@aifabrix/builder 2.42.1 → 2.44.0

package/lib/generator/helpers.js

@@ -9,8 +9,9 @@
  */
 
 const fs = require('fs');
-const yaml = require('js-yaml');
+const path = require('path');
 const { loadConfigFile } = require('../utils/config-format');
+const { urlTokenToKeyVaultSecretName } = require('./deploy-manifest-azure-kv');
 
 /**
  * Loads application config file (application.yaml, application.json, or legacy path) via converter.
@@ -37,21 +38,25 @@ function loadEnvTemplate(templatePath) {
 }
 
 /**
- * Loads rbac.yaml file if it exists
- * @param {string} rbacPath - Path to rbac.yaml
- * @returns {Object|null} Parsed RBAC configuration or null
- * @throws {Error} If file exists but has invalid YAML
+ * Loads RBAC config file (rbac.yaml, rbac.yml, or rbac.json) if it exists.
+ * Uses loadConfigFile so format is inferred from extension.
+ *
+ * @param {string} rbacPath - Path to RBAC file (e.g. from resolveRbacPath)
+ * @returns {Object|null} Parsed RBAC configuration or null if path is falsy or file does not exist
+ * @throws {Error} If file exists but has invalid syntax (message references actual filename, e.g. rbac.json)
  */
 function loadRbac(rbacPath) {
+  if (!rbacPath || typeof rbacPath !== 'string') {
+    return null;
+  }
   if (!fs.existsSync(rbacPath)) {
     return null;
   }
-
-  const rbacContent = fs.readFileSync(rbacPath, 'utf8');
   try {
-    return yaml.load(rbacContent);
+    return loadConfigFile(rbacPath);
   } catch (error) {
-    throw new Error(`Invalid YAML syntax in rbac.yaml: ${error.message}`);
+    const basename = path.basename(rbacPath);
+    throw new Error(`Invalid syntax in ${basename}: ${error.message}`);
   }
 }
 
@@ -214,6 +219,9 @@ function determineVariableLocation(value, key) {
   if (value.startsWith('kv://')) {
     location = 'keyvault';
     required = true;
+  } else if (value.startsWith('url://')) {
+    location = 'keyvault';
+    required = true;
   }
 
   // Check if it's a sensitive variable
@@ -225,6 +233,31 @@ function determineVariableLocation(value, key) {
   return { location, required };
 }
 
+/**
+ * Maps env.template url:// value(s) to Key Vault secret name(s) for deploy JSON.
+ * Comma-separated lists are supported (e.g. CORS ALLOWED_ORIGINS): each segment
+ * starting with url:// is mapped; other segments are left unchanged (e.g. http://localhost:*).
+ *
+ * @param {string} appKey - application.yaml app.key
+ * @param {string} value - Full value after KEY= (must start with url:// for caller)
+ * @returns {string} Comma-joined secret names / literals
+ */
+function mapUrlTemplateValueToKeyVaultNames(appKey, value) {
+  const segments = value
+    .split(',')
+    .map((s) => s.trim())
+    .filter((s) => s.length > 0);
+  return segments
+    .map((seg) => {
+      if (seg.startsWith('url://')) {
+        const token = seg.slice('url://'.length).trim();
+        return urlTokenToKeyVaultSecretName(appKey, token);
+      }
+      return seg;
+    })
+    .join(',');
+}
+
 /**
  * Creates a configuration item from parsed variable
  * @function createConfigItem
@@ -233,12 +266,27 @@ function determineVariableLocation(value, key) {
  * @param {string} location - Variable location
  * @param {boolean} required - Whether variable is required
  * @param {Map} portalInputMap - Map of portalInput configurations
+ * @param {string|null} appKey - application.yaml app.key (required when value uses url://)
  * @returns {Object} Configuration item
  */
-function createConfigItem(key, value, location, required, portalInputMap) {
+function createConfigItem(key, value, location, required, portalInputMap, appKey) {
+  let storedValue = value;
+  if (location === 'keyvault') {
+    if (value.startsWith('kv://')) {
+      storedValue = value.replace('kv://', '');
+    } else if (value.startsWith('url://')) {
+      if (!appKey) {
+        throw new Error(
+          `Cannot resolve ${key}=${value}: application app.key is required to map url:// to a Key Vault secret name`
+        );
+      }
+      storedValue = mapUrlTemplateValueToKeyVaultNames(appKey, value);
+    }
+  }
+
   const configItem = {
     name: key,
-    value: value.replace('kv://', ''), // Remove kv:// prefix for KeyVault
+    value: storedValue,
     location,
     required
   };
@@ -255,6 +303,10 @@ function parseEnvironmentVariables(envTemplate, variablesConfig = null) {
   const configuration = [];
   const lines = envTemplate.split('\n');
   const portalInputMap = createPortalInputMap(variablesConfig);
+  const appKey =
+    variablesConfig && variablesConfig.app && variablesConfig.app.key
+      ? String(variablesConfig.app.key).trim()
+      : null;
 
   for (const line of lines) {
     const parsed = parseEnvironmentVariableLine(line);
@@ -263,7 +315,14 @@ function parseEnvironmentVariables(envTemplate, variablesConfig = null) {
     }
 
     const { location, required } = determineVariableLocation(parsed.value, parsed.key);
-    const configItem = createConfigItem(parsed.key, parsed.value, location, required, portalInputMap);
+    const configItem = createConfigItem(
+      parsed.key,
+      parsed.value,
+      location,
+      required,
+      portalInputMap,
+      appKey
+    );
     configuration.push(configItem);
   }
 

package/lib/generator/index.js

@@ -13,7 +13,7 @@ const fs = require('fs');
 const path = require('path');
 const _validator = require('../validation/validator');
 const builders = require('./builders');
-const { detectAppType, getDeployJsonPath, resolveApplicationConfigPath } = require('../utils/paths');
+const { detectAppType, getDeployJsonPath, resolveApplicationConfigPath, resolveRbacPath } = require('../utils/paths');
 const { logOfflinePathWhenType } = require('../utils/cli-utils');
 const splitFunctions = require('./split');
 const { loadVariables, loadEnvTemplate, loadRbac, parseEnvironmentVariables } = require('./helpers');
@@ -22,6 +22,7 @@ const { generateControllerManifest } = require('./external-controller-manifest')
 const { resolveVersionForApp } = require('../utils/image-version');
 const { getContainerPort } = require('../utils/port-resolver');
 const { buildEnvVarMap } = require('../utils/env-map');
+const { rewriteFrontDoorHostForAzureDeploy } = require('./deploy-manifest-azure-kv');
 
 /**
  * Generates deployment JSON from application configuration files
@@ -39,7 +40,7 @@ const { buildEnvVarMap } = require('../utils/env-map');
  *
  * @example
  * const jsonPath = await generateDeployJson('myapp');
- * // Returns: './builder/myapp/myapp-deploy.json' or './integration/hubspot/application-schema.json'
+ * // Returns: './builder/myapp/myapp-deploy.json' or './integration/hubspot-test/application-schema.json'
  */
 /**
  * Loads configuration files for deployment generation
@@ -51,12 +52,12 @@ const { buildEnvVarMap } = require('../utils/env-map');
 function loadDeploymentConfigFiles(appPath, appType, appName) {
   const variablesPath = resolveApplicationConfigPath(appPath);
   const templatePath = path.join(appPath, 'env.template');
-  const rbacPath = path.join(appPath, 'rbac.yaml');
+  const rbacPath = resolveRbacPath(appPath);
   const jsonPath = getDeployJsonPath(appName, appType, true); // Use new naming
 
   const { parsed: variables } = loadVariables(variablesPath);
   const envTemplate = loadEnvTemplate(templatePath);
-  const rbac = loadRbac(rbacPath);
+  const rbac = rbacPath ? loadRbac(rbacPath) : null;
 
   return { variables, envTemplate, rbac, jsonPath };
 }
@@ -191,6 +192,8 @@ function buildAndValidateDeployment(appName, variables, envTemplate, rbac, optio
     substituteEnvVarsInDeployment(deployment, envVarMap);
   }
 
+  rewriteFrontDoorHostForAzureDeploy(deployment);
+
   // Ensure no other ${...} placeholders remain in manifest
   _validator.validateNoUnresolvedVariablesInDeployment(deployment);
 
@@ -236,6 +239,7 @@ async function buildDeploymentManifestInMemory(appName, options = {}) {
   }
   const envVarMap = await buildEnvVarMap('docker', null, null, { appPort: effectivePort });
   substituteEnvVarsInDeployment(deployment, envVarMap);
+  rewriteFrontDoorHostForAzureDeploy(deployment);
   _validator.validateNoUnresolvedVariablesInDeployment(deployment);
   return { deployment, appPath };
 }

package/lib/generator/split-readme.js

@@ -13,10 +13,15 @@ const { parseImageReference } = require('./parse-image');
  * @param {Object} deployment - Deployment JSON object
  * @returns {{ appName: string, config: Object }}
  */
-function buildReadmeConfigForExternal(deployment) {
+function buildReadmeConfigForExternal(deployment, options = {}) {
   const system = deployment.system;
   const appName = system.key || deployment.key || 'external-system';
   const dataSources = deployment.dataSources || deployment.datasources || [];
+  const rawExt = options.fileExt;
+  const fileExt =
+    rawExt !== undefined && rawExt !== null && String(rawExt).trim() !== ''
+      ? (String(rawExt).startsWith('.') ? String(rawExt) : `.${String(rawExt)}`)
+      : '.json';
   return {
     appName,
     config: {
@@ -25,7 +30,7 @@ function buildReadmeConfigForExternal(deployment) {
       systemType: system.type || 'openapi',
       systemDisplayName: system.displayName || appName,
       systemDescription: system.description || `External system integration for ${appName}`,
-      fileExt: '.yaml',
+      fileExt,
       datasourceCount: dataSources.length,
       datasources: dataSources
     }
@@ -49,7 +54,7 @@ function buildReadmeConfigForApp(deployment) {
     displayName: deployment.displayName,
     description: deployment.description,
     port,
-    build: { localPort: port },
+    build: {},
     image: { name: imageName, registry },
     registry,
     database: deployment.requiresDatabase,
@@ -80,9 +85,9 @@ function buildReadmeConfigForApp(deployment) {
  * @param {Object} deployment - Deployment JSON object
  * @returns {{ appName: string, config: Object }}
  */
-function buildReadmeConfigFromDeployment(deployment) {
+function buildReadmeConfigFromDeployment(deployment, options = {}) {
   if (deployment.system && typeof deployment.system === 'object') {
-    return buildReadmeConfigForExternal(deployment);
+    return buildReadmeConfigForExternal(deployment, options);
   }
   return buildReadmeConfigForApp(deployment);
 }
@@ -92,11 +97,11 @@ function buildReadmeConfigFromDeployment(deployment) {
  * @param {Object} deployment - Deployment JSON object
  * @returns {string} README.md content
  */
-function generateReadmeFromDeployJson(deployment) {
+function generateReadmeFromDeployJson(deployment, options = {}) {
   if (!deployment || typeof deployment !== 'object') {
     throw new Error('Deployment object is required');
   }
-  const { appName, config } = buildReadmeConfigFromDeployment(deployment);
+  const { appName, config } = buildReadmeConfigFromDeployment(deployment, options);
   return generateReadmeMd(appName, config);
 }
 

package/lib/generator/split-variables.js

@@ -56,7 +56,8 @@ function extractOptionalSections(deployment) {
   const optional = {};
   const names = [
     'healthCheck', 'authentication', 'build', 'repository', 'deployment',
-    'startupCommand', 'runtimeVersion', 'scaling', 'frontDoorRouting'
+    'startupCommand', 'runtimeVersion', 'scaling', 'frontDoorRouting',
+    'environmentScopedResources'
   ];
   for (const sectionName of names) {
     extractOptionalSection(deployment, sectionName, optional);

package/lib/generator/split.js

@@ -14,6 +14,7 @@ const yaml = require('js-yaml');
 const { parseImageReference } = require('./parse-image');
 const { generateReadmeFromDeployJson } = require('./split-readme');
 const { extractVariablesYaml, getExternalDatasourceFileName } = require('./split-variables');
+const { generateExternalEnvTemplateContent } = require('../utils/external-env-template');
 
 /**
  * Converts configuration array back to env.template format
@@ -207,24 +208,49 @@ function mergeEnvTemplateWithExisting(existingContent, expectedByKey) {
   return updatedLines.join('\n') + (updatedLines.length > 0 ? '\n' : '');
 }
 
+/**
+ * Builds key -> line map from env.template content (for merge when using external system template).
+ * @param {string} content - Full env.template content
+ * @returns {Map<string, string>} Key to full KEY=value line
+ */
+function buildExpectedByKeyFromEnvContent(content) {
+  const expectedByKey = new Map();
+  if (!content || typeof content !== 'string') return expectedByKey;
+  const lines = content.split(/\r?\n/);
+  for (const line of lines) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith('#')) continue;
+    const eq = trimmed.indexOf('=');
+    if (eq > 0) {
+      const key = trimmed.substring(0, eq).trim();
+      expectedByKey.set(key, trimmed);
+    }
+  }
+  return expectedByKey;
+}
+
 /**
  * Writes env.template (merge or overwrite).
  * @param {string} outputDir - Output directory
  * @param {string} envTemplate - Default env.template content
- * @param {Object} options - Options (mergeEnvTemplate, configuration)
+ * @param {Object} options - Options (mergeEnvTemplate, configuration, expectedByKey for external)
  * @returns {Promise<string>} Path to env.template
  */
 async function writeEnvTemplateToDir(outputDir, envTemplate, options) {
   const envTemplatePath = path.join(outputDir, 'env.template');
   const fsSync = require('fs');
-  if (options.mergeEnvTemplate && options.configuration && fsSync.existsSync(envTemplatePath)) {
-    const expectedByKey = buildEnvTemplateExpectedByKey(options.configuration);
-    const existingContent = await fs.readFile(envTemplatePath, 'utf8');
-    const merged = mergeEnvTemplateWithExisting(existingContent, expectedByKey);
-    await writeComponentFile(envTemplatePath, merged);
-  } else {
-    await writeComponentFile(envTemplatePath, envTemplate);
+  const useMerge = options.mergeEnvTemplate && fsSync.existsSync(envTemplatePath);
+  if (useMerge) {
+    const expectedByKey = options.expectedByKey ||
+      (options.configuration ? buildEnvTemplateExpectedByKey(options.configuration) : new Map());
+    if (expectedByKey.size > 0) {
+      const existingContent = await fs.readFile(envTemplatePath, 'utf8');
+      const merged = mergeEnvTemplateWithExisting(existingContent, expectedByKey);
+      await writeComponentFile(envTemplatePath, merged);
+      return envTemplatePath;
+    }
   }
+  await writeComponentFile(envTemplatePath, envTemplate);
   return envTemplatePath;
 }
 
@@ -401,12 +427,21 @@ async function splitDeployJson(deployJsonPath, outputDir = null, splitOptions =
   normalizeDeploymentForSplit(deployment);
 
   const configArray = deployment.configuration || [];
-  const envTemplate = extractEnvTemplate(configArray);
+  let envTemplate;
+  const writeOptions = buildSplitWriteOptions(splitOptions, configArray);
+  if (deployment.system && typeof deployment.system === 'object') {
+    envTemplate = generateExternalEnvTemplateContent(deployment.system);
+    if (writeOptions.mergeEnvTemplate) {
+      writeOptions.expectedByKey = buildExpectedByKeyFromEnvContent(envTemplate);
+    }
+  } else {
+    envTemplate = extractEnvTemplate(configArray);
+  }
+
   const variables = extractVariablesYaml(deployment);
   const rbac = extractRbacYaml(deployment);
-  const readme = generateReadmeFromDeployJson(deployment);
+  const readme = generateReadmeFromDeployJson(deployment, { fileExt: '.yaml' });
 
-  const writeOptions = buildSplitWriteOptions(splitOptions, configArray);
   const result = await writeComponentFiles(finalOutputDir, envTemplate, variables, rbac, readme, writeOptions);
   await applyExternalSystemFilesToResult(finalOutputDir, deployment, result);
   return result;

package/lib/generator/wizard-readme.js

@@ -6,10 +6,10 @@
  */
 
 'use strict';
+const { formatSuccessLine } = require('../utils/cli-test-layout-chalk');
 
 const fs = require('fs').promises;
 const path = require('path');
-const chalk = require('chalk');
 const logger = require('../utils/logger');
 const { generateExternalReadmeContent } = require('../utils/external-readme');
 
@@ -48,7 +48,7 @@ async function generateReadme(options) {
 
     if (aiGeneratedContent) {
       await fs.writeFile(readmePath, aiGeneratedContent, 'utf8');
-      logger.log(chalk.green('✓ Generated README.md (AI-generated from dataplane)'));
+      logger.log(formatSuccessLine('Generated README.md (AI-generated from dataplane)'));
       return;
     }
 
@@ -82,7 +82,7 @@ async function generateReadme(options) {
     });
 
     await fs.writeFile(readmePath, readmeContent, 'utf8');
-    logger.log(chalk.green('✓ Generated README.md (template)'));
+    logger.log(formatSuccessLine('Generated README.md (template)'));
   } catch (error) {
     throw new Error(`Failed to generate README.md: ${error.message}`);
   }

package/lib/generator/wizard.js

@@ -8,14 +8,15 @@
  * PASSWORD, BASEURL. See docs/external-systems.md and docs/wizard.md.
  */
 
+const { formatSuccessLine } = require('../utils/cli-test-layout-chalk');
 const fs = require('fs').promises;
 const path = require('path');
 const Handlebars = require('handlebars');
-const chalk = require('chalk');
 const logger = require('../utils/logger');
 const { resolveApplicationConfigPath } = require('../utils/app-config-resolver');
 const { loadConfigFile, writeConfigFile } = require('../utils/config-format');
 const { systemKeyToKvPrefix, securityKeyToVar, isValidKvPath } = require('../utils/credential-secrets-env');
+const { generateExternalEnvTemplateContent } = require('../utils/external-env-template');
 const { generateReadme } = require('./wizard-readme');
 
 /**
@@ -60,7 +61,7 @@ async function writeSystemYamlFile(appPath, finalSystemKey, systemConfig, format
   const systemFileName = `${finalSystemKey}-system${ext}`;
   const systemFilePath = path.join(appPath, systemFileName);
   writeConfigFile(systemFilePath, systemConfig, format === 'json' ? 'json' : 'yaml');
-  logger.log(chalk.green(`✓ Generated system file: ${systemFileName}`));
+  logger.log(formatSuccessLine(`Generated system file: ${systemFileName}`));
   return systemFilePath;
 }
 
@@ -96,7 +97,7 @@ async function writeDatasourceYamlFiles(appPath, finalSystemKey, datasourceConfi
     const datasourceFilePath = path.join(appPath, datasourceFileName);
     writeConfigFile(datasourceFilePath, datasourceConfig, fmt);
     datasourceFileNames.push(datasourceFileName);
-    logger.log(chalk.green(`✓ Generated datasource file: ${datasourceFileName}`));
+    logger.log(formatSuccessLine(`Generated datasource file: ${datasourceFileName}`));
   }
   return datasourceFileNames;
 }
@@ -130,10 +131,12 @@ async function generateConfigFilesForWizard(params) {
     format: format || 'yaml'
   });
 
-  // Generate env.template with KV_* authentication variables
-  await generateEnvTemplate(appPath, systemConfig, finalSystemKey);
-
+  // Generate env.template with Authentication and Configuration sections (Handlebars)
   const envTemplatePath = path.join(appPath, 'env.template');
+  const envTemplateContent = generateExternalEnvTemplateContent(systemConfig);
+  await fs.writeFile(envTemplatePath, envTemplateContent, 'utf8');
+  logger.log(formatSuccessLine('Generated env.template'));
+
   try {
     const secretsEnsure = require('../core/secrets-ensure');
     await secretsEnsure.ensureSecretsFromEnvTemplate(envTemplatePath, { emptyValuesForCredentials: true });
@@ -161,7 +164,7 @@ async function generateConfigFilesForWizard(params) {
   const deployJson = toDeployJsonShape(manifest);
   const deployManifestPath = path.join(appPath, `${finalSystemKey}-deploy.json`);
   await fs.writeFile(deployManifestPath, JSON.stringify(deployJson, null, 2), 'utf8');
-  logger.log(chalk.green(`✓ Generated deployment manifest: ${finalSystemKey}-deploy.json`));
+  logger.log(formatSuccessLine(`Generated deployment manifest: ${finalSystemKey}-deploy.json`));
 
   return {
     variablesPath: configPath,
@@ -290,7 +293,7 @@ async function generateOrUpdateVariablesYaml(params) {
       const fsSync = require('fs');
       if (fsSync.existsSync(configPath)) fsSync.unlinkSync(configPath);
     }
-    logger.log(chalk.green(`✓ Generated/updated application${ext}`));
+    logger.log(formatSuccessLine(`Generated/updated application${ext}`));
     return targetPath;
   } catch (error) {
     throw new Error(`Failed to generate application config: ${error.message}`);
@@ -393,15 +396,15 @@ function addBaseUrlLines(lines, systemConfig) {
 }
 
 /**
- * Generate env.template with KV_* authentication variables
+ * Generate env.template with KV_* authentication variables (legacy; prefer generateExternalEnvTemplateContent).
  * @async
- * @function generateEnvTemplate
+ * @function _generateEnvTemplate
  * @param {string} appPath - Application directory path
  * @param {Object} systemConfig - System configuration (must have key for systemKey)
  * @param {string} [finalSystemKey] - Final system key for KV_ prefix (default: systemConfig.key)
  * @throws {Error} If generation fails
  */
-async function generateEnvTemplate(appPath, systemConfig, finalSystemKey) {
+async function _generateEnvTemplate(appPath, systemConfig, finalSystemKey) {
   try {
     const envTemplatePath = path.join(appPath, 'env.template');
     const systemKey = finalSystemKey || systemConfig?.key;
@@ -414,7 +417,7 @@ async function generateEnvTemplate(appPath, systemConfig, finalSystemKey) {
     addBaseUrlLines(lines, systemConfig);
 
     await fs.writeFile(envTemplatePath, lines.join('\n'), 'utf8');
-    logger.log(chalk.green('✓ Generated env.template'));
+    logger.log(formatSuccessLine('Generated env.template'));
   } catch (error) {
     throw new Error(`Failed to generate env.template: ${error.message}`);
   }
@@ -437,7 +440,7 @@ async function writeDeployScriptFromTemplate(templateName, outputPath, context)
   const templatePath = path.join(templatesExternalDir, templateName);
   const content = Handlebars.compile(await fs.readFile(templatePath, 'utf8'))(context);
   await fs.writeFile(outputPath, content, 'utf8');
-  logger.log(chalk.green(`✓ Generated ${path.basename(outputPath)}`));
+  logger.log(formatSuccessLine(`Generated ${path.basename(outputPath)}`));
 }
 
 async function generateDeployScripts(appPath, systemKey, systemFileName, datasourceFileNames) {

package/lib/infrastructure/compose.js

@@ -12,6 +12,32 @@ const fs = require('fs');
 const handlebars = require('handlebars');
 const path = require('path');
 
+/**
+ * Normalize a host path for Docker Compose bind mounts. Docker Desktop sends
+ * mounts to a Linux VM; backslashes in Windows paths yield "invalid volume
+ * specification" from the daemon.
+ *
+ * On Windows, Compose often forwards binds as "SOURCE:TARGET:rw". A SOURCE
+ * like "C:/Users/..." is split at the first colon, so the engine must receive
+ * paths in Linux-VM form (e.g. "/c/Users/...") instead.
+ *
+ * @param {string} fsPath - Host path (absolute or relative)
+ * @returns {string} Path with forward slashes, resolved when relative
+ */
+function toDockerBindMountSource(fsPath) {
+  if (!fsPath || typeof fsPath !== 'string') {
+    return fsPath;
+  }
+  let resolved = path.resolve(fsPath).split(path.sep).join('/');
+  if (process.platform === 'win32') {
+    const drive = /^([a-zA-Z]):(\/.*)$/.exec(resolved);
+    if (drive) {
+      resolved = `/${drive[1].toLowerCase()}${drive[2]}`;
+    }
+  }
+  return resolved;
+}
+
 /**
  * Builds Traefik configuration from environment variables
  * @param {boolean} enabled - Whether Traefik should be included
@@ -22,7 +48,8 @@ function buildTraefikConfig(enabled) {
     enabled: !!enabled,
     certStore: process.env.TRAEFIK_CERT_STORE || null,
     certFile: process.env.TRAEFIK_CERT_FILE || null,
-    keyFile: process.env.TRAEFIK_KEY_FILE || null
+    keyFile: process.env.TRAEFIK_KEY_FILE || null,
+    trustForwardedHeaders: false
   };
 }
 
@@ -40,13 +67,23 @@ function validateTraefikConfig(traefikConfig) {
 
   if (traefikConfig.certStore) {
     if (!traefikConfig.certFile || !traefikConfig.keyFile) {
-      errors.push('TRAEFIK_CERT_FILE and TRAEFIK_KEY_FILE are required when TRAEFIK_CERT_STORE is set');
+      errors.push(
+        'TLS is enabled for Traefik but certificate files are missing or invalid. ' +
+          'Set TRAEFIK_CERT_FILE and TRAEFIK_KEY_FILE (and TRAEFIK_CERT_STORE if used) to your local cert and key, ' +
+          'or disable TLS in application/frontDoorRouting for local development.'
+      );
     } else {
       if (!fs.existsSync(traefikConfig.certFile)) {
-        errors.push(`Certificate file not found: ${traefikConfig.certFile}`);
+        errors.push(
+          'TLS is enabled for Traefik but certificate files are missing or invalid. ' +
+            `Certificate file not found: ${traefikConfig.certFile}`
+        );
       }
       if (!fs.existsSync(traefikConfig.keyFile)) {
-        errors.push(`Private key file not found: ${traefikConfig.keyFile}`);
+        errors.push(
+          'TLS is enabled for Traefik but certificate files are missing or invalid. ' +
+            `Private key file not found: ${traefikConfig.keyFile}`
+        );
       }
     }
   }
@@ -82,6 +119,20 @@ function generateComposeFile(templatePath, devId, idNum, ports, infraDir, option
   const redisCommanderConfig = options.redisCommander && typeof options.redisCommander.enabled === 'boolean'
     ? options.redisCommander
     : { enabled: true };
+  const traefikForCompose = traefikConfig && typeof traefikConfig === 'object'
+    ? {
+      ...traefikConfig,
+      trustForwardedHeaders: !!traefikConfig.trustForwardedHeaders,
+      ...(traefikConfig.certFile
+        ? { certFile: toDockerBindMountSource(traefikConfig.certFile) }
+        : {}),
+      ...(traefikConfig.keyFile
+        ? { keyFile: toDockerBindMountSource(traefikConfig.keyFile) }
+        : {})
+    }
+    : traefikConfig;
+  const initScriptsBind = toDockerBindMountSource(path.join(infraDir, 'init-scripts'));
+  const infraDirBind = toDockerBindMountSource(infraDir);
   const composeContent = template({
     devId: devId,
     postgresPort: ports.postgres,
@@ -94,7 +145,9 @@ function generateComposeFile(templatePath, devId, idNum, ports, infraDir, option
     serversJsonPath: serversJsonPath,
     pgpassPath: pgpassPath,
     infraDir: infraDir,
-    traefik: traefikConfig,
+    initScriptsBind: initScriptsBind,
+    infraDirBind: infraDirBind,
+    traefik: traefikForCompose,
     pgadmin: pgadminConfig,
     redisCommander: redisCommanderConfig
   });
@@ -106,5 +159,6 @@ function generateComposeFile(templatePath, devId, idNum, ports, infraDir, option
 module.exports = {
   buildTraefikConfig,
   validateTraefikConfig,
-  generateComposeFile
+  generateComposeFile,
+  toDockerBindMountSource
 };