feat: deploy cities labeler

templates/Caddyfile.j2

@@ -24,3 +24,12 @@
   reverse_proxy http://localhost:8787
 }
 {% endif %}
+{% if pds_cities_enabled is defined and pds_cities_enabled | bool %}
+{{ pds_cities_hostname }} {
+  log {
+    output stdout
+    format json
+  }
+  reverse_proxy http://localhost:4100
+}
+{% endif %}

templates/cities-labeler-compose.yaml.j2

@@ -0,0 +1,27 @@
+name: cities-labeler
+
+# Cities labeler — deployed by Ansible to
+# {{ pds_data_dir }}/cities/compose.yaml
+
+services:
+  app:
+    build: .
+    env_file: .env
+    ports:
+      - "127.0.0.1:4100:4100"
+    # the host's /etc/hosts maps the PDS hostname to 127.0.1.1 (cloud-init
+    # manage_etc_hosts), which Docker propagates to container DNS — pin the
+    # real address so the labeler can log in to the PDS
+    extra_hosts:
+      - "{{ pds_hostname }}:{{ hostvars[inventory_hostname].ansible_default_ipv4.address }}"
+    volumes:
+      # bind mount keeps the label database under /pds — captured by the backup tarball
+      - ./data:/data
+    # runs unprivileged; ./data must be owned by uid 1000
+    user: "1000:1000"
+    read_only: true
+    cap_drop:
+      - ALL
+    security_opt:
+      - no-new-privileges:true
+    restart: unless-stopped

templates/cities-labeler.env.j2

@@ -0,0 +1,3 @@
+LABELER_HANDLE={{ pds_cities_handle | default('cities.' ~ pds_hostname) }}
+LABELER_APP_PASSWORD={{ pds_cities_app_password }}
+SIGNING_KEY_HEX={{ pds_cities_signing_key }}