@envsync-cloud/deploy 0.20.5 → 0.20.7

package/dist/cli.js

@@ -1070,7 +1070,7 @@ ${renderEnvList({
     networks: [envsync]
 ${includeRuntimeInfra ? `
   minikms:
-    image: ghcr.io/envsync-cloud/minikms:sha-735dfe8
+    image: ghcr.io/envsync-cloud/minikms:sha-9ffbf53
     environment:
 ${renderEnvList({
     MINIKMS_ROOT_KEY: runtimeEnv.MINIKMS_ROOT_KEY,
@@ -1146,11 +1146,7 @@ ${renderEnvList({
 ${apiLicenseVolume}
     networks: [envsync]
     healthcheck:
-      test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:4000/health"]
-      interval: 10s
-      timeout: 5s
-      retries: 8
-      start_period: 60s
+      disable: true
     deploy:
       replicas: ${slotHasApiDeployment(deployment.slots.blue) ? 1 : 0}
 
@@ -1165,11 +1161,7 @@ ${renderEnvList({
 ${apiLicenseVolume}
     networks: [envsync]
     healthcheck:
-      test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:4000/health"]
-      interval: 10s
-      timeout: 5s
-      retries: 8
-      start_period: 60s
+      disable: true
     deploy:
       replicas: ${slotHasApiDeployment(deployment.slots.green) ? 1 : 0}` : ""}${netutilsService}${vpnResult?.serviceBlock ?? ""}
 
@@ -3059,6 +3051,11 @@ function runOpenFgaMigrate(config, runtimeEnv) {
   ]);
   logSuccess("OpenFGA datastore migrations completed");
 }
+var MINIKMS_MIGRATE_SQL = [
+  "psql -h minikms_db -U postgres -d minikms -f /migrations/001_initial_schema.sql",
+  "psql -h minikms_db -U postgres -d minikms -f /migrations/002_vault_storage.sql",
+  "psql -h minikms_db -U postgres -d minikms -f /migrations/003_escrow_recovery.sql"
+].join(" && ");
 function runMiniKmsMigrate(config, runtimeEnv) {
   logStep("Running miniKMS datastore migrations");
   if (currentOptions.dryRun) {
@@ -3075,7 +3072,7 @@ function runMiniKmsMigrate(config, runtimeEnv) {
       "postgres:17",
       "sh",
       "-lc",
-      "psql -h minikms_db -U postgres -d minikms -f /migrations/001_initial_schema.sql && psql -h minikms_db -U postgres -d minikms -f /migrations/002_vault_storage.sql"
+      MINIKMS_MIGRATE_SQL
     ]);
     return;
   }
@@ -3091,7 +3088,7 @@ function runMiniKmsMigrate(config, runtimeEnv) {
     "postgres:17",
     "sh",
     "-lc",
-    "psql -h minikms_db -U postgres -d minikms -f /migrations/001_initial_schema.sql && psql -h minikms_db -U postgres -d minikms -f /migrations/002_vault_storage.sql"
+    MINIKMS_MIGRATE_SQL
   ]);
   logSuccess("miniKMS datastore migrations completed");
 }
@@ -3631,6 +3628,25 @@ function apiHealth(services, stackName) {
   if (blue === "healthy" || green === "healthy") return "healthy";
   return "degraded";
 }
+function probeApiSlotHttp(config, slot) {
+  const host = `envsync_api_${slot}`;
+  const output = tryRun(
+    "docker",
+    [
+      "run",
+      "--rm",
+      "--network",
+      stackNetworkName(config),
+      "--entrypoint",
+      "bun",
+      config.images.api,
+      "-e",
+      `const r=await fetch("http://${host}:4000/health"); if(!r.ok) process.exit(1); console.log(await r.text());`
+    ],
+    { quiet: true }
+  );
+  return output.includes("ok");
+}
 function waitForApiSlotHealthy(config, slot, timeoutSeconds = 300) {
   if (currentOptions.dryRun) {
     logDryRun(`Would wait for API ${slot} slot readiness`);
@@ -3640,7 +3656,7 @@ function waitForApiSlotHealthy(config, slot, timeoutSeconds = 300) {
   const serviceName = slotStackServiceName(config, slot);
   while (Date.now() < deadline) {
     const services2 = listStackServices(config);
-    if (serviceHealth(services2, serviceName) === "healthy") {
+    if (serviceHealth(services2, serviceName) === "healthy" && probeApiSlotHttp(config, slot)) {
       logSuccess(`API ${slot} slot is healthy`);
       return;
     }

package/dist/index.js

@@ -1067,7 +1067,7 @@ ${renderEnvList({
     networks: [envsync]
 ${includeRuntimeInfra ? `
   minikms:
-    image: ghcr.io/envsync-cloud/minikms:sha-735dfe8
+    image: ghcr.io/envsync-cloud/minikms:sha-9ffbf53
     environment:
 ${renderEnvList({
     MINIKMS_ROOT_KEY: runtimeEnv.MINIKMS_ROOT_KEY,
@@ -1143,11 +1143,7 @@ ${renderEnvList({
 ${apiLicenseVolume}
     networks: [envsync]
     healthcheck:
-      test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:4000/health"]
-      interval: 10s
-      timeout: 5s
-      retries: 8
-      start_period: 60s
+      disable: true
     deploy:
       replicas: ${slotHasApiDeployment(deployment.slots.blue) ? 1 : 0}
 
@@ -1162,11 +1158,7 @@ ${renderEnvList({
 ${apiLicenseVolume}
     networks: [envsync]
     healthcheck:
-      test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:4000/health"]
-      interval: 10s
-      timeout: 5s
-      retries: 8
-      start_period: 60s
+      disable: true
     deploy:
       replicas: ${slotHasApiDeployment(deployment.slots.green) ? 1 : 0}` : ""}${netutilsService}${vpnResult?.serviceBlock ?? ""}
 
@@ -2937,7 +2929,7 @@ function runMiniKmsMigrate(config, runtimeEnv) {
       "postgres:17",
       "sh",
       "-lc",
-      "psql -h minikms_db -U postgres -d minikms -f /migrations/001_initial_schema.sql && psql -h minikms_db -U postgres -d minikms -f /migrations/002_vault_storage.sql"
+      MINIKMS_MIGRATE_SQL
     ]);
     return;
   }
@@ -2953,7 +2945,7 @@ function runMiniKmsMigrate(config, runtimeEnv) {
     "postgres:17",
     "sh",
     "-lc",
-    "psql -h minikms_db -U postgres -d minikms -f /migrations/001_initial_schema.sql && psql -h minikms_db -U postgres -d minikms -f /migrations/002_vault_storage.sql"
+    MINIKMS_MIGRATE_SQL
   ]);
   logSuccess("miniKMS datastore migrations completed");
 }
@@ -3493,6 +3485,25 @@ function apiHealth(services, stackName) {
   if (blue === "healthy" || green === "healthy") return "healthy";
   return "degraded";
 }
+function probeApiSlotHttp(config, slot) {
+  const host = `envsync_api_${slot}`;
+  const output = tryRun(
+    "docker",
+    [
+      "run",
+      "--rm",
+      "--network",
+      stackNetworkName(config),
+      "--entrypoint",
+      "bun",
+      config.images.api,
+      "-e",
+      `const r=await fetch("http://${host}:4000/health"); if(!r.ok) process.exit(1); console.log(await r.text());`
+    ],
+    { quiet: true }
+  );
+  return output.includes("ok");
+}
 function waitForApiSlotHealthy(config, slot, timeoutSeconds = 300) {
   if (currentOptions.dryRun) {
     logDryRun(`Would wait for API ${slot} slot readiness`);
@@ -3502,7 +3513,7 @@ function waitForApiSlotHealthy(config, slot, timeoutSeconds = 300) {
   const serviceName = slotStackServiceName(config, slot);
   while (Date.now() < deadline) {
     const services2 = listStackServices(config);
-    if (serviceHealth(services2, serviceName) === "healthy") {
+    if (serviceHealth(services2, serviceName) === "healthy" && probeApiSlotHttp(config, slot)) {
       logSuccess(`API ${slot} slot is healthy`);
       return;
     }
@@ -5123,7 +5134,7 @@ async function main() {
       process.exit(1);
   }
 }
-var NETUTILS_EXPOSE_ALL_START_PORT, NETUTILS_EXPOSE_ALL_PORTS, HOST_ROOT, ETC_ROOT, TRAEFIK_STATE_ROOT, DEPLOY_ROOT, RELEASES_ROOT, BACKUPS_ROOT, REPO_ROOT, DEPLOY_ENV, DEPLOY_YAML, WIREGUARD_ROOT, LICENSE_ROOT, SETUP_TOKEN_FILE, LICENSE_BUNDLE_FILE, LICENSE_CERT_FILE, LICENSE_KEY_FILE, LICENSE_ROOT_CA_FILE, LICENSE_FILE_MODE, LICENSE_DIR_MODE, VERSIONS_LOCK, STACK_FILE, BOOTSTRAP_BASE_STACK_FILE, BOOTSTRAP_STACK_FILE, TRAEFIK_DYNAMIC_FILE, KEYCLOAK_REALM_FILE, NGINX_WEB_CONF, NGINX_LANDING_CONF, NGINX_API_MAINTENANCE_CONF, NGINX_VPN_CONF, OTEL_AGENT_CONF, CLICKSTACK_CLICKHOUSE_CONF, INTERNAL_CONFIG_JSON, UPGRADE_BACKUPS_ROOT, WIREGUARD_STATE_FILE, WIREGUARD_PRIVATE_KEY_FILE, WIREGUARD_PUBLIC_KEY_FILE, WIREGUARD_CONFIG_FILE, DEPLOY_RENDER_PATHS, REMOVE_TARGETS, REMOVE_CONFIRMATION_TOKEN, STACK_VOLUMES, REQUIRED_BOOTSTRAP_ENV_KEYS, REQUIRED_CLICKSTACK_SAVED_SEARCHES, REQUIRED_CLICKSTACK_TAGS, CLICKSTACK_SELFHOST_TEAM_NAME, SEMVER_VERSION_RE, currentOptions, DEFAULT_SOURCE_REPO_URL, DEFAULT_ENTERPRISE_LICENSE_SERVER_URL, MANAGED_VERSIONED_IMAGE_PREFIXES;
+var NETUTILS_EXPOSE_ALL_START_PORT, NETUTILS_EXPOSE_ALL_PORTS, HOST_ROOT, ETC_ROOT, TRAEFIK_STATE_ROOT, DEPLOY_ROOT, RELEASES_ROOT, BACKUPS_ROOT, REPO_ROOT, DEPLOY_ENV, DEPLOY_YAML, WIREGUARD_ROOT, LICENSE_ROOT, SETUP_TOKEN_FILE, LICENSE_BUNDLE_FILE, LICENSE_CERT_FILE, LICENSE_KEY_FILE, LICENSE_ROOT_CA_FILE, LICENSE_FILE_MODE, LICENSE_DIR_MODE, VERSIONS_LOCK, STACK_FILE, BOOTSTRAP_BASE_STACK_FILE, BOOTSTRAP_STACK_FILE, TRAEFIK_DYNAMIC_FILE, KEYCLOAK_REALM_FILE, NGINX_WEB_CONF, NGINX_LANDING_CONF, NGINX_API_MAINTENANCE_CONF, NGINX_VPN_CONF, OTEL_AGENT_CONF, CLICKSTACK_CLICKHOUSE_CONF, INTERNAL_CONFIG_JSON, UPGRADE_BACKUPS_ROOT, WIREGUARD_STATE_FILE, WIREGUARD_PRIVATE_KEY_FILE, WIREGUARD_PUBLIC_KEY_FILE, WIREGUARD_CONFIG_FILE, DEPLOY_RENDER_PATHS, REMOVE_TARGETS, REMOVE_CONFIRMATION_TOKEN, STACK_VOLUMES, REQUIRED_BOOTSTRAP_ENV_KEYS, REQUIRED_CLICKSTACK_SAVED_SEARCHES, REQUIRED_CLICKSTACK_TAGS, CLICKSTACK_SELFHOST_TEAM_NAME, SEMVER_VERSION_RE, currentOptions, DEFAULT_SOURCE_REPO_URL, DEFAULT_ENTERPRISE_LICENSE_SERVER_URL, MANAGED_VERSIONED_IMAGE_PREFIXES, MINIKMS_MIGRATE_SQL;
 var init_cli = __esm({
   "src/cli.ts"() {
     "use strict";
@@ -5295,6 +5306,11 @@ var init_cli = __esm({
       web_oss: "ghcr.io/envsync-cloud/envsync-web-oss-static:",
       landing: "ghcr.io/envsync-cloud/envsync-landing-static:"
     };
+    MINIKMS_MIGRATE_SQL = [
+      "psql -h minikms_db -U postgres -d minikms -f /migrations/001_initial_schema.sql",
+      "psql -h minikms_db -U postgres -d minikms -f /migrations/002_vault_storage.sql",
+      "psql -h minikms_db -U postgres -d minikms -f /migrations/003_escrow_recovery.sql"
+    ].join(" && ");
     main().catch((err) => {
       console.error(err instanceof Error ? err.message : err);
       process.exit(1);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@envsync-cloud/deploy",
-  "version": "0.20.5",
+  "version": "0.20.7",
   "description": "OSS CLI for self-hosted EnvSync deployment on Docker Swarm",
   "type": "module",
   "bin": {
@@ -46,7 +46,7 @@
     "zod": "^3.25.76"
   },
   "devDependencies": {
-    "@envsync-cloud/deploy-core": "0.20.5",
+    "@envsync-cloud/deploy-core": "0.20.7",
     "tsup": "^8.5.0",
     "typescript": "^5.9.2"
   },