rb-portless 0.1.0 → 0.2.0.dev.20260630.4729847

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: fe5a5a76f71f89027e083e3ba964520c22aef5f1a42ecefc3850e16a0ac16bb2
-  data.tar.gz: 13081e8f73114575b5a96ab27f9dec30c4949f333fa3c95ba0659f104cf16b19
+  metadata.gz: 2dcf6d284947fe4b095fbb7522041c1774210a95e050067496d69e2b2b026067
+  data.tar.gz: 39de3f4bfed765815e9ef526d894aec69a6558c5b95006de894fa281067605d2
 SHA512:
-  metadata.gz: 06a5c203d83b18de91ca2248744854e71933cdb4771626d8ae7af4e9bdbc2840c98edcfcc9cc51a9b88f9b6d6d9431c733118910bfcb380c372b9ad2151916e0
-  data.tar.gz: 44412d9c53a6c2990af830497f55bfd30cc5a3f4e9cd2032a9b5347cfc6853931e0754191ecb634607cfbaffc448e3ba4b333f259ae037d759ff6b15f31ccd3c
+  metadata.gz: 9b536cdca612b71d0000dd55a512fad71c5adc01122c743cee96ebaefff1fc9ddc9b3514ebacb6a4e087c1bf7d3046a0de07b51eb72a3f6629a8de1f325f7351
+  data.tar.gz: 56666b652b02b527d6ceb25842d9facd66fe6f9bc7f2cb052e3c8bbe530002f59e1f9685c8f8061afbe9b1ce1e1c9cd4c53b23e38f45f6cee723f065b5d0b33b

data/CHANGELOG.md

@@ -4,6 +4,14 @@ All notable changes to this project are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/), and the project adheres to
 [Semantic Versioning](https://semver.org/).
 
+## [0.2.0]
+
+### Added
+
+- **Auto-trust on first run.** `run` now trusts the local CA automatically the
+  first time (interactive only; skipped with a hint in CI), matching portless —
+  HTTPS works with no browser warnings without a separate `trust` step.
+
 ## [0.1.0] — first release
 
 The full portless workflow for Ruby, validated end-to-end against a real Rails

data/README.md

@@ -41,12 +41,12 @@ rb-portless run -- npm run dev     # Vite/Astro/etc. get --port injected
 
 A random port (4000–4999) is injected as `PORT` (and `HOST=127.0.0.1`);
 Rails/puma respect it natively. The proxy **auto-starts** on first run: it
-generates a local CA, and binds 443 — a one-time `sudo` on macOS/Linux, exactly
-like portless (falls back to `:1355` if you decline). Run `rb-portless trust`
-once so your browser accepts the certificates.
+generates a local CA, **trusts it** (one keychain/sudo prompt, like portless),
+and binds 443 — another one-time `sudo` on macOS/Linux (falls back to `:1355` if
+you decline). After that, HTTPS just works with no browser warnings.
 
 ```bash
-rb-portless trust                  # trust the local CA (HTTPS, no warnings)
+rb-portless trust                  # re-trust manually if ever needed
 rb-portless service install        # bind 443 at boot — never prompt for sudo again
 ```
 
@@ -104,8 +104,7 @@ end
 ```
 
 ```bash
-rb-portless trust            # one-time: trust the local CA
-rb-portless run bin/dev      # → https://myapp.localhost
+rb-portless run bin/dev      # → https://myapp.localhost (CA auto-trusted on first run)
 ```
 
 That's it. The railtie **auto-detects when you're running under `rb-portless`**
@@ -164,6 +163,29 @@ boundary). For ports < 1024 it re-execs under `sudo` so the elevated process can
 bind the socket, then hands ownership of state files back to you. See
 [`AGENTS.md`](AGENTS.md) for the full architecture.
 
+## Compared to portless (Node)
+
+The mental model is identical — `run` wraps your dev command, the proxy
+auto-starts, named `.localhost` URLs replace ports. The only Ruby-world addition
+is the one-line `require "portless/rails"` to satisfy Rails' host authorization.
+
+| | **portless (Node)** | **rb-portless (Ruby/Rails)** |
+|---|---|---|
+| Install | `npm i -g portless` | `gem install rb-portless` (or Gemfile dev group) |
+| Run a server | `portless run next dev` | `rb-portless run bin/rails server` |
+| Run the dev orchestrator | `portless` (runs `"dev"` script) | `rb-portless run bin/dev` (wraps Foreman) |
+| Bake into the project | `"dev": "portless run next dev"` → `npm run dev` | put `rb-portless run` in `bin/dev`, or use the binstub |
+| Name the URL | `portless myapp …` / `portless.json` | `portless.json` `{ "name": "myapp" }` (else dir/git root) |
+| Wildcard tenant subdomains | `tld` config | `portless.json` `{ "tld": "myapp.localhost" }` → `*.myapp.localhost` |
+| Pin the backend port | `--app-port` / `appPort` | `appPort` in `portless.json` |
+| Framework port injection | vite/astro/etc. auto | same (Rails/puma respect `PORT` natively) |
+| HTTPS trust | auto on first run (+ `portless trust`) | auto on first run (+ `rb-portless trust`) |
+| **Host allowlist** | not needed | **`gem "rb-portless", require: "portless/rails"`** (Rails-only) |
+| Privileged 443 bind | sudo re-exec (auto) | sudo re-exec (auto), `:1355` fallback |
+| Bind at boot (no sudo) | `portless service install` | `rb-portless service install` |
+| Inspect / manage | `portless list / doctor / clean` | `rb-portless list / doctor / clean` |
+| Static route (DB, etc.) | `portless alias pg 5432` | `rb-portless alias pg 5432` |
+
 ## Contributing
 
 ```bash

data/lib/portless/runner.rb

@@ -21,6 +21,7 @@ module Portless
       hostname = @config.hostname
       url = "#{@config.tls ? 'https' : 'http'}://#{hostname}"
 
+      ensure_trusted if @config.tls
       Daemon.ensure_running(tls: @config.tls)
       @route_store.add(hostname: hostname, port: port, pid: Process.pid, force: true)
 
@@ -33,6 +34,24 @@ module Portless
 
     private
 
+    # Trust the local CA on first run (like portless), so HTTPS works without
+    # browser warnings out of the box. Interactive only — macOS prompts for
+    # keychain auth; in CI/no-TTY we skip with a hint rather than hang. Never
+    # blocks the run if trusting fails.
+    def ensure_trusted
+      return if Trust.trusted?
+
+      unless Privilege.interactive?
+        warn "rb-portless: CA not trusted — run `rb-portless trust` (HTTPS shows warnings until then)"
+        return
+      end
+
+      warn "rb-portless: trusting the local CA (first run)…"
+      Trust.install!
+    rescue Portless::Error => e
+      warn "rb-portless: couldn't auto-trust the CA (#{e.message}) — run `rb-portless trust`"
+    end
+
     # Run the child in its own process group so we can signal the whole tree,
     # forwarding INT/TERM and propagating its exit status.
     def supervise(command, port, url)

data/lib/portless/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Portless
-  VERSION = "0.1.0"
+  VERSION = "0.2.0.dev.20260630.4729847"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rb-portless
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.2.0.dev.20260630.4729847
 platform: ruby
 authors:
 - David Afonso