fix(deploy): add optional Turnstile and customer mTLS proxy

compose/e.yml

@@ -62,6 +62,7 @@ services:
       - e-data:/data
       - e-plugin-data:/data/plugins
       - ${OVERCOOKED_ROOT:-/opt/overcooked}/config/e-server.production.yaml:/etc/overcooked-e/config.yaml:ro
+      - ${OVERCOOKED_ROOT:-/opt/overcooked}/control-plane:/run/overcooked-control-plane:ro
     environment:
       PRODUCT_E_CONFIG: /etc/overcooked-e/config.yaml
       PRODUCT_E_ENVIRONMENT: production
@@ -72,6 +73,9 @@ services:
       PRODUCT_E_CONTROL_PLANE_URL: ${PRODUCT_E_CONTROL_PLANE_URL:?required}
       PRODUCT_E_CONTROL_PLANE_KEY_ID: ${PRODUCT_E_CONTROL_PLANE_KEY_ID:?required}
       PRODUCT_E_CONTROL_PLANE_SHARED_SECRET: ${PRODUCT_E_CONTROL_PLANE_SHARED_SECRET:?required}
+      PRODUCT_E_CONTROL_PLANE_TLS_CERT_FILE: ${PRODUCT_E_CONTROL_PLANE_TLS_CERT_FILE:?required}
+      PRODUCT_E_CONTROL_PLANE_TLS_KEY_FILE: ${PRODUCT_E_CONTROL_PLANE_TLS_KEY_FILE:?required}
+      PRODUCT_E_CONTROL_PLANE_TLS_CA_FILE: ${PRODUCT_E_CONTROL_PLANE_TLS_CA_FILE:?required}
       PRODUCT_E_LICENSE_ENABLED: ${PRODUCT_E_LICENSE_ENABLED:-true}
       PRODUCT_E_AUTH_URL: ${PRODUCT_E_AUTH_URL:?required}
       PRODUCT_E_AUTH_ALLOW_INSECURE_HTTP: ${PRODUCT_E_AUTH_ALLOW_INSECURE_HTTP:-false}
@@ -123,4 +127,3 @@ volumes:
   e-data:
   e-plugin-data:
   e-backup-staging:
-

compose/s.yml

@@ -102,8 +102,8 @@ services:
       S_VERSION: ${S_VERSION:-customer}
       S_BACKUP_DIRECTORY: /var/lib/overcooked-s/backups
       S_UPDATE_DIRECTORY: /var/lib/overcooked-s/updates
-      S_TURNSTILE_SITE_KEY: ${S_TURNSTILE_SITE_KEY:?required}
-      S_TURNSTILE_SECRET_KEY: ${S_TURNSTILE_SECRET_KEY:?required}
+      S_TURNSTILE_SITE_KEY: ${S_TURNSTILE_SITE_KEY:-}
+      S_TURNSTILE_SECRET_KEY: ${S_TURNSTILE_SECRET_KEY:-}
       S_TURNSTILE_HOSTNAME: ${S_TURNSTILE_HOSTNAME:-}
       S_TELEGRAM_MTPROTO_URL: ${S_TELEGRAM_MTPROTO_URL:-http://telegram-disabled.invalid:8098}
       S_PORTAL_LOCATION: ${S_PORTAL_LOCATION:-Private Node}
@@ -112,7 +112,7 @@ services:
       S_PORTAL_ANNOUNCEMENT: ${S_PORTAL_ANNOUNCEMENT:-}
       S_STORAGE_WEBHOOK_SECRET: ${S_STORAGE_WEBHOOK_SECRET:-}
       S_NODE_IMAGE_ARCHIVE: /var/lib/overcooked-s/node-images/media-node.tar.gz
-      S_NODE_IMAGE_NAME: ${S_NODE_IMAGE_NAME:-overcooked-media-node:latest}
+      S_NODE_IMAGE_NAME: ${S_NODE_IMAGE_NAME:-git.leee.xin/overcooked/overcooked-media-node:latest}
       S_NODE_CONTROLLER_HOST: ${S_NODE_CONTROLLER_HOST:-}
     volumes:
       - s-backups:/var/lib/overcooked-s/backups
@@ -133,6 +133,36 @@ services:
     logging: *logging
     mem_limit: 384m
 
+  control-proxy:
+    image: ${S_WEBUI_IMAGE:?required}
+    restart: unless-stopped
+    init: true
+    depends_on:
+      s-control: {condition: service_healthy}
+    command: ["node", "/run/overcooked-control-plane/control-proxy.mjs"]
+    volumes:
+      - ${OVERCOOKED_ROOT:-/opt/overcooked}/control-plane:/run/overcooked-control-plane:ro
+    healthcheck:
+      test:
+        - CMD
+        - node
+        - -e
+        - |
+          const fs = require("node:fs");
+          const https = require("node:https");
+          const request = https.get("https://control-proxy:8443/health/live", {ca: fs.readFileSync("/run/overcooked-control-plane/ca.crt"), cert: fs.readFileSync("/run/overcooked-control-plane/client.crt"), key: fs.readFileSync("/run/overcooked-control-plane/client.key"), servername: "control-proxy", rejectUnauthorized: true}, (response) => { response.resume(); process.exit(response.statusCode === 200 ? 0 : 1); });
+          request.setTimeout(2000, () => { request.destroy(); process.exit(1); });
+          request.on("error", () => process.exit(1));
+      interval: 10s
+      timeout: 3s
+      start_period: 10s
+      retries: 6
+    networks: [control-plane]
+    security_opt: [no-new-privileges:true]
+    cap_drop: [ALL]
+    logging: *logging
+    mem_limit: 128m
+
   webui:
     image: ${S_WEBUI_IMAGE:?required}
     restart: unless-stopped