pikasTech-HWLAB/deploy/frp/README.md

FRP DEV Contract

The DEV reverse link is D601 to master edge through frp.

• Public API/edge endpoint: http://74.48.78.17:16667
• Public browser endpoint: http://74.48.78.17:16666
• hwlab-cloud-web owns the public browser entry on port 16666.
• hwlab-edge-proxy owns public API/health ingress on port 16667.
• frps.dev.toml reserves D601 16666 / 16667, G14 DEV 17666 / 17667, and G14 PROD 18666 / 18667 as TCP remotePort values; do not also bind them as vhostHTTPPort, because that collides with the DEV TCP proxy.
• deploy/deploy.yaml is the source for the public endpoints and FRP proxy mapping. Run node scripts/deploy-contract-plan.mjs --check to detect drift such as public 6666/6667 reuse before any future apply command.
• No secret values are stored in this repository. Operators must provide auth material out of band before a real deployment.
• UniDesk backend, provider-gateway, and microservice proxy are not HWLAB runtime substitutes.

G14 public preview

G14 uses separate preview port ranges and must not reuse D601's 16666 / 16667:

• G14 DEV browser endpoint: http://74.48.78.17:17666
• G14 DEV API/edge endpoint: http://74.48.78.17:17667
• G14 DEV frpc proxy names: hwlab-g14-cloud-web and hwlab-g14-edge-proxy
• G14 DEV k3s Deployment: hwlab-dev/hwlab-g14-frpc, generated by scripts/g14-gitops-render.mjs
• G14 PROD browser endpoint: http://74.48.78.17:18666
• G14 PROD API/edge endpoint: http://74.48.78.17:18667
• G14 PROD frpc proxy names: hwlab-g14-prod-cloud-web and hwlab-g14-prod-edge-proxy
• G14 PROD k3s Deployment: hwlab-prod/hwlab-g14-prod-frpc, generated by scripts/g14-gitops-render.mjs
• Master frps allow-list template: deploy/frp/frps.dev.toml
• G14 DEV frpc local template: deploy/frp/frpc.g14.toml
• G14 PROD frpc local template: deploy/frp/frpc.g14-prod.toml

Only hwlab-cloud-web:8080 and hwlab-edge-proxy:6667 are exposed through FRP. Internal services, Tekton, Argo CD, registry, and database stay ClusterIP-only. The master-side /opt/hwlab-frp/frps.dev.toml and active /etc/frp/frps.toml may need a manual allow-list update matching deploy/frp/frps.dev.toml before the G14 frpc Deployments can register 17666 / 17667 and 18666 / 18667; this is an edge operation, not a D601 client change.