version: 1
kind: platform-infra-public-edge

metadata:
  id: public-edge
  owner: platform-infra
  relatedIssues:
    - 2181
    - 2274
    - 2358
    - 2541

defaults:
  targetId: NC01

delivery:
  enabled: true
  authorityId: public-edge-master
  sourceBranch: master
  pipelineId: platform-infra-gitea-nc01
  sourceCommitEnvironment: SOURCE_COMMIT
  transport:
    hostCwd: /root
    secretRef:
      configRef: config/secrets-distribution.yaml
      targetId: public-edge-delivery-nc01
      secretName: public-edge-trans
      targetKey: UNIDESK_SSH_CLIENT_TOKEN
  hostHelper:
    archiveRoot: /root/unidesk/.state/public-edge-delivery
    entrypoint: scripts/native/cicd/apply-platform-infra-public-edge-archive.mjs
    sourcePaths:
      - config
      - scripts
      - package.json
      - bun.lock

targets:
  NC01:
    route: NC01
    publicAddress: 152.53.229.148
    isolation:
      excludedRoutes:
        - PK01
      preservedUdpPorts:
        - 443
    listener:
      httpPort: 80
      httpsPort: 443
      protocols:
        - h1
        - h2
    runtime:
      image: caddy:2.10.2-alpine
      resourceProtection:
        cpuShares: 2048
        memoryReservation: 128m
        memoryLimit: 512m
      containerName: unidesk-public-edge
      workDir: /opt/unidesk/public-edge
      composePath: /opt/unidesk/public-edge/docker-compose.yaml
      caddyfilePath: /opt/unidesk/public-edge/Caddyfile
      dataDir: /var/lib/unidesk/pikaoa-edge/caddy-data
      configDir: /var/lib/unidesk/pikaoa-edge/caddy-config
      statePath: /var/lib/unidesk/public-edge/reconcile-state.json
      lockPath: /run/lock/unidesk-public-edge.lock
      legacy:
        containerName: pikaoa-edge
        composePath: /opt/unidesk/pikaoa-edge/docker-compose.yaml
        caddyfilePath: /opt/unidesk/pikaoa-edge/Caddyfile
      dnsServers:
        - 10.43.0.10
      # 共享入口包含长耗时流式 API，首响应头预算统一按 10 分钟配置。
      responseHeaderTimeoutSeconds: 600
    sites:
      - id: gitea
        configRef: config/platform-infra/gitea.yaml
        path: app.publicExposure
      - id: artifact-registry
        configRef: config/platform-infra/k3s-clusters.yaml
        path: targets.d601.k3s.registryMirror
      - id: pikaoa-development
        configRef: config/pikaoa.yaml
        path: developmentRuntime.targets.NC01
      - id: pikaoa-production
        configRef: config/pikaoa.yaml
        path: releaseRuntime.targets.NC01
      - id: vpn-subscription
        configRef: config/platform-infra/vpn-subscription.yaml
        path: targets.NC01.publicExposure
      - id: hwlab-development
        configRef: config/hwlab-node-control-plane.yaml
        path: publicExposures.NC01.v03
      - id: hwlab-tasktree-native
        configRef: config/hwlab-node-lanes.yaml
        path: lanes.v03.targets.NC01.nativeDevelopment.tasktree.publicExposure
      - id: hwlab-workbench-native
        configRef: config/hwlab-node-lanes.yaml
        path: lanes.v03.targets.NC01.nativeDevelopment.workbench.publicExposure
      - id: hwlab-hwpod-native
        configRef: config/hwlab-node-lanes.yaml
        path: lanes.v03.targets.NC01.nativeDevelopment.hwpod.publicExposure
      - id: agentrun-native
        configRef: config/agentrun.yaml
        path: nativeDevelopment.manager.publicExposure
      - id: hwlab-caserun-native
        configRef: config/hwlab-node-lanes.yaml
        path: lanes.v03.targets.NC01.nativeDevelopment.caserun.publicExposure
      - id: hwlab-production
        configRef: config/hwlab-node-control-plane.yaml
        path: publicExposures.NC01.production
      - id: hwpod-home
        configRef: config/platform-infra/hwpod-home.yaml
        path: targets[id=NC01].publicExposures.apex
      - id: hwpod-home-www
        configRef: config/platform-infra/hwpod-home.yaml
        path: targets[id=NC01].publicExposures.www
      - id: unidesk
        configRef: config/frontend.yaml
        path: publicExposure
      - id: provider-apps
        configRef: config/platform-infra/apps.yaml
        path: publicExposure
      - id: provider-install
        configRef: config/platform-infra/apps.yaml
        path: install.publicExposures.requested
      - id: provider-install-reachable
        configRef: config/platform-infra/apps.yaml
        path: install.publicExposures.reachable
      - id: webterm
        configRef: config/platform-infra/webterm.yaml
        path: targets[id=local-7683].publicExposure
      - id: webterm-7682
        configRef: config/platform-infra/webterm.yaml
        path: targets[id=local-7682].publicExposure
      - id: apistate
        configRef: config/platform-infra/sub2rank.yaml
        path: targets[id=NC01].publicEdge
      - id: sub2api-nc01
        configRef: config/platform-infra/sub2api.yaml
        path: targets[id=NC01].publicEdge
      - id: selfmedia-development
        configRef: config/selfmedia.yaml
        path: delivery.targets.NC01.deployment.publicExposure.edge
      - id: selfmedia-production
        configRef: config/selfmedia.yaml
        path: delivery.targets.NC01_PRODUCTION.deployment.publicExposure.edge
      - id: temporal
        configRef: config/platform-infra/temporal.yaml
        path: publicExposure
      - id: findjob
        configRef: config/platform-infra/findjob.yaml
        path: publicExposure
      - id: superapi-local
        configRef: /root/superapi/config/superapi.yaml
        path: publicExposure
        sourceCommit: 04caa95a3fd984f81ce9144948b1cc879df04f68
      - id: superapi-development
        configRef: /root/superapi/config/superapi.yaml
        path: deployment.targets.l2.publicExposure
        sourceCommit: ed9dada3ebe61a4d1d376b3e8d8a52f419b83366
      - id: superapi-production
        configRef: /root/superapi/config/superapi.yaml
        path: deployment.targets.l3.publicExposure
        sourceCommit: ed9dada3ebe61a4d1d376b3e8d8a52f419b83366
