@envsync-cloud/deploy-cli 0.8.16 → 0.9.0

package/README.md

@@ -148,4 +148,4 @@ bun run src/index.ts plan-topology /etc/envsync/deploy.yaml
 - `upgrade` and `deploy` reconcile managed versioned artifacts from `release.version`.
 - Custom image overrides are still preserved for advanced self-host setups.
 - Enterprise package publication now targets NPM Packages rather than the public npm registry.
-- The full deployment guide lives in [SELFHOSTING.md](/Users/bravo68web/Projects/OSS/EnvSync/monorepo/SELFHOSTING.md).
+- The full deployment guide lives in [SELFHOSTING.md](../../SELFHOSTING.md).

package/dist/index.js

@@ -4117,6 +4117,11 @@ var deployConfigSchema = external_exports.object({
   frontend: external_exports.object({
     dashboard_variant: external_exports.enum(["oss", "enterprise"]).optional(),
     include_manage_subtree: external_exports.boolean().optional()
+  }).default({}),
+  vpn: external_exports.object({
+    provider: external_exports.enum(["netbird", "none"]).default("none"),
+    internal_domain: external_exports.string().default("envsync.local"),
+    nb_setup_key: external_exports.string().default("")
   }).default({})
 });
 function readDeployConfigFile(filePath) {
@@ -4475,7 +4480,9 @@ function buildRuntimeEnv2(config, generated) {
     OTEL_SERVICE_NAME: "envsync-api",
     OTEL_SDK_DISABLED: "false",
     CLICKSTACK_URL: publicHttpsUrl(config, hosts.obs),
-    KEYCLOAK_IMAGE_TAG: keycloakImageTag(config.images.keycloak)
+    KEYCLOAK_IMAGE_TAG: keycloakImageTag(config.images.keycloak),
+    // Is this too hacky? We go Shawn way.
+    ...config.vpn?.provider && config.vpn.provider !== "none" && config.vpn.nb_setup_key ? { NB_SETUP_KEY: config.vpn.nb_setup_key } : {}
   };
 }
 function renderEnvFile(env) {
@@ -4789,6 +4796,104 @@ function renderNetutilsService(config) {
 ${ports}
     networks: [envsync]`;
 }
+var VPN_SERVICE_RENDERERS = {
+  none: () => null,
+  netbird: renderNetbirdService
+};
+function renderNetbirdService(config, paths, runtimeEnv) {
+  const nbSetupKey = runtimeEnv.NB_SETUP_KEY ?? "";
+  return {
+    serviceBlock: `
+  netbird_nginx:
+    image: ghcr.io/envsync-cloud/netbird-nginx
+    cap_add:
+      - NET_ADMIN
+      - SYS_ADMIN
+      - SYS_RESOURCE
+    networks: [envsync]
+    environment:
+${renderEnvList({ NB_SETUP_KEY: nbSetupKey })}
+    volumes:
+      - netbird_client:/var/lib/netbird
+      - ${paths.nginxVpnConf}:/etc/nginx/nginx.conf:ro`,
+    // Adding comment for readability, extra volume below. We gotta do something about too many ` bhaiya.
+    extraVolumes: ["netbird_client"]
+  };
+}
+function renderVpnService(config, paths, runtimeEnv) {
+  const provider = config.vpn?.provider ?? "none";
+  const renderer = VPN_SERVICE_RENDERERS[provider];
+  if (!renderer) return null;
+  return renderer(config, paths, runtimeEnv);
+}
+function renderNginxVpnConf(config) {
+  const domain = config.vpn?.internal_domain ?? "envsync.local";
+  return `events {}
+
+stream {
+  server {
+    listen 5432;
+    proxy_pass postgres:5432;
+  }
+  server {
+    listen 6379;
+    proxy_pass redis:6379;
+  }
+  server {
+    listen 50051;
+    proxy_pass minikms:50051;
+  }
+  server {
+    listen 5544;
+    proxy_pass minikms_db:5432;
+  }
+  server {
+    listen 8091;
+    proxy_pass openfga:8091;
+  }
+}
+
+http {
+  server {
+    listen 80;
+    server_name keycloak.${domain};
+    location / {
+      proxy_pass http://keycloak:8080/;
+      proxy_set_header Host $host;
+      proxy_set_header X-Real-IP $remote_addr;
+      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    }
+  }
+  server {
+    listen 80;
+    server_name openfga.${domain};
+    location / {
+      proxy_pass http://openfga:8090/;
+      proxy_set_header Host $host;
+      proxy_set_header X-Real-IP $remote_addr;
+    }
+  }
+  server {
+    listen 80;
+    server_name clickstack.${domain};
+    location / {
+      proxy_pass http://clickstack:8080/;
+      proxy_set_header Host $host;
+      proxy_set_header X-Real-IP $remote_addr;
+    }
+  }
+  server {
+    listen 80;
+    server_name rustfs.${domain};
+    location / {
+      proxy_pass http://rustfs:9001/;
+      proxy_set_header Host $host;
+      proxy_set_header X-Real-IP $remote_addr;
+    }
+  }
+}
+`;
+}
 function renderOtelAgentConfig(config) {
   return [
     "receivers:",
@@ -4846,6 +4951,7 @@ function renderStack(config, runtimeEnv, generated, mode, paths) {
   const s3ConsoleRouterName = `${stackName}-s3-console-router`;
   const s3ConsoleServiceName = `${stackName}-s3-console-service`;
   const netutilsService = renderNetutilsService(config);
+  const vpnResult = renderVpnService(config, paths, runtimeEnv);
   const apiEnvironment = {
     ...runtimeEnv,
     OTEL_EXPORTER_OTLP_ENDPOINT: "http://otel-agent:4318",
@@ -5113,7 +5219,7 @@ ${renderEnvList({
 ${apiLicenseVolume}
     networks: [envsync]
     deploy:
-      replicas: ${slotHasApiDeployment(deployment.slots.green) ? 1 : 0}` : ""}${netutilsService}
+      replicas: ${slotHasApiDeployment(deployment.slots.green) ? 1 : 0}` : ""}${netutilsService}${vpnResult?.serviceBlock ?? ""}
 
 networks:
   envsync:
@@ -5130,6 +5236,8 @@ volumes:
   clickstack_data:
   clickstack_ch_data:
   clickstack_ch_logs:
+  ${vpnResult?.extraVolumes.map((v) => `
+  ${v}:`).join("") ?? ""}
 
 configs:
   keycloak_realm:
@@ -5231,6 +5339,7 @@ var KEYCLOAK_REALM_FILE = path3.join(DEPLOY_ROOT, "keycloak-realm.envsync.json")
 var NGINX_WEB_CONF = path3.join(DEPLOY_ROOT, "nginx-web.conf");
 var NGINX_LANDING_CONF = path3.join(DEPLOY_ROOT, "nginx-landing.conf");
 var NGINX_API_MAINTENANCE_CONF = path3.join(DEPLOY_ROOT, "nginx-api-maintenance.conf");
+var NGINX_VPN_CONF = path3.join(DEPLOY_ROOT, "nginx-vpn.conf");
 var OTEL_AGENT_CONF = path3.join(DEPLOY_ROOT, "otel-agent.yaml");
 var CLICKSTACK_CLICKHOUSE_CONF = path3.join(DEPLOY_ROOT, "clickhouse-listen.xml");
 var INTERNAL_CONFIG_JSON = path3.join(DEPLOY_ROOT, "config.json");
@@ -5248,7 +5357,8 @@ var DEPLOY_RENDER_PATHS = {
   otelAgentConf: OTEL_AGENT_CONF,
   nginxLandingConf: NGINX_LANDING_CONF,
   nginxWebConf: NGINX_WEB_CONF,
-  nginxApiMaintenanceConf: NGINX_API_MAINTENANCE_CONF
+  nginxApiMaintenanceConf: NGINX_API_MAINTENANCE_CONF,
+  nginxVpnConf: NGINX_VPN_CONF
 };
 var REMOVE_TARGETS = [
   DEPLOY_ROOT,
@@ -6137,6 +6247,11 @@ function normalizeConfig(raw) {
       keep_failed_upgrade_db_snapshot: raw.upgrade?.keep_failed_upgrade_db_snapshot ?? true
     },
     netutils: normalizeNetutilsForwards(raw.netutils?.forwards, stackName, raw.netutils?.enabled ?? false),
+    vpn: {
+      provider: raw.vpn?.provider ?? "none",
+      internal_domain: raw.vpn?.internal_domain ?? "envsync.local",
+      nb_setup_key: raw.vpn?.nb_setup_key ?? ""
+    },
     license: raw.license ? {
       server_url: raw.license.server_url,
       key: raw.license.key,
@@ -6470,6 +6585,9 @@ function writeDeployArtifacts(config, generated) {
   writeFileMaybe(NGINX_API_MAINTENANCE_CONF, renderApiMaintenanceConf());
   writeFileMaybe(OTEL_AGENT_CONF, renderOtelAgentConfig(config));
   writeFileMaybe(CLICKSTACK_CLICKHOUSE_CONF, renderClickstackClickHouseConfig());
+  if (config.vpn?.provider && config.vpn.provider !== "none") {
+    writeFileMaybe(NGINX_VPN_CONF, renderNginxVpnConf(config));
+  }
   logSuccess(currentOptions.dryRun ? "Deploy artifacts previewed" : "Deploy artifacts written");
 }
 function saveDesiredConfig(config) {
@@ -7585,6 +7703,13 @@ async function cmdSetup() {
     }
   }
   const licenseServerUrl = await ask("Enterprise license server URL", DEFAULT_ENTERPRISE_LICENSE_SERVER_URL);
+  const vpnProvider = (await ask("VPN provider for internal service access (netbird/none)", "none")).toLowerCase();
+  let vpnInternalDomain = "envsync.local";
+  let vpnNbSetupKey = "";
+  if (vpnProvider !== "none") {
+    vpnInternalDomain = await ask("Internal root domain", "envsync.local");
+    vpnNbSetupKey = await ask("Netbird setup key", "");
+  }
   const licenseKey = licenseServerUrl ? await ask("Enterprise license key", "") : "";
   const certificateBundleFile = licenseServerUrl ? "" : await ask("Enterprise certificate bundle file (optional)", "");
   const installFingerprint = deterministicInstallFingerprint(rootDomain, "envsync");
@@ -7664,6 +7789,11 @@ async function cmdSetup() {
     netutils: {
       enabled: netutilsEnabled,
       forwards: netutilsForwards
+    },
+    vpn: {
+      provider: vpnProvider,
+      internal_domain: vpnInternalDomain,
+      nb_setup_key: vpnNbSetupKey
     }
   };
   saveDesiredConfig(config);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@envsync-cloud/deploy-cli",
-  "version": "0.8.16",
+  "version": "0.9.0",
   "description": "CLI for self-hosted EnvSync deployment on Docker Swarm",
   "type": "module",
   "bin": {