feat: self-hosted Docker stack, live AIS relay, vessel data-source indicators

Self-contained Docker/Podman Compose stack with bundled Redis, AIS relay
sidecar, and all services needed to run World Monitor locally.

Docker stack:
- Dockerfile.relay: lightweight Node.js sidecar running scripts/ais-relay.cjs
  for live AIS vessel data via AISStream.io WebSocket
- docker-compose.yml: self-contained stack (app + Redis + redis-rest + AIS relay)
  with env-var references for all API keys — no hardcoded values
- .gitignore: docker-compose.override.yml for local-specific configuration

AIS data-source transparency:
- GlobeMap: native tooltip shows "AIS LIVE" vs "EST. POSITION" per vessel
- GlobeMap: hover tooltip shows green "AIS LIVE" or amber "EST. POSITION"
  with USNI attribution and article date when applicable
- GlobeMap: USNI-sourced vessels rendered with dashed amber ring and reduced
  opacity to visually distinguish estimated positions
- MapPopup: data-source badge in vessel detail popup header

Quick start:
  cp .env.example .env        # add API keys
  docker compose up -d --build

Author: jrtorrez31337

.dockerignore

@@ -0,0 +1,19 @@
+node_modules
+dist
+.git
+.github
+.windsurf
+.agent
+.agents
+.claude
+.factory
+.planning
+e2e
+src-tauri/target
+src-tauri/sidecar/node
+*.log
+*.md
+!README.md
+docs/internal
+docs/Docs_To_Review
+tests

.gitignore

@@ -6,6 +6,7 @@ public/blog/
 *.log
 .env
 .env.local
+docker-compose.override.yml
 .playwright-mcp/
 .vercel
 api/\[domain\]/v1/\[rpc\].js

Dockerfile

@@ -0,0 +1,65 @@
+# =============================================================================
+# World Monitor — Docker Image
+# =============================================================================
+# Multi-stage build:
+#   builder  — installs deps, compiles TS handlers, builds Vite frontend
+#   final    — nginx (static) + node (API) under supervisord
+# =============================================================================
+
+# ── Stage 1: Builder ─────────────────────────────────────────────────────────
+FROM node:22-alpine AS builder
+
+WORKDIR /app
+
+# Install root dependencies (layer-cached until package.json changes)
+COPY package.json package-lock.json ./
+RUN npm ci --ignore-scripts
+
+# Install blog-site dependencies (separate workspace)
+COPY blog-site/package.json blog-site/package-lock.json ./blog-site/
+RUN cd blog-site && npm ci --ignore-scripts
+
+# Copy full source
+COPY . .
+
+# Compile TypeScript API handlers → self-contained ESM bundles
+# Output is api/**/*.js alongside the source .ts files
+RUN node docker/build-handlers.mjs
+
+# Build Vite frontend (outputs to dist/)
+RUN npm run build
+
+# ── Stage 2: Runtime ─────────────────────────────────────────────────────────
+FROM node:20-alpine AS final
+
+# nginx + supervisord
+RUN apk add --no-cache nginx supervisor && \
+    mkdir -p /tmp/nginx-client-body /tmp/nginx-proxy /tmp/nginx-fastcgi \
+             /tmp/nginx-uwsgi /tmp/nginx-scgi /var/log/supervisor
+
+WORKDIR /app
+
+# API server
+COPY --from=builder /app/src-tauri/sidecar/local-api-server.mjs ./local-api-server.mjs
+COPY --from=builder /app/src-tauri/sidecar/package.json ./package.json
+
+# API handler modules (JS originals + compiled TS bundles)
+COPY --from=builder /app/api ./api
+
+# Static data files used by handlers at runtime
+COPY --from=builder /app/data ./data
+
+# Built frontend static files
+COPY --from=builder /app/dist /usr/share/nginx/html
+
+# Nginx + supervisord configs
+COPY docker/nginx.conf /etc/nginx/nginx.conf
+COPY docker/supervisord.conf /etc/supervisor/conf.d/worldmonitor.conf
+
+EXPOSE 8080
+
+# Healthcheck via nginx
+HEALTHCHECK --interval=30s --timeout=5s --start-period=15s --retries=3 \
+  CMD wget -qO- http://localhost:8080/api/health || exit 1
+
+CMD ["/usr/bin/supervisord", "-c", "/etc/supervisor/conf.d/worldmonitor.conf"]

Dockerfile.relay

@@ -0,0 +1,27 @@
+# =============================================================================
+# AIS Relay Sidecar
+# =============================================================================
+# Runs scripts/ais-relay.cjs as a standalone container.
+# Only dependency beyond Node stdlib is the 'ws' WebSocket library.
+# Set AISSTREAM_API_KEY in docker-compose.yml.
+# =============================================================================
+
+FROM node:22-alpine
+
+WORKDIR /app
+
+# Install only the ws package (everything else is Node stdlib)
+RUN npm install --omit=dev ws@8
+
+# Relay script
+COPY scripts/ais-relay.cjs ./scripts/ais-relay.cjs
+
+# Shared helper required by the relay (rss-allowed-domains.cjs)
+COPY shared/ ./shared/
+
+EXPOSE 3004
+
+HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
+  CMD wget -qO- http://localhost:3004/health || exit 1
+
+CMD ["node", "scripts/ais-relay.cjs"]

docker-compose.yml

@@ -0,0 +1,84 @@
+# =============================================================================
+# World Monitor — Docker / Podman Compose
+# =============================================================================
+# Self-contained stack: app + Redis + AIS relay.
+#
+# Quick start:
+#   cp .env.example .env        # add your API keys
+#   docker compose up -d --build
+#
+# The app will be available at http://localhost:3000
+# =============================================================================
+
+version: '3.9'
+
+services:
+
+  worldmonitor:
+    build:
+      context: .
+      dockerfile: Dockerfile
+    image: worldmonitor:latest
+    container_name: worldmonitor
+    ports:
+      - "${WM_PORT:-3000}:8080"
+    environment:
+      UPSTASH_REDIS_REST_URL: "http://redis-rest:80"
+      UPSTASH_REDIS_REST_TOKEN: "wm-local-token"
+      LOCAL_API_PORT: "46123"
+      LOCAL_API_MODE: "docker"
+      LOCAL_API_CLOUD_FALLBACK: "false"
+      WS_RELAY_URL: "http://ais-relay:3004"
+      # LLM provider (any OpenAI-compatible endpoint)
+      LLM_API_URL: "${LLM_API_URL:-}"
+      LLM_API_KEY: "${LLM_API_KEY:-}"
+      LLM_MODEL: "${LLM_MODEL:-}"
+      GROQ_API_KEY: "${GROQ_API_KEY:-}"
+      # Data source API keys (optional — features degrade gracefully)
+      AISSTREAM_API_KEY: "${AISSTREAM_API_KEY:-}"
+      FINNHUB_API_KEY: "${FINNHUB_API_KEY:-}"
+      EIA_API_KEY: "${EIA_API_KEY:-}"
+      FRED_API_KEY: "${FRED_API_KEY:-}"
+      ACLED_ACCESS_TOKEN: "${ACLED_ACCESS_TOKEN:-}"
+      NASA_FIRMS_API_KEY: "${NASA_FIRMS_API_KEY:-}"
+      CLOUDFLARE_API_TOKEN: "${CLOUDFLARE_API_TOKEN:-}"
+      AVIATIONSTACK_API: "${AVIATIONSTACK_API:-}"
+    depends_on:
+      redis-rest:
+        condition: service_started
+      ais-relay:
+        condition: service_started
+    restart: unless-stopped
+
+  ais-relay:
+    build:
+      context: .
+      dockerfile: Dockerfile.relay
+    image: worldmonitor-ais-relay:latest
+    container_name: worldmonitor-ais-relay
+    environment:
+      AISSTREAM_API_KEY: "${AISSTREAM_API_KEY:-}"
+      PORT: "3004"
+    restart: unless-stopped
+
+  redis:
+    image: docker.io/redis:7-alpine
+    container_name: worldmonitor-redis
+    command: redis-server --maxmemory 256mb --maxmemory-policy allkeys-lru
+    volumes:
+      - redis-data:/data
+    restart: unless-stopped
+
+  redis-rest:
+    image: docker.io/hiett/serverless-redis-http:latest
+    container_name: worldmonitor-redis-rest
+    environment:
+      SRH_MODE: "env"
+      SRH_TOKEN: "wm-local-token"
+      SRH_CONNECTION_STRING: "redis://redis:6379"
+    depends_on:
+      - redis
+    restart: unless-stopped
+
+volumes:
+  redis-data:

docker/build-handlers.mjs

@@ -0,0 +1,104 @@
+/**
+ * Compiles all API handlers into self-contained ESM bundles so the
+ * local-api-server.mjs sidecar can discover and load them without node_modules.
+ *
+ * Two passes:
+ *   1. TypeScript handlers (api/**\/*.ts) → bundled .js at same path
+ *   2. Plain JS handlers (api/*.js root level) → bundled in-place to inline npm deps
+ *
+ * Run: node docker/build-handlers.mjs
+ */
+
+import { build } from 'esbuild';
+import { readdir, stat } from 'node:fs/promises';
+import { fileURLToPath } from 'node:url';
+import path from 'node:path';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const projectRoot = path.resolve(__dirname, '..');
+const apiRoot = path.join(projectRoot, 'api');
+
+// ── Pass 1: TypeScript handlers in subdirectories ─────────────────────────
+async function findTsHandlers(dir) {
+  const entries = await readdir(dir, { withFileTypes: true });
+  const handlers = [];
+  for (const entry of entries) {
+    const fullPath = path.join(dir, entry.name);
+    if (entry.isDirectory()) {
+      handlers.push(...await findTsHandlers(fullPath));
+    } else if (
+      entry.name.endsWith('.ts') &&
+      !entry.name.startsWith('_') &&
+      !entry.name.endsWith('.test.ts') &&
+      !entry.name.endsWith('.d.ts')
+    ) {
+      handlers.push(fullPath);
+    }
+  }
+  return handlers;
+}
+
+// ── Pass 2: Plain JS handlers at api/ root level ──────────────────────────
+async function findJsHandlers(dir) {
+  const entries = await readdir(dir, { withFileTypes: true });
+  return entries
+    .filter(e =>
+      e.isFile() &&
+      e.name.endsWith('.js') &&
+      !e.name.startsWith('_') &&
+      !e.name.endsWith('.test.js') &&
+      !e.name.endsWith('.test.mjs')
+    )
+    .map(e => path.join(dir, e.name));
+}
+
+async function compileHandlers(handlers, label) {
+  if (handlers.length === 0) {
+    console.log(`${label}: nothing to compile`);
+    return 0;
+  }
+  console.log(`${label}: compiling ${handlers.length} handlers...`);
+
+  const results = await Promise.allSettled(
+    handlers.map(async (entryPoint) => {
+      const outfile = entryPoint.replace(/\.ts$/, '.js');
+      await build({
+        entryPoints: [entryPoint],
+        outfile,
+        bundle: true,
+        format: 'esm',
+        platform: 'node',
+        target: 'node20',
+        treeShaking: true,
+        allowOverwrite: true,
+        loader: { '.ts': 'ts' },
+      });
+      const { size } = await stat(outfile);
+      return { file: path.relative(projectRoot, outfile), size };
+    })
+  );
+
+  let ok = 0, failed = 0;
+  for (const result of results) {
+    if (result.status === 'fulfilled') {
+      const { file, size } = result.value;
+      console.log(`  ✓ ${file}  (${(size / 1024).toFixed(1)} KB)`);
+      ok++;
+    } else {
+      console.error(`  ✗ ${result.reason?.message || result.reason}`);
+      failed++;
+    }
+  }
+  return failed;
+}
+
+const tsHandlers = await findTsHandlers(apiRoot);
+const jsHandlers = await findJsHandlers(apiRoot);
+
+const tsFailed = await compileHandlers(tsHandlers, 'build-handlers [TS]');
+// JS handlers bundled AFTER TS so compiled .js outputs don't get re-processed
+const jsFailed = await compileHandlers(jsHandlers, 'build-handlers [JS]');
+
+const totalFailed = tsFailed + jsFailed;
+console.log(`\nbuild-handlers: complete (${totalFailed} failures)`);
+if (totalFailed > 0) process.exit(1);

docker/nginx.conf

@@ -0,0 +1,84 @@
+worker_processes auto;
+error_log /dev/stderr warn;
+pid /tmp/nginx.pid;
+
+events {
+  worker_connections 1024;
+}
+
+http {
+  include       /etc/nginx/mime.types;
+  default_type  application/octet-stream;
+
+  log_format main '$remote_addr - [$time_local] "$request" $status $body_bytes_sent';
+  access_log /dev/stdout main;
+
+  sendfile on;
+  tcp_nopush on;
+  keepalive_timeout 65;
+
+  # Serve pre-compressed assets (gzip .gz — built by vite brotliPrecompressPlugin)
+  # brotli_static requires ngx_brotli module — not in Alpine nginx, use gzip fallback
+  gzip_static on;
+  gzip on;
+  gzip_comp_level 5;
+  gzip_min_length 1024;
+  gzip_vary on;
+  gzip_types application/json application/javascript text/css text/plain application/xml text/xml image/svg+xml;
+
+  # Temp dirs writable by non-root
+  client_body_temp_path /tmp/nginx-client-body;
+  proxy_temp_path /tmp/nginx-proxy;
+  fastcgi_temp_path /tmp/nginx-fastcgi;
+  uwsgi_temp_path /tmp/nginx-uwsgi;
+  scgi_temp_path /tmp/nginx-scgi;
+
+  server {
+    listen 8080;
+    root /usr/share/nginx/html;
+    index index.html;
+
+    # Static assets — immutable cache
+    location /assets/ {
+      add_header Cache-Control "public, max-age=31536000, immutable";
+      try_files $uri =404;
+    }
+
+    location /map-styles/ {
+      add_header Cache-Control "public, max-age=31536000, immutable";
+      try_files $uri =404;
+    }
+
+    location /data/ {
+      add_header Cache-Control "public, max-age=31536000, immutable";
+      try_files $uri =404;
+    }
+
+    location /textures/ {
+      add_header Cache-Control "public, max-age=31536000, immutable";
+      try_files $uri =404;
+    }
+
+    # API proxy → Node.js local-api-server
+    location /api/ {
+      proxy_pass http://127.0.0.1:46123;
+      proxy_http_version 1.1;
+      proxy_set_header Host $host;
+      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+      proxy_set_header X-Forwarded-Proto $scheme;
+      # Pass Origin as localhost so api key checks pass for browser-origin requests
+      proxy_set_header Origin http://localhost;
+      proxy_read_timeout 120s;
+      proxy_send_timeout 120s;
+    }
+
+    # SPA fallback — all other routes serve index.html
+    location / {
+      add_header Cache-Control "no-cache, no-store, must-revalidate";
+      # Allow nested YouTube iframes to call requestStorageAccess() so
+      # signed-in users' YouTube session cookies are used (avoids bot-check).
+      add_header Permissions-Policy "storage-access=*";
+      try_files $uri $uri/ /index.html;
+    }
+  }
+}