Run it locally¶

Two application repositories are expected next to the infra one:

evocases-iframe/
├── infra-evocases-iframe/   <- you are here
├── evocases-iframe-be/
└── evocases-iframe-fe/

cp .env.example .env
cp env/be.env.example env/be.env      # fill JWT_SECRET and SEED_ENCRYPTION_KEYS
docker compose build
docker compose up -d --wait
docker compose run --rm migrate
docker compose --profile seed run --rm be-seed

docker-compose.override.yml is picked up automatically. It publishes ports on 127.0.0.1 and adds edge, the nginx proxy that reproduces the tunnel's path split.


Game / embed	http://localhost:8080 — through `edge`
Back office	http://localhost:3002
bo-api	http://localhost:4101
Postgres	`localhost:5433`
Redis	`localhost:6380`

games-api is deliberately not published. Reaching it directly bypasses the path split, so a test could pass against a document the deployment would never serve that way. Go through http://localhost:8080.

Check the embed end to end¶

curl -sI http://localhost:8080/lootbox/index.html   # games-api, carries frame-ancestors
curl -sI http://localhost:8080/lootbox/assets/      # fe-embeds

Both halves separately. One working does not imply the other.

Seeds¶

be-seed runs bootstrap.ts: the installation row, the game registry, loot-box defaults and the first super admin. Safe anywhere, never overwrites.
seed:demo adds the playable catalogue, known logins and the mock wallet.

The demo seed's guard is weaker than it looks

assertLocalDatabase() allows the hosts localhost, 127.0.0.1, ::1, postgres, db. In a compose stack the database host is literally postgres, so the host check passes — only NODE_ENV=production stands between a deployed environment and a set of credentials that are public in the repository. The image does not set NODE_ENV; Doppler does, for stg and prd.

Mock wallet¶

docker compose --profile mock-wallet up -d mock-wallet. It is a development stub and is never routed — anything using it must reach it over the compose network only.