@aifabrix/builder 2.48.0 → 2.49.1

package/lib/infrastructure/traefik-tls-dynamic.js

@@ -0,0 +1,88 @@
+/**
+ * Traefik v3 dynamic TLS configuration (file provider).
+ * Static CLI flags for certificate stores were removed in Traefik v3.
+ *
+ * @fileoverview Write traefik-tls.yaml for infra compose
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+
+const TRAEFIK_TLS_DYNAMIC_BASENAME = 'traefik-tls.yaml';
+const TRAEFIK_TLS_CONTAINER_PATH = '/etc/traefik/dynamic/tls.yaml';
+const TRAEFIK_CERT_CONTAINER_PATH = '/etc/traefik/certs/tls.crt';
+const TRAEFIK_KEY_CONTAINER_PATH = '/etc/traefik/certs/tls.key';
+
+/**
+ * @param {string} storeName
+ * @returns {string}
+ */
+function buildTraefikTlsDynamicYaml(storeName) {
+  const store = String(storeName || 'default').trim() || 'default';
+  const certLine = `        certFile: ${TRAEFIK_CERT_CONTAINER_PATH}`;
+  const keyLine = `        keyFile: ${TRAEFIK_KEY_CONTAINER_PATH}`;
+  const blocks = [
+    'tls:',
+    '  stores:',
+    '    default:',
+    '      defaultCertificate:',
+    certLine,
+    keyLine
+  ];
+  if (store !== 'default') {
+    blocks.push(`    ${store}:`);
+    blocks.push('      defaultCertificate:');
+    blocks.push(certLine);
+    blocks.push(keyLine);
+  }
+  return `${blocks.join('\n')}\n`;
+}
+
+/**
+ * @param {Object} traefikConfig
+ * @returns {boolean}
+ */
+function traefikConfigHasTlsFiles(traefikConfig) {
+  return Boolean(
+    traefikConfig &&
+      traefikConfig.certStore &&
+      traefikConfig.certFile &&
+      traefikConfig.keyFile
+  );
+}
+
+/**
+ * Write dynamic TLS config for Traefik file provider when cert store + files are set.
+ *
+ * @param {string} infraDir
+ * @param {Object} traefikConfig
+ * @returns {{ hostPath: string, containerPath: string, certContainerPath: string, keyContainerPath: string }|null}
+ */
+function writeTraefikTlsDynamicConfig(infraDir, traefikConfig) {
+  if (!traefikConfigHasTlsFiles(traefikConfig)) {
+    return null;
+  }
+  const hostPath = path.join(infraDir, TRAEFIK_TLS_DYNAMIC_BASENAME);
+  const content = buildTraefikTlsDynamicYaml(traefikConfig.certStore);
+  fs.writeFileSync(hostPath, content, { mode: 0o600 });
+  return {
+    hostPath,
+    containerPath: TRAEFIK_TLS_CONTAINER_PATH,
+    certContainerPath: TRAEFIK_CERT_CONTAINER_PATH,
+    keyContainerPath: TRAEFIK_KEY_CONTAINER_PATH
+  };
+}
+
+module.exports = {
+  TRAEFIK_TLS_DYNAMIC_BASENAME,
+  TRAEFIK_TLS_CONTAINER_PATH,
+  TRAEFIK_CERT_CONTAINER_PATH,
+  TRAEFIK_KEY_CONTAINER_PATH,
+  buildTraefikTlsDynamicYaml,
+  traefikConfigHasTlsFiles,
+  writeTraefikTlsDynamicConfig
+};

package/lib/utils/app-bootstrap-api.js

@@ -0,0 +1,53 @@
+const { formatBlockingError } = require('./cli-test-layout-chalk');
+/**
+ * Bootstrap API utilities for install-time application provisioning.
+ *
+ * @fileoverview Bootstrap API call helpers
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+const chalk = require('chalk');
+const logger = require('./logger');
+const { bootstrapApplication } = require('../api/applications.api');
+const { formatApiError } = require('./api-error-handler');
+
+/**
+ * Call bootstrap provisioning API.
+ * @async
+ * @param {string} apiUrl - Controller URL
+ * @param {string} encryptionKey - Shared ENCRYPTION_KEY (never log)
+ * @param {string} environment - Environment key
+ * @param {Object} registrationData - Registration payload
+ * @returns {Promise<Object>} Application data (credentials only when newly created)
+ */
+async function callBootstrapApi(apiUrl, encryptionKey, environment, registrationData) {
+  try {
+    const response = await bootstrapApplication(apiUrl, environment, encryptionKey, registrationData);
+
+    if (!response.success) {
+      const formattedError = response.formattedError || formatApiError(response, apiUrl);
+      logger.error(formattedError);
+      logger.error(chalk.gray(`\nController URL: ${apiUrl}`));
+      throw new Error(formattedError);
+    }
+
+    const apiResponse = response.data;
+    if (apiResponse && apiResponse.data) {
+      return apiResponse.data;
+    }
+    if (apiResponse && (apiResponse.application || apiResponse.status)) {
+      return apiResponse;
+    }
+
+    logger.error(formatBlockingError('Invalid bootstrap response: missing application data'));
+    throw new Error('Invalid bootstrap response');
+  } catch (error) {
+    logger.error(formatBlockingError('Bootstrap API call failed'));
+    logger.error(chalk.gray(`Controller URL: ${apiUrl}`));
+    logger.error(chalk.gray(`Error: ${error.message}`));
+    throw error;
+  }
+}
+
+module.exports = { callBootstrapApi };

package/lib/utils/app-run-containers.js

@@ -136,10 +136,19 @@ async function checkContainerRunning(appName, developerId, debug = false, scopeO
  * @param {number|string} developerId - Developer ID (0 = default infra, > 0 = developer-specific; string allowed)
  * @param {boolean} [debug=false] - Enable debug logging
  */
-async function stopAndRemoveContainer(appName, developerId, debug = false, scopeOpts = null) {
+async function stopAndRemoveContainer(
+  appName,
+  developerId,
+  debug = false,
+  scopeOpts = null,
+  opts = {}
+) {
+  const suppressLog = opts && opts.suppressLog === true;
   try {
     const containerName = getContainerName(appName, developerId, scopeOpts);
-    logger.log(formatProgress(`Stopping container ${containerName}…`));
+    if (!suppressLog) {
+      logger.log(formatProgress(`Stopping container ${containerName}…`));
+    }
     const stopCmd = `docker stop ${containerName}`;
     if (debug) {
       logger.log(chalk.gray(`[DEBUG] Executing: ${stopCmd}`));
@@ -150,7 +159,9 @@ async function stopAndRemoveContainer(appName, developerId, debug = false, scope
       logger.log(chalk.gray(`[DEBUG] Executing: ${rmCmd}`));
     }
     await execWithDockerEnv(rmCmd);
-    logger.log(formatSuccessLine(`Container ${containerName} stopped and removed`));
+    if (!suppressLog) {
+      logger.log(formatSuccessLine(`Container ${containerName} stopped and removed`));
+    }
   } catch (error) {
     if (debug) {
       logger.log(chalk.gray(`[DEBUG] Stop/remove container error: ${error.message}`));

package/lib/utils/applications-config-defaults.js

@@ -120,8 +120,8 @@ function coerceTriStateBool(v) {
 }
 
 /**
- * Whether `aifabrix run` / resolve should use Traefik-style public URL hints for this app when infra allows.
- * Default **false** when unset. Legacy `noProxy: true` ⇒ false; legacy `noProxy: false` with no `proxy` ⇒ true.
+ * Stored per-app `proxy` preference from config (may be stale when `traefik: false`).
+ * Use {@link getEffectiveApplicationsRunProxyHint} for runtime / display.
  *
  * @param {Object|null|undefined} userConfig - Parsed config.yaml root
  * @param {string} appKey - Application key
@@ -183,6 +183,21 @@ async function persistApplicationRunProxyFlag(appKey, proxyEnabled) {
   await config.saveConfig(cfg);
 }
 
+/**
+ * Effective proxy hint for URL expansion and CLI display.
+ * Always **false** when infra Traefik is off — stored `applications.<app>.proxy` is ignored.
+ *
+ * @param {Object|null|undefined} userConfig
+ * @param {string} appKey
+ * @returns {boolean}
+ */
+function getEffectiveApplicationsRunProxyHint(userConfig, appKey) {
+  if (!userConfig || userConfig.traefik !== true) {
+    return false;
+  }
+  return getApplicationsRunProxyHint(userConfig, appKey);
+}
+
 /**
  * Whether declarative `url://*` expansion should treat Traefik as on (infra Traefik + per-app `proxy: true`).
  *
@@ -191,11 +206,12 @@ async function persistApplicationRunProxyFlag(appKey, proxyEnabled) {
  * @returns {boolean}
  */
 function isDeclarativeTraefikUrlsEnabled(userConfig, appKey) {
-  return Boolean(userConfig && userConfig.traefik === true) && getApplicationsRunProxyHint(userConfig, appKey);
+  return getEffectiveApplicationsRunProxyHint(userConfig, appKey);
 }
 
 module.exports = {
   getApplicationsRunProxyHint,
+  getEffectiveApplicationsRunProxyHint,
   isApplicationsReloadDefaultOn,
   isDeclarativeTraefikUrlsEnabled,
   isPreferLocalEnvOutputPath,

package/lib/utils/compose-generate-docker-compose.js

@@ -144,6 +144,8 @@ function buildComposeTemplateContext(ctx) {
     dbInitEnvFile: ctx.dbInitEnvFileAbsolutePath,
     databasePasswords: ctx.databasePasswords,
     devId: ctx.idNum,
+    idNum: ctx.idNum,
+    traefikScoped: ctx.idNum > 0,
     networkName: ctx.networkName,
     containerName: ctx.containerName,
     misoEnvironment: resolveMisoEnvironment(ctx.options),
@@ -201,7 +203,12 @@ async function readDatabasePasswordsIfNeeded(readDatabasePasswords, requiresData
  * @returns {Promise<object>}
  */
 async function loadComposeHead(deps, appName, appConfig, options) {
-  const { loadDockerComposeTemplate, resolveComposeImageOverrideString, getDeveloperIdAndNumeric, getRemoteServerForCompose } = deps;
+  const {
+    loadDockerComposeTemplate,
+    resolveComposeImageOverrideString,
+    getDeveloperIdAndNumeric,
+    getFrontDoorHostContextForCompose
+  } = deps;
   const language = appConfig.build?.language || appConfig.language || 'typescript';
   const template = loadDockerComposeTemplate(language);
   const port = options.port || appConfig.port || 3000;
@@ -209,10 +216,13 @@ async function loadComposeHead(deps, appName, appConfig, options) {
   const { devId, idNum } = await getDeveloperIdAndNumeric();
   const { scoped } = resolveScopedComposeOpts(options);
   let remoteServer = null;
-  if (typeof getRemoteServerForCompose === 'function') {
-    remoteServer = await getRemoteServerForCompose();
+  let developerRootDomain = null;
+  if (typeof getFrontDoorHostContextForCompose === 'function') {
+    const frontDoorCtx = await getFrontDoorHostContextForCompose();
+    remoteServer = frontDoorCtx.remoteServer;
+    developerRootDomain = frontDoorCtx.developerRootDomain;
   }
-  return { template, port, imageOverride, devId, idNum, scoped, remoteServer };
+  return { template, port, imageOverride, devId, idNum, scoped, remoteServer, developerRootDomain };
 }
 
 /**
@@ -224,12 +234,13 @@ async function loadComposeHead(deps, appName, appConfig, options) {
  */
 function buildComposeLayouts(deps, appName, appConfig, head, options) {
   const { buildNetworkAndContainerNames, buildServiceConfig, buildVolumesConfig, buildNetworksConfig } = deps;
-  const { port, imageOverride, devId, idNum, scoped, remoteServer } = head;
+  const { port, imageOverride, devId, idNum, scoped, remoteServer, developerRootDomain } = head;
   const { networkName, containerName } = buildNetworkAndContainerNames(appName, devId, idNum, scoped);
   const serviceConfig = buildServiceConfig(appName, appConfig, port, devId, {
     imageOverride,
     scopeOpts: scoped,
     remoteServer,
+    developerRootDomain,
     omitAppTraefikLabels: options && options.omitAppTraefikLabels === true
   });
   const volumesConfig = buildVolumesConfig(appName);

package/lib/utils/compose-generator.js

@@ -116,7 +116,7 @@ function buildImageConfig(config, appName, imageOverride) {
  * @param {string|null|undefined} [readinessSuffix] - Path after vdir (default /health/ready or healthCheck.readinessPathSuffix)
  * @returns {string} Absolute path starting with /
  */
-function computeAlignedHealthCheckPath(config, devId, scopeOpts, remoteServer, readinessSuffix) {
+function computeAlignedHealthCheckPath(config, devId, scopeOpts, remoteServer, readinessSuffix, developerRootDomain) {
   const hc = config.healthCheck || {};
   let suffix = '/health/ready';
   if (
@@ -128,7 +128,7 @@ function computeAlignedHealthCheckPath(config, devId, scopeOpts, remoteServer, r
   } else if (typeof hc.readinessPathSuffix === 'string' && hc.readinessPathSuffix.startsWith('/')) {
     suffix = hc.readinessPathSuffix;
   }
-  const traefik = buildTraefikIngressBase(config, devId, scopeOpts, remoteServer);
+  const traefik = buildTraefikIngressBase(config, devId, scopeOpts, remoteServer, developerRootDomain);
   if (traefik.enabled === true) {
     const p = traefik.path;
     if (!p || p === '/') {
@@ -158,7 +158,7 @@ function computeAlignedHealthCheckPath(config, devId, scopeOpts, remoteServer, r
  * @param {{ skipVdirMergeWhenPathIsBareHealth?: boolean }} [opts] - When `skipVdirMergeWhenPathIsBareHealth`, path `/health` is left as-is (in-container probe; ingress strips vdir for miso/dataplane). Deployment JSON health paths do **not** use this helper — see `buildHealthCheck` in `builders.js` (YAML paths only).
  * @returns {string} Absolute path starting with /
  */
-function resolveHealthCheckPathWithFrontDoorVdir(config, devId, scopeOpts, remoteServer, opts) {
+function resolveHealthCheckPathWithFrontDoorVdir(config, devId, scopeOpts, remoteServer, opts, developerRootDomain) {
   const hc = config.healthCheck || {};
   const raw = typeof hc.path === 'string' && hc.path.startsWith('/') ? hc.path : '/health';
   const fd = config.frontDoorRouting;
@@ -168,7 +168,7 @@ function resolveHealthCheckPathWithFrontDoorVdir(config, devId, scopeOpts, remot
   if (opts && opts.skipVdirMergeWhenPathIsBareHealth === true && raw === '/health') {
     return raw;
   }
-  const traefik = buildTraefikIngressBase(config, devId, scopeOpts, remoteServer);
+  const traefik = buildTraefikIngressBase(config, devId, scopeOpts, remoteServer, developerRootDomain);
   if (traefik.enabled !== true) {
     return raw;
   }
@@ -178,7 +178,7 @@ function resolveHealthCheckPathWithFrontDoorVdir(config, devId, scopeOpts, remot
       ? ''
       : String(vdirRaw).replace(/\/+$/, '');
   if (!vdir) {
-    return computeAlignedHealthCheckPath(config, devId, scopeOpts, remoteServer, raw);
+    return computeAlignedHealthCheckPath(config, devId, scopeOpts, remoteServer, raw, developerRootDomain);
   }
   if (raw === vdir || raw.startsWith(`${vdir}/`)) {
     return raw;
@@ -192,13 +192,14 @@ function resolveHealthCheckPathWithFrontDoorVdir(config, devId, scopeOpts, remot
  * @param {string|number} devId - Developer id
  * @param {Object|null} scopeOpts - Env-scoped compose options
  * @param {string|null|undefined} remoteServer - Remote server URL
+ * @param {string|null|undefined} [developerRootDomain] - App hostname root
  * @returns {Object} Health check configuration
  */
-function buildHealthCheckConfig(config, devId, scopeOpts, remoteServer) {
+function buildHealthCheckConfig(config, devId, scopeOpts, remoteServer, developerRootDomain) {
   const hc = config.healthCheck || {};
   const path = resolveHealthCheckPathWithFrontDoorVdir(config, devId, scopeOpts, remoteServer, {
     skipVdirMergeWhenPathIsBareHealth: true
-  });
+  }, developerRootDomain);
   return {
     path,
     interval: hc.interval || 30,
@@ -230,10 +231,11 @@ function buildDevUsername(devId) {
  * @param {Object|null} scopeOpts - Env-scoped Traefik path
  * @param {string|null|undefined} remoteServer - From config (for ${REMOTE_HOST})
  * @param {string|undefined} [resolvedHealthPathForStrip] - Compose health path; when omitted, derived via resolveHealthCheckPathWithFrontDoorVdir (same as probe)
+ * @param {string|null|undefined} [developerRootDomain] - App hostname root from settings
  * @returns {Object} Traefik configuration object
  */
-function buildTraefikConfig(config, devId, scopeOpts = null, remoteServer = null, resolvedHealthPathForStrip) {
-  const base = buildTraefikIngressBase(config, devId, scopeOpts, remoteServer);
+function buildTraefikConfig(config, devId, scopeOpts = null, remoteServer = null, resolvedHealthPathForStrip, developerRootDomain) {
+  const base = buildTraefikIngressBase(config, devId, scopeOpts, remoteServer, developerRootDomain);
   if (!base.enabled) {
     return { enabled: false };
   }
@@ -242,7 +244,7 @@ function buildTraefikConfig(config, devId, scopeOpts = null, remoteServer = null
       ? String(resolvedHealthPathForStrip)
       : resolveHealthCheckPathWithFrontDoorVdir(config, devId, scopeOpts, remoteServer, {
         skipVdirMergeWhenPathIsBareHealth: true
-      });
+      }, developerRootDomain);
   const devNum = parseDeveloperIdNum(devId);
   // Shared builder host: nginx terminates TLS on :443 and proxies HTTP to per-dev Traefik :80 (e.g. 280).
   // Traefik must only attach routers to `web` for developer-id > 0; `websecure`+tls labels without
@@ -282,6 +284,7 @@ function buildRequiresConfig(config) {
  * @param {string} [runExtras.imageOverride] - Full image reference for run (e.g. from --image)
  * @param {Object|null} [runExtras.scopeOpts] - Traefik / scoped compose options
  * @param {string|null|undefined} [runExtras.remoteServer] - For ${REMOTE_HOST} in frontDoorRouting.host
+ * @param {string|null|undefined} [runExtras.developerRootDomain] - App hostname root (overrides remote-server host)
  * @param {boolean} [runExtras.omitAppTraefikLabels] - When true (user config `traefik: false`), omit Traefik labels and BASE_PATH env from compose even if application.yaml enables frontDoorRouting
  * @returns {Object} Service configuration
  */
@@ -290,6 +293,7 @@ function buildServiceConfig(appName, config, port, devId, runExtras = {}) {
     imageOverride = null,
     scopeOpts = null,
     remoteServer = null,
+    developerRootDomain = null,
     omitAppTraefikLabels = false
   } = runExtras;
   const containerPortValue = getContainerPort(config, 3000);
@@ -303,7 +307,7 @@ function buildServiceConfig(appName, config, port, devId, runExtras = {}) {
     ? composeTraefikServiceKey(appName, scopeOpts.runEnvKey)
     : null;
   const scopeForHealthAndTraefik = useTraefikScope ? scopeOpts : null;
-  const healthCheck = buildHealthCheckConfig(config, devId, scopeForHealthAndTraefik, remoteServer);
+  const healthCheck = buildHealthCheckConfig(config, devId, scopeForHealthAndTraefik, remoteServer, developerRootDomain);
   return {
     app: buildAppConfig(appName, config, composeAppKey),
     image: buildImageConfig(config, appName, imageOverride),
@@ -319,7 +323,8 @@ function buildServiceConfig(appName, config, port, devId, runExtras = {}) {
           devId,
           scopeForHealthAndTraefik,
           remoteServer,
-          healthCheck.path
+          healthCheck.path,
+          developerRootDomain
         ),
     ...buildRequiresConfig(config)
   };
@@ -379,20 +384,34 @@ function buildNetworkAndContainerNames(appName, devId, idNum, scopeOpts = null)
 }
 
 const { createGenerateDockerCompose } = require('./compose-generate-docker-compose');
-async function getRemoteServerForCompose() {
+async function getFrontDoorHostContextForCompose() {
   try {
     const rs = await config.getRemoteServer();
-    return rs && String(rs).trim() ? String(rs).trim() : null;
+    const remoteServer = rs && String(rs).trim() ? String(rs).trim() : null;
+    let developerRootDomain = null;
+    try {
+      const root = await config.getDeveloperRootDomain();
+      developerRootDomain = root && String(root).trim() ? String(root).trim() : null;
+    } catch {
+      developerRootDomain = null;
+    }
+    return { remoteServer, developerRootDomain };
   } catch {
-    return null;
+    return { remoteServer: null, developerRootDomain: null };
   }
 }
 
+async function getRemoteServerForCompose() {
+  const ctx = await getFrontDoorHostContextForCompose();
+  return ctx.remoteServer;
+}
+
 const generateDockerCompose = createGenerateDockerCompose({
   loadDockerComposeTemplate,
   resolveComposeImageOverrideString,
   getDeveloperIdAndNumeric,
   getRemoteServerForCompose,
+  getFrontDoorHostContextForCompose,
   buildNetworkAndContainerNames,
   buildServiceConfig,
   buildVolumesConfig,

package/lib/utils/compose-traefik-ingress-base.js

@@ -10,6 +10,10 @@ const {
   buildEnvScopedTraefikPath
 } = require('./environment-scoped-resources');
 const { parseDeveloperIdNum } = require('./declarative-url-ports');
+const {
+  resolveRemoteHostForFrontDoor,
+  hasFrontDoorRemoteHostContext
+} = require('./remote-host-for-front-door');
 
 /**
  * Derives base path from routing pattern by removing trailing wildcards
@@ -66,21 +70,15 @@ function buildDevUsernameForFrontDoorHost(devId) {
  * @param {string} template
  * @param {string|number|null|undefined} developerIdRaw
  * @param {string|null|undefined} remoteServer
+ * @param {string|null|undefined} [developerRootDomain] - App hostname root (overrides remote-server hostname for ${REMOTE_HOST})
  * @returns {string}
  */
-function expandFrontDoorHostPlaceholders(template, developerIdRaw, remoteServer) {
+function expandFrontDoorHostPlaceholders(template, developerIdRaw, remoteServer, developerRootDomain) {
   let t = String(template || '');
   t = t.replace(/\$\{DEV_USERNAME\}\$\{REMOTE_HOST\}/g, '${DEV_USERNAME}.${REMOTE_HOST}');
   const devU = buildDevUsernameForFrontDoorHost(developerIdRaw);
   t = t.replace(/\$\{DEV_USERNAME\}/g, devU);
-  let remoteHost = '';
-  try {
-    if (remoteServer && String(remoteServer).trim()) {
-      remoteHost = new URL(String(remoteServer).trim()).hostname;
-    }
-  } catch {
-    remoteHost = '';
-  }
+  const remoteHost = resolveRemoteHostForFrontDoor({ remoteServer, developerRootDomain });
   t = t.replace(/\$\{REMOTE_HOST\}/g, remoteHost);
   t = t.replace(/^\.+/g, '').replace(/\.{2,}/g, '.').replace(/\.+$/g, '').trim();
   return t;
@@ -90,13 +88,13 @@ function templateUsesRemoteHostPlaceholder(hostTemplate) {
   return /\$\{REMOTE_HOST\}/.test(String(hostTemplate || ''));
 }
 
-function resolveTraefikRouterHost(hostTemplate, developerIdRaw, remoteServer) {
+function resolveTraefikRouterHost(hostTemplate, developerIdRaw, remoteServer, developerRootDomain) {
   const usesRemote = templateUsesRemoteHostPlaceholder(hostTemplate);
-  const hasRemote = Boolean(remoteServer && String(remoteServer).trim());
+  const hasRemote = hasFrontDoorRemoteHostContext({ remoteServer, developerRootDomain });
   if (usesRemote && !hasRemote) {
     return 'localhost';
   }
-  return expandFrontDoorHostPlaceholders(hostTemplate, developerIdRaw, remoteServer);
+  return expandFrontDoorHostPlaceholders(hostTemplate, developerIdRaw, remoteServer, developerRootDomain);
 }
 
 /**
@@ -108,9 +106,10 @@ function resolveTraefikRouterHost(hostTemplate, developerIdRaw, remoteServer) {
  * @param {string|number} devId - Developer id for host expansion
  * @param {Object|null} scopeOpts - Env-scoped Traefik path (effectiveEnvironmentScopedResources, runEnvKey)
  * @param {string|null|undefined} remoteServer - For ${REMOTE_HOST}
+ * @param {string|null|undefined} [developerRootDomain] - App hostname root from settings
  * @returns {{ enabled: false } | { enabled: true, host: string, path: string, tls: boolean, certStore: string|null }}
  */
-function buildTraefikIngressBase(config, devId, scopeOpts, remoteServer) {
+function buildTraefikIngressBase(config, devId, scopeOpts, remoteServer, developerRootDomain) {
   const frontDoor = config.frontDoorRouting;
   if (!frontDoor || frontDoor.enabled !== true) {
     return { enabled: false };
@@ -118,7 +117,7 @@ function buildTraefikIngressBase(config, devId, scopeOpts, remoteServer) {
   if (!frontDoor.host || typeof frontDoor.host !== 'string') {
     throw new Error('frontDoorRouting.host is required when frontDoorRouting.enabled is true');
   }
-  const host = resolveTraefikRouterHost(frontDoor.host, devId, remoteServer);
+  const host = resolveTraefikRouterHost(frontDoor.host, devId, remoteServer, developerRootDomain);
   const basePath = derivePathFromPattern(frontDoor.pattern);
   let pathOut = basePath;
   if (

package/lib/utils/config-paths.js

@@ -22,6 +22,7 @@ const SETTINGS_RESPONSE_KEYS = [
   'aifabrix-env-config',
   'remote-server',
   'docker-endpoint',
+  'developer-root-domain',
   'docker-tls-skip-verify',
   'sync-ssh-user',
   'sync-ssh-host'
@@ -290,6 +291,9 @@ function createRemoteConfigGetters(getConfigFn) {
     },
     async getSyncSshHost() {
       return getPathConfig(getConfigFn, 'sync-ssh-host');
+    },
+    async getDeveloperRootDomain() {
+      return getPathConfig(getConfigFn, 'developer-root-domain');
     }
   };
 }
@@ -424,6 +428,7 @@ module.exports = {
   resolveEnvConfigPathToAbsolute,
   SETTINGS_RESPONSE_KEYS,
   applySecretsUrlFromRemote,
-  applySyncAndDockerFromHost
+  applySyncAndDockerFromHost,
+  hostnameFromUrl
 };
 

package/lib/utils/dev-user-groups.js

@@ -8,6 +8,7 @@
 const ALLOWED_DEV_GROUPS = Object.freeze([
   'admin',
   'secret-manager',
+  'secret-reader',
   'developer',
   'docker'
 ]);