@arcote.tech/arc-cli 0.7.32 → 0.8.1

package/src/deploy/config.ts

@@ -70,6 +70,22 @@ export interface DeployProvisionTerraform {
   tokenEnv: string;
   /** Path to public SSH key uploaded to the provider. Default: ~/.ssh/id_ed25519.pub */
   sshPublicKey?: string;
+  /**
+   * Server name in Hetzner Console + prefix for the managed SSH key.
+   * Must be unique per Hetzner project. Fallback when absent: `arc-<first env>`
+   * (legacy — kept so existing single-app deploys don't rename their server).
+   * Set this per app to run several apps in one Hetzner project without name
+   * collisions (e.g. "arc-bmf-prod").
+   */
+  serverName?: string;
+  /**
+   * How the operator public key reaches the fresh VM.
+   * - "resource" (default, legacy): creates an `hcloud_ssh_key` object.
+   * - "cloud-init": injects the key via `user_data`, creating NO key object.
+   *   Pick this when multiple apps share one Hetzner project with the same
+   *   local public key — a key object would collide on name AND fingerprint.
+   */
+  sshKeyStrategy?: "resource" | "cloud-init";
 }
 
 export interface DeployProvisionAnsible {
@@ -261,9 +277,29 @@ export function validateDeployConfig(input: unknown): DeployConfig {
     );
   }
 
+  // Host is optional when a terraform provision block is present — terraform
+  // fills it on first deploy (persisted back via saveDeployConfig). This lets
+  // a user hand-write a partial config and leave `target.host` empty. Without
+  // provision, a host is mandatory (there's nothing to create it).
+  const provisionRaw = (input as Record<string, unknown>).provision;
+  const hasProvisionTf =
+    isObject(provisionRaw) &&
+    isObject((provisionRaw as Record<string, unknown>).terraform);
+  const hostRaw = optionalString(target, "target.host");
+  let host: string;
+  if (hostRaw && hostRaw.length > 0) {
+    host = hostRaw;
+  } else if (hasProvisionTf) {
+    host = "PENDING_TERRAFORM";
+  } else {
+    throw new Error(
+      `deploy.arc.json: target.host is required unless provision.terraform is present (with provision, terraform fills it on first deploy).`,
+    );
+  }
+
   const validated: DeployConfig = {
     target: {
-      host: requireString(target, "target.host"),
+      host,
       user: optionalString(target, "target.user") ?? "deploy",
       port: optionalNumber(target, "target.port") ?? 22,
       remoteDir: optionalString(target, "target.remoteDir") ?? "/opt/arc",
@@ -379,6 +415,25 @@ export function validateDeployConfig(input: unknown): DeployConfig {
         `deploy.arc.json: provision.terraform.provider must be "hcloud" (got "${providerVal}")`,
       );
     }
+    const serverName = optionalString(tf, "provision.terraform.serverName");
+    if (serverName !== undefined && !/^[a-z0-9-]{1,63}$/.test(serverName)) {
+      throw new Error(
+        `deploy.arc.json: provision.terraform.serverName "${serverName}" must match [a-z0-9-] and be at most 63 chars`,
+      );
+    }
+    const sshKeyStrategyRaw = optionalString(
+      tf,
+      "provision.terraform.sshKeyStrategy",
+    );
+    if (
+      sshKeyStrategyRaw !== undefined &&
+      sshKeyStrategyRaw !== "resource" &&
+      sshKeyStrategyRaw !== "cloud-init"
+    ) {
+      throw new Error(
+        `deploy.arc.json: provision.terraform.sshKeyStrategy must be "resource" or "cloud-init" (got "${sshKeyStrategyRaw}")`,
+      );
+    }
     const terraform: DeployProvisionTerraform = {
       provider: "hcloud",
       serverType: requireString(tf, "provision.terraform.serverType"),
@@ -386,6 +441,11 @@ export function validateDeployConfig(input: unknown): DeployConfig {
       image: optionalString(tf, "provision.terraform.image") ?? "ubuntu-22.04",
       tokenEnv: requireString(tf, "provision.terraform.tokenEnv"),
       sshPublicKey: optionalString(tf, "provision.terraform.sshPublicKey"),
+      serverName,
+      sshKeyStrategy: sshKeyStrategyRaw as
+        | "resource"
+        | "cloud-init"
+        | undefined,
     };
     let ansible: DeployProvisionAnsible | undefined;
     const ansibleRaw = (provision as Record<string, unknown>).ansible;

package/src/deploy/survey.ts

@@ -5,6 +5,7 @@ import type {
   DeployProvision,
   DeployProvisionTerraform,
 } from "./config";
+import { sanitizeImageName } from "./image";
 
 // ---------------------------------------------------------------------------
 // Interactive init for deploy.arc.json. Grouped into minimal phases:
@@ -15,7 +16,7 @@ import type {
 // Returns a validated DeployConfig ready to save. On Ctrl-C, exits the process.
 // ---------------------------------------------------------------------------
 
-export async function runSurvey(): Promise<DeployConfig> {
+export async function runSurvey(appName?: string): Promise<DeployConfig> {
   clack.intro("arc platform deploy — initial setup");
 
   // Phase 1: mode
@@ -129,12 +130,25 @@ export async function runSurvey(): Promise<DeployConfig> {
     })) as string;
     if (clack.isCancel(location)) cancel();
 
+    // Namespace the server per app and inject the SSH key via cloud-init, so
+    // several apps can share one Hetzner project without colliding on server
+    // name or SSH key name/fingerprint. Both are opt-in fields with legacy
+    // fallbacks, but new configs default to the collision-safe combo.
+    const firstEnv = Object.keys(envs)[0] ?? "host";
+    const appSlug = sanitizeImageName(appName ?? "arc-app").replace(
+      /[^a-z0-9-]+/g,
+      "-",
+    );
+    const serverName = `arc-${appSlug}-${firstEnv}`.slice(0, 63);
+
     const terraform: DeployProvisionTerraform = {
       provider: "hcloud",
       serverType,
       location,
       image: "ubuntu-22.04",
       tokenEnv,
+      serverName,
+      sshKeyStrategy: "cloud-init",
     };
     provision = { terraform };
   }

package/src/deploy/terraform.ts

@@ -20,6 +20,8 @@ export interface TerraformInputs {
   token: string;
   /** Deterministic server name shown in Hetzner Console. */
   serverName: string;
+  /** Inject SSH key via cloud-init user_data instead of a managed key object. */
+  useCloudInitKey: boolean;
   /** Workspace root — used to scope state dir per project. */
   workspaceDir: string;
 }
@@ -61,6 +63,7 @@ export async function runTerraform(
       `server_location = "${inputs.tf.location}"`,
       `server_image = "${inputs.tf.image}"`,
       `ssh_public_key = "${expandHome(sshPubKey)}"`,
+      `use_cloud_init_key = ${inputs.useCloudInitKey}`,
     ].join("\n") + "\n";
 
   writeFileSync(join(workDir, "terraform.tfvars"), tfvars);

package/src/index.ts

@@ -35,8 +35,16 @@ platform
   .description("Start platform in dev mode (Bun server + Vite HMR)")
   .option("--no-cache", "Force full rebuild on startup")
   .option("--map", "Also start the Arc Context Map dev tool on a separate port")
-  .action((opts: { cache?: boolean; map?: boolean }) =>
-    platformDev({ noCache: opts.cache === false, map: opts.map }),
+  .option(
+    "--headless",
+    "Host API + federated module chunks + map, WITHOUT the app's own SPA shell (implies --map)",
+  )
+  .action((opts: { cache?: boolean; map?: boolean; headless?: boolean }) =>
+    platformDev({
+      noCache: opts.cache === false,
+      map: opts.map,
+      headless: opts.headless,
+    }),
   );
 
 platform