@envsync-cloud/deploy-cli 0.8.8 → 0.8.10

package/dist/index.js

@@ -4334,6 +4334,7 @@ function domainMap(rootDomain) {
     landing: rootDomain,
     app: `app.${rootDomain}`,
     api: `api.${rootDomain}`,
+    manage_api: `manage-api.${rootDomain}`,
     auth: `auth.${rootDomain}`,
     obs: `obs.${rootDomain}`,
     mail: `mail.${rootDomain}`,
@@ -4397,6 +4398,8 @@ function buildRuntimeEnv2(config, generated) {
   const hosts = domainMap(config.domain.root_domain);
   const bucketName = "envsync-bucket";
   const oss = isOssConfig(config);
+  const enterprise = !oss;
+  const license = config.license ?? {};
   return {
     NODE_ENV: "production",
     ENVSYNC_EDITION: oss ? "oss" : "enterprise",
@@ -4409,8 +4412,14 @@ function buildRuntimeEnv2(config, generated) {
     ENVSYNC_LICENSE_CERT_PATH: oss ? "" : "/etc/envsync/license/enterprise-cert.pem",
     ENVSYNC_LICENSE_KEY_PATH: oss ? "" : "/etc/envsync/license/enterprise-key.pem",
     ENVSYNC_LICENSE_ROOT_CA_CERT_PATH: oss ? "" : "/etc/envsync/license/root-ca.pem",
+    ENVSYNC_LICENSE_SERVER_URL: enterprise ? license.server_url ?? "" : "",
+    ENVSYNC_LICENSE_KEY: enterprise ? license.key ?? "" : "",
+    ENVSYNC_INSTALL_FINGERPRINT: enterprise ? license.install_fingerprint ?? "" : "",
+    ENVSYNC_LICENSE_LEASE_TTL_SECONDS: String(license.lease_ttl_seconds ?? 300),
+    ENVSYNC_STACK_NAME: config.services.stack_name,
     DB_AUTO_MIGRATE: "false",
     PORT: `${config.services.api_port}`,
+    MANAGEMENT_API_PORT: `${config.services.management_api_port}`,
     DATABASE_HOST: "postgres",
     DATABASE_PORT: "5432",
     DATABASE_USER: "postgres",
@@ -4452,6 +4461,7 @@ function buildRuntimeEnv2(config, generated) {
     OPENFGA_STORE_ID: generated.openfga.store_id,
     OPENFGA_MODEL_ID: generated.openfga.model_id,
     OPENFGA_DB_PASSWORD: generated.secrets.openfga_db_password,
+    MANAGEMENT_API_URL: oss ? "" : publicHttpsUrl(config, hosts.manage_api),
     CLICKSTACK_OPERATOR_EMAIL: generated.clickstack.operator_email,
     CLICKSTACK_OPERATOR_PASSWORD: generated.clickstack.operator_password,
     CLICKSTACK_ACCESS_KEY: generated.clickstack.access_key,
@@ -4541,6 +4551,7 @@ function renderTraefikDynamicConfig(config, generated) {
   const activeSlot = generated.deployment.active_slot;
   const apiServiceName = generated.deployment.maintenance_mode ? "envsync-api-maintenance" : "envsync-api";
   const landingEnabled = !isOssConfig(config);
+  const managementEnabled = !isOssConfig(config);
   const otelAllowedOrigins = [
     ...landingEnabled ? publicHttpsOriginVariants(config, hosts.landing) : [],
     ...publicHttpsOriginVariants(config, hosts.app)
@@ -4602,6 +4613,16 @@ function renderTraefikDynamicConfig(config, generated) {
     "      loadBalancer:",
     "        servers:",
     "          - url: http://api_maintenance:8080",
+    ...managementEnabled ? [
+      "    envsync-management-api:",
+      "      loadBalancer:",
+      "        healthCheck:",
+      "          path: /health",
+      "          interval: 5s",
+      "          timeout: 3s",
+      "        servers:",
+      `          - url: http://envsync-management-api:${config.services.management_api_port}`
+    ] : [],
     ...landingEnabled ? [
       "    landing:",
       "      loadBalancer:",
@@ -4629,6 +4650,14 @@ function renderTraefikDynamicConfig(config, generated) {
       "      tls:",
       "        certResolver: letsencrypt"
     ] : [],
+    ...managementEnabled ? [
+      "    management-api-router:",
+      `      rule: Host(\`${hosts.manage_api}\`)`,
+      "      service: envsync-management-api",
+      "      entryPoints: [websecure]",
+      "      tls:",
+      "        certResolver: letsencrypt"
+    ] : [],
     "    web-router:",
     `      rule: Host(\`${hosts.app}\`)`,
     "      service: web",
@@ -4707,10 +4736,12 @@ function renderFrontendRuntimeConfig(config, generated) {
   const hosts = domainMap(config.domain.root_domain);
   const otelEndpoint = publicHttpsUrl(config, hosts.obs);
   const activeReleaseVersion = generated.deployment.slots[generated.deployment.active_slot].release_version || config.release.version;
+  const managementApiUrl = config.edition === "enterprise" ? publicHttpsUrl(config, hosts.manage_api) : "";
   return `window.__ENVSYNC_RUNTIME_CONFIG__ = ${JSON.stringify({
     apiBaseUrl: publicHttpsUrl(config, hosts.api),
     appBaseUrl: publicHttpsUrl(config, hosts.app),
     authBaseUrl: publicHttpsUrl(config, hosts.auth),
+    managementApiUrl,
     keycloakRealm: config.auth.keycloak_realm,
     webClientId: config.auth.web_client_id,
     apiDocsUrl: publicHttpsUrl(config, hosts.api, "/docs"),
@@ -4772,6 +4803,7 @@ function renderStack(config, runtimeEnv, generated, mode, paths) {
   const includeRuntimeInfra = mode !== "base";
   const includeAppServices = mode === "full";
   const landingEnabled = !isOssConfig(config);
+  const managementEnabled = !isOssConfig(config);
   const apiLicenseVolume = landingEnabled ? "\n    volumes:\n      - /etc/envsync/license:/etc/envsync/license:ro" : "";
   const deployment = createSteadyApiDeploymentState(config, generated);
   const stackName = config.services.stack_name;
@@ -4983,6 +5015,17 @@ ${renderEnvList({
       - source: otel_agent_conf
         target: /etc/otel-agent.yaml
     networks: [envsync]
+${includeRuntimeInfra && managementEnabled ? `
+
+  envsync-management-api:
+    image: ${config.images.management_api}
+    environment:
+${renderEnvList({
+    ...apiEnvironment,
+    PORT: `${config.services.management_api_port}`
+  })}
+${apiLicenseVolume}
+    networks: [envsync]` : ""}
 ${includeAppServices ? `
 
   api_maintenance:
@@ -5117,6 +5160,8 @@ var LICENSE_BUNDLE_FILE = path3.join(LICENSE_ROOT, "enterprise-license-bundle.js
 var LICENSE_CERT_FILE = path3.join(LICENSE_ROOT, "enterprise-cert.pem");
 var LICENSE_KEY_FILE = path3.join(LICENSE_ROOT, "enterprise-key.pem");
 var LICENSE_ROOT_CA_FILE = path3.join(LICENSE_ROOT, "root-ca.pem");
+var LICENSE_FILE_MODE = 420;
+var LICENSE_DIR_MODE = 493;
 var VERSIONS_LOCK = path3.join(DEPLOY_ROOT, "versions.lock.json");
 var STACK_FILE = path3.join(DEPLOY_ROOT, "docker-stack.yaml");
 var BOOTSTRAP_BASE_STACK_FILE = path3.join(DEPLOY_ROOT, "docker-stack.bootstrap.base.yaml");
@@ -5218,6 +5263,7 @@ var DEFAULT_SOURCE_REPO_URL = "https://github.com/EnvSync-Cloud/envsync.git";
 var DEFAULT_ENTERPRISE_LICENSE_SERVER_URL = "https://license.envsync.cloud";
 var MANAGED_VERSIONED_IMAGE_PREFIXES = {
   api: "ghcr.io/envsync-cloud/envsync-api:",
+  management_api: "ghcr.io/envsync-cloud/envsync-management-api:",
   keycloak: "envsync-keycloak:",
   web: "ghcr.io/envsync-cloud/envsync-web-static:",
   landing: "ghcr.io/envsync-cloud/envsync-landing-static:"
@@ -5333,6 +5379,27 @@ function writeFileMaybe(target, content, mode) {
   }
   writeFile(target, content, mode);
 }
+function ensureEnterpriseLicenseFilesReadable() {
+  if (exists2(LICENSE_ROOT)) {
+    try {
+      fs3.chmodSync(LICENSE_ROOT, LICENSE_DIR_MODE);
+    } catch {
+      throw new Error(
+        `Cannot update directory mode for ${LICENSE_ROOT}. Fix by running: chmod ${LICENSE_DIR_MODE.toString(8)} ${LICENSE_ROOT}`
+      );
+    }
+  }
+  for (const filePath of [LICENSE_BUNDLE_FILE, LICENSE_CERT_FILE, LICENSE_KEY_FILE, LICENSE_ROOT_CA_FILE]) {
+    if (!exists2(filePath)) continue;
+    try {
+      fs3.chmodSync(filePath, LICENSE_FILE_MODE);
+    } catch {
+      throw new Error(
+        `Cannot update file mode for ${filePath}. Fix by running: chmod ${LICENSE_FILE_MODE.toString(8)} ${filePath}`
+      );
+    }
+  }
+}
 function exists2(target) {
   return fs3.existsSync(target);
 }
@@ -5424,6 +5491,7 @@ function domainMap2(rootDomain) {
     landing: rootDomain,
     app: `app.${rootDomain}`,
     api: `api.${rootDomain}`,
+    manage_api: `manage-api.${rootDomain}`,
     auth: `auth.${rootDomain}`,
     obs: `obs.${rootDomain}`,
     mail: `mail.${rootDomain}`,
@@ -5599,6 +5667,7 @@ function versionedImages(version) {
   assertSemverVersion(version);
   return {
     api: `ghcr.io/envsync-cloud/envsync-api:${version}`,
+    management_api: `ghcr.io/envsync-cloud/envsync-management-api:${version}`,
     keycloak: `envsync-keycloak:${version}`,
     web: `ghcr.io/envsync-cloud/envsync-web-static:${version}`,
     landing: `ghcr.io/envsync-cloud/envsync-landing-static:${version}`
@@ -5664,6 +5733,7 @@ function normalizeConfig(raw) {
     },
     images: {
       api: !raw.images?.api || isManagedVersionedImage(raw.images.api, "api") ? derivedImages.api : raw.images.api,
+      management_api: !raw.images?.management_api || isManagedVersionedImage(raw.images.management_api, "management_api") ? derivedImages.management_api : raw.images.management_api,
       keycloak: !raw.images?.keycloak || isManagedVersionedImage(raw.images.keycloak, "keycloak") ? derivedImages.keycloak : raw.images.keycloak,
       web: !raw.images?.web || isManagedVersionedImage(raw.images.web, "web") ? derivedImages.web : raw.images.web,
       landing: !raw.images?.landing || isManagedVersionedImage(raw.images.landing, "landing") ? derivedImages.landing : raw.images.landing,
@@ -5674,6 +5744,7 @@ function normalizeConfig(raw) {
     services: {
       stack_name: stackName,
       api_port: requireDefined(raw.services?.api_port, "services.api_port"),
+      management_api_port: raw.services?.management_api_port ?? 4001,
       public_http_port: raw.services?.public_http_port ?? 80,
       public_https_port: raw.services?.public_https_port ?? 443,
       clickstack_ui_port: requireDefined(raw.services?.clickstack_ui_port, "services.clickstack_ui_port"),
@@ -5726,6 +5797,7 @@ function normalizeConfig(raw) {
       key: raw.license.key,
       install_fingerprint: raw.license.install_fingerprint ?? deterministicInstallFingerprint(rootDomain, stackName),
       certificate_bundle_file: raw.license.certificate_bundle_file,
+      lease_ttl_seconds: raw.license.lease_ttl_seconds,
       certificate_validity_days: raw.license.certificate_validity_days
     } : raw.edition === "oss" ? void 0 : {
       install_fingerprint: deterministicInstallFingerprint(rootDomain, stackName),
@@ -7148,6 +7220,7 @@ async function cmdSetup() {
     domain: { root_domain: rootDomain, acme_email: acmeEmail },
     images: {
       api: releaseImages.api,
+      management_api: releaseImages.management_api,
       keycloak: releaseImages.keycloak,
       web: releaseImages.web,
       landing: releaseImages.landing,
@@ -7158,6 +7231,7 @@ async function cmdSetup() {
     services: {
       stack_name: "envsync",
       api_port: 4e3,
+      management_api_port: 4001,
       public_http_port: 80,
       public_https_port: 443,
       clickstack_ui_port: 8080,
@@ -7308,6 +7382,9 @@ async function cmdDeploy() {
   logSection("Deploy");
   const { config, generated } = loadState();
   logReleaseContext(config);
+  if (!isOssConfig2(config)) {
+    ensureEnterpriseLicenseFilesReadable();
+  }
   assertSwarmManager();
   assertBootstrapState(generated);
   if (!currentOptions.dryRun) {
@@ -7658,6 +7735,9 @@ async function cmdUpgrade(targetVersion) {
     ref: `v${desiredVersion}`
   };
   logReleaseContext(config);
+  if (!isOssConfig2(config) && !currentOptions.dryRun) {
+    ensureEnterpriseLicenseFilesReadable();
+  }
   config.images = {
     ...config.images,
     ...versionedImages(desiredVersion)
@@ -7749,16 +7829,25 @@ async function requestEnterpriseLicenseCertificate(config, route) {
   return parseEnterpriseLicenseBundle(body.bundle);
 }
 function writeEnterpriseLicenseBundle(bundle) {
-  writeFileMaybe(LICENSE_BUNDLE_FILE, JSON.stringify(bundle, null, 2) + "\n", 384);
-  writeFileMaybe(LICENSE_CERT_FILE, bundle.certificate_pem.endsWith("\n") ? bundle.certificate_pem : `${bundle.certificate_pem}
-`, 384);
-  writeFileMaybe(LICENSE_KEY_FILE, bundle.private_key_pem.endsWith("\n") ? bundle.private_key_pem : `${bundle.private_key_pem}
-`, 384);
+  writeFileMaybe(LICENSE_BUNDLE_FILE, JSON.stringify(bundle, null, 2) + "\n", LICENSE_FILE_MODE);
+  writeFileMaybe(
+    LICENSE_CERT_FILE,
+    bundle.certificate_pem.endsWith("\n") ? bundle.certificate_pem : `${bundle.certificate_pem}
+`,
+    LICENSE_FILE_MODE
+  );
+  writeFileMaybe(
+    LICENSE_KEY_FILE,
+    bundle.private_key_pem.endsWith("\n") ? bundle.private_key_pem : `${bundle.private_key_pem}
+`,
+    LICENSE_FILE_MODE
+  );
   writeFileMaybe(LICENSE_ROOT_CA_FILE, bundle.root_ca_pem.endsWith("\n") ? bundle.root_ca_pem : `${bundle.root_ca_pem}
-`, 420);
+`, LICENSE_FILE_MODE);
 }
 async function ensureEnterpriseCertificateBundle(config) {
   if (isOssConfig2(config)) return;
+  ensureEnterpriseLicenseFilesReadable();
   if (exists2(LICENSE_BUNDLE_FILE) && exists2(LICENSE_CERT_FILE) && exists2(LICENSE_KEY_FILE) && exists2(LICENSE_ROOT_CA_FILE)) {
     validateEnterpriseLicenseBundleFiles(config, false);
     return;
@@ -7817,6 +7906,7 @@ async function cmdLicense(action = "validate-cert") {
     logInfo("OSS deployments do not require license verification.");
     return;
   }
+  ensureEnterpriseLicenseFilesReadable();
   if (action === "issue-cert" || action === "renew-cert") {
     const route = action === "renew-cert" ? "renew" : "issue";
     if (currentOptions.dryRun) {
@@ -8058,6 +8148,7 @@ async function cmdRestore(archivePath, autoDeploy = false) {
   if (exists2(restoredLicenseRoot)) {
     fs3.rmSync(LICENSE_ROOT, { recursive: true, force: true });
     fs3.cpSync(restoredLicenseRoot, LICENSE_ROOT, { recursive: true });
+    ensureEnterpriseLicenseFilesReadable();
   }
   const config = loadConfig();
   for (const volume of STACK_VOLUMES) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@envsync-cloud/deploy-cli",
-  "version": "0.8.8",
+  "version": "0.8.10",
   "description": "CLI for self-hosted EnvSync deployment on Docker Swarm",
   "type": "module",
   "bin": {