Merge pull request #291 from trails-cool/feat/brouter-host-compose

BRouter host compose + Planner auth + cd-brouter rewrite
2026-04-23 23:09:23 +02:00 · 2026-04-23 23:09:23 +02:00 · 34b2e44ed1
commit 34b2e44ed1
parent f0fe6abfa4 c49047fd33
11 changed files with 527 additions and 79 deletions
--- a/.github/workflows/cd-brouter.yml
+++ b/.github/workflows/cd-brouter.yml
@ -5,6 +5,7 @@ on:
    branches: [main]
    paths:
      - "docker/brouter/**"
+      - "infrastructure/brouter-host/**"
  workflow_dispatch: {}

 concurrency:
@ -36,13 +37,63 @@ jobs:
            ghcr.io/trails-cool/brouter:${{ github.sha }}

  deploy:
-    name: Deploy BRouter
+    name: Deploy BRouter to dedicated host
    needs: [build]
    runs-on: ubuntu-latest
+    environment: infra
    steps:
      - uses: actions/checkout@v6

-      - name: Deploy via SSH
+      - name: Decrypt shared secret
+        run: |
+          curl -sLO https://github.com/getsops/sops/releases/download/v3.9.4/sops-v3.9.4.linux.amd64
+          chmod +x sops-v3.9.4.linux.amd64
+          # Extract ONLY BROUTER_AUTH_TOKEN from secrets.app.env — the
+          # rest of that file is app-only and has no business reaching
+          # the BRouter host.
+          SOPS_AGE_KEY="${{ secrets.AGE_SECRET_KEY }}" ./sops-v3.9.4.linux.amd64 -d infrastructure/secrets.app.env \
+            | grep '^BROUTER_AUTH_TOKEN=' > infrastructure/brouter-host/.env
+          chmod 0600 infrastructure/brouter-host/.env
+
+      - name: Copy compose project to dedicated host
+        uses: appleboy/scp-action@v1
+        with:
+          host: ${{ secrets.BROUTER_DEPLOY_HOST }}
+          username: trails
+          port: ${{ secrets.BROUTER_DEPLOY_SSH_PORT }}
+          key: ${{ secrets.BROUTER_DEPLOY_SSH_KEY }}
+          source: "infrastructure/brouter-host/docker-compose.yml,infrastructure/brouter-host/Caddyfile,infrastructure/brouter-host/download-segments.sh,infrastructure/brouter-host/.env"
+          target: /home/trails/brouter
+          strip_components: 2
+
+      - name: Pull image and restart containers
+        uses: appleboy/ssh-action@v1
+        with:
+          host: ${{ secrets.BROUTER_DEPLOY_HOST }}
+          username: trails
+          port: ${{ secrets.BROUTER_DEPLOY_SSH_PORT }}
+          key: ${{ secrets.BROUTER_DEPLOY_SSH_KEY }}
+          script: |
+            set -euo pipefail
+            cd /home/trails/brouter
+
+            chmod +x download-segments.sh
+
+            # Segment download is explicitly NOT run here — it's
+            # multi-hour and idempotent. Seeding the segments directory
+            # is a one-shot operator task (see brouter-host/README.md).
+            # Run `~/brouter/download-segments.sh` by hand (or via cron)
+            # to refresh.
+            if [ ! -d segments ] || [ -z "$(ls -A segments 2>/dev/null)" ]; then
+              echo "WARNING: segments/ is empty. BRouter will start but return 404 until segments are seeded."
+              mkdir -p segments
+            fi
+
+            docker compose pull
+            docker compose up -d --remove-orphans
+            docker compose ps
+
+      - name: Annotate deploy in flagship Grafana
        uses: appleboy/ssh-action@v1
        with:
          host: ${{ secrets.DEPLOY_HOST }}
@ -50,34 +101,7 @@ jobs:
          key: ${{ secrets.DEPLOY_SSH_KEY }}
          script: |
            cd /opt/trails-cool
-
-            # Download BRouter segments for Europe (W10-E40, N35-N70)
-            mkdir -p /opt/trails-cool/segments
-            EUROPE_TILES="
-              W10_N50 W10_N55 W10_N60 W10_N65
-              W5_N35 W5_N40 W5_N45 W5_N50 W5_N55 W5_N60 W5_N65
-              E0_N35 E0_N40 E0_N45 E0_N50 E0_N55 E0_N60 E0_N65 E0_N70
-              E5_N35 E5_N40 E5_N45 E5_N50 E5_N55 E5_N60 E5_N65 E5_N70
-              E10_N35 E10_N40 E10_N45 E10_N50 E10_N55 E10_N60 E10_N65 E10_N70
-              E15_N35 E15_N40 E15_N45 E15_N50 E15_N55 E15_N60 E15_N65 E15_N70
-              E20_N35 E20_N40 E20_N45 E20_N50 E20_N55 E20_N60 E20_N65 E20_N70
-              E25_N35 E25_N40 E25_N45 E25_N50 E25_N55 E25_N60 E25_N65
-              E30_N35 E30_N40 E30_N45 E30_N50 E30_N55 E30_N60 E30_N65
-              E35_N40 E35_N45 E35_N50 E35_N55 E35_N60
-              E40_N40 E40_N45 E40_N50 E40_N55
-            "
-            for tile in $EUROPE_TILES; do
-              [ -f "/opt/trails-cool/segments/${tile}.rd5" ] || \
-                wget -q "https://brouter.de/brouter/segments4/${tile}.rd5" -O "/opt/trails-cool/segments/${tile}.rd5" 2>/dev/null || \
-                rm -f "/opt/trails-cool/segments/${tile}.rd5"
-            done
-
-            docker pull ghcr.io/trails-cool/brouter:latest
-            docker compose up -d brouter
-            docker image prune -af
-
-            # Annotate deploy in Grafana
-            GRAFANA_TOKEN=$(grep GRAFANA_SERVICE_TOKEN .env | cut -d= -f2- 2>/dev/null)
+            GRAFANA_TOKEN=$(grep GRAFANA_SERVICE_TOKEN .env | cut -d= -f2-)
            if [ -n "$GRAFANA_TOKEN" ]; then
              docker compose exec -T grafana curl -sf -X POST \
                -H "Authorization: Bearer $GRAFANA_TOKEN" \
--- a/apps/planner/app/lib/brouter.test.ts
+++ b/apps/planner/app/lib/brouter.test.ts
@ -1,5 +1,5 @@
-import { describe, it, expect } from "vitest";
-import { mergeGeoJsonSegments } from "./brouter";
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+import { computeRoute, computeSegmentGpx, mergeGeoJsonSegments } from "./brouter";

 function makeSegment(coords: number[][], length: number, ascend: number) {
  return {
@ -221,6 +221,83 @@ describe("highway tag extraction", () => {
  });
 });

+describe("X-BRouter-Auth header", () => {
+  // Minimal valid response so computeRoute doesn't throw during merge.
+  const stubGeoJson = JSON.stringify({
+    type: "FeatureCollection",
+    features: [
+      {
+        type: "Feature",
+        properties: { "track-length": "100", "filtered ascend": "0", "total-time": "10" },
+        geometry: { type: "LineString", coordinates: [[13.0, 52.0, 30], [13.1, 52.1, 40]] },
+      },
+    ],
+  });
+
+  let fetchSpy: ReturnType<typeof vi.fn>;
+
+  beforeEach(() => {
+    fetchSpy = vi.fn().mockResolvedValue(
+      new Response(stubGeoJson, { status: 200, headers: { "content-type": "application/json" } }),
+    );
+    vi.stubGlobal("fetch", fetchSpy);
+  });
+
+  afterEach(() => {
+    vi.unstubAllEnvs();
+    vi.unstubAllGlobals();
+  });
+
+  it("attaches X-BRouter-Auth when BROUTER_AUTH_TOKEN is set (computeRoute)", async () => {
+    vi.stubEnv("BROUTER_AUTH_TOKEN", "test-token-abc");
+
+    await computeRoute({
+      waypoints: [
+        { lat: 52.0, lon: 13.0 },
+        { lat: 52.1, lon: 13.1 },
+      ],
+    });
+
+    expect(fetchSpy).toHaveBeenCalledTimes(1);
+    const [, init] = fetchSpy.mock.calls[0]!;
+    expect(init?.headers).toMatchObject({ "X-BRouter-Auth": "test-token-abc" });
+  });
+
+  it("omits X-BRouter-Auth when BROUTER_AUTH_TOKEN is unset (dev/test convenience)", async () => {
+    vi.stubEnv("BROUTER_AUTH_TOKEN", "");
+
+    await computeRoute({
+      waypoints: [
+        { lat: 52.0, lon: 13.0 },
+        { lat: 52.1, lon: 13.1 },
+      ],
+    });
+
+    const [, init] = fetchSpy.mock.calls[0]!;
+    expect(init?.headers).not.toHaveProperty("X-BRouter-Auth");
+  });
+
+  it("attaches X-BRouter-Auth on computeSegmentGpx as well", async () => {
+    vi.stubEnv("BROUTER_AUTH_TOKEN", "test-token-xyz");
+    fetchSpy.mockResolvedValueOnce(
+      new Response('<gpx><trk><trkseg><trkpt lat="52" lon="13"/></trkseg></trk></gpx>', {
+        status: 200,
+        headers: { "content-type": "application/gpx+xml" },
+      }),
+    );
+
+    await computeSegmentGpx({
+      waypoints: [
+        { lat: 52.0, lon: 13.0 },
+        { lat: 52.1, lon: 13.1 },
+      ],
+    });
+
+    const [, init] = fetchSpy.mock.calls[0]!;
+    expect(init?.headers).toMatchObject({ "X-BRouter-Auth": "test-token-xyz" });
+  });
+});
+
 describe("waypoint to BRouter segments", () => {
  it("splits N waypoints into N-1 pairs", () => {
    const waypoints = [
--- a/apps/planner/app/lib/brouter.ts
+++ b/apps/planner/app/lib/brouter.ts
@ -1,5 +1,23 @@
 const BROUTER_URL = process.env.BROUTER_URL ?? "http://localhost:17777";

+// The BRouter host's Caddy sidecar requires every request to carry a
+// shared-secret header. Missing in production = every request 403s, so
+// crash loudly at startup rather than during the first route request.
+if (process.env.NODE_ENV === "production" && !process.env.BROUTER_AUTH_TOKEN) {
+  throw new Error(
+    "BROUTER_AUTH_TOKEN is required in production. The BRouter Caddy " +
+      "sidecar rejects unauthenticated requests with 403. Check the " +
+      "SOPS-encrypted infrastructure/secrets.app.env and the cd-apps " +
+      "env wiring.",
+  );
+}
+
+// Read at call time so tests can stub via vi.stubEnv without module reset.
+function authHeaders(): HeadersInit {
+  const token = process.env.BROUTER_AUTH_TOKEN;
+  return token ? { "X-BRouter-Auth": token } : {};
+}
+
 export interface NoGoArea {
  points: Array<{ lat: number; lon: number }>;
 }
@ -77,7 +95,7 @@ export class BRouterError extends Error {
 }

 async function fetchSegment(url: string): Promise<Record<string, unknown>> {
-  const response = await fetch(url);
+  const response = await fetch(url, { headers: authHeaders() });
  if (!response.ok) {
    const body = await response.text();
    throw new BRouterError(body.trim(), response.status);
@ -310,7 +328,9 @@ export async function computeSegmentGpx(request: {
  const nogoParam = request.noGoAreas?.length ? noGoAreasToParam(request.noGoAreas) : undefined;
  if (nogoParam) params.set("polygons", nogoParam);

-  const resp = await fetch(`${BROUTER_URL}/brouter?${params}`);
+  const resp = await fetch(`${BROUTER_URL}/brouter?${params}`, {
+    headers: authHeaders(),
+  });
  if (!resp.ok) {
    const body = await resp.text();
    throw new BRouterError(body.trim(), resp.status);
--- a/docker/brouter/Dockerfile
+++ b/docker/brouter/Dockerfile
@ -34,10 +34,13 @@ RUN for f in /data/profiles/*.brf; do \
 USER app
 EXPOSE 17777

+# JAVA_OPTS can be overridden at runtime (e.g., `-Xmx8g` for planet-scale).
+# The default keeps the flagship's single-instance footprint small.
+ENV JAVA_OPTS="-Xmx1024M -Xms256M -Xmn64M"
+
 # BRouter server: <segmentdir> <profiledir> <customprofiledir> <port> <maxthreads>
-CMD ["java", "-Xmx1024M", "-Xms256M", "-Xmn64M", \
-     "-DmaxRunningTime=300", \
-     "-cp", "brouter.jar", \
-     "btools.server.RouteServer", \
-     "/data/segments", "/data/profiles", "/data/profiles", \
-     "17777", "4"]
+# Shell form so $JAVA_OPTS expands at container start.
+CMD java $JAVA_OPTS -DmaxRunningTime=300 -cp brouter.jar \
+    btools.server.RouteServer \
+    /data/segments /data/profiles /data/profiles \
+    17777 4
--- a/infrastructure/brouter-host/Caddyfile
+++ b/infrastructure/brouter-host/Caddyfile
@ -0,0 +1,47 @@
+# BRouter Caddy sidecar.
+#
+# Role: enforce the X-BRouter-Auth shared-secret header so the exposed
+# vSwitch port can only be used by the Planner, not by any other process
+# that happens to land on the private network.
+#
+# Note on auth hygiene: by default, Caddy's access log does NOT include
+# request headers, so the token value is not written to disk. If you
+# ever enable `log { format json }` with `fields_exclude`, make sure
+# `X-BRouter-Auth` is NOT added to the log's request headers set.
+
+{
+	# Bind admin socket to localhost only (default behavior, explicit here
+	# as defense-in-depth).
+	admin localhost:2019
+	# Don't attempt TLS — we only listen on the private vSwitch and
+	# terminate plain HTTP on :17777. No certs, no Let's Encrypt, no
+	# leakage of this hostname to the ACME CAs.
+	auto_https off
+}
+
+:17777 {
+	# Match requests carrying the correct shared secret.
+	@authed header X-BRouter-Auth {$BROUTER_AUTH_TOKEN}
+
+	handle @authed {
+		reverse_proxy brouter:17777 {
+			# Don't forward the auth header upstream — BRouter doesn't
+			# use it, and it's cleaner to contain the credential at
+			# the proxy boundary.
+			header_up -X-BRouter-Auth
+		}
+	}
+
+	# Everything else: blunt 403.
+	handle {
+		respond "Forbidden" 403
+	}
+
+	# Access log to stdout (structured JSON). Container logs are captured
+	# by Docker's json-file driver and shipped to Loki by the promtail
+	# sidecar. Header values are NOT logged unless explicitly configured.
+	log {
+		output stdout
+		format json
+	}
+}
--- a/infrastructure/brouter-host/README.md
+++ b/infrastructure/brouter-host/README.md
@ -0,0 +1,94 @@
+# BRouter host compose project
+
+Runs on a dedicated Hetzner Robot server (currently `ullrich.is`,
+private IP `10.0.1.10` over vSwitch #80672), owned by the non-root
+`trails` user. Services:
+
+- **brouter** — the BRouter Java server, planet-scale segments, 8 GB
+  JVM heap, no public port.
+- **caddy** — thin sidecar enforcing the `X-BRouter-Auth` shared-secret
+  header. Bound to `10.0.1.10:17777` (vSwitch IP only).
+
+Public ingress is blocked at the host's UFW (port 17777 is only allowed
+on the VLAN interface from `10.0.0.2`, the flagship's vSwitch IP).
+
+## One-time provisioning
+
+Runs as the `trails` user on the dedicated host.
+
+```bash
+# 1. Land the compose project
+cd ~
+git clone https://github.com/trails-cool/trails.git repo
+mkdir -p brouter
+cp -r repo/infrastructure/brouter-host/* brouter/
+cd brouter
+
+# 2. Provide the shared secret (matches BROUTER_AUTH_TOKEN in SOPS)
+#    The CD workflow normally writes this file; for manual bring-up,
+#    do it yourself.
+cat > .env <<'EOF'
+BROUTER_AUTH_TOKEN=<paste value from sops -d infrastructure/secrets.app.env | grep BROUTER_AUTH_TOKEN>
+EOF
+chmod 0600 .env
+
+# 3. Seed segments (multi-hour, ~60–80 GB)
+./download-segments.sh
+
+# 4. Start services
+docker compose pull
+docker compose up -d
+
+# 5. Smoke test from the flagship (over vSwitch)
+#    Should return 200 with the token, 403 without.
+# ssh root@trails.cool 'curl -sSf -H "X-BRouter-Auth: <TOKEN>" http://10.0.1.10:17777/brouter?lonlats=... '
+```
+
+## Subsequent deploys
+
+The `cd-brouter` GitHub Actions workflow handles routine updates:
+it pulls the latest image, rewrites the compose file + Caddyfile from
+the repo, and restarts.
+
+## Segment updates
+
+Segments are refreshed by brouter.de weekly. To pull updates:
+
+```bash
+./download-segments.sh
+docker compose restart brouter
+```
+
+Schedule via cron if you want automatic updates (not wired in this repo
+yet).
+
+## Token rotation
+
+1. Regenerate: `openssl rand -base64 32`.
+2. Update SOPS: `sops infrastructure/secrets.app.env` (writer uses the
+   `sops -d | append | sops -e` pattern via the CD workflow; editing
+   directly works too).
+3. Merge the SOPS change to `main`.
+4. `cd-apps` redeploys the Planner (sends the new token outbound).
+5. `cd-brouter` redeploys Caddy (matches on the new token).
+6. Brief overlap window where Planner sends new token but Caddy still
+   accepts old: both deploys should fire within a minute of each other,
+   so a few 403s are the worst case.
+
+## Rollback
+
+If BRouter is misbehaving and the flagship BRouter is still warm
+(during the 48 h soak window post-cutover), flip `BROUTER_URL` in
+`infrastructure/secrets.app.env` back to `http://brouter:17777` and
+redeploy the Planner. After the soak window, see the change's
+design.md for the longer rollback path.
+
+## Logging
+
+The dedicated host's Docker daemon default logging driver is `loki`
+(the operator's personal Loki). Our compose file explicitly overrides
+each service to `json-file` so logs stay local; a `promtail` sidecar
+(section 6.3 of the relocate change) tails them and ships to
+trails.cool's Loki over the vSwitch. If you disable that sidecar, the
+BRouter logs will NOT flow to trails.cool's Grafana — they'll just
+accumulate locally and eventually rotate.
--- a/infrastructure/brouter-host/docker-compose.yml
+++ b/infrastructure/brouter-host/docker-compose.yml
@ -0,0 +1,78 @@
+# BRouter host compose project — runs on the dedicated Hetzner Robot
+# server `ullrich.is` under the `trails` user. See README.md for first-time
+# provisioning notes.
+#
+# Exposed surface: Caddy listens on 10.0.1.10:17777 (vSwitch IP only).
+# BRouter itself is not published to the host — only reachable via the
+# internal Docker network from the Caddy sidecar.
+#
+# Logging: the host's default logging driver is `loki` (user's personal
+# Loki). Every service here explicitly overrides to `json-file` so logs
+# stay local and are picked up by the promtail sidecar (section 6.3) for
+# shipping to trails.cool's Loki.
+
+services:
+  brouter:
+    image: ghcr.io/trails-cool/brouter:latest
+    container_name: trails-brouter
+    restart: unless-stopped
+    # Planet-scale coverage: segments live on the host and are mounted in.
+    # 8 GB heap for segment cache; -Xms generous because routing is
+    # memory-heavy and we don't benefit from a slow JVM warmup.
+    environment:
+      JAVA_OPTS: "-Xmx8g -Xms512M"
+    volumes:
+      - ./segments:/data/segments:ro
+    networks:
+      - trails-brouter-internal
+    # Scope logs to json-file so we don't leak to the host's default Loki
+    logging:
+      driver: json-file
+      options:
+        max-size: "10m"
+        max-file: "3"
+    labels:
+      trails.cool.service: "brouter"
+    healthcheck:
+      test: ["CMD-SHELL", "wget -q -O- http://localhost:17777/ >/dev/null 2>&1 || exit 1"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 60s
+
+  caddy:
+    image: caddy:2-alpine
+    container_name: trails-brouter-caddy
+    restart: unless-stopped
+    depends_on:
+      brouter:
+        condition: service_healthy
+    # Bind ONLY to the vSwitch IP on the host — the dedicated host's
+    # public IP remains unaffected. UFW further restricts this to traffic
+    # sourced from the flagship's private IP (10.0.0.2).
+    ports:
+      - "10.0.1.10:17777:17777"
+    environment:
+      BROUTER_AUTH_TOKEN: ${BROUTER_AUTH_TOKEN:?BROUTER_AUTH_TOKEN must be set}
+    volumes:
+      - ./Caddyfile:/etc/caddy/Caddyfile:ro
+      - caddy-data:/data
+      - caddy-config:/config
+    networks:
+      - trails-brouter-internal
+    logging:
+      driver: json-file
+      options:
+        max-size: "10m"
+        max-file: "3"
+    labels:
+      trails.cool.service: "brouter-caddy"
+
+volumes:
+  caddy-data:
+  caddy-config:
+
+networks:
+  trails-brouter-internal:
+    driver: bridge
+    # Container-to-container only; no host-level exposure via this net
--- a/infrastructure/brouter-host/download-segments.sh
+++ b/infrastructure/brouter-host/download-segments.sh
@ -0,0 +1,80 @@
+#!/bin/bash
+# Download / refresh BRouter RD5 segments from brouter.de for planet-wide
+# coverage. Idempotent: re-running only fetches files that are new or
+# updated upstream (wget -N uses Last-Modified). First run takes hours
+# and pulls ~60–80 GB; subsequent runs are cheap.
+#
+# Usage:
+#   ./download-segments.sh [dest_dir]
+#   dest_dir defaults to ./segments relative to this script
+#
+# Runs safely as non-root; no privileged operations. Can be cron'd.
+#
+# After a successful run, restart the brouter container so it reloads
+# any updated segments:
+#   docker compose restart brouter
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+DEST_DIR="${1:-$SCRIPT_DIR/segments}"
+BASE_URL="https://brouter.de/brouter/segments4"
+
+mkdir -p "$DEST_DIR"
+
+echo "Listing tiles at $BASE_URL/ ..."
+# Extract RD5 filenames from the Apache-style directory listing.
+# Pattern matches the standard brouter tile naming: W120_N40.rd5 etc.
+tiles=$(curl --fail --silent --show-error --location "$BASE_URL/" \
+  | grep -oE '[WE][0-9]+_[NS][0-9]+\.rd5' \
+  | sort -u)
+
+if [ -z "$tiles" ]; then
+  echo "ERROR: no tiles found at $BASE_URL/ (directory listing empty or blocked)" >&2
+  exit 1
+fi
+
+total=$(printf '%s\n' "$tiles" | wc -l | tr -d ' ')
+echo "Found $total tiles. Destination: $DEST_DIR"
+echo
+
+cd "$DEST_DIR"
+
+i=0
+skipped=0
+failed=0
+while read -r tile; do
+  [ -z "$tile" ] && continue
+  i=$((i + 1))
+  # -N: only fetch if remote is newer than local (Last-Modified)
+  # -q: quiet; we print our own progress
+  if wget --no-verbose --timestamping --tries=3 --timeout=60 "$BASE_URL/$tile" 2>&1 | grep -q 'not retrieving'; then
+    skipped=$((skipped + 1))
+  fi
+  if [ ! -s "$tile" ]; then
+    echo "  [$i/$total] FAILED: $tile"
+    failed=$((failed + 1))
+  fi
+  # Print heartbeat every 25 tiles so hour-long runs don't look hung
+  if [ $((i % 25)) -eq 0 ]; then
+    echo "  [$i/$total] ... $skipped already-current, $failed failed so far"
+  fi
+done <<< "$tiles"
+
+echo
+echo "Done. Totals:"
+echo "  attempted: $i"
+echo "  already current: $skipped"
+echo "  failed: $failed"
+echo
+echo "Destination size:"
+du -sh "$DEST_DIR"
+echo
+echo "Tile count on disk:"
+ls "$DEST_DIR"/*.rd5 2>/dev/null | wc -l
+
+if [ "$failed" -gt 0 ]; then
+  echo
+  echo "WARNING: $failed downloads failed. Re-run the script to retry." >&2
+  exit 2
+fi
--- a/infrastructure/docker-compose.yml
+++ b/infrastructure/docker-compose.yml
@ -54,7 +54,16 @@ services:
    image: ghcr.io/trails-cool/planner:latest
    restart: unless-stopped
    environment:
-      BROUTER_URL: http://brouter:17777
+      # BROUTER_URL overridable via SOPS: during the cutover to the
+      # dedicated BRouter host, flip to `http://10.0.1.10:17777` without
+      # touching this compose file. Default keeps the in-tree BRouter
+      # for the soak window and local dev.
+      BROUTER_URL: ${BROUTER_URL:-http://brouter:17777}
+      # Shared secret the Planner attaches as X-BRouter-Auth on every
+      # BRouter request. The Caddy sidecar on the dedicated BRouter
+      # host enforces this header; for the in-tree flagship BRouter
+      # it's an unused extra header. Set in SOPS secrets.app.env.
+      BROUTER_AUTH_TOKEN: ${BROUTER_AUTH_TOKEN}
      # Ordered failover list for the Overpass proxy. The code defaults
      # to the same pair if unset; declaring it here makes the prod
      # upstream explicit and easy to reshuffle via env when a
--- a/infrastructure/secrets.app.env
+++ b/infrastructure/secrets.app.env
@ -1,24 +1,25 @@
-#ENC[AES256_GCM,data:4AVDH0K+AknlSfn7+uBxY1bQrJaLgu7e4H9a2r0DJTw4cxYMNfDJ4qtcnOAJXQLmf9tdQMQ=,iv:eJ4Cck3LvSi3W58QhZjkmL2+Q+TYYO1w8ucSM9Z2tF0=,tag:OAiQY06xOXDRQqdtTgyVqQ==,type:comment]
-#ENC[AES256_GCM,data:+hScU/d5XG/4YJfrbf7wvQgQxnivPnZiRb43u8WePdmopML3CY0J5A03qpxEJdKYNFcALB/nOd1rMjhjGLexTNjdy+pjPfs+82xlEUU=,iv:azEAINahXBDJeglTu7FSBbd0OvUy5vyiER5aYqDsMfE=,tag:fEwUHGMq5SS5J8NN3auCyw==,type:comment]
-POSTGRES_PASSWORD=ENC[AES256_GCM,data:8GlpWQ8J,iv:P2ZXmY+PIzuRt7IplHIR2Fgqv3v86Js9kadlVLloyv4=,tag:Hnp2UDtrZ6J3zbLO5lydkw==,type:str]
-JWT_SECRET=ENC[AES256_GCM,data:VMN5O225nhWNcjTMXySpGzejCa4Kanat0qN1FjYYGljWkHrgRSOmFEl+lDg=,iv:p+/uFO9tjfuy6dcRkijqvhPDVb9ST90WCSRiFfDJ3aU=,tag:R4dPEwVAe1u9wilvr0e67Q==,type:str]
-SESSION_SECRET=ENC[AES256_GCM,data:sbyyoq+gsVZZbf/YfSAzRN8K1ny+6b4bDoWj5yjJr6qpk7dYoeYKoMGTOek=,iv:Jk81deYxkdyg6MNGMB/DiQRR27cr87CD8K7g70YDzko=,tag:7hAAxEd0DIPZcQ4IgoHrzA==,type:str]
-SMTP_URL=ENC[AES256_GCM,data:o4kgOpqNnbtoAfZMM3+cnk0pHIQ/xfQ7Z2wg003qkx+7aU0JdNW8FXlxPc7QAOHT/jreIirLe9VV6K5tLMA6ICuQeA==,iv:6o06J4DR5IWdNSY9fCBZGRhE6qWnDQR/Dq9HhO4viqA=,tag:gFQs4no1VGTZSzYDfgZeCw==,type:str]
-SMTP_FROM=ENC[AES256_GCM,data:pS4B7UxNc9DIyhveRV0LP3wchAFtCY1TN7NhTK9YsM92,iv:jnz4zEjU++PVC1OOyQTvr4mnDNe1hmx4oqZMLJ/7jcQ=,tag:ifclwnVpmcD8x0SLMK+ZPw==,type:str]
-#ENC[AES256_GCM,data:JBaEnieYaksobMJTGbOYHuzFT1Hx7St/PX6esQUBgtsDCr75VFl0FFRqxdBQwlxhXpGyYKIfAbuECIf0JuMxiild9k/ccVyL6rBTr7TQA6f7P5x9A3SyVb0=,iv:+LT8MMP6bjPcvClofLB36HgIEYhddzJkIaH40cmFNmE=,tag:vQzUpCiA+jID5mWOgZ/c0A==,type:comment]
-SENTRY_AUTH_TOKEN=ENC[AES256_GCM,data:OlNJy9wOTqPxylchz57eFmwk950czwgpQgtYTwjZwBMtDheOGfF/lvqsJiWwxBGNLScKn/f6B8WY2waEBTe+bLEpyPm1RbCS72ov+w+XDJkZoI102zk+/SzeGMT1xsYbYM7o4ClrxsbV1R4/D87mPo2bfd7eBKj1ixy8TaN1zoDM8P+LCsG+KgzA013X964Aybqok0eXlZEU2cWPbHPHUd4+UEhoLPsOUeUWeNkf1QeOjYFYmlThZAQX/sRp0gI=,iv:em12AHHFcCZiUPhV9GX/vLYABb3ydlsRHViRWwqNftw=,tag:9SAqs72gIuPJ5CYZGwcE6Q==,type:str]
-DEPLOY_GHCR_TOKEN=ENC[AES256_GCM,data:cmyUDf24Mt5iS8rRwjpCMPfGBjKDXW4vXQjEqlO1KWNNxO0fW5SFlg==,iv:rhKAgWZ48JGfq2vS6FJ58E9pU41s6zHYe0xo7+YapoM=,tag:LKl86akqu7E32Lp0ScDWYg==,type:str]
-#ENC[AES256_GCM,data:PhxKhxmL30iKEyvTTmmmVZw=,iv:dTLvkB4muDNdBT98EtQdfDnBcpBb7MiBBwDfTkLc2UI=,tag:Qa3jCS4UYHi1kQsXpFwCiw==,type:comment]
-WAHOO_CLIENT_ID=ENC[AES256_GCM,data:RWyd1ocUcIeNk0vIqpb21IAJuIEc6M3g2IC8RmHeOozBpUWppOSB2ItLFg==,iv:CKKy/L9+VZSBEcPoOTEMZa6hWet0qA9kwD+byu2M3WE=,tag:3/qloZMHq3StT0KgtLgxvg==,type:str]
-WAHOO_CLIENT_SECRET=ENC[AES256_GCM,data:1DGPQqjTZVoJmrgXcMav9y3NMe6+FPNvIqSYM1Q6cQDLLkrsGKzFLCYV6w==,iv:aHcjMvQaXln/5R30etnotdV1Yezpdlc2+bqpXT0ab2U=,tag:ZIzvRFecfU9XuetwCPrngQ==,type:str]
-WAHOO_WEBHOOK_TOKEN=ENC[AES256_GCM,data:KQScuqVvDPMyv0rgUC0J225QH3VyL2i3R23PtiC9Ny2ceaD9,iv:jwFRtYLFqlEdbDaJ3WwD+puHMDUpv+8BWPpwnL6iDfQ=,tag:3CxS7Co3p5dfH1JQGpr8FQ==,type:str]
-#ENC[AES256_GCM,data:pVTNdWtliidKyQ==,iv:6SYQ6NTVev9N2vBJpYZ0YI9T7VjNa0s7RBoduapqe7Q=,tag:16aYQ1NHsbNQ+GopI+byQQ==,type:comment]
-DEMO_BOT_ENABLED=ENC[AES256_GCM,data:1DGCKA==,iv:fgN8FofiTbx+BHuPJAuc5NSRqIvltAZXDPhdnqswWhY=,tag:KBcom4hduccHOUtrlNAHwg==,type:str]
-DEMO_BOT_RETENTION_DAYS=ENC[AES256_GCM,data:GI0=,iv:AMuQKcpNba+zmUcsD7WCt20yMmUTHSGTOi8P+uXH3Yw=,tag:efgU1u5PBqUqmG20vVuN3Q==,type:str]
-DEMO_BOT_REGION=ENC[AES256_GCM,data:g0vX0lNXRk/ICLkLOr3U3FwpdUIT0tMxn3uHaxsGLc2Qtw==,iv:Cz2jNRBWUEVe9SGh37ZoLdca76Y15riLJowgf9C0cQE=,tag:nwkF4Xi9XX40M2ldGLWE6A==,type:str]
-sops_age__list_0__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWblo1Rm9rUlFCQkVVRUVR\nSCtPR1kwMlFvRXplNmdxWVVSOEJzUVB3VlZBCk9Hb1FJSCs1R2llMkk4eGVydnlh\nUmJmU0Joa1pneEZSWFJ5L1VZRnNiZ0UKLS0tIG9aaUkzT0o5dERSekM0cjNxOXBM\nRVhnU1prNjFOa0RQdEVsSlB5QnZzMGcKFFPBeSgQozLR2zohwr/lYBRFzeAK8Hzd\nV635q8YQrXBt9ZUSYvy/b7Gse61+ynaqI7ukLfbc/cRNszQFSuMJyg==\n-----END AGE ENCRYPTED FILE-----\n
+#ENC[AES256_GCM,data:ww5Jcy69nczMA0NXM+TRIbOXEbw1ZbQMY1CfAo/tqRQnRzktO1ZqmCDT2vvlzV3Svjm94F4=,iv:FtrBBmW0z6sR+xm5PDjgxeD8mK0EHP9RubYcBti2AZc=,tag:Eui+7Fhb9RktPp+K22Jwew==,type:comment]
+#ENC[AES256_GCM,data:cUKJRRj7teAMAKSQy5tM1YxYar/3+sEnT7V+jP5sosGEVkGMe2O0jZnBYweYcQA9YGFP7UA/j2zdSi89YYFE7KJCO0ix0gxU0klaktQ=,iv:jiL+AK1PUDHU0eDlcj4dcCXjyFEirQF2fbmsGGXWik4=,tag:dCaIVwSFQSKn+BZp4/iy7A==,type:comment]
+POSTGRES_PASSWORD=ENC[AES256_GCM,data:YWW3SMoY,iv:jxW/S7FL3KryelrEQnbxxwPicbPWaG97W3P1wn0o5QE=,tag:tmuFv4KOpCzVHP6QCBv0ng==,type:str]
+JWT_SECRET=ENC[AES256_GCM,data:dGdP9a5CdapDEU+ZitaS+gYZzQiCCQ/RyhZjIfaX8pReSKTI0/rF2oTOgjM=,iv:5xFU3a0yHqgMKkXKHG7NgnegAILri9cKcg9LkK9SGTQ=,tag:6ZqdmdpS6St8TPiPgddJBg==,type:str]
+SESSION_SECRET=ENC[AES256_GCM,data:kpWkrig2A60lTDWTbnb/mLno7nXjDYrrfQbOmdIsgGcAuceGr7ewPxDuXlw=,iv:R/sDKuVNpi99VNMAyPu5U3a4jbpeVG4os/ZEHkhQ6CU=,tag:Mu1+zBDbveBinFaZCRLjww==,type:str]
+SMTP_URL=ENC[AES256_GCM,data:gVzwdw/qtl0hWWqKDbaD+vYIrrjsewv5Mbey4Vrk++P5JhHsedTncH69roz4plW2gtj/8uIF0LFHteylZukiPwmOZw==,iv:NNxuZ1Rve1xWnWGNS93aBxfh6yr2HZSEAPi7W0gpPlU=,tag:9S27tQrw+HanqQh7POrS/A==,type:str]
+SMTP_FROM=ENC[AES256_GCM,data:M5MaspNeJZEBP+9WH0NYkOUDeuKAz2gGiJtpkzDnfm/1,iv:IgWtsRBgCgJ1BI+H43Fr8m7b8MYcm0Fwo9C2ykPfPeI=,tag:MMLyftnl96Izk129qbRCRg==,type:str]
+#ENC[AES256_GCM,data:AEDUN3ufk7nt7F0l3xnudGuy+ElYGH4zEr93OBVHj/1tm5lefB64sUeg0c3xjAITm1cfHsr7Fggxh/e2woNQP0J0n2W7YgeLTdjc8qu1ESBnuZ3p7GLm3zI=,iv:H+PMzxePmimf3PAopAeUoZngRoU6BbAdTtF9BMUTikg=,tag:63CPdCW6AXpJftxon49swQ==,type:comment]
+SENTRY_AUTH_TOKEN=ENC[AES256_GCM,data:E651MuRZXXrcRsVQbGi48mwOjmkE4zVZb1s3SunW256NOKf53yYcklVobMcXJGt6FiBEYNnF7wTjI+gwMLg8zn3lDhywWvP69h6sABLtnBTNtFGqXn0rHGEqdmkrFHNgQYhuWWb+iyiVPus5xgU71OgToN0HQ5UxiIgmW40k1BDpGWuqCS3Zu1q8IKcwzY41jxQNtanLgA1zPHjfPlXJ9i/68G2frFodtUPr5LsViPvOU/at9OKkSRmw8QfYqVw=,iv:I+tqVWDJDTIlLgf5G71Ak6iZrIihbalfdFgOaqNVGkA=,tag:MLzTa7IFQt1q3+cnmB7VPQ==,type:str]
+DEPLOY_GHCR_TOKEN=ENC[AES256_GCM,data:OlLPbBQHGzB+ipathPb7KQMyA5MdCsxsprynwF2L9Ir5k7IwCfIP5A==,iv:1RNyf+9hVB7pfKCTPndQQkBePqrlcdi7LspcchwRQB4=,tag:ZoNGxbw1dMD9tNfJplajMQ==,type:str]
+#ENC[AES256_GCM,data:NjfDxmmf/3w2s59LLb3HfQk=,iv:bLVAiaUmRtvikb72hFuOpbAkFZn0mtpLCxAfm/0h7kQ=,tag:WaF/lErYjMR9RixuR222Ag==,type:comment]
+WAHOO_CLIENT_ID=ENC[AES256_GCM,data:T7f6/m5F2keZEfBuJZeKrFLayNt4GQfkliallqpChJoLme0IP9sklcYR9A==,iv:kve6y3btWq7LP/F3hIB8I+MgM+9FHHl9+FeEhQ63akM=,tag:47KG+IECcrUMsB5X8HGBmQ==,type:str]
+WAHOO_CLIENT_SECRET=ENC[AES256_GCM,data:/1GtQQT5ul+1UuF3S7xlJ9UjfwKB5ZTrQjqc4yhlIjjlQn0/ATJIZ7c1wg==,iv:GXS0CCX+Qw/w6JrYRMsmypQofelXaCvXo97U4QRXO9w=,tag:bDudhCQ8MZdEHTLp4a4xYA==,type:str]
+WAHOO_WEBHOOK_TOKEN=ENC[AES256_GCM,data:ZWQBNbMbQZunmOTWiwV3TRwDz0S3dHQhLpiJ1JAW/bEF0fqv,iv:qTu74NTv/Q5v7dR9uH8Sv8o1ZEWn2Z6Ng/OB4bhZNLY=,tag:ydkDTAMTyXmZhzJF7zkThw==,type:str]
+#ENC[AES256_GCM,data:/cGixQ9DXEkiJQ==,iv:7rwg4wWQm9FKtnbNaRSdUJW04cnQuZrpKjBmH0fbQDU=,tag:0kDnjhX34sldpCJEctgpCA==,type:comment]
+DEMO_BOT_ENABLED=ENC[AES256_GCM,data:3YjbHg==,iv:S1VkE81GnKfArgKrQkUUIF7ByomzLKXQxvz2NfFN3ts=,tag:cjQIqKLq7nJaBdwVMb9oyg==,type:str]
+DEMO_BOT_RETENTION_DAYS=ENC[AES256_GCM,data:TBs=,iv:nSHXlED3C4CXGIPTZcNeB81FEtmLrWRWDuoF7sKXbFg=,tag:UaZ+z+lCcm0HXMMZ3lO9KA==,type:str]
+DEMO_BOT_REGION=ENC[AES256_GCM,data:fo5W9GNkYvCz5vx/OAISKzuXoIh5peNV3C73Z4aFIp+FCQ==,iv:THo3TcutFEdtBamnBxwS0SU3jYOmuAFdeoiOUxSVS4E=,tag:aoNkh4xIOr2dTW7UZeCPeA==,type:str]
+BROUTER_AUTH_TOKEN=ENC[AES256_GCM,data:U+oiuOkJQAO0LHIAlyjemObTL7hZlDS5XYdtFuWZx5ZWZodxVASeHYZAJXw=,iv:tHspZedPIpdPM4G7z/WlwtH/gLszgH/lS8DsKdtaYoc=,tag:BCfL7Qrr7GGQGQPIl+hZyQ==,type:str]
+sops_age__list_0__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqeDhnUTEzNDk5N1ZPSGFZ\nWjhFaEk3ZC9ackk4UTRaTFNuVkFnTmhXdEVZCnhjU0lFdHJ4dVpjSFYveFhFZmZN\neE0rMEZSNjBNU0RSeWloR2pYQmhlL0UKLS0tIGs5ZzVKbzN3WDBUQkZMSjBJQ0tr\nYkdBRHJra3daMVpSY1JIS2E3cHQyaG8Ky0cBnpRibgbX4famAtqxjc1oGvy5DuO9\nzk6zIQhM99XIoF7W/wn3JF6hPNSBOy7Bd7wVPUVVoE/uE0pIB+VSxQ==\n-----END AGE ENCRYPTED FILE-----\n
 sops_age__list_0__map_recipient=age1vukt8py0s2mm47fx6qh6vykckfkdqslf9w68ekytfzvc8xp7e3rqn6p64n
-sops_lastmodified=2026-04-19T08:33:27Z
-sops_mac=ENC[AES256_GCM,data:OIK/gIKLb8lYMiirw3M+dOAcTPFTArBD/70tv/YDhMZH64J/Boe44JaB2YvrUpT1+Vu9vaoG3JvXw/OcpZd2vKYx57tF9/oJwVgqkpIunS3QPtcYENok9WurNrw526VMk61SUsCMdJx8uTOfUuM/aWzm3AbPWirKdGwYfElWhro=,iv:tvJRe/TDOI4ana+VMQl7frX3m8+IycMpqLnWefFWCZc=,tag:BxqPBItK4JHp+AXQspP50Q==,type:str]
+sops_lastmodified=2026-04-23T20:34:10Z
+sops_mac=ENC[AES256_GCM,data:SgAFlc7VNbH1OJ+RaCEo+TF+vtn2arJOqpZYT6fgSdCPBGRnaI9rqN+paSYYgHQgzrTY7E/iGa/Fmtis8mecwdS+zTNlcF+ucuuo06szb8eq06p0fU49EHE7xUoIPBgwbfKVOc4r2T0iKHJ7iuNVa4UwH6tVeSrQh5tEtAuGikI=,iv:ajzxtZhBXcTDVRwb/A1VaSSUjcoCpE4c3w4SYaHSXBs=,tag:KzMKBaA4TRJQWKWSW04DHg==,type:str]
 sops_unencrypted_suffix=_unencrypted
 sops_version=3.9.4
--- a/openspec/changes/relocate-brouter-to-dedicated-host/tasks.md
+++ b/openspec/changes/relocate-brouter-to-dedicated-host/tasks.md
@ -19,33 +19,48 @@

 ## 2. Secrets and config

- [ ] 2.1 Generate a 32-byte random `BROUTER_AUTH_TOKEN`
- [ ] 2.2 Add `BROUTER_AUTH_TOKEN` to `infrastructure/secrets.infra.env` (SOPS) and commit the re-encrypted file
- [ ] 2.3 Add `BROUTER_AUTH_TOKEN` to `infrastructure/secrets.app.env` (SOPS) for the Planner
- [ ] 2.4 Add GitHub Actions secrets: `BROUTER_DEPLOY_HOST`, `BROUTER_DEPLOY_SSH_KEY`
+- [x] 2.1 Generate a 32-byte random `BROUTER_AUTH_TOKEN`
+  - `openssl rand -base64 32`; active token lives only in SOPS and the operator's clipboard history. Rotate by regenerating and re-running 2.3.
+- [ ] ~~2.2 Add `BROUTER_AUTH_TOKEN` to `infrastructure/secrets.infra.env` (SOPS)~~ **obsoleted** — after relocation, `cd-infra` no longer deploys BRouter and therefore doesn't need the token. `cd-brouter` reads it from `secrets.app.env` instead (see 5.1). Single source of truth.
+- [x] 2.3 Add `BROUTER_AUTH_TOKEN` to `infrastructure/secrets.app.env` (SOPS) for the Planner
+  - Token added via `sops -d | append | sops -e`; round-trip decrypt confirms. Committed in this branch.
+- [x] 2.4 Add GitHub Actions secrets: `BROUTER_DEPLOY_HOST`, `BROUTER_DEPLOY_SSH_KEY`, `BROUTER_DEPLOY_SSH_PORT`
+  - Set via `gh secret set` from operator laptop: `BROUTER_DEPLOY_HOST=ullrich.is`, `BROUTER_DEPLOY_SSH_PORT=2232`, `BROUTER_DEPLOY_SSH_KEY` from `~/.ssh/trails-brouter-deploy`.
 - [ ] 2.5 Document the rotation runbook in `docs/deployment.md` (or equivalent)

 ## 3. BRouter host compose project

- [ ] 3.1 Create `infrastructure/brouter-host/docker-compose.yml` with services `brouter` (bound only to the internal Docker network) and `caddy` (published on the vSwitch IP, auth-enforcing)
- [ ] 3.2 Create `infrastructure/brouter-host/Caddyfile` that requires `X-BRouter-Auth` equal to the configured token and forwards matching requests to `brouter:17777`; redact the header from access logs
- [ ] 3.3 Set `JAVA_OPTS=-Xmx8g` (or equivalent BRouter env) on the `brouter` service
- [ ] 3.4 Create `infrastructure/brouter-host/download-segments.sh` that fetches the planet RD5 tile list idempotently into `./segments/`
- [ ] 3.5 Add a README in `infrastructure/brouter-host/` with one-shot provisioning notes (`git clone`, first segment download, first compose up)
+- [x] 3.1 Create `infrastructure/brouter-host/docker-compose.yml` with services `brouter` (bound only to the internal Docker network) and `caddy` (published on the vSwitch IP, auth-enforcing)
+  - Compose has explicit `logging: driver: json-file` on each service to bypass the dedicated host's default `loki` logging driver. Caddy binds to `10.0.1.10:17777`; brouter has no published port.
+- [x] 3.2 Create `infrastructure/brouter-host/Caddyfile` that requires `X-BRouter-Auth` equal to the configured token and forwards matching requests to `brouter:17777`; redact the header from access logs
+  - Header matcher + 403 fallback; `auto_https off` since vSwitch-only. Caddy default access log format does not include request headers, so token is not logged.
+- [x] 3.3 Set `JAVA_OPTS=-Xmx8g` (or equivalent BRouter env) on the `brouter` service
+  - Also patched `docker/brouter/Dockerfile` to honor `JAVA_OPTS` (was hardcoded `-Xmx1024M` in CMD). Default env keeps flagship behavior unchanged.
+- [x] 3.4 Create `infrastructure/brouter-host/download-segments.sh` that fetches the planet RD5 tile list idempotently into `./segments/`
+  - Crawls brouter.de directory listing, uses `wget -N` for Last-Modified-based incremental updates, prints heartbeat every 25 tiles.
+- [x] 3.5 Add a README in `infrastructure/brouter-host/` with one-shot provisioning notes (`git clone`, first segment download, first compose up)
+  - Covers bring-up, segment refresh, token rotation, rollback. Paired with the CD workflow which handles routine updates.

 ## 4. Planner changes

- [ ] 4.1 Add `BROUTER_AUTH_TOKEN` env var to `apps/planner/app/lib/brouter.ts`; send `X-BRouter-Auth` on every fetch
- [ ] 4.2 Fail the Planner startup with a clear error when `NODE_ENV=production` and `BROUTER_AUTH_TOKEN` is unset
- [ ] 4.3 Update `infrastructure/docker-compose.yml` Planner service env to pass `BROUTER_AUTH_TOKEN` through from the SOPS env file
- [ ] 4.4 Add a unit test covering the header-attachment path in `apps/planner/app/lib/brouter.ts`
+- [x] 4.1 Add `BROUTER_AUTH_TOKEN` env var to `apps/planner/app/lib/brouter.ts`; send `X-BRouter-Auth` on every fetch
+  - `authHeaders()` helper reads env at call time (testable); attached to both `computeRoute` and `computeSegmentGpx` fetch sites.
+- [x] 4.2 Fail the Planner startup with a clear error when `NODE_ENV=production` and `BROUTER_AUTH_TOKEN` is unset
+  - Module-level throw at import. Prod container fails fast; dev/test unaffected.
+- [x] 4.3 Update `infrastructure/docker-compose.yml` Planner service env to pass `BROUTER_AUTH_TOKEN` through from the SOPS env file
+  - Also made `BROUTER_URL` overridable so cutover is a single SOPS edit away.
+- [x] 4.4 Add a unit test covering the header-attachment path in `apps/planner/app/lib/brouter.ts`
+  - 3 new tests: token set → header attached, token unset → header omitted, covers both `computeRoute` and `computeSegmentGpx`.

 ## 5. CD workflow

- [ ] 5.1 Rewrite `.github/workflows/cd-brouter.yml` deploy job: SSH as `trails@${{ secrets.BROUTER_DEPLOY_HOST }}`, `cd ~trails/brouter`, `docker compose pull && docker compose up -d`
- [ ] 5.2 Update workflow `paths:` trigger to include `infrastructure/brouter-host/**`
- [ ] 5.3 Move the segment-download logic out of the workflow into the on-host `download-segments.sh`; workflow calls it but tolerates a long-running invocation (or skips on subsequent deploys if segments already present)
- [ ] 5.4 Keep the Grafana annotation step, pointing at the flagship Grafana over its existing path
+- [x] 5.1 Rewrite `.github/workflows/cd-brouter.yml` deploy job: SSH as `trails@${{ secrets.BROUTER_DEPLOY_HOST }}`, `cd ~trails/brouter`, `docker compose pull && docker compose up -d`
+  - SSH on port `BROUTER_DEPLOY_SSH_PORT` (2232), dedicated key `BROUTER_DEPLOY_SSH_KEY`.
+- [x] 5.2 Update workflow `paths:` trigger to include `infrastructure/brouter-host/**`
+- [x] 5.3 Move the segment-download logic out of the workflow into the on-host `download-segments.sh`; workflow calls it but tolerates a long-running invocation (or skips on subsequent deploys if segments already present)
+  - Workflow does NOT call `download-segments.sh` — first-time seed is a manual operator step (per README and task 7.1); routine re-runs are cron-able on the dedicated host.
+- [x] 5.4 Keep the Grafana annotation step, pointing at the flagship Grafana over its existing path
+  - Still uses `DEPLOY_HOST` + `DEPLOY_SSH_KEY` to reach the flagship for the annotation.
 - [ ] 5.5 Remove the `brouter:` service from `infrastructure/docker-compose.yml` on the flagship (deferred to cutover step 7.5)

 ## 6. Observability