@envsync-cloud/deploy 0.20.7 → 0.20.9

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/cli.ts
-import { createHash as createHash2, randomBytes as randomBytes2, randomInt } from "crypto";
+import { createHash as createHash2, generateKeyPairSync, randomBytes as randomBytes2, randomInt } from "crypto";
 import { spawnSync } from "child_process";
 import fs4 from "fs";
 import path4 from "path";
@@ -293,6 +293,7 @@ function domainMap(rootDomain) {
     api: `api.${rootDomain}`,
     auth: `auth.${rootDomain}`,
     obs: `obs.${rootDomain}`,
+    track: `t.${rootDomain}`,
     mail: `mail.${rootDomain}`,
     s3: `s3.${rootDomain}`,
     s3Console: `console.s3.${rootDomain}`
@@ -438,6 +439,9 @@ function buildRuntimeEnv2(config, generated, options) {
     OTEL_EXPORTER_OTLP_ENDPOINT: "http://otel-agent:4318",
     OTEL_SERVICE_NAME: "envsync-api",
     OTEL_SDK_DISABLED: "false",
+    POSTHOG_KEY: config.analytics?.posthog_key || process.env.POSTHOG_KEY || "",
+    POSTHOG_HOST: config.analytics?.posthog_host || process.env.POSTHOG_HOST || "https://eu.i.posthog.com",
+    ENVSYNC_POSTHOG_DISABLED: config.analytics?.disabled ? "true" : process.env.ENVSYNC_POSTHOG_DISABLED || "false",
     CLICKSTACK_URL: publicHttpsUrl(config, hosts.obs),
     KEYCLOAK_IMAGE_TAG: keycloakImageTag(config.images.keycloak),
     // Is this too hacky? We go Shawn way.
@@ -639,6 +643,12 @@ function renderTraefikDynamicConfig(config, generated) {
     `      service: ${apiServiceName}`,
     "      entryPoints: [websecure]",
     "      tls:",
+    "        certResolver: letsencrypt",
+    "    track-router:",
+    `      rule: Host(\`${hosts.track}\`)`,
+    `      service: ${apiServiceName}`,
+    "      entryPoints: [websecure]",
+    "      tls:",
     "        certResolver: letsencrypt"
   ].join("\n") + "\n";
 }
@@ -682,7 +692,8 @@ function renderApiMaintenanceConf() {
 }
 function renderFrontendRuntimeConfig(config, generated) {
   const hosts = domainMap(config.domain.root_domain);
-  const otelEndpoint = publicHttpsUrl(config, hosts.obs);
+  const otelEndpoint = publicHttpsUrl(config, hosts.track, "/obs");
+  const posthogProxy = publicHttpsUrl(config, hosts.track, "/ph");
   const managementApiEnabled = !isOssConfig(config);
   const activeReleaseVersion = generated.deployment.slots[generated.deployment.active_slot].release_version || config.release.version;
   const apiBaseUrl = publicHttpsUrl(config, hosts.api);
@@ -709,6 +720,9 @@ function renderFrontendRuntimeConfig(config, generated) {
     hyperdxUrl: otelEndpoint,
     hyperdxDisabled: generated.clickstack.browser_api_key.length === 0,
     hyperdxAdvancedNetworkCapture: false,
+    posthogKey: config.analytics?.posthog_key || process.env.POSTHOG_KEY || void 0,
+    posthogHost: config.analytics?.posthog_host || process.env.POSTHOG_HOST || posthogProxy,
+    posthogDisabled: Boolean(config.analytics?.disabled) || process.env.ENVSYNC_POSTHOG_DISABLED === "true",
     releaseVersion: activeReleaseVersion,
     activeApiSlot: generated.deployment.active_slot
   }, null, 2)};
@@ -1074,11 +1088,14 @@ ${includeRuntimeInfra ? `
     environment:
 ${renderEnvList({
     MINIKMS_ROOT_KEY: runtimeEnv.MINIKMS_ROOT_KEY,
+    MINIKMS_SESSION_SIGNING_KEY_FILE: "/run/secrets/minikms-session-signing-key",
     MINIKMS_DB_URL: `postgres://postgres:${runtimeEnv.MINIKMS_DB_PASSWORD}@minikms_db:5432/minikms?sslmode=disable`,
     MINIKMS_REDIS_URL: "redis://redis:6379",
     MINIKMS_GRPC_ADDR: "0.0.0.0:50051",
     MINIKMS_TLS_ENABLED: "false"
   })}
+    volumes:
+      - ${paths.deployRoot}/minikms-session-signing-key.pem:/run/secrets/minikms-session-signing-key:ro
     networks: [envsync]` : ""}
 
   clickstack:
@@ -1462,6 +1479,7 @@ var NGINX_VPN_CONF = path4.join(DEPLOY_ROOT, "nginx-vpn.conf");
 var OTEL_AGENT_CONF = path4.join(DEPLOY_ROOT, "otel-agent.yaml");
 var CLICKSTACK_CLICKHOUSE_CONF = path4.join(DEPLOY_ROOT, "clickhouse-listen.xml");
 var INTERNAL_CONFIG_JSON = path4.join(DEPLOY_ROOT, "config.json");
+var MINIKMS_SESSION_SIGNING_KEY_FILE = path4.join(DEPLOY_ROOT, "minikms-session-signing-key.pem");
 var UPGRADE_BACKUPS_ROOT = path4.join(BACKUPS_ROOT, "upgrade");
 var WIREGUARD_STATE_FILE = path4.join(WIREGUARD_ROOT, "state.json");
 var WIREGUARD_PRIVATE_KEY_FILE = path4.join(WIREGUARD_ROOT, "server-private.key");
@@ -1799,6 +1817,10 @@ function exists2(target) {
 function randomSecret(bytes = 24) {
   return randomBytes2(bytes).toString("hex");
 }
+function generateMinikmsSessionSigningKey() {
+  const { privateKey } = generateKeyPairSync("ec", { namedCurve: "P-256" });
+  return privateKey.export({ type: "pkcs8", format: "pem" }).toString();
+}
 function deterministicInstallFingerprint(rootDomain, stackName) {
   return `envsync-${createHash2("sha256").update(`${rootDomain}:${stackName}`).digest("hex").slice(0, 32)}`;
 }
@@ -2073,6 +2095,7 @@ function domainMap2(rootDomain) {
     api: `api.${rootDomain}`,
     auth: `auth.${rootDomain}`,
     obs: `obs.${rootDomain}`,
+    track: `t.${rootDomain}`,
     mail: `mail.${rootDomain}`,
     s3: `s3.${rootDomain}`,
     s3Console: `console.s3.${rootDomain}`
@@ -2428,7 +2451,12 @@ function normalizeConfig(raw) {
     } : raw.edition === "oss" ? void 0 : {
       install_fingerprint: deterministicInstallFingerprint(rootDomain, stackName),
       certificate_validity_days: 1095
-    }
+    },
+    analytics: raw.analytics ? {
+      posthog_key: raw.analytics.posthog_key,
+      posthog_host: raw.analytics.posthog_host,
+      disabled: raw.analytics.disabled
+    } : void 0
   };
 }
 function emptyGeneratedState() {
@@ -2459,6 +2487,7 @@ function emptyGeneratedState() {
       keycloak_api_client_secret: "",
       openfga_db_password: "",
       minikms_root_key: "",
+      minikms_session_signing_key: "",
       minikms_db_password: ""
     },
     bootstrap: {
@@ -2495,6 +2524,7 @@ function normalizeGeneratedState(raw) {
       keycloak_api_client_secret: raw?.secrets?.keycloak_api_client_secret ?? defaults.secrets.keycloak_api_client_secret,
       openfga_db_password: raw?.secrets?.openfga_db_password ?? defaults.secrets.openfga_db_password,
       minikms_root_key: raw?.secrets?.minikms_root_key ?? defaults.secrets.minikms_root_key,
+      minikms_session_signing_key: raw?.secrets?.minikms_session_signing_key ?? defaults.secrets.minikms_session_signing_key,
       minikms_db_password: raw?.secrets?.minikms_db_password ?? defaults.secrets.minikms_db_password
     },
     bootstrap: {
@@ -2545,6 +2575,7 @@ function mergeGeneratedState(env, generated) {
       keycloak_api_client_secret: env.KEYCLOAK_API_CLIENT_SECRET ?? normalized.secrets.keycloak_api_client_secret,
       openfga_db_password: env.OPENFGA_DB_PASSWORD ?? normalized.secrets.openfga_db_password,
       minikms_root_key: env.MINIKMS_ROOT_KEY ?? normalized.secrets.minikms_root_key,
+      minikms_session_signing_key: env.MINIKMS_SESSION_SIGNING_KEY ?? normalized.secrets.minikms_session_signing_key,
       minikms_db_password: env.MINIKMS_DB_PASSWORD ?? normalized.secrets.minikms_db_password
     },
     bootstrap: normalized.bootstrap
@@ -2573,6 +2604,7 @@ function ensureGeneratedRuntimeState(config, generated) {
       keycloak_api_client_secret: generated.secrets.keycloak_api_client_secret || randomSecret(),
       openfga_db_password: generated.secrets.openfga_db_password || randomSecret(),
       minikms_root_key: generated.secrets.minikms_root_key || randomBytes2(32).toString("hex"),
+      minikms_session_signing_key: generated.secrets.minikms_session_signing_key || generateMinikmsSessionSigningKey(),
       minikms_db_password: generated.secrets.minikms_db_password || randomSecret()
     },
     bootstrap: generated.bootstrap
@@ -2738,6 +2770,9 @@ function writeDeployArtifacts(config, generated) {
     ensureSetupTokenFile(SETUP_TOKEN_FILE, setupToken);
     logInfo(`Setup token fingerprint: ${setupTokenFingerprint(setupToken)} (${SETUP_TOKEN_FILE})`);
   }
+  if (generated.secrets.minikms_session_signing_key) {
+    writeFileMaybe(MINIKMS_SESSION_SIGNING_KEY_FILE, generated.secrets.minikms_session_signing_key, 384);
+  }
   writeFileMaybe(DEPLOY_ENV, renderEnvFile(runtimeEnv), 384);
   writeFileMaybe(
     INTERNAL_CONFIG_JSON,
@@ -4571,7 +4606,8 @@ async function cmdHealth(asJson) {
       app: publicHttpsUrl2(config, hosts.app),
       api: publicHttpsUrl2(config, hosts.api, "/health"),
       auth: publicHttpsUrl2(config, hosts.auth, `/realms/${config.auth.keycloak_realm}/.well-known/openid-configuration`),
-      obs: publicHttpsUrl2(config, hosts.obs)
+      obs: publicHttpsUrl2(config, hosts.obs),
+      track: publicHttpsUrl2(config, hosts.track)
     },
     frontend_runtime: {
       web: {

package/dist/index.js

@@ -294,6 +294,7 @@ function domainMap(rootDomain) {
     api: `api.${rootDomain}`,
     auth: `auth.${rootDomain}`,
     obs: `obs.${rootDomain}`,
+    track: `t.${rootDomain}`,
     mail: `mail.${rootDomain}`,
     s3: `s3.${rootDomain}`,
     s3Console: `console.s3.${rootDomain}`
@@ -439,6 +440,9 @@ function buildRuntimeEnv2(config, generated, options) {
     OTEL_EXPORTER_OTLP_ENDPOINT: "http://otel-agent:4318",
     OTEL_SERVICE_NAME: "envsync-api",
     OTEL_SDK_DISABLED: "false",
+    POSTHOG_KEY: config.analytics?.posthog_key || process.env.POSTHOG_KEY || "",
+    POSTHOG_HOST: config.analytics?.posthog_host || process.env.POSTHOG_HOST || "https://eu.i.posthog.com",
+    ENVSYNC_POSTHOG_DISABLED: config.analytics?.disabled ? "true" : process.env.ENVSYNC_POSTHOG_DISABLED || "false",
     CLICKSTACK_URL: publicHttpsUrl(config, hosts.obs),
     KEYCLOAK_IMAGE_TAG: keycloakImageTag(config.images.keycloak),
     // Is this too hacky? We go Shawn way.
@@ -640,6 +644,12 @@ function renderTraefikDynamicConfig(config, generated) {
     `      service: ${apiServiceName}`,
     "      entryPoints: [websecure]",
     "      tls:",
+    "        certResolver: letsencrypt",
+    "    track-router:",
+    `      rule: Host(\`${hosts.track}\`)`,
+    `      service: ${apiServiceName}`,
+    "      entryPoints: [websecure]",
+    "      tls:",
     "        certResolver: letsencrypt"
   ].join("\n") + "\n";
 }
@@ -683,7 +693,8 @@ function renderApiMaintenanceConf() {
 }
 function renderFrontendRuntimeConfig(config, generated) {
   const hosts = domainMap(config.domain.root_domain);
-  const otelEndpoint = publicHttpsUrl(config, hosts.obs);
+  const otelEndpoint = publicHttpsUrl(config, hosts.track, "/obs");
+  const posthogProxy = publicHttpsUrl(config, hosts.track, "/ph");
   const managementApiEnabled = !isOssConfig(config);
   const activeReleaseVersion = generated.deployment.slots[generated.deployment.active_slot].release_version || config.release.version;
   const apiBaseUrl = publicHttpsUrl(config, hosts.api);
@@ -710,6 +721,9 @@ function renderFrontendRuntimeConfig(config, generated) {
     hyperdxUrl: otelEndpoint,
     hyperdxDisabled: generated.clickstack.browser_api_key.length === 0,
     hyperdxAdvancedNetworkCapture: false,
+    posthogKey: config.analytics?.posthog_key || process.env.POSTHOG_KEY || void 0,
+    posthogHost: config.analytics?.posthog_host || process.env.POSTHOG_HOST || posthogProxy,
+    posthogDisabled: Boolean(config.analytics?.disabled) || process.env.ENVSYNC_POSTHOG_DISABLED === "true",
     releaseVersion: activeReleaseVersion,
     activeApiSlot: generated.deployment.active_slot
   }, null, 2)};
@@ -1071,11 +1085,14 @@ ${includeRuntimeInfra ? `
     environment:
 ${renderEnvList({
     MINIKMS_ROOT_KEY: runtimeEnv.MINIKMS_ROOT_KEY,
+    MINIKMS_SESSION_SIGNING_KEY_FILE: "/run/secrets/minikms-session-signing-key",
     MINIKMS_DB_URL: `postgres://postgres:${runtimeEnv.MINIKMS_DB_PASSWORD}@minikms_db:5432/minikms?sslmode=disable`,
     MINIKMS_REDIS_URL: "redis://redis:6379",
     MINIKMS_GRPC_ADDR: "0.0.0.0:50051",
     MINIKMS_TLS_ENABLED: "false"
   })}
+    volumes:
+      - ${paths.deployRoot}/minikms-session-signing-key.pem:/run/secrets/minikms-session-signing-key:ro
     networks: [envsync]` : ""}
 
   clickstack:
@@ -1424,7 +1441,7 @@ var init_org_setup = __esm({
 
 // src/cli.ts
 var cli_exports = {};
-import { createHash as createHash2, randomBytes as randomBytes2, randomInt } from "crypto";
+import { createHash as createHash2, generateKeyPairSync, randomBytes as randomBytes2, randomInt } from "crypto";
 import { spawnSync } from "child_process";
 import fs4 from "fs";
 import path4 from "path";
@@ -1661,6 +1678,10 @@ function exists2(target) {
 function randomSecret(bytes = 24) {
   return randomBytes2(bytes).toString("hex");
 }
+function generateMinikmsSessionSigningKey() {
+  const { privateKey } = generateKeyPairSync("ec", { namedCurve: "P-256" });
+  return privateKey.export({ type: "pkcs8", format: "pem" }).toString();
+}
 function deterministicInstallFingerprint(rootDomain, stackName) {
   return `envsync-${createHash2("sha256").update(`${rootDomain}:${stackName}`).digest("hex").slice(0, 32)}`;
 }
@@ -1935,6 +1956,7 @@ function domainMap2(rootDomain) {
     api: `api.${rootDomain}`,
     auth: `auth.${rootDomain}`,
     obs: `obs.${rootDomain}`,
+    track: `t.${rootDomain}`,
     mail: `mail.${rootDomain}`,
     s3: `s3.${rootDomain}`,
     s3Console: `console.s3.${rootDomain}`
@@ -2290,7 +2312,12 @@ function normalizeConfig(raw) {
     } : raw.edition === "oss" ? void 0 : {
       install_fingerprint: deterministicInstallFingerprint(rootDomain, stackName),
       certificate_validity_days: 1095
-    }
+    },
+    analytics: raw.analytics ? {
+      posthog_key: raw.analytics.posthog_key,
+      posthog_host: raw.analytics.posthog_host,
+      disabled: raw.analytics.disabled
+    } : void 0
   };
 }
 function emptyGeneratedState() {
@@ -2321,6 +2348,7 @@ function emptyGeneratedState() {
       keycloak_api_client_secret: "",
       openfga_db_password: "",
       minikms_root_key: "",
+      minikms_session_signing_key: "",
       minikms_db_password: ""
     },
     bootstrap: {
@@ -2357,6 +2385,7 @@ function normalizeGeneratedState(raw) {
       keycloak_api_client_secret: raw?.secrets?.keycloak_api_client_secret ?? defaults.secrets.keycloak_api_client_secret,
       openfga_db_password: raw?.secrets?.openfga_db_password ?? defaults.secrets.openfga_db_password,
       minikms_root_key: raw?.secrets?.minikms_root_key ?? defaults.secrets.minikms_root_key,
+      minikms_session_signing_key: raw?.secrets?.minikms_session_signing_key ?? defaults.secrets.minikms_session_signing_key,
       minikms_db_password: raw?.secrets?.minikms_db_password ?? defaults.secrets.minikms_db_password
     },
     bootstrap: {
@@ -2407,6 +2436,7 @@ function mergeGeneratedState(env, generated) {
       keycloak_api_client_secret: env.KEYCLOAK_API_CLIENT_SECRET ?? normalized.secrets.keycloak_api_client_secret,
       openfga_db_password: env.OPENFGA_DB_PASSWORD ?? normalized.secrets.openfga_db_password,
       minikms_root_key: env.MINIKMS_ROOT_KEY ?? normalized.secrets.minikms_root_key,
+      minikms_session_signing_key: env.MINIKMS_SESSION_SIGNING_KEY ?? normalized.secrets.minikms_session_signing_key,
       minikms_db_password: env.MINIKMS_DB_PASSWORD ?? normalized.secrets.minikms_db_password
     },
     bootstrap: normalized.bootstrap
@@ -2435,6 +2465,7 @@ function ensureGeneratedRuntimeState(config, generated) {
       keycloak_api_client_secret: generated.secrets.keycloak_api_client_secret || randomSecret(),
       openfga_db_password: generated.secrets.openfga_db_password || randomSecret(),
       minikms_root_key: generated.secrets.minikms_root_key || randomBytes2(32).toString("hex"),
+      minikms_session_signing_key: generated.secrets.minikms_session_signing_key || generateMinikmsSessionSigningKey(),
       minikms_db_password: generated.secrets.minikms_db_password || randomSecret()
     },
     bootstrap: generated.bootstrap
@@ -2600,6 +2631,9 @@ function writeDeployArtifacts(config, generated) {
     ensureSetupTokenFile(SETUP_TOKEN_FILE, setupToken);
     logInfo(`Setup token fingerprint: ${setupTokenFingerprint(setupToken)} (${SETUP_TOKEN_FILE})`);
   }
+  if (generated.secrets.minikms_session_signing_key) {
+    writeFileMaybe(MINIKMS_SESSION_SIGNING_KEY_FILE, generated.secrets.minikms_session_signing_key, 384);
+  }
   writeFileMaybe(DEPLOY_ENV, renderEnvFile(runtimeEnv), 384);
   writeFileMaybe(
     INTERNAL_CONFIG_JSON,
@@ -4428,7 +4462,8 @@ async function cmdHealth(asJson) {
       app: publicHttpsUrl2(config, hosts.app),
       api: publicHttpsUrl2(config, hosts.api, "/health"),
       auth: publicHttpsUrl2(config, hosts.auth, `/realms/${config.auth.keycloak_realm}/.well-known/openid-configuration`),
-      obs: publicHttpsUrl2(config, hosts.obs)
+      obs: publicHttpsUrl2(config, hosts.obs),
+      track: publicHttpsUrl2(config, hosts.track)
     },
     frontend_runtime: {
       web: {
@@ -5134,7 +5169,7 @@ async function main() {
       process.exit(1);
   }
 }
-var NETUTILS_EXPOSE_ALL_START_PORT, NETUTILS_EXPOSE_ALL_PORTS, HOST_ROOT, ETC_ROOT, TRAEFIK_STATE_ROOT, DEPLOY_ROOT, RELEASES_ROOT, BACKUPS_ROOT, REPO_ROOT, DEPLOY_ENV, DEPLOY_YAML, WIREGUARD_ROOT, LICENSE_ROOT, SETUP_TOKEN_FILE, LICENSE_BUNDLE_FILE, LICENSE_CERT_FILE, LICENSE_KEY_FILE, LICENSE_ROOT_CA_FILE, LICENSE_FILE_MODE, LICENSE_DIR_MODE, VERSIONS_LOCK, STACK_FILE, BOOTSTRAP_BASE_STACK_FILE, BOOTSTRAP_STACK_FILE, TRAEFIK_DYNAMIC_FILE, KEYCLOAK_REALM_FILE, NGINX_WEB_CONF, NGINX_LANDING_CONF, NGINX_API_MAINTENANCE_CONF, NGINX_VPN_CONF, OTEL_AGENT_CONF, CLICKSTACK_CLICKHOUSE_CONF, INTERNAL_CONFIG_JSON, UPGRADE_BACKUPS_ROOT, WIREGUARD_STATE_FILE, WIREGUARD_PRIVATE_KEY_FILE, WIREGUARD_PUBLIC_KEY_FILE, WIREGUARD_CONFIG_FILE, DEPLOY_RENDER_PATHS, REMOVE_TARGETS, REMOVE_CONFIRMATION_TOKEN, STACK_VOLUMES, REQUIRED_BOOTSTRAP_ENV_KEYS, REQUIRED_CLICKSTACK_SAVED_SEARCHES, REQUIRED_CLICKSTACK_TAGS, CLICKSTACK_SELFHOST_TEAM_NAME, SEMVER_VERSION_RE, currentOptions, DEFAULT_SOURCE_REPO_URL, DEFAULT_ENTERPRISE_LICENSE_SERVER_URL, MANAGED_VERSIONED_IMAGE_PREFIXES, MINIKMS_MIGRATE_SQL;
+var NETUTILS_EXPOSE_ALL_START_PORT, NETUTILS_EXPOSE_ALL_PORTS, HOST_ROOT, ETC_ROOT, TRAEFIK_STATE_ROOT, DEPLOY_ROOT, RELEASES_ROOT, BACKUPS_ROOT, REPO_ROOT, DEPLOY_ENV, DEPLOY_YAML, WIREGUARD_ROOT, LICENSE_ROOT, SETUP_TOKEN_FILE, LICENSE_BUNDLE_FILE, LICENSE_CERT_FILE, LICENSE_KEY_FILE, LICENSE_ROOT_CA_FILE, LICENSE_FILE_MODE, LICENSE_DIR_MODE, VERSIONS_LOCK, STACK_FILE, BOOTSTRAP_BASE_STACK_FILE, BOOTSTRAP_STACK_FILE, TRAEFIK_DYNAMIC_FILE, KEYCLOAK_REALM_FILE, NGINX_WEB_CONF, NGINX_LANDING_CONF, NGINX_API_MAINTENANCE_CONF, NGINX_VPN_CONF, OTEL_AGENT_CONF, CLICKSTACK_CLICKHOUSE_CONF, INTERNAL_CONFIG_JSON, MINIKMS_SESSION_SIGNING_KEY_FILE, UPGRADE_BACKUPS_ROOT, WIREGUARD_STATE_FILE, WIREGUARD_PRIVATE_KEY_FILE, WIREGUARD_PUBLIC_KEY_FILE, WIREGUARD_CONFIG_FILE, DEPLOY_RENDER_PATHS, REMOVE_TARGETS, REMOVE_CONFIRMATION_TOKEN, STACK_VOLUMES, REQUIRED_BOOTSTRAP_ENV_KEYS, REQUIRED_CLICKSTACK_SAVED_SEARCHES, REQUIRED_CLICKSTACK_TAGS, CLICKSTACK_SELFHOST_TEAM_NAME, SEMVER_VERSION_RE, currentOptions, DEFAULT_SOURCE_REPO_URL, DEFAULT_ENTERPRISE_LICENSE_SERVER_URL, MANAGED_VERSIONED_IMAGE_PREFIXES, MINIKMS_MIGRATE_SQL;
 var init_cli = __esm({
   "src/cli.ts"() {
     "use strict";
@@ -5199,6 +5234,7 @@ var init_cli = __esm({
     OTEL_AGENT_CONF = path4.join(DEPLOY_ROOT, "otel-agent.yaml");
     CLICKSTACK_CLICKHOUSE_CONF = path4.join(DEPLOY_ROOT, "clickhouse-listen.xml");
     INTERNAL_CONFIG_JSON = path4.join(DEPLOY_ROOT, "config.json");
+    MINIKMS_SESSION_SIGNING_KEY_FILE = path4.join(DEPLOY_ROOT, "minikms-session-signing-key.pem");
     UPGRADE_BACKUPS_ROOT = path4.join(BACKUPS_ROOT, "upgrade");
     WIREGUARD_STATE_FILE = path4.join(WIREGUARD_ROOT, "state.json");
     WIREGUARD_PRIVATE_KEY_FILE = path4.join(WIREGUARD_ROOT, "server-private.key");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@envsync-cloud/deploy",
-  "version": "0.20.7",
+  "version": "0.20.9",
   "description": "OSS CLI for self-hosted EnvSync deployment on Docker Swarm",
   "type": "module",
   "bin": {
@@ -46,7 +46,7 @@
     "zod": "^3.25.76"
   },
   "devDependencies": {
-    "@envsync-cloud/deploy-core": "0.20.7",
+    "@envsync-cloud/deploy-core": "0.20.9",
     "tsup": "^8.5.0",
     "typescript": "^5.9.2"
   },