@gambi97/keel-cli 0.3.6 → 0.4.0

package/README.md

@@ -207,16 +207,16 @@ Environments are separated with **Terraform workspaces**: same code, one
 independent state per environment in one bucket, differences confined to the
 per-environment `<env>.tfvars` files.
 
-| Data                                | Lives in                 | Why                                                                                  |
-| ----------------------------------- | ------------------------ | ------------------------------------------------------------------------------------ |
-| Scaleway API keys                   | GitHub encrypted secrets | CI needs them to run Terraform                                                       |
-| Infisical machine identity          | GitHub encrypted secrets | Lets Terraform read app secrets at plan/apply                                        |
-| Basic Auth user/password            | Infisical (non-prod)     | App secret, injected into the container, rotatable                                   |
-| Database connection string          | Infisical (each env)     | Complete, ready-to-use value synced by the pipeline after each apply                 |
-| App public URL (`APP_URL`)          | Infisical (each env)     | Synced by the pipeline once a container exists; for links, OAuth callbacks, webhooks |
-| Object Storage coordinates (opt-in) | Infisical (each env)     | `S3_*` values synced by the pipeline after each apply                                |
-| Bucket, region, Infisical project   | GitHub variables         | Non-sensitive wiring, editable in one place                                          |
-| Project name, scaling, image        | Committed tfvars         | Reviewable configuration, no secrets                                                 |
+| Data                                | Lives in                 | Why                                                                                                                                                       |
+| ----------------------------------- | ------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Scaleway API keys                   | GitHub encrypted secrets | CI needs them to run Terraform                                                                                                                            |
+| Infisical machine identity          | GitHub encrypted secrets | Lets Terraform read app secrets at plan/apply                                                                                                             |
+| Basic Auth user/password            | Infisical (non-prod)     | App secret, injected into the container, rotatable                                                                                                        |
+| Database connection string          | Infisical (each env)     | Complete, ready-to-use value synced by the pipeline after each apply                                                                                      |
+| App public URL (`APP_URL`)          | Infisical (each env)     | Synced by the pipeline after each apply (real from the first one — the container starts on keel's placeholder page); for links, OAuth callbacks, webhooks |
+| Object Storage coordinates (opt-in) | Infisical (each env)     | `S3_*` values synced by the pipeline after each apply                                                                                                     |
+| Bucket, region, Infisical project   | GitHub variables         | Non-sensitive wiring, editable in one place                                                                                                               |
+| Project name, scaling, image        | Committed tfvars         | Reviewable configuration, no secrets                                                                                                                      |
 
 ## After the bootstrap
 
@@ -263,6 +263,12 @@ creating anything**.
    `ContainersFullAccess`, `ServerlessSQLDatabaseFullAccess`,
    `ContainerRegistryFullAccess`, plus `IAMManager` so Terraform can create
    the app's dedicated least-privilege database credential).
+5. **Organization security settings — API-key expiration must be unlimited**
+   (Console → Organization → Security → API keys). The app's database and
+   Object Storage credentials are non-expiring service credentials by design
+   (the container reads them at runtime); if your organization forces API
+   keys to expire, the first CI apply fails creating them. keel checks this
+   setting during validation and warns before anything is created.
 
 </details>
 
@@ -273,7 +279,9 @@ creating anything**.
 1. Create an account at [app.infisical.com](https://app.infisical.com) (or
    use a self-hosted instance).
 2. Create a **Machine Identity** with **Universal Auth**: you need its
-   **client ID** and **client secret**.
+   **client ID** and **client secret**. Create the client secret with
+   **unlimited uses** (Max Number of Uses = 0): CI logs in with it on every
+   plan/apply, so any finite usage limit eventually runs out mid-pipeline.
 3. Give the identity permission to create and manage projects.
 
 </details>

package/dist/bootstrap/infisical.js

@@ -30,8 +30,15 @@ export async function login(infisical) {
     const { host, clientId, clientSecret } = infisical;
     const { status, data } = await api(host, '/api/v1/auth/universal-auth/login', { method: 'POST', body: { clientId, clientSecret } });
     if (status !== 200 || !data.accessToken) {
-        throw new InfisicalError(`Infisical Universal Auth login failed (HTTP ${status}${data.message ? `: ${data.message}` : ''}). ` +
-            'Check the machine identity client ID/secret and that Universal Auth is enabled.');
+        // A usage-limited client secret is a trap for this setup: besides the
+        // bootstrap, CI logs in with it on every plan/apply, so any finite limit
+        // eventually runs out. Name the fix instead of a generic "check secret".
+        const remediation = /usage limit/i.test(data.message ?? '')
+            ? 'This client secret was created with a usage limit and it is spent. Create a new one ' +
+                'with unlimited uses (Max Number of Uses = 0): CI logs in with it on every plan/apply, ' +
+                'so a limited secret will always run out.'
+            : 'Check the machine identity client ID/secret and that Universal Auth is enabled.';
+        throw new InfisicalError(`Infisical Universal Auth login failed (HTTP ${status}${data.message ? `: ${data.message}` : ''}). ${remediation}`);
     }
     return data.accessToken;
 }

package/dist/bootstrap/scaleway.js

@@ -7,10 +7,38 @@ export class ScalewayError extends Error {
     }
 }
 const API_BASE = 'https://api.scaleway.com';
+/**
+ * The generated stack creates non-expiring service credentials (the app's
+ * database and Object Storage API keys are read by the container at runtime).
+ * An organization security setting that forces API-key expiration makes the
+ * very first CI apply fail — hours after the bootstrap looked green. Read the
+ * setting here (read-only) so the run can warn upfront, while it is still a
+ * 30-second console fix. Returns undefined when the key cannot read it.
+ */
+async function apiKeyExpirationPolicyWarning(secretKey, organizationId) {
+    try {
+        const response = await fetch(`${API_BASE}/iam/v1alpha1/organizations/${organizationId}/security-settings`, { headers: { 'X-Auth-Token': secretKey } });
+        if (!response.ok)
+            return undefined;
+        const settings = (await response.json());
+        const seconds = Number.parseInt(settings.max_api_key_expiration_duration ?? '0', 10);
+        if (!Number.isFinite(seconds) || seconds <= 0)
+            return undefined; // "0s" = unlimited
+        return ('Your Scaleway organization requires API keys to expire ' +
+            `(max ${Math.round(seconds / 86400)} days). The database/storage credentials the ` +
+            'generated stack creates are non-expiring service credentials, so the first CI apply ' +
+            'WILL fail on them. Disable the requirement first (Console → Organization → Security → ' +
+            'API keys), then merge or re-run the apply.');
+    }
+    catch {
+        return undefined;
+    }
+}
 /**
  * Validate credentials with a harmless read call before creating anything.
  * Also confirms the project belongs to the given organization. Read-only: it
- * proves the key can see the project, not that it can create resources.
+ * proves the key can see the project, not that it can create resources. The
+ * returned warning flags an org policy that would break the first CI apply.
  */
 export async function validateScalewayCredentials(scaleway) {
     const { secretKey, projectId, organizationId } = scaleway;
@@ -32,6 +60,8 @@ export async function validateScalewayCredentials(scaleway) {
         throw new ScalewayError(`Scaleway project ${projectId} belongs to organization ${project.organization_id}, ` +
             `not ${organizationId}. Check --scw-organization-id.`, 'organization');
     }
+    const warning = await apiKeyExpirationPolicyWarning(secretKey, organizationId);
+    return warning ? { warning } : {};
 }
 const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 /**

package/dist/contracts.js

@@ -43,6 +43,21 @@ export const BASE_SYNCED_KEYS = ['DATABASE_URL', 'APP_URL'];
  */
 export const BASIC_AUTH_SECRET_KEYS = ['BASIC_AUTH_USER', 'BASIC_AUTH_PASSWORD'];
 export const BASIC_AUTH_FLAG = 'BASIC_AUTH_ENABLED';
+/**
+ * Public image rendered as the default container_image in every generated
+ * <env>.tfvars: the very first apply brings a keel-branded page up, so
+ * APP_URL is real from day zero. Built and pushed by the Placeholder image
+ * workflow from placeholder/ in this repo; it is also the reference
+ * implementation of the env contract (PROJECT_NAME, APP_ENVIRONMENT,
+ * BASIC_AUTH_*). Users replace it by editing container_image — or set ""
+ * to skip the container entirely.
+ */
+export const PLACEHOLDER_IMAGE = 'ghcr.io/gambi97/keel-placeholder:v1';
+/**
+ * Plain environment variables the generated app_stack injects into the
+ * container, so any image (the placeholder first) knows what it runs as.
+ */
+export const CONTAINER_ENV_KEYS = ['PROJECT_NAME', 'APP_ENVIRONMENT'];
 /**
  * Naming convention for per-environment resources (registry, namespaces,
  * database, buckets…): mirrored by `local.name` in the app_stack template,

package/dist/generate.js

@@ -2,7 +2,7 @@ import { spawnSync } from 'node:child_process';
 import { chmodSync, cpSync, existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync, } from 'node:fs';
 import { join } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { CONTRACT_VERSION } from './contracts.js';
+import { CONTRACT_VERSION, PLACEHOLDER_IMAGE } from './contracts.js';
 import { toolVersion } from './meta.js';
 import { STATE_FILE } from './state.js';
 export class GenerateError extends Error {
@@ -85,6 +85,7 @@ function envTfvarsTokens(answers, env) {
         __ENABLE_OBJECT_STORAGE__: String(answers.objectStorage),
         __MIN_SCALE__: String(env.minScale),
         __MAX_SCALE__: String(env.maxScale),
+        __CONTAINER_IMAGE__: PLACEHOLDER_IMAGE,
     };
 }
 /**

package/dist/index.js

@@ -298,8 +298,9 @@ async function runBootstrap(answers, state, options) {
     else {
         // All three credentials are checked before anything is created anywhere,
         // so a bad token cannot leave a half-bootstrapped account behind.
+        let scalewayWarning;
         await withSpinner('Validating Scaleway, Infisical and GitHub credentials', async () => {
-            await validateScalewayCredentials(answers.scaleway);
+            scalewayWarning = (await validateScalewayCredentials(answers.scaleway)).warning;
             await validateInfisical(answers.infisical);
             ctx = await createContext(answers.github);
             // A repo with commits would make the push fail after the bucket and the
@@ -310,6 +311,8 @@ async function runBootstrap(answers, state, options) {
                 assertRepoUsable(ctx, repoState);
             }
         });
+        if (scalewayWarning)
+            log.warn(scalewayWarning);
     }
     for (const step of BOOTSTRAP_STEPS) {
         if (isDone(state, step.name)) {

package/dist/prompts.js

@@ -358,11 +358,16 @@ async function askScaleway(out) {
             out.scaleway.organizationId = await text('Scaleway organization ID');
         }
         try {
-            await validateScalewayCredentials({
+            const { warning } = await validateScalewayCredentials({
                 secretKey: out.scaleway.secretKey,
                 projectId: out.scaleway.projectId,
                 organizationId: out.scaleway.organizationId,
             });
+            // e.g. an org policy that would make the first CI apply fail: better a
+            // loud heads-up now, while it is a 30-second console fix, than a red
+            // pipeline hours after everything here looked green.
+            if (warning)
+                log.warn(warning);
             p.outro('Scaleway connected — credentials valid and project reachable.');
             return;
         }

package/dist/ui.js

@@ -75,14 +75,14 @@ export function renderNextSteps(answers, repoUrl, containerUrlHint) {
     return [
         'Next steps:',
         '',
-        `  1. Add a Dockerfile to your application and push its image to the`,
-        `     registry created by the first pipeline run (${containerUrlHint}).`,
+        `  1. Push to main (or merge a PR) to deploy the non-production environments:`,
+        `     ${repoUrl}/actions — the first apply already serves keel's placeholder`,
+        `     page, so APP_URL is live from day zero.`,
         `  2. Replace the placeholder secrets in Infisical (${answers.infisical.host})`,
         `     project "${answers.infisical.projectName}" with real values.`,
-        `  3. Push to main (or merge a PR) to deploy the non-production environments:`,
-        `     ${repoUrl}/actions`,
-        `  4. Set container_image in ${answers.environments.map((e) => `${e.slug}.tfvars`).join(' / ')} once an image exists.`,
-        `  5. Release to production with a version tag: git tag v1.0.0 && git push --tags`,
+        `  3. Ship your app: push its image to the registry (${containerUrlHint}),`,
+        `     then point container_image at it in ${answers.environments.map((e) => `${e.slug}.tfvars`).join(' / ')}.`,
+        `  4. Release to production with a version tag: git tag v1.0.0 && git push --tags`,
         '',
         `Repository: ${repoUrl}`,
     ].join('\n');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gambi97/keel-cli",
-  "version": "0.3.6",
+  "version": "0.4.0",
   "description": "One command from zero to a production-shaped serverless infrastructure on Scaleway (Terraform + GitHub Actions + Infisical). Only Node required.",
   "keywords": [
     "keel",

package/templates/README.md

@@ -65,11 +65,13 @@ tag vX.Y.Z        -> apply production (the commit the tag points at)
 
 ## First deploy
 
-1. **Merge or push to `main`.** The first pipeline run creates registry and
-   databases for the non-production environments (and the Object Storage
-   bucket, if enabled). The Serverless Container is intentionally skipped until
-   an image exists (`container_image` is empty), so the first apply is green.
-   Production waits for a version tag (step 5).
+1. **Merge or push to `main`.** The first pipeline run creates the registry,
+   the database and a Serverless Container for each non-production
+   environment (and the Object Storage bucket, if enabled). The container
+   starts on **keel's placeholder page** (`container_image` in the tfvars), so
+   `terraform output container_url` — and the `APP_URL` secret — are real from
+   day zero. Production waits for a version tag (step 5). Setting
+   `container_image = ""` skips the container entirely.
 
 2. **Build and push the app image** (any Dockerfile, listening on port 8080
    by default), replacing `<env>` with your target environment (e.g. staging):
@@ -91,7 +93,7 @@ tag vX.Y.Z        -> apply production (the commit the tag points at)
    | Variable | Where | Notes |
    |---|---|---|
    | `DATABASE_URL` | every environment | Complete connection string, auto-updated by the pipeline after each apply. No action needed |
-   | `APP_URL` | every environment | Public URL of the app, auto-updated by the pipeline once a container exists. Useful for links, OAuth callbacks, webhooks |
+   | `APP_URL` | every environment | Public URL of the app, auto-updated by the pipeline after each apply (real from the first one — the placeholder counts). Useful for links, OAuth callbacks, webhooks |
    | `BASIC_AUTH_USER` / `BASIC_AUTH_PASSWORD` | non-production | The app must enforce these when `BASIC_AUTH_ENABLED=true` |
    | `S3_BUCKET` / `S3_ENDPOINT` / `S3_REGION` / `S3_ACCESS_KEY` / `S3_SECRET_KEY` | every environment (if Object Storage enabled) | Auto-updated by the pipeline after each apply |
 
@@ -209,7 +211,15 @@ Avoid local applies: they race against CI on the same state.
   match a Scaleway key with Object Storage access.
 - **Plan fails reading Infisical secrets**: check `INFISICAL_PROJECT_ID` and
   that the machine identity has access to the project and every environment.
-- **Apply green but no container**: expected until `container_image` is set.
+  If the error mentions a **usage limit**, the machine identity's client
+  secret was created with a maximum number of uses and it is spent: create a
+  new client secret with unlimited uses (the pipeline logs in on every
+  plan/apply) and update the `INFISICAL_CLIENT_SECRET` Actions secret.
+- **Apply green but no container**: expected only when `container_image` is
+  `""`; by default every environment serves keel's placeholder page.
+- **The app answers 401**: non-production environments enforce Basic Auth by
+  default — the credentials are `BASIC_AUTH_USER` / `BASIC_AUTH_PASSWORD` in
+  that environment's Infisical secrets.
 - **App can't reach the database**: `DATABASE_URL` is only synced after an
   apply; check the value in Infisical for that environment. It must contain
   a username and password (the dedicated IAM credential), not placeholders.

package/templates/env.tfvars

@@ -6,3 +6,8 @@ enable_basic_auth     = __ENABLE_BASIC_AUTH__
 enable_object_storage = __ENABLE_OBJECT_STORAGE__
 min_scale             = __MIN_SCALE__
 max_scale             = __MAX_SCALE__
+
+# The image this environment runs. Starts as keel's placeholder page so the
+# first apply brings a container up and APP_URL is real; replace it with your
+# application's image when ready ("" skips the container entirely).
+container_image = "__CONTAINER_IMAGE__"

package/templates/modules/app_stack/main.tf

@@ -81,9 +81,9 @@ resource "scaleway_iam_api_key" "storage" {
   description    = "Object Storage credential for ${local.name} (managed by Terraform)"
 }
 
-# The container is gated on an image being available: registry and database
-# are provisioned first, the container appears once an image has been pushed
-# and container_image is set.
+# The container runs whatever image the tfvars point at — keel's placeholder
+# page at first, the application once its image is pushed. Setting
+# container_image = "" skips the container entirely.
 resource "scaleway_container" "this" {
   count = var.container_image == "" ? 0 : 1
 
@@ -97,9 +97,15 @@ resource "scaleway_container" "this" {
   max_scale          = var.max_scale
   privacy            = "public"
 
-  environment_variables = var.enable_basic_auth ? {
-    BASIC_AUTH_ENABLED = "true"
-  } : {}
+  # Plain identity variables any image can rely on; the placeholder renders
+  # them, real apps are free to ignore them.
+  environment_variables = merge(
+    {
+      PROJECT_NAME    = var.project_name
+      APP_ENVIRONMENT = var.environment
+    },
+    var.enable_basic_auth ? { BASIC_AUTH_ENABLED = "true" } : {},
+  )
 
   # BASIC_AUTH_USER / BASIC_AUTH_PASSWORD / DATABASE_URL arrive here from
   # Infisical; the app is responsible for enforcing Basic Auth when enabled.