gemstack 0.3.4 → 0.3.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3aad267b7791a6ed292930136454e90238f3ccacb61ac93fcf9e9cbd4d13a1e2
-  data.tar.gz: d2a196ec3a4cf3fc652a7f8eba101ed02b48ddba87d53ed079835680ba65f890
+  metadata.gz: 30c68d4db704acae059c66f9847b0158ad178ebd7da1368c37056e5b93232306
+  data.tar.gz: 2b65b33d1e415354038e4f4bac03556196af8d95fc01f144c7a53e97d95527b1
 SHA512:
-  metadata.gz: cab7c1fa05b4d071574044a98df461ccfdcb3050df12927ebf780c5b45a8b3eaa649b1fbb089e217986efc86b5aa35131dcfea4bbf5ca4491f6c17ec65f991bd
-  data.tar.gz: 4dd5583fd43c3b2f750748e8d754c313d10089eeab9ab0ad0245999a4e7790a9db58eb151065414401505ba243ea060074712d17ac36a146cd4976089fffd393
+  metadata.gz: 9939a8e3bd4fb59fc2794ae86b66fc05751f8aa6463a4cd637cc8cd575ba300c2d824c02a4a245cda0a3b666e0107ab383f7e5a16499dffafda152e433b02448
+  data.tar.gz: 389c35595446d6c96ac811be7a978e019bb310e7cb03570b7e04033e1f2a3fda682cbecb1b1e513409933b18b5d6322375175ddc324ec23270a6a78308676af7

data/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 0.3.5
+
+See the [GemStack changelog](https://github.com/gemstack-rb/gemstack/blob/main/CHANGELOG.md).
+
+## 0.3.4
+
+See the [GemStack changelog](https://github.com/gemstack-rb/gemstack/blob/main/CHANGELOG.md).
+
 ## 0.3.3
 
 See the [GemStack changelog](https://github.com/gemstack-rb/gemstack/blob/main/CHANGELOG.md).

data/lib/gemstack/cli/deploy_generator.rb

@@ -2,16 +2,25 @@
 
 module GemStack
   class CLI < Thor
-    # `gemstack generate deploy` — Dockerfile (api + web targets), compose.yaml
-    # (Postgres, migrations, API, jobs, Next.js, Caddy), Caddyfile, Procfile and
-    # .dockerignore. Nothing is deployed anywhere.
+    # `gemstack generate deploy` — a Kamal setup: one Dockerfile image for every
+    # process, config/deploy.yml (web, api and jobs roles; kamal-proxy routes /api
+    # to Ruby and handles HTTPS; database accessories), .kamal/secrets,
+    # bin/docker-entrypoint and .dockerignore. Nothing is deployed anywhere.
     class DeployGenerator < Generator
       def initialize(root:, output: $stdout, force: false)
         super(output: output, force: force)
         @root = root
       end
 
+      KAMAL_GEM = %(gem "kamal", require: false, group: :development # bundle exec kamal deploy (config/deploy.yml)\n)
+      # The image runs Next.js's standalone server (node frontend/server.js); the
+      # Dockerfile asks for that build with GEMSTACK_NEXT_OUTPUT=standalone.
+      STANDALONE = %(  output: process.env.GEMSTACK_NEXT_OUTPUT === "standalone" ? "standalone" : undefined,\n)
+
       def app_name = File.basename(@root).downcase.gsub(/[^a-z0-9_-]/, "-")
+      # Kamal service and container names (also DNS names on the server).
+      def service = app_name.tr("_", "-")
+      def database_name = "#{app_name.tr("-", "_")}_production"
       def frontend? = File.file?(File.join(@root, "frontend/package.json"))
 
       # A worker process is needed for background jobs (and auth's emails).
@@ -50,16 +59,10 @@ module GemStack
       end
 
       def runtime_packages
-        (%w[libyaml-0-2
-            curl] + { "postgresql" => ["libpq5"], "mysql2" => ["libmariadb3"] }.fetch(database_adapter, [])).join(" ")
-      end
-
-      def database_url
-        case database_adapter
-        when "sqlite3" then "sqlite3:/data/production.sqlite3"
-        when "postgresql" then "postgres://app:${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD}@db:5432/app"
-        else "#{database_adapter}://app:${MYSQL_PASSWORD:?set MYSQL_PASSWORD}@db:3306/app"
-        end
+        packages = %w[libyaml-0-2 curl] +
+                   { "postgresql" => ["libpq5"], "mysql2" => ["libmariadb3"] }.fetch(database_adapter, [])
+        packages << "libstdc++6" if frontend? # Node.js
+        packages.join(" ")
       end
 
       def ruby_version
@@ -77,10 +80,12 @@ module GemStack
         template_files("deploy", override_root: @root).sort.each do |rel, source|
           content = File.read(source)
           content = render(content, source) if rel.end_with?(".tt")
-          write(File.join(@root, output_path(rel.delete_suffix(".tt"))), content)
+          write(File.join(@root, output_path(rel.delete_suffix(".tt"))), content, mode: File.stat(source).mode)
         end
         keep = File.join(@root, "vendor/.keep")
         write(keep, "") unless File.exist?(keep) # the Dockerfile copies vendor/ (e.g. vendor/cache)
+        add_kamal_gem
+        enable_standalone_frontend if frontend?
         warn_about_local_gems
         self
       end
@@ -89,6 +94,30 @@ module GemStack
 
       def gemfile = @gemfile ||= File.read(File.join(@root, "Gemfile"))
 
+      def add_kamal_gem
+        path = File.join(@root, "Gemfile")
+        return status("identical", path, "kamal") if gemfile.match?(/^\s*gem ["']kamal["']/)
+
+        File.write(path, "#{gemfile.chomp}\n\n#{KAMAL_GEM}")
+        status("gem", path, "kamal — run bundle install")
+      end
+
+      def enable_standalone_frontend
+        path = File.join(@root, "frontend/next.config.ts")
+        return unless File.file?(path)
+
+        config = File.read(path)
+        return status("identical", path, "standalone output") if config.include?("GEMSTACK_NEXT_OUTPUT")
+
+        updated = config.sub(/^const nextConfig: NextConfig = \{\n/) { |open| open + STANDALONE }
+        if updated == config
+          return status("warning", path, "add `output: \"standalone\"` for the Docker build (docs/deployment.md)")
+        end
+
+        File.write(path, updated)
+        status("update", path, "standalone output for the Docker build")
+      end
+
       # Apps generated from a GemStack checkout point at it with an absolute
       # path, which doesn't exist inside the image.
       def warn_about_local_gems

data/lib/gemstack/cli/doctor/secret_checks.rb

@@ -0,0 +1,49 @@
+# frozen_string_literal: true
+
+module GemStack
+  class CLI < Thor
+    class Doctor
+      # Secrets must never be committed: no secret files tracked by git, and
+      # .kamal/secrets (which is committed) may only reference secrets
+      # ($NAME, $(kamal secrets fetch …)); a value written in place is a leak.
+      module SecretChecks
+        def check_git_secrets
+          return unless File.directory?(path(".git"))
+
+          out, status = @run.call("git", "-C", @root, "ls-files", "--", ".env", ".env.*", "*.pem", "*.key",
+                                  "tmp/*_secret")
+          return unless status.success?
+
+          tracked = out.lines.map(&:strip).reject { |file| file.empty? || file.end_with?(".example") }
+          if tracked.empty?
+            pass("no secret files tracked by git")
+          else
+            problem("secret files tracked by git: #{tracked.join(", ")}",
+                    "remove them from git (git rm --cached …), rotate every secret they contain, and ask whoever " \
+                    "manages your infrastructure to check where the repository was shared")
+          end
+        end
+
+        def check_kamal_secrets
+          content = read(".kamal/secrets")
+          return unless content
+
+          literal = content.lines.filter_map do |line|
+            name, value = line.strip.split("=", 2)
+            next if name.nil? || name.start_with?("#") || value.nil?
+
+            value = value.strip.delete_prefix('"').delete_suffix('"').delete_prefix("'").delete_suffix("'")
+            name unless value.empty? || value.include?("$")
+          end
+          if literal.empty?
+            pass(".kamal/secrets only references secrets")
+          else
+            problem(".kamal/secrets contains secret values: #{literal.join(", ")}",
+                    "replace each with a reference (NAME=$NAME, or $(kamal secrets fetch …)), rotate those " \
+                    "secrets, and ask whoever manages your infrastructure to check where the repository was shared")
+          end
+        end
+      end
+    end
+  end
+end

data/lib/gemstack/cli/doctor.rb

@@ -4,6 +4,7 @@ require "open3"
 require "socket"
 require "gemstack/dev"
 require_relative "doctor/upgrade_check"
+require_relative "doctor/secret_checks"
 
 module GemStack
   class CLI < Thor
@@ -13,6 +14,7 @@ module GemStack
     # deploy needs.
     class Doctor
       include UpgradeCheck
+      include SecretChecks
 
       Result = Struct.new(:status, :title, :hint)
 
@@ -33,6 +35,7 @@ module GemStack
         check_node
         check_frontend_dependencies
         check_git_secrets
+        check_kamal_secrets
         check_gemstack_upgrade
         booted = check_boot
         if booted
@@ -98,23 +101,6 @@ module GemStack
       end
 
       # Secrets committed to git stay in its history (and in every clone).
-      def check_git_secrets
-        return unless File.directory?(path(".git"))
-
-        out, status = @run.call("git", "-C", @root, "ls-files", "--", ".env", ".env.*", "*.pem", "*.key",
-                                "tmp/*_secret")
-        return unless status.success?
-
-        tracked = out.lines.map(&:strip).reject { |file| file.empty? || file.end_with?(".example") }
-        if tracked.empty?
-          pass("no secret files tracked by git")
-        else
-          problem("secret files tracked by git: #{tracked.join(", ")}",
-                  "remove them from git (git rm --cached …), rotate every secret they contain, and ask whoever " \
-                  "manages your infrastructure to check where the repository was shared")
-        end
-      end
-
       def check_boot
         ENV["GEMSTACK_ENV"] = "production" if @production
         ENV["GEMSTACK_ENV"] ||= "development"

data/lib/gemstack/cli/helpers.rb

@@ -0,0 +1,88 @@
+# frozen_string_literal: true
+
+module GemStack
+  class CLI < Thor
+    # The `generate` command's helpers (kept out of cli.rb for length); nested in
+    # CLI so the generator classes (ResourceSpec, ResourceGenerator, …) resolve.
+    module Helpers
+      # -e ENV, else GEMSTACK_ENV, else development.
+      def use_environment!
+        ENV["GEMSTACK_ENV"] = options[:environment] || ENV["GEMSTACK_ENV"] || "development"
+      end
+
+      def generate_model(root, name, args)
+        abort("Usage: gemstack generate model NAME field:type ...") unless name && !args.empty?
+        spec = ResourceSpec.new(name, args)
+        ResourceGenerator.new(
+          spec,
+          root: root,
+          parts: %i[migration model serializer],
+          tests: !options[:skip_tests],
+          force: options[:force]
+        ).run
+        say("\nNext: gemstack db:migrate")
+      end
+
+      def generate_job(root, name, args)
+        abort("Usage: gemstack generate job NAME [QUEUE]") unless name
+        JobGenerator.new(name, queue: args.first, root: root, force: options[:force]).run
+        say("\nNext: gemstack db:migrate (first job only) · #{Inflector.camelize(name)}.perform_later(...)")
+      end
+
+      def generate_policy(root, name)
+        abort("Usage: gemstack generate policy MODEL") unless name
+        PolicyGenerator.new(name, root: root, force: options[:force]).run
+        say("\nNext: authorize!(record) and policy_scope(#{Inflector.camelize(name)}) in controllers")
+      end
+
+      def generate_resource(root, name, args)
+        abort("Usage: gemstack generate resource NAME field:type ...") unless name
+        abort("--api-only and --frontend-only can't be combined") if options[:api_only] && options[:frontend_only]
+        interactive = args.empty? && $stdin.tty?
+        args = ask("Fields (e.g. name:string price:decimal description:text:optional):").split if interactive
+        abort("Give at least one field, e.g. `gemstack generate resource #{name} name:string`") if args.empty?
+
+        spec = ResourceSpec.new(name, args, actions: resource_actions(interactive))
+        parts = resource_parts(root, interactive)
+        tests = !options[:skip_tests] && (!interactive || yes?("Generate tests? [Y/n]"))
+        ResourceGenerator.new(spec, root: root, parts: parts, tests: tests, force: options[:force]).run
+        refresh_contract(root) unless options[:skip_contract]
+        page = " · open http://localhost:3000/#{spec.url_segment}" if parts.include?(:frontend)
+        say("\nNext: gemstack db:migrate#{page}")
+      end
+
+      def resource_parts(root, interactive)
+        parts = options[:frontend_only] ? [] : %i[migration model serializer controller]
+        frontend = File.directory?(File.join(root, "frontend")) && !options[:api_only]
+        frontend &&= yes?("Generate Next.js pages? [Y/n]") if interactive
+        frontend ? parts + [:frontend] : parts
+      end
+
+      def resource_actions(interactive)
+        return options[:actions].split(",").map(&:strip) if options[:actions]
+        return ResourceSpec::REST_ACTIONS if !interactive || yes?("Generate the full CRUD API? [Y/n]")
+
+        ask("Actions (comma-separated from #{ResourceSpec::REST_ACTIONS.join(",")}):").split(",").map(&:strip)
+      end
+
+      # Thor's yes? only accepts y/yes; treat an empty answer as "yes".
+      def yes?(question)
+        answer = ask(question).strip.downcase
+        answer.empty? || %w[y yes].include?(answer)
+      end
+
+      # Regenerates TypeScript types/clients in the app's own bundle.
+      def refresh_contract(root)
+        say("  #{"run".rjust(9)}  gemstack contract")
+        ok = (defined?(Bundler) ? Bundler.with_unbundled_env { contract_command(root) } : contract_command(root))
+        return if ok
+
+        say("  #{"warning".rjust(9)}  contract not generated — run `gemstack contract` once the database is reachable")
+      end
+
+      def contract_command(root)
+        system("bundle", "exec", "gemstack", "contract", "--quiet", chdir: root)
+      end
+    end
+  end
+end

data/lib/gemstack/cli/update_generator.rb

@@ -0,0 +1,131 @@
+# frozen_string_literal: true
+
+require "bundler"
+require "json"
+require "net/http"
+
+module GemStack
+  class CLI < Thor
+    # `gemstack update [VERSION]` — moves an app to the latest GemStack release
+    # (or VERSION): rewrites every GemStack gem's constraint in the Gemfile to
+    # "~> VERSION" and runs `bundle update` for them, together (the gems pin each
+    # other's exact version). Apps that use a GemStack checkout (`path "…"`)
+    # update the checkout instead.
+    class UpdateGenerator
+      # GemStack's gems, as an app's Gemfile lists them (gemstack-cli comes with gemstack).
+      GEMS = %w[gemstack gemstack-auth gemstack-realtime].freeze
+      VERSION_FORMAT = /\A\d+\.\d+\.\d+\z/
+      LATEST_URL = "https://rubygems.org/api/v1/versions/gemstack/latest.json"
+
+      def initialize(root:, version: nil, output: $stdout, latest: nil, bundle: nil)
+        @root = root
+        @version = version
+        @output = output
+        @latest = latest || -> { latest_release }
+        @bundle = bundle || ->(gems) { Bundler.with_unbundled_env { system("bundle", "update", *gems, chdir: @root) } }
+      end
+
+      def run
+        gemfile = read("Gemfile") or return failure("no Gemfile in #{@root}")
+        return checkout(gemfile) if gemfile.match?(/^\s*path\s+["'][^"']+["']\s+do\b/)
+
+        listed = GEMS.select { |name| gemfile.match?(gem_line(name)) }
+        return failure(%(no `gem "gemstack"` in the Gemfile)) unless listed.include?("gemstack")
+
+        target = @version || @latest.call
+        return failure("#{target.inspect} is not a version (e.g. 0.3.5)") unless target.to_s.match?(VERSION_FORMAT)
+
+        current = locked_version
+        if current == target
+          @output.puts("GemStack is already #{target}.")
+          return true
+        end
+        if current && Gem::Version.new(target) < Gem::Version.new(current) && !@version
+          @output.puts("GemStack #{current} is newer than the latest release (#{target}); nothing to do.")
+          return true
+        end
+
+        update(gemfile, listed, current, target)
+      end
+
+      private
+
+      def update(gemfile, listed, current, target)
+        @output.puts("Updating GemStack #{current || "(not installed yet)"} → #{target}")
+        updated = listed.reduce(gemfile) { |text, name| constrain(text, name, target) }
+        File.write(File.join(@root, "Gemfile"), updated)
+        listed.each { |name| @output.puts(%(  Gemfile  gem "#{name}", "~> #{target}")) }
+
+        gems = (listed + ["gemstack-cli"]).uniq
+        @output.puts("  run      bundle update #{gems.join(" ")}")
+        bundled = begin
+          @bundle.call(gems)
+        rescue StandardError
+          File.write(File.join(@root, "Gemfile"), gemfile) # never leave a half-done update behind
+          raise
+        end
+        return bundle_failed(gemfile) unless bundled
+
+        installed = locked_version
+        unless installed == target
+          return failure("bundle update finished but Gemfile.lock has gemstack #{installed.inspect}, not #{target}")
+        end
+
+        @output.puts(<<~DONE)
+
+          GemStack #{target} is installed. Next:
+            - read what changed: https://github.com/gemstack-rb/gemstack/blob/main/CHANGELOG.md
+            - gemstack doctor
+            - gemstack test
+        DONE
+        true
+      end
+
+      # `gem "name"` with any (or no) version requirement → `gem "name", "~> target"`,
+      # keeping other options (require:, group:) and trailing comments.
+      def constrain(text, name, target)
+        text.gsub(/^(\s*gem\s+["']#{Regexp.escape(name)}["'])((?:\s*,\s*["'][^"']*["'])*)/) do
+          %(#{Regexp.last_match(1)}, "~> #{target}")
+        end
+      end
+
+      def gem_line(name) = /^\s*gem\s+["']#{Regexp.escape(name)}["']/
+
+      def checkout(gemfile)
+        path = gemfile[/^\s*path\s+["']([^"']+)["']/, 1]
+        @output.puts("This app uses GemStack from a checkout (#{path}): update it there, e.g.")
+        @output.puts("  git -C #{path.delete_suffix("/gems")} pull")
+        true
+      end
+
+      def bundle_failed(original)
+        File.write(File.join(@root, "Gemfile"), original)
+        failure("bundle update failed — the Gemfile is unchanged; see Bundler's message above")
+      end
+
+      def locked_version
+        read("Gemfile.lock")&.[](/^    gemstack \(([^)]+)\)/, 1)
+      end
+
+      def latest_release
+        response = Net::HTTP.get_response(URI(LATEST_URL))
+        raise Thor::Error, "rubygems.org answered #{response.code}" unless response.is_a?(Net::HTTPSuccess)
+
+        JSON.parse(response.body).fetch("version")
+      rescue SocketError, SystemCallError, Timeout::Error, JSON::ParserError => e
+        raise Thor::Error, "Couldn't look up the latest GemStack on rubygems.org (#{e.class}). " \
+                           "Pass a version: gemstack update 0.3.5"
+      end
+
+      def read(relative)
+        path = File.join(@root, relative)
+        File.read(path) if File.file?(path)
+      end
+
+      def failure(message)
+        @output.puts("✗ #{message}")
+        false
+      end
+    end
+  end
+end

data/lib/gemstack/cli.rb

@@ -24,9 +24,11 @@ module GemStack
     require_relative "cli/doctor"
     require_relative "cli/deploy_generator"
     require_relative "cli/add_generator"
+    require_relative "cli/update_generator"
     require_relative "cli/commands/db"
     require_relative "cli/commands/jobs"
     require_relative "cli/console_methods"
+    require_relative "cli/helpers"
 
     # Commands that need the application's bundle (see Project.ensure_bundle!).
     class << self
@@ -51,7 +53,6 @@ module GemStack
     desc "new NAME", "Create a new GemStack application (Ruby API + Next.js frontend)"
     long_desc <<~DESC
       Creates NAME/ with a Ruby API, a Next.js + TypeScript frontend and no business resources.
-
       Then: cd NAME && gemstack dev
     DESC
     method_option :skip_install, type: :boolean, default: false, desc: "Don't run bundle install / npm install"
@@ -153,7 +154,7 @@ module GemStack
         app/policies/order_policy.rb + test (needs gemstack add auth)
 
       gemstack generate deploy
-        Dockerfile (api + web images), compose.yaml, Caddyfile, Procfile, .dockerignore
+        Kamal: Dockerfile, config/deploy.yml, .kamal/secrets, bin/docker-entrypoint, .dockerignore
 
       Field syntax: name:type[:optional][:unique][:index]. Types: #{ResourceSpec::TYPES.join(", ")}.
       Fields are required unless marked :optional.
@@ -180,7 +181,8 @@ module GemStack
       when "policy" then generate_policy(root, name)
       when "deploy"
         DeployGenerator.new(root: root, force: options[:force]).run
-        say("\nNext: docker compose up --build (see compose.yaml) · recipes: docs/deployment.md")
+        say("\nNext: bundle install, edit the CHANGE lines in config/deploy.yml, then " \
+            "bundle exec kamal setup — docs/deployment.md")
       when nil then abort("Usage: gemstack generate GENERATOR NAME. Generators: #{GENERATORS}")
       else abort("Unknown generator #{generator.inspect}. Available: #{GENERATORS}")
       end
@@ -196,12 +198,10 @@ module GemStack
     long_desc <<~DESC
       gemstack add realtime
         Adds gemstack-realtime, config/channels.rb, frontend/lib/gemstack/realtime.ts and test helpers.
-
       gemstack add auth
         Sign up, log in/out, password reset and email verification, API tokens and policies:
         migrations (users, sessions, auth_tokens), User model, controllers, routes, AuthMailer,
         tests and Next.js pages (/login, /signup, /forgot-password, /reset-password, /verify-email, /account).
-
       gemstack add storage
         File uploads straight from the browser to disk (development) or S3: config, uploads
         controller, routes and frontend/lib/upload.ts.
@@ -219,8 +219,7 @@ module GemStack
     desc "doctor", "Check that this app can run (Ruby, Node, database, migrations, contract…) and how to fix it"
     long_desc <<~DESC
       gemstack doctor               checks for development
-      gemstack doctor --production  also checks the settings a deploy needs (run it with the production
-                                    environment variables: SECRET_KEY_BASE, DATABASE_URL, SMTP_URL…)
+      gemstack doctor --production  also checks the settings a deploy needs (run it with the production environment variables: SECRET_KEY_BASE, DATABASE_URL, SMTP_URL…)
     DESC
     method_option :production, type: :boolean, default: false
     def doctor
@@ -231,78 +230,19 @@ module GemStack
     desc "version", "Print the GemStack version"
     def version = say("GemStack #{GemStack::VERSION}")
 
-    no_commands do
-      # -e ENV, else GEMSTACK_ENV, else development.
-      def use_environment! = ENV["GEMSTACK_ENV"] = options[:environment] || ENV["GEMSTACK_ENV"] || "development"
-
-      def generate_model(root, name, args)
-        abort("Usage: gemstack generate model NAME field:type ...") unless name && !args.empty?
-        spec = ResourceSpec.new(name, args)
-        ResourceGenerator.new(spec, root: root, parts: %i[migration model serializer], tests: !options[:skip_tests],
-                                    force: options[:force]).run
-        say("\nNext: gemstack db:migrate")
-      end
-
-      def generate_job(root, name, args)
-        abort("Usage: gemstack generate job NAME [QUEUE]") unless name
-        JobGenerator.new(name, queue: args.first, root: root, force: options[:force]).run
-        say("\nNext: gemstack db:migrate (first job only) · #{Inflector.camelize(name)}.perform_later(...)")
-      end
-
-      def generate_policy(root, name)
-        abort("Usage: gemstack generate policy MODEL") unless name
-        PolicyGenerator.new(name, root: root, force: options[:force]).run
-        say("\nNext: authorize!(record) and policy_scope(#{Inflector.camelize(name)}) in controllers")
-      end
-
-      def generate_resource(root, name, args)
-        abort("Usage: gemstack generate resource NAME field:type ...") unless name
-        abort("--api-only and --frontend-only can't be combined") if options[:api_only] && options[:frontend_only]
-        interactive = args.empty? && $stdin.tty?
-        args = ask("Fields (e.g. name:string price:decimal description:text:optional):").split if interactive
-        abort("Give at least one field, e.g. `gemstack generate resource #{name} name:string`") if args.empty?
-
-        spec = ResourceSpec.new(name, args, actions: resource_actions(interactive))
-        parts = resource_parts(root, interactive)
-        tests = !options[:skip_tests] && (!interactive || yes?("Generate tests? [Y/n]"))
-        ResourceGenerator.new(spec, root: root, parts: parts, tests: tests, force: options[:force]).run
-        refresh_contract(root) unless options[:skip_contract]
-        page = " · open http://localhost:3000/#{spec.url_segment}" if parts.include?(:frontend)
-        say("\nNext: gemstack db:migrate#{page}")
-      end
-
-      def resource_parts(root, interactive)
-        parts = options[:frontend_only] ? [] : %i[migration model serializer controller]
-        frontend = File.directory?(File.join(root, "frontend")) && !options[:api_only]
-        frontend &&= yes?("Generate Next.js pages? [Y/n]") if interactive
-        frontend ? parts + [:frontend] : parts
-      end
-
-      def resource_actions(interactive)
-        return options[:actions].split(",").map(&:strip) if options[:actions]
-        return ResourceSpec::REST_ACTIONS if !interactive || yes?("Generate the full CRUD API? [Y/n]")
-
-        ask("Actions (comma-separated from #{ResourceSpec::REST_ACTIONS.join(",")}):").split(",").map(&:strip)
-      end
-
-      # Thor's yes? only accepts y/yes; treat an empty answer as "yes".
-      def yes?(question)
-        answer = ask(question).strip.downcase
-        answer.empty? || %w[y yes].include?(answer)
-      end
-
-      # Regenerates TypeScript types/clients in the app's own bundle.
-      def refresh_contract(root)
-        say("  #{"run".rjust(9)}  gemstack contract")
-        ok = (defined?(Bundler) ? Bundler.with_unbundled_env { contract_command(root) } : contract_command(root))
-        return if ok
-
-        say("  #{"warning".rjust(9)}  contract not generated — run `gemstack contract` once the database is reachable")
-      end
+    desc "update [VERSION]", "Update this app to the latest GemStack release (or VERSION)"
+    long_desc <<~DESC
+      Sets every GemStack gem in the Gemfile (gemstack, gemstack-auth, gemstack-realtime) to
+      "~> VERSION" and runs bundle update for them. Without VERSION, uses the latest release on
+      rubygems.org.
 
-      def contract_command(root)
-        system("bundle", "exec", "gemstack", "contract", "--quiet", chdir: root)
-      end
+        gemstack update          # the latest release
+        gemstack update 0.3.5    # a specific version
+    DESC
+    def update(version = nil)
+      exit(1) unless UpdateGenerator.new(root: Project.root!, version: version).run
     end
+
+    include Helpers
   end
 end

data/lib/gemstack/version.rb

@@ -2,5 +2,5 @@
 
 module GemStack
   # All GemStack gems are released together under a single version.
-  VERSION = "0.3.4"
+  VERSION = "0.3.5"
 end

data/templates/deploy/Dockerfile.tt

@@ -1,63 +1,65 @@
 # syntax=docker/dockerfile:1
-# Production images for <%= app_name %> (gemstack generate deploy — docs/deployment.md).
+# Production image for <%= app_name %> (gemstack generate deploy — docs/deployment.md).
 #
-#   docker build --target api -t <%= app_name %>-api .     # Ruby API (Puma), also runs jobs and migrations
+# One image runs every process; config/deploy.yml (Kamal) gives each role its command:
 <% if frontend? -%>
-#   docker build --target web -t <%= app_name %>-web .     # Next.js
+#   web   node frontend/server.js              Next.js
 <% end -%>
+#   api   bundle exec puma -C config/puma.rb   Ruby API (bin/docker-entrypoint migrates first)
+<% if jobs? -%>
+#   jobs  bundle exec gemstack jobs            background jobs
+<% end -%>
+#
+#   docker build -t <%= service %> .
 #
 # Configuration comes from the environment at runtime (SECRET_KEY_BASE,
-# DATABASE_URL, …); nothing secret is baked into the images.
+# DATABASE_URL, …); nothing secret is baked into the image.
 
 ARG RUBY_VERSION=<%= ruby_version %>
+<% if frontend? -%>
 ARG NODE_VERSION=<%= node_version %>
+<% end -%>
 
-# ── Ruby API ────────────────────────────────────────────────────────────────
-FROM ruby:${RUBY_VERSION}-slim AS api-build
+FROM ruby:${RUBY_VERSION}-slim AS base
+WORKDIR /app
+ENV GEMSTACK_ENV=production BUNDLE_DEPLOYMENT=1 BUNDLE_WITHOUT="development:test" BUNDLE_PATH=/usr/local/bundle
+
+# ── Ruby gems and application code ──────────────────────────────────────────
+FROM base AS gems
 RUN apt-get update -qq && apt-get install --no-install-recommends -y <%= build_packages %> \
     && rm -rf /var/lib/apt/lists/*
-WORKDIR /app
-ENV BUNDLE_DEPLOYMENT=1 BUNDLE_WITHOUT="development:test" BUNDLE_PATH=/usr/local/bundle
 COPY Gemfile Gemfile.lock ./
 COPY vendor/ ./vendor/
 RUN bundle install --jobs 4 && rm -rf /usr/local/bundle/cache "${BUNDLE_PATH}"/ruby/*/cache
 COPY . .
-RUN rm -rf frontend tmp/* log/* .env*
-
-FROM ruby:${RUBY_VERSION}-slim AS api
-RUN apt-get update -qq && apt-get install --no-install-recommends -y <%= runtime_packages %> \
-    && rm -rf /var/lib/apt/lists/* \
-    && groupadd --system --gid 1000 app && useradd --system --uid 1000 --gid app --create-home app<% if sqlite? %> \
-    && mkdir -p /data && chown app:app /data<% end %>
-WORKDIR /app
-ENV GEMSTACK_ENV=production BUNDLE_DEPLOYMENT=1 BUNDLE_WITHOUT="development:test" BUNDLE_PATH=/usr/local/bundle \
-    GEMSTACK_API_HOST=0.0.0.0 GEMSTACK_API_PORT=4000
-COPY --from=api-build /usr/local/bundle /usr/local/bundle
-COPY --from=api-build --chown=app:app /app /app
-USER app
-EXPOSE 4000
-HEALTHCHECK --interval=10s --timeout=3s --start-period=20s CMD curl -fsS http://127.0.0.1:4000/api/health || exit 1
-# Other processes use the same image: `bundle exec gemstack jobs`, `bundle exec gemstack db:migrate`.
-CMD ["bundle", "exec", "puma", "-C", "config/puma.rb"]
+RUN rm -rf frontend tmp/* log/* .env* .kamal
 <% if frontend? -%>
 
-# ── Next.js ─────────────────────────────────────────────────────────────────
-FROM node:${NODE_VERSION}-slim AS web-build
-WORKDIR /app
+# ── Next.js (standalone build: the server and only the modules it needs) ─────
+FROM node:${NODE_VERSION}-slim AS frontend
+WORKDIR /frontend
 COPY frontend/package.json frontend/package-lock.json ./
 RUN npm ci
 COPY frontend/ ./
-ENV NEXT_TELEMETRY_DISABLED=1
-# GEMSTACK_API_URL is only needed here when Next.js proxies /api itself (no reverse proxy in front).
-ARG GEMSTACK_API_URL
-ENV GEMSTACK_API_URL=${GEMSTACK_API_URL}
-RUN npm run build && npm prune --omit=dev
+ENV NEXT_TELEMETRY_DISABLED=1 GEMSTACK_NEXT_OUTPUT=standalone
+RUN npm run build \
+    && mkdir -p public && cp -r public .next/standalone/ && cp -r .next/static .next/standalone/.next/
+<% end -%>
 
-FROM node:${NODE_VERSION}-slim AS web
-WORKDIR /app
-ENV NODE_ENV=production NEXT_TELEMETRY_DISABLED=1 PORT=3000
-COPY --from=web-build --chown=node:node /app ./
-USER node
-EXPOSE 3000
-CMD ["npm", "start"]
+# ── Runtime ─────────────────────────────────────────────────────────────────
+FROM base
+RUN apt-get update -qq && apt-get install --no-install-recommends -y <%= runtime_packages %> \
+    && rm -rf /var/lib/apt/lists/* \
+    && groupadd --system --gid 1000 app && useradd --system --uid 1000 --gid app --create-home app<% if sqlite? %> \
+    && mkdir -p /data && chown app:app /data<% end %>
+COPY --from=gems /usr/local/bundle /usr/local/bundle
+COPY --from=gems --chown=app:app /app /app
+<% if frontend? -%>
+COPY --from=frontend /usr/local/bin/node /usr/local/bin/node
+COPY --from=frontend --chown=app:app /frontend/.next/standalone /app/frontend
 <% end -%>
+ENV GEMSTACK_API_HOST=0.0.0.0 GEMSTACK_API_PORT=4000<% if frontend? %> NODE_ENV=production NEXT_TELEMETRY_DISABLED=1 PORT=3000<% end %>
+USER app
+EXPOSE <%= frontend? ? "3000 4000" : "4000" %>
+ENTRYPOINT ["/app/bin/docker-entrypoint"]
+CMD ["bundle", "exec", "puma", "-C", "config/puma.rb"]

data/templates/deploy/bin/docker-entrypoint.tt

@@ -0,0 +1,21 @@
+#!/bin/sh
+# Runs before every process in the production image (Dockerfile ENTRYPOINT).
+set -e
+
+case "$*" in
+<% if database? -%>
+  *puma*)
+    # The API applies pending migrations before it starts serving, so a
+    # deploy never runs new code against an old schema.
+    bundle exec gemstack db:migrate
+    ;;
+<% end -%>
+<% if frontend? -%>
+  *server.js*)
+    # Docker sets HOSTNAME to the container's name; Next.js listens on it.
+    export HOSTNAME=0.0.0.0
+    ;;
+<% end -%>
+esac
+
+exec "$@"

data/templates/deploy/config/deploy.yml.tt

@@ -0,0 +1,156 @@
+# Kamal deploy configuration for <%= app_name %> (gemstack generate deploy — docs/deployment.md).
+#
+#   bundle exec kamal setup    # first deploy: Docker, kamal-proxy (HTTPS) and accessories on the server
+#   bundle exec kamal deploy   # every deploy after that, with zero downtime
+#
+# Replace the placeholders marked CHANGE. Secrets are read from .kamal/secrets,
+# which only references environment variables, never their values.
+
+service: <%= service %>
+
+# CHANGE: your registry user (Docker Hub here; see registry: below for others).
+image: your-user/<%= service %>
+
+servers:
+<% if frontend? -%>
+  web:
+    hosts:
+      - 192.168.0.1 # CHANGE: your server's IP or hostname
+    cmd: node frontend/server.js
+    env:
+      clear:
+        # Server Components call the API directly, through the alias below.
+        GEMSTACK_API_URL: http://<%= service %>-api:4000
+  api:
+    hosts:
+      - 192.168.0.1 # CHANGE
+    cmd: bundle exec puma -C config/puma.rb
+    options:
+      network-alias: <%= service %>-api
+    # The browser calls /api on the same origin: kamal-proxy sends it here.
+    proxy:
+      app_port: 4000
+      path_prefix: /api
+      strip_path_prefix: false
+      # HTTPS comes from the web role's certificate (same domain, root path).
+      ssl: false
+      # Don't trust X-Forwarded-* headers sent by clients (IP-based rate limits).
+      forward_headers: false
+      healthcheck:
+        path: /api/health
+    env:
+      clear:
+        WEB_CONCURRENCY: 2
+<% else -%>
+  api:
+    hosts:
+      - 192.168.0.1 # CHANGE: your server's IP or hostname
+    cmd: bundle exec puma -C config/puma.rb
+    env:
+      clear:
+        WEB_CONCURRENCY: 2
+<% end -%>
+<% if jobs? -%>
+  jobs:
+    hosts:
+      - 192.168.0.1 # CHANGE
+    cmd: bundle exec gemstack jobs
+<% end -%>
+
+primary_role: <%= frontend? ? "web" : "api" %>
+
+# HTTPS with a Let's Encrypt certificate: point the domain's DNS at the server first.
+proxy:
+  ssl: true
+  host: app.example.com # CHANGE: your domain
+<% if frontend? -%>
+  app_port: 3000
+  healthcheck:
+    path: /
+<% else -%>
+  app_port: 4000
+  healthcheck:
+    path: /api/health
+<% end -%>
+
+registry:
+  # server: ghcr.io # for GitHub's registry; Docker Hub is the default
+  username: your-user # CHANGE
+  password:
+    - KAMAL_REGISTRY_PASSWORD
+
+env:
+  clear:
+    GEMSTACK_ENV: production
+    APP_URL: https://app.example.com # CHANGE: the public URL (email links)
+<% if sqlite? -%>
+    DATABASE_URL: sqlite3:/data/production.sqlite3
+<% end -%>
+<% if redis? -%>
+    REDIS_URL: redis://<%= service %>-redis:6379/0
+<% end -%>
+<% if mail? -%>
+    MAIL_FROM: app@example.com # CHANGE
+<% end -%>
+  secret:
+    - SECRET_KEY_BASE
+<% if database? && !sqlite? -%>
+    - DATABASE_URL
+<% end -%>
+<% if mail? -%>
+    - SMTP_URL
+<% end -%>
+<% if sqlite? -%>
+
+# The SQLite file lives on this volume, shared by every role: keep them on one server.
+volumes:
+  - "<%= service %>_data:/data"
+<% end -%>
+
+builder:
+  arch: amd64
+<% if postgresql? || mysql? || redis? -%>
+
+accessories:
+<% if postgresql? -%>
+  db:
+    image: postgres:17
+    host: 192.168.0.1 # CHANGE
+    env:
+      clear:
+        POSTGRES_USER: app
+        POSTGRES_DB: <%= database_name %>
+      secret:
+        - POSTGRES_PASSWORD
+    directories:
+      - data:/var/lib/postgresql/data
+<% elsif mysql? -%>
+  db:
+    image: mysql:8.4
+    host: 192.168.0.1 # CHANGE
+    env:
+      clear:
+        MYSQL_USER: app
+        MYSQL_DATABASE: <%= database_name %>
+        MYSQL_RANDOM_ROOT_PASSWORD: "yes"
+      secret:
+        - MYSQL_PASSWORD
+    directories:
+      - data:/var/lib/mysql
+<% end -%>
+<% if redis? -%>
+  redis:
+    image: redis:7
+    host: 192.168.0.1 # CHANGE
+    cmd: redis-server --save "" --appendonly no
+<% end -%>
+<% end -%>
+
+# bundle exec kamal console | logs | migrate | shell
+aliases:
+  console: app exec --interactive --reuse --roles=api "bundle exec gemstack console"
+  logs: app logs --follow
+<% if database? -%>
+  migrate: app exec --roles=api "bundle exec gemstack db:migrate"
+<% end -%>
+  shell: app exec --interactive --reuse --roles=api "bash"

data/templates/deploy/dot_dockerignore

@@ -1,5 +1,6 @@
 # Kept out of the build context (and so out of images).
 .git
+.kamal/
 .env
 .env.*
 !.env.example

data/templates/deploy/dot_kamal/secrets.tt

@@ -0,0 +1,18 @@
+# Secrets for Kamal (config/deploy.yml), resolved on your machine at deploy time.
+#
+# This file is committed to git: only ever write REFERENCES here — environment
+# variables ($NAME) or password-manager commands ($(kamal secrets fetch ...)) —
+# never a secret's value. `gemstack doctor` flags values written in place.
+
+KAMAL_REGISTRY_PASSWORD=$KAMAL_REGISTRY_PASSWORD
+SECRET_KEY_BASE=$SECRET_KEY_BASE
+<% if postgresql? -%>
+POSTGRES_PASSWORD=$POSTGRES_PASSWORD
+DATABASE_URL=postgres://app:$POSTGRES_PASSWORD@<%= service %>-db:5432/<%= database_name %>
+<% elsif mysql? -%>
+MYSQL_PASSWORD=$MYSQL_PASSWORD
+DATABASE_URL=<%= database_adapter %>://app:$MYSQL_PASSWORD@<%= service %>-db:3306/<%= database_name %>
+<% end -%>
+<% if mail? -%>
+SMTP_URL=$SMTP_URL
+<% end -%>

data/templates/frontend/next.config.ts

@@ -2,12 +2,15 @@ import type { NextConfig } from "next";
 
 // One public origin, in every environment:
 // - `gemstack dev`: the GemStack gateway routes /api/* to Ruby before requests reach Next.js.
-// - Production: set GEMSTACK_API_URL (e.g. http://api.internal:4000) and Next.js proxies
-//   /api/* to the Ruby API. Leave it unset if a reverse proxy already routes /api/*.
+// - Production with Kamal (gemstack generate deploy): kamal-proxy routes /api/* to Ruby.
+// - Elsewhere: set GEMSTACK_API_URL (e.g. http://api.internal:4000) at build time and
+//   Next.js proxies /api/* to the Ruby API.
 const apiUrl = process.env.GEMSTACK_API_URL?.replace(/\/$/, "");
 const apiPath = process.env.NEXT_PUBLIC_GEMSTACK_API_PATH ?? "/api";
 
 const nextConfig: NextConfig = {
+  // The production image (gemstack generate deploy) runs Next.js's standalone server.
+  output: process.env.GEMSTACK_NEXT_OUTPUT === "standalone" ? "standalone" : undefined,
   async rewrites() {
     if (!apiUrl) return [];
     return [{ source: `${apiPath}/:path*`, destination: `${apiUrl}${apiPath}/:path*` }];

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: gemstack
 version: !ruby/object:Gem::Version
-  version: 0.3.4
+  version: 0.3.5
 platform: ruby
 authors:
 - Adware Technologies
@@ -44,14 +44,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.3.4
+        version: 0.3.5
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.3.4
+        version: 0.3.5
 - !ruby/object:Gem::Dependency
   name: json
   requirement: !ruby/object:Gem::Requirement
@@ -181,9 +181,11 @@ files:
 - lib/gemstack/cli/deploy_generator.rb
 - lib/gemstack/cli/destroy_generator.rb
 - lib/gemstack/cli/doctor.rb
+- lib/gemstack/cli/doctor/secret_checks.rb
 - lib/gemstack/cli/doctor/upgrade_check.rb
 - lib/gemstack/cli/generation_manifest.rb
 - lib/gemstack/cli/generator.rb
+- lib/gemstack/cli/helpers.rb
 - lib/gemstack/cli/job_generator.rb
 - lib/gemstack/cli/migration_changes.rb
 - lib/gemstack/cli/migration_generator.rb
@@ -193,6 +195,7 @@ files:
 - lib/gemstack/cli/project.rb
 - lib/gemstack/cli/resource_generator.rb
 - lib/gemstack/cli/resource_spec.rb
+- lib/gemstack/cli/update_generator.rb
 - lib/gemstack/contract.rb
 - lib/gemstack/contract/builder.rb
 - lib/gemstack/contract/docs.rb
@@ -329,11 +332,11 @@ files:
 - templates/auth/test/controllers/auth_test.rb
 - templates/controller/app/controllers/%file_name%_controller.rb.tt
 - templates/controller/test/controllers/%file_name%_controller_test.rb.tt
-- templates/deploy/Caddyfile.tt
 - templates/deploy/Dockerfile.tt
-- templates/deploy/Procfile.tt
-- templates/deploy/compose.yaml.tt
+- templates/deploy/bin/docker-entrypoint.tt
+- templates/deploy/config/deploy.yml.tt
 - templates/deploy/dot_dockerignore
+- templates/deploy/dot_kamal/secrets.tt
 - templates/frontend/app/globals.css
 - templates/frontend/app/layout.tsx.tt
 - templates/frontend/app/page.module.css

data/templates/deploy/Caddyfile.tt

@@ -1,19 +0,0 @@
-# One public origin: /api/* → Ruby, everything else → Next.js (docs/deployment.md).
-# SITE_ADDRESS=example.com gets a Let's Encrypt certificate automatically;
-# "localhost" uses Caddy's local CA (trust it with `caddy trust`, or curl -k).
-{$SITE_ADDRESS:localhost} {
-	encode zstd gzip
-
-	handle /api/* {
-		reverse_proxy api:4000 {
-			# Server-Sent Events: stream responses immediately.
-			flush_interval -1
-		}
-	}
-<% if frontend? -%>
-
-	handle {
-		reverse_proxy web:3000
-	}
-<% end -%>
-}

data/templates/deploy/Procfile.tt

@@ -1,6 +0,0 @@
-# Process types for Procfile platforms (Heroku, Render, Railway, Dokku…) — docs/deployment.md.
-release: bundle exec gemstack db:migrate
-web: GEMSTACK_API_PORT=${PORT:-4000} bundle exec puma -C config/puma.rb
-<% if jobs? -%>
-worker: bundle exec gemstack jobs
-<% end -%>

data/templates/deploy/compose.yaml.tt

@@ -1,129 +0,0 @@
-# Runs <%= app_name %> in production mode on this machine, behind Caddy on https://localhost:
-#
-#   export SECRET_KEY_BASE=$(openssl rand -hex 64)<% if postgresql? %> POSTGRES_PASSWORD=$(openssl rand -hex 16)<% elsif mysql? %> MYSQL_PASSWORD=$(openssl rand -hex 16)<% end %>
-#   docker compose up --build
-#
-# It's also a map of what a real deploy needs: one image per process type,
-# migrations before the API starts, and a proxy sending /api to Ruby.
-<% if sqlite? -%>
-# SQLite: the database file lives on the `data` volume, shared by the API, the
-# jobs worker and migrations — keep them on one host.
-<% end -%>
-name: <%= app_name.tr("_", "-") %>
-
-x-api-env: &api-env
-  GEMSTACK_ENV: production
-  SECRET_KEY_BASE: ${SECRET_KEY_BASE:?set SECRET_KEY_BASE (openssl rand -hex 64)}
-<% if database? -%>
-  DATABASE_URL: <%= database_url %>
-<% end -%>
-<% if redis? -%>
-  REDIS_URL: redis://redis:6379/0 # realtime fan-out between the API and the jobs worker
-<% end -%>
-  APP_URL: ${APP_URL:-https://localhost}
-<% if mail? -%>
-  SMTP_URL: ${SMTP_URL:-}   # e.g. smtp://user:pass@smtp.example.com:587 — emails retry until it is set
-  MAIL_FROM: ${MAIL_FROM:-}
-<% end -%>
-
-services:
-<% if postgresql? -%>
-  db:
-    image: postgres:17
-    environment:
-      POSTGRES_USER: app
-      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD}
-      POSTGRES_DB: app
-    volumes: [db:/var/lib/postgresql/data]
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U app -d app"]
-      interval: 2s
-      retries: 30
-
-<% elsif mysql? -%>
-  db:
-    image: mysql:8.4
-    environment:
-      MYSQL_DATABASE: app
-      MYSQL_USER: app
-      MYSQL_PASSWORD: ${MYSQL_PASSWORD:?set MYSQL_PASSWORD}
-      MYSQL_RANDOM_ROOT_PASSWORD: "yes"
-    volumes: [db:/var/lib/mysql]
-    healthcheck:
-      test: ["CMD-SHELL", "mysqladmin ping -h 127.0.0.1 -uapp -p$$MYSQL_PASSWORD --silent"]
-      interval: 3s
-      retries: 40
-
-<% end -%>
-<% if redis? -%>
-  redis:
-    image: redis:7
-    command: ["redis-server", "--save", "", "--appendonly", "no"]
-
-<% end -%>
-<% if database? -%>
-  migrate:
-    image: <%= app_name %>-api
-    build: { context: ., target: api }
-    healthcheck: { disable: true }
-    command: ["bundle", "exec", "gemstack", "db:migrate"]
-    environment: *api-env
-<% if sqlite? -%>
-    volumes: [data:/data]
-<% else -%>
-    depends_on: { db: { condition: service_healthy } }
-<% end -%>
-
-<% end -%>
-  api:
-    image: <%= app_name %>-api
-    build: { context: ., target: api }
-    environment:
-      <<: *api-env
-      WEB_CONCURRENCY: ${WEB_CONCURRENCY:-2}
-<% if sqlite? -%>
-    volumes: [data:/data]
-<% end -%>
-<% if database? -%>
-    depends_on: { migrate: { condition: service_completed_successfully } }
-<% end -%>
-<% if jobs? -%>
-
-  jobs:
-    image: <%= app_name %>-api
-    build: { context: ., target: api }
-    healthcheck: { disable: true }
-    command: ["bundle", "exec", "gemstack", "jobs"]
-    environment: *api-env
-<% if sqlite? -%>
-    volumes: [data:/data]
-<% end -%>
-    depends_on: { migrate: { condition: service_completed_successfully } }
-<% end -%>
-<% if frontend? -%>
-
-  web:
-    image: <%= app_name %>-web
-    build: { context: ., target: web }
-    environment:
-      GEMSTACK_API_URL: http://api:4000 # Server Components call the API directly
-    depends_on: [api]
-<% end -%>
-
-  proxy:
-    image: caddy:2
-    ports: ["80:80", "443:443"]
-    environment:
-      SITE_ADDRESS: ${SITE_ADDRESS:-localhost}
-    volumes:
-      - ./Caddyfile:/etc/caddy/Caddyfile:ro
-      - caddy:/data
-    depends_on: [api<%= ", web" if frontend? %>]
-
-volumes:
-<% if sqlite? -%>
-  data:
-<% elsif database? -%>
-  db:
-<% end -%>
-  caddy: