0.1.38 gateway

docker-compose.yml

@@ -39,6 +39,11 @@ services:
       # Unset disables /admin entirely — the library import, maintenance switch and
       # analytics page all live behind it.
       MEMBY_ADMIN_TOKEN: "${MEMBY_ADMIN_TOKEN:-}"
+      # Where the console's own container serves its built assets. Internal to this
+      # network: memby-admin is never published, and the gateway proxies /admin to it so
+      # the console shares this origin, this cookie and this single ingress. Blank
+      # disables the console while leaving the /admin API intact for automation.
+      MEMBY_ADMIN_UI_URL: "${MEMBY_ADMIN_UI_URL:-http://memby-admin:80}"
       # CI publishes signed APKs here. The dedicated token does not grant access to the
       # rest of the admin API.
       MEMBY_PUBLIC_URL: "${MEMBY_PUBLIC_URL:-https://mserver.sublogue.com}"
@@ -79,6 +84,10 @@ services:
         condition: service_healthy
       redis:
         condition: service_healthy
+      # Started, not healthy: the gateway serves televisions and must not wait on the
+      # console to come up. A console that is not answering yet is a page that says so.
+      memby-admin:
+        condition: service_started
     healthcheck:
       # No shell or curl in a distroless image, so probe with the binary's own server
       # via the container's TCP port from the Docker healthcheck's perspective.
@@ -88,6 +97,32 @@ services:
       retries: 3
       start_period: 10s
 
+  # The operations console: a React application built at image time and served by nginx.
+  #
+  # Deliberately not published. The household's reverse proxy sends one hostname to the
+  # gateway and nothing else, and the admin session is a cookie on that origin — so the
+  # gateway proxies /admin here rather than this being a second origin with its own proxy
+  # rule, its own CORS allowlist and a cookie relaxed to SameSite=None to survive the
+  # crossing. It holds no state and no credentials; replacing it is replacing a directory
+  # of files.
+  memby-admin:
+    build: ./admin-ui
+    restart: unless-stopped
+    expose:
+      - "80"
+    read_only: true
+    # The only writable paths nginx needs. Everything else in the image is static.
+    tmpfs:
+      - /var/cache/nginx
+      - /var/run
+    mem_limit: "${MEMBY_ADMIN_MEMORY_LIMIT:-64m}"
+    healthcheck:
+      test: ["CMD", "wget", "-qO-", "http://127.0.0.1/healthz"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 5s
+
   postgres:
     image: postgres:17-alpine
     restart: unless-stopped