---
name: expose-fmap-worker
description: Configure frpc to expose a Mac mini worker service through one of the 24 reserved solar-term pinyin HTTPS endpoints under fmap.dev. Use when an agent needs to publish, inspect, restart, or stop a local worker service through the fmap.dev FRP tunnel.
---

# Expose fmap Worker

Use the existing FRP infrastructure. Connect through `frp.fmap.dev:443` over WSS; port 7000 is private to the `i` machine. Do not edit DNS, add Caddy hosts, or introduce a registration service.

The canonical agent-readable copy of these instructions is available at `https://gateway.fmap.dev`.

## Required inputs

- A user-confirmed free name from the reserved list. Do not infer availability from an HTTP response:
  - Spring: `lichun`, `yushui`, `jingzhe`, `chunfen`, `qingming`, `guyu`
  - Summer: `lixia`, `xiaoman`, `mangzhong`, `xiazhi`, `xiaoshu`, `dashu`
  - Autumn: `liqiu`, `chushu`, `bailu`, `qiufen`, `hanlu`, `shuangjiang`
  - Winter: `lidong`, `xiaoxue`, `daxue`, `dongzhi`, `xiaohan`, `dahan`
- The local service port and whether `frpc` reaches it through `127.0.0.1`, a Docker service name, or `host.docker.internal`.
- `FRPS_TOKEN`, supplied through a secret or local environment file. On the designated Mac mini it is stored in `/Users/bencode/.config/frp/fmap.env`. Never print or commit it.

## Configure

1. Verify the local service is reachable from the environment that runs `frpc`.
2. Reuse an existing `frpc` container or installation when present.
3. Load `FRPS_TOKEN` without printing it, then create a mode `0600` TOML configuration with the selected slot:

```toml
serverAddr = "frp.fmap.dev"
serverPort = 443
transport.protocol = "wss"

[auth]
method = "token"
token = "<FRPS_TOKEN>"

[[proxies]]
name = "fmap-lichun"
type = "http"
localIP = "127.0.0.1"
localPort = 3000
subdomain = "lichun"
```

4. Replace `lichun`, `localIP`, and `localPort` with the confirmed values. Keep `subdomain` in the reserved list.
5. Start or restart `frpc` using its existing process manager or Docker Compose service.
6. Check `frpc` logs for a successful proxy registration, then verify its `https://<name>.fmap.dev` URL over HTTPS.

## Stop or change a tunnel

Stop the owning `frpc` process or remove only its matching proxy entry. Confirm the old public URL no longer reaches the local service before reassigning the slot.

## Boundaries

- Treat name assignment as manual coordination; this setup has no registry or locking service.
- Do not use arbitrary `*.fmap.dev` names.
- Do not connect directly to `49.0.200.80:7000`.
- Do not expose the local service port publicly as a substitute for the tunnel.
- If `frps` or Caddy is unavailable, report the failure; do not mutate the `i` machine unless explicitly asked.