gemstack-cli 0.1.0

data/templates/auth/frontend/app/forgot-password/page.tsx

@@ -0,0 +1,48 @@
+"use client";
+
+import Link from "next/link";
+import { useState, type FormEvent } from "react";
+import { errorMessage, useForgotPassword } from "@/lib/auth";
+
+export default function ForgotPasswordPage() {
+  const [email, setEmail] = useState("");
+  const forgot = useForgotPassword();
+
+  function handleSubmit(event: FormEvent<HTMLFormElement>) {
+    event.preventDefault();
+    forgot.mutate(email);
+  }
+
+  if (forgot.isSuccess) {
+    return (
+      <main className="page">
+        <h1>Check your email</h1>
+        <p>If an account exists for {email}, we sent it a link to choose a new password.</p>
+        <Link href="/login">Back to log in</Link>
+      </main>
+    );
+  }
+
+  const message = errorMessage(forgot.error);
+  return (
+    <main className="page">
+      <h1>Reset your password</h1>
+      <form className="form" onSubmit={handleSubmit}>
+        <label className="field">
+          Email
+          <input type="email" autoComplete="email" required value={email} onChange={(e) => setEmail(e.target.value)} />
+        </label>
+        {message && (
+          <p className="form-error" role="alert">
+            {message}
+          </p>
+        )}
+        <div className="actions">
+          <button className="button" type="submit" disabled={forgot.isPending}>
+            Send reset link
+          </button>
+        </div>
+      </form>
+    </main>
+  );
+}

data/templates/auth/frontend/app/login/page.tsx

@@ -0,0 +1,26 @@
+"use client";
+
+import Link from "next/link";
+import { useRouter } from "next/navigation";
+import { CredentialsForm } from "@/components/auth/CredentialsForm";
+import { useLogin } from "@/lib/auth";
+
+export default function LoginPage() {
+  const router = useRouter();
+  const login = useLogin();
+
+  return (
+    <main className="page">
+      <h1>Log in</h1>
+      <CredentialsForm
+        submitLabel="Log in"
+        error={login.error}
+        pending={login.isPending}
+        onSubmit={(credentials) => login.mutate(credentials, { onSuccess: () => router.push("/account") })}
+      />
+      <p className="muted">
+        <Link href="/forgot-password">Forgot your password?</Link> · No account? <Link href="/signup">Sign up</Link>
+      </p>
+    </main>
+  );
+}

data/templates/auth/frontend/app/reset-password/page.tsx

@@ -0,0 +1,11 @@
+import { ResetPasswordForm } from "@/components/auth/ResetPasswordForm";
+
+export default async function ResetPasswordPage({ searchParams }: { searchParams: Promise<{ token?: string }> }) {
+  const { token } = await searchParams;
+  return (
+    <main className="page">
+      <h1>Choose a new password</h1>
+      {token ? <ResetPasswordForm token={token} /> : <p className="form-error">This link is missing its token.</p>}
+    </main>
+  );
+}

data/templates/auth/frontend/app/signup/page.tsx

@@ -0,0 +1,27 @@
+"use client";
+
+import Link from "next/link";
+import { useRouter } from "next/navigation";
+import { CredentialsForm } from "@/components/auth/CredentialsForm";
+import { useSignup } from "@/lib/auth";
+
+export default function SignupPage() {
+  const router = useRouter();
+  const signup = useSignup();
+
+  return (
+    <main className="page">
+      <h1>Create an account</h1>
+      <CredentialsForm
+        submitLabel="Sign up"
+        newPassword
+        error={signup.error}
+        pending={signup.isPending}
+        onSubmit={(credentials) => signup.mutate(credentials, { onSuccess: () => router.push("/account") })}
+      />
+      <p className="muted">
+        Already have an account? <Link href="/login">Log in</Link>
+      </p>
+    </main>
+  );
+}

data/templates/auth/frontend/app/verify-email/page.tsx

@@ -0,0 +1,11 @@
+import { VerifyEmail } from "@/components/auth/VerifyEmail";
+
+export default async function VerifyEmailPage({ searchParams }: { searchParams: Promise<{ token?: string }> }) {
+  const { token } = await searchParams;
+  return (
+    <main className="page">
+      <h1>Confirm your email</h1>
+      {token ? <VerifyEmail token={token} /> : <p className="form-error">This link is missing its token.</p>}
+    </main>
+  );
+}

data/templates/auth/frontend/components/auth/CredentialsForm.tsx

@@ -0,0 +1,58 @@
+"use client";
+
+import { useState, type FormEvent } from "react";
+import { errorMessage, type Credentials } from "@/lib/auth";
+
+export function CredentialsForm({
+  submitLabel,
+  newPassword = false,
+  error,
+  pending,
+  onSubmit,
+}: {
+  submitLabel: string;
+  newPassword?: boolean;
+  error: unknown;
+  pending: boolean;
+  onSubmit: (credentials: Credentials) => void;
+}) {
+  const [email, setEmail] = useState("");
+  const [password, setPassword] = useState("");
+
+  function handleSubmit(event: FormEvent<HTMLFormElement>) {
+    event.preventDefault();
+    onSubmit({ email, password });
+  }
+
+  const message = errorMessage(error);
+  return (
+    <form className="form" onSubmit={handleSubmit}>
+      <label className="field">
+        Email
+        <input type="email" autoComplete="email" required value={email} onChange={(e) => setEmail(e.target.value)} />
+      </label>
+      <label className="field">
+        Password
+        <input
+          type="password"
+          autoComplete={newPassword ? "new-password" : "current-password"}
+          minLength={newPassword ? 12 : undefined}
+          required
+          value={password}
+          onChange={(e) => setPassword(e.target.value)}
+        />
+        {newPassword && <small className="muted">At least 12 characters. A few random words work well.</small>}
+      </label>
+      {message && (
+        <p className="form-error" role="alert">
+          {message}
+        </p>
+      )}
+      <div className="actions">
+        <button className="button" type="submit" disabled={pending}>
+          {pending ? "Please wait…" : submitLabel}
+        </button>
+      </div>
+    </form>
+  );
+}

data/templates/auth/frontend/components/auth/ResetPasswordForm.tsx

@@ -0,0 +1,43 @@
+"use client";
+
+import { useRouter } from "next/navigation";
+import { useState, type FormEvent } from "react";
+import { errorMessage, useResetPassword } from "@/lib/auth";
+
+export function ResetPasswordForm({ token }: { token: string }) {
+  const router = useRouter();
+  const [password, setPassword] = useState("");
+  const reset = useResetPassword();
+
+  function handleSubmit(event: FormEvent<HTMLFormElement>) {
+    event.preventDefault();
+    reset.mutate({ token, password }, { onSuccess: () => router.push("/account") });
+  }
+
+  const message = errorMessage(reset.error);
+  return (
+    <form className="form" onSubmit={handleSubmit}>
+      <label className="field">
+        New password
+        <input
+          type="password"
+          autoComplete="new-password"
+          minLength={12}
+          required
+          value={password}
+          onChange={(e) => setPassword(e.target.value)}
+        />
+      </label>
+      {message && (
+        <p className="form-error" role="alert">
+          {message}
+        </p>
+      )}
+      <div className="actions">
+        <button className="button" type="submit" disabled={reset.isPending}>
+          Save password
+        </button>
+      </div>
+    </form>
+  );
+}

data/templates/auth/frontend/components/auth/VerifyEmail.tsx

@@ -0,0 +1,28 @@
+"use client";
+
+import Link from "next/link";
+import { useEffect, useRef } from "react";
+import { errorMessage, useVerifyEmail } from "@/lib/auth";
+
+// Confirms on load. Links in emails are opened with GET, so the page posts
+// the token — a mail scanner prefetching the link can't use it up.
+export function VerifyEmail({ token }: { token: string }) {
+  const verify = useVerifyEmail();
+  const started = useRef(false);
+
+  useEffect(() => {
+    if (started.current) return;
+    started.current = true;
+    verify.mutate(token);
+  }, [token, verify]);
+
+  if (verify.isSuccess) {
+    return (
+      <p>
+        Your email address is confirmed. <Link href="/account">Continue</Link>
+      </p>
+    );
+  }
+  if (verify.isError) return <p className="form-error">{errorMessage(verify.error)}</p>;
+  return <p className="muted">Confirming…</p>;
+}

data/templates/auth/frontend/lib/auth.ts

@@ -0,0 +1,113 @@
+"use client";
+
+// Authentication hooks (generated by `gemstack add auth`). The session lives
+// in an HttpOnly cookie the browser sends automatically — JavaScript never
+// sees it, so there is no token to store or leak.
+import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
+import { ApiError } from "@/lib/gemstack/client";
+import { apiTokens, emailVerifications, passwordResets, registrations, sessions } from "@/lib/api/generated";
+import type { SessionCreateInput, User } from "@/lib/api/generated";
+
+export const authKeys = { me: ["auth", "me"] as const, tokens: ["auth", "tokens"] as const };
+
+export type Credentials = SessionCreateInput;
+
+/** The signed-in user, or null when signed out. */
+export function useCurrentUser() {
+  return useQuery({
+    queryKey: authKeys.me,
+    queryFn: async () => {
+      try {
+        return await sessions.get();
+      } catch (error) {
+        if (error instanceof ApiError && error.status === 401) return null;
+        throw error;
+      }
+    },
+    staleTime: 60_000,
+  });
+}
+
+function useSignedIn() {
+  const queryClient = useQueryClient();
+  return (user: User) => {
+    queryClient.setQueryData(authKeys.me, user);
+    // Anything cached belonged to the previous (or no) user.
+    return queryClient.invalidateQueries({ predicate: (query) => query.queryKey[0] !== "auth" });
+  };
+}
+
+export function useLogin() {
+  const signedIn = useSignedIn();
+  return useMutation({ mutationFn: (input: Credentials) => sessions.create(input), onSuccess: signedIn });
+}
+
+export function useSignup() {
+  const signedIn = useSignedIn();
+  return useMutation({ mutationFn: (input: Credentials) => registrations.create(input), onSuccess: signedIn });
+}
+
+export function useLogout() {
+  const queryClient = useQueryClient();
+  return useMutation({
+    mutationFn: () => sessions.delete(),
+    onSuccess: () => {
+      queryClient.clear();
+      queryClient.setQueryData(authKeys.me, null);
+    },
+  });
+}
+
+export function useForgotPassword() {
+  return useMutation({ mutationFn: (email: string) => passwordResets.create({ email }) });
+}
+
+export function useResetPassword() {
+  const signedIn = useSignedIn();
+  return useMutation({
+    mutationFn: (input: { token: string; password: string }) => passwordResets.update(input),
+    onSuccess: signedIn,
+  });
+}
+
+export function useVerifyEmail() {
+  const queryClient = useQueryClient();
+  return useMutation({
+    mutationFn: (token: string) => emailVerifications.update({ token }),
+    onSuccess: () => queryClient.invalidateQueries({ queryKey: authKeys.me }),
+  });
+}
+
+export function useResendVerification() {
+  return useMutation({ mutationFn: () => emailVerifications.create() });
+}
+
+export function useApiTokens() {
+  return useQuery({ queryKey: authKeys.tokens, queryFn: () => apiTokens.list() });
+}
+
+export function useCreateApiToken() {
+  const queryClient = useQueryClient();
+  return useMutation({
+    mutationFn: (name: string) => apiTokens.create({ name }),
+    onSuccess: () => queryClient.invalidateQueries({ queryKey: authKeys.tokens }),
+  });
+}
+
+export function useRevokeApiToken() {
+  const queryClient = useQueryClient();
+  return useMutation({
+    mutationFn: (id: number) => apiTokens.delete(id),
+    onSuccess: () => queryClient.invalidateQueries({ queryKey: authKeys.tokens }),
+  });
+}
+
+/** A readable message for a failed auth request. */
+export function errorMessage(error: unknown): string | null {
+  if (!error) return null;
+  if (error instanceof ApiError) {
+    const fields = Object.entries(error.errors).map(([field, messages]) => `${field} ${messages.join(", ")}`);
+    return fields.length ? fields.join(". ") : error.message;
+  }
+  return "Something went wrong. Please try again.";
+}

data/templates/auth/test/controllers/auth_test.rb

@@ -0,0 +1,108 @@
+# frozen_string_literal: true
+
+require_relative "../test_helper"
+
+# The authentication flows generated by `gemstack add auth`.
+class AuthTest < GemStack::TestCase
+  PASSWORD = "correct horse battery staple"
+
+  def create_user(email = "ada@example.com") = User.create(email: email, password: PASSWORD)
+  def token_from(mail) = mail.text_part.decoded[/token=([\w-]+)/, 1]
+
+  def test_signup_signs_in_and_sends_a_verification_email
+    assert_emails(1) { post_json "/api/auth/signup", { email: "Ada@Example.com", password: PASSWORD } }
+
+    assert_status 201
+    assert_equal "ada@example.com", json_body["email"]
+    refute json_body.key?("password_digest")
+    assert_equal ["ada@example.com"], last_email.to
+    get_json "/api/auth/me"
+
+    assert_status 200
+  end
+
+  def test_signup_validation
+    create_user
+    post_json "/api/auth/signup", { email: "ada@example.com", password: "short" }
+
+    assert_error 422, "validation_failed"
+    assert_equal ["is already taken"], json_body["errors"]["email"]
+    assert_equal ["is too short (minimum 12 characters)"], json_body["errors"]["password"]
+  end
+
+  def test_login_me_logout
+    user = create_user
+    post_json "/api/auth/login", { email: "ADA@example.com", password: PASSWORD }
+
+    assert_status 200
+    get_json "/api/auth/me"
+
+    assert_equal user.id, json_body["id"]
+    delete_json "/api/auth/logout"
+
+    assert_status 204
+    get_json "/api/auth/me"
+
+    assert_error 401, "unauthenticated"
+  end
+
+  def test_login_failures_look_the_same
+    create_user
+    post_json "/api/auth/login", { email: "ada@example.com", password: "wrong password!" }
+    wrong_password = json_body
+    post_json "/api/auth/login", { email: "nobody@example.com", password: PASSWORD }
+
+    assert_error 401, "invalid_credentials"
+    assert_equal wrong_password["error"]["message"], json_body["error"]["message"]
+  end
+
+  def test_password_reset
+    user = create_user
+    other_device = GemStack::Auth::Sessions.create(user.id)
+    assert_emails(1) { post_json "/api/auth/password/forgot", { email: user.email } }
+
+    assert_status 202
+    post_json "/api/auth/password/reset", { token: token_from(last_email), password: "a brand new passphrase" }
+
+    assert_status 200
+    assert User.authenticate_by(email: user.email, password: "a brand new passphrase")
+    assert_nil GemStack::Auth::Sessions.find(other_device), "other sessions end"
+    post_json "/api/auth/password/reset", { token: token_from(last_email), password: "and another one!!" }
+
+    assert_error 400, "invalid_token"
+  end
+
+  def test_forgot_password_does_not_reveal_accounts
+    assert_emails(0) { post_json "/api/auth/password/forgot", { email: "nobody@example.com" } }
+
+    assert_status 202
+  end
+
+  def test_email_verification
+    user = create_user
+    sign_in_as(user)
+    assert_emails(1) { post_json "/api/auth/email/resend" }
+    post_json "/api/auth/email/verify", { token: token_from(last_email) }
+
+    assert_status 204
+    assert User[user.id].email_verified?
+  end
+
+  def test_api_tokens
+    user = create_user
+    sign_in_as(user)
+    post_json "/api/auth/tokens", { name: "CI" }
+
+    assert_status 201
+    token = json_body["token"]
+    get_json "/api/auth/me", {}, { "HTTP_AUTHORIZATION" => "Bearer #{token}" }
+
+    assert_equal user.id, json_body["id"]
+    get_json "/api/auth/tokens"
+
+    assert_equal ["CI"], json_body.map { |t| t["name"] }
+    delete_json "/api/auth/tokens/#{json_body.first["id"]}"
+
+    assert_status 204
+  end
+end

data/templates/controller/app/controllers/%file_name%_controller.rb.tt

@@ -0,0 +1,10 @@
+# frozen_string_literal: true
+
+class <%= class_name %> < ApplicationController
+<% actions.each_with_index do |action, index| -%>
+<%= "\n" if index.positive? %>  # <%= route_for(action)[0].upcase %> /api<%= route_for(action)[1] %>
+  def <%= action %>
+    render({ action: "<%= file_name %>#<%= action %>" })
+  end
+<% end -%>
+end

data/templates/controller/test/controllers/%file_name%_controller_test.rb.tt

@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+require_relative "<%= "../" * (file_name.count("/") + 1) %>test_helper"
+
+class <%= class_name %>Test < GemStack::TestCase
+<% actions.each_with_index do |action, index| -%>
+<%= "\n" if index.positive? %>  def test_<%= action %>
+    <%= route_for(action)[0] %>_json "<%= request_path(action) %>"
+
+    assert_status 200
+    assert_equal({ "action" => "<%= file_name %>#<%= action %>" }, json_body)
+  end
+<% end -%>
+end

data/templates/deploy/Caddyfile.tt

@@ -0,0 +1,19 @@
+# One public origin: /api/* → Ruby, everything else → Next.js (docs/deployment.md).
+# SITE_ADDRESS=example.com gets a Let's Encrypt certificate automatically;
+# "localhost" uses Caddy's local CA (trust it with `caddy trust`, or curl -k).
+{$SITE_ADDRESS:localhost} {
+	encode zstd gzip
+
+	handle /api/* {
+		reverse_proxy api:4000 {
+			# Server-Sent Events: stream responses immediately.
+			flush_interval -1
+		}
+	}
+<% if frontend? -%>
+
+	handle {
+		reverse_proxy web:3000
+	}
+<% end -%>
+}

data/templates/deploy/Dockerfile.tt

@@ -0,0 +1,62 @@
+# syntax=docker/dockerfile:1
+# Production images for <%= app_name %> (gemstack generate deploy — docs/deployment.md).
+#
+#   docker build --target api -t <%= app_name %>-api .     # Ruby API (Puma), also runs jobs and migrations
+<% if frontend? -%>
+#   docker build --target web -t <%= app_name %>-web .     # Next.js
+<% end -%>
+#
+# Configuration comes from the environment at runtime (SECRET_KEY_BASE,
+# DATABASE_URL, …); nothing secret is baked into the images.
+
+ARG RUBY_VERSION=<%= ruby_version %>
+ARG NODE_VERSION=<%= node_version %>
+
+# ── Ruby API ────────────────────────────────────────────────────────────────
+FROM ruby:${RUBY_VERSION}-slim AS api-build
+RUN apt-get update -qq && apt-get install --no-install-recommends -y build-essential libpq-dev libyaml-dev git \
+    && rm -rf /var/lib/apt/lists/*
+WORKDIR /app
+ENV BUNDLE_DEPLOYMENT=1 BUNDLE_WITHOUT="development:test" BUNDLE_PATH=/usr/local/bundle
+COPY Gemfile Gemfile.lock ./
+COPY vendor/ ./vendor/
+RUN bundle install --jobs 4 && rm -rf /usr/local/bundle/cache "${BUNDLE_PATH}"/ruby/*/cache
+COPY . .
+RUN rm -rf frontend tmp/* log/* .env*
+
+FROM ruby:${RUBY_VERSION}-slim AS api
+RUN apt-get update -qq && apt-get install --no-install-recommends -y libpq5 libyaml-0-2 curl \
+    && rm -rf /var/lib/apt/lists/* \
+    && groupadd --system --gid 1000 app && useradd --system --uid 1000 --gid app --create-home app
+WORKDIR /app
+ENV GEMSTACK_ENV=production BUNDLE_DEPLOYMENT=1 BUNDLE_WITHOUT="development:test" BUNDLE_PATH=/usr/local/bundle \
+    GEMSTACK_API_HOST=0.0.0.0 GEMSTACK_API_PORT=4000
+COPY --from=api-build /usr/local/bundle /usr/local/bundle
+COPY --from=api-build --chown=app:app /app /app
+USER app
+EXPOSE 4000
+HEALTHCHECK --interval=10s --timeout=3s --start-period=20s CMD curl -fsS http://127.0.0.1:4000/api/health || exit 1
+# Other processes use the same image: `bundle exec gemstack jobs`, `bundle exec gemstack db:migrate`.
+CMD ["bundle", "exec", "puma", "-C", "config/puma.rb"]
+<% if frontend? -%>
+
+# ── Next.js ─────────────────────────────────────────────────────────────────
+FROM node:${NODE_VERSION}-slim AS web-build
+WORKDIR /app
+COPY frontend/package.json frontend/package-lock.json ./
+RUN npm ci
+COPY frontend/ ./
+ENV NEXT_TELEMETRY_DISABLED=1
+# GEMSTACK_API_URL is only needed here when Next.js proxies /api itself (no reverse proxy in front).
+ARG GEMSTACK_API_URL
+ENV GEMSTACK_API_URL=${GEMSTACK_API_URL}
+RUN npm run build && npm prune --omit=dev
+
+FROM node:${NODE_VERSION}-slim AS web
+WORKDIR /app
+ENV NODE_ENV=production NEXT_TELEMETRY_DISABLED=1 PORT=3000
+COPY --from=web-build --chown=node:node /app ./
+USER node
+EXPOSE 3000
+CMD ["npm", "start"]
+<% end -%>

data/templates/deploy/Procfile.tt

@@ -0,0 +1,6 @@
+# Process types for Procfile platforms (Heroku, Render, Railway, Dokku…) — docs/deployment.md.
+release: bundle exec gemstack db:migrate
+web: GEMSTACK_API_PORT=${PORT:-4000} bundle exec puma -C config/puma.rb
+<% if jobs? -%>
+worker: bundle exec gemstack jobs
+<% end -%>

data/templates/deploy/compose.yaml.tt

@@ -0,0 +1,80 @@
+# Runs <%= app_name %> in production mode on this machine, behind Caddy on https://localhost:
+#
+#   export SECRET_KEY_BASE=$(openssl rand -hex 64) POSTGRES_PASSWORD=$(openssl rand -hex 16)
+#   docker compose up --build
+#
+# It's also a map of what a real deploy needs: one image per process type,
+# migrations before the API starts, and a proxy sending /api to Ruby.
+name: <%= app_name.tr("_", "-") %>
+
+x-api-env: &api-env
+  GEMSTACK_ENV: production
+  SECRET_KEY_BASE: ${SECRET_KEY_BASE:?set SECRET_KEY_BASE (openssl rand -hex 64)}
+  DATABASE_URL: postgres://app:${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD}@db:5432/app
+  APP_URL: ${APP_URL:-https://localhost}
+<% if mail? -%>
+  SMTP_URL: ${SMTP_URL:-}   # e.g. smtp://user:pass@smtp.example.com:587 — emails retry until it is set
+  MAIL_FROM: ${MAIL_FROM:-}
+<% end -%>
+
+services:
+  db:
+    image: postgres:17
+    environment:
+      POSTGRES_USER: app
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD}
+      POSTGRES_DB: app
+    volumes: [db:/var/lib/postgresql/data]
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U app -d app"]
+      interval: 2s
+      retries: 30
+
+  migrate:
+    image: <%= app_name %>-api
+    build: { context: ., target: api }
+    healthcheck: { disable: true }
+    command: ["bundle", "exec", "gemstack", "db:migrate"]
+    environment: *api-env
+    depends_on: { db: { condition: service_healthy } }
+
+  api:
+    image: <%= app_name %>-api
+    build: { context: ., target: api }
+    environment:
+      <<: *api-env
+      WEB_CONCURRENCY: ${WEB_CONCURRENCY:-2}
+    depends_on: { migrate: { condition: service_completed_successfully } }
+<% if jobs? -%>
+
+  jobs:
+    image: <%= app_name %>-api
+    build: { context: ., target: api }
+    healthcheck: { disable: true }
+    command: ["bundle", "exec", "gemstack", "jobs"]
+    environment: *api-env
+    depends_on: { migrate: { condition: service_completed_successfully } }
+<% end -%>
+<% if frontend? -%>
+
+  web:
+    image: <%= app_name %>-web
+    build: { context: ., target: web }
+    environment:
+      GEMSTACK_API_URL: http://api:4000 # Server Components call the API directly
+    depends_on: [api]
+<% end -%>
+
+  proxy:
+    image: caddy:2
+    ports: ["80:80", "443:443"]
+    environment:
+      SITE_ADDRESS: ${SITE_ADDRESS:-localhost}
+    volumes:
+      - ./Caddyfile:/etc/caddy/Caddyfile:ro
+      - caddy:/data
+    depends_on: [api<%= ", web" if frontend? %>]
+
+volumes:
+  db:
+  caddy: