Add stac map and stac manager

[pantierra]

No description provided.

[claude]

Claude finished @pantierra's task in 1m 33s —— View job

---

Claude's Review

Todo list

• Gather context (diff, docker-compose, related files)
• Review correctness, security, best-practice issues
• Apply ponytail-review pass for over-engineering
• Post final review

---

✅ No blocking issues — safe to merge.

Reviewed the diff adding stac-map and stac-manager services (docker-compose.yml, docker-compose.hetzner.yml, new Dockerfile.stac-map, Dockerfile.browser tweaks, landing page, env docs).

A couple of non-blocking observations:

• dockerfiles/Dockerfile.browser:20 — RUN sed -i 's///' index.html fails silently if the `` markers aren't present in the checked-out stac-browser ref (e.g. after a future version bump). `sed` won't error on a no-op match, so a future `STAC_BROWSER_REF` bump could silently ship a build without runtime-config injection rather than failing the build. Worth a follow-up comment noting the assumption, or a check that the substitution actually changed the file.
• docker-compose.yml:100 — stac-manager image is pinned by tag and digest (1.0.3@sha256:...), matching the existing convention for stac-auth-proxy. Good consistency; verified the digest is a well-formed 64-char sha256.
• Build-time vs runtime config distinction for stac-map (Vite env vars baked in at image build, not container start) is clearly called out in .env.example, which avoids a common gotcha.

No security issues (no secrets exposed, OIDC client IDs are public-client identifiers as expected, non-root nginx user retained), and no correctness bugs found in the compose wiring (traefik labels/stripprefix/base-path all line up between service and override files).

Simplify (ponytail): nothing to flag — the new Dockerfile and compose blocks follow the same minimal patterns already established by the existing stac-browser/stac-auth-proxy services, no speculative abstraction introduced.

---

💰 Estimated review cost: $0.34 · 1m33s · 16 turns