# FRP DEV Contract

The DEV reverse link is D601 to master edge through frp.

- Public API/edge endpoint: `http://74.48.78.17:16667`
- Public browser endpoint: `http://74.48.78.17:16666`
- `hwlab-cloud-web` owns the public browser entry on port `16666`.
- `hwlab-edge-proxy` owns public API/health ingress on port `16667`.
- `frps.dev.toml` reserves D601 `16666` / `16667`, G14 DEV `17666` / `17667`, and G14 PROD `18666` / `18667`
  as TCP `remotePort` values; do not also bind them as `vhostHTTPPort`, because that collides with
  the DEV TCP proxy.
- `deploy/deploy.json` is the source for the public endpoints and FRP proxy
  mapping. Run `node scripts/deploy-contract-plan.mjs --check` to detect drift
  such as public `6666`/`6667` reuse before any future apply command.
- No secret values are stored in this repository. Operators must provide auth
  material out of band before a real deployment.
- UniDesk backend, provider-gateway, and microservice proxy are not HWLAB runtime
  substitutes.

## G14 public preview

G14 uses separate preview port ranges and must not reuse D601's `16666` / `16667`:

- G14 DEV browser endpoint: `http://74.48.78.17:17666`
- G14 DEV API/edge endpoint: `http://74.48.78.17:17667`
- G14 DEV frpc proxy names: `hwlab-g14-cloud-web` and `hwlab-g14-edge-proxy`
- G14 DEV k3s Deployment: `hwlab-dev/hwlab-g14-frpc`, generated by `scripts/g14-gitops-render.mjs`
- G14 PROD browser endpoint: `http://74.48.78.17:18666`
- G14 PROD API/edge endpoint: `http://74.48.78.17:18667`
- G14 PROD frpc proxy names: `hwlab-g14-prod-cloud-web` and `hwlab-g14-prod-edge-proxy`
- G14 PROD k3s Deployment: `hwlab-prod/hwlab-g14-prod-frpc`, generated by `scripts/g14-gitops-render.mjs`
- Master frps allow-list template: `deploy/frp/frps.dev.toml`
- G14 DEV frpc local template: `deploy/frp/frpc.g14.toml`
- G14 PROD frpc local template: `deploy/frp/frpc.g14-prod.toml`

Only `hwlab-cloud-web:8080` and `hwlab-edge-proxy:6667` are exposed through FRP.
Internal services, Tekton, Argo CD, registry, and database stay ClusterIP-only.
The master-side `/opt/hwlab-frp/frps.dev.toml` and active `/etc/frp/frps.toml` may need a manual allow-list update matching `deploy/frp/frps.dev.toml` before
the G14 frpc Deployments can register `17666` / `17667` and `18666` / `18667`; this is an edge operation, not a D601
client change.