From fb9398e29634fb8d98b2128189a6afecc5e04cce Mon Sep 17 00:00:00 2001
From: UniDesk Codex <codex@pikapython.com>
Date: Mon, 6 Jul 2026 17:04:22 +0800
Subject: [PATCH] fix: inject jd01 v03 frpc auth token

---
 deploy/deploy.yaml        | 3 +++
 scripts/gitops-render.mjs | 7 ++++++-
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/deploy/deploy.yaml b/deploy/deploy.yaml
index bf9cee77..d5aaedb4 100644
--- a/deploy/deploy.yaml
+++ b/deploy/deploy.yaml
@@ -330,6 +330,9 @@ lanes:
       server:
         address: 82.156.23.220
         bindPort: 22000
+      auth:
+        secretName: hwlab-v03-frpc-secrets
+        secretKey: token
       proxies:
         - name: hwlab-jd01-v03-cloud-web
           endpointId: frontend
diff --git a/scripts/gitops-render.mjs b/scripts/gitops-render.mjs
index bc5584f5..db1d585e 100644
--- a/scripts/gitops-render.mjs
+++ b/scripts/gitops-render.mjs
@@ -1171,7 +1171,9 @@ function runtimeFrpConfigForProfile(deploy, profile) {
     webRemotePort: proxyPort("frontend", fallbackWebRemotePort),
     edgeRemotePort: proxyPort("api", fallbackEdgeRemotePort),
     webProxyName: proxyValue("frontend", "name", null),
-    edgeProxyName: proxyValue("api", "name", null)
+    edgeProxyName: proxyValue("api", "name", null),
+    authSecretName: typeof frp?.auth?.secretName === "string" && frp.auth.secretName.trim().length > 0 ? frp.auth.secretName.trim() : null,
+    authSecretKey: typeof frp?.auth?.secretKey === "string" && frp.auth.secretKey.trim().length > 0 ? frp.auth.secretKey.trim() : null
   };
 }
 
@@ -4543,9 +4545,11 @@ function nodeFrpcManifest({ profile = "dev", source = null, deploy = null } = {}
     hostNetwork: true,
     dnsPolicy: "ClusterFirstWithHostNet"
   } : {};
+  const authConfigText = frpConfig.authSecretName && frpConfig.authSecretKey ? `auth.token = "{{ .Envs.FRPC_AUTH_TOKEN }}"\n` : "";
   const configText = `serverAddr = "${frpConfig.serverAddr}"
 serverPort = ${frpConfig.serverPort}
 loginFailExit = true
+${authConfigText}
 
 [[proxies]]
 name = "${webProxyName}"
@@ -4599,6 +4603,7 @@ remotePort = ${frpConfig.edgeRemotePort}
                 name: "frpc",
                 image: "fatedier/frpc:v0.68.1",
                 imagePullPolicy: "IfNotPresent",
+                ...(frpConfig.authSecretName && frpConfig.authSecretKey ? { env: [{ name: "FRPC_AUTH_TOKEN", valueFrom: { secretKeyRef: { name: frpConfig.authSecretName, key: frpConfig.authSecretKey } } }] } : {}),
                 args: ["-c", "/etc/frp/frpc.toml"],
                 volumeMounts: [{ name: "config", mountPath: "/etc/frp", readOnly: true }]
               }],