dandri/ukmesh
1
0
Fork 0
mirror of https://github.com/gadgethd/ukmesh.git synced 2026-09-09 16:45:33 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
12da1689e4c01090efb39bbb38fe7d6e6eea694e
ukmesh/docker-compose.yml
T
BenandClaude Sonnet 4.6 edc8206a22 Add ML path learner, Anubis bot protection, planned coverage, companion page, and misc improvements 
- ml-path-learner: new Python worker that trains a prefix→node ML model from gold paths and writes scores to ml_path_prefix_scores
- lazyResolver: integrate ML scores and edge priors into tiered candidate ranking; bidirectional pass-2 propagation; global cross-group direct anchors
- Anubis: add sidecar bot-protection containers for all public HTTP services; botPolicy.yaml
- Planned coverage: new API route + frontend map layers for placing hypothetical repeaters and computing coverage
- Map: light/dark theme toggle; map-tools button group (LOS, Repeater, theme); plan-repeater mode with click-to-place/remove and polling
- Frontend: remove inferred nodes from map display (backend inference kept for internal use)
- Stats page: observer region summary, channel traffic, companion activity endpoints and UI
- UKCompanionPage: new companion activity page
- Teesside site: extracted into standalone build context (teesside-site/)
- healthcheck overrides: share.html, sw.js, region filter support, SVG score ring updates
- DB: dedicated analytics pool; DATABASE_SKIP_SCHEMA_INIT flag; path hash prefix indexes; lateral join fixes for node_link_radio_reports
- docker-compose: ml-path-learner service; anubis sidecars; DATABASE_SKIP_SCHEMA_INIT on all workers; OBSERVER_RETENTION_SECONDS; REGIONS_FILE
- backend-site: internal operator dashboard routes
- docker/mesh-health-check-entrypoint.sh: extract channel secret from MESHCORE_CHANNEL_SECRETS at startup
- scripts: observer key generation, observer registration, healthcheck tunnel check
- vacuum-compressed-chunks.sh: maintenance script

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-03 01:33:48 +00:00

511 lines
17 KiB
YAML
Raw Blame History

x-anubis-base: &anubis-base
image: ghcr.io/techarohq/anubis:v1.25.0
restart: unless-stopped
volumes:
- ./anubis/botPolicy.yaml:/data/botPolicy.yaml:ro
services:
timescaledb:
image: timescale/timescaledb:latest-pg16
restart: unless-stopped
command: ["postgres", "-c", "max_connections=300"]
environment:
POSTGRES_DB: ${POSTGRES_DB:-meshcore}
POSTGRES_USER: ${POSTGRES_USER:-meshcore}
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?POSTGRES_PASSWORD required}
volumes:
- timescaledb_data:/var/lib/postgresql/data
- ./backend/src/db/schema/base.sql:/docker-entrypoint-initdb.d/001_schema.sql:ro
healthcheck:
test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-meshcore} -d ${POSTGRES_DB:-meshcore}"]
interval: 10s
timeout: 5s
retries: 10
start_period: 30s
mosquitto:
image: eclipse-mosquitto:2
restart: unless-stopped
volumes:
- ./mosquitto:/mosquitto/config
- mosquitto_data:/mosquitto/data
- mosquitto_log:/mosquitto/log
redis:
image: redis:7-alpine
restart: unless-stopped
volumes:
- redis_data:/data
healthcheck:
test: ["CMD", "redis-cli", "ping"]
interval: 10s
timeout: 5s
retries: 5
backend:
build:
context: .
dockerfile: Dockerfile.backend
restart: unless-stopped
environment:
DATABASE_URL: postgresql://${POSTGRES_USER:-meshcore}:${POSTGRES_PASSWORD}@timescaledb:5432/${POSTGRES_DB:-meshcore}
MQTT_BROKER_URL: ${MQTT_BROKER_URL:-ws://mosquitto:9001}
MQTT_USERNAME: ${MQTT_USERNAME:-backend}
MQTT_PASSWORD: ${MQTT_PASSWORD}
REDIS_URL: ${REDIS_URL:-redis://redis:6379}
JWT_SECRET: ${JWT_SECRET:?JWT_SECRET required}
OPENTOPODATA_API: ${OPENTOPODATA_API:-https://api.opentopodata.org}
PORT: ${PORT:-3000}
MESHCORE_CHANNEL_SECRETS: ${MESHCORE_CHANNEL_SECRETS:-}
OWNER_DATABASE_URL: ${OWNER_DATABASE_URL:-postgresql://${POSTGRES_USER:-meshcore}:${POSTGRES_PASSWORD}@timescaledb:5432/${OWNER_POSTGRES_DB:-meshcore_owner_auth}}
OWNER_MQTT_USERNAME_MAP: ${OWNER_MQTT_USERNAME_MAP:-}
OWNER_COOKIE_SECRET: ${OWNER_COOKIE_SECRET:-}
ALLOWED_ORIGINS: ${ALLOWED_ORIGINS:-http://localhost:3001,http://localhost:3002,https://ukmesh.com,https://www.ukmesh.com,https://app.ukmesh.com,https://teessidemesh.com,https://www.teessidemesh.com,https://app.teessidemesh.com,https://test.ukmesh.com}
RADIO_BOT_URL: ${RADIO_BOT_URL:-}
COVERAGE_MODEL_VERSION: ${COVERAGE_MODEL_VERSION:-5}
DATABASE_STATEMENT_TIMEOUT_MS: 300000
DATABASE_POOL_MAX: ${DATABASE_POOL_MAX:-20}
DATABASE_SKIP_SCHEMA_INIT: "true"
WS_INITIAL_STATE_ENABLED: "1"
NODE_ENV: production
depends_on:
timescaledb:
condition: service_healthy
redis:
condition: service_healthy
mosquitto:
condition: service_started
ports:
- "3000:3000"
volumes:
- mosquitto_log:/mosquitto/log:ro
- ./mosquitto:/mosquitto/config
- /var/run/docker.sock:/var/run/docker.sock
acl-watcher:
build:
context: .
dockerfile: Dockerfile.backend
restart: unless-stopped
command: ["node", "dist/workers/acl-watcher.js"]
environment:
MOSQUITTO_ACL_PATH: /mosquitto/config/acl
MOSQUITTO_CONTAINER_NAME: mosquitto
NODE_ENV: production
depends_on:
- mosquitto
volumes:
- ./mosquitto:/mosquitto/config
- /var/run/docker.sock:/var/run/docker.sock
path-learning-worker:
build:
context: .
dockerfile: Dockerfile.backend
restart: unless-stopped
command: ["node", "dist/workers/path-learning.js"]
environment:
DATABASE_URL: postgresql://${POSTGRES_USER:-meshcore}:${POSTGRES_PASSWORD}@timescaledb:5432/${POSTGRES_DB:-meshcore}
REDIS_URL: ${REDIS_URL:-redis://redis:6379}
JWT_SECRET: ${JWT_SECRET:?JWT_SECRET required}
DATABASE_STATEMENT_TIMEOUT_MS: 300000
DATABASE_SKIP_SCHEMA_INIT: "true"
NODE_ENV: production
depends_on:
timescaledb:
condition: service_healthy
redis:
condition: service_healthy
path-history-worker:
build:
context: .
dockerfile: Dockerfile.backend
restart: unless-stopped
command: ["node", "dist/workers/path-history.js"]
environment:
DATABASE_URL: postgresql://${POSTGRES_USER:-meshcore}:${POSTGRES_PASSWORD}@timescaledb:5432/${POSTGRES_DB:-meshcore}
REDIS_URL: ${REDIS_URL:-redis://redis:6379}
JWT_SECRET: ${JWT_SECRET:?JWT_SECRET required}
DATABASE_STATEMENT_TIMEOUT_MS: 300000
DATABASE_SKIP_SCHEMA_INIT: "true"
NODE_ENV: production
depends_on:
timescaledb:
condition: service_healthy
redis:
condition: service_healthy
health-worker:
build:
context: .
dockerfile: Dockerfile.backend
restart: unless-stopped
command: ["node", "dist/workers/health.js"]
environment:
DATABASE_URL: postgresql://${POSTGRES_USER:-meshcore}:${POSTGRES_PASSWORD}@timescaledb:5432/${POSTGRES_DB:-meshcore}
REDIS_URL: ${REDIS_URL:-redis://redis:6379}
JWT_SECRET: ${JWT_SECRET:?JWT_SECRET required}
DATABASE_STATEMENT_TIMEOUT_MS: 300000
DATABASE_SKIP_SCHEMA_INIT: "true"
NODE_ENV: production
depends_on:
timescaledb:
condition: service_healthy
redis:
condition: service_healthy
link-backfill-worker:
build:
context: .
dockerfile: Dockerfile.backend
restart: "no"
command: ["node", "dist/workers/link-backfill.js"]
environment:
DATABASE_URL: postgresql://${POSTGRES_USER:-meshcore}:${POSTGRES_PASSWORD}@timescaledb:5432/${POSTGRES_DB:-meshcore}
MQTT_BROKER_URL: ${MQTT_BROKER_URL:-ws://mosquitto:9001}
REDIS_URL: ${REDIS_URL:-redis://redis:6379}
MESHCORE_CHANNEL_SECRETS: ${MESHCORE_CHANNEL_SECRETS:-}
DATABASE_SKIP_SCHEMA_INIT: "true"
NODE_ENV: production
depends_on:
timescaledb:
condition: service_healthy
redis:
condition: service_healthy
backend:
condition: service_started
viewshed-worker:
build:
context: ./viewshed-worker
dockerfile: Dockerfile
restart: unless-stopped
environment:
DATABASE_URL: postgresql://${POSTGRES_USER:-meshcore}:${POSTGRES_PASSWORD}@timescaledb:5432/${POSTGRES_DB:-meshcore}
REDIS_URL: ${REDIS_URL:-redis://redis:6379}
SRTM_DIR: /data/srtm
WORKER_MODE: viewshed
NUM_WORKERS: '1'
COVERAGE_MODEL: ${COVERAGE_MODEL:-rf_radial_100m}
COVERAGE_MODEL_VERSION: ${COVERAGE_MODEL_VERSION:-5}
volumes:
- srtm_data:/data/srtm
deploy:
resources:
limits:
cpus: '1.5'
memory: '5g'
depends_on:
timescaledb:
condition: service_healthy
redis:
condition: service_healthy
link-worker:
build:
context: ./viewshed-worker
dockerfile: Dockerfile
restart: unless-stopped
cpus: 2.0
environment:
DATABASE_URL: postgresql://${POSTGRES_USER:-meshcore}:${POSTGRES_PASSWORD}@timescaledb:5432/${POSTGRES_DB:-meshcore}
REDIS_URL: ${REDIS_URL:-redis://redis:6379}
RADIO_BOT_URL: ${RADIO_BOT_URL:-http://meshcore-radio-bot:3011}
SRTM_DIR: /data/srtm
WORKER_MODE: link
NUM_WORKERS: '1'
volumes:
- srtm_data:/data/srtm
depends_on:
timescaledb:
condition: service_healthy
redis:
condition: service_healthy
ml-path-learner:
build:
context: ./ml-path-learner
dockerfile: Dockerfile
restart: unless-stopped
cpus: 2.0
mem_limit: '2g'
environment:
DATABASE_URL: postgresql://${POSTGRES_USER:-meshcore}:${POSTGRES_PASSWORD}@timescaledb:5432/${POSTGRES_DB:-meshcore}
GOLD_EXTRACTION_INTERVAL_MINS: '15'
TRAINING_INTERVAL_MINS: '30'
MIN_GOLD_PATHS: '100'
CONFIDENCE_THRESHOLD: '0.85'
depends_on:
timescaledb:
condition: service_healthy
website-teesside:
build:
context: ./teesside-site
dockerfile: Dockerfile
restart: unless-stopped
ports:
- "3002:80"
depends_on:
- backend
app-ukmesh:
build:
context: .
dockerfile: Dockerfile.app
args:
VITE_APP_HOSTNAME: app.ukmesh.com
VITE_NETWORK: ukmesh
VITE_SITE: ukmesh
restart: unless-stopped
depends_on:
- backend
ports:
- "3003:80"
volumes:
- ${TERRAIN_TILES_PATH:-./terrain-tiles}:/terrain-tiles:ro
website-ukmesh:
build:
context: .
dockerfile: Dockerfile.website
args:
VITE_APP_HOSTNAME: app.ukmesh.com
VITE_SITE: ukmesh
restart: unless-stopped
ports:
- "3004:80"
depends_on:
- backend
mesh-health-check:
build:
context: .
dockerfile: Dockerfile.mesh-health-check
args:
MESH_HEALTH_CHECK_REF: ${HEALTHCHECK_SOURCE_REF:-main}
restart: unless-stopped
environment:
PORT: "3090"
APP_TITLE: ${HEALTHCHECK_APP_TITLE:-UKMesh Health Check}
APP_EYEBROW: ${HEALTHCHECK_APP_EYEBROW:-MeshCore Observer Coverage}
APP_HEADLINE: ${HEALTHCHECK_APP_HEADLINE:-Check your UK mesh reach.}
APP_DESCRIPTION: ${HEALTHCHECK_APP_DESCRIPTION:-Generate a test code, send it to the configured channel, and watch observer coverage build in real time.}
EXTERNAL_LINK_URL: ${HEALTHCHECK_EXTERNAL_LINK_URL:-https://ukmesh.com}
EXTERNAL_LINK_LABEL: ${HEALTHCHECK_EXTERNAL_LINK_LABEL:-UKMesh}
LOG_LEVEL: ${HEALTHCHECK_LOG_LEVEL:-info}
TRUST_PROXY: "1"
MQTT_HOST: mosquitto
MQTT_PORT: "9001"
MQTT_USERNAME: ${MQTT_USERNAME:-backend}
MQTT_PASSWORD: ${MQTT_PASSWORD}
MQTT_TOPIC: ${HEALTHCHECK_MQTT_TOPIC:-meshcore/+/+/packets,meshcore/+/+/status,meshcore/+/+/internal}
MQTT_TRANSPORT: websockets
MQTT_WS_PATH: /
MQTT_TLS: "false"
DASH_BROKER_HOST: ${HEALTHCHECK_DASH_BROKER_HOST:-mqtt.ukmesh.com}
TEST_CHANNEL_NAME: ${HEALTHCHECK_TEST_CHANNEL_NAME:-ukmeshtest}
TEST_CHANNEL_SECRET: ${HEALTHCHECK_TEST_CHANNEL_SECRET:-}
TEST_CHANNEL_SECRET_SOURCE_NAME: ${HEALTHCHECK_TEST_CHANNEL_SECRET_SOURCE_NAME:-test}
TEST_CHANNEL_HASH: ${HEALTHCHECK_TEST_CHANNEL_HASH:-}
MESHCORE_CHANNEL_SECRETS: ${MESHCORE_CHANNEL_SECRETS:-}
SESSION_TTL_SECONDS: ${HEALTHCHECK_SESSION_TTL_SECONDS:-600}
RESULT_RETENTION_SECONDS: ${HEALTHCHECK_RESULT_RETENTION_SECONDS:-604800}
MAX_USES_PER_CODE: ${HEALTHCHECK_MAX_USES_PER_CODE:-3}
KNOWN_OBSERVERS: ${HEALTHCHECK_KNOWN_OBSERVERS:-}
OBSERVER_ACTIVE_WINDOW_SECONDS: ${HEALTHCHECK_OBSERVER_ACTIVE_WINDOW_SECONDS:-900}
OBSERVER_RETENTION_SECONDS: ${HEALTHCHECK_OBSERVER_RETENTION_SECONDS:-14400}
OBSERVERS_FILE: /app/data/observer.json
RESULTS_FILE: /app/data/session-results.json
REGIONS_FILE: ${HEALTHCHECK_REGIONS_FILE:-regions/uk.geojson}
TURNSTILE_ENABLED: ${HEALTHCHECK_TURNSTILE_ENABLED:-false}
TURNSTILE_SITE_KEY: ${HEALTHCHECK_TURNSTILE_SITE_KEY:-}
TURNSTILE_SECRET_KEY: ${HEALTHCHECK_TURNSTILE_SECRET_KEY:-}
depends_on:
- mosquitto
ports:
- "3090:3090"
volumes:
- mesh_health_check_data:/app/data
- ./healthcheck-overrides/index.html:/app/public/index.html:ro
- ./healthcheck-overrides/share.html:/app/public/share.html:ro
- ./healthcheck-overrides/sw.js:/app/public/sw.js:ro
- ./healthcheck-overrides/ukmesh-theme.css:/app/public/ukmesh-theme.css:ro
app-dev:
build:
context: .
dockerfile: Dockerfile.app
args:
VITE_APP_HOSTNAME: ${VITE_DEV_APP_HOSTNAME:-}
VITE_NETWORK: test
VITE_SITE: dev
VITE_OBSERVER_ID: ${VITE_DEV_OBSERVER_ID:-}
VITE_SITE_DISPLAY_NAME: ${VITE_DEV_SITE_DISPLAY_NAME:-UK Mesh Test}
VITE_SITE_FOOTER_NAME: ${VITE_DEV_SITE_FOOTER_NAME:-UK Mesh Test}
VITE_SITE_APP_URL: ${VITE_DEV_SITE_APP_URL:-https://test.ukmesh.com}
VITE_SITE_HOME_URL: ${VITE_DEV_SITE_HOME_URL:-https://test.ukmesh.com}
restart: unless-stopped
depends_on:
- backend
ports:
- "3005:80"
website-dev:
build:
context: .
dockerfile: Dockerfile.website
args:
VITE_APP_HOSTNAME: ${VITE_DEV_APP_HOSTNAME:-app-dev.ukmesh.com}
VITE_NETWORK: test
VITE_SITE: dev
VITE_OBSERVER_ID: ${VITE_DEV_OBSERVER_ID:-}
VITE_SITE_DISPLAY_NAME: ${VITE_DEV_SITE_DISPLAY_NAME:-UK Mesh Test}
VITE_SITE_FOOTER_NAME: ${VITE_DEV_SITE_FOOTER_NAME:-UK Mesh Test}
VITE_SITE_APP_URL: ${VITE_DEV_SITE_APP_URL:-https://test.ukmesh.com}
VITE_SITE_HOME_URL: ${VITE_DEV_SITE_HOME_URL:-https://test.ukmesh.com}
restart: unless-stopped
ports:
- "3006:80"
depends_on:
- backend
# ── Anubis bot protection ─────────────────────────────────────────────────────
# One sidecar per public HTTP service. Cloudflare Tunnel routes to these
# containers (port 8923) instead of the origin services directly.
# MQTT (mosquitto:9001) is intentionally excluded — non-browser clients.
# Dev services are intentionally excluded — low value.
anubis-website-ukmesh:
<<: *anubis-base
environment:
ED25519_PRIVATE_KEY_HEX: "${ANUBIS_ED25519_PRIVATE_KEY_HEX:?ANUBIS_ED25519_PRIVATE_KEY_HEX required}"
BIND: ":8923"
TARGET: "http://website-ukmesh:80"
COOKIE_DOMAIN: "ukmesh.com"
COOKIE_SECURE: "true"
COOKIE_SAME_SITE: "Lax"
COOKIE_EXPIRATION_TIME: "168h"
POLICY_FNAME: "/data/botPolicy.yaml"
SLOG_LEVEL: "INFO"
CUSTOM_REAL_IP_HEADER: "CF-Connecting-IP"
depends_on:
- website-ukmesh
anubis-app-ukmesh:
<<: *anubis-base
environment:
ED25519_PRIVATE_KEY_HEX: "${ANUBIS_ED25519_PRIVATE_KEY_HEX:?ANUBIS_ED25519_PRIVATE_KEY_HEX required}"
BIND: ":8923"
TARGET: "http://app-ukmesh:80"
COOKIE_DOMAIN: "app.ukmesh.com"
COOKIE_SECURE: "true"
COOKIE_SAME_SITE: "Lax"
COOKIE_EXPIRATION_TIME: "168h"
POLICY_FNAME: "/data/botPolicy.yaml"
SLOG_LEVEL: "INFO"
CUSTOM_REAL_IP_HEADER: "CF-Connecting-IP"
depends_on:
- app-ukmesh
anubis-website-teesside:
<<: *anubis-base
environment:
ED25519_PRIVATE_KEY_HEX: "${ANUBIS_ED25519_PRIVATE_KEY_HEX:?ANUBIS_ED25519_PRIVATE_KEY_HEX required}"
BIND: ":8923"
TARGET: "http://website-teesside:80"
COOKIE_DOMAIN: "teessidemesh.com"
COOKIE_SECURE: "true"
COOKIE_SAME_SITE: "Lax"
COOKIE_EXPIRATION_TIME: "168h"
POLICY_FNAME: "/data/botPolicy.yaml"
SLOG_LEVEL: "INFO"
CUSTOM_REAL_IP_HEADER: "CF-Connecting-IP"
depends_on:
- website-teesside
anubis-health-check:
<<: *anubis-base
environment:
ED25519_PRIVATE_KEY_HEX: "${ANUBIS_ED25519_PRIVATE_KEY_HEX:?ANUBIS_ED25519_PRIVATE_KEY_HEX required}"
BIND: ":8923"
TARGET: "http://mesh-health-check:3090"
COOKIE_DOMAIN: "healthcheck.ukmesh.com"
COOKIE_SECURE: "true"
COOKIE_SAME_SITE: "Lax"
COOKIE_EXPIRATION_TIME: "168h"
POLICY_FNAME: "/data/botPolicy.yaml"
SLOG_LEVEL: "INFO"
CUSTOM_REAL_IP_HEADER: "CF-Connecting-IP"
depends_on:
- mesh-health-check
networks:
default:
# Cloudflare Tunnel currently routes healthcheck.ukmesh.com to
# http://anubis-mesh-health-check:8923. Keep this alias unless the
# tunnel ingress config is changed at Cloudflare too.
aliases:
- anubis-mesh-health-check
cloudflared:
image: cloudflare/cloudflared:latest
restart: unless-stopped
command: tunnel run
profiles: [tunnel]
environment:
TUNNEL_TOKEN: ${CLOUDFLARE_TUNNEL_TOKEN}
depends_on:
- backend
- anubis-website-ukmesh
- anubis-app-ukmesh
- anubis-website-teesside
- anubis-health-check
- app-dev
- website-dev
- mosquitto
loki:
image: grafana/loki:3.4
restart: unless-stopped
command: -config.file=/etc/loki/loki.yaml
volumes:
- ./logging/loki.yaml:/etc/loki/loki.yaml:ro
- loki_data:/loki
promtail:
image: grafana/promtail:3.4
restart: unless-stopped
command: -config.file=/etc/promtail/promtail.yaml
volumes:
- ./logging/promtail.yaml:/etc/promtail/promtail.yaml:ro
- /var/run/docker.sock:/var/run/docker.sock:ro
depends_on:
- loki
grafana:
image: grafana/grafana:11.5.0
restart: unless-stopped
environment:
GF_SECURITY_ADMIN_PASSWORD: ${GRAFANA_ADMIN_PASSWORD:?GRAFANA_ADMIN_PASSWORD required}
GF_USERS_ALLOW_SIGN_UP: "false"
GF_AUTH_ANONYMOUS_ENABLED: "false"
volumes:
- ./logging/grafana/provisioning:/etc/grafana/provisioning:ro
- ./logging/grafana/dashboards:/etc/grafana/dashboards:ro
- grafana_data:/var/lib/grafana
ports:
- "3010:3000"
depends_on:
- loki
volumes:
timescaledb_data:
mosquitto_data:
mosquitto_log:
redis_data:
srtm_data:
loki_data:
grafana_data:
mesh_health_check_data:
Reference in New Issue View Git Blame Copy Permalink