five-on-it / apps/api/src/fleet-registry
apps/api/src/fleet-registry
The fleet's registry (TECHNICAL_SPECS §11, the servers' wave): the game servers that joined the platform on their own, each by a heartbeat every 5 s (@foi/protocol's FleetHeartbeat, POST /fleet/heartbeat with the fleet's secret, fleet-routes.ts), forgotten REGISTRY.expiryMs after the last one. The API opens rooms on them beside the servers it was given (FOI_GAME_SERVERS), and Prometheus finds them through FleetRegistry.targets (its http_sd).
A heartbeat names two addresses the platform then uses: the API fetches the server's internalUrl and sends players to its publicUrl. Both are checked (checkAddresses): the first must be plain http to an address of the fleet's private networks (FOI_FLEET_NETWORKS, by CIDR), so a leaked secret cannot point the API at anything else; the second a WebSocket address under the fleet's domain (FOI_FLEET_DOMAIN), so it cannot send players elsewhere.