@envsync-cloud/deploy 0.8.1

package/README.md

@@ -0,0 +1,15 @@
+# EnvSync OSS Deploy
+
+Public OSS deploy package.
+
+Current responsibilities:
+
+- validate OSS deploy configs against edition rules
+- render an OSS topology plan
+- omit landing and management API artifacts
+- keep observability opt-in
+
+Commands:
+
+- `envsync-deploy validate [deploy.yaml]`
+- `envsync-deploy plan [deploy.yaml]`

package/dist/index.js

@@ -0,0 +1,370 @@
+#!/usr/bin/env node
+
+// src/index.ts
+import { spawnSync } from "child_process";
+import chalk from "chalk";
+
+// ../deploy-core/src/index.ts
+import fs from "fs";
+import path from "path";
+import YAML from "yaml";
+import { z } from "zod";
+var DeployPlanError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "DeployPlanError";
+  }
+};
+var deployConfigSchema = z.object({
+  edition: z.enum(["oss", "enterprise"]).optional(),
+  source: z.object({
+    repo_url: z.string().default("https://github.com/EnvSync-Cloud/envsync.git"),
+    ref: z.string().default("main")
+  }).default({}),
+  release: z.object({
+    version: z.string().default("0.8.1"),
+    channel: z.string().default("stable")
+  }).default({}),
+  domain: z.object({
+    root_domain: z.string().default("example.com"),
+    acme_email: z.string().default("ops@example.com")
+  }).default({}),
+  services: z.object({
+    stack_name: z.string().default("envsync"),
+    api_port: z.number().int().positive().default(4e3),
+    management_api_port: z.number().int().positive().default(4001),
+    public_http_port: z.number().int().positive().default(80),
+    public_https_port: z.number().int().positive().default(443)
+  }).default({}),
+  images: z.object({
+    api: z.string().default("ghcr.io/envsync-cloud/envsync-api:stable"),
+    management_api: z.string().default("ghcr.io/envsync-cloud/envsync-management-api:stable"),
+    web: z.string().default("ghcr.io/envsync-cloud/envsync-web-oss-static:stable"),
+    enterprise_web: z.string().default("ghcr.io/envsync-cloud/envsync-web-static:stable"),
+    landing: z.string().default("ghcr.io/envsync-cloud/envsync-landing-static:stable"),
+    keycloak: z.string().default("envsync-keycloak:stable"),
+    clickstack: z.string().default("ghcr.io/envsync-cloud/clickstack:stable"),
+    otel_agent: z.string().default("otel/opentelemetry-collector-contrib:latest")
+  }).default({}),
+  features: z.object({
+    management_api: z.boolean().optional(),
+    management_web: z.boolean().optional(),
+    landing: z.boolean().optional()
+  }).default({}),
+  observability: z.object({
+    enabled: z.boolean().optional(),
+    public_obs: z.boolean().optional()
+  }).default({}),
+  license: z.object({
+    required: z.boolean().optional(),
+    server_url: z.string().optional(),
+    key: z.string().optional(),
+    install_fingerprint: z.string().optional(),
+    lease_ttl_seconds: z.number().int().positive().default(300)
+  }).default({}),
+  frontend: z.object({
+    dashboard_variant: z.enum(["oss", "enterprise"]).optional(),
+    include_manage_subtree: z.boolean().optional()
+  }).default({})
+});
+function readDeployConfigFile(filePath) {
+  const absolutePath = path.resolve(process.cwd(), filePath);
+  if (!fs.existsSync(absolutePath)) {
+    throw new DeployPlanError(`Deploy config file not found: ${absolutePath}`);
+  }
+  const raw = fs.readFileSync(absolutePath, "utf8");
+  if (absolutePath.endsWith(".json")) {
+    return JSON.parse(raw);
+  }
+  return YAML.parse(raw);
+}
+function validateEditionRules(config, edition) {
+  const errors = [];
+  if (edition === "oss") {
+    if (config.edition === "enterprise") {
+      errors.push("OSS deploy tooling cannot consume a config explicitly marked as enterprise.");
+    }
+    if (config.features.management_api === true) {
+      errors.push("OSS edition cannot enable management_api.");
+    }
+    if (config.features.landing === true) {
+      errors.push("OSS edition cannot enable landing.");
+    }
+    if (config.license.required === true) {
+      errors.push("OSS edition cannot require enterprise licensing.");
+    }
+    if (config.license.server_url || config.license.key || config.license.install_fingerprint) {
+      errors.push("OSS edition cannot include enterprise license server settings.");
+    }
+    if (config.frontend.dashboard_variant === "enterprise") {
+      errors.push("OSS edition cannot use the enterprise dashboard variant.");
+    }
+  }
+  if (edition === "enterprise") {
+    if (config.edition === "oss") {
+      errors.push("Enterprise deploy tooling cannot consume a config explicitly marked as oss.");
+    }
+    if (config.features.management_api === false) {
+      errors.push("Enterprise edition must enable management_api.");
+    }
+    if (config.features.landing === false) {
+      errors.push("Enterprise edition must enable landing.");
+    }
+    if (config.license.required === false) {
+      errors.push("Enterprise edition must require licensing.");
+    }
+    if (!config.license.server_url) {
+      errors.push("Enterprise edition requires license.server_url.");
+    }
+    if (config.frontend.dashboard_variant === "oss") {
+      errors.push("Enterprise edition cannot use the OSS dashboard variant.");
+    }
+  }
+  if (errors.length > 0) {
+    throw new DeployPlanError(errors.join(" "));
+  }
+}
+function buildServicePlans(config, edition) {
+  const observabilityEnabled = config.observability.enabled ?? edition === "enterprise";
+  const managementEnabled = edition === "enterprise";
+  const landingEnabled = edition === "enterprise";
+  return [
+    { id: "api", enabled: true, tier: "core", reason: "Required in all editions.", image: config.images.api },
+    { id: "web", enabled: true, tier: "core", reason: "Primary dashboard artifact.", image: edition === "enterprise" ? config.images.enterprise_web : config.images.web },
+    { id: "postgres", enabled: true, tier: "core", reason: "Core persistence.", image: null },
+    { id: "redis", enabled: true, tier: "core", reason: "Core cache and sessions.", image: null },
+    { id: "rustfs", enabled: true, tier: "core", reason: "Object storage for artifacts.", image: null },
+    { id: "openfga", enabled: true, tier: "core", reason: "Authorization service.", image: null },
+    { id: "minikms", enabled: true, tier: "core", reason: "Secret encryption service.", image: null },
+    { id: "keycloak", enabled: true, tier: "core", reason: "Authentication provider.", image: config.images.keycloak },
+    { id: "management-api", enabled: managementEnabled, tier: "enterprise", reason: managementEnabled ? "Enterprise control plane API." : "Not deployed in OSS.", image: managementEnabled ? config.images.management_api : null },
+    { id: "landing", enabled: landingEnabled, tier: "enterprise", reason: landingEnabled ? "Enterprise/public onboarding surface." : "Omitted in OSS.", image: landingEnabled ? config.images.landing : null },
+    { id: "clickstack", enabled: observabilityEnabled, tier: observabilityEnabled ? "optional" : "optional", reason: observabilityEnabled ? "Observability enabled for this topology." : "Observability disabled.", image: observabilityEnabled ? config.images.clickstack : null },
+    { id: "otel-agent", enabled: observabilityEnabled, tier: "optional", reason: observabilityEnabled ? "OTEL pipeline enabled for this topology." : "OTEL disabled.", image: observabilityEnabled ? config.images.otel_agent : null }
+  ];
+}
+function buildFrontendArtifacts(config, edition) {
+  const enterprise = edition === "enterprise";
+  return [
+    {
+      id: "dashboard",
+      package_name: "envsync-web",
+      build_command: enterprise ? "bun run --filter envsync-web build:enterprise" : "bun run --filter envsync-web build:oss",
+      mount_path: "/",
+      included: true,
+      image: enterprise ? config.images.enterprise_web : config.images.web
+    },
+    {
+      id: "landing",
+      package_name: "envsync-landing",
+      build_command: "bun run --filter envsync-landing build",
+      mount_path: "/",
+      included: enterprise,
+      image: enterprise ? config.images.landing : null
+    }
+  ];
+}
+function buildRuntimeEnv(config, edition) {
+  const enterprise = edition === "enterprise";
+  const observabilityEnabled = config.observability.enabled ?? enterprise;
+  return {
+    ENVSYNC_EDITION: edition,
+    ENVSYNC_OBSERVABILITY_ENABLED: String(observabilityEnabled),
+    ENVSYNC_MANAGEMENT_ENABLED: String(enterprise),
+    ENVSYNC_LANDING_ENABLED: String(enterprise),
+    ENVSYNC_SINGLE_ORG_MODE: String(edition === "oss"),
+    ENVSYNC_LICENSE_ENFORCEMENT: String(enterprise),
+    MANAGEMENT_API_URL: enterprise ? `https://manage-api.${config.domain.root_domain}` : "",
+    ENVSYNC_LICENSE_SERVER_URL: enterprise ? config.license.server_url ?? "" : "",
+    ENVSYNC_LICENSE_KEY: enterprise ? config.license.key ?? "" : "",
+    ENVSYNC_INSTALL_FINGERPRINT: enterprise ? config.license.install_fingerprint ?? "" : "",
+    ENVSYNC_LICENSE_LEASE_TTL_SECONDS: String(config.license.lease_ttl_seconds),
+    ENVSYNC_STACK_NAME: config.services.stack_name,
+    ENVSYNC_RELEASE_VERSION: config.release.version
+  };
+}
+function buildReleaseArtifacts(config, edition) {
+  const npmPackages = [
+    {
+      name: "@envsync-cloud/deploy",
+      registry: "npm",
+      edition: "oss",
+      publish: edition === "oss"
+    },
+    {
+      name: "@envsync-cloud/deploy-cli",
+      registry: "github-packages",
+      edition: "enterprise",
+      publish: edition === "enterprise"
+    }
+  ];
+  const container_images = [
+    {
+      name: "envsync-api",
+      image: config.images.api,
+      build_target: "packages/envsync-api",
+      edition: "shared"
+    }
+  ];
+  if (edition === "enterprise") {
+    container_images.push(
+      {
+        name: "envsync-management-api",
+        image: config.images.management_api,
+        build_target: "packages/envsync-management-api",
+        edition: "enterprise"
+      },
+      {
+        name: "envsync-web-static",
+        image: config.images.enterprise_web,
+        build_target: "apps/envsync-web#build:enterprise",
+        edition: "enterprise"
+      },
+      {
+        name: "envsync-landing-static",
+        image: config.images.landing,
+        build_target: "apps/envsync-landing#build",
+        edition: "enterprise"
+      }
+    );
+  } else {
+    container_images.push({
+      name: "envsync-web-oss-static",
+      image: config.images.web,
+      build_target: "apps/envsync-web#build:oss",
+      edition: "oss"
+    });
+  }
+  return {
+    npm_packages: npmPackages,
+    container_images
+  };
+}
+function createDeploymentPlan(rawConfig, forcedEdition) {
+  const config = deployConfigSchema.parse(rawConfig);
+  const edition = forcedEdition ?? config.edition ?? "oss";
+  validateEditionRules(config, edition);
+  const warnings = [];
+  if (edition === "oss" && (config.observability.enabled ?? false) === false) {
+    warnings.push("Observability is disabled for OSS. ClickStack and OTEL services will be omitted.");
+  }
+  if (edition === "enterprise" && !config.license.key) {
+    warnings.push("Enterprise topology is valid, but license.key is empty. Activation will fail until a real key is supplied.");
+  }
+  return {
+    edition,
+    config,
+    services: buildServicePlans(config, edition),
+    frontend: buildFrontendArtifacts(config, edition),
+    runtime_env: buildRuntimeEnv(config, edition),
+    release_artifacts: buildReleaseArtifacts(config, edition),
+    warnings
+  };
+}
+function loadDeploymentPlanFromFile(filePath, forcedEdition) {
+  return createDeploymentPlan(readDeployConfigFile(filePath), forcedEdition);
+}
+function formatDeploymentPlan(plan, format = "yaml") {
+  if (format === "json") {
+    return JSON.stringify(plan, null, 2);
+  }
+  return YAML.stringify(plan);
+}
+
+// src/index.ts
+function printHelp() {
+  console.log(`
+${chalk.bold("EnvSync OSS Deploy")}
+
+Commands:
+  bootstrap [--force]               Bootstrap an OSS self-host topology
+  deploy                            Deploy the OSS self-host topology
+  health [--json]                   Inspect OSS self-host health
+  backup                            Create a self-host backup
+  validate [deploy.yaml] [--json]   Validate an OSS topology config
+  plan [deploy.yaml] [--json]       Render the OSS topology plan
+  validate-topology [deploy.yaml]   Alias for validate
+  plan-topology [deploy.yaml]       Alias for plan
+`);
+}
+function getPositionals(argv) {
+  return argv.filter((arg) => !arg.startsWith("--"));
+}
+function getPlan(filePath, edition) {
+  return loadDeploymentPlanFromFile(filePath ?? "deploy.yaml", edition);
+}
+function runLifecycleCommand(args) {
+  const result = spawnSync("bun", ["run", "packages/deploy-cli/src/index.ts", ...args], {
+    cwd: process.cwd(),
+    stdio: "inherit",
+    env: process.env
+  });
+  if ((result.status ?? 1) !== 0) {
+    process.exit(result.status ?? 1);
+  }
+}
+async function main() {
+  const argv = process.argv.slice(2);
+  const command = argv[0];
+  const rest = argv.slice(1);
+  const json = rest.includes("--json");
+  const positionals = getPositionals(rest);
+  const filePath = positionals[0];
+  if (!command || command === "--help" || command === "help") {
+    printHelp();
+    return;
+  }
+  switch (command) {
+    case "bootstrap":
+    case "deploy":
+    case "health":
+    case "backup":
+    case "restore":
+    case "promote":
+    case "rollback":
+    case "upgrade":
+    case "upgrade-deps": {
+      runLifecycleCommand([command, ...rest]);
+      break;
+    }
+    case "validate": {
+      const plan = getPlan(filePath, "oss");
+      if (json) {
+        console.log(JSON.stringify({ valid: true, edition: plan.edition, warnings: plan.warnings }, null, 2));
+      } else {
+        console.log(chalk.green("OSS topology is valid."));
+        if (plan.warnings.length > 0) {
+          for (const warning of plan.warnings) {
+            console.log(chalk.yellow(`warning: ${warning}`));
+          }
+        }
+      }
+      break;
+    }
+    case "plan": {
+      const plan = getPlan(filePath, "oss");
+      console.log(formatDeploymentPlan(plan, json ? "json" : "yaml"));
+      break;
+    }
+    case "validate-topology": {
+      const plan = getPlan(filePath, "oss");
+      if (json) {
+        console.log(JSON.stringify({ valid: true, edition: plan.edition, warnings: plan.warnings }, null, 2));
+      } else {
+        console.log(chalk.green("OSS topology is valid."));
+      }
+      break;
+    }
+    case "plan-topology": {
+      const plan = getPlan(filePath, "oss");
+      console.log(formatDeploymentPlan(plan, json ? "json" : "yaml"));
+      break;
+    }
+    default:
+      throw new Error(`Unknown command: ${command}`);
+  }
+}
+main().catch((error) => {
+  console.error(chalk.red(error instanceof Error ? error.message : String(error)));
+  process.exit(1);
+});

package/package.json

@@ -0,0 +1,50 @@
+{
+  "name": "@envsync-cloud/deploy",
+  "version": "0.8.1",
+  "type": "module",
+  "bin": {
+    "envsync-deploy": "dist/index.js"
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "tsup --config tsup.config.ts",
+    "prepack": "bun run build",
+    "check:pack": "npm pack --dry-run",
+    "test": "bun run build && bun test"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/EnvSync-Cloud/envsync.git",
+    "directory": "packages/deploy"
+  },
+  "homepage": "https://github.com/EnvSync-Cloud/envsync/tree/main/packages/deploy#readme",
+  "bugs": {
+    "url": "https://github.com/EnvSync-Cloud/envsync/issues"
+  },
+  "author": "EnvSync Cloud",
+  "license": "MIT",
+  "keywords": [
+    "envsync",
+    "deploy",
+    "self-hosted",
+    "docker-swarm",
+    "cli",
+    "secrets",
+    "oss"
+  ],
+  "dependencies": {
+    "chalk": "^5.6.2",
+    "yaml": "^2.8.1",
+    "zod": "^3.25.76"
+  },
+  "devDependencies": {
+    "tsup": "^8.5.0",
+    "typescript": "^5.9.2"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}