feat(map): add cached public station navigation

2026-08-12 10:50:06 +08:00
parent 357dd490e9
commit 6ef98d03c2
13 changed files with 780 additions and 4 deletions
@@ -0,0 +1,49 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+release_id=${1:?release id is required}
+archive=${2:?release archive is required}
+root=${STATION_NAVIGATION_ROOT:-/opt/lingniu-station-navigation}
+service=${STATION_NAVIGATION_SERVICE:-lingniu-station-navigation.service}
+base_url=${STATION_NAVIGATION_BASE_URL:-http://127.0.0.1:20804}
+
+case "$release_id" in
+  ''|*[!A-Za-z0-9._-]*) printf 'invalid release id: %s\n' "$release_id" >&2; exit 1 ;;
+esac
+test -f "$archive"
+
+if ! id station-navigation >/dev/null 2>&1; then
+  useradd --system --home-dir "$root" --shell /sbin/nologin station-navigation
+fi
+mkdir -p "$root/releases"
+next="$root/releases/$release_id"
+test ! -e "$next"
+mkdir -p "$next"
+
+while IFS= read -r member; do
+  case "$member" in
+    /*|../*|*/../*|*/..) printf 'archive contains unsafe path: %s\n' "$member" >&2; exit 1 ;;
+  esac
+done < <(tar -tzf "$archive")
+tar --no-same-owner -xzf "$archive" -C "$next"
+test -f "$next/server.py"
+test -f "$next/index.html"
+chown -R root:station-navigation "$next"
+chmod -R u=rwX,g=rX,o= "$next"
+
+ln -s "$next" "$root/current.next"
+python3 -c 'import os,sys; os.replace(sys.argv[1],sys.argv[2])' "$root/current.next" "$root/current"
+systemctl restart "$service"
+
+for _ in $(seq 1 30); do
+  if systemctl is-active --quiet "$service" && curl -fsS "$base_url/api/health" | grep -q '"service":"station-navigation"'; then
+    curl -fsS "$base_url/" | grep -q 'id="dashboardTitle"'
+    curl -fsS "$base_url/api/stations" | python3 -c 'import json,sys; d=json.load(sys.stdin); assert d["status"]=="ok" and d["summary"]["totalStations"]>400; forbidden={"hydrogenVolume","fuelingVolume","dailyHydrogenVolume"}; assert not (forbidden & set().union(*(x.keys() for x in d["stations"])))'
+    printf 'station_navigation_release_install=ok release=%s\n' "$release_id"
+    exit 0
+  fi
+  sleep 1
+done
+
+systemctl status "$service" --no-pager >&2 || true
+exit 1
@@ -0,0 +1,31 @@
+[Unit]
+Description=Lingniu Public Hydrogen Station Navigation
+After=network-online.target lingniu-vehicle-open-platform.service
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=station-navigation
+Group=station-navigation
+# The public process needs read-only access to the operations map's shared
+# logo and stylesheet.  Its own release remains owned by station-navigation.
+SupplementaryGroups=vehicle-map
+WorkingDirectory=/opt/lingniu-station-navigation/current
+# Reuse the operations map's existing Open Platform credential; the public
+# service still returns only the station-directory allowlist in server.py.
+EnvironmentFile=/opt/lingniu-vehicle-map/env/vehicle-map.env
+Environment=STATION_NAVIGATION_HOST=0.0.0.0
+Environment=STATION_NAVIGATION_PORT=20804
+Environment=STATION_NAVIGATION_CACHE_SECONDS=120
+Environment=VEHICLE_MAP_ASSET_ROOT=/opt/lingniu-vehicle-map/current
+ExecStart=/usr/bin/python3 /opt/lingniu-station-navigation/current/server.py
+Restart=always
+RestartSec=3
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=full
+ProtectHome=true
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+
+[Install]
+WantedBy=multi-user.target