@gambi97/keel-cli 0.3.7 → 0.4.0

package/README.md

@@ -207,16 +207,16 @@ Environments are separated with **Terraform workspaces**: same code, one
 independent state per environment in one bucket, differences confined to the
 per-environment `<env>.tfvars` files.
 
-| Data                                | Lives in                 | Why                                                                                  |
-| ----------------------------------- | ------------------------ | ------------------------------------------------------------------------------------ |
-| Scaleway API keys                   | GitHub encrypted secrets | CI needs them to run Terraform                                                       |
-| Infisical machine identity          | GitHub encrypted secrets | Lets Terraform read app secrets at plan/apply                                        |
-| Basic Auth user/password            | Infisical (non-prod)     | App secret, injected into the container, rotatable                                   |
-| Database connection string          | Infisical (each env)     | Complete, ready-to-use value synced by the pipeline after each apply                 |
-| App public URL (`APP_URL`)          | Infisical (each env)     | Synced by the pipeline once a container exists; for links, OAuth callbacks, webhooks |
-| Object Storage coordinates (opt-in) | Infisical (each env)     | `S3_*` values synced by the pipeline after each apply                                |
-| Bucket, region, Infisical project   | GitHub variables         | Non-sensitive wiring, editable in one place                                          |
-| Project name, scaling, image        | Committed tfvars         | Reviewable configuration, no secrets                                                 |
+| Data                                | Lives in                 | Why                                                                                                                                                       |
+| ----------------------------------- | ------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Scaleway API keys                   | GitHub encrypted secrets | CI needs them to run Terraform                                                                                                                            |
+| Infisical machine identity          | GitHub encrypted secrets | Lets Terraform read app secrets at plan/apply                                                                                                             |
+| Basic Auth user/password            | Infisical (non-prod)     | App secret, injected into the container, rotatable                                                                                                        |
+| Database connection string          | Infisical (each env)     | Complete, ready-to-use value synced by the pipeline after each apply                                                                                      |
+| App public URL (`APP_URL`)          | Infisical (each env)     | Synced by the pipeline after each apply (real from the first one — the container starts on keel's placeholder page); for links, OAuth callbacks, webhooks |
+| Object Storage coordinates (opt-in) | Infisical (each env)     | `S3_*` values synced by the pipeline after each apply                                                                                                     |
+| Bucket, region, Infisical project   | GitHub variables         | Non-sensitive wiring, editable in one place                                                                                                               |
+| Project name, scaling, image        | Committed tfvars         | Reviewable configuration, no secrets                                                                                                                      |
 
 ## After the bootstrap
 

package/dist/contracts.js

@@ -43,6 +43,21 @@ export const BASE_SYNCED_KEYS = ['DATABASE_URL', 'APP_URL'];
  */
 export const BASIC_AUTH_SECRET_KEYS = ['BASIC_AUTH_USER', 'BASIC_AUTH_PASSWORD'];
 export const BASIC_AUTH_FLAG = 'BASIC_AUTH_ENABLED';
+/**
+ * Public image rendered as the default container_image in every generated
+ * <env>.tfvars: the very first apply brings a keel-branded page up, so
+ * APP_URL is real from day zero. Built and pushed by the Placeholder image
+ * workflow from placeholder/ in this repo; it is also the reference
+ * implementation of the env contract (PROJECT_NAME, APP_ENVIRONMENT,
+ * BASIC_AUTH_*). Users replace it by editing container_image — or set ""
+ * to skip the container entirely.
+ */
+export const PLACEHOLDER_IMAGE = 'ghcr.io/gambi97/keel-placeholder:v1';
+/**
+ * Plain environment variables the generated app_stack injects into the
+ * container, so any image (the placeholder first) knows what it runs as.
+ */
+export const CONTAINER_ENV_KEYS = ['PROJECT_NAME', 'APP_ENVIRONMENT'];
 /**
  * Naming convention for per-environment resources (registry, namespaces,
  * database, buckets…): mirrored by `local.name` in the app_stack template,

package/dist/generate.js

@@ -2,7 +2,7 @@ import { spawnSync } from 'node:child_process';
 import { chmodSync, cpSync, existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync, } from 'node:fs';
 import { join } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { CONTRACT_VERSION } from './contracts.js';
+import { CONTRACT_VERSION, PLACEHOLDER_IMAGE } from './contracts.js';
 import { toolVersion } from './meta.js';
 import { STATE_FILE } from './state.js';
 export class GenerateError extends Error {
@@ -85,6 +85,7 @@ function envTfvarsTokens(answers, env) {
         __ENABLE_OBJECT_STORAGE__: String(answers.objectStorage),
         __MIN_SCALE__: String(env.minScale),
         __MAX_SCALE__: String(env.maxScale),
+        __CONTAINER_IMAGE__: PLACEHOLDER_IMAGE,
     };
 }
 /**

package/dist/ui.js

@@ -75,14 +75,14 @@ export function renderNextSteps(answers, repoUrl, containerUrlHint) {
     return [
         'Next steps:',
         '',
-        `  1. Add a Dockerfile to your application and push its image to the`,
-        `     registry created by the first pipeline run (${containerUrlHint}).`,
+        `  1. Push to main (or merge a PR) to deploy the non-production environments:`,
+        `     ${repoUrl}/actions — the first apply already serves keel's placeholder`,
+        `     page, so APP_URL is live from day zero.`,
         `  2. Replace the placeholder secrets in Infisical (${answers.infisical.host})`,
         `     project "${answers.infisical.projectName}" with real values.`,
-        `  3. Push to main (or merge a PR) to deploy the non-production environments:`,
-        `     ${repoUrl}/actions`,
-        `  4. Set container_image in ${answers.environments.map((e) => `${e.slug}.tfvars`).join(' / ')} once an image exists.`,
-        `  5. Release to production with a version tag: git tag v1.0.0 && git push --tags`,
+        `  3. Ship your app: push its image to the registry (${containerUrlHint}),`,
+        `     then point container_image at it in ${answers.environments.map((e) => `${e.slug}.tfvars`).join(' / ')}.`,
+        `  4. Release to production with a version tag: git tag v1.0.0 && git push --tags`,
         '',
         `Repository: ${repoUrl}`,
     ].join('\n');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gambi97/keel-cli",
-  "version": "0.3.7",
+  "version": "0.4.0",
   "description": "One command from zero to a production-shaped serverless infrastructure on Scaleway (Terraform + GitHub Actions + Infisical). Only Node required.",
   "keywords": [
     "keel",

package/templates/README.md

@@ -65,11 +65,13 @@ tag vX.Y.Z        -> apply production (the commit the tag points at)
 
 ## First deploy
 
-1. **Merge or push to `main`.** The first pipeline run creates registry and
-   databases for the non-production environments (and the Object Storage
-   bucket, if enabled). The Serverless Container is intentionally skipped until
-   an image exists (`container_image` is empty), so the first apply is green.
-   Production waits for a version tag (step 5).
+1. **Merge or push to `main`.** The first pipeline run creates the registry,
+   the database and a Serverless Container for each non-production
+   environment (and the Object Storage bucket, if enabled). The container
+   starts on **keel's placeholder page** (`container_image` in the tfvars), so
+   `terraform output container_url` — and the `APP_URL` secret — are real from
+   day zero. Production waits for a version tag (step 5). Setting
+   `container_image = ""` skips the container entirely.
 
 2. **Build and push the app image** (any Dockerfile, listening on port 8080
    by default), replacing `<env>` with your target environment (e.g. staging):
@@ -91,7 +93,7 @@ tag vX.Y.Z        -> apply production (the commit the tag points at)
    | Variable | Where | Notes |
    |---|---|---|
    | `DATABASE_URL` | every environment | Complete connection string, auto-updated by the pipeline after each apply. No action needed |
-   | `APP_URL` | every environment | Public URL of the app, auto-updated by the pipeline once a container exists. Useful for links, OAuth callbacks, webhooks |
+   | `APP_URL` | every environment | Public URL of the app, auto-updated by the pipeline after each apply (real from the first one — the placeholder counts). Useful for links, OAuth callbacks, webhooks |
    | `BASIC_AUTH_USER` / `BASIC_AUTH_PASSWORD` | non-production | The app must enforce these when `BASIC_AUTH_ENABLED=true` |
    | `S3_BUCKET` / `S3_ENDPOINT` / `S3_REGION` / `S3_ACCESS_KEY` / `S3_SECRET_KEY` | every environment (if Object Storage enabled) | Auto-updated by the pipeline after each apply |
 
@@ -213,7 +215,11 @@ Avoid local applies: they race against CI on the same state.
   secret was created with a maximum number of uses and it is spent: create a
   new client secret with unlimited uses (the pipeline logs in on every
   plan/apply) and update the `INFISICAL_CLIENT_SECRET` Actions secret.
-- **Apply green but no container**: expected until `container_image` is set.
+- **Apply green but no container**: expected only when `container_image` is
+  `""`; by default every environment serves keel's placeholder page.
+- **The app answers 401**: non-production environments enforce Basic Auth by
+  default — the credentials are `BASIC_AUTH_USER` / `BASIC_AUTH_PASSWORD` in
+  that environment's Infisical secrets.
 - **App can't reach the database**: `DATABASE_URL` is only synced after an
   apply; check the value in Infisical for that environment. It must contain
   a username and password (the dedicated IAM credential), not placeholders.

package/templates/env.tfvars

@@ -6,3 +6,8 @@ enable_basic_auth     = __ENABLE_BASIC_AUTH__
 enable_object_storage = __ENABLE_OBJECT_STORAGE__
 min_scale             = __MIN_SCALE__
 max_scale             = __MAX_SCALE__
+
+# The image this environment runs. Starts as keel's placeholder page so the
+# first apply brings a container up and APP_URL is real; replace it with your
+# application's image when ready ("" skips the container entirely).
+container_image = "__CONTAINER_IMAGE__"

package/templates/modules/app_stack/main.tf

@@ -81,9 +81,9 @@ resource "scaleway_iam_api_key" "storage" {
   description    = "Object Storage credential for ${local.name} (managed by Terraform)"
 }
 
-# The container is gated on an image being available: registry and database
-# are provisioned first, the container appears once an image has been pushed
-# and container_image is set.
+# The container runs whatever image the tfvars point at — keel's placeholder
+# page at first, the application once its image is pushed. Setting
+# container_image = "" skips the container entirely.
 resource "scaleway_container" "this" {
   count = var.container_image == "" ? 0 : 1
 
@@ -97,9 +97,15 @@ resource "scaleway_container" "this" {
   max_scale          = var.max_scale
   privacy            = "public"
 
-  environment_variables = var.enable_basic_auth ? {
-    BASIC_AUTH_ENABLED = "true"
-  } : {}
+  # Plain identity variables any image can rely on; the placeholder renders
+  # them, real apps are free to ignore them.
+  environment_variables = merge(
+    {
+      PROJECT_NAME    = var.project_name
+      APP_ENVIRONMENT = var.environment
+    },
+    var.enable_basic_auth ? { BASIC_AUTH_ENABLED = "true" } : {},
+  )
 
   # BASIC_AUTH_USER / BASIC_AUTH_PASSWORD / DATABASE_URL arrive here from
   # Infisical; the app is responsible for enforcing Basic Auth when enabled.