@flisk-sh/flisk 0.0.0-stage → 1.3.190

package/engine/topologies/platform/docker/layers/infisical/index.star

@@ -0,0 +1,42 @@
+# Copyright (c) 2026 Flisk Landscape contributors
+# SPDX-License-Identifier: MIT
+# =============================================================================
+# 🔐 INFISICAL DOCKER LAYERS - Master Index
+# =============================================================================
+# Centralizes all Infisical-related Docker layer functionality
+# =============================================================================
+#
+# This module provides:
+#   - Dockerfile generation for Infisical integration
+#   - Secret injection at runtime (L4 layers)
+#   - CLI setup at build time (L3 layers)
+#   - Prisma migrator secret resolution
+#
+# Usage:
+#   load("./infisical/index.star", "InfisicalLayers")
+#   
+#   # Runtime setup
+#   dockerfile_snippet = InfisicalLayers.Docker.runtime_setup("my-service")
+#   
+#   # Builder setup  
+#   builder_snippet = InfisicalLayers.Docker.builder_setup(use_infisical=True)
+#   
+#   # Environment for docker-compose
+#   env = InfisicalLayers.Docker.generate_compose_env("my-service")
+# =============================================================================
+
+# Load all Infisical Docker submodules
+load("./infisical_docker.star", "InfisicalDocker")
+
+# =============================================================================
+# Exports
+# =============================================================================
+
+InfisicalLayers = struct(
+    # Main Docker integration
+    Docker=InfisicalDocker,
+    
+    # Constants
+    ENTRYPOINT_PATH=InfisicalDocker.ENTRYPOINT_PATH,
+    ENTRYPOINT_SOURCE=InfisicalDocker.ENTRYPOINT_SOURCE,
+)

package/engine/topologies/platform/docker/layers/infisical/infisical_docker.star

@@ -0,0 +1,264 @@
+# Copyright (c) 2026 Flisk Landscape contributors
+# SPDX-License-Identifier: MIT
+# =============================================================================
+# 🔐 INFISICAL DOCKER INTEGRATION
+# =============================================================================
+# Replaces: Hardcoded infisical-entrypoint.sh references in Dockerfile generation
+# Uses: Starlark generators for secret configuration
+# =============================================================================
+#
+# This module provides:
+#   - Dockerfile generation for Infisical secret injection
+#   - Environment variable configuration using Starlark generators
+#   - Entrypoint setup with proper secret paths
+#
+# Usage:
+#   load("./infisical_docker.star", "InfisicalDocker")
+#   dockerfile_snippet = InfisicalDocker.runtime_setup("my-service", "/services/my-service")
+# =============================================================================
+
+# Load the generators
+load("../../../../tilt/generators/infisical/secrets_generator.star", _Secrets="SecretsGenerator")
+load("../../../../tilt/generators/infisical/path_manager.star", _Paths="PathManager")
+
+# =============================================================================
+# Constants
+# =============================================================================
+
+ENTRYPOINT_PATH = "/entrypoint.sh"
+ENTRYPOINT_SOURCE = "shared-platform-engineering/docker-templates/infisical-entrypoint.sh"
+
+# =============================================================================
+# Runtime Secret Injection (L4 Runtime Layers)
+# =============================================================================
+
+def _runtime_setup(resource_name, secret_path=None, resource_type="backend", command="bun run start", use_entrypoint=True):
+    """
+    Generate Dockerfile snippet for Infisical runtime setup.
+    
+    Args:
+        resource_name: Name of the service
+        secret_path: Infisical path (default: auto-generated from resource_name)
+        resource_type: Type of service (backend, frontend, worker, etc.)
+        command: Command to run after secret injection
+        use_entrypoint: Whether to use entrypoint.sh (default: True)
+    
+    Returns:
+        String with Dockerfile commands for runtime setup
+    """
+    # Auto-generate secret path if not provided
+    if not secret_path:
+        path_plan = _Paths.plan_resource_path(resource_name, resource_type)
+        secret_path = path_plan["full_path"]
+    
+    # Generate configuration using the Starlark generator
+    config = _Secrets.generate_for_service(
+        resource_name=resource_name,
+        secret_path=secret_path,
+        resource_type=resource_type,
+        command=command,
+    )
+    
+    # Extract environment variables from the config
+    env_vars = config["docker_compose"]["environment"]
+    
+    parts = []
+    
+    if use_entrypoint:
+        # Copy entrypoint script
+        parts.append("COPY --chmod=0755 {} {}\n".format(ENTRYPOINT_SOURCE, ENTRYPOINT_PATH))
+        
+        # Set environment variables
+        for key, value in env_vars.items():
+            # Handle env var references properly
+            if value.startswith("${") and value.endswith("}"):
+                parts.append("ENV {}={}\n".format(key, value))
+            else:
+                parts.append("ENV {}=\"{}\"\n".format(key, value))
+        
+        # Set RESOURCE_NAME explicitly
+        parts.append("ENV RESOURCE_NAME={}\n".format(resource_name))
+        
+        # Set entrypoint
+        parts.append("ENTRYPOINT [\"{}\"]\n".format(ENTRYPOINT_PATH))
+        
+        # Set command
+        cmd_parts = command.split()
+        cmd_json = ", ".join(["\"{}\"".format(p) for p in cmd_parts])
+        parts.append("CMD [{}]\n".format(cmd_json))
+    else:
+        # Without entrypoint, just set env vars and use direct command
+        for key, value in env_vars.items():
+            parts.append("ENV {}={}\n".format(key, value))
+        parts.append("CMD [\"{}\"]\n".format(command))
+    
+    return "".join(parts)
+
+def _runtime_setup_simple(resource_name, use_entrypoint=True):
+    """
+    Simple runtime setup using known service configuration.
+    
+    Args:
+        resource_name: Name of the service
+        use_entrypoint: Whether to use entrypoint.sh
+    
+    Returns:
+        String with Dockerfile commands
+    """
+    # Try to get known path
+    secret_path = _Paths.get_known_resource_path(resource_name)
+    
+    if not secret_path:
+        # Plan a new path
+        path_plan = _Paths.plan_resource_path(resource_name)
+        secret_path = path_plan["full_path"]
+    
+    return _runtime_setup(
+        resource_name=resource_name,
+        secret_path=secret_path,
+        use_entrypoint=use_entrypoint,
+    )
+
+# =============================================================================
+# Builder Secret Injection (L3 Builder Layers)
+# =============================================================================
+
+def _builder_setup(use_infisical=True, use_golden=True):
+    """
+    Generate Dockerfile snippet for builder Infisical CLI setup.
+    
+    Args:
+        use_infisical: Whether to include Infisical CLI setup
+        use_golden: Whether using golden image (skips CLI install)
+    
+    Returns:
+        String with Dockerfile commands for builder setup
+    """
+    if not use_infisical or use_golden:
+        return ""
+    
+    # Only install Infisical CLI if not skipped AND not using golden image
+    return (
+        "# Conditionally install Infisical CLI only if not skipped\n"
+        + "RUN if [ \"$SKIP_INFISICAL_SETUP\" != \"1\" ]; then \\\n"
+        + "        echo \"\u26a0\ufe0f Installing Infisical CLI...\" && \\\n"
+        + "        apk add --no-cache bash curl netcat-openbsd && \\\n"
+        + "        curl -sL https://dl.cloudsmith.io/public/infisical/infisical-cli/setup.alpine.sh | bash && \\\n"
+        + "        apk add --no-cache infisical; \\\n"
+        + "    else \\\n"
+        + "        echo \"\u2705 Skipping Infisical CLI installation (SKIP_INFISICAL_SETUP=1)\"; \\\n"
+        + "    fi\n"
+        + "COPY --chmod=0755 {} {}\n".format(ENTRYPOINT_SOURCE, ENTRYPOINT_PATH)
+    )
+
+# =============================================================================
+# Environment Variable Generation (for docker-compose)
+# =============================================================================
+
+def _generate_compose_env(resource_name, secret_path=None, resource_type="backend", additional_vars=None):
+    """
+    Generate environment variables for docker-compose.
+    
+    Args:
+        resource_name: Name of the service
+        secret_path: Infisical path
+        resource_type: Type of service
+        additional_vars: Additional environment variables
+    
+    Returns:
+        Dict of environment variables for docker-compose
+    """
+    if not secret_path:
+        secret_path = _Paths.get_known_resource_path(resource_name)
+        if not secret_path:
+            path_plan = _Paths.plan_resource_path(resource_name, resource_type)
+            secret_path = path_plan["full_path"]
+    
+    config = _Secrets.generate_for_service(
+        resource_name=resource_name,
+        secret_path=secret_path,
+        resource_type=resource_type,
+    )
+    
+    env = config["docker_compose"]["environment"]
+    
+    if additional_vars:
+        env.update(additional_vars)
+    
+    return env
+
+# =============================================================================
+# Secret Path Resolution (for Prisma/migrators)
+# =============================================================================
+
+def _resolve_secret_path(resource_name, default_subpath="/database"):
+    """
+    Resolve the secret path for database operations.
+    
+    Args:
+        resource_name: Name of the service
+        default_subpath: Default subpath for database secrets
+    
+    Returns:
+        String with the full secret path
+    """
+    base_path = _Paths.get_known_resource_path(resource_name)
+    
+    if not base_path:
+        path_plan = _Paths.plan_resource_path(resource_name)
+        base_path = path_plan["full_path"]
+    
+    return "{}{}".format(base_path, default_subpath)
+
+def _generate_migrator_env(resource_name, db_name=None):
+    """
+    Generate environment variables for database migrator.
+    
+    Args:
+        resource_name: Name of the service
+        db_name: Database name (optional)
+    
+    Returns:
+        Dict of environment variables
+    """
+    secret_path = _resolve_secret_path(resource_name)
+    
+    env = {
+        "RESOURCE_NAME": resource_name,
+        "INFISICAL_SECRET_PATH": secret_path,
+        "INFISICAL_TOKEN": "${INFISICAL_TOKEN:-}",
+        "INFISICAL_CLIENT_ID": "${INFISICAL_CLIENT_ID:-}",
+        "INFISICAL_CLIENT_SECRET": "${INFISICAL_CLIENT_SECRET:-}",
+        "INFISICAL_API_URL": "${INFISICAL_API_URL:-http://infisical:8080}",
+        "INFISICAL_PROJECT_ID": "${INFISICAL_PROJECT_ID:-}",
+        "INFISICAL_ENVIRONMENT": "${INFISICAL_ENVIRONMENT:-dev}",
+    }
+    
+    if db_name:
+        env["DATABASE_NAME"] = db_name
+    
+    return env
+
+# =============================================================================
+# Main Public API
+# =============================================================================
+
+InfisicalDocker = struct(
+    # Runtime setup (L4 layers)
+    runtime_setup=_runtime_setup,
+    runtime_setup_simple=_runtime_setup_simple,
+    
+    # Builder setup (L3 layers)
+    builder_setup=_builder_setup,
+    
+    # Environment generation
+    generate_compose_env=_generate_compose_env,
+    generate_migrator_env=_generate_migrator_env,
+    
+    # Path resolution
+    resolve_secret_path=_resolve_secret_path,
+    
+    # Constants
+    ENTRYPOINT_PATH=ENTRYPOINT_PATH,
+    ENTRYPOINT_SOURCE=ENTRYPOINT_SOURCE,
+)

package/engine/topologies/platform/docker/layers/l1_base_layers.star

@@ -0,0 +1,89 @@
+# Copyright (c) 2026 Flisk contributors
+# SPDX-License-Identifier: MIT
+"""
+L1 Base Layers - OS and Runtime Environment Foundation
+
+Provides the foundational layers for all Dockerfiles:
+- l1_os_base: Alpine Linux base with essential tools
+- l1_runtime_env: Runtime environment variables
+"""
+
+BUN_BASE = "oven/bun:1.3.11-alpine"
+ALPINE_BASE = "alpine:3.22"
+load('../../../../../discovery/config.star', 'GLOBAL_CONFIG')
+
+# Load project name for dynamic golden image naming
+# Use TDK_PROJECT_ROOT env var set by Tilt, fallback to current directory
+def _load_golden_prefix():
+    project_root = os.environ.get('TDK_PROJECT_ROOT', '')
+    project_json_path = '.tdk/project.json'
+    if project_root:
+        project_json_path = project_root + '/' + project_json_path
+    
+    if os.path.exists(project_json_path):
+        _project_json = read_json(project_json_path)
+        return _project_json.get('project', {}).get('name', 'tdk-project')
+    return 'tdk-project'
+
+_GOLDEN_PREFIX = _load_golden_prefix()
+
+GOLDEN_L1_IMAGE = GLOBAL_CONFIG['docker'].get('golden_l1_image', _GOLDEN_PREFIX + '-l1:latest')
+
+
+def L1_generate_os_base(base_image = None, maintainer = None, use_golden = True):
+    """
+    Generate the OS base layer with Alpine Linux and essential tools.
+
+    Args:
+        base_image: Base image to use (default: {prefix}-l1:latest if use_golden=True, else Alpine 3.18)
+        maintainer: Maintainer label (default: project name from project.json)
+        use_golden: Whether to use the golden L1 image (default: True)
+
+    Returns:
+        Dockerfile content string for the l1_os_base stage
+    """
+    if base_image == None:
+        base_image = GOLDEN_L1_IMAGE if use_golden else ALPINE_BASE
+
+    # Set default maintainer from project name
+    if maintainer == None:
+        maintainer = _GOLDEN_PREFIX
+
+    # If using golden L1 image, skip dependency installation (already in base)
+    if base_image == GOLDEN_L1_IMAGE or _GOLDEN_PREFIX + "-l1" in base_image:
+        return (
+            "# ---- L1: os_base (Golden L1: " + base_image + ") ----\n"
+            + "FROM " + base_image + " AS l1_os_base\n"
+            + "# OS dependencies pre-installed in golden L1 image\n"
+            + "WORKDIR /app\n"
+        )
+    
+    # Standard base with dependency installation
+    return (
+        "# ---- L1: os_base (" + base_image + ") ----\n"
+        + "FROM " + base_image + " AS l1_os_base\n"
+        + "LABEL maintainer=\"" + maintainer + "\"\n"
+        + "RUN apk add --no-cache ca-certificates tzdata curl bash openssl \\\n"
+        + "    && addgroup -S app && adduser -S app -G app\n"
+        + "WORKDIR /app\n"
+    )
+
+
+def L1_generate_runtime_env(envs = None):
+    """
+    Generate the runtime environment variables layer.
+    
+    Args:
+        envs: Dictionary of environment variables (default: production settings)
+    
+    Returns:
+        Dockerfile content string for the l1_runtime_env stage
+    """
+    if envs == None:
+        envs = {"NODE_ENV": "production", "BUN_INSTALL_CACHE_DIR": "/cache/bun"}
+    parts = ["# ---- L1: runtime_env ----\n", "# Shared runtime environment\n"]
+    for k in envs:
+        parts.append("ENV " + k + "=" + envs[k] + "\n")
+    return "".join(parts)
+
+GLOBAL_CONFIG = {}

package/engine/topologies/platform/docker/layers/l2_dependency_layers.star

@@ -0,0 +1,147 @@
+# Copyright (c) 2026 Flisk contributors
+# SPDX-License-Identifier: MIT
+# === INLINED CONSTANTS for pure extension loading ===
+RUNTIME = "bun"
+# === END INLINED CONSTANTS ===
+
+
+"""
+L2 Dependency Layers - Package Manifest and Dependency Resolution
+
+Handles the dependency layers for efficient Docker caching:
+- l2_dependency_manifest: Copy and install package manifests
+- l2_dependency_resolver: Cache resolved dependencies
+"""
+
+load('./l1_base_layers.star', 'BUN_BASE')
+load('../../../../../discovery/config.star', 'GLOBAL_CONFIG')
+load('../../../tilt/common/utils_debug.star', 'DEBUG_MODE')
+load('../../../tilt/manifest/constants.star', 'AUTOGENERATED_CONFIG_PATHS', 'GENERATED_CONFIG_FILENAMES')
+
+
+# Load project name for dynamic golden image naming
+# Use TDK_PROJECT_ROOT env var set by Tilt, fallback to current directory
+def _load_golden_prefix():
+    project_root = os.environ.get('TDK_PROJECT_ROOT', '')
+    project_json_path = '.tdk/project.json'
+    if project_root:
+        project_json_path = project_root + '/' + project_json_path
+    
+    if os.path.exists(project_json_path):
+        _project_json = read_json(project_json_path)
+        return _project_json.get('project', {}).get('name', 'tdk-project')
+    return 'tdk-project'
+
+_GOLDEN_PREFIX = _load_golden_prefix()
+
+GOLDEN_L2_IMAGE = GLOBAL_CONFIG['docker'].get('golden_l2_image', _GOLDEN_PREFIX + '-l2:latest')
+
+
+def normalize_res_path(res_path):
+    """Normalize resource path for Docker COPY commands.
+    
+    Docker COPY requires paths relative to the build context (project root).
+    Absolute filesystem paths must become project-relative (including ../sibling).
+    Never strip only the leading '/' — that turns
+    `/private/var/.../platform/verdaccio` into a fake in-repo path.
+    
+    Args:
+        res_path: Resource path (may be absolute or relative)
+    
+    Returns:
+        Normalized relative path for Docker COPY
+    """
+    if not res_path:
+        return res_path
+    if not res_path.startswith('/'):
+        return res_path
+    project_root = os.environ.get('TDK_PROJECT_ROOT', '.')
+    cmd = (
+        "python3 -c \"import os; print(os.path.relpath(os.path.realpath('''" +
+        res_path +
+        "'''), os.path.realpath('''" +
+        project_root +
+        "''')))\""
+    )
+    relative = str(local(cmd, quiet=True, echo_off=True)).strip()
+    if relative:
+        return relative
+    root_prefix = project_root.rstrip('/') + '/'
+    if res_path.startswith(root_prefix):
+        return res_path[len(root_prefix):]
+    return res_path[1:]
+
+
+def L2_generate_dependency_manifest(res_path, manager = RUNTIME, use_golden = True):
+    """
+    Generate the dependency manifest layer that copies package files.
+    This layer is cached independently for faster builds.
+    
+    Args:
+        res_path: Resource path (service directory)
+        manager: Package manager to use (default: RUNTIME from master config)
+        use_golden: Whether to use golden L2 image (default: True)
+    
+    Returns:
+        Dockerfile content string for the l2_deps_manifest stage
+    """
+    # Normalize res_path for Docker COPY (must be relative to build context)
+    res_path_rel = normalize_res_path(res_path)
+
+    # Prefer golden L2 image when enabled and defined; fall back to plain Bun image.
+    base_image = GOLDEN_L2_IMAGE if (use_golden and GOLDEN_L2_IMAGE) else BUN_BASE
+    use_golden_for_manifest = base_image == GOLDEN_L2_IMAGE
+    debug_tools_install = "" if use_golden_for_manifest else "# Install debugging tools for troubleshooting\nRUN echo '🔧 Installing debug tools...' && apk add --no-cache curl netcat-openbsd jq bind-tools vim && echo '✅ Debug tools installed'\n"
+
+    diagnostics_block = """
+# Comprehensive pre-flight diagnostics (debug mode)
+RUN echo '🔍 DEPENDENCY INSTALLATION DIAGNOSTICS (debug)' && \\
+    echo "Bun version: $(bun --version)" && \\
+    echo "Lock files:" && ls -lh bun.lock* 2>/dev/null && \\
+    echo "Cache dir:" && ls -lh /cache/bun 2>/dev/null || true
+"""
+    if not DEBUG_MODE:
+        diagnostics_block = "# Diagnostics suppressed (set TILT_DEBUG=true for verbose output)\n"
+
+    install_deps_verbose = "INSTALL_DEPS_VERBOSE=1 " if DEBUG_MODE else ""
+
+    return (
+        "# ---- L2: dependency_manifest ----\n"
+        + "FROM " + base_image + " AS l2_deps_manifest\n"
+        + "WORKDIR /app\n"
+        + "\n"
+        + "# Cache-busting mechanism - change this value to force dependency reinstall\n"
+        + "ARG CACHE_BUSTER=2026-06-25-v1\n"
+        + "RUN echo \"Cache buster: ${CACHE_BUSTER}\"\n"
+        + "\n"
+        + debug_tools_install
+        + "\n"
+        + "# Copy workspace root for monorepo resolution\n"
+        + "COPY package.json ./package.json\n"
+        + "COPY " + res_path_rel + "/" + AUTOGENERATED_CONFIG_PATHS['npmrc_docker'] + " /app/.npmrc\n"
+        + "COPY " + res_path_rel + "/" + AUTOGENERATED_CONFIG_PATHS['bunfig_docker'] + " /app/.bunfig.toml\n"
+        + "\n"
+        + "# Copy service manifest files for deterministic dependency layer\n"
+        + "WORKDIR /app/" + res_path + "\n"
+        + "COPY " + res_path_rel + "/package.json ./package.json\n"
+        + "COPY " + res_path_rel + "/" + AUTOGENERATED_CONFIG_PATHS['npmrc_docker'] + " .npmrc\n"
+        + "COPY " + res_path_rel + "/" + AUTOGENERATED_CONFIG_PATHS['bunfig_docker'] + " .bunfig.toml\n"
+        + "\n"
+        + diagnostics_block
+        + "# Install dependencies (quiet by default; set TILT_DEBUG=true for verbose diagnostics)\n"
+        + "COPY shared-platform-engineering/docker-templates/install-deps.sh /usr/local/bin/install-deps.sh\n"
+        # NOTE: sharing=shared allows parallel builds (20+ services) without lock contention.
+        # Bun's cache uses content-addressable storage with atomic writes, so concurrent access is safe.
+        + "RUN --mount=type=cache,target=/cache/bun,sharing=shared chmod +x /usr/local/bin/install-deps.sh && start_ts=$(date +%s) && "
+        + install_deps_verbose
+        + "/usr/local/bin/install-deps.sh && end_ts=$(date +%s) && echo \"install-deps duration: $((end_ts-start_ts))s\"\n"
+        # Guarantee /app/node_modules/.bun exists so L3's COPY --link never
+        # fails with "not found". Bun's isolated linker only creates this dir
+        # when hoisted packages are present; without TDK_LICENSE_KEY the public-
+        # npm install may skip it entirely.
+        + "RUN mkdir -p /app/node_modules/.bun\n"
+    )
+
+DEBUG = {}
+
+GLOBAL_CONFIG = {}