@envsync-cloud/deploy 0.20.7 → 0.20.9

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (3) hide show
  1. package/dist/cli.js +40 -4
  2. package/dist/index.js +41 -5
  3. package/package.json +2 -2
package/dist/cli.js CHANGED
@@ -1,7 +1,7 @@
1
1
  #!/usr/bin/env node
2
2
 
3
3
  // src/cli.ts
4
- import { createHash as createHash2, randomBytes as randomBytes2, randomInt } from "crypto";
4
+ import { createHash as createHash2, generateKeyPairSync, randomBytes as randomBytes2, randomInt } from "crypto";
5
5
  import { spawnSync } from "child_process";
6
6
  import fs4 from "fs";
7
7
  import path4 from "path";
@@ -293,6 +293,7 @@ function domainMap(rootDomain) {
293
293
  api: `api.${rootDomain}`,
294
294
  auth: `auth.${rootDomain}`,
295
295
  obs: `obs.${rootDomain}`,
296
+ track: `t.${rootDomain}`,
296
297
  mail: `mail.${rootDomain}`,
297
298
  s3: `s3.${rootDomain}`,
298
299
  s3Console: `console.s3.${rootDomain}`
@@ -438,6 +439,9 @@ function buildRuntimeEnv2(config, generated, options) {
438
439
  OTEL_EXPORTER_OTLP_ENDPOINT: "http://otel-agent:4318",
439
440
  OTEL_SERVICE_NAME: "envsync-api",
440
441
  OTEL_SDK_DISABLED: "false",
442
+ POSTHOG_KEY: config.analytics?.posthog_key || process.env.POSTHOG_KEY || "",
443
+ POSTHOG_HOST: config.analytics?.posthog_host || process.env.POSTHOG_HOST || "https://eu.i.posthog.com",
444
+ ENVSYNC_POSTHOG_DISABLED: config.analytics?.disabled ? "true" : process.env.ENVSYNC_POSTHOG_DISABLED || "false",
441
445
  CLICKSTACK_URL: publicHttpsUrl(config, hosts.obs),
442
446
  KEYCLOAK_IMAGE_TAG: keycloakImageTag(config.images.keycloak),
443
447
  // Is this too hacky? We go Shawn way.
@@ -639,6 +643,12 @@ function renderTraefikDynamicConfig(config, generated) {
639
643
  ` service: ${apiServiceName}`,
640
644
  " entryPoints: [websecure]",
641
645
  " tls:",
646
+ " certResolver: letsencrypt",
647
+ " track-router:",
648
+ ` rule: Host(\`${hosts.track}\`)`,
649
+ ` service: ${apiServiceName}`,
650
+ " entryPoints: [websecure]",
651
+ " tls:",
642
652
  " certResolver: letsencrypt"
643
653
  ].join("\n") + "\n";
644
654
  }
@@ -682,7 +692,8 @@ function renderApiMaintenanceConf() {
682
692
  }
683
693
  function renderFrontendRuntimeConfig(config, generated) {
684
694
  const hosts = domainMap(config.domain.root_domain);
685
- const otelEndpoint = publicHttpsUrl(config, hosts.obs);
695
+ const otelEndpoint = publicHttpsUrl(config, hosts.track, "/obs");
696
+ const posthogProxy = publicHttpsUrl(config, hosts.track, "/ph");
686
697
  const managementApiEnabled = !isOssConfig(config);
687
698
  const activeReleaseVersion = generated.deployment.slots[generated.deployment.active_slot].release_version || config.release.version;
688
699
  const apiBaseUrl = publicHttpsUrl(config, hosts.api);
@@ -709,6 +720,9 @@ function renderFrontendRuntimeConfig(config, generated) {
709
720
  hyperdxUrl: otelEndpoint,
710
721
  hyperdxDisabled: generated.clickstack.browser_api_key.length === 0,
711
722
  hyperdxAdvancedNetworkCapture: false,
723
+ posthogKey: config.analytics?.posthog_key || process.env.POSTHOG_KEY || void 0,
724
+ posthogHost: config.analytics?.posthog_host || process.env.POSTHOG_HOST || posthogProxy,
725
+ posthogDisabled: Boolean(config.analytics?.disabled) || process.env.ENVSYNC_POSTHOG_DISABLED === "true",
712
726
  releaseVersion: activeReleaseVersion,
713
727
  activeApiSlot: generated.deployment.active_slot
714
728
  }, null, 2)};
@@ -1074,11 +1088,14 @@ ${includeRuntimeInfra ? `
1074
1088
  environment:
1075
1089
  ${renderEnvList({
1076
1090
  MINIKMS_ROOT_KEY: runtimeEnv.MINIKMS_ROOT_KEY,
1091
+ MINIKMS_SESSION_SIGNING_KEY_FILE: "/run/secrets/minikms-session-signing-key",
1077
1092
  MINIKMS_DB_URL: `postgres://postgres:${runtimeEnv.MINIKMS_DB_PASSWORD}@minikms_db:5432/minikms?sslmode=disable`,
1078
1093
  MINIKMS_REDIS_URL: "redis://redis:6379",
1079
1094
  MINIKMS_GRPC_ADDR: "0.0.0.0:50051",
1080
1095
  MINIKMS_TLS_ENABLED: "false"
1081
1096
  })}
1097
+ volumes:
1098
+ - ${paths.deployRoot}/minikms-session-signing-key.pem:/run/secrets/minikms-session-signing-key:ro
1082
1099
  networks: [envsync]` : ""}
1083
1100
 
1084
1101
  clickstack:
@@ -1462,6 +1479,7 @@ var NGINX_VPN_CONF = path4.join(DEPLOY_ROOT, "nginx-vpn.conf");
1462
1479
  var OTEL_AGENT_CONF = path4.join(DEPLOY_ROOT, "otel-agent.yaml");
1463
1480
  var CLICKSTACK_CLICKHOUSE_CONF = path4.join(DEPLOY_ROOT, "clickhouse-listen.xml");
1464
1481
  var INTERNAL_CONFIG_JSON = path4.join(DEPLOY_ROOT, "config.json");
1482
+ var MINIKMS_SESSION_SIGNING_KEY_FILE = path4.join(DEPLOY_ROOT, "minikms-session-signing-key.pem");
1465
1483
  var UPGRADE_BACKUPS_ROOT = path4.join(BACKUPS_ROOT, "upgrade");
1466
1484
  var WIREGUARD_STATE_FILE = path4.join(WIREGUARD_ROOT, "state.json");
1467
1485
  var WIREGUARD_PRIVATE_KEY_FILE = path4.join(WIREGUARD_ROOT, "server-private.key");
@@ -1799,6 +1817,10 @@ function exists2(target) {
1799
1817
  function randomSecret(bytes = 24) {
1800
1818
  return randomBytes2(bytes).toString("hex");
1801
1819
  }
1820
+ function generateMinikmsSessionSigningKey() {
1821
+ const { privateKey } = generateKeyPairSync("ec", { namedCurve: "P-256" });
1822
+ return privateKey.export({ type: "pkcs8", format: "pem" }).toString();
1823
+ }
1802
1824
  function deterministicInstallFingerprint(rootDomain, stackName) {
1803
1825
  return `envsync-${createHash2("sha256").update(`${rootDomain}:${stackName}`).digest("hex").slice(0, 32)}`;
1804
1826
  }
@@ -2073,6 +2095,7 @@ function domainMap2(rootDomain) {
2073
2095
  api: `api.${rootDomain}`,
2074
2096
  auth: `auth.${rootDomain}`,
2075
2097
  obs: `obs.${rootDomain}`,
2098
+ track: `t.${rootDomain}`,
2076
2099
  mail: `mail.${rootDomain}`,
2077
2100
  s3: `s3.${rootDomain}`,
2078
2101
  s3Console: `console.s3.${rootDomain}`
@@ -2428,7 +2451,12 @@ function normalizeConfig(raw) {
2428
2451
  } : raw.edition === "oss" ? void 0 : {
2429
2452
  install_fingerprint: deterministicInstallFingerprint(rootDomain, stackName),
2430
2453
  certificate_validity_days: 1095
2431
- }
2454
+ },
2455
+ analytics: raw.analytics ? {
2456
+ posthog_key: raw.analytics.posthog_key,
2457
+ posthog_host: raw.analytics.posthog_host,
2458
+ disabled: raw.analytics.disabled
2459
+ } : void 0
2432
2460
  };
2433
2461
  }
2434
2462
  function emptyGeneratedState() {
@@ -2459,6 +2487,7 @@ function emptyGeneratedState() {
2459
2487
  keycloak_api_client_secret: "",
2460
2488
  openfga_db_password: "",
2461
2489
  minikms_root_key: "",
2490
+ minikms_session_signing_key: "",
2462
2491
  minikms_db_password: ""
2463
2492
  },
2464
2493
  bootstrap: {
@@ -2495,6 +2524,7 @@ function normalizeGeneratedState(raw) {
2495
2524
  keycloak_api_client_secret: raw?.secrets?.keycloak_api_client_secret ?? defaults.secrets.keycloak_api_client_secret,
2496
2525
  openfga_db_password: raw?.secrets?.openfga_db_password ?? defaults.secrets.openfga_db_password,
2497
2526
  minikms_root_key: raw?.secrets?.minikms_root_key ?? defaults.secrets.minikms_root_key,
2527
+ minikms_session_signing_key: raw?.secrets?.minikms_session_signing_key ?? defaults.secrets.minikms_session_signing_key,
2498
2528
  minikms_db_password: raw?.secrets?.minikms_db_password ?? defaults.secrets.minikms_db_password
2499
2529
  },
2500
2530
  bootstrap: {
@@ -2545,6 +2575,7 @@ function mergeGeneratedState(env, generated) {
2545
2575
  keycloak_api_client_secret: env.KEYCLOAK_API_CLIENT_SECRET ?? normalized.secrets.keycloak_api_client_secret,
2546
2576
  openfga_db_password: env.OPENFGA_DB_PASSWORD ?? normalized.secrets.openfga_db_password,
2547
2577
  minikms_root_key: env.MINIKMS_ROOT_KEY ?? normalized.secrets.minikms_root_key,
2578
+ minikms_session_signing_key: env.MINIKMS_SESSION_SIGNING_KEY ?? normalized.secrets.minikms_session_signing_key,
2548
2579
  minikms_db_password: env.MINIKMS_DB_PASSWORD ?? normalized.secrets.minikms_db_password
2549
2580
  },
2550
2581
  bootstrap: normalized.bootstrap
@@ -2573,6 +2604,7 @@ function ensureGeneratedRuntimeState(config, generated) {
2573
2604
  keycloak_api_client_secret: generated.secrets.keycloak_api_client_secret || randomSecret(),
2574
2605
  openfga_db_password: generated.secrets.openfga_db_password || randomSecret(),
2575
2606
  minikms_root_key: generated.secrets.minikms_root_key || randomBytes2(32).toString("hex"),
2607
+ minikms_session_signing_key: generated.secrets.minikms_session_signing_key || generateMinikmsSessionSigningKey(),
2576
2608
  minikms_db_password: generated.secrets.minikms_db_password || randomSecret()
2577
2609
  },
2578
2610
  bootstrap: generated.bootstrap
@@ -2738,6 +2770,9 @@ function writeDeployArtifacts(config, generated) {
2738
2770
  ensureSetupTokenFile(SETUP_TOKEN_FILE, setupToken);
2739
2771
  logInfo(`Setup token fingerprint: ${setupTokenFingerprint(setupToken)} (${SETUP_TOKEN_FILE})`);
2740
2772
  }
2773
+ if (generated.secrets.minikms_session_signing_key) {
2774
+ writeFileMaybe(MINIKMS_SESSION_SIGNING_KEY_FILE, generated.secrets.minikms_session_signing_key, 384);
2775
+ }
2741
2776
  writeFileMaybe(DEPLOY_ENV, renderEnvFile(runtimeEnv), 384);
2742
2777
  writeFileMaybe(
2743
2778
  INTERNAL_CONFIG_JSON,
@@ -4571,7 +4606,8 @@ async function cmdHealth(asJson) {
4571
4606
  app: publicHttpsUrl2(config, hosts.app),
4572
4607
  api: publicHttpsUrl2(config, hosts.api, "/health"),
4573
4608
  auth: publicHttpsUrl2(config, hosts.auth, `/realms/${config.auth.keycloak_realm}/.well-known/openid-configuration`),
4574
- obs: publicHttpsUrl2(config, hosts.obs)
4609
+ obs: publicHttpsUrl2(config, hosts.obs),
4610
+ track: publicHttpsUrl2(config, hosts.track)
4575
4611
  },
4576
4612
  frontend_runtime: {
4577
4613
  web: {
package/dist/index.js CHANGED
@@ -294,6 +294,7 @@ function domainMap(rootDomain) {
294
294
  api: `api.${rootDomain}`,
295
295
  auth: `auth.${rootDomain}`,
296
296
  obs: `obs.${rootDomain}`,
297
+ track: `t.${rootDomain}`,
297
298
  mail: `mail.${rootDomain}`,
298
299
  s3: `s3.${rootDomain}`,
299
300
  s3Console: `console.s3.${rootDomain}`
@@ -439,6 +440,9 @@ function buildRuntimeEnv2(config, generated, options) {
439
440
  OTEL_EXPORTER_OTLP_ENDPOINT: "http://otel-agent:4318",
440
441
  OTEL_SERVICE_NAME: "envsync-api",
441
442
  OTEL_SDK_DISABLED: "false",
443
+ POSTHOG_KEY: config.analytics?.posthog_key || process.env.POSTHOG_KEY || "",
444
+ POSTHOG_HOST: config.analytics?.posthog_host || process.env.POSTHOG_HOST || "https://eu.i.posthog.com",
445
+ ENVSYNC_POSTHOG_DISABLED: config.analytics?.disabled ? "true" : process.env.ENVSYNC_POSTHOG_DISABLED || "false",
442
446
  CLICKSTACK_URL: publicHttpsUrl(config, hosts.obs),
443
447
  KEYCLOAK_IMAGE_TAG: keycloakImageTag(config.images.keycloak),
444
448
  // Is this too hacky? We go Shawn way.
@@ -640,6 +644,12 @@ function renderTraefikDynamicConfig(config, generated) {
640
644
  ` service: ${apiServiceName}`,
641
645
  " entryPoints: [websecure]",
642
646
  " tls:",
647
+ " certResolver: letsencrypt",
648
+ " track-router:",
649
+ ` rule: Host(\`${hosts.track}\`)`,
650
+ ` service: ${apiServiceName}`,
651
+ " entryPoints: [websecure]",
652
+ " tls:",
643
653
  " certResolver: letsencrypt"
644
654
  ].join("\n") + "\n";
645
655
  }
@@ -683,7 +693,8 @@ function renderApiMaintenanceConf() {
683
693
  }
684
694
  function renderFrontendRuntimeConfig(config, generated) {
685
695
  const hosts = domainMap(config.domain.root_domain);
686
- const otelEndpoint = publicHttpsUrl(config, hosts.obs);
696
+ const otelEndpoint = publicHttpsUrl(config, hosts.track, "/obs");
697
+ const posthogProxy = publicHttpsUrl(config, hosts.track, "/ph");
687
698
  const managementApiEnabled = !isOssConfig(config);
688
699
  const activeReleaseVersion = generated.deployment.slots[generated.deployment.active_slot].release_version || config.release.version;
689
700
  const apiBaseUrl = publicHttpsUrl(config, hosts.api);
@@ -710,6 +721,9 @@ function renderFrontendRuntimeConfig(config, generated) {
710
721
  hyperdxUrl: otelEndpoint,
711
722
  hyperdxDisabled: generated.clickstack.browser_api_key.length === 0,
712
723
  hyperdxAdvancedNetworkCapture: false,
724
+ posthogKey: config.analytics?.posthog_key || process.env.POSTHOG_KEY || void 0,
725
+ posthogHost: config.analytics?.posthog_host || process.env.POSTHOG_HOST || posthogProxy,
726
+ posthogDisabled: Boolean(config.analytics?.disabled) || process.env.ENVSYNC_POSTHOG_DISABLED === "true",
713
727
  releaseVersion: activeReleaseVersion,
714
728
  activeApiSlot: generated.deployment.active_slot
715
729
  }, null, 2)};
@@ -1071,11 +1085,14 @@ ${includeRuntimeInfra ? `
1071
1085
  environment:
1072
1086
  ${renderEnvList({
1073
1087
  MINIKMS_ROOT_KEY: runtimeEnv.MINIKMS_ROOT_KEY,
1088
+ MINIKMS_SESSION_SIGNING_KEY_FILE: "/run/secrets/minikms-session-signing-key",
1074
1089
  MINIKMS_DB_URL: `postgres://postgres:${runtimeEnv.MINIKMS_DB_PASSWORD}@minikms_db:5432/minikms?sslmode=disable`,
1075
1090
  MINIKMS_REDIS_URL: "redis://redis:6379",
1076
1091
  MINIKMS_GRPC_ADDR: "0.0.0.0:50051",
1077
1092
  MINIKMS_TLS_ENABLED: "false"
1078
1093
  })}
1094
+ volumes:
1095
+ - ${paths.deployRoot}/minikms-session-signing-key.pem:/run/secrets/minikms-session-signing-key:ro
1079
1096
  networks: [envsync]` : ""}
1080
1097
 
1081
1098
  clickstack:
@@ -1424,7 +1441,7 @@ var init_org_setup = __esm({
1424
1441
 
1425
1442
  // src/cli.ts
1426
1443
  var cli_exports = {};
1427
- import { createHash as createHash2, randomBytes as randomBytes2, randomInt } from "crypto";
1444
+ import { createHash as createHash2, generateKeyPairSync, randomBytes as randomBytes2, randomInt } from "crypto";
1428
1445
  import { spawnSync } from "child_process";
1429
1446
  import fs4 from "fs";
1430
1447
  import path4 from "path";
@@ -1661,6 +1678,10 @@ function exists2(target) {
1661
1678
  function randomSecret(bytes = 24) {
1662
1679
  return randomBytes2(bytes).toString("hex");
1663
1680
  }
1681
+ function generateMinikmsSessionSigningKey() {
1682
+ const { privateKey } = generateKeyPairSync("ec", { namedCurve: "P-256" });
1683
+ return privateKey.export({ type: "pkcs8", format: "pem" }).toString();
1684
+ }
1664
1685
  function deterministicInstallFingerprint(rootDomain, stackName) {
1665
1686
  return `envsync-${createHash2("sha256").update(`${rootDomain}:${stackName}`).digest("hex").slice(0, 32)}`;
1666
1687
  }
@@ -1935,6 +1956,7 @@ function domainMap2(rootDomain) {
1935
1956
  api: `api.${rootDomain}`,
1936
1957
  auth: `auth.${rootDomain}`,
1937
1958
  obs: `obs.${rootDomain}`,
1959
+ track: `t.${rootDomain}`,
1938
1960
  mail: `mail.${rootDomain}`,
1939
1961
  s3: `s3.${rootDomain}`,
1940
1962
  s3Console: `console.s3.${rootDomain}`
@@ -2290,7 +2312,12 @@ function normalizeConfig(raw) {
2290
2312
  } : raw.edition === "oss" ? void 0 : {
2291
2313
  install_fingerprint: deterministicInstallFingerprint(rootDomain, stackName),
2292
2314
  certificate_validity_days: 1095
2293
- }
2315
+ },
2316
+ analytics: raw.analytics ? {
2317
+ posthog_key: raw.analytics.posthog_key,
2318
+ posthog_host: raw.analytics.posthog_host,
2319
+ disabled: raw.analytics.disabled
2320
+ } : void 0
2294
2321
  };
2295
2322
  }
2296
2323
  function emptyGeneratedState() {
@@ -2321,6 +2348,7 @@ function emptyGeneratedState() {
2321
2348
  keycloak_api_client_secret: "",
2322
2349
  openfga_db_password: "",
2323
2350
  minikms_root_key: "",
2351
+ minikms_session_signing_key: "",
2324
2352
  minikms_db_password: ""
2325
2353
  },
2326
2354
  bootstrap: {
@@ -2357,6 +2385,7 @@ function normalizeGeneratedState(raw) {
2357
2385
  keycloak_api_client_secret: raw?.secrets?.keycloak_api_client_secret ?? defaults.secrets.keycloak_api_client_secret,
2358
2386
  openfga_db_password: raw?.secrets?.openfga_db_password ?? defaults.secrets.openfga_db_password,
2359
2387
  minikms_root_key: raw?.secrets?.minikms_root_key ?? defaults.secrets.minikms_root_key,
2388
+ minikms_session_signing_key: raw?.secrets?.minikms_session_signing_key ?? defaults.secrets.minikms_session_signing_key,
2360
2389
  minikms_db_password: raw?.secrets?.minikms_db_password ?? defaults.secrets.minikms_db_password
2361
2390
  },
2362
2391
  bootstrap: {
@@ -2407,6 +2436,7 @@ function mergeGeneratedState(env, generated) {
2407
2436
  keycloak_api_client_secret: env.KEYCLOAK_API_CLIENT_SECRET ?? normalized.secrets.keycloak_api_client_secret,
2408
2437
  openfga_db_password: env.OPENFGA_DB_PASSWORD ?? normalized.secrets.openfga_db_password,
2409
2438
  minikms_root_key: env.MINIKMS_ROOT_KEY ?? normalized.secrets.minikms_root_key,
2439
+ minikms_session_signing_key: env.MINIKMS_SESSION_SIGNING_KEY ?? normalized.secrets.minikms_session_signing_key,
2410
2440
  minikms_db_password: env.MINIKMS_DB_PASSWORD ?? normalized.secrets.minikms_db_password
2411
2441
  },
2412
2442
  bootstrap: normalized.bootstrap
@@ -2435,6 +2465,7 @@ function ensureGeneratedRuntimeState(config, generated) {
2435
2465
  keycloak_api_client_secret: generated.secrets.keycloak_api_client_secret || randomSecret(),
2436
2466
  openfga_db_password: generated.secrets.openfga_db_password || randomSecret(),
2437
2467
  minikms_root_key: generated.secrets.minikms_root_key || randomBytes2(32).toString("hex"),
2468
+ minikms_session_signing_key: generated.secrets.minikms_session_signing_key || generateMinikmsSessionSigningKey(),
2438
2469
  minikms_db_password: generated.secrets.minikms_db_password || randomSecret()
2439
2470
  },
2440
2471
  bootstrap: generated.bootstrap
@@ -2600,6 +2631,9 @@ function writeDeployArtifacts(config, generated) {
2600
2631
  ensureSetupTokenFile(SETUP_TOKEN_FILE, setupToken);
2601
2632
  logInfo(`Setup token fingerprint: ${setupTokenFingerprint(setupToken)} (${SETUP_TOKEN_FILE})`);
2602
2633
  }
2634
+ if (generated.secrets.minikms_session_signing_key) {
2635
+ writeFileMaybe(MINIKMS_SESSION_SIGNING_KEY_FILE, generated.secrets.minikms_session_signing_key, 384);
2636
+ }
2603
2637
  writeFileMaybe(DEPLOY_ENV, renderEnvFile(runtimeEnv), 384);
2604
2638
  writeFileMaybe(
2605
2639
  INTERNAL_CONFIG_JSON,
@@ -4428,7 +4462,8 @@ async function cmdHealth(asJson) {
4428
4462
  app: publicHttpsUrl2(config, hosts.app),
4429
4463
  api: publicHttpsUrl2(config, hosts.api, "/health"),
4430
4464
  auth: publicHttpsUrl2(config, hosts.auth, `/realms/${config.auth.keycloak_realm}/.well-known/openid-configuration`),
4431
- obs: publicHttpsUrl2(config, hosts.obs)
4465
+ obs: publicHttpsUrl2(config, hosts.obs),
4466
+ track: publicHttpsUrl2(config, hosts.track)
4432
4467
  },
4433
4468
  frontend_runtime: {
4434
4469
  web: {
@@ -5134,7 +5169,7 @@ async function main() {
5134
5169
  process.exit(1);
5135
5170
  }
5136
5171
  }
5137
- var NETUTILS_EXPOSE_ALL_START_PORT, NETUTILS_EXPOSE_ALL_PORTS, HOST_ROOT, ETC_ROOT, TRAEFIK_STATE_ROOT, DEPLOY_ROOT, RELEASES_ROOT, BACKUPS_ROOT, REPO_ROOT, DEPLOY_ENV, DEPLOY_YAML, WIREGUARD_ROOT, LICENSE_ROOT, SETUP_TOKEN_FILE, LICENSE_BUNDLE_FILE, LICENSE_CERT_FILE, LICENSE_KEY_FILE, LICENSE_ROOT_CA_FILE, LICENSE_FILE_MODE, LICENSE_DIR_MODE, VERSIONS_LOCK, STACK_FILE, BOOTSTRAP_BASE_STACK_FILE, BOOTSTRAP_STACK_FILE, TRAEFIK_DYNAMIC_FILE, KEYCLOAK_REALM_FILE, NGINX_WEB_CONF, NGINX_LANDING_CONF, NGINX_API_MAINTENANCE_CONF, NGINX_VPN_CONF, OTEL_AGENT_CONF, CLICKSTACK_CLICKHOUSE_CONF, INTERNAL_CONFIG_JSON, UPGRADE_BACKUPS_ROOT, WIREGUARD_STATE_FILE, WIREGUARD_PRIVATE_KEY_FILE, WIREGUARD_PUBLIC_KEY_FILE, WIREGUARD_CONFIG_FILE, DEPLOY_RENDER_PATHS, REMOVE_TARGETS, REMOVE_CONFIRMATION_TOKEN, STACK_VOLUMES, REQUIRED_BOOTSTRAP_ENV_KEYS, REQUIRED_CLICKSTACK_SAVED_SEARCHES, REQUIRED_CLICKSTACK_TAGS, CLICKSTACK_SELFHOST_TEAM_NAME, SEMVER_VERSION_RE, currentOptions, DEFAULT_SOURCE_REPO_URL, DEFAULT_ENTERPRISE_LICENSE_SERVER_URL, MANAGED_VERSIONED_IMAGE_PREFIXES, MINIKMS_MIGRATE_SQL;
5172
+ var NETUTILS_EXPOSE_ALL_START_PORT, NETUTILS_EXPOSE_ALL_PORTS, HOST_ROOT, ETC_ROOT, TRAEFIK_STATE_ROOT, DEPLOY_ROOT, RELEASES_ROOT, BACKUPS_ROOT, REPO_ROOT, DEPLOY_ENV, DEPLOY_YAML, WIREGUARD_ROOT, LICENSE_ROOT, SETUP_TOKEN_FILE, LICENSE_BUNDLE_FILE, LICENSE_CERT_FILE, LICENSE_KEY_FILE, LICENSE_ROOT_CA_FILE, LICENSE_FILE_MODE, LICENSE_DIR_MODE, VERSIONS_LOCK, STACK_FILE, BOOTSTRAP_BASE_STACK_FILE, BOOTSTRAP_STACK_FILE, TRAEFIK_DYNAMIC_FILE, KEYCLOAK_REALM_FILE, NGINX_WEB_CONF, NGINX_LANDING_CONF, NGINX_API_MAINTENANCE_CONF, NGINX_VPN_CONF, OTEL_AGENT_CONF, CLICKSTACK_CLICKHOUSE_CONF, INTERNAL_CONFIG_JSON, MINIKMS_SESSION_SIGNING_KEY_FILE, UPGRADE_BACKUPS_ROOT, WIREGUARD_STATE_FILE, WIREGUARD_PRIVATE_KEY_FILE, WIREGUARD_PUBLIC_KEY_FILE, WIREGUARD_CONFIG_FILE, DEPLOY_RENDER_PATHS, REMOVE_TARGETS, REMOVE_CONFIRMATION_TOKEN, STACK_VOLUMES, REQUIRED_BOOTSTRAP_ENV_KEYS, REQUIRED_CLICKSTACK_SAVED_SEARCHES, REQUIRED_CLICKSTACK_TAGS, CLICKSTACK_SELFHOST_TEAM_NAME, SEMVER_VERSION_RE, currentOptions, DEFAULT_SOURCE_REPO_URL, DEFAULT_ENTERPRISE_LICENSE_SERVER_URL, MANAGED_VERSIONED_IMAGE_PREFIXES, MINIKMS_MIGRATE_SQL;
5138
5173
  var init_cli = __esm({
5139
5174
  "src/cli.ts"() {
5140
5175
  "use strict";
@@ -5199,6 +5234,7 @@ var init_cli = __esm({
5199
5234
  OTEL_AGENT_CONF = path4.join(DEPLOY_ROOT, "otel-agent.yaml");
5200
5235
  CLICKSTACK_CLICKHOUSE_CONF = path4.join(DEPLOY_ROOT, "clickhouse-listen.xml");
5201
5236
  INTERNAL_CONFIG_JSON = path4.join(DEPLOY_ROOT, "config.json");
5237
+ MINIKMS_SESSION_SIGNING_KEY_FILE = path4.join(DEPLOY_ROOT, "minikms-session-signing-key.pem");
5202
5238
  UPGRADE_BACKUPS_ROOT = path4.join(BACKUPS_ROOT, "upgrade");
5203
5239
  WIREGUARD_STATE_FILE = path4.join(WIREGUARD_ROOT, "state.json");
5204
5240
  WIREGUARD_PRIVATE_KEY_FILE = path4.join(WIREGUARD_ROOT, "server-private.key");
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@envsync-cloud/deploy",
3
- "version": "0.20.7",
3
+ "version": "0.20.9",
4
4
  "description": "OSS CLI for self-hosted EnvSync deployment on Docker Swarm",
5
5
  "type": "module",
6
6
  "bin": {
@@ -46,7 +46,7 @@
46
46
  "zod": "^3.25.76"
47
47
  },
48
48
  "devDependencies": {
49
- "@envsync-cloud/deploy-core": "0.20.7",
49
+ "@envsync-cloud/deploy-core": "0.20.9",
50
50
  "tsup": "^8.5.0",
51
51
  "typescript": "^5.9.2"
52
52
  },