@caelo-cms/provisioning 0.10.48 → 0.10.50

package/src/caddy-redirects.test.ts

@@ -0,0 +1,115 @@
+// SPDX-License-Identifier: MPL-2.0
+
+/**
+ * #587 — self-hosted wiring for the redirects table: each public vhost
+ * imports its build's `_redirects.caddy`, and the Caddy container reloads
+ * itself when a deploy changes it (caddy-redirects.ts). The snippet and the
+ * loop run against a real Caddy in caddy-redirects.docker.test.ts.
+ */
+
+import { describe, expect, it } from "bun:test";
+import { readFileSync } from "node:fs";
+import { resolve } from "node:path";
+import { generateCaddyfile, selfHostedSeedDomains } from "./caddy.js";
+import { caddyRedirectReloadCommand, caddyRedirectReloadScript } from "./caddy-redirects.js";
+import {
+  COMPOSE_ADMIN_UPSTREAM,
+  COMPOSE_GATEWAY_UPSTREAM,
+  COMPOSE_REDIRECT_SNIPPETS,
+  generateDockerCompose,
+} from "./compose.js";
+
+const caddyfile = generateCaddyfile({
+  ownerEmail: "owner@example.com",
+  tls: "acme",
+  publicSiteRoot: "/srv/caelo/output/production/current",
+  stagingSiteRoot: "/srv/caelo/output/staging/current",
+  adminUpstream: COMPOSE_ADMIN_UPSTREAM,
+  gatewayUpstream: COMPOSE_GATEWAY_UPSTREAM,
+  domains: selfHostedSeedDomains("example.com", "staging.example.com"),
+});
+
+/** The site block of `host`: from its `<host> {` line to the next `}` line. */
+function block(host: string): string {
+  const lines = caddyfile.split("\n");
+  const start = lines.indexOf(`${host} {`);
+  if (start === -1) return "";
+  const end = lines.indexOf("}", start);
+  return lines.slice(start, end + 1).join("\n");
+}
+
+describe("Caddyfile — redirects (#587)", () => {
+  it("each public vhost imports the redirect snippet of the build it serves", () => {
+    expect(block("example.com")).toContain(
+      "  root * /srv/caelo/output/production/current\n  import /srv/caelo/output/production/current/_redirects.caddy*\n",
+    );
+    expect(block("staging.example.com")).toContain(
+      "import /srv/caelo/output/staging/current/_redirects.caddy*",
+    );
+    expect(block("admin.example.com")).not.toContain("_redirects.caddy");
+  });
+
+  it("the dev Caddyfiles import the snippet of /srv/current", () => {
+    for (const env of ["production", "staging"]) {
+      const src = readFileSync(resolve(import.meta.dir, `../caddy/Caddyfile.${env}`), "utf8");
+      expect(src).toContain("\timport /srv/current/_redirects.caddy*\n");
+    }
+  });
+});
+
+describe("Compose — Caddy picks up new redirects (#587)", () => {
+  const yaml = generateDockerCompose({
+    domain: "example.com",
+    postgresPassword: "pgpw",
+    rolePasswords: { admin: "a", public: "p", gateway: "g" },
+    caeloSecretKek: "0".repeat(64),
+    diskSize: "20Gi",
+    ports: { http: 80, https: 443 },
+    project: "caelo-example-com",
+    images: {
+      mode: "release",
+      admin: `ghcr.io/caelo-cms/admin@sha256:${"a".repeat(64)}`,
+      gateway: `ghcr.io/caelo-cms/gateway@sha256:${"b".repeat(64)}`,
+    },
+  });
+  const service = (name: string) => {
+    const start = yaml.indexOf(`  ${name}:\n`);
+    const end = yaml.indexOf("\n\n", start);
+    return yaml.slice(start, end === -1 ? undefined : end);
+  };
+
+  it("runs Caddy with the loop that reloads it on a changed snippet", () => {
+    expect(service("caddy")).toContain(
+      `    ${caddyRedirectReloadCommand(COMPOSE_REDIRECT_SNIPPETS)}\n`,
+    );
+    expect(COMPOSE_REDIRECT_SNIPPETS).toBe("/srv/caelo/output/*/current/_redirects.caddy");
+    // The loop names no container or project: it runs inside the Caddy
+    // container of whichever Compose project this is.
+    expect(caddyRedirectReloadCommand(COMPOSE_REDIRECT_SNIPPETS)).not.toMatch(
+      /caelo-caddy|COMPOSE_PROJECT|docker/,
+    );
+    expect(yaml).not.toContain("caddy-admin");
+  });
+});
+
+describe("dev docker-compose.yml (#587)", () => {
+  it("runs both dev Caddies with the same reload loop", () => {
+    const src = readFileSync(resolve(import.meta.dir, "../../../docker-compose.yml"), "utf8");
+    const line = `    ${caddyRedirectReloadCommand("/srv/current/_redirects.caddy")}\n`;
+    expect(src.split(line)).toHaveLength(3);
+  });
+});
+
+describe("caddyRedirectReloadScript", () => {
+  it("refuses a glob that could break out of the shell script", () => {
+    expect(() => caddyRedirectReloadScript("/srv/x; rm -rf /")).toThrow(/unsafe snippet glob/);
+  });
+
+  it("doubles every $ for Compose, nothing else", () => {
+    const script = caddyRedirectReloadScript("/srv/current/_redirects.caddy");
+    const cmd = caddyRedirectReloadCommand("/srv/current/_redirects.caddy");
+    const parsed = JSON.parse(cmd.slice("command: ".length)) as string[];
+    expect(parsed.slice(0, 2)).toEqual(["/bin/sh", "-c"]);
+    expect(parsed[2]?.replaceAll("$$", "$")).toBe(script);
+  });
+});

package/src/caddy-redirects.ts

@@ -0,0 +1,68 @@
+// SPDX-License-Identifier: MPL-2.0
+
+/**
+ * How the self-hosted Caddy picks up a deploy's redirect snippet (#587).
+ *
+ * Each public site block imports `<site root>/_redirects.caddy`, which the
+ * static generator rewrites on every build. Caddy reads imports only when it
+ * loads a config, so something must reload it after a deploy. The container
+ * does that itself: its command runs Caddy plus a small loop that watches a
+ * checksum of the snippets and runs `caddy reload` (against Caddy's own
+ * localhost admin endpoint, inside the container) when they change.
+ *
+ * Why not the alternatives:
+ * - `caddy run --watch` stops watching for good after the first config that
+ *   fails to load — a snippet read while a deploy is still copying it would
+ *   freeze the redirects until Caddy restarts.
+ * - The admin reloading Caddy through the admin API would need a channel
+ *   from the admin into Caddy and would post a file's content over HTTP.
+ *
+ * The loop waits until the checksum is stable across two reads before
+ * reloading (a deploy may be mid-copy), and a reload Caddy rejects only
+ * logs: Caddy keeps the previous config, and the next change retries.
+ */
+
+/** Seconds between checksum polls. */
+const POLL_SECONDS = 2;
+
+/**
+ * The container's shell script: Caddy in the foreground of the container's
+ * lifetime, reloaded when any file matching `snippetGlob` changes.
+ *
+ * @param snippetGlob Shell glob of the imported snippets, e.g.
+ *   `/srv/caelo/output/*\/current/_redirects.caddy`.
+ */
+export function caddyRedirectReloadScript(snippetGlob: string): string {
+  if (/[\s'"`$\\;&|<>]/.test(snippetGlob)) {
+    throw new Error(`caddy-redirects: unsafe snippet glob ${JSON.stringify(snippetGlob)}`);
+  }
+  const config = "--config /etc/caddy/Caddyfile --adapter caddyfile";
+  return [
+    `sum() { cat ${snippetGlob} 2>/dev/null | md5sum; }`,
+    "last=$(sum)",
+    `caddy run ${config} &`,
+    "pid=$!",
+    `trap 'kill -TERM "$pid" 2>/dev/null; wait "$pid"; exit $?' TERM INT`,
+    `while kill -0 "$pid" 2>/dev/null; do`,
+    `  sleep ${POLL_SECONDS}`,
+    "  now=$(sum)",
+    `  [ "$now" = "$last" ] && continue`,
+    // A deploy may still be copying the file: reload only a stable one.
+    "  sleep 1",
+    `  [ "$(sum)" = "$now" ] || continue`,
+    "  last=$now",
+    `  caddy reload ${config} || echo "caelo: redirects changed but Caddy rejected the reload; still serving the previous redirects" >&2`,
+    "done",
+    `wait "$pid"`,
+  ].join("\n");
+}
+
+/**
+ * A Compose `command:` line running {@link caddyRedirectReloadScript}. `$` is
+ * doubled because Compose interpolates `$VAR` in the file; the JSON string is
+ * a valid YAML double-quoted scalar.
+ */
+export function caddyRedirectReloadCommand(snippetGlob: string): string {
+  const script = caddyRedirectReloadScript(snippetGlob).replaceAll("$", () => "$$");
+  return `command: ["/bin/sh", "-c", ${JSON.stringify(script)}]`;
+}

package/src/caddy-validate.test.ts

@@ -0,0 +1,119 @@
+// SPDX-License-Identifier: MPL-2.0
+
+/**
+ * The generated Caddyfile through the real Caddy (issue #566): `caddy
+ * validate` on the exact image the Compose file runs ({@link CADDY_IMAGE}).
+ * String assertions cannot catch a directive Caddy refuses — #566 shipped a
+ * `try_files` nested in `file_server { }` that every unit test accepted and
+ * Caddy 2.11 rejected, so no self-hosted vhost came up.
+ *
+ * Needs Docker. CI sets `CAELO_CADDY_VALIDATE=required`, which turns a
+ * missing Docker into a failure instead of a skip, so this check can never
+ * silently stop running there.
+ */
+
+import { describe, expect, it } from "bun:test";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { type CaddyfileSpec, generateCaddyfile, selfHostedSeedDomains } from "./caddy.js";
+import { CADDY_IMAGE, COMPOSE_ADMIN_UPSTREAM, COMPOSE_GATEWAY_UPSTREAM } from "./compose.js";
+
+const REQUIRED = process.env.CAELO_CADDY_VALIDATE === "required";
+
+function dockerAvailable(): boolean {
+  try {
+    return Bun.spawnSync(["docker", "info"], { stdout: "ignore", stderr: "ignore" }).exitCode === 0;
+  } catch {
+    return false;
+  }
+}
+
+const HAVE_DOCKER = dockerAvailable();
+
+/** `caddy validate` with the Caddyfile on stdin (no bind mount, so it works on any Docker host). */
+async function caddyValidate(caddyfile: string): Promise<{ exitCode: number; output: string }> {
+  const proc = Bun.spawn(
+    [
+      "docker",
+      "run",
+      "--rm",
+      "-i",
+      CADDY_IMAGE,
+      "caddy",
+      "validate",
+      "--config",
+      "/dev/stdin",
+      "--adapter",
+      "caddyfile",
+    ],
+    { stdin: new TextEncoder().encode(caddyfile), stdout: "pipe", stderr: "pipe" },
+  );
+  const [stdout, stderr] = await Promise.all([
+    new Response(proc.stdout).text(),
+    new Response(proc.stderr).text(),
+  ]);
+  return { exitCode: await proc.exited, output: `${stdout}\n${stderr}` };
+}
+
+const base: CaddyfileSpec = {
+  ownerEmail: "owner@example.com",
+  tls: "acme",
+  publicSiteRoot: "/srv/caelo/output/production/current",
+  stagingSiteRoot: "/srv/caelo/output/staging/current",
+  adminUpstream: COMPOSE_ADMIN_UPSTREAM,
+  gatewayUpstream: COMPOSE_GATEWAY_UPSTREAM,
+  domains: selfHostedSeedDomains("example.com", "staging.example.com"),
+};
+
+const CASES: Record<string, string> = {
+  "the seed vhosts `init` writes (ACME)": generateCaddyfile(base),
+  "the seed vhosts with --tls internal": generateCaddyfile({ ...base, tls: "internal" }),
+  "seed + operator-added admin and public domains": generateCaddyfile({
+    ...base,
+    domains: [
+      ...base.domains,
+      { hostname: "www.example.org", kind: "public", env: "production" },
+      { hostname: "cms.example.org", kind: "admin", env: "production" },
+    ],
+  }),
+  "no domains yet (the :8081 block)": generateCaddyfile({ ...base, domains: [] }),
+  "caddy/Caddyfile.production": readFileSync(
+    join(import.meta.dir, "..", "caddy", "Caddyfile.production"),
+    "utf8",
+  ),
+  "caddy/Caddyfile.staging": readFileSync(
+    join(import.meta.dir, "..", "caddy", "Caddyfile.staging"),
+    "utf8",
+  ),
+};
+
+describe(`generated Caddyfiles pass \`caddy validate\` on ${CADDY_IMAGE} (#566)`, () => {
+  if (REQUIRED) {
+    it("Docker is available (CAELO_CADDY_VALIDATE=required)", () => {
+      expect(HAVE_DOCKER).toBe(true);
+    });
+  }
+  it.skipIf(!HAVE_DOCKER)(
+    "rejects the #566 shape (proves the check is not a no-op)",
+    async () => {
+      const r = await caddyValidate(
+        ":80 {\n  file_server {\n    try_files {path} {path}/index.html\n  }\n}\n",
+      );
+      expect(r.exitCode).not.toBe(0);
+      expect(r.output).toContain("unknown subdirective 'try_files'");
+    },
+    180_000,
+  );
+  for (const [name, caddyfile] of Object.entries(CASES)) {
+    it.skipIf(!HAVE_DOCKER)(
+      name,
+      async () => {
+        const r = await caddyValidate(caddyfile);
+        if (r.exitCode !== 0) console.error(r.output);
+        expect(r.exitCode).toBe(0);
+        expect(r.output).toContain("Valid configuration");
+      },
+      180_000,
+    );
+  }
+});

package/src/caddy.test.ts

@@ -0,0 +1,108 @@
+// SPDX-License-Identifier: MPL-2.0
+
+import { describe, expect, it } from "bun:test";
+import {
+  type CaddyfileSpec,
+  generateCaddyfile,
+  selfHostedAdminHost,
+  selfHostedSeedDomains,
+} from "./caddy.js";
+import { COMPOSE_ADMIN_UPSTREAM, COMPOSE_GATEWAY_UPSTREAM } from "./compose.js";
+
+/** The inputs `cms-provision init` passes for example.com. */
+const spec: CaddyfileSpec = {
+  ownerEmail: "owner@example.com",
+  tls: "acme",
+  publicSiteRoot: "/srv/caelo/output/production/current",
+  stagingSiteRoot: "/srv/caelo/output/staging/current",
+  adminUpstream: COMPOSE_ADMIN_UPSTREAM,
+  gatewayUpstream: COMPOSE_GATEWAY_UPSTREAM,
+  domains: selfHostedSeedDomains("example.com", "staging.example.com"),
+};
+
+/** One site block, from its address line to its closing brace. */
+function block(caddyfile: string, host: string): string {
+  const start = caddyfile.indexOf(`\n${host} {\n`);
+  if (start === -1) throw new Error(`no site block for ${host}`);
+  return caddyfile.slice(start + 1, caddyfile.indexOf("\n}\n", start) + 2);
+}
+
+describe("self-hosted seed vhosts", () => {
+  it("puts the admin on admin.<domain>, the live and the staging site on their own hosts", () => {
+    expect(selfHostedSeedDomains("example.com", "staging.example.com")).toEqual([
+      { hostname: "admin.example.com", kind: "admin", env: "production" },
+      { hostname: "example.com", kind: "public", env: "production" },
+      { hostname: "staging.example.com", kind: "public", env: "staging" },
+    ]);
+    expect(selfHostedAdminHost("example.com")).toBe("admin.example.com");
+  });
+
+  it("refuses two vhosts for one host — Caddy would reject the whole file", () => {
+    expect(() =>
+      generateCaddyfile({
+        ...spec,
+        domains: [
+          { hostname: "example.com", kind: "admin", env: "production" },
+          { hostname: "example.com", kind: "public", env: "production" },
+        ],
+      }),
+    ).toThrow(/example\.com is listed twice/);
+  });
+});
+
+describe("Caddyfile upstreams (#707)", () => {
+  const out = generateCaddyfile(spec);
+
+  it("proxies to the Compose service names, never to localhost (Caddy's own container)", () => {
+    expect(out).not.toContain("localhost");
+    expect(out).not.toContain("127.0.0.1");
+    expect(block(out, "admin.example.com")).toContain("reverse_proxy caelo-admin:5173");
+    for (const host of ["example.com", "staging.example.com"]) {
+      expect(block(out, host)).toContain("handle /api/* {\n    reverse_proxy caelo-gateway:8090\n");
+    }
+  });
+
+  it("does not route /admin/* on the public site (the admin routes from / on its own host)", () => {
+    expect(block(out, "example.com")).not.toContain("/admin");
+  });
+});
+
+describe("Caddyfile static site (#566)", () => {
+  const publicBlock = block(generateCaddyfile(spec), "example.com");
+
+  it("emits try_files as its own directive before file_server, never inside it", () => {
+    expect(publicBlock).toContain(
+      "  handle {\n    try_files {path} {path}/index.html\n    file_server\n  }\n",
+    );
+    expect(publicBlock).not.toMatch(/file_server \{[^}]*try_files/);
+  });
+
+  it("answers a missing path with a 404 and the generator's 404 page, not the home page", () => {
+    expect(publicBlock).not.toContain("/index.html /index.html");
+    expect(publicBlock).toContain(
+      "  handle_errors 404 {\n    rewrite * /404.html\n    file_server\n  }\n",
+    );
+  });
+
+  it("serves production and staging from their own roots; only staging is noindex", () => {
+    const out = generateCaddyfile(spec);
+    expect(block(out, "example.com")).toContain("root * /srv/caelo/output/production/current");
+    expect(block(out, "example.com")).not.toContain("X-Robots-Tag");
+    const staging = block(out, "staging.example.com");
+    expect(staging).toContain("root * /srv/caelo/output/staging/current");
+    expect(staging).toContain('header X-Robots-Tag "noindex"');
+  });
+});
+
+describe("Caddyfile TLS", () => {
+  it("uses ACME with the Owner's email by default", () => {
+    const out = generateCaddyfile(spec);
+    expect(out.startsWith("{\n  email owner@example.com\n}\n")).toBe(true);
+    expect(out).not.toContain("local_certs");
+  });
+
+  it("issues every certificate from Caddy's local CA with tls internal", () => {
+    const out = generateCaddyfile({ ...spec, tls: "internal" });
+    expect(out.startsWith("{\n  email owner@example.com\n  local_certs\n}\n")).toBe(true);
+  });
+});

package/src/caddy.ts

@@ -5,18 +5,32 @@
  *
  * Reads the `domains` table + the deploy targets and emits a
  * deterministic Caddyfile string. The CLI's `regenerate-caddy`
- * sub-command writes this to `/etc/caddy/Caddyfile` and runs
+ * sub-command writes this to `.caelo/Caddyfile` and runs
  * `caddy reload`.
  *
  * Per-vhost shape:
  *   <hostname> {
- *     # admin   → reverse_proxy localhost:5173
- *     # public  → root + try_files (static), with /api/* → gateway
- *     tls <ownerEmail>
+ *     # admin   → reverse_proxy <adminUpstream>
+ *     # public  → /api/* → <gatewayUpstream>; everything else is the
+ *     #           static site (try_files + file_server, 404 → /404.html)
  *   }
  *
+ * Upstreams are `host:port` as seen FROM CADDY. In the Compose install
+ * Caddy runs in its own container, where `localhost` is Caddy itself, so
+ * the CLI passes the Compose service names (`caelo-admin:5173`,
+ * `caelo-gateway:8090`) — issue #707.
+ *
+ * Every directive here must be one Caddy accepts: the output is checked
+ * with `caddy validate` on the pinned Caddy image (caddy-validate.test.ts,
+ * run in CI) — issue #566 shipped a `try_files` nested inside
+ * `file_server { }`, which Caddy 2.11 refuses, so no vhost came up.
+ *
  * Staging vhosts force `X-Robots-Tag: noindex`.
  *
+ * Public vhosts import the redirect snippet of the build they serve
+ * (`_redirects.caddy`, #587); the Caddy container reloads itself when a
+ * deploy changes it (caddy-redirects.ts).
+ *
  * Public vhosts mark content-hashed build outputs (fonts, plugin
  * bundles — `CONTENT_HASHED_PATH_PATTERN` in @caelo-cms/shared)
  * `immutable` for a year. Everything else keeps Caddy's file_server
@@ -26,13 +40,22 @@
  * hashed URL (an old page requesting an asset the new build dropped)
  * is never cached for a year.
  *
+ * A path that matches no file is a real 404 serving the generator's
+ * `/404.html` — never the home page with a 200 (an SPA-style
+ * `/index.html` fallback would turn every dead URL into a soft 404).
+ * Same behaviour as the GCS / S3 / Blob adapters (CLAUDE.md §11.B).
+ *
  * `.ico` files (theme favicons) are served as `image/x-icon`, the one
  * icon MIME the media library stores and `<link rel="icon" type>`
  * declares. file_server only fills Content-Type when no earlier handler
  * set it, so the `header` line wins over the host's mime.types name.
  */
 
-import { CONTENT_HASHED_PATH_PATTERN, IMMUTABLE_CACHE_CONTROL } from "@caelo-cms/shared";
+import {
+  CONTENT_HASHED_PATH_PATTERN,
+  caddyRedirectsImport,
+  IMMUTABLE_CACHE_CONTROL,
+} from "@caelo-cms/shared";
 
 export interface CaddyDomainSpec {
   readonly hostname: string;
@@ -40,21 +63,64 @@ export interface CaddyDomainSpec {
   readonly env: "production" | "staging";
 }
 
+/**
+ * How Caddy gets certificates: `acme` — publicly trusted ones from Let's
+ * Encrypt / ZeroSSL (needs public DNS + ports 80/443 reachable); `internal`
+ * — Caddy's own local CA, for a LAN or evaluation install without public
+ * DNS (browsers warn until the CA root is trusted).
+ */
+export type CaddyTlsMode = "acme" | "internal";
+
 export interface CaddyfileSpec {
   readonly ownerEmail: string;
-  readonly publicSiteRoot: string; // absolute path on disk
+  readonly tls: CaddyTlsMode;
+  readonly publicSiteRoot: string; // absolute path inside the Caddy container
   readonly stagingSiteRoot: string;
-  readonly adminPort: number;
-  readonly gatewayPort: number;
+  /** `host:port` of the admin as Caddy reaches it (Compose: `caelo-admin:5173`). */
+  readonly adminUpstream: string;
+  /** `host:port` of the API gateway as Caddy reaches it (Compose: `caelo-gateway:8090`). */
+  readonly gatewayUpstream: string;
   readonly domains: ReadonlyArray<CaddyDomainSpec>;
 }
 
+/** The host the admin of a self-hosted install answers on (same convention as GCP). */
+export function selfHostedAdminHost(domain: string): string {
+  return `admin.${domain}`;
+}
+
+/**
+ * The vhosts every self-hosted install serves before an Owner adds domains
+ * in the admin: the admin on `admin.<domain>`, the live site on `<domain>`,
+ * the staging site on its own host. The admin needs its own host — it
+ * routes from `/` (`/setup`, `/login`, …), so it cannot share one with the
+ * public site, and Caddy refuses two site blocks for the same address.
+ */
+export function selfHostedSeedDomains(domain: string, stagingDomain: string): CaddyDomainSpec[] {
+  return [
+    { hostname: selfHostedAdminHost(domain), kind: "admin", env: "production" },
+    { hostname: domain, kind: "public", env: "production" },
+    { hostname: stagingDomain, kind: "public", env: "staging" },
+  ];
+}
+
 export function generateCaddyfile(spec: CaddyfileSpec): string {
+  const hostnames = new Set<string>();
+  for (const d of spec.domains) {
+    if (hostnames.has(d.hostname)) {
+      // Caddy refuses a config with two site blocks for one address, so a
+      // duplicate would take every vhost down, not just this one.
+      throw new Error(
+        `Caddyfile: ${d.hostname} is listed twice — one host serves either the admin or a public site, not both.`,
+      );
+    }
+    hostnames.add(d.hostname);
+  }
+
   const blocks: string[] = [];
 
   // Global options.
   blocks.push(`{
-  email ${spec.ownerEmail}
+  email ${spec.ownerEmail}${spec.tls === "internal" ? "\n  local_certs" : ""}
 }
 `);
 
@@ -68,7 +134,7 @@ export function generateCaddyfile(spec: CaddyfileSpec): string {
     blocks.push(`# No domains configured yet — cms-provision regenerate-caddy
 # will overwrite this file when you add one at /settings/domains.
 :8081 {
-  reverse_proxy localhost:${spec.adminPort}
+  reverse_proxy ${spec.adminUpstream}
 }
 `);
   }
@@ -80,15 +146,18 @@ function vhost(d: CaddyDomainSpec, spec: CaddyfileSpec): string {
   const noindex = d.env === "staging" ? `\n  header X-Robots-Tag "noindex"` : "";
   if (d.kind === "admin") {
     return `${d.hostname} {${noindex}
-  reverse_proxy localhost:${spec.adminPort}
+  reverse_proxy ${spec.adminUpstream}
 }
 `;
   }
-  // public — API routes go to the gateway,
-  // the rest serves static files. Locale variants serve from a
+  // public — API routes go to the gateway, the rest is the static site.
+  // `try_files` is its own directive (a rewrite), never a file_server
+  // subdirective (#566).
   const root = d.env === "staging" ? spec.stagingSiteRoot : spec.publicSiteRoot;
+  // #587 — the redirects table of the build this vhost serves.
   return `${d.hostname} {${noindex}
   root * ${root}
+  ${caddyRedirectsImport(root)}
   @content_hashed {
     path_regexp content_hashed ${CONTENT_HASHED_PATH_PATTERN}
     file
@@ -97,15 +166,15 @@ function vhost(d: CaddyDomainSpec, spec: CaddyfileSpec): string {
   @ico path *.ico
   header @ico Content-Type "image/x-icon"
   handle /api/* {
-    reverse_proxy localhost:${spec.gatewayPort}
-  }
-  handle /admin/* {
-    reverse_proxy localhost:${spec.adminPort}
+    reverse_proxy ${spec.gatewayUpstream}
   }
   handle {
-    file_server {
-      try_files {path} {path}/index.html /index.html
-    }
+    try_files {path} {path}/index.html
+    file_server
+  }
+  handle_errors 404 {
+    rewrite * /404.html
+    file_server
   }
 }
 `;

package/src/cli-routing.test.ts

@@ -13,6 +13,18 @@ describe("resolveCliRoute", () => {
     ).toEqual({ kind: "wizard" });
   });
 
+  it("routes the self-hosted one-command install to init (#707)", () => {
+    expect(
+      resolveCliRoute(
+        argv("--provider", "self-hosted", "--domain", "example.com", "--owner-email", "o@x.y"),
+        HANDLERS,
+      ),
+    ).toEqual({ kind: "handler", name: "init" });
+    expect(resolveCliRoute(argv("--provider", "self-hosted", "--help"), HANDLERS)).toEqual({
+      kind: "usage",
+    });
+  });
+
   it("routes a bare invocation to the wizard", () => {
     expect(resolveCliRoute(argv(), HANDLERS)).toEqual({ kind: "wizard" });
   });

package/src/cli-routing.ts

@@ -30,6 +30,13 @@ export function resolveCliRoute(argv: readonly string[], handlerNames: Iterable<
   if (argv.includes("--no-wizard") || argv.includes("--help") || argv.includes("-h")) {
     return { kind: "usage" };
   }
+  // #707 — `--provider self-hosted --domain … --owner-email …` is the
+  // self-hosted one-command install: `init` writes `.caelo/` and starts the
+  // stack. (The cloud wizard has nothing to provision for it.)
+  const provider = argv.indexOf("--provider");
+  if (provider !== -1 && argv[provider + 1] === "self-hosted") {
+    return { kind: "handler", name: "init" };
+  }
   return { kind: "wizard" };
 }