@envsync-cloud/deploy-cli 0.8.11 → 0.8.13

package/dist/index.js

@@ -4400,6 +4400,7 @@ function buildRuntimeEnv2(config, generated) {
   const oss = isOssConfig(config);
   const enterprise = !oss;
   const license = config.license ?? {};
+  const accessProxy = config.access_proxy;
   return {
     NODE_ENV: "production",
     ENVSYNC_EDITION: oss ? "oss" : "enterprise",
@@ -4428,6 +4429,13 @@ function buildRuntimeEnv2(config, generated) {
     POSTGRES_USER: "postgres",
     POSTGRES_PASSWORD: "envsync-postgres",
     POSTGRES_DB: "envsync",
+    ENVSYNC_ACCESS_PROXY_ENABLED: `${accessProxy?.enabled ?? false}`,
+    ENVSYNC_ACCESS_PROXY_PROVIDER: accessProxy?.provider ?? "",
+    ENVSYNC_ACCESS_PROXY_DOMAIN: accessProxy?.domain ?? "",
+    ENVSYNC_ACCESS_PROXY_SERVICE_SCOPE: accessProxy?.service_scope ?? "all",
+    ENVSYNC_ACCESS_PROXY_SERVICES: Array.isArray(accessProxy?.services) ? accessProxy.services.join(",") : "",
+    ENVSYNC_ACCESS_PROXY_ADVERTISE_ROUTES: `${accessProxy?.advertise_routes ?? false}`,
+    ENVSYNC_ACCESS_PROXY_INCLUDE_ADMIN_SERVICES: `${accessProxy?.include_admin_services ?? false}`,
     S3_BUCKET: bucketName,
     S3_REGION: "us-east-1",
     S3_ACCESS_KEY: "envsync-rustfs",
@@ -4737,11 +4745,16 @@ function renderFrontendRuntimeConfig(config, generated) {
   const otelEndpoint = publicHttpsUrl(config, hosts.obs);
   const managementApiEnabled = !isOssConfig(config);
   const activeReleaseVersion = generated.deployment.slots[generated.deployment.active_slot].release_version || config.release.version;
+  const accessProxy = config.access_proxy;
   const managementApiUrl = managementApiEnabled ? publicHttpsUrl(config, hosts.manage_api) : "";
   return `window.__ENVSYNC_RUNTIME_CONFIG__ = ${JSON.stringify({
     apiBaseUrl: publicHttpsUrl(config, hosts.api),
     appBaseUrl: publicHttpsUrl(config, hosts.app),
     authBaseUrl: publicHttpsUrl(config, hosts.auth),
+    accessProxyEnabled: accessProxy?.enabled ?? false,
+    accessProxyDomain: accessProxy?.domain ?? "",
+    accessProxyServiceScope: accessProxy?.service_scope ?? "all",
+    accessProxyServices: accessProxy?.services ?? [],
     managementApiUrl,
     keycloakRealm: config.auth.keycloak_realm,
     webClientId: config.auth.web_client_id,
@@ -5462,6 +5475,12 @@ function parseEnvFile(content) {
   }
   return out;
 }
+function asBool(value) {
+  return value.trim().toLowerCase() === "true" || value.trim().toLowerCase() === "y" || value.trim().toLowerCase() === "yes";
+}
+function asStringList(value) {
+  return value.split(",").map((item) => item.trim()).filter((item) => item.length > 0);
+}
 async function ask(question, fallback = "") {
   if (!process.stdin.isTTY) return fallback;
   const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
@@ -5803,6 +5822,30 @@ function normalizeConfig(raw) {
     } : raw.edition === "oss" ? void 0 : {
       install_fingerprint: deterministicInstallFingerprint(rootDomain, stackName),
       certificate_validity_days: 1095
+    },
+    access_proxy: {
+      enabled: raw.access_proxy?.enabled ?? false,
+      provider: "tsdproxy",
+      auth_token: raw.access_proxy?.auth_token ?? "",
+      domain: raw.access_proxy?.domain ?? `tsdproxy.${rootDomain}`,
+      service_scope: raw.access_proxy?.service_scope === "selected" ? "selected" : "all",
+      services: Array.isArray(raw.access_proxy?.services) ? raw.access_proxy.services.filter((s) => typeof s === "string" && s.trim().length > 0) : [
+        "api",
+        "web",
+        "landing",
+        "keycloak",
+        "openfga",
+        "postgre*",
+        "redis",
+        "rustfs",
+        "clickstack",
+        "obs",
+        "envsync_api_*",
+        "envsync_management-api",
+        "envsync-api"
+      ],
+      advertise_routes: raw.access_proxy?.advertise_routes ?? false,
+      include_admin_services: raw.access_proxy?.include_admin_services ?? false
     }
   };
 }
@@ -7212,6 +7255,14 @@ async function cmdSetup() {
   const licenseKey = licenseServerUrl ? await ask("Enterprise license key", "") : "";
   const certificateBundleFile = licenseServerUrl ? "" : await ask("Enterprise certificate bundle file (optional)", "");
   const installFingerprint = deterministicInstallFingerprint(rootDomain, "envsync");
+  const enableAccessProxy = asBool(await ask("Enable private access proxy for container services (y/N)", "n"));
+  const accessProxyProvider = enableAccessProxy ? await ask("Private access proxy provider", "tsdproxy") : "tsdproxy";
+  const accessProxyAuthToken = enableAccessProxy ? await ask("Proxy auth token or API key", "") : "";
+  const accessProxyDomain = enableAccessProxy ? await ask("Private access domain", `tsdproxy.${rootDomain}`) : `tsdproxy.${rootDomain}`;
+  const accessProxyExposeAll = enableAccessProxy ? asBool(await ask("Expose all services through proxy (Y/n)", "y")) : true;
+  const accessProxyServices = !accessProxyExposeAll ? asStringList(await ask("Service hostnames to expose (comma-separated)", "postgres,api,web,landing,keycloak,minikms,openfga,rustfs,clickstack,obs,manage-api")) : [];
+  const includeAdminServices = enableAccessProxy ? asBool(await ask("Expose admin/maintenance services (y/N)", "n")) : false;
+  const accessProxyAdvertiseRoutes = enableAccessProxy ? asBool(await ask("Advertise overlay subnet routes through the proxy provider (y/N)", "n")) : false;
   const config = {
     edition: "enterprise",
     source: defaultSourceConfig(releaseVersion),
@@ -7284,6 +7335,16 @@ async function cmdSetup() {
       install_fingerprint: installFingerprint,
       certificate_bundle_file: certificateBundleFile || void 0,
       certificate_validity_days: 1095
+    },
+    access_proxy: {
+      enabled: enableAccessProxy,
+      provider: accessProxyProvider,
+      auth_token: accessProxyAuthToken,
+      domain: accessProxyDomain,
+      service_scope: accessProxyExposeAll ? "all" : "selected",
+      services: accessProxyServices,
+      advertise_routes: accessProxyAdvertiseRoutes,
+      include_admin_services: includeAdminServices
     }
   };
   saveDesiredConfig(config);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@envsync-cloud/deploy-cli",
-  "version": "0.8.11",
+  "version": "0.8.13",
   "description": "CLI for self-hosted EnvSync deployment on Docker Swarm",
   "type": "module",
   "bin": {