katalyst-thermite 1.1.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: '02089b926bee271fd703e7ac9aab79a4adf886f627f212d518427a4d3263bfe8'
+  data.tar.gz: 4782edfbf124fd1b63f8bc959072de74c2e2bb49ec9f2a0e4c87196d2dcd28d3
+SHA512:
+  metadata.gz: d3971994ede5200b2798773970002b161b3a62beb0c6e2d79c04078f63913bd3639b81dc1cc66a9cf39970bf948fbcba9a7e2cf1dc0524a0176b61365f6421e2
+  data.tar.gz: 804df729abc85ba29fe70a859a1e7000c0c6b9b4719c045fc7d2ccd958fd4705cdca2a7740c0ff22b4eed0c30f2ed1315736619f7de1357503da19c21395a7d5

data/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Katalyst Interactive
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

data/README.md

@@ -0,0 +1,41 @@
+# Katalyst::Thermite
+
+Katalyst Thermite provides tools for adding and updating libraries and frameworks following Katalyst best practices.
+
+## Installation
+
+Add the gem to the `development` group in your Gemfile:
+
+```ruby
+group :development do
+  gem "katalyst-thermite"
+end
+```
+
+## Usage
+
+Run installers to add common frameworks and libraries to your Rails app, for example:
+
+```shell
+bin/rails thermite:install:koi
+```
+
+Available installers:
+
+```shell
+bin/rails thermite:install:active_storage
+bin/rails thermite:install:content_security_policy
+bin/rails thermite:install:docker
+bin/rails thermite:install:permissions_policy
+bin/rails thermite:install:sentry
+bin/rails thermite:install:solid_cable
+bin/rails thermite:install:solid_queue
+```
+
+## Contributing
+
+Bug reports and pull requests are welcome on GitHub at https://github.com/katalyst/thermite.
+
+## License
+
+The gem is available as open source under the terms of the [MIT License](https://opensource.org/licenses/MIT).

data/lib/generators/thermite/install/active_storage/USAGE

@@ -0,0 +1,28 @@
+Description:
+    Installs Active Storage following Katalyst conventions, on fresh or existing apps.
+
+    Writes a Katalyst-flavoured config/storage.yml (Disk locally, S3 elsewhere) and
+    points config.active_storage.service at :s3 for every non dev/test environment.
+
+    Also secures direct uploads: the POST /rails/active_storage/direct_uploads endpoint
+    is routed through an authenticated controller, and the disk service routes are
+    disabled unless storage is served from local disk. Authentication is app-specific, so
+    the controller ships locked down (every upload rejected) and the generated request
+    spec leaves the authenticated examples pending for you to complete.
+
+    To use the S3 service in deployed environments, add `aws-sdk-s3` to your Gemfile.
+
+Example:
+    bin/rails thermite:install:active_storage
+
+    This will:
+        Create config/storage.yml
+        Install the Active Storage migrations
+        Set the Active Storage service to :s3 (non dev/test environments)
+        Add app/controllers/active_storage/authenticated_direct_uploads_controller.rb
+        Add config/routes/overrides.rb and draw it from config/routes.rb
+        Add spec/requests/active_storage/authenticated_direct_uploads_controller_spec.rb
+
+    After running, enable uploads for your authenticated users:
+        Permit your principals in #current_user in the authenticated direct uploads controller
+        Complete the pending examples in the generated request spec

data/lib/generators/thermite/install/active_storage/active_storage_generator.rb

@@ -0,0 +1,79 @@
+# frozen_string_literal: true
+
+require "rails"
+require "rails/generators"
+
+# Installs Active Storage following Katalyst conventions, on fresh or existing apps.
+module Thermite
+  module Install
+    class ActiveStorageGenerator < Rails::Generators::Base
+      def self.source_root
+        File.expand_path("templates", __dir__)
+      end
+
+      def copy_storage_config
+        template "config/storage.yml"
+      end
+
+      # Lock the direct upload endpoint behind authentication and disable the disk
+      # service routes when storage isn't served from local disk. The authentication
+      # stubs are left for the app to complete (see the generated controller and spec).
+      def secure_direct_uploads
+        copy_file "app/controllers/active_storage/authenticated_direct_uploads_controller.rb"
+        copy_file "config/routes/overrides.rb"
+        copy_file "spec/requests/active_storage/authenticated_direct_uploads_controller_spec.rb"
+        draw_overrides
+      end
+
+      # update tops up an existing install; install lays the base for a new one.
+      def install_migrations
+        rails_command active_storage_installed? ? "active_storage:update" : "active_storage:install"
+      end
+
+      def configure_services
+        environments.each do |pathname|
+          next if local?(pathname)
+
+          gsub_file pathname, /(# )?config\.active_storage\.service\s*=.*/,
+                    "config.active_storage.service = :s3", verbose: false
+        end
+      end
+
+      private
+
+      # Wire config/routes/overrides.rb into the app's router with `draw :overrides`,
+      # inserted just inside the routes block. Idempotent and a no-op without routes.rb.
+      def draw_overrides
+        routes = Pathname(destination_root).join("config/routes.rb")
+        return unless routes.exist?
+        return if routes.read.include?("draw :overrides")
+
+        inject_into_file "config/routes.rb", "  draw :overrides\n",
+                         after: /^\s*Rails\.application\.routes\.draw do\n/, verbose: false
+      end
+
+      def environments
+        Pathname(destination_root).join("config/environments").glob("*.rb")
+      end
+
+      def active_storage_installed?
+        Pathname(destination_root).join("db/migrate").glob("*create_active_storage_tables*").any?
+      end
+
+      def local?(pathname)
+        %w[development test].include?(pathname.basename(".rb").to_s)
+      end
+
+      # Overridable at runtime via RAILS_ASSETS_BUCKET_ID (see storage.yml).
+      def asset_bucket_name
+        name = if defined?(Rails.application) && Rails.application
+                 Rails.application.class.module_parent_name
+               else
+                 File.basename(destination_root)
+               end
+
+        "#{name.to_s.underscore.dasherize}-web-assets"
+      end
+    end
+  end
+end

data/lib/generators/thermite/install/active_storage/templates/app/controllers/active_storage/authenticated_direct_uploads_controller.rb

@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+module ActiveStorage
+  # Active Storage's default direct upload endpoint (POST /rails/active_storage/direct_uploads)
+  # mints a signed URL that lets the caller PUT a file straight into the storage service.
+  # Left unauthenticated, it is an open door for anyone to fill the asset bucket.
+  # @see https://guides.rubyonrails.org/active_storage_overview.html#authenticated-controllers
+  #
+  # This controller restricts the endpoint to authenticated principals and rate limits
+  # requests using #current_user to identify a database-backed principal for authorisation and
+  # request throttling. If no principal is returned requests fail with :unauthorized.
+  # @see config/routes/overrides.rb
+  class AuthenticatedDirectUploadsController < ActiveStorage::DirectUploadsController
+    before_action :authenticate_user!
+    rate_limit to: 20, within: 10.seconds, by: -> { current_user.to_gid }
+
+    private
+
+    # Reject any request we can't attribute to a #current_user.
+    def authenticate_user!
+      head(:unauthorized) if current_user.nil?
+    end
+
+    # The authenticated principal for the current request, or nil when the request is anonymous.
+    def current_user
+      nil
+    end
+  end
+end

data/lib/generators/thermite/install/active_storage/templates/config/routes/overrides.rb

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+# Drawn from config/routes.rb via `draw :overrides`.
+
+# Only authenticated users can post files.
+# @see app/controllers/active_storage/authenticated_direct_uploads_controller.rb
+post "/rails/active_storage/direct_uploads", to: "active_storage/authenticated_direct_uploads#create"
+
+# Disable the disk service routes unless files are actually served from local disk.
+unless %i[local test].include?(Rails.application.config.active_storage.service)
+  no_route = ->(req) { raise ActionController::RoutingError, "No route matches #{req['REQUEST_PATH']}" }
+
+  get "/rails/active_storage/disk/:encoded_key/*filename", to: no_route
+  put "/rails/active_storage/disk/:encoded_token", to: no_route
+end

data/lib/generators/thermite/install/active_storage/templates/config/storage.yml.tt

@@ -0,0 +1,12 @@
+test:
+  service: Disk
+  root: <%%= Rails.root.join("tmp/storage") %>
+
+local:
+  service: Disk
+  root: <%%= Rails.root.join("storage") %>
+
+s3:
+  service: S3
+  region: ap-southeast-2
+  bucket: <%%= ENV.fetch("RAILS_ASSETS_BUCKET_ID", "<%= asset_bucket_name %>") %>

data/lib/generators/thermite/install/active_storage/templates/spec/requests/active_storage/authenticated_direct_uploads_controller_spec.rb

@@ -0,0 +1,70 @@
+# frozen_string_literal: true
+
+require "rails_helper"
+
+RSpec.describe ActiveStorage::AuthenticatedDirectUploadsController do
+  let(:action) { post(rails_direct_uploads_path, params:) }
+  let(:file) { StringIO.new("example") }
+  let(:params) do
+    {
+      blob: {
+        filename:     "example.txt",
+        content_type: "text/plain",
+        byte_size:    file.string.bytesize,
+        checksum:     OpenSSL::Digest::MD5.new(file.string).base64digest,
+      },
+    }
+  end
+
+  it "rejects uploads from anonymous users" do
+    action
+
+    expect(response).to have_http_status(:unauthorized)
+  end
+
+  context "as a signed-in admin", pending: "requires admin session setup" do
+    # include_context "with admin session"
+
+    it "permits the upload" do
+      action
+
+      expect(response).to have_http_status(:ok)
+    end
+  end
+
+  context "as a signed-in user", pending: "requires user session setup" do
+    # before { sign_in(create(:user)) }
+
+    it "permits the upload" do
+      action
+
+      expect(response).to have_http_status(:ok)
+    end
+  end
+
+  describe "rate limiting", pending: "requires a user session" do
+    # rate_limit captures the cache in a lambda at class-load time, so stub the call not the object.
+    let(:cache) { ActiveSupport::Cache::MemoryStore.new }
+    let(:rate_limit) { 20 }
+
+    before do
+      allow(Rails.cache).to receive(:increment) do |name, amount = 1, **options|
+        cache.increment(name, amount, **options)
+      end
+    end
+
+    # include_context "with admin session"
+
+    it "throttles bursts of uploads with 429 Too Many Requests" do
+      aggregate_failures do
+        rate_limit.times do
+          post(rails_direct_uploads_path, params:, headers:)
+          expect(response).to have_http_status(:ok)
+        end
+
+        post(rails_direct_uploads_path, params:, headers:)
+        expect(response).to have_http_status(:too_many_requests)
+      end
+    end
+  end
+end

data/lib/generators/thermite/install/content_security_policy/USAGE

@@ -0,0 +1,21 @@
+Description:
+    Installs the Katalyst content security policy configuration.
+
+    Generates config/initializers/content_security_policy.rb with a
+    nonce-based policy controlled per deployment via CONTENT_SECURITY_POLICY:
+
+    - enforce (default): the policy is enforced
+    - report: policy violations are reported but not enforced — use this to
+      trial policy changes and review violations in Sentry before enforcing
+    - none: no policy header is sent — set this on existing apps that have
+      not yet reviewed the policy against their content
+
+    Violation reports are delivered to Sentry when SENTRY_DSN is set and the
+    Sentry initializer registers the report URI (see thermite:install:sentry).
+
+    See https://docs.sentry.io/platforms/ruby/guides/rails/security-policy-reporting/
+    and the project's Sentry Project Settings > SDK Setup > Security Headers page
+    (https://<org>.sentry.io/settings/projects/<project>/security-headers/).
+
+Example:
+    bin/rails generate thermite:install:content_security_policy

data/lib/generators/thermite/install/content_security_policy/content_security_policy_generator.rb

@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+require "rails"
+require "rails/generators"
+
+module Thermite
+  module Install
+    class ContentSecurityPolicyGenerator < Rails::Generators::Base
+      def self.source_root
+        File.expand_path("templates", __dir__)
+      end
+
+      def copy_files
+        copy_file "config/initializers/content_security_policy.rb"
+      end
+    end
+  end
+end

data/lib/generators/thermite/install/content_security_policy/templates/config/initializers/content_security_policy.rb

@@ -0,0 +1,72 @@
+# frozen_string_literal: true
+
+# Be sure to restart your server when you modify this file.
+
+# Define an application-wide content security policy.
+# See the Securing Rails Applications Guide for more information:
+# https://guides.rubyonrails.org/security.html#content-security-policy-header
+
+# Enforced by default. Set CONTENT_SECURITY_POLICY=report per deployment to
+# trial policy changes and review violations in Sentry, or =none for existing
+# apps that have not yet reviewed the policy against their content.
+CSP_MODE = ENV.fetch("CONTENT_SECURITY_POLICY", "enforce").freeze
+
+warn "Unknown configuration CONTENT_SECURITY_POLICY=#{CSP_MODE}" unless CSP_MODE.in?(%w[none report enforce])
+
+return if CSP_MODE == "none"
+
+# Deliver violation reports to Sentry (see config/initializers/sentry.rb)
+# https://docs.sentry.io/platforms/ruby/guides/rails/security-policy-reporting/
+# Sentry's report endpoint is shown under Project Settings > SDK Setup > Security Headers,
+# e.g. https://<org>.sentry.io/settings/projects/<project>/security-headers/
+reporting = if ENV.key?("SENTRY_DSN")
+              sentry_uri = "https://#{URI(ENV.fetch('SENTRY_DSN')).hostname}"
+              [sentry_uri, sentry_uri.gsub("ingest.sentry", "ingest.us.sentry")]
+            else
+              []
+            end
+
+Rails.application.configure do
+  config.content_security_policy do |policy|
+    policy.default_src(:self)
+    policy.frame_ancestors(:self)
+
+    # Permissive policy, many browser plugins use custom fonts
+    policy.font_src(:self, :data, :https)
+
+    # Permissive policy, allow data URLs and https (hotlinking, tracking pixels)
+    policy.img_src(:self, :data, :https)
+
+    # Block legacy embeds, such as flash
+    policy.object_src(:none)
+
+    # Restricted policy, all scripts should have nonce or SRI. strict-dynamic
+    # allows scripts to load children (CSP-3); unsafe-inline and https are
+    # fallbacks for legacy browsers, ignored when nonces are supported.
+    policy.script_src(:self, :strict_dynamic, :wasm_unsafe_eval, :unsafe_inline, :https)
+
+    # Permissive policy, browser plugins inject inline styles.
+    # Safari < 26.0 does not support -attr and -elem (https://bugs.webkit.org/show_bug.cgi?id=276931)
+    policy.style_src(:self, :unsafe_inline, :https)
+
+    # Permissive policy, allows external embeds and user browser plugins
+    policy.frame_src(:self, :https)
+
+    # Permissive policy, many browser plugins use connect
+    policy.connect_src(:self, :data, :https, *reporting)
+  end
+
+  # Generate nonces for permitted importmap, inline scripts, and inline styles.
+  # A fresh nonce per request is incompatible with conditional GET caching; apps
+  # that create a session on every request can use the session id instead, see
+  # https://guides.rubyonrails.org/security.html#adding-a-nonce
+  config.content_security_policy_nonce_generator  = ->(_request) { SecureRandom.base64(16) }
+  config.content_security_policy_nonce_directives = %w[script-src style-src-elem]
+
+  # Automatically add `nonce` to `javascript_tag`, `javascript_include_tag`, and `stylesheet_link_tag`
+  # if the corresponding directives are specified in `content_security_policy_nonce_directives`.
+  config.content_security_policy_nonce_auto = true
+
+  # Report violations without enforcing the policy.
+  config.content_security_policy_report_only = true if CSP_MODE == "report"
+end

data/lib/generators/thermite/install/docker/USAGE

@@ -0,0 +1,8 @@
+Description:
+    Installs the Katalyst Docker container setup.
+
+Example:
+    bin/rails generate thermite:install:docker
+
+    This creates a root Dockerfile, bin/docker-entrypoint, .dockerignore,
+    and removes the legacy Koi 4-era docker directory (if it exists)

data/lib/generators/thermite/install/docker/docker_generator.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+require "rails"
+require "rails/generators"
+
+module Thermite
+  module Install
+    class DockerGenerator < Rails::Generators::Base
+      def self.source_root
+        File.expand_path("templates", __dir__)
+      end
+
+      def copy_docker_files
+        template "Dockerfile.tt", "Dockerfile"
+        copy_file ".dockerignore"
+        copy_file "bin/docker-entrypoint"
+        chmod "bin/docker-entrypoint", 0o755 & ~File.umask, verbose: false
+      end
+
+      def remove_legacy_docker_directory
+        remove_dir "docker" if Pathname(destination_root).join("docker").directory?
+      end
+
+      private
+
+      def application_name
+        if defined?(Rails.application) && Rails.application
+          Rails.application.class.module_parent_name.to_s.underscore.dasherize
+        else
+          File.basename(destination_root).underscore.dasherize
+        end
+      end
+    end
+  end
+end

data/lib/generators/thermite/install/docker/templates/Dockerfile.tt

@@ -0,0 +1,119 @@
+# syntax=docker/dockerfile:1
+# check=error=true
+
+ARG APPLICATION_NAME="<%= application_name %>"
+ARG RUBY_VERSION=4.0
+FROM ruby:$RUBY_VERSION-slim AS base
+
+ARG PACKAGES="curl libvips libjemalloc2 postgresql-client"
+
+# Rails app lives here
+WORKDIR /rails
+
+# Install base packages
+RUN apt-get update -qq && \
+    DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends $PACKAGES && \
+    rm -rf /var/lib/apt/lists /var/cache/apt/archives
+
+ARG APPLICATION_NAME
+ARG APPLICATION_VERSION
+ARG APPLICATION_REVISION
+
+# Set production environment
+ENV APPLICATION_NAME="${APPLICATION_NAME}" \
+    BUNDLE_DEPLOYMENT="1" \
+    BUNDLE_PATH="/usr/local/bundle" \
+    BUNDLE_WITHOUT="development:test" \
+    EXECJS_RUNTIME="Disabled" \
+    RAILS_ENV="production" \
+    PUMA_SSL="1" \
+    TZ="Australia/Adelaide"
+
+# Create a rails group and user for non-privileged access
+RUN groupadd --system --gid 1000 rails && \
+    useradd rails --uid 1000 --gid 1000 --create-home --shell /bin/bash && \
+    echo "$APPLICATION_NAME ($APPLICATION_VERSION) [$APPLICATION_REVISION]" > /etc/motd && \
+    echo "PS1='\u@\${APPLICATION_NAME}-\${RAILS_ENV}:\w\$ '" >> /etc/bash.bashrc && \
+    echo "cat /etc/motd" >> /etc/bash.bashrc
+
+# Build rails gems and assets in a throw-away build stage to reduce size of final image
+FROM base AS build
+
+# Install packages needed to build gems
+ARG BUILD_PACKAGES="build-essential git libcurl4-openssl-dev libpq-dev libyaml-dev pkg-config zlib1g-dev"
+RUN apt-get update -qq && \
+    apt-get install --no-install-recommends -y $BUILD_PACKAGES && \
+    rm -rf /var/lib/apt/lists /var/cache/apt/archives
+
+# Install application gems
+COPY Gemfile Gemfile.lock ./
+RUN bundle install && \
+    rm -rf ~/.bundle/ "${BUNDLE_PATH}"/ruby/*/cache "${BUNDLE_PATH}"/ruby/*/bundler/gems/*/.git && \
+    bundle exec bootsnap precompile --gemfile
+
+# Copy application code
+COPY --link . .
+
+# Precompile bootsnap code for faster boot times
+RUN bundle exec bootsnap precompile app/ lib/
+
+# If set, assets will be compiled into a subdirectory of public/ with this prefix
+ARG CDN_ASSET_PREFIX=""
+
+# Precompile assets for production
+RUN DATABASE_URL="postgresql://localhost" \
+    SECRET_KEY_BASE_DUMMY=1 \
+    ./bin/rails assets:precompile
+
+# END OF BUILD ##
+
+# Copy assets to the CDN
+FROM amazon/aws-cli:latest AS cdn
+
+ARG AWS_DEFAULT_REGION="ap-southeast-2"
+ARG CDN_ASSET_PREFIX=""
+ARG S3_ASSETS_BUCKET=""
+
+COPY --from=build /rails/public public
+RUN --mount=type=secret,id=aws-key-id,env=AWS_ACCESS_KEY_ID \
+    --mount=type=secret,id=aws-secret-key,env=AWS_SECRET_ACCESS_KEY \
+    --mount=type=secret,id=aws-session-token,env=AWS_SESSION_TOKEN \
+    if [ -n "$CDN_ASSET_PREFIX" ] && [ -n "$S3_ASSETS_BUCKET" ]; then \
+      aws s3 sync --only-show-errors --cache-control "public, max-age=31536000, immutable" \
+        public/$CDN_ASSET_PREFIX s3://$S3_ASSETS_BUCKET/$CDN_ASSET_PREFIX; \
+    fi
+
+# END OF CDN ##
+
+# Assemble everything into a single layer
+FROM base AS assemble
+
+ARG APPLICATION_VERSION
+ARG APPLICATION_REVISION
+
+COPY --link . .
+COPY --from=build /rails/tmp/cache/bootsnap tmp/cache/bootsnap
+COPY --from=cdn /aws/public public
+RUN echo $APPLICATION_VERSION > VERSION && \
+    echo $APPLICATION_REVISION > REVISION && \
+    mkdir -p db log ssl storage tmp/pids tmp/sockets && \
+    chown -R rails:rails db log ssl storage tmp
+
+# Final stage for app image
+FROM base
+
+ARG CDN_ASSET_PREFIX
+
+# Puma and Rails configuration for a small server setup with puma in single mode with 5 workers
+ENV CDN_ASSET_PREFIX=$CDN_ASSET_PREFIX \
+    WEB_CONCURRENCY=0 \
+    RAILS_MAX_THREADS=5
+
+# Assemble layers
+COPY --from=build --link "${BUNDLE_PATH}" "${BUNDLE_PATH}"
+COPY --from=assemble --link /rails .
+
+USER 1000:1000
+EXPOSE 4443
+ENTRYPOINT ["/rails/bin/docker-entrypoint"]
+CMD ["./bin/rails", "server"]

data/lib/generators/thermite/install/docker/templates/bin/docker-entrypoint

@@ -0,0 +1,21 @@
+#!/bin/bash -e
+
+# Enable jemalloc for reduced memory usage and latency.
+if [ -z "${LD_PRELOAD+x}" ]; then
+    LD_PRELOAD=$(find /usr/lib -name libjemalloc.so.2 -print -quit)
+    export LD_PRELOAD
+fi
+
+# If running the rails server then create or migrate existing database
+if [ "${@: -2:1}" == "./bin/rails" ] && [ "${@: -1:1}" == "server" ]; then
+  ./bin/rails db:prepare
+
+  # create a self-signed certificate for puma
+  mkdir -p ~/.ssl
+  openssl req -x509 -newkey rsa:2048 -nodes -days 730 \
+    -subj '/CN=docker/' \
+    -keyout ~/.ssl/docker.key \
+    -out ~/.ssl/docker.crt
+fi
+
+exec "${@}"

data/lib/generators/thermite/install/permissions_policy/USAGE

@@ -0,0 +1,11 @@
+Description:
+    Installs the Katalyst permissions policy configuration.
+
+    Generates config/initializers/permissions_policy.rb with a restrictive
+    Permissions-Policy header: camera, microphone, geolocation, payment,
+    gyroscope, and usb are denied, and fullscreen is limited to the app
+    itself. Allow specific features (e.g. geolocation, payment) only for apps
+    that use them. The header applies as soon as it is deployed.
+
+Example:
+    bin/rails generate thermite:install:permissions_policy

data/lib/generators/thermite/install/permissions_policy/permissions_policy_generator.rb

@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+require "rails"
+require "rails/generators"
+
+module Thermite
+  module Install
+    class PermissionsPolicyGenerator < Rails::Generators::Base
+      def self.source_root
+        File.expand_path("templates", __dir__)
+      end
+
+      def copy_files
+        copy_file "config/initializers/permissions_policy.rb"
+      end
+    end
+  end
+end

data/lib/generators/thermite/install/permissions_policy/templates/config/initializers/permissions_policy.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+Rails.application.config.permissions_policy do |policy|
+  policy.camera      :none
+  policy.fullscreen  :self
+  policy.geolocation :none
+  policy.gyroscope   :none
+  policy.microphone  :none
+  policy.payment     :none
+  policy.usb         :none
+end

data/lib/generators/thermite/install/sentry/USAGE

@@ -0,0 +1,18 @@
+Description:
+    Installs the Katalyst Sentry configuration.
+
+    Generates config/initializers/sentry.rb with the standard errors-only
+    data posture for sentry-ruby/sentry-rails 7.x:
+
+    - structured logging disabled (no request/SQL logs sent to Sentry)
+    - explicit data_collection settings (no user info, cookies, bodies,
+      query params, or database query values)
+    - error events sanitized with the app's parameter filter
+    - CSP violations reported to Sentry when a content security policy is
+      configured (see thermite:install:content_security_policy and
+      https://docs.sentry.io/platforms/ruby/guides/rails/security-policy-reporting/)
+    - tracing and profiling off unless enabled per deployment via
+      SENTRY_TRACES_SAMPLE_RATE / SENTRY_PROFILES_SAMPLE_RATE
+
+Example:
+    bin/rails generate thermite:install:sentry

data/lib/generators/thermite/install/sentry/sentry_generator.rb

@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+
+require "rails"
+require "rails/generators"
+
+module Thermite
+  module Install
+    class SentryGenerator < Rails::Generators::Base
+      def self.source_root
+        File.expand_path("templates", __dir__)
+      end
+
+      # Fail early with a helpful message when sentry-rails isn't available.
+      def verify_sentry!
+        require "sentry-rails"
+      rescue LoadError
+        raise Thor::Error, <<~MSG.strip
+          thermite:install:sentry requires the sentry-rails gem, which is not available.
+          Add it to your Gemfile and run `bundle install`:
+
+              gem "sentry-rails"
+        MSG
+      end
+
+      def copy_files
+        template "config/initializers/sentry.rb"
+      end
+
+      private
+
+      # The environments Sentry should report from: every deployed environment,
+      # derived from config/environments/*.rb so we don't hard-code names like
+      # "staging" / "uat".
+      def enabled_environments
+        environments
+          .map { |pathname| pathname.basename(".rb").to_s }
+          .reject { |environment| %w[development test].include?(environment) }
+          .sort_by { |environment| environment == "production" ? 1 : 0 }
+      end
+
+      def environments
+        Pathname(destination_root).join("config/environments").glob("*.rb")
+      end
+    end
+  end
+end

data/lib/generators/thermite/install/sentry/templates/config/initializers/sentry.rb.tt

@@ -0,0 +1,50 @@
+# frozen_string_literal: true
+
+# Sanitize error events with the application's parameter filter
+filter   = ActiveSupport::ParameterFilter.new(Rails.application.config.filter_parameters)
+sanitize = lambda do |event, _hint|
+  event.extra    = filter.filter(event.extra) if event.extra
+  event.user     = filter.filter(event.user) if event.user
+  event.contexts = filter.filter(event.contexts) if event.contexts
+  event
+end
+
+ActiveSupport.on_load(:active_record) do
+  version = Rails.root.join("VERSION")
+
+  # DSN is set via SENTRY_DSN in ENV
+  Sentry.init do |config|
+    config.enabled_environments = %w[<%= enabled_environments.join(" ") %>]
+    config.release              = File.read(version).strip.split("/").last if version.exist?
+
+    # Errors only: structured logging sends a log event for every request and
+    # SQL query. Collecting logs is a per-client data decision.
+    config.rails.structured_logging.enabled = false
+
+    # Data collection posture, based on sentry-ruby 7's `send_default_pii`
+    pii_headers = %w[forwarded -ip _ip remote via _user -user]
+
+    config.data_collection.user_info                   = false
+    config.data_collection.cookies.mode                = :off
+    config.data_collection.http_headers.request.terms  = pii_headers
+    config.data_collection.http_headers.response.terms = pii_headers
+    config.data_collection.http_bodies                 = []
+    config.data_collection.url_query_params.mode       = :off
+    config.data_collection.database_query_data         = false
+    config.data_collection.queues                      = false
+
+    config.before_send = sanitize
+
+    # Report CSP violations to Sentry (requires a content security policy)
+    # https://docs.sentry.io/platforms/ruby/guides/rails/security-policy-reporting/
+    if (policy = Rails.application.config.content_security_policy).present? && config.csp_report_uri.present?
+      policy.report_uri(config.csp_report_uri)
+    end
+
+    # Tracing and profiling, off unless enabled per deployment.
+    # Profiling requires the vernier gem.
+    config.traces_sample_rate   = ENV.fetch("SENTRY_TRACES_SAMPLE_RATE", "0").to_f
+    config.profiles_sample_rate = ENV.fetch("SENTRY_PROFILES_SAMPLE_RATE", "0").to_f
+    config.profiler_class       = Sentry::Vernier::Profiler
+  end
+end

data/lib/generators/thermite/install/solid_cable/USAGE

@@ -0,0 +1,16 @@
+Description:
+    Installs Solid Cable using a single, shared database (Katalyst's preferred setup).
+
+    Unlike `solid_cable:install`, this does not provision a separate cable
+    database. The solid_cable tables are added to the primary database via a
+    normal migration in db/migrate, and config/cable.yml uses the solid_cable
+    adapter without a `connects_to` configuration.
+
+    Requires the solid_cable gem to be present in the host application.
+
+Example:
+    bin/rails thermite:install:solid_cable
+
+    This will:
+        Create config/cable.yml
+        Create a db/migrate migration for the solid_cable tables

data/lib/generators/thermite/install/solid_cable/solid_cable_generator.rb

@@ -0,0 +1,98 @@
+# frozen_string_literal: true
+
+require "rails"
+require "rails/generators"
+require "rails/generators/active_record/migration"
+
+require "active_record"
+require "yaml"
+
+# For a single-database install, solid cable's documented setup is to copy the contents
+# of db/cable_schema.rb into a normal migration, delete db/cable_schema.rb,
+# remove connects_to from config/cable.yml, then run db:migrate.
+# Thermite follows that path by generating the migration directly.
+#
+# solid_cable is an optional dependency: it is required lazily in #verify_solid_cable!
+# so the generator still loads (and lists) when solid_cable is absent.
+module Thermite
+  module Install
+    class SolidCableGenerator < Rails::Generators::Base
+      # Provides migration_template, next_migration_number (timestamped) and the
+      # CreateMigration action that makes re-runs safe: identical content is
+      # skipped, a same-named migration with different content raises a conflict.
+      include ActiveRecord::Generators::Migration
+
+      # Reuse solid_cable's own templates. Resolved lazily so the class loads
+      # without solid_cable present; populated once #verify_solid_cable! requires it.
+      def self.source_root
+        ::SolidCable::InstallGenerator.source_root if defined?(::SolidCable::InstallGenerator)
+      end
+
+      # Search our own templates (the migration) first, then solid_cable's
+      # (cable.yml).
+      def self.source_paths
+        [File.expand_path("templates", __dir__), source_root].compact
+      end
+
+      # Our source_root points into solid_cable, so the inherited USAGE lookup
+      # would resolve to solid_cable's USAGE. Point it at ours instead.
+      def self.usage_path
+        File.expand_path("USAGE", __dir__)
+      end
+
+      # Fail early with a helpful message when solid_cable isn't available.
+      def verify_solid_cable!
+        require "solid_cable/version"
+        require "generators/solid_cable/install/install_generator"
+      rescue LoadError
+        raise Thor::Error, <<~MSG.strip
+          thermite:install:solid_cable requires the solid_cable gem, which is not available.
+          Add it to your Gemfile and run `bundle install`:
+
+              gem "solid_cable"
+        MSG
+      end
+
+      # Based on SolidCable::InstallGenerator#copy_files but writing schema to a migration instead
+      # @see https://github.com/rails/solid_cable#single-database-configuration
+      def copy_files
+        template "config/cable.yml"
+        migration_template "add_solid_cable.rb", "db/migrate/add_solid_cable.rb", skip: true
+      end
+
+      private
+
+      # The application's extra environments, derived from config/environments/*.rb so
+      # we don't hard-code names like "staging" / "uat".
+      def extra_environments
+        environments
+          .reject { |pathname| local?(pathname) || production?(pathname) }
+          .map { |path| path.basename(".rb").to_s }
+      end
+
+      def environments
+        Pathname(destination_root).join("config/environments").glob("*.rb")
+      end
+
+      def local?(pathname)
+        %w[development test].include?(pathname.basename(".rb").to_s)
+      end
+
+      def production?(pathname)
+        pathname.basename(".rb").to_s == "production"
+      end
+
+      def solid_cable_schema_body
+        schema = File.read(File.join(self.class.source_root, "db/cable_schema.rb"))
+
+        schema
+          # Keep only the schema block body.
+          .sub(%r{\A.*ActiveRecord::Schema[^\n]+do\n}, "")
+          .sub(/\nend\n?\z/, "")
+          .lines
+          .map { |line| line == "\n" ? line : "  #{line}" }
+          .join
+      end
+    end
+  end
+end

data/lib/generators/thermite/install/solid_cable/templates/add_solid_cable.rb.tt

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+class <%= migration_class_name %> < ActiveRecord::Migration[<%= ActiveRecord::Migration.current_version %>]
+  def change
+<%= solid_cable_schema_body.chomp %>
+  end
+end

data/lib/generators/thermite/install/solid_cable/templates/config/cable.yml.tt

@@ -0,0 +1,16 @@
+development:
+  adapter: async
+
+test:
+  adapter: test
+
+production: &production
+  adapter: solid_cable
+  polling_interval: 0.1.seconds
+  message_retention: 1.day
+
+<% extra_environments.each do |environment| -%>
+
+<%= environment %>:
+  <<: *production
+<% end -%>

data/lib/generators/thermite/install/solid_queue/USAGE

@@ -0,0 +1,18 @@
+Description:
+    Installs Solid Queue using a single, shared database (Katalyst's preferred setup).
+
+    Unlike `solid_queue:install`, this does not provision a separate queue
+    database. The solid_queue tables are added to the primary database via a
+    normal migration in db/migrate, and `config.active_job.queue_adapter` is set
+    to :solid_queue without a `connects_to` configuration.
+
+    Requires the solid_queue gem to be present in the host application.
+
+Example:
+    bin/rails thermite:install:solid_queue
+
+    This will:
+        Create config/queue.yml and config/recurring.yml
+        Create a db/migrate migration for the solid_queue tables
+        Install the bin/jobs binstub
+        Set the Active Job queue adapter to :solid_queue (non dev/test environments)

data/lib/generators/thermite/install/solid_queue/solid_queue_generator.rb

@@ -0,0 +1,94 @@
+# frozen_string_literal: true
+
+require "rails"
+require "rails/generators"
+require "rails/generators/active_record/migration"
+
+require "active_record"
+
+# For a single-database install, solid queue's documented setup is to copy the contents
+# of db/queue_schema.rb into a normal migration, delete db/queue_schema.rb,
+# remove config.solid_queue.connects_to, then run db:migrate.
+module Thermite
+  module Install
+    class SolidQueueGenerator < Rails::Generators::Base
+      include ActiveRecord::Generators::Migration
+
+      # Reuse solid_queue's own templates. Resolved lazily so the class loads
+      # without solid_queue present; populated once #verify_solid_queue! requires it.
+      def self.source_root
+        ::SolidQueue::InstallGenerator.source_root if defined?(::SolidQueue::InstallGenerator)
+      end
+
+      # Search our own templates (the migration) first, then solid_queue's
+      # (queue.yml, recurring.yml, bin/jobs).
+      def self.source_paths
+        [File.expand_path("templates", __dir__), source_root].compact
+      end
+
+      # Our source_root points into solid_queue, so the inherited USAGE lookup
+      # would resolve to solid_queue's USAGE. Point it at ours instead.
+      def self.usage_path
+        File.expand_path("USAGE", __dir__)
+      end
+
+      # Fail early with a helpful message when solid_queue isn't available.
+      def verify_solid_queue!
+        require "solid_queue/version"
+        require "generators/solid_queue/install/install_generator"
+      rescue LoadError
+        raise Thor::Error, <<~MSG.strip
+          thermite:install:solid_queue requires the solid_queue gem, which is not available.
+          Add it to your Gemfile and run `bundle install`:
+
+              gem "solid_queue"
+        MSG
+      end
+
+      # Based on SolidQueue::InstallGenerator#copy_files but writing schema to a migration instead
+      # @see https://github.com/rails/solid_queue#single-database-configuration
+      def copy_files
+        template "config/queue.yml"
+        template "config/recurring.yml"
+        migration_template "add_solid_queue.rb", "db/migrate/add_solid_queue.rb", skip: true
+        template "bin/jobs"
+        chmod "bin/jobs", 0o755 & ~File.umask, verbose: false
+      end
+
+      # Based on SolidQueue::InstallGenerator#configure_adapter but without connects_to configuration
+      # @see https://github.com/rails/solid_queue#single-database-configuration
+      def configure_adapter
+        Pathname(destination_root).join("config/environments").glob("*.rb").each do |pathname|
+          next if %w[development.rb test.rb].include?(pathname.basename.to_s)
+
+          gsub_file pathname, /\n\s*config\.solid_queue\.connects_to\s+=.*\n/, "\n", verbose: false
+          gsub_file pathname, /(# )?config\.active_job\.queue_adapter\s+=.*\n/,
+                    "config.active_job.queue_adapter = :solid_queue\n"
+        end
+      end
+
+      private
+
+      # The application's environments, derived from config/environments/*.rb so
+      # we don't hard-code names like "staging" / "uat".
+      def application_environments
+        Pathname(destination_root).join("config/environments")
+          .glob("*.rb")
+          .map { |path| path.basename(".rb").to_s }
+          .sort
+      end
+
+      def solid_queue_schema_body
+        schema = File.read(File.join(self.class.source_root, "db/queue_schema.rb"))
+
+        schema
+          # Keep only the schema block body.
+          .sub(%r{\A.*ActiveRecord::Schema[^\n]+do\n}, "")
+          .sub(/\nend\n?\z/, "")
+          .lines
+          .map { |line| line == "\n" ? line : "  #{line}" }
+          .join
+      end
+    end
+  end
+end

data/lib/generators/thermite/install/solid_queue/templates/add_solid_queue.rb.tt

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+class <%= migration_class_name %> < ActiveRecord::Migration[<%= ActiveRecord::Migration.current_version %>]
+  def change
+    <%= solid_queue_schema_body.chomp %>
+  end
+end

data/lib/generators/thermite/install/solid_queue/templates/config/queue.yml.tt

@@ -0,0 +1,14 @@
+default: &default
+  dispatchers:
+    - polling_interval: 1
+      batch_size: 500
+  workers:
+    - queues: "*"
+      threads: 3
+      processes: <%%= ENV.fetch("JOB_CONCURRENCY", 1) %>
+      polling_interval: 0.1
+<% application_environments.each do |environment| -%>
+
+<%= environment %>:
+  <<: *default
+<% end -%>

data/lib/generators/thermite/install/solid_queue/templates/config/recurring.yml.tt

@@ -0,0 +1,9 @@
+production: &production
+  clear_solid_queue_finished_jobs:
+    command: "SolidQueue::Job.clear_finished_in_batches(sleep_between_batches: 0.3)"
+    schedule: every hour at minute 12
+<% (application_environments - %w[development test production]).each do |environment| -%>
+
+<%= environment %>:
+  <<: *production
+<% end -%>

data/lib/katalyst-thermite.rb

@@ -0,0 +1,3 @@
+# frozen_string_literal: true
+
+require "thermite"

data/lib/thermite/engine.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+module Thermite
+  class Engine < ::Rails::Engine
+    isolate_namespace Thermite
+
+    rake_tasks do
+      load "thermite/tasks.rb"
+    end
+  end
+end

data/lib/thermite/tasks.rb

@@ -0,0 +1,20 @@
+# frozen_string_literal: true
+
+namespace :thermite do
+  namespace :install do
+    desc "Install Solid Queue"
+    task :solid_queue do
+      Rails::Command.invoke :generate, ["thermite:install:solid_queue"]
+    end
+
+    desc "Install Active Storage"
+    task :active_storage do
+      Rails::Command.invoke :generate, ["thermite:install:active_storage"]
+    end
+
+    desc "Install Solid Cable"
+    task :solid_cable do
+      Rails::Command.invoke :generate, ["thermite:install:solid_cable"]
+    end
+  end
+end

data/lib/thermite.rb

@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+require "thermite/engine"
+
+require "active_support"
+
+require "zeitwerk"
+
+loader = Zeitwerk::Loader.for_gem(warn_on_extra_files: false)
+loader.ignore("#{__dir__}/generators")
+loader.ignore("#{__dir__}/katalyst-thermite.rb")
+loader.ignore("#{__dir__}/thermite/tasks.rb")
+loader.setup
+
+module Thermite
+  extend self
+end

metadata

@@ -0,0 +1,102 @@
+--- !ruby/object:Gem::Specification
+name: katalyst-thermite
+version: !ruby/object:Gem::Version
+  version: 1.1.0
+platform: ruby
+authors:
+- Katalyst Interactive
+bindir: bin
+cert_chain: []
+date: 1980-01-02 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: activesupport
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: railties
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+email:
+- developers@katalyst.com.au
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- LICENSE
+- README.md
+- lib/generators/thermite/install/active_storage/USAGE
+- lib/generators/thermite/install/active_storage/active_storage_generator.rb
+- lib/generators/thermite/install/active_storage/templates/app/controllers/active_storage/authenticated_direct_uploads_controller.rb
+- lib/generators/thermite/install/active_storage/templates/config/routes/overrides.rb
+- lib/generators/thermite/install/active_storage/templates/config/storage.yml.tt
+- lib/generators/thermite/install/active_storage/templates/spec/requests/active_storage/authenticated_direct_uploads_controller_spec.rb
+- lib/generators/thermite/install/content_security_policy/USAGE
+- lib/generators/thermite/install/content_security_policy/content_security_policy_generator.rb
+- lib/generators/thermite/install/content_security_policy/templates/config/initializers/content_security_policy.rb
+- lib/generators/thermite/install/docker/USAGE
+- lib/generators/thermite/install/docker/docker_generator.rb
+- lib/generators/thermite/install/docker/templates/Dockerfile.tt
+- lib/generators/thermite/install/docker/templates/bin/docker-entrypoint
+- lib/generators/thermite/install/permissions_policy/USAGE
+- lib/generators/thermite/install/permissions_policy/permissions_policy_generator.rb
+- lib/generators/thermite/install/permissions_policy/templates/config/initializers/permissions_policy.rb
+- lib/generators/thermite/install/sentry/USAGE
+- lib/generators/thermite/install/sentry/sentry_generator.rb
+- lib/generators/thermite/install/sentry/templates/config/initializers/sentry.rb.tt
+- lib/generators/thermite/install/solid_cable/USAGE
+- lib/generators/thermite/install/solid_cable/solid_cable_generator.rb
+- lib/generators/thermite/install/solid_cable/templates/add_solid_cable.rb.tt
+- lib/generators/thermite/install/solid_cable/templates/config/cable.yml.tt
+- lib/generators/thermite/install/solid_queue/USAGE
+- lib/generators/thermite/install/solid_queue/solid_queue_generator.rb
+- lib/generators/thermite/install/solid_queue/templates/add_solid_queue.rb.tt
+- lib/generators/thermite/install/solid_queue/templates/config/queue.yml.tt
+- lib/generators/thermite/install/solid_queue/templates/config/recurring.yml.tt
+- lib/katalyst-thermite.rb
+- lib/thermite.rb
+- lib/thermite/engine.rb
+- lib/thermite/tasks.rb
+homepage: https://github.com/katalyst/thermite
+licenses:
+- MIT
+metadata:
+  rubygems_mfa_required: 'true'
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '4.0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 4.0.16
+specification_version: 4
+summary: Katalyst tools for integrating common patterns into Rails apps
+test_files: []