e703843b9b
- poi-extract.sh: PBF download -> osmium tags-filter -> centroid NDJSON + manifest, published via the Caddy sidecar at vSwitch-only /poi/* - osmium-filters.txt + poi-selectors.sql generated from map-core selectors, guarded by sync tests so poiCategories stays the single source of truth - poi-import.sh: checksum verify -> classify into category rows -> 70% guard (--bootstrap override) -> atomic rename swap; node_exporter textfile metric for import outcome - systemd service+timer units for both halves (monthly, offset) - cd-infra.yml: ship infrastructure/scripts to the flagship - e2e: mock /api/pois instead of /api/overpass Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
59 lines
1.8 KiB
Caddyfile
59 lines
1.8 KiB
Caddyfile
# BRouter Caddy sidecar.
|
|
#
|
|
# Role: enforce the X-BRouter-Auth shared-secret header so the exposed
|
|
# vSwitch port can only be used by the Planner, not by any other process
|
|
# that happens to land on the private network.
|
|
#
|
|
# Note on auth hygiene: by default, Caddy's access log does NOT include
|
|
# request headers, so the token value is not written to disk. If you
|
|
# ever enable `log { format json }` with `fields_exclude`, make sure
|
|
# `X-BRouter-Auth` is NOT added to the log's request headers set.
|
|
{
|
|
# Bind admin socket to localhost only (default behavior, explicit here
|
|
# as defense-in-depth).
|
|
admin localhost:2019
|
|
# Don't attempt TLS — we only listen on the private vSwitch and
|
|
# terminate plain HTTP on :17777. No certs, no Let's Encrypt, no
|
|
# leakage of this hostname to the ACME CAs.
|
|
auto_https off
|
|
}
|
|
|
|
:17777 {
|
|
# Match requests carrying the correct shared secret.
|
|
@authed header X-BRouter-Auth {$BROUTER_AUTH_TOKEN}
|
|
|
|
handle @authed {
|
|
# POI index artifact + manifest published by poi-extract.sh. Served
|
|
# read-only from the mounted publish dir; the flagship import job
|
|
# pulls /poi/manifest.json and /poi/pois.ndjson.gz over the vSwitch.
|
|
# Same auth + vSwitch-only binding as BRouter, so it's unreachable
|
|
# from the public internet.
|
|
handle_path /poi/* {
|
|
root * /srv/poi
|
|
file_server
|
|
}
|
|
|
|
handle {
|
|
reverse_proxy brouter:17777 {
|
|
# Don't forward the auth header upstream — BRouter doesn't
|
|
# use it, and it's cleaner to contain the credential at
|
|
# the proxy boundary.
|
|
header_up -X-BRouter-Auth
|
|
}
|
|
}
|
|
}
|
|
|
|
# Everything else: blunt 403.
|
|
handle {
|
|
respond "Forbidden" 403
|
|
}
|
|
|
|
# Access log to stdout (structured JSON). Container logs are captured
|
|
# by Docker's json-file driver and shipped to Loki by the promtail
|
|
# sidecar. Header values are NOT logged unless explicitly configured.
|
|
log {
|
|
output stdout
|
|
format json
|
|
}
|
|
}
|