Freegle / Iznik / 23431

71%

master: 73%

Pull #894

circleci

feat(edge): implement + dev-validate front-end host (edge) Compose profile

Preparatory work for the front-end server migration (plan §5/§6). All of it
runs ONLY under the new `edge` profile, which is in no default profile set, so
local dev and CI are unaffected (verified via `docker-compose config`).

- docker-compose.yml: join `delivery`+`tusd` to the `edge` profile;
  parameterize tusd `command` via `${TUSD_COMMAND:-<dev default>}` (dev literal
  unchanged); add `frontend-nginx` + `tile-server` (edge-only); add
  `delivery-cache`/`tusd-data`/`osm-data`/`osm-tiles` volumes.
- frontend-nginx.conf: front door — uploads (:80 proxy_protocol + :8080 plain,
  no CORS), delivery cache pinned to `proxy_cache_key "https://wsrv.nl$request_uri"`
  with @handle_redirect and a single X-Cache-Status, tiles single-ACAO,
  PROXY-protocol real-IP, :8081 /healthz, 444 catch-all.
- docker-compose.override.edge.yml: VM-only — publish :80/:8080 and bind tusd's
  upload dir to the shared-NFS host mount /srv/tusd-data.

Dev-validated on an isolated `edge-dev` worktree (see plan §6a): all three
compose renders, `nginx -t`, and live curls of every vhost (delivery
MISS->HIT with real PROXY framing, tiles exactly-one-ACAO, uploads 405 with no
nginx CORS, catch-all 444). Three bugs found+fixed during validation: healthcheck
localhost->127.0.0.1 (busybox IPv6), weserv internal-host 403, double
X-Cache-Status.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019FENH5AZF3x2djCMR3U9KC

11263 of 14981 branches covered (75.18%)

Branch coverage included in aggregate %.

123640 of 174011 relevant lines covered (71.05%)

37.29 hits per line