@akash-chowdhury-24/deployhub 2.0.31 → 2.0.33

package/README.md

@@ -855,7 +855,7 @@ DeployHub detects whether the server uses Debian-style `sites-available` or RHEL
 1. Set `DOCKER_IMAGE_NAME` in `.env` (e.g. `myuser/myapp` for Docker Hub)
 2. For private registries (or any push): set `DOCKER_REGISTRY_USERNAME` and `DOCKER_REGISTRY_TOKEN`
 3. Leave `DOCKER_IMAGE_TAG` unset for a unique tag each build — set it only if you intentionally want a fixed tag
-4. For remote Docker: set `DOCKER_HOST` (e.g. `ssh://ubuntu@203.0.113.10`)
+4. For a remote Linux host, choose **Remote Linux server via SSH** at init (`remote.mode: "ssh"`) and set `SSH_HOST`, `SSH_USER`, `SSH_KEY_PATH` — DeployHub runs `docker pull`/`run` over node-ssh. Use `DOCKER_HOST` only for the advanced raw CLI transport (`tcp://` or a custom `ssh://` setup you already manage)
 5. Run `deployhub doctor`, then `git push origin main`
 
 | Variable | Description | Example | Where to get it |
@@ -865,7 +865,8 @@ DeployHub detects whether the server uses Debian-style `sites-available` or RHEL
 | `DOCKER_REGISTRY_URL` | Registry URL (optional) | `https://ghcr.io` | Registry docs |
 | `DOCKER_REGISTRY_USERNAME` | Registry user | `myuser` | Registry account |
 | `DOCKER_REGISTRY_TOKEN` | Registry password/token | *(secret)* | Docker Hub / GHCR PAT |
-| `DOCKER_HOST` | Remote daemon (optional) | `ssh://ubuntu@host` | Remote Docker setup |
+| `DOCKER_HOST` | Advanced raw daemon URI (optional) | `tcp://host:2376` | Only if you manage TLS/ssh:// yourself |
+| `SSH_HOST` / `SSH_USER` / `SSH_KEY_PATH` | Remote Linux via SSH (`remote.mode: ssh`) | `203.0.113.10` / `ubuntu` / `~/.ssh/key.pem` | Same names as EC2 |
 
 ### AWS EC2
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@akash-chowdhury-24/deployhub",
-  "version": "2.0.31",
+  "version": "2.0.33",
   "description": "Zero-configuration deployment and artifact manager",
   "type": "module",
   "main": "./src/cli/index.js",

package/src/commands/deploy.js

@@ -11,6 +11,10 @@ import {
   runHealthChecksForEnvs,
   formatHealthCheckAllSummary,
 } from '../utils/health-check.js';
+import {
+  runDockerPortPublishChecksForEnvs,
+  verifyStageShouldRun,
+} from '../utils/docker-port-publish.js';
 import { createLogger } from '../logger/index.js';
 
 /**
@@ -76,12 +80,28 @@ export function registerDeployCommand(program) {
             const deployed = /** @type {string[]} */ (
               ctx.state.deployedTargets || targets
             );
-            return anyEnvHasResolvableHealthCheckUrl(ctx.config, deployed);
+            return verifyStageShouldRun(
+              ctx.config,
+              deployed,
+              anyEnvHasResolvableHealthCheckUrl
+            );
           },
           async run(ctx) {
             const deployed = /** @type {string[]} */ (
               ctx.state.deployedTargets || targets
             );
+            const portOutcome = await runDockerPortPublishChecksForEnvs(
+              ctx.config,
+              deployed,
+              { requireRunning: true }
+            );
+            if (portOutcome.failures.length > 0) {
+              throw new Error(portOutcome.failures[0].error);
+            }
+            for (const r of portOutcome.results) {
+              console.log(chalk.green(`Docker port published (${r.envName}): ${r.message}`));
+            }
+
             const { results, failures } = await runHealthChecksForEnvs(
               ctx.config,
               deployed

package/src/commands/doctor.js

@@ -31,6 +31,19 @@ import { formatPasswordlessSudoGuidance } from '../utils/nginx.js';
 import { checkImagePullability } from '../utils/docker-image-deploy.js';
 import { namespaceExists } from '../utils/kubernetes-namespace.js';
 import { resolvePhpVersion } from '../utils/php-version.js';
+import {
+  resolveDockerSshTarget,
+  probeRemoteDockerPs,
+  formatRemoteDockerSshFailure,
+  formatRemoteDockerNotInstalled,
+  formatRemoteDockerPermissionDenied,
+  formatRemoteDockerDaemonOk,
+} from '../utils/docker-remote.js';
+import { resolveDockerRemoteMode } from '../utils/docker-remote-mode.js';
+import {
+  checkEnvDockerPortPublish,
+  resolveDockerPublishPort,
+} from '../utils/docker-port-publish.js';
 import {
   buildPhpFpmUnitListCommand,
   formatPhpFpmMissingError,
@@ -183,14 +196,16 @@ export async function runDeploymentChecks(config, envName, envConfig) {
 
   /** @type {CheckResult[]} */
   const checks = [];
-  const requiredKeys = getDeploymentEnvKeys(deployType, config);
+  const requiredKeys = getDeploymentEnvKeys(deployType, config, settings);
 
   checks.push(
     await runCheck(`${deployType} env vars`, async () => {
       const missing = requiredKeys.filter((k) => {
         if (k === 'SSH_KEY_PATH') {
-          return !process.env.SSH_KEY_PATH && !process.env.SSH_KEY;
+          return !process.env.SSH_KEY_PATH && !process.env.SSH_KEY && !settings.keyPath;
         }
+        if (k === 'SSH_HOST') return !(settings.host || process.env.SSH_HOST);
+        if (k === 'SSH_USER') return !(settings.user || process.env.SSH_USER);
         return !process.env[k];
       });
       if (missing.length > 0) {
@@ -447,22 +462,155 @@ export async function runDeploymentChecks(config, envName, envConfig) {
   }
 
   if (deployType === 'docker') {
-    checks.push(
-      await runCheck('Docker daemon', async () => {
-        try {
-          const provider = getDeploymentProvider('docker', config, envName);
-          await provider.testConnection();
-          return { name: 'Docker daemon', pass: true, message: 'Docker daemon reachable' };
-        } catch (err) {
-          const msg = err instanceof Error ? err.message : String(err);
+    const dockerRemoteMode = resolveDockerRemoteMode(settings, process.env);
+
+    if (dockerRemoteMode === 'ssh') {
+      const target = resolveDockerSshTarget(settings, process.env);
+      const host = target.host;
+      const user = target.user;
+      const keyPath = target.keyPath;
+      const sshPort = target.sshPort;
+
+      checks.push(
+        await runCheck('SSH key', async () => {
+          const result = await validateSshKeyForDoctor(
+            keyPath ? String(keyPath) : undefined,
+            process.env.SSH_KEY
+          );
           return {
-            name: 'Docker daemon',
+            name: 'SSH key',
+            pass: result.ok,
+            message: result.message,
+          };
+        })
+      );
+
+      checks.push(
+        await runCheck('SSH host reachability', async () => {
+          if (!host) {
+            return {
+              name: 'SSH host reachability',
+              pass: false,
+              message: 'SSH_HOST is required — set it in .env to your server IP or hostname.',
+            };
+          }
+          const result = await testSshHostReachability(String(host), sshPort);
+          return {
+            name: 'SSH host reachability',
+            pass: result.ok,
+            message: result.message,
+          };
+        })
+      );
+
+      checks.push(
+        await runCheck('Remote Docker daemon reachable', async () => {
+          const probe = await probeRemoteDockerPs(target);
+          if (!probe.sshOk) {
+            return {
+              name: 'Remote Docker daemon reachable',
+              pass: false,
+              message: formatRemoteDockerSshFailure(host, user),
+            };
+          }
+          if (probe.kind === 'not-installed') {
+            return {
+              name: 'Remote Docker daemon reachable',
+              pass: false,
+              message: formatRemoteDockerNotInstalled(host, user),
+            };
+          }
+          if (probe.kind === 'ok' || probe.kind === 'permission') {
+            return {
+              name: 'Remote Docker daemon reachable',
+              pass: true,
+              message: formatRemoteDockerDaemonOk(host, user),
+            };
+          }
+          return {
+            name: 'Remote Docker daemon reachable',
             pass: false,
-            message: `Docker not reachable — ${msg}. Install Docker or set DOCKER_HOST for a remote daemon.`,
+            message:
+              probe.detail ||
+              `Remote Docker daemon is not reachable (${user}@${host}).`,
           };
-        }
-      })
-    );
+        })
+      );
+
+      checks.push(
+        await runCheck('Remote Docker permission', async () => {
+          const probe = await probeRemoteDockerPs(target);
+          if (!probe.sshOk) {
+            return {
+              name: 'Remote Docker permission',
+              pass: false,
+              message: formatRemoteDockerSshFailure(host, user),
+            };
+          }
+          if (probe.kind === 'permission') {
+            return {
+              name: 'Remote Docker permission',
+              pass: false,
+              message: formatRemoteDockerPermissionDenied(host, user),
+            };
+          }
+          if (probe.kind === 'ok') {
+            return {
+              name: 'Remote Docker permission',
+              pass: true,
+              message: `SSH user '${user}' can access the Docker daemon on ${host}`,
+            };
+          }
+          if (probe.kind === 'not-installed') {
+            return {
+              name: 'Remote Docker permission',
+              pass: false,
+              message: formatRemoteDockerNotInstalled(host, user),
+            };
+          }
+          return {
+            name: 'Remote Docker permission',
+            pass: false,
+            message:
+              probe.detail ||
+              `Cannot verify Docker permissions for '${user}' on ${host}.`,
+          };
+        })
+      );
+    } else {
+      checks.push(
+        await runCheck('Docker daemon', async () => {
+          try {
+            const provider = getDeploymentProvider('docker', config, envName);
+            await provider.testConnection();
+            return { name: 'Docker daemon', pass: true, message: 'Docker daemon reachable' };
+          } catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            return {
+              name: 'Docker daemon',
+              pass: false,
+              message: `Docker not reachable — ${msg}. Install Docker or set DOCKER_HOST for a remote daemon.`,
+            };
+          }
+        })
+      );
+    }
+
+    const publishPort = resolveDockerPublishPort(config, settings, envName);
+    if (dockerRemoteMode === 'ssh' || publishPort != null) {
+      checks.push(
+        await runCheck('Docker port published', async () => {
+          const outcome = await checkEnvDockerPortPublish(config, envName, {
+            requireRunning: false,
+          });
+          return {
+            name: 'Docker port published',
+            pass: outcome.pass,
+            message: outcome.message,
+          };
+        })
+      );
+    }
   }
 
   if (deployType === 'kubernetes') {
@@ -1142,7 +1290,9 @@ export function registerDoctorCommand(program) {
             const method = getEnvMethod(env);
             if (!method) continue;
             // Local/.env uses unprefixed names; prefixed CI names are checked separately below.
-            required.push(...getDeploymentSecretKeys(method, config));
+            required.push(
+              ...getDeploymentSecretKeys(method, config, getEnvSettings(env))
+            );
           }
 
           const unique = [...new Set(required)];
@@ -1179,7 +1329,7 @@ export function registerDoctorCommand(program) {
             config,
             config.environments
           );
-          const baseKeys = getDeploymentSecretKeys(method, config);
+          const baseKeys = getDeploymentSecretKeys(method, config, getEnvSettings(env));
 
           for (let i = 0; i < baseKeys.length; i++) {
             const base = baseKeys[i];

package/src/commands/env.js

@@ -164,6 +164,7 @@ export function registerEnvCommand(program) {
             existingEnvNames: Object.keys(config.environments || {}),
             deployType: opts.method,
             nonInteractive: Boolean(opts.yes),
+            portDefault: config.port,
           }
         );
       } catch (err) {
@@ -171,12 +172,21 @@ export function registerEnvCommand(program) {
         process.exit(1);
       }
 
+      // Docker env add must not inherit top-level port via singleConfig — that
+      // silently stamps another environment's port onto the new env. Interactive
+      // answers carry deployAnswers.port; --yes omits it so SSH deploy/doctor
+      // fail with the published-port error instead of a wrong fallback.
+      const entrySingleConfig =
+        deployAnswers.deployType === 'docker'
+          ? { framework: singleConfig?.framework, port: deployAnswers.port }
+          : singleConfig;
+
       config.environments[name] = buildServerEnvEntry(
         deployAnswers,
         projectType,
         config.project,
         backendConfig,
-        singleConfig
+        entrySingleConfig
       );
 
       if (!config.defaultEnvironment) {

package/src/commands/init.js

@@ -382,6 +382,7 @@ export function registerInitCommand(program) {
             {
               ...(opts.envName ? { envName: opts.envName } : {}),
               existingEnvNames: Object.keys(environments),
+              portDefault: singleConfig?.port ?? backendConfig?.port,
             }
           );
           primaryDeployType = deployAnswers.deployType;

package/src/commands/verify.js

@@ -7,6 +7,10 @@ import {
   runHealthChecksForEnvs,
   formatHealthCheckAllSummary,
 } from '../utils/health-check.js';
+import {
+  runDockerPortPublishChecksForEnvs,
+  verifyStageShouldRun,
+} from '../utils/docker-port-publish.js';
 
 /**
  * Standalone verify — same per-env URL resolution and summary as the deploy pipeline stage.
@@ -31,7 +35,7 @@ export async function runVerify(config, envFlag, options = {}) {
     };
   }
 
-  if (!anyEnvHasResolvableHealthCheckUrl(config, targets)) {
+  if (!verifyStageShouldRun(config, targets, anyEnvHasResolvableHealthCheckUrl)) {
     const label =
       targets.length === 1
         ? `environment "${targets[0]}"`
@@ -47,28 +51,47 @@ export async function runVerify(config, envFlag, options = {}) {
     };
   }
 
+  const portOutcome = await runDockerPortPublishChecksForEnvs(config, targets, {
+    requireRunning: true,
+    ...options,
+  });
+
   const { results, failures } = await runHealthChecksForEnvs(config, targets, options);
-  const multi = targets.length > 1 || failures.length > 0;
+  const allFailures = [
+    ...portOutcome.failures.map((f) => ({ envName: f.envName, url: '', error: f.error })),
+    ...failures,
+  ];
+  const portResults = portOutcome.results.map((r) => ({
+    envName: r.envName,
+    url: '',
+    status: 0,
+    elapsed: 0,
+    message: r.message,
+  }));
+  const mergedResults = [...portResults, ...results];
+  const multi = targets.length > 1 || allFailures.length > 0;
   const summary = multi ? formatHealthCheckAllSummary(results, failures) : '';
 
   let message = '';
-  if (failures.length === 0 && results.length === 1 && !multi) {
+  if (allFailures.length === 0 && results.length === 1 && portOutcome.results.length === 0 && !multi) {
     const r = results[0];
     message = `Health check passed (${r.envName}): HTTP ${r.status} (${r.elapsed}ms)`;
-  } else if (failures.length === 0 && results.length === 0) {
+  } else if (allFailures.length === 0 && results.length === 0 && portOutcome.results.length === 1) {
+    message = portOutcome.results[0].message;
+  } else if (allFailures.length === 0 && results.length === 0 && portOutcome.results.length === 0) {
     message = `No health check URL configured for the selected environment(s).`;
   }
 
   return {
-    ok: failures.length === 0 && results.length > 0,
+    ok: allFailures.length === 0 && (results.length > 0 || portOutcome.results.length > 0),
     targets,
-    results,
-    failures,
+    results: mergedResults,
+    failures: allFailures,
     summary,
     message:
       message ||
-      (failures.length > 0
-        ? failures[0].error
+      (allFailures.length > 0
+        ? allFailures[0].error
         : `All ${results.length} environment(s) passed health checks.`),
     skippedDisabled,
   };

package/src/core/config.js

@@ -54,6 +54,16 @@ const MethodConfigSchema = z
     dockerImageName: z.string().optional(),
     dockerRegistryUrl: z.string().optional(),
     dockerHost: z.string().optional(),
+    /**
+     * Docker-method only. Kubernetes must ignore this — it deploys via kubectl,
+     * never a remote Docker daemon. `ssh` = node-ssh + remote docker CLI;
+     * `local` = this machine; `raw` = unmanaged DOCKER_HOST (ssh:// or tcp://).
+     */
+    remote: z
+      .object({
+        mode: z.enum(['ssh', 'local', 'raw']),
+      })
+      .optional(),
     healthCheckUrl: z.string().optional(),
     appName: z.string().optional(),
     framework: z.string().optional(),

package/src/core/environments.js

@@ -266,6 +266,22 @@ export function resolveEnvTargets(config, envFlag) {
   return { targets: [envFlag], skippedDisabled: [] };
 }
 
+/**
+ * Whitelist of method-config fields copied onto process env for Docker and
+ * Kubernetes providers. Structural (not a per-method if): only these keys are
+ * ever copied. `remote` / `host` / `user` / `keyPath` are intentionally absent
+ * — docker SSH identity is read by docker.js from settings + SSH_* env vars.
+ * Kubernetes uses this same helper and therefore cannot observe remote.mode.
+ */
+export const METHOD_SETTINGS_ENV_OVERLAY = Object.freeze({
+  dockerImageName: 'DOCKER_IMAGE_NAME',
+  dockerRegistryUrl: 'DOCKER_REGISTRY_URL',
+  dockerHost: 'DOCKER_HOST',
+  kubeNamespace: 'KUBE_NAMESPACE',
+  kubeconfig: 'KUBECONFIG',
+  kubeContext: 'KUBE_CONTEXT',
+});
+
 /**
  * Overlay method-specific config onto process env for Docker/K8s providers.
  * Secrets still come from real env vars; non-secret names/paths come from config.
@@ -277,12 +293,10 @@ export function resolveEnvTargets(config, envFlag) {
 export function mergeMethodSettingsIntoEnv(env, settings) {
   /** @type {Record<string, string|undefined>} */
   const out = { ...env };
-  if (settings.dockerImageName) out.DOCKER_IMAGE_NAME = String(settings.dockerImageName);
-  if (settings.dockerRegistryUrl) out.DOCKER_REGISTRY_URL = String(settings.dockerRegistryUrl);
-  if (settings.dockerHost) out.DOCKER_HOST = String(settings.dockerHost);
-  if (settings.kubeNamespace) out.KUBE_NAMESPACE = String(settings.kubeNamespace);
-  if (settings.kubeconfig) out.KUBECONFIG = String(settings.kubeconfig);
-  if (settings.kubeContext) out.KUBE_CONTEXT = String(settings.kubeContext);
+  for (const [settingKey, envKey] of Object.entries(METHOD_SETTINGS_ENV_OVERLAY)) {
+    const value = settings[settingKey];
+    if (value) out[envKey] = String(value);
+  }
   return out;
 }
 
@@ -302,4 +316,5 @@ export default {
   buildEnvironmentEntry,
   resolveEnvTargets,
   mergeMethodSettingsIntoEnv,
+  METHOD_SETTINGS_ENV_OVERLAY,
 };

package/src/core/stages.js

@@ -8,6 +8,11 @@ import {
   anyEnvHasResolvableHealthCheckUrl,
   runHealthChecksForEnvs,
 } from '../utils/health-check.js';
+import {
+  anyDockerEnvHasPublishPort,
+  runDockerPortPublishChecksForEnvs,
+  verifyStageShouldRun,
+} from '../utils/docker-port-publish.js';
 import { getProjectVersion } from '../utils/version.js';
 import { resolveBuildId } from '../utils/build-id.js';
 import { ensureDeployScaffold } from '../utils/scaffold.js';
@@ -224,12 +229,25 @@ export function buildPipelineStages(config, cwd, state) {
     {
       name: 'verify',
       enabled: (ctx) => {
-        if (ctx.config.pipeline.verify !== true) return false;
+        if (ctx.config.pipeline.verify !== true) {
+          const deployed = /** @type {string[]} */ (ctx.state.deployedTargets || []);
+          return anyDockerEnvHasPublishPort(ctx.config, deployed);
+        }
         const deployed = /** @type {string[]} */ (ctx.state.deployedTargets || []);
-        return anyEnvHasResolvableHealthCheckUrl(ctx.config, deployed);
+        return verifyStageShouldRun(
+          ctx.config,
+          deployed,
+          anyEnvHasResolvableHealthCheckUrl
+        );
       },
       async run(ctx) {
         const deployed = /** @type {string[]} */ (ctx.state.deployedTargets || []);
+        const portOutcome = await runDockerPortPublishChecksForEnvs(ctx.config, deployed, {
+          requireRunning: true,
+        });
+        if (portOutcome.failures.length > 0) {
+          throw new Error(portOutcome.failures[0].error);
+        }
         const { results, failures } = await runHealthChecksForEnvs(ctx.config, deployed);
         if (failures.length > 0) {
           throw new Error(failures[0].error);