@crossdelta/infrastructure 0.11.7 → 0.12.0

package/dist/index.cjs

@@ -1142,7 +1142,7 @@ var CADDY_DEFAULTS = {
     limits: { cpu: "200m", memory: "256Mi" }
   },
   storage: { size: "1Gi", storageClass: "do-block-storage" },
-  healthCheck: { port: 80, path: "/healthz" }
+  healthCheck: { port: 8080, path: "/healthz" }
 };
 var indent = (text, level) => {
   const prefix = "  ".repeat(level);
@@ -1155,9 +1155,7 @@ var basicAuthLines = (basicAuth) => basicAuth ? ["basic_auth {", `  ${basicAuth.
 var generateHandleBlock = (handle, level, basicAuth) => {
   const hasPath = handle.path != null;
   const header = hasPath ? `handle ${handle.path}* {` : "handle {";
-  const body = [
-    ...basicAuthLines(basicAuth)
-  ];
+  const body = [...basicAuthLines(basicAuth)];
   if (handle.redirect) {
     body.push(`redir ${handle.redirect} permanent`);
   } else if (handle.upstream) {
@@ -1172,8 +1170,11 @@ var generateHandleBlock = (handle, level, basicAuth) => {
 ${inner}
 }`, level);
 };
-var generateRouteBlock = (route, encode) => {
+var generateRouteBlock = (route, encode, useOnDemandTls) => {
   const body = [];
+  if (useOnDemandTls) {
+    body.push("  tls {", "    on_demand", "  }");
+  }
   if (!route.redirect && encode?.length) {
     body.push(`  encode ${encode.join(" ")}`);
   }
@@ -1232,9 +1233,10 @@ var generateCaddyfile = (config) => {
   const healthCheckBlock = `:${healthCheck.port} {
   respond ${healthCheck.path} 200
 }`;
+  const useOnDemandTls = config.onDemandTls != null;
   const blocks = [
     generateGlobalBlock(config),
-    ...config.routes.map((route) => generateRouteBlock(route, config.encode)),
+    ...config.routes.map((route) => generateRouteBlock(route, config.encode, useOnDemandTls)),
     healthCheckBlock,
     ...config.catchAllUpstream && config.onDemandTls ? [generateCatchAllBlock(config.catchAllUpstream, config.encode)] : []
   ];
@@ -1264,10 +1266,11 @@ var deployCaddy = (provider, namespace, config) => {
   }, { provider });
   const caddyContainer = {
     name: "caddy",
-    image: "caddy:2-alpine",
+    image: "caddy:2.11.2-alpine",
     ports: [
       { name: "https", containerPort: 443, protocol: "TCP" },
-      { name: "http", containerPort: 80, protocol: "TCP" }
+      { name: "http", containerPort: 80, protocol: "TCP" },
+      { name: "health", containerPort: healthCheck.port, protocol: "TCP" }
     ],
     resources: buildResourceSpec(config.resources),
     volumeMounts: [
@@ -1322,9 +1325,12 @@ var deployCaddy = (provider, namespace, config) => {
       namespace,
       labels,
       annotations: {
+        "service.beta.kubernetes.io/do-loadbalancer-tls-passthrough": "true",
         "service.beta.kubernetes.io/do-loadbalancer-healthcheck-path": healthCheck.path,
         "service.beta.kubernetes.io/do-loadbalancer-healthcheck-protocol": "http",
-        "service.beta.kubernetes.io/do-loadbalancer-healthcheck-port": String(healthCheck.port)
+        "service.beta.kubernetes.io/do-loadbalancer-healthcheck-port": String(healthCheck.port),
+        "service.beta.kubernetes.io/do-loadbalancer-healthcheck-check-interval-seconds": "3",
+        "service.beta.kubernetes.io/do-loadbalancer-healthcheck-healthy-threshold": "3"
       }
     },
     spec: {

package/dist/index.js

@@ -1046,7 +1046,7 @@ var CADDY_DEFAULTS = {
     limits: { cpu: "200m", memory: "256Mi" }
   },
   storage: { size: "1Gi", storageClass: "do-block-storage" },
-  healthCheck: { port: 80, path: "/healthz" }
+  healthCheck: { port: 8080, path: "/healthz" }
 };
 var indent = (text, level) => {
   const prefix = "  ".repeat(level);
@@ -1059,9 +1059,7 @@ var basicAuthLines = (basicAuth) => basicAuth ? ["basic_auth {", `  ${basicAuth.
 var generateHandleBlock = (handle, level, basicAuth) => {
   const hasPath = handle.path != null;
   const header = hasPath ? `handle ${handle.path}* {` : "handle {";
-  const body = [
-    ...basicAuthLines(basicAuth)
-  ];
+  const body = [...basicAuthLines(basicAuth)];
   if (handle.redirect) {
     body.push(`redir ${handle.redirect} permanent`);
   } else if (handle.upstream) {
@@ -1076,8 +1074,11 @@ var generateHandleBlock = (handle, level, basicAuth) => {
 ${inner}
 }`, level);
 };
-var generateRouteBlock = (route, encode) => {
+var generateRouteBlock = (route, encode, useOnDemandTls) => {
   const body = [];
+  if (useOnDemandTls) {
+    body.push("  tls {", "    on_demand", "  }");
+  }
   if (!route.redirect && encode?.length) {
     body.push(`  encode ${encode.join(" ")}`);
   }
@@ -1136,9 +1137,10 @@ var generateCaddyfile = (config) => {
   const healthCheckBlock = `:${healthCheck.port} {
   respond ${healthCheck.path} 200
 }`;
+  const useOnDemandTls = config.onDemandTls != null;
   const blocks = [
     generateGlobalBlock(config),
-    ...config.routes.map((route) => generateRouteBlock(route, config.encode)),
+    ...config.routes.map((route) => generateRouteBlock(route, config.encode, useOnDemandTls)),
     healthCheckBlock,
     ...config.catchAllUpstream && config.onDemandTls ? [generateCatchAllBlock(config.catchAllUpstream, config.encode)] : []
   ];
@@ -1168,10 +1170,11 @@ var deployCaddy = (provider, namespace, config) => {
   }, { provider });
   const caddyContainer = {
     name: "caddy",
-    image: "caddy:2-alpine",
+    image: "caddy:2.11.2-alpine",
     ports: [
       { name: "https", containerPort: 443, protocol: "TCP" },
-      { name: "http", containerPort: 80, protocol: "TCP" }
+      { name: "http", containerPort: 80, protocol: "TCP" },
+      { name: "health", containerPort: healthCheck.port, protocol: "TCP" }
     ],
     resources: buildResourceSpec(config.resources),
     volumeMounts: [
@@ -1226,9 +1229,12 @@ var deployCaddy = (provider, namespace, config) => {
       namespace,
       labels,
       annotations: {
+        "service.beta.kubernetes.io/do-loadbalancer-tls-passthrough": "true",
         "service.beta.kubernetes.io/do-loadbalancer-healthcheck-path": healthCheck.path,
         "service.beta.kubernetes.io/do-loadbalancer-healthcheck-protocol": "http",
-        "service.beta.kubernetes.io/do-loadbalancer-healthcheck-port": String(healthCheck.port)
+        "service.beta.kubernetes.io/do-loadbalancer-healthcheck-port": String(healthCheck.port),
+        "service.beta.kubernetes.io/do-loadbalancer-healthcheck-check-interval-seconds": "3",
+        "service.beta.kubernetes.io/do-loadbalancer-healthcheck-healthy-threshold": "3"
       }
     },
     spec: {

package/dist/runtimes/doks/caddy.d.ts

@@ -32,7 +32,7 @@ export declare const generateCaddyfile: (config: CaddyConfig) => string;
  * Deploy Caddy as a reverse proxy to the cluster.
  *
  * Creates:
- * - Deployment with `caddy:2-alpine` (Strategy: Recreate for RWO PVC)
+ * - Deployment with `caddy:2.11.2-alpine` (Strategy: Recreate for RWO PVC)
  * - LoadBalancer Service with DigitalOcean health check annotations
  * - PVC for cert persistence (`/data`)
  * - ConfigMap with the generated Caddyfile

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crossdelta/infrastructure",
-  "version": "0.11.7",
+  "version": "0.12.0",
   "type": "module",
   "license": "MIT",
   "publishConfig": {
@@ -35,7 +35,7 @@
     }
   },
   "dependencies": {
-    "@crossdelta/cloudevents": "^0.8.1"
+    "@crossdelta/cloudevents": "^0.8.2"
   },
   "peerDependencies": {
     "@pulumi/digitalocean": "^4.0.0",