@caelo-cms/provisioning 0.10.49 → 0.10.51

package/src/caddy-redirects.docker.test.ts

@@ -0,0 +1,255 @@
+// SPDX-License-Identifier: MPL-2.0
+
+/**
+ * #587 — the self-hosted redirect path end to end against the Caddy image
+ * the Compose file runs ({@link CADDY_IMAGE}):
+ *
+ * - the GENERATED Caddyfile (the seed vhosts `init` writes) and the repo's
+ *   dev Caddyfiles pass `caddy validate` with a real redirect snippet
+ *   imported;
+ * - a container started like the Compose service (same Caddyfile shape,
+ *   same `/srv/caelo` mount, same reload-loop command and snippet glob)
+ *   answers redirected paths on the live and the staging host with the
+ *   planned status + Location — query kept, case-sensitive, the live page
+ *   wins, 410 for gone;
+ * - the reload loop picks up a deploy's new snippet, a snippet Caddy
+ *   rejects leaves the previous redirects live, and the next good snippet
+ *   is picked up again.
+ *
+ * Needs Docker and curl. CI sets `CAELO_CADDY_VALIDATE=required` (as for
+ * caddy-validate.test.ts), which turns a missing Docker into a failure.
+ */
+
+import { afterAll, beforeAll, describe, expect, it } from "bun:test";
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import { buildRedirectPlan, emitCaddyRedirects, type RedirectTableRow } from "@caelo-cms/shared";
+import { generateCaddyfile, selfHostedSeedDomains } from "./caddy.js";
+import { caddyRedirectReloadScript } from "./caddy-redirects.js";
+import {
+  CADDY_IMAGE,
+  COMPOSE_ADMIN_UPSTREAM,
+  COMPOSE_GATEWAY_UPSTREAM,
+  COMPOSE_REDIRECT_SNIPPETS,
+  SITE_OUTPUT_ROOT,
+} from "./compose.js";
+
+const REQUIRED = process.env.CAELO_CADDY_VALIDATE === "required";
+const dockerUp = Bun.spawnSync(["docker", "info"], { stdout: "ignore", stderr: "ignore" }).success;
+if (!dockerUp && REQUIRED) {
+  throw new Error(
+    "caddy-redirects.docker.test: CAELO_CADDY_VALIDATE=required but `docker info` failed",
+  );
+}
+
+const LIVE = "example.test";
+const STAGING = "staging.example.test";
+const CADDY_DIR = resolve(import.meta.dir, "../caddy");
+const SERVED = ["index.html", "about/index.html", "blog/index.html"];
+
+function docker(args: string[]): { ok: boolean; out: string } {
+  const r = Bun.spawnSync(["docker", ...args], { stdout: "pipe", stderr: "pipe" });
+  return { ok: r.success, out: `${r.stdout.toString()}${r.stderr.toString()}` };
+}
+
+function snippet(rows: [string, string, number][]): string {
+  const tableRows: RedirectTableRow[] = rows.map(([fromPath, toPath, statusCode]) => ({
+    fromPath,
+    toPath,
+    statusCode,
+  }));
+  return emitCaddyRedirects(
+    buildRedirectPlan({
+      rows: tableRows,
+      pageUrlStyle: "directory",
+      servedFiles: new Set(SERVED),
+    }),
+  );
+}
+
+describe.skipIf(!dockerUp)(`self-hosted redirects through ${CADDY_IMAGE}`, () => {
+  const name = `caelo-test-587-${process.pid}-${Date.now()}`;
+  let dir = "";
+  let httpsPort = "";
+
+  /** The host dir mounted at SITE_OUTPUT_ROOT, as `./output` is in Compose. */
+  const outputDir = () => join(dir, "output");
+  const current = (env: string) => join(outputDir(), "output", env, "current");
+  const write = (env: string, body: string) =>
+    writeFileSync(join(current(env), "_redirects.caddy"), body);
+
+  /** Status + Location of `https://<host><path>` through the container. */
+  const probe = (host: string, path: string): { status: number; location: string | null } => {
+    const r = Bun.spawnSync(
+      [
+        "curl",
+        "-sk",
+        "-o",
+        "/dev/null",
+        "-D",
+        "-",
+        "--resolve",
+        `${host}:${httpsPort}:127.0.0.1`,
+        `https://${host}:${httpsPort}${path}`,
+      ],
+      { stdout: "pipe", stderr: "pipe" },
+    );
+    const head = r.stdout.toString();
+    const status = Number(head.match(/^HTTP\/\S+ (\d{3})/)?.[1] ?? 0);
+    const location = head.match(/^location: ([^\r\n]*)/im)?.[1]?.trim() ?? null;
+    return { status, location };
+  };
+  const eventually = async (host: string, path: string, location: string) => {
+    const deadline = Date.now() + 30_000;
+    for (;;) {
+      const got = probe(host, path).location;
+      if (got === location) return;
+      if (Date.now() > deadline) {
+        throw new Error(
+          `${host}${path} → ${got}, expected ${location}: ${docker(["logs", name]).out}`,
+        );
+      }
+      await Bun.sleep(250);
+    }
+  };
+
+  beforeAll(() => {
+    dir = mkdtempSync(join(tmpdir(), "caelo-587-caddy-"));
+    for (const env of ["production", "staging"]) {
+      for (const f of SERVED) {
+        mkdirSync(join(current(env), f, ".."), { recursive: true });
+        writeFileSync(join(current(env), f), `<p>${env} ${f}</p>`);
+      }
+    }
+    // The Caddyfile `init` writes, with Caddy's local CA so the test needs
+    // no public DNS.
+    writeFileSync(
+      join(dir, "Caddyfile"),
+      generateCaddyfile({
+        ownerEmail: "owner@example.test",
+        tls: "internal",
+        publicSiteRoot: `${SITE_OUTPUT_ROOT}/output/production/current`,
+        stagingSiteRoot: `${SITE_OUTPUT_ROOT}/output/staging/current`,
+        adminUpstream: COMPOSE_ADMIN_UPSTREAM,
+        gatewayUpstream: COMPOSE_GATEWAY_UPSTREAM,
+        domains: selfHostedSeedDomains(LIVE, STAGING),
+      }),
+    );
+    write(
+      "production",
+      snippet([
+        ["/old", "/about", 301],
+        ["/tmp", "/blog", 302],
+        ["/perm", "/about", 308],
+        ["/hop1", "/hop2", 301],
+        ["/hop2", "/blog", 301],
+        ["/Case", "/about", 301],
+        ["/q", "/about?ref=old", 301],
+        ["/gone", "/410", 410],
+        ["/about", "/elsewhere", 301],
+      ]),
+    );
+    write("staging", snippet([["/staged-old", "/blog", 301]]));
+  });
+
+  afterAll(() => {
+    docker(["rm", "-f", name]);
+    if (dir) rmSync(dir, { recursive: true, force: true });
+  });
+
+  it("the generated Caddyfile and the repo's dev Caddyfiles validate with a snippet imported", () => {
+    const validate = (caddyfile: string, siteMount: string) =>
+      docker([
+        "run",
+        "--rm",
+        "-v",
+        `${caddyfile}:/etc/caddy/Caddyfile:ro`,
+        "-v",
+        siteMount,
+        CADDY_IMAGE,
+        "caddy",
+        "validate",
+        "--config",
+        "/etc/caddy/Caddyfile",
+        "--adapter",
+        "caddyfile",
+      ]);
+    const generated = validate(join(dir, "Caddyfile"), `${outputDir()}:${SITE_OUTPUT_ROOT}:ro`);
+    expect(generated.out).toContain("Valid configuration");
+    for (const env of ["production", "staging"]) {
+      const devFile = join(dir, `Caddyfile.${env}`);
+      writeFileSync(devFile, readFileSync(join(CADDY_DIR, `Caddyfile.${env}`), "utf8"));
+      // docker-compose.yml mounts output/<env> at /srv; current/ holds the snippet.
+      const r = validate(devFile, `${join(outputDir(), "output", env)}:/srv:ro`);
+      expect(`${env}: ${r.out.includes("Valid configuration")}`).toBe(`${env}: true`);
+    }
+  }, 180_000);
+
+  it("a container started like the Compose service answers the planned redirects", async () => {
+    const run = docker([
+      "run",
+      "-d",
+      "--name",
+      name,
+      "-p",
+      "127.0.0.1::443",
+      "-v",
+      `${join(dir, "Caddyfile")}:/etc/caddy/Caddyfile:ro`,
+      "-v",
+      `${outputDir()}:${SITE_OUTPUT_ROOT}:ro`,
+      CADDY_IMAGE,
+      // The Compose service's command, with the Compose snippet glob.
+      "/bin/sh",
+      "-c",
+      caddyRedirectReloadScript(COMPOSE_REDIRECT_SNIPPETS),
+    ]);
+    expect(run.ok).toBe(true);
+    httpsPort = docker(["port", name, "443/tcp"]).out.trim().split("\n")[0]?.split(":").pop() ?? "";
+    const deadline = Date.now() + 90_000;
+    while (probe(LIVE, "/").status !== 200) {
+      if (Date.now() > deadline) {
+        throw new Error(`Caddy did not start: ${docker(["logs", name]).out}`);
+      }
+      await Bun.sleep(500);
+    }
+
+    const expectRedirect = (path: string, status: number, location: string, host = LIVE) => {
+      const r = probe(host, path);
+      expect(`${host}${path} ${r.status} ${r.location}`).toBe(
+        `${host}${path} ${status} ${location}`,
+      );
+    };
+    expectRedirect("/old", 301, "/about/");
+    expectRedirect("/old/", 301, "/about/");
+    expectRedirect("/old?utm_source=x&a=1", 301, "/about/?utm_source=x&a=1");
+    expectRedirect("/tmp", 302, "/blog/");
+    expectRedirect("/perm/", 308, "/about/");
+    expectRedirect("/hop1", 301, "/blog/");
+    expectRedirect("/Case", 301, "/about/");
+    expectRedirect("/q?dropped=1", 301, "/about?ref=old");
+    expectRedirect("/staged-old", 301, "/blog/", STAGING);
+    expect(probe(LIVE, "/gone").status).toBe(410);
+    // Exact, case-sensitive: /case is not /Case.
+    expect(probe(LIVE, "/case").status).toBe(404);
+    // Each host serves its own build's redirects.
+    expect(probe(LIVE, "/staged-old").status).toBe(404);
+    // The live page wins over the recorded /about → /elsewhere.
+    expect(probe(LIVE, "/about/")).toEqual({ status: 200, location: null });
+  }, 180_000);
+
+  it("the reload loop picks up a deploy's new snippet", async () => {
+    write("production", snippet([["/brand-new", "/blog", 301]]));
+    await eventually(LIVE, "/brand-new", "/blog/");
+    expect(probe(LIVE, "/old").status).toBe(404);
+  }, 60_000);
+
+  it("a snippet Caddy rejects leaves the previous redirects live; the next good one is picked up", async () => {
+    write("production", "map {path} {\n");
+    await Bun.sleep(5_000);
+    expect(probe(LIVE, "/brand-new").location).toBe("/blog/");
+    expect(docker(["logs", name]).out).toContain("Caddy rejected the reload");
+    write("production", snippet([["/after-fix", "/about", 301]]));
+    await eventually(LIVE, "/after-fix", "/about/");
+  }, 60_000);
+});

package/src/caddy-redirects.test.ts

@@ -0,0 +1,115 @@
+// SPDX-License-Identifier: MPL-2.0
+
+/**
+ * #587 — self-hosted wiring for the redirects table: each public vhost
+ * imports its build's `_redirects.caddy`, and the Caddy container reloads
+ * itself when a deploy changes it (caddy-redirects.ts). The snippet and the
+ * loop run against a real Caddy in caddy-redirects.docker.test.ts.
+ */
+
+import { describe, expect, it } from "bun:test";
+import { readFileSync } from "node:fs";
+import { resolve } from "node:path";
+import { generateCaddyfile, selfHostedSeedDomains } from "./caddy.js";
+import { caddyRedirectReloadCommand, caddyRedirectReloadScript } from "./caddy-redirects.js";
+import {
+  COMPOSE_ADMIN_UPSTREAM,
+  COMPOSE_GATEWAY_UPSTREAM,
+  COMPOSE_REDIRECT_SNIPPETS,
+  generateDockerCompose,
+} from "./compose.js";
+
+const caddyfile = generateCaddyfile({
+  ownerEmail: "owner@example.com",
+  tls: "acme",
+  publicSiteRoot: "/srv/caelo/output/production/current",
+  stagingSiteRoot: "/srv/caelo/output/staging/current",
+  adminUpstream: COMPOSE_ADMIN_UPSTREAM,
+  gatewayUpstream: COMPOSE_GATEWAY_UPSTREAM,
+  domains: selfHostedSeedDomains("example.com", "staging.example.com"),
+});
+
+/** The site block of `host`: from its `<host> {` line to the next `}` line. */
+function block(host: string): string {
+  const lines = caddyfile.split("\n");
+  const start = lines.indexOf(`${host} {`);
+  if (start === -1) return "";
+  const end = lines.indexOf("}", start);
+  return lines.slice(start, end + 1).join("\n");
+}
+
+describe("Caddyfile — redirects (#587)", () => {
+  it("each public vhost imports the redirect snippet of the build it serves", () => {
+    expect(block("example.com")).toContain(
+      "  root * /srv/caelo/output/production/current\n  import /srv/caelo/output/production/current/_redirects.caddy*\n",
+    );
+    expect(block("staging.example.com")).toContain(
+      "import /srv/caelo/output/staging/current/_redirects.caddy*",
+    );
+    expect(block("admin.example.com")).not.toContain("_redirects.caddy");
+  });
+
+  it("the dev Caddyfiles import the snippet of /srv/current", () => {
+    for (const env of ["production", "staging"]) {
+      const src = readFileSync(resolve(import.meta.dir, `../caddy/Caddyfile.${env}`), "utf8");
+      expect(src).toContain("\timport /srv/current/_redirects.caddy*\n");
+    }
+  });
+});
+
+describe("Compose — Caddy picks up new redirects (#587)", () => {
+  const yaml = generateDockerCompose({
+    domain: "example.com",
+    postgresPassword: "pgpw",
+    rolePasswords: { admin: "a", public: "p", gateway: "g" },
+    caeloSecretKek: "0".repeat(64),
+    diskSize: "20Gi",
+    ports: { http: 80, https: 443 },
+    project: "caelo-example-com",
+    images: {
+      mode: "release",
+      admin: `ghcr.io/caelo-cms/admin@sha256:${"a".repeat(64)}`,
+      gateway: `ghcr.io/caelo-cms/gateway@sha256:${"b".repeat(64)}`,
+    },
+  });
+  const service = (name: string) => {
+    const start = yaml.indexOf(`  ${name}:\n`);
+    const end = yaml.indexOf("\n\n", start);
+    return yaml.slice(start, end === -1 ? undefined : end);
+  };
+
+  it("runs Caddy with the loop that reloads it on a changed snippet", () => {
+    expect(service("caddy")).toContain(
+      `    ${caddyRedirectReloadCommand(COMPOSE_REDIRECT_SNIPPETS)}\n`,
+    );
+    expect(COMPOSE_REDIRECT_SNIPPETS).toBe("/srv/caelo/output/*/current/_redirects.caddy");
+    // The loop names no container or project: it runs inside the Caddy
+    // container of whichever Compose project this is.
+    expect(caddyRedirectReloadCommand(COMPOSE_REDIRECT_SNIPPETS)).not.toMatch(
+      /caelo-caddy|COMPOSE_PROJECT|docker/,
+    );
+    expect(yaml).not.toContain("caddy-admin");
+  });
+});
+
+describe("dev docker-compose.yml (#587)", () => {
+  it("runs both dev Caddies with the same reload loop", () => {
+    const src = readFileSync(resolve(import.meta.dir, "../../../docker-compose.yml"), "utf8");
+    const line = `    ${caddyRedirectReloadCommand("/srv/current/_redirects.caddy")}\n`;
+    expect(src.split(line)).toHaveLength(3);
+  });
+});
+
+describe("caddyRedirectReloadScript", () => {
+  it("refuses a glob that could break out of the shell script", () => {
+    expect(() => caddyRedirectReloadScript("/srv/x; rm -rf /")).toThrow(/unsafe snippet glob/);
+  });
+
+  it("doubles every $ for Compose, nothing else", () => {
+    const script = caddyRedirectReloadScript("/srv/current/_redirects.caddy");
+    const cmd = caddyRedirectReloadCommand("/srv/current/_redirects.caddy");
+    const parsed = JSON.parse(cmd.slice("command: ".length)) as string[];
+    expect(parsed.slice(0, 2)).toEqual(["/bin/sh", "-c"]);
+    expect(parsed[2]?.replaceAll("$$", "$")).toBe(script);
+  });
+});

package/src/caddy-redirects.ts

@@ -0,0 +1,68 @@
+// SPDX-License-Identifier: MPL-2.0
+
+/**
+ * How the self-hosted Caddy picks up a deploy's redirect snippet (#587).
+ *
+ * Each public site block imports `<site root>/_redirects.caddy`, which the
+ * static generator rewrites on every build. Caddy reads imports only when it
+ * loads a config, so something must reload it after a deploy. The container
+ * does that itself: its command runs Caddy plus a small loop that watches a
+ * checksum of the snippets and runs `caddy reload` (against Caddy's own
+ * localhost admin endpoint, inside the container) when they change.
+ *
+ * Why not the alternatives:
+ * - `caddy run --watch` stops watching for good after the first config that
+ *   fails to load — a snippet read while a deploy is still copying it would
+ *   freeze the redirects until Caddy restarts.
+ * - The admin reloading Caddy through the admin API would need a channel
+ *   from the admin into Caddy and would post a file's content over HTTP.
+ *
+ * The loop waits until the checksum is stable across two reads before
+ * reloading (a deploy may be mid-copy), and a reload Caddy rejects only
+ * logs: Caddy keeps the previous config, and the next change retries.
+ */
+
+/** Seconds between checksum polls. */
+const POLL_SECONDS = 2;
+
+/**
+ * The container's shell script: Caddy in the foreground of the container's
+ * lifetime, reloaded when any file matching `snippetGlob` changes.
+ *
+ * @param snippetGlob Shell glob of the imported snippets, e.g.
+ *   `/srv/caelo/output/*\/current/_redirects.caddy`.
+ */
+export function caddyRedirectReloadScript(snippetGlob: string): string {
+  if (/[\s'"`$\\;&|<>]/.test(snippetGlob)) {
+    throw new Error(`caddy-redirects: unsafe snippet glob ${JSON.stringify(snippetGlob)}`);
+  }
+  const config = "--config /etc/caddy/Caddyfile --adapter caddyfile";
+  return [
+    `sum() { cat ${snippetGlob} 2>/dev/null | md5sum; }`,
+    "last=$(sum)",
+    `caddy run ${config} &`,
+    "pid=$!",
+    `trap 'kill -TERM "$pid" 2>/dev/null; wait "$pid"; exit $?' TERM INT`,
+    `while kill -0 "$pid" 2>/dev/null; do`,
+    `  sleep ${POLL_SECONDS}`,
+    "  now=$(sum)",
+    `  [ "$now" = "$last" ] && continue`,
+    // A deploy may still be copying the file: reload only a stable one.
+    "  sleep 1",
+    `  [ "$(sum)" = "$now" ] || continue`,
+    "  last=$now",
+    `  caddy reload ${config} || echo "caelo: redirects changed but Caddy rejected the reload; still serving the previous redirects" >&2`,
+    "done",
+    `wait "$pid"`,
+  ].join("\n");
+}
+
+/**
+ * A Compose `command:` line running {@link caddyRedirectReloadScript}. `$` is
+ * doubled because Compose interpolates `$VAR` in the file; the JSON string is
+ * a valid YAML double-quoted scalar.
+ */
+export function caddyRedirectReloadCommand(snippetGlob: string): string {
+  const script = caddyRedirectReloadScript(snippetGlob).replaceAll("$", () => "$$");
+  return `command: ["/bin/sh", "-c", ${JSON.stringify(script)}]`;
+}

package/src/caddy-validate.test.ts

@@ -0,0 +1,119 @@
+// SPDX-License-Identifier: MPL-2.0
+
+/**
+ * The generated Caddyfile through the real Caddy (issue #566): `caddy
+ * validate` on the exact image the Compose file runs ({@link CADDY_IMAGE}).
+ * String assertions cannot catch a directive Caddy refuses — #566 shipped a
+ * `try_files` nested in `file_server { }` that every unit test accepted and
+ * Caddy 2.11 rejected, so no self-hosted vhost came up.
+ *
+ * Needs Docker. CI sets `CAELO_CADDY_VALIDATE=required`, which turns a
+ * missing Docker into a failure instead of a skip, so this check can never
+ * silently stop running there.
+ */
+
+import { describe, expect, it } from "bun:test";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { type CaddyfileSpec, generateCaddyfile, selfHostedSeedDomains } from "./caddy.js";
+import { CADDY_IMAGE, COMPOSE_ADMIN_UPSTREAM, COMPOSE_GATEWAY_UPSTREAM } from "./compose.js";
+
+const REQUIRED = process.env.CAELO_CADDY_VALIDATE === "required";
+
+function dockerAvailable(): boolean {
+  try {
+    return Bun.spawnSync(["docker", "info"], { stdout: "ignore", stderr: "ignore" }).exitCode === 0;
+  } catch {
+    return false;
+  }
+}
+
+const HAVE_DOCKER = dockerAvailable();
+
+/** `caddy validate` with the Caddyfile on stdin (no bind mount, so it works on any Docker host). */
+async function caddyValidate(caddyfile: string): Promise<{ exitCode: number; output: string }> {
+  const proc = Bun.spawn(
+    [
+      "docker",
+      "run",
+      "--rm",
+      "-i",
+      CADDY_IMAGE,
+      "caddy",
+      "validate",
+      "--config",
+      "/dev/stdin",
+      "--adapter",
+      "caddyfile",
+    ],
+    { stdin: new TextEncoder().encode(caddyfile), stdout: "pipe", stderr: "pipe" },
+  );
+  const [stdout, stderr] = await Promise.all([
+    new Response(proc.stdout).text(),
+    new Response(proc.stderr).text(),
+  ]);
+  return { exitCode: await proc.exited, output: `${stdout}\n${stderr}` };
+}
+
+const base: CaddyfileSpec = {
+  ownerEmail: "owner@example.com",
+  tls: "acme",
+  publicSiteRoot: "/srv/caelo/output/production/current",
+  stagingSiteRoot: "/srv/caelo/output/staging/current",
+  adminUpstream: COMPOSE_ADMIN_UPSTREAM,
+  gatewayUpstream: COMPOSE_GATEWAY_UPSTREAM,
+  domains: selfHostedSeedDomains("example.com", "staging.example.com"),
+};
+
+const CASES: Record<string, string> = {
+  "the seed vhosts `init` writes (ACME)": generateCaddyfile(base),
+  "the seed vhosts with --tls internal": generateCaddyfile({ ...base, tls: "internal" }),
+  "seed + operator-added admin and public domains": generateCaddyfile({
+    ...base,
+    domains: [
+      ...base.domains,
+      { hostname: "www.example.org", kind: "public", env: "production" },
+      { hostname: "cms.example.org", kind: "admin", env: "production" },
+    ],
+  }),
+  "no domains yet (the :8081 block)": generateCaddyfile({ ...base, domains: [] }),
+  "caddy/Caddyfile.production": readFileSync(
+    join(import.meta.dir, "..", "caddy", "Caddyfile.production"),
+    "utf8",
+  ),
+  "caddy/Caddyfile.staging": readFileSync(
+    join(import.meta.dir, "..", "caddy", "Caddyfile.staging"),
+    "utf8",
+  ),
+};
+
+describe(`generated Caddyfiles pass \`caddy validate\` on ${CADDY_IMAGE} (#566)`, () => {
+  if (REQUIRED) {
+    it("Docker is available (CAELO_CADDY_VALIDATE=required)", () => {
+      expect(HAVE_DOCKER).toBe(true);
+    });
+  }
+  it.skipIf(!HAVE_DOCKER)(
+    "rejects the #566 shape (proves the check is not a no-op)",
+    async () => {
+      const r = await caddyValidate(
+        ":80 {\n  file_server {\n    try_files {path} {path}/index.html\n  }\n}\n",
+      );
+      expect(r.exitCode).not.toBe(0);
+      expect(r.output).toContain("unknown subdirective 'try_files'");
+    },
+    180_000,
+  );
+  for (const [name, caddyfile] of Object.entries(CASES)) {
+    it.skipIf(!HAVE_DOCKER)(
+      name,
+      async () => {
+        const r = await caddyValidate(caddyfile);
+        if (r.exitCode !== 0) console.error(r.output);
+        expect(r.exitCode).toBe(0);
+        expect(r.output).toContain("Valid configuration");
+      },
+      180_000,
+    );
+  }
+});

package/src/caddy.test.ts

@@ -0,0 +1,108 @@
+// SPDX-License-Identifier: MPL-2.0
+
+import { describe, expect, it } from "bun:test";
+import {
+  type CaddyfileSpec,
+  generateCaddyfile,
+  selfHostedAdminHost,
+  selfHostedSeedDomains,
+} from "./caddy.js";
+import { COMPOSE_ADMIN_UPSTREAM, COMPOSE_GATEWAY_UPSTREAM } from "./compose.js";
+
+/** The inputs `cms-provision init` passes for example.com. */
+const spec: CaddyfileSpec = {
+  ownerEmail: "owner@example.com",
+  tls: "acme",
+  publicSiteRoot: "/srv/caelo/output/production/current",
+  stagingSiteRoot: "/srv/caelo/output/staging/current",
+  adminUpstream: COMPOSE_ADMIN_UPSTREAM,
+  gatewayUpstream: COMPOSE_GATEWAY_UPSTREAM,
+  domains: selfHostedSeedDomains("example.com", "staging.example.com"),
+};
+
+/** One site block, from its address line to its closing brace. */
+function block(caddyfile: string, host: string): string {
+  const start = caddyfile.indexOf(`\n${host} {\n`);
+  if (start === -1) throw new Error(`no site block for ${host}`);
+  return caddyfile.slice(start + 1, caddyfile.indexOf("\n}\n", start) + 2);
+}
+
+describe("self-hosted seed vhosts", () => {
+  it("puts the admin on admin.<domain>, the live and the staging site on their own hosts", () => {
+    expect(selfHostedSeedDomains("example.com", "staging.example.com")).toEqual([
+      { hostname: "admin.example.com", kind: "admin", env: "production" },
+      { hostname: "example.com", kind: "public", env: "production" },
+      { hostname: "staging.example.com", kind: "public", env: "staging" },
+    ]);
+    expect(selfHostedAdminHost("example.com")).toBe("admin.example.com");
+  });
+
+  it("refuses two vhosts for one host — Caddy would reject the whole file", () => {
+    expect(() =>
+      generateCaddyfile({
+        ...spec,
+        domains: [
+          { hostname: "example.com", kind: "admin", env: "production" },
+          { hostname: "example.com", kind: "public", env: "production" },
+        ],
+      }),
+    ).toThrow(/example\.com is listed twice/);
+  });
+});
+
+describe("Caddyfile upstreams (#707)", () => {
+  const out = generateCaddyfile(spec);
+
+  it("proxies to the Compose service names, never to localhost (Caddy's own container)", () => {
+    expect(out).not.toContain("localhost");
+    expect(out).not.toContain("127.0.0.1");
+    expect(block(out, "admin.example.com")).toContain("reverse_proxy caelo-admin:5173");
+    for (const host of ["example.com", "staging.example.com"]) {
+      expect(block(out, host)).toContain("handle /api/* {\n    reverse_proxy caelo-gateway:8090\n");
+    }
+  });
+
+  it("does not route /admin/* on the public site (the admin routes from / on its own host)", () => {
+    expect(block(out, "example.com")).not.toContain("/admin");
+  });
+});
+
+describe("Caddyfile static site (#566)", () => {
+  const publicBlock = block(generateCaddyfile(spec), "example.com");
+
+  it("emits try_files as its own directive before file_server, never inside it", () => {
+    expect(publicBlock).toContain(
+      "  handle {\n    try_files {path} {path}/index.html\n    file_server\n  }\n",
+    );
+    expect(publicBlock).not.toMatch(/file_server \{[^}]*try_files/);
+  });
+
+  it("answers a missing path with a 404 and the generator's 404 page, not the home page", () => {
+    expect(publicBlock).not.toContain("/index.html /index.html");
+    expect(publicBlock).toContain(
+      "  handle_errors 404 {\n    rewrite * /404.html\n    file_server\n  }\n",
+    );
+  });
+
+  it("serves production and staging from their own roots; only staging is noindex", () => {
+    const out = generateCaddyfile(spec);
+    expect(block(out, "example.com")).toContain("root * /srv/caelo/output/production/current");
+    expect(block(out, "example.com")).not.toContain("X-Robots-Tag");
+    const staging = block(out, "staging.example.com");
+    expect(staging).toContain("root * /srv/caelo/output/staging/current");
+    expect(staging).toContain('header X-Robots-Tag "noindex"');
+  });
+});
+
+describe("Caddyfile TLS", () => {
+  it("uses ACME with the Owner's email by default", () => {
+    const out = generateCaddyfile(spec);
+    expect(out.startsWith("{\n  email owner@example.com\n}\n")).toBe(true);
+    expect(out).not.toContain("local_certs");
+  });
+
+  it("issues every certificate from Caddy's local CA with tls internal", () => {
+    const out = generateCaddyfile({ ...spec, tls: "internal" });
+    expect(out.startsWith("{\n  email owner@example.com\n  local_certs\n}\n")).toBe(true);
+  });
+});