feat(fifa17-docker): OPENFUT_SERVERS component selection for staged Py->Rust migration

entrypoint.sh validates/selects among lsx blaze roster utas pow and skips
unselected responders (errors if none). docker-compose threads the env
through; .env.example documents it. Retained pre-existing WIP verified.

fifa17-recon/docker/fifa17-python/.env.example

@@ -9,3 +9,25 @@ OPENFUT_ADVERTISE=203.0.113.10   # <- REPLACE with this host's LAN IP
 # Defaults to 0.0.0.0 (container-facing); the original all-on-localhost flow
 # uses the loopback default baked into the responders when unset.
 OPENFUT_BIND=0.0.0.0
+
+# OPENFUT_SERVERS — which Python responders Docker runs (space/comma separated).
+# Default (unset) = the server-side set: "blaze roster utas pow".
+#
+# This host is the SERVER (.120). Docker runs ONLY components that have NOT been
+# migrated to a Rust host. During migration the Rust hosts (redirector / roster
+# / utas) run OUTSIDE Docker; as each Python component is replaced, remove its
+# name here so the two never serve the same role at once.
+#   blaze   Blaze redirector + main + nucleus (bundled)   :42127 :42130 :42131
+#   roster  FUT roster-update XML                         :8081
+#   utas    FUT/UTAS RS4 API                              :8099
+#           (Rust utas-host still proxies its non-/club routes here for now)
+#   pow     POW / EASFC                                   :8094 (+ content :8080)
+#   lsx     Origin LSX bootstrap                          :4216
+#           CLIENT-SIDE: LSX runs on the game machine (.105) with autopatch, NOT
+#           on this server. Leave it OUT unless client and server share one box.
+#
+# Example — Rust already owns roster, so Docker should not also serve it:
+#   OPENFUT_SERVERS=blaze utas pow
+# When you drop a component, also stop advertising / DNAT'ing its port to this
+# container so the client is routed to the Rust host instead.
+#OPENFUT_SERVERS=blaze roster utas pow

fifa17-recon/docker/fifa17-python/docker-compose.yml

@@ -36,10 +36,14 @@ services:
       FUT_PROFILE_ROOT: "/state/accounts"
       FUT_SETTINGS: "off"
       FUT_MODES: "1"
+      # Which Python responders this SERVER runs. Default excludes lsx (that is
+      # a client-side responder — see below). Drop a name once it is migrated to
+      # a Rust host (run outside Docker) so the two never overlap. See .env.example.
+      OPENFUT_SERVERS: "${OPENFUT_SERVERS:-blaze roster utas pow}"
     volumes:
       - "../state:/state"
     ports:
-      - "4216:4216"      # LSX (Origin bootstrap)
+      - "4216:4216"      # LSX — CLIENT-SIDE (.105); only used if lsx is enabled for all-on-one-box
       - "42127:42127"    # Blaze redirector (TLS)
       - "42130:42130"    # Blaze main
       - "42131:42131"    # Nucleus OAuth stub

fifa17-recon/docker/fifa17-python/entrypoint.sh

@@ -57,10 +57,40 @@ declare -a SERVERS=(
   "pow|pow_server.py|-"
 )
 
+# ── Component selection ──────────────────────────────────────────────────────
+# OPENFUT_SERVERS picks which Python responders run (space- or comma-separated).
+# This container is the SERVER side (.120). It serves ONLY components that have
+# NOT been migrated to a Rust host — as each moves to Rust (which runs OUTSIDE
+# Docker during migration), drop its name so the two never serve the same role.
+#   blaze   Blaze redirector + main + nucleus (bundled)   :42127 :42130 :42131
+#   roster  FUT roster-update XML                         :8081
+#   utas    FUT/UTAS RS4 API                              :8099
+#           (the Rust utas-host currently reverse-proxies its non-/club routes
+#            back here, so keep this enabled until UTAS is fully migrated)
+#   pow     POW / EASFC                                   :8094 (+ content :8080)
+#   lsx     Origin LSX bootstrap                          :4216
+#           CLIENT-SIDE — LSX runs on the game machine (.105) with autopatch,
+#           NOT on the server. Excluded by default; enable ONLY for an
+#           all-on-one-box dev setup where client and server share a host.
+OPENFUT_SERVERS="${OPENFUT_SERVERS:-blaze roster utas pow}"
+want=" ${OPENFUT_SERVERS//,/ } "
+known=" lsx blaze roster utas pow "
+for w in $want; do
+  case "$known" in
+    *" $w "*) ;;
+    *) echo "[openfut] unknown component '$w' in OPENFUT_SERVERS (valid: lsx blaze roster utas pow)" >&2; exit 2 ;;
+  esac
+done
+echo "[openfut] servers=$OPENFUT_SERVERS"
+
 pids=()
 names=()
 for entry in "${SERVERS[@]}"; do
   IFS='|' read -r name script env <<<"$entry"
+  case "$want" in
+    *" $name "*) ;;
+    *) echo "[openfut] skipping $name (not in OPENFUT_SERVERS)"; continue ;;
+  esac
   envprefix=""; [ "$env" != "-" ] && envprefix="env $env"
   echo "[openfut] starting $name ($script)"
   # shellcheck disable=SC2086
@@ -69,6 +99,11 @@ for entry in "${SERVERS[@]}"; do
   names+=("$name")
 done
 
+if [ "${#pids[@]}" -eq 0 ]; then
+  echo "[openfut] OPENFUT_SERVERS selected no components; nothing to run" >&2
+  exit 2
+fi
+
 # Propagate SIGTERM/SIGINT to children so `docker stop` is clean.
 term() {
   echo "[openfut] shutting down…"