@caelo-cms/provisioning 0.10.49 → 0.10.51

package/src/caddy.ts

@@ -5,18 +5,32 @@
  *
  * Reads the `domains` table + the deploy targets and emits a
  * deterministic Caddyfile string. The CLI's `regenerate-caddy`
- * sub-command writes this to `/etc/caddy/Caddyfile` and runs
+ * sub-command writes this to `.caelo/Caddyfile` and runs
  * `caddy reload`.
  *
  * Per-vhost shape:
  *   <hostname> {
- *     # admin   → reverse_proxy localhost:5173
- *     # public  → root + try_files (static), with /api/* → gateway
- *     tls <ownerEmail>
+ *     # admin   → reverse_proxy <adminUpstream>
+ *     # public  → /api/* → <gatewayUpstream>; everything else is the
+ *     #           static site (try_files + file_server, 404 → /404.html)
  *   }
  *
+ * Upstreams are `host:port` as seen FROM CADDY. In the Compose install
+ * Caddy runs in its own container, where `localhost` is Caddy itself, so
+ * the CLI passes the Compose service names (`caelo-admin:5173`,
+ * `caelo-gateway:8090`) — issue #707.
+ *
+ * Every directive here must be one Caddy accepts: the output is checked
+ * with `caddy validate` on the pinned Caddy image (caddy-validate.test.ts,
+ * run in CI) — issue #566 shipped a `try_files` nested inside
+ * `file_server { }`, which Caddy 2.11 refuses, so no vhost came up.
+ *
  * Staging vhosts force `X-Robots-Tag: noindex`.
  *
+ * Public vhosts import the redirect snippet of the build they serve
+ * (`_redirects.caddy`, #587); the Caddy container reloads itself when a
+ * deploy changes it (caddy-redirects.ts).
+ *
  * Public vhosts mark content-hashed build outputs (fonts, plugin
  * bundles — `CONTENT_HASHED_PATH_PATTERN` in @caelo-cms/shared)
  * `immutable` for a year. Everything else keeps Caddy's file_server
@@ -26,13 +40,22 @@
  * hashed URL (an old page requesting an asset the new build dropped)
  * is never cached for a year.
  *
+ * A path that matches no file is a real 404 serving the generator's
+ * `/404.html` — never the home page with a 200 (an SPA-style
+ * `/index.html` fallback would turn every dead URL into a soft 404).
+ * Same behaviour as the GCS / S3 / Blob adapters (CLAUDE.md §11.B).
+ *
  * `.ico` files (theme favicons) are served as `image/x-icon`, the one
  * icon MIME the media library stores and `<link rel="icon" type>`
  * declares. file_server only fills Content-Type when no earlier handler
  * set it, so the `header` line wins over the host's mime.types name.
  */
 
-import { CONTENT_HASHED_PATH_PATTERN, IMMUTABLE_CACHE_CONTROL } from "@caelo-cms/shared";
+import {
+  CONTENT_HASHED_PATH_PATTERN,
+  caddyRedirectsImport,
+  IMMUTABLE_CACHE_CONTROL,
+} from "@caelo-cms/shared";
 
 export interface CaddyDomainSpec {
   readonly hostname: string;
@@ -40,21 +63,64 @@ export interface CaddyDomainSpec {
   readonly env: "production" | "staging";
 }
 
+/**
+ * How Caddy gets certificates: `acme` — publicly trusted ones from Let's
+ * Encrypt / ZeroSSL (needs public DNS + ports 80/443 reachable); `internal`
+ * — Caddy's own local CA, for a LAN or evaluation install without public
+ * DNS (browsers warn until the CA root is trusted).
+ */
+export type CaddyTlsMode = "acme" | "internal";
+
 export interface CaddyfileSpec {
   readonly ownerEmail: string;
-  readonly publicSiteRoot: string; // absolute path on disk
+  readonly tls: CaddyTlsMode;
+  readonly publicSiteRoot: string; // absolute path inside the Caddy container
   readonly stagingSiteRoot: string;
-  readonly adminPort: number;
-  readonly gatewayPort: number;
+  /** `host:port` of the admin as Caddy reaches it (Compose: `caelo-admin:5173`). */
+  readonly adminUpstream: string;
+  /** `host:port` of the API gateway as Caddy reaches it (Compose: `caelo-gateway:8090`). */
+  readonly gatewayUpstream: string;
   readonly domains: ReadonlyArray<CaddyDomainSpec>;
 }
 
+/** The host the admin of a self-hosted install answers on (same convention as GCP). */
+export function selfHostedAdminHost(domain: string): string {
+  return `admin.${domain}`;
+}
+
+/**
+ * The vhosts every self-hosted install serves before an Owner adds domains
+ * in the admin: the admin on `admin.<domain>`, the live site on `<domain>`,
+ * the staging site on its own host. The admin needs its own host — it
+ * routes from `/` (`/setup`, `/login`, …), so it cannot share one with the
+ * public site, and Caddy refuses two site blocks for the same address.
+ */
+export function selfHostedSeedDomains(domain: string, stagingDomain: string): CaddyDomainSpec[] {
+  return [
+    { hostname: selfHostedAdminHost(domain), kind: "admin", env: "production" },
+    { hostname: domain, kind: "public", env: "production" },
+    { hostname: stagingDomain, kind: "public", env: "staging" },
+  ];
+}
+
 export function generateCaddyfile(spec: CaddyfileSpec): string {
+  const hostnames = new Set<string>();
+  for (const d of spec.domains) {
+    if (hostnames.has(d.hostname)) {
+      // Caddy refuses a config with two site blocks for one address, so a
+      // duplicate would take every vhost down, not just this one.
+      throw new Error(
+        `Caddyfile: ${d.hostname} is listed twice — one host serves either the admin or a public site, not both.`,
+      );
+    }
+    hostnames.add(d.hostname);
+  }
+
   const blocks: string[] = [];
 
   // Global options.
   blocks.push(`{
-  email ${spec.ownerEmail}
+  email ${spec.ownerEmail}${spec.tls === "internal" ? "\n  local_certs" : ""}
 }
 `);
 
@@ -68,7 +134,7 @@ export function generateCaddyfile(spec: CaddyfileSpec): string {
     blocks.push(`# No domains configured yet — cms-provision regenerate-caddy
 # will overwrite this file when you add one at /settings/domains.
 :8081 {
-  reverse_proxy localhost:${spec.adminPort}
+  reverse_proxy ${spec.adminUpstream}
 }
 `);
   }
@@ -80,15 +146,18 @@ function vhost(d: CaddyDomainSpec, spec: CaddyfileSpec): string {
   const noindex = d.env === "staging" ? `\n  header X-Robots-Tag "noindex"` : "";
   if (d.kind === "admin") {
     return `${d.hostname} {${noindex}
-  reverse_proxy localhost:${spec.adminPort}
+  reverse_proxy ${spec.adminUpstream}
 }
 `;
   }
-  // public — API routes go to the gateway,
-  // the rest serves static files. Locale variants serve from a
+  // public — API routes go to the gateway, the rest is the static site.
+  // `try_files` is its own directive (a rewrite), never a file_server
+  // subdirective (#566).
   const root = d.env === "staging" ? spec.stagingSiteRoot : spec.publicSiteRoot;
+  // #587 — the redirects table of the build this vhost serves.
   return `${d.hostname} {${noindex}
   root * ${root}
+  ${caddyRedirectsImport(root)}
   @content_hashed {
     path_regexp content_hashed ${CONTENT_HASHED_PATH_PATTERN}
     file
@@ -97,15 +166,15 @@ function vhost(d: CaddyDomainSpec, spec: CaddyfileSpec): string {
   @ico path *.ico
   header @ico Content-Type "image/x-icon"
   handle /api/* {
-    reverse_proxy localhost:${spec.gatewayPort}
-  }
-  handle /admin/* {
-    reverse_proxy localhost:${spec.adminPort}
+    reverse_proxy ${spec.gatewayUpstream}
   }
   handle {
-    file_server {
-      try_files {path} {path}/index.html /index.html
-    }
+    try_files {path} {path}/index.html
+    file_server
+  }
+  handle_errors 404 {
+    rewrite * /404.html
+    file_server
   }
 }
 `;

package/src/checkpoint-secrets.test.ts

@@ -40,7 +40,6 @@ const setupLink = "https://admin.acme.test/setup?token=fakeSetupToken0123456789"
 const stackOutputs = {
   adminDatabaseUrlOut: { value: databaseUrls("10.1.2.3").admin, secret: false },
   publicDatabaseUrlOut: { value: databaseUrls("10.1.2.3").public, secret: false },
-  gatewayDatabaseUrlOut: { value: databaseUrls("10.1.2.3").gateway, secret: false },
   bootstrapUrlOut: { value: setupLink, secret: false },
   bootstrapTokenExpiresAtOut: { value: "2026-10-13T00:00:00.000Z", secret: false },
   providerOut: { value: "gcp", secret: false },

package/src/cli-routing.test.ts

@@ -13,6 +13,18 @@ describe("resolveCliRoute", () => {
     ).toEqual({ kind: "wizard" });
   });
 
+  it("routes the self-hosted one-command install to init (#707)", () => {
+    expect(
+      resolveCliRoute(
+        argv("--provider", "self-hosted", "--domain", "example.com", "--owner-email", "o@x.y"),
+        HANDLERS,
+      ),
+    ).toEqual({ kind: "handler", name: "init" });
+    expect(resolveCliRoute(argv("--provider", "self-hosted", "--help"), HANDLERS)).toEqual({
+      kind: "usage",
+    });
+  });
+
   it("routes a bare invocation to the wizard", () => {
     expect(resolveCliRoute(argv(), HANDLERS)).toEqual({ kind: "wizard" });
   });

package/src/cli-routing.ts

@@ -30,6 +30,13 @@ export function resolveCliRoute(argv: readonly string[], handlerNames: Iterable<
   if (argv.includes("--no-wizard") || argv.includes("--help") || argv.includes("-h")) {
     return { kind: "usage" };
   }
+  // #707 — `--provider self-hosted --domain … --owner-email …` is the
+  // self-hosted one-command install: `init` writes `.caelo/` and starts the
+  // stack. (The cloud wizard has nothing to provision for it.)
+  const provider = argv.indexOf("--provider");
+  if (provider !== -1 && argv[provider + 1] === "self-hosted") {
+    return { kind: "handler", name: "init" };
+  }
   return { kind: "wizard" };
 }