@envsync-cloud/deploy-cli 0.6.17 → 0.6.19

package/dist/index.js

@@ -269,6 +269,16 @@ function domainMap(rootDomain) {
     s3Console: `console.s3.${rootDomain}`
   };
 }
+function publicHttpsOrigin(config, host) {
+  return `https://${host}${config.services.public_https_port === 443 ? "" : `:${config.services.public_https_port}`}`;
+}
+function publicHttpsOriginVariants(config, host) {
+  const canonical = `https://${host}`;
+  if (config.services.public_https_port === 443) {
+    return [canonical];
+  }
+  return [canonical, publicHttpsOrigin(config, host)];
+}
 function getDeployCliVersion() {
   try {
     const packageJsonPath = new URL("../package.json", import.meta.url);
@@ -650,6 +660,10 @@ function renderKeycloakRealm(config, runtimeEnv) {
 }
 function renderTraefikDynamicConfig(config) {
   const hosts = domainMap(config.domain.root_domain);
+  const otelAllowedOrigins = [
+    ...publicHttpsOriginVariants(config, hosts.landing),
+    ...publicHttpsOriginVariants(config, hosts.app)
+  ];
   return [
     "http:",
     "  middlewares:",
@@ -664,15 +678,17 @@ function renderTraefikDynamicConfig(config) {
     "    otel-cors:",
     "      headers:",
     "        accessControlAllowOriginList:",
-    `          - https://${hosts.landing}`,
-    `          - https://${hosts.app}`,
+    ...otelAllowedOrigins.map((origin) => `          - ${origin}`),
     "        accessControlAllowMethods:",
     "          - POST",
     "          - OPTIONS",
     "        accessControlAllowHeaders:",
     "          - Content-Type",
+    "          - content-type",
     "          - Authorization",
-    "        accessControlAllowCredentials: false",
+    "          - authorization",
+    "        accessControlAllowCredentials: true",
+    "        accessControlMaxAge: 600",
     "        addVaryHeader: true",
     "  services:",
     "    envsync-api:",
@@ -702,10 +718,6 @@ function renderTraefikDynamicConfig(config) {
     "      loadBalancer:",
     "        servers:",
     "          - url: http://clickstack:8080",
-    "    clickstack-api:",
-    "      loadBalancer:",
-    "        servers:",
-    "          - url: http://clickstack:8000",
     "    clickstack-otlp:",
     "      loadBalancer:",
     "        servers:",
@@ -715,36 +727,42 @@ function renderTraefikDynamicConfig(config) {
     `      rule: Host(\`${hosts.landing}\`)`,
     "      service: landing",
     "      entryPoints: [websecure]",
-    "      tls: {}",
+    "      tls:",
+    "        certResolver: letsencrypt",
     "    web-router:",
     `      rule: Host(\`${hosts.app}\`)`,
     "      service: web",
     "      entryPoints: [websecure]",
-    "      tls: {}",
+    "      tls:",
+    "        certResolver: letsencrypt",
     "    obs-otlp-router:",
     `      rule: Host(\`${hosts.obs}\`) && (PathPrefix(\`/v1/traces\`) || PathPrefix(\`/v1/logs\`) || PathPrefix(\`/v1/metrics\`))`,
     "      service: clickstack-otlp",
     "      middlewares: [otel-cors]",
     "      priority: 100",
     "      entryPoints: [websecure]",
-    "      tls: {}",
+    "      tls:",
+    "        certResolver: letsencrypt",
     "    obs-api-router:",
     `      rule: Host(\`${hosts.obs}\`) && PathPrefix(\`/api\`)`,
-    "      service: clickstack-api",
+    "      service: clickstack-ui",
     "      priority: 90",
     "      entryPoints: [websecure]",
-    "      tls: {}",
+    "      tls:",
+    "        certResolver: letsencrypt",
     "    obs-ui-router:",
     `      rule: Host(\`${hosts.obs}\`)`,
     "      service: clickstack-ui",
     "      priority: 10",
     "      entryPoints: [websecure]",
-    "      tls: {}",
+    "      tls:",
+    "        certResolver: letsencrypt",
     "    api-router:",
     `      rule: Host(\`${hosts.api}\`)`,
     "      service: envsync-api",
     "      entryPoints: [websecure]",
-    "      tls: {}"
+    "      tls:",
+    "        certResolver: letsencrypt"
   ].join("\n") + "\n";
 }
 function renderNginxConf(kind) {
@@ -941,8 +959,9 @@ ${renderEnvList({
     KC_PROXY_HEADERS: "xforwarded",
     KC_HOSTNAME_STRICT: "false"
   })}
-    volumes:
-      - ${KEYCLOAK_REALM_FILE}:/opt/keycloak/data/import/realm.json:ro
+    configs:
+      - source: keycloak_realm
+        target: /opt/keycloak/data/import/realm.json
     networks: [envsync]
     deploy:
       labels:
@@ -1012,7 +1031,9 @@ ${renderEnvList({
       - clickstack_data:/data/db
       - clickstack_ch_data:/var/lib/clickhouse
       - clickstack_ch_logs:/var/log/clickhouse-server
-      - ${CLICKSTACK_CLICKHOUSE_CONF}:/etc/clickhouse-server/config.d/envsync-listen-host.xml:ro
+    configs:
+      - source: clickstack_clickhouse_conf
+        target: /etc/clickhouse-server/config.d/envsync-listen-host.xml
     networks: [envsync]
     healthcheck:
       disable: true
@@ -1020,22 +1041,27 @@ ${renderEnvList({
   otel-agent:
     image: ${config.images.otel_agent}
     command: ["--config=/etc/otel-agent.yaml"]
-    volumes:
-      - ${OTEL_AGENT_CONF}:/etc/otel-agent.yaml:ro
+    configs:
+      - source: otel_agent_conf
+        target: /etc/otel-agent.yaml
     networks: [envsync]
 ${includeAppServices ? `
 
   landing_nginx:
     image: nginx:1.27-alpine
+    configs:
+      - source: nginx_landing_conf
+        target: /etc/nginx/conf.d/default.conf
     volumes:
-      - ${NGINX_LANDING_CONF}:/etc/nginx/conf.d/default.conf:ro
       - ${RELEASES_ROOT}/landing/current:/srv/landing:ro
     networks: [envsync]
 
   web_nginx:
     image: nginx:1.27-alpine
+    configs:
+      - source: nginx_web_conf
+        target: /etc/nginx/conf.d/default.conf
     volumes:
-      - ${NGINX_WEB_CONF}:/etc/nginx/conf.d/default.conf:ro
       - ${RELEASES_ROOT}/web/current:/srv/web:ro
     networks: [envsync]
 
@@ -1066,6 +1092,18 @@ volumes:
   clickstack_data:
   clickstack_ch_data:
   clickstack_ch_logs:
+
+configs:
+  keycloak_realm:
+    file: ${KEYCLOAK_REALM_FILE}
+  clickstack_clickhouse_conf:
+    file: ${CLICKSTACK_CLICKHOUSE_CONF}
+  otel_agent_conf:
+    file: ${OTEL_AGENT_CONF}
+  nginx_landing_conf:
+    file: ${NGINX_LANDING_CONF}
+  nginx_web_conf:
+    file: ${NGINX_WEB_CONF}
 `.trimStart();
 }
 function writeDeployArtifacts(config, generated) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@envsync-cloud/deploy-cli",
-  "version": "0.6.17",
+  "version": "0.6.19",
   "description": "CLI for self-hosted EnvSync deployment on Docker Swarm",
   "type": "module",
   "bin": {