@envsync-cloud/deploy 0.20.6 → 0.20.8

package/dist/cli.js

@@ -293,6 +293,7 @@ function domainMap(rootDomain) {
     api: `api.${rootDomain}`,
     auth: `auth.${rootDomain}`,
     obs: `obs.${rootDomain}`,
+    track: `t.${rootDomain}`,
     mail: `mail.${rootDomain}`,
     s3: `s3.${rootDomain}`,
     s3Console: `console.s3.${rootDomain}`
@@ -438,6 +439,9 @@ function buildRuntimeEnv2(config, generated, options) {
     OTEL_EXPORTER_OTLP_ENDPOINT: "http://otel-agent:4318",
     OTEL_SERVICE_NAME: "envsync-api",
     OTEL_SDK_DISABLED: "false",
+    POSTHOG_KEY: config.analytics?.posthog_key || process.env.POSTHOG_KEY || "",
+    POSTHOG_HOST: config.analytics?.posthog_host || process.env.POSTHOG_HOST || "https://eu.i.posthog.com",
+    ENVSYNC_POSTHOG_DISABLED: config.analytics?.disabled ? "true" : process.env.ENVSYNC_POSTHOG_DISABLED || "false",
     CLICKSTACK_URL: publicHttpsUrl(config, hosts.obs),
     KEYCLOAK_IMAGE_TAG: keycloakImageTag(config.images.keycloak),
     // Is this too hacky? We go Shawn way.
@@ -639,6 +643,12 @@ function renderTraefikDynamicConfig(config, generated) {
     `      service: ${apiServiceName}`,
     "      entryPoints: [websecure]",
     "      tls:",
+    "        certResolver: letsencrypt",
+    "    track-router:",
+    `      rule: Host(\`${hosts.track}\`)`,
+    `      service: ${apiServiceName}`,
+    "      entryPoints: [websecure]",
+    "      tls:",
     "        certResolver: letsencrypt"
   ].join("\n") + "\n";
 }
@@ -682,7 +692,8 @@ function renderApiMaintenanceConf() {
 }
 function renderFrontendRuntimeConfig(config, generated) {
   const hosts = domainMap(config.domain.root_domain);
-  const otelEndpoint = publicHttpsUrl(config, hosts.obs);
+  const otelEndpoint = publicHttpsUrl(config, hosts.track, "/obs");
+  const posthogProxy = publicHttpsUrl(config, hosts.track, "/ph");
   const managementApiEnabled = !isOssConfig(config);
   const activeReleaseVersion = generated.deployment.slots[generated.deployment.active_slot].release_version || config.release.version;
   const apiBaseUrl = publicHttpsUrl(config, hosts.api);
@@ -709,6 +720,9 @@ function renderFrontendRuntimeConfig(config, generated) {
     hyperdxUrl: otelEndpoint,
     hyperdxDisabled: generated.clickstack.browser_api_key.length === 0,
     hyperdxAdvancedNetworkCapture: false,
+    posthogKey: config.analytics?.posthog_key || process.env.POSTHOG_KEY || void 0,
+    posthogHost: config.analytics?.posthog_host || process.env.POSTHOG_HOST || posthogProxy,
+    posthogDisabled: Boolean(config.analytics?.disabled) || process.env.ENVSYNC_POSTHOG_DISABLED === "true",
     releaseVersion: activeReleaseVersion,
     activeApiSlot: generated.deployment.active_slot
   }, null, 2)};
@@ -1070,7 +1084,7 @@ ${renderEnvList({
     networks: [envsync]
 ${includeRuntimeInfra ? `
   minikms:
-    image: ghcr.io/envsync-cloud/minikms:sha-735dfe8
+    image: ghcr.io/envsync-cloud/minikms:sha-9ffbf53
     environment:
 ${renderEnvList({
     MINIKMS_ROOT_KEY: runtimeEnv.MINIKMS_ROOT_KEY,
@@ -2073,6 +2087,7 @@ function domainMap2(rootDomain) {
     api: `api.${rootDomain}`,
     auth: `auth.${rootDomain}`,
     obs: `obs.${rootDomain}`,
+    track: `t.${rootDomain}`,
     mail: `mail.${rootDomain}`,
     s3: `s3.${rootDomain}`,
     s3Console: `console.s3.${rootDomain}`
@@ -2428,7 +2443,12 @@ function normalizeConfig(raw) {
     } : raw.edition === "oss" ? void 0 : {
       install_fingerprint: deterministicInstallFingerprint(rootDomain, stackName),
       certificate_validity_days: 1095
-    }
+    },
+    analytics: raw.analytics ? {
+      posthog_key: raw.analytics.posthog_key,
+      posthog_host: raw.analytics.posthog_host,
+      disabled: raw.analytics.disabled
+    } : void 0
   };
 }
 function emptyGeneratedState() {
@@ -3051,6 +3071,11 @@ function runOpenFgaMigrate(config, runtimeEnv) {
   ]);
   logSuccess("OpenFGA datastore migrations completed");
 }
+var MINIKMS_MIGRATE_SQL = [
+  "psql -h minikms_db -U postgres -d minikms -f /migrations/001_initial_schema.sql",
+  "psql -h minikms_db -U postgres -d minikms -f /migrations/002_vault_storage.sql",
+  "psql -h minikms_db -U postgres -d minikms -f /migrations/003_escrow_recovery.sql"
+].join(" && ");
 function runMiniKmsMigrate(config, runtimeEnv) {
   logStep("Running miniKMS datastore migrations");
   if (currentOptions.dryRun) {
@@ -3067,7 +3092,7 @@ function runMiniKmsMigrate(config, runtimeEnv) {
       "postgres:17",
       "sh",
       "-lc",
-      "psql -h minikms_db -U postgres -d minikms -f /migrations/001_initial_schema.sql && psql -h minikms_db -U postgres -d minikms -f /migrations/002_vault_storage.sql"
+      MINIKMS_MIGRATE_SQL
     ]);
     return;
   }
@@ -3083,7 +3108,7 @@ function runMiniKmsMigrate(config, runtimeEnv) {
     "postgres:17",
     "sh",
     "-lc",
-    "psql -h minikms_db -U postgres -d minikms -f /migrations/001_initial_schema.sql && psql -h minikms_db -U postgres -d minikms -f /migrations/002_vault_storage.sql"
+    MINIKMS_MIGRATE_SQL
   ]);
   logSuccess("miniKMS datastore migrations completed");
 }
@@ -4566,7 +4591,8 @@ async function cmdHealth(asJson) {
       app: publicHttpsUrl2(config, hosts.app),
       api: publicHttpsUrl2(config, hosts.api, "/health"),
       auth: publicHttpsUrl2(config, hosts.auth, `/realms/${config.auth.keycloak_realm}/.well-known/openid-configuration`),
-      obs: publicHttpsUrl2(config, hosts.obs)
+      obs: publicHttpsUrl2(config, hosts.obs),
+      track: publicHttpsUrl2(config, hosts.track)
     },
     frontend_runtime: {
       web: {

package/dist/index.js

@@ -294,6 +294,7 @@ function domainMap(rootDomain) {
     api: `api.${rootDomain}`,
     auth: `auth.${rootDomain}`,
     obs: `obs.${rootDomain}`,
+    track: `t.${rootDomain}`,
     mail: `mail.${rootDomain}`,
     s3: `s3.${rootDomain}`,
     s3Console: `console.s3.${rootDomain}`
@@ -439,6 +440,9 @@ function buildRuntimeEnv2(config, generated, options) {
     OTEL_EXPORTER_OTLP_ENDPOINT: "http://otel-agent:4318",
     OTEL_SERVICE_NAME: "envsync-api",
     OTEL_SDK_DISABLED: "false",
+    POSTHOG_KEY: config.analytics?.posthog_key || process.env.POSTHOG_KEY || "",
+    POSTHOG_HOST: config.analytics?.posthog_host || process.env.POSTHOG_HOST || "https://eu.i.posthog.com",
+    ENVSYNC_POSTHOG_DISABLED: config.analytics?.disabled ? "true" : process.env.ENVSYNC_POSTHOG_DISABLED || "false",
     CLICKSTACK_URL: publicHttpsUrl(config, hosts.obs),
     KEYCLOAK_IMAGE_TAG: keycloakImageTag(config.images.keycloak),
     // Is this too hacky? We go Shawn way.
@@ -640,6 +644,12 @@ function renderTraefikDynamicConfig(config, generated) {
     `      service: ${apiServiceName}`,
     "      entryPoints: [websecure]",
     "      tls:",
+    "        certResolver: letsencrypt",
+    "    track-router:",
+    `      rule: Host(\`${hosts.track}\`)`,
+    `      service: ${apiServiceName}`,
+    "      entryPoints: [websecure]",
+    "      tls:",
     "        certResolver: letsencrypt"
   ].join("\n") + "\n";
 }
@@ -683,7 +693,8 @@ function renderApiMaintenanceConf() {
 }
 function renderFrontendRuntimeConfig(config, generated) {
   const hosts = domainMap(config.domain.root_domain);
-  const otelEndpoint = publicHttpsUrl(config, hosts.obs);
+  const otelEndpoint = publicHttpsUrl(config, hosts.track, "/obs");
+  const posthogProxy = publicHttpsUrl(config, hosts.track, "/ph");
   const managementApiEnabled = !isOssConfig(config);
   const activeReleaseVersion = generated.deployment.slots[generated.deployment.active_slot].release_version || config.release.version;
   const apiBaseUrl = publicHttpsUrl(config, hosts.api);
@@ -710,6 +721,9 @@ function renderFrontendRuntimeConfig(config, generated) {
     hyperdxUrl: otelEndpoint,
     hyperdxDisabled: generated.clickstack.browser_api_key.length === 0,
     hyperdxAdvancedNetworkCapture: false,
+    posthogKey: config.analytics?.posthog_key || process.env.POSTHOG_KEY || void 0,
+    posthogHost: config.analytics?.posthog_host || process.env.POSTHOG_HOST || posthogProxy,
+    posthogDisabled: Boolean(config.analytics?.disabled) || process.env.ENVSYNC_POSTHOG_DISABLED === "true",
     releaseVersion: activeReleaseVersion,
     activeApiSlot: generated.deployment.active_slot
   }, null, 2)};
@@ -1067,7 +1081,7 @@ ${renderEnvList({
     networks: [envsync]
 ${includeRuntimeInfra ? `
   minikms:
-    image: ghcr.io/envsync-cloud/minikms:sha-735dfe8
+    image: ghcr.io/envsync-cloud/minikms:sha-9ffbf53
     environment:
 ${renderEnvList({
     MINIKMS_ROOT_KEY: runtimeEnv.MINIKMS_ROOT_KEY,
@@ -1935,6 +1949,7 @@ function domainMap2(rootDomain) {
     api: `api.${rootDomain}`,
     auth: `auth.${rootDomain}`,
     obs: `obs.${rootDomain}`,
+    track: `t.${rootDomain}`,
     mail: `mail.${rootDomain}`,
     s3: `s3.${rootDomain}`,
     s3Console: `console.s3.${rootDomain}`
@@ -2290,7 +2305,12 @@ function normalizeConfig(raw) {
     } : raw.edition === "oss" ? void 0 : {
       install_fingerprint: deterministicInstallFingerprint(rootDomain, stackName),
       certificate_validity_days: 1095
-    }
+    },
+    analytics: raw.analytics ? {
+      posthog_key: raw.analytics.posthog_key,
+      posthog_host: raw.analytics.posthog_host,
+      disabled: raw.analytics.disabled
+    } : void 0
   };
 }
 function emptyGeneratedState() {
@@ -2929,7 +2949,7 @@ function runMiniKmsMigrate(config, runtimeEnv) {
       "postgres:17",
       "sh",
       "-lc",
-      "psql -h minikms_db -U postgres -d minikms -f /migrations/001_initial_schema.sql && psql -h minikms_db -U postgres -d minikms -f /migrations/002_vault_storage.sql"
+      MINIKMS_MIGRATE_SQL
     ]);
     return;
   }
@@ -2945,7 +2965,7 @@ function runMiniKmsMigrate(config, runtimeEnv) {
     "postgres:17",
     "sh",
     "-lc",
-    "psql -h minikms_db -U postgres -d minikms -f /migrations/001_initial_schema.sql && psql -h minikms_db -U postgres -d minikms -f /migrations/002_vault_storage.sql"
+    MINIKMS_MIGRATE_SQL
   ]);
   logSuccess("miniKMS datastore migrations completed");
 }
@@ -4428,7 +4448,8 @@ async function cmdHealth(asJson) {
       app: publicHttpsUrl2(config, hosts.app),
       api: publicHttpsUrl2(config, hosts.api, "/health"),
       auth: publicHttpsUrl2(config, hosts.auth, `/realms/${config.auth.keycloak_realm}/.well-known/openid-configuration`),
-      obs: publicHttpsUrl2(config, hosts.obs)
+      obs: publicHttpsUrl2(config, hosts.obs),
+      track: publicHttpsUrl2(config, hosts.track)
     },
     frontend_runtime: {
       web: {
@@ -5134,7 +5155,7 @@ async function main() {
       process.exit(1);
   }
 }
-var NETUTILS_EXPOSE_ALL_START_PORT, NETUTILS_EXPOSE_ALL_PORTS, HOST_ROOT, ETC_ROOT, TRAEFIK_STATE_ROOT, DEPLOY_ROOT, RELEASES_ROOT, BACKUPS_ROOT, REPO_ROOT, DEPLOY_ENV, DEPLOY_YAML, WIREGUARD_ROOT, LICENSE_ROOT, SETUP_TOKEN_FILE, LICENSE_BUNDLE_FILE, LICENSE_CERT_FILE, LICENSE_KEY_FILE, LICENSE_ROOT_CA_FILE, LICENSE_FILE_MODE, LICENSE_DIR_MODE, VERSIONS_LOCK, STACK_FILE, BOOTSTRAP_BASE_STACK_FILE, BOOTSTRAP_STACK_FILE, TRAEFIK_DYNAMIC_FILE, KEYCLOAK_REALM_FILE, NGINX_WEB_CONF, NGINX_LANDING_CONF, NGINX_API_MAINTENANCE_CONF, NGINX_VPN_CONF, OTEL_AGENT_CONF, CLICKSTACK_CLICKHOUSE_CONF, INTERNAL_CONFIG_JSON, UPGRADE_BACKUPS_ROOT, WIREGUARD_STATE_FILE, WIREGUARD_PRIVATE_KEY_FILE, WIREGUARD_PUBLIC_KEY_FILE, WIREGUARD_CONFIG_FILE, DEPLOY_RENDER_PATHS, REMOVE_TARGETS, REMOVE_CONFIRMATION_TOKEN, STACK_VOLUMES, REQUIRED_BOOTSTRAP_ENV_KEYS, REQUIRED_CLICKSTACK_SAVED_SEARCHES, REQUIRED_CLICKSTACK_TAGS, CLICKSTACK_SELFHOST_TEAM_NAME, SEMVER_VERSION_RE, currentOptions, DEFAULT_SOURCE_REPO_URL, DEFAULT_ENTERPRISE_LICENSE_SERVER_URL, MANAGED_VERSIONED_IMAGE_PREFIXES;
+var NETUTILS_EXPOSE_ALL_START_PORT, NETUTILS_EXPOSE_ALL_PORTS, HOST_ROOT, ETC_ROOT, TRAEFIK_STATE_ROOT, DEPLOY_ROOT, RELEASES_ROOT, BACKUPS_ROOT, REPO_ROOT, DEPLOY_ENV, DEPLOY_YAML, WIREGUARD_ROOT, LICENSE_ROOT, SETUP_TOKEN_FILE, LICENSE_BUNDLE_FILE, LICENSE_CERT_FILE, LICENSE_KEY_FILE, LICENSE_ROOT_CA_FILE, LICENSE_FILE_MODE, LICENSE_DIR_MODE, VERSIONS_LOCK, STACK_FILE, BOOTSTRAP_BASE_STACK_FILE, BOOTSTRAP_STACK_FILE, TRAEFIK_DYNAMIC_FILE, KEYCLOAK_REALM_FILE, NGINX_WEB_CONF, NGINX_LANDING_CONF, NGINX_API_MAINTENANCE_CONF, NGINX_VPN_CONF, OTEL_AGENT_CONF, CLICKSTACK_CLICKHOUSE_CONF, INTERNAL_CONFIG_JSON, UPGRADE_BACKUPS_ROOT, WIREGUARD_STATE_FILE, WIREGUARD_PRIVATE_KEY_FILE, WIREGUARD_PUBLIC_KEY_FILE, WIREGUARD_CONFIG_FILE, DEPLOY_RENDER_PATHS, REMOVE_TARGETS, REMOVE_CONFIRMATION_TOKEN, STACK_VOLUMES, REQUIRED_BOOTSTRAP_ENV_KEYS, REQUIRED_CLICKSTACK_SAVED_SEARCHES, REQUIRED_CLICKSTACK_TAGS, CLICKSTACK_SELFHOST_TEAM_NAME, SEMVER_VERSION_RE, currentOptions, DEFAULT_SOURCE_REPO_URL, DEFAULT_ENTERPRISE_LICENSE_SERVER_URL, MANAGED_VERSIONED_IMAGE_PREFIXES, MINIKMS_MIGRATE_SQL;
 var init_cli = __esm({
   "src/cli.ts"() {
     "use strict";
@@ -5306,6 +5327,11 @@ var init_cli = __esm({
       web_oss: "ghcr.io/envsync-cloud/envsync-web-oss-static:",
       landing: "ghcr.io/envsync-cloud/envsync-landing-static:"
     };
+    MINIKMS_MIGRATE_SQL = [
+      "psql -h minikms_db -U postgres -d minikms -f /migrations/001_initial_schema.sql",
+      "psql -h minikms_db -U postgres -d minikms -f /migrations/002_vault_storage.sql",
+      "psql -h minikms_db -U postgres -d minikms -f /migrations/003_escrow_recovery.sql"
+    ].join(" && ");
     main().catch((err) => {
       console.error(err instanceof Error ? err.message : err);
       process.exit(1);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@envsync-cloud/deploy",
-  "version": "0.20.6",
+  "version": "0.20.8",
   "description": "OSS CLI for self-hosted EnvSync deployment on Docker Swarm",
   "type": "module",
   "bin": {
@@ -46,7 +46,7 @@
     "zod": "^3.25.76"
   },
   "devDependencies": {
-    "@envsync-cloud/deploy-core": "0.20.6",
+    "@envsync-cloud/deploy-core": "0.20.8",
     "tsup": "^8.5.0",
     "typescript": "^5.9.2"
   },