From 07d7af8b56bfde3f1333ccdbd1340bd18e0fb165 Mon Sep 17 00:00:00 2001
From: root <root@v2202607378382480008.hotsrv.de>
Date: Thu, 9 Jul 2026 10:46:51 +0200
Subject: [PATCH] fix: render nc01 frp public exposure

---
 deploy/deploy.yaml        | 17 +++++++++++++++++
 scripts/gitops-render.mjs | 13 ++++++++-----
 2 files changed, 25 insertions(+), 5 deletions(-)

diff --git a/deploy/deploy.yaml b/deploy/deploy.yaml
index 5e75270c..92d02c44 100644
--- a/deploy/deploy.yaml
+++ b/deploy/deploy.yaml
@@ -346,6 +346,23 @@ lanes:
           localHost: hwlab-edge-proxy.hwlab-v03.svc.cluster.local
           localPort: 6667
           remotePort: 22088
+      nodes:
+        NC01:
+          proxies:
+            - name: hwlab-nc01-v03-cloud-web
+              endpointId: frontend
+              type: tcp
+              localServiceId: hwlab-cloud-web
+              localHost: hwlab-cloud-web.hwlab-v03.svc.cluster.local
+              localPort: 8080
+              remotePort: 22082
+            - name: hwlab-nc01-v03-edge-proxy
+              endpointId: api
+              type: tcp
+              localServiceId: hwlab-edge-proxy
+              localHost: hwlab-edge-proxy.hwlab-v03.svc.cluster.local
+              localPort: 6667
+              remotePort: 22083
     artifactCatalog: deploy/artifact-catalog.v03.json
     runtimePath: runtime-v03
     imageTagMode: full
diff --git a/scripts/gitops-render.mjs b/scripts/gitops-render.mjs
index 14be4803..ebf13b4d 100644
--- a/scripts/gitops-render.mjs
+++ b/scripts/gitops-render.mjs
@@ -1148,10 +1148,13 @@ function runtimePrometheusOperatorResourcesEnabled(deploy, profile) {
   return enabled !== false;
 }
 
-function runtimeFrpConfigForProfile(deploy, profile) {
+function runtimeFrpConfigForProfile(deploy, profile, args = {}) {
   const fallbackWebRemotePort = isRuntimeLane(profile) ? defaultPortForRuntimeLane(profile) : profile === "prod" ? 18666 : 17666;
   const fallbackEdgeRemotePort = isRuntimeLane(profile) ? fallbackWebRemotePort + 1 : profile === "prod" ? 18667 : 17667;
-  const frp = isRuntimeLane(profile) ? runtimeLaneConfig(deploy, profile)?.frp : deploy?.frp;
+  const baseFrp = isRuntimeLane(profile) ? runtimeLaneConfig(deploy, profile)?.frp : deploy?.frp;
+  const nodeId = effectiveSecretPlaneNodeId(args);
+  const nodeFrp = nodeId ? baseFrp?.nodes?.[nodeId] : null;
+  const frp = nodeFrp && typeof nodeFrp === "object" && !Array.isArray(nodeFrp) ? { ...baseFrp, ...nodeFrp } : baseFrp;
   const server = frp && typeof frp === "object" && !Array.isArray(frp) ? frp.server : null;
   const proxies = Array.isArray(frp?.proxies) ? frp.proxies : [];
   const proxyByEndpoint = new Map(proxies
@@ -4529,13 +4532,13 @@ function argoApplication(args, profile = "dev") {
   };
 }
 
-function nodeFrpcManifest({ profile = "dev", source = null, deploy = null } = {}) {
+function nodeFrpcManifest({ profile = "dev", source = null, deploy = null, args = {} } = {}) {
   const namespace = namespaceNameForProfile(profile);
   const profileLabel = runtimeLabelForProfile(profile);
   const deploymentName = isRuntimeLane(profile) ? `hwlab-${profile}-frpc` : profile === "prod" ? "hwlab-node-prod-frpc" : "hwlab-node-frpc";
   const configName = `${deploymentName}-config`;
   const proxyPrefix = isRuntimeLane(profile) ? `hwlab-${profile}` : profile === "prod" ? "hwlab-node-prod" : "hwlab-node";
-  const frpConfig = runtimeFrpConfigForProfile(deploy, profile);
+  const frpConfig = runtimeFrpConfigForProfile(deploy, profile, args);
   const webProxyName = frpConfig.webProxyName || `${proxyPrefix}-cloud-web`;
   const edgeProxyName = frpConfig.edgeProxyName || `${proxyPrefix}-edge-proxy`;
   const labels = {
@@ -5990,7 +5993,7 @@ async function plannedFiles(args) {
     if (isRuntimeLane(profile)) putJson(`${runtimePath}/observability.yaml`, observabilityManifest({ deploy, profile, namespace, labels: profileLabels, annotations, metricsSidecarScript }));
     if (isRuntimeLane(profile)) putJson(`${runtimePath}/opencode.yaml`, opencodeServerManifest({ profile, source, deploy, catalog: artifactCatalog, registryPrefix: args.registryPrefix, useDeployImages: args.useDeployImages, sourceBranch: args.sourceBranch, gitReadUrl: args.gitReadUrl, sourceRepo: args.sourceRepo }));
     if (includeDeviceAgent) putJson(`${runtimePath}/device-agent-71-freq.yaml`, deviceAgent71FreqManifest({ profile, source, registryPrefix: args.registryPrefix, catalog: artifactCatalog, useDeployImages: args.useDeployImages }));
-    putJson(`${runtimePath}/node-frpc.yaml`, nodeFrpcManifest({ profile, source, deploy }));
+    putJson(`${runtimePath}/node-frpc.yaml`, nodeFrpcManifest({ profile, source, deploy, args }));
   }
   return { files, source };
 }