feat: 接入 frontend 子模块并集成 envoy

.gitmodules

@@ -0,0 +1,3 @@
+[submodule "frontend"]
+	path = frontend
+	url = http://103.236.53.208:3000/juwan/juwan-frontend.git

deploy/dev/build.py

@@ -91,9 +91,23 @@ def discover_targets():
     return targets
 
 
+def frontend_target():
+    frontend_root = ROOT_DIR / "frontend"
+    if not (frontend_root / "Dockerfile").exists():
+        return None
+    return {
+        "context": "frontend",
+        "dockerfile": "Dockerfile",
+        "tags": [f"{IMAGE_PREFIX}/frontend:{IMAGE_TAG}"],
+    }
+
+
 def main():
     os.chdir(ROOT_DIR)
     targets = discover_targets()
+    ft = frontend_target()
+    if ft is not None:
+        targets["frontend"] = ft
     if not targets:
         print("No targets found")
         sys.exit(1)

deploy/dev/docker-compose.yml

@@ -291,6 +291,14 @@ services:
       rl-redis:
         condition: service_started
 
+  frontend:
+    image: juwan/frontend:dev
+    container_name: juwan-frontend
+    restart: unless-stopped
+    environment:
+      NODE_ENV: production
+      PORT: "3000"
+
   # ==================== RPC 层 ====================
   user-rpc:
     image: juwan/users-rpc:dev

deploy/dev/envoy.yaml

@@ -427,10 +427,13 @@ static_resources:
 
                         - match:
                             prefix: /
-                          direct_response:
+                          route:
-                            status: 404
+                            cluster: frontend_cluster
-                            body:
+                            timeout: 30s
-                              inline_string: gateway route not found
+                          typed_per_filter_config:
+                            envoy.filters.http.ext_authz:
+                              "@type": type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute
+                              disabled: true
 
                 access_log:
                   - name: envoy.access_loggers.stdout
@@ -975,6 +978,20 @@ static_resources:
                       address: ratelimit
                       port_value: 8081
 
+    - name: frontend_cluster
+      connect_timeout: 2s
+      type: STRICT_DNS
+      lb_policy: ROUND_ROBIN
+      load_assignment:
+        cluster_name: frontend_cluster
+        endpoints:
+          - lb_endpoints:
+              - endpoint:
+                  address:
+                    socket_address:
+                      address: frontend
+                      port_value: 3000
+
 admin:
   access_log_path: /tmp/admin.log
   address: