||||
context: ..
|
||||
dockerfile: deploy/brouter/Dockerfile
|
||||
image: halkyon-brouter
|
||||
restart: unless-stopped
|
||||
user: "61177:61177"
|
||||
read_only: true
|
||||
tmpfs:
|
||||
- /tmp:size=16m,uid=61177,gid=61177
|
||||
volumes:
|
||||
- ./brouter/segments:/segments4:ro
|
||||
# Beside Train's server alone: no site, no published port, never beside Caddy or
|
||||
# Postgres.
|
||||
networks:
|
||||
- routing
|
||||
mem_limit: 640m
|
||||
# No log at all: BRouter writes each route's waypoints to its output, and where
|
||||
# people run must never be kept. To look into a failure, switch to journald for
|
||||
# a while.
|
||||
logging:
|
||||
driver: none
|
||||
|
||||
brouter-segments:
|
||||
image: halkyon-brouter
|
||||
restart: unless-stopped
|
||||
user: "61177:61177"
|
||||
read_only: true
|
||||
command: ["/app/segments.sh"]
|
||||
environment:
|
||||
# `west,south,east,north` of the segments' south-west corners; Europe's.
|
||||
BROUTER_REGION: ${BROUTER_REGION:--25,35,40,70}
|
||||
volumes:
|
||||
- ./brouter/segments:/segments4
|
||||
# Out to brouter.de alone; on a network of its own, beside nothing.
|
||||
networks:
|
||||
- downloads
|
||||
mem_limit: 64m
|
||||
logging:
|
||||
driver: journald
|
||||
|
||||
caddy:
|
||||
environment:
|
||||
TRAIN_DOMAIN: ${TRAIN_DOMAIN:?set TRAIN_DOMAIN in deploy/.env}
|
||||
volumes:
|
||||
- ./sidecars/train.caddy:/etc/caddy/sidecars/train.caddy:ro
|
||||
|
||||
server:
|
||||
environment:
|
||||
# Train's web server, told when an account goes (ADR 0016); set
|
||||
# INSTANCE_MEMBERS in .env to name more members, Train's among them.
|
||||
INSTANCE_MEMBERS: ${INSTANCE_MEMBERS:-http://train-server:8082/}
|
||||
|
||||
networks:
|
||||
# Train's server and BRouter, without a way out.
|
||||
routing:
|
||||
internal: true
|
||||
downloads:
|
||||
Loading…
Reference in a new issue