From 3fcd4c982ed45b3c90fdb2af528db7e3986dfb3c Mon Sep 17 00:00:00 2001
From: Neil <4138956+nwparker@users.noreply.github.com>
Date: Fri, 13 Nov 2026 05:52:26 -0800
Subject: [PATCH] relay: copy deployment-staged data (apps/relay/ip-country)
 into the runtime image (#42025)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The director's IP → country table (ORCA_RELAY_IP_COUNTRY_DB) is fetched and verified by the
deployment's image build and staged in apps/relay/ip-country. The directory holds only a README
here, so an image built from this repository alone is unchanged apart from that file.
---
 cloud/apps/relay/Dockerfile           |  3 +++
 cloud/apps/relay/ip-country/README.md | 12 ++++++++++++
 2 files changed, 15 insertions(+)
 create mode 100644 cloud/apps/relay/ip-country/README.md

diff --git a/cloud/apps/relay/Dockerfile b/cloud/apps/relay/Dockerfile
index 1c0e86af8cb..4c18538388d 100644
--- a/cloud/apps/relay/Dockerfile
+++ b/cloud/apps/relay/Dockerfile
@@ -32,6 +32,9 @@ RUN pnpm install --prod --frozen-lockfile --filter @orca-cloud/relay... \
   && rm -rf /opt/pnpm /usr/local/lib/node_modules /opt/yarn-* /root/.cache /root/.local \
   && rm -f /usr/local/bin/npm /usr/local/bin/npx /usr/local/bin/corepack \
     /usr/local/bin/pnpm /usr/local/bin/pnpx /usr/local/bin/yarn /usr/local/bin/yarnpkg
+# Data a deployment stages into apps/relay/ip-country before the build (README there), e.g. the
+# director's IP → country table for ORCA_RELAY_IP_COUNTRY_DB. Holds only the README otherwise.
+COPY apps/relay/ip-country apps/relay/ip-country
 USER node
 EXPOSE 8080
 CMD ["node", "apps/relay/dist/index.js"]
diff --git a/cloud/apps/relay/ip-country/README.md b/cloud/apps/relay/ip-country/README.md
new file mode 100644
index 00000000000..805691175e7
--- /dev/null
+++ b/cloud/apps/relay/ip-country/README.md
@@ -0,0 +1,12 @@
+# Relay image data
+
+The relay Dockerfile copies this directory into the runtime image at
+`/app/apps/relay/ip-country`. In this repository it holds only this README.
+
+A deployment may stage data files here before it builds the image. The director's
+IP → country table is one: a CSV of `first,last,CC` ranges (IPv4 and IPv6, inclusive,
+optionally gzipped) that `ORCA_RELAY_IP_COUNTRY_DB` names (`src/ip-country.ts`). Nothing
+reads a file here unless that variable points at it, so an image built without the table
+behaves exactly as before.
+
+Whoever stages a third-party table also stages its licence notice next to it.