@geekmidas/cli 10.0.0-alpha.121 → 10.0.0-alpha.123

package/dist/{compose-C43c03WZ.mjs → compose-cHkF---f.mjs}

@@ -1,10 +1,10 @@
 import { t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
 import { t as GkmError } from "./errors-D8Gwp5kU.mjs";
 import { a as runOutput, i as run } from "./run-BJLIerMM.mjs";
-import { B as LOGS_PORT, I as otlpTelemetryEnv, L as resolveStageTelemetry, at as certificateFor, ft as SERVER_IPV4_KEY, ht as isReservedStageKey, it as ComposeTlsFileMissing, ot as proxyFor, z as telemetryEnv } from "./workspace-D1QbNd55.mjs";
-import { a as serverAddressHint, h as stackBackups, i as requiredServerAddress, l as systemLookup, m as backupsService, o as stackHosts, p as backupsRoleStatements, r as isLocalHost, s as stageDns, t as HostNotPointingAtServer, u as BACKUPS_SERVICE, x as stageBackups } from "./dns-agf2VCdV.mjs";
+import { B as LOGS_PORT, I as otlpTelemetryEnv, L as resolveStageTelemetry, at as certificateFor, ft as SERVER_IPV4_KEY, ht as isReservedStageKey, it as ComposeTlsFileMissing, ot as proxyFor, z as telemetryEnv } from "./workspace-DUnnVjqC.mjs";
+import { E as stageBackups, a as serverAddressHint, b as stackBackups, d as passwordSites, f as siteAuth, h as BACKUPS_SERVICE, i as requiredServerAddress, l as systemLookup, m as withSitePasswords, o as stackHosts, p as siteNames, r as isLocalHost, s as stageDns, t as HostNotPointingAtServer, v as backupsRoleStatements, y as backupsService } from "./dns-DFvO5a53.mjs";
 import { t as defineTarget } from "./define-6poNqm5O.mjs";
-import { $ as devServicesUsed, $n as withLogsPassword, Bn as hostFor, Cn as STACK_CACHE, Dn as withRedisPassword, En as stackRedis, Fn as scopeTelemetryEnv, Gt as imageLayout, I as appDockerfile, K as validateImageRef, Kt as TURBO_VERSION, Ln as telemetryOf, M as stageProviderNotes, On as envFor, Pn as isTelemetryKey, Qn as stackLogs, Qt as publicBuildValues, R as ensureDockerignore, Rn as usesTelemetry, Sn as REDIS_SERVICE, St as composeFor, Tn as runsRedis, Vn as DEFAULT_IMAGES, Wn as portKeys, Wt as composeBuildPaths, Xn as logsAccess, Yn as LOGS_SERVICE, Yt as findBuildRoot, Zn as logsService, _ as createComposeState, _t as LEGACY_LOCAL_LOGIN, an as bucketLifecycles, at as appEnvKeys, bt as pgClient, cn as postgresStatements, ct as workerEnvKeys, dn as LOCAL_RABBITMQ_USER, dt as constructGlobs, en as workerUnits, er as NoDomainForStage, et as externalServices, fn as loadLocalCredentials, in as applyPostgres, it as suppliedOnly, jn as planFor, kn as localRolePassword, mn as postgresSuperuser, n as reportDatabaseRuns, nn as applyLifecycles, nr as resolveHost, o as recordDnsChanges, on as bucketPolicies, qn as primaryPortKey, qt as WORKER_PORT, r as reportPlannedSeeds, rn as applyPolicies, rt as stageServiceDeclarations, s as currentActor, st as networkEnv, t as DeploySeedsFailed, tn as applyBuckets, tr as isMainFrontendApp, u as DeployJournal, vt as ensurePostgresLogin, wn as redisService, x as recordRelease, xn as withGeneratedSecrets, yt as bucketClient, z as workerDockerfile, zn as EMULATOR_ACCESS_KEY_ID, zt as initStageSecrets } from "./seeds-Cwtv-U9-.mjs";
+import { $n as stackLogs, $t as publicBuildValues, An as localRolePassword, B as workerDockerfile, Bn as EMULATOR_ACCESS_KEY_ID, Bt as initStageSecrets, Cn as REDIS_SERVICE, Ct as composeFor, Dn as stackRedis, En as runsRedis, Fn as isTelemetryKey, Gn as portKeys, Gt as composeBuildPaths, Hn as DEFAULT_IMAGES, In as scopeTelemetryEnv, Jn as primaryPortKey, Jt as WORKER_PORT, Kt as imageLayout, L as appDockerfile, Mn as planFor, N as stageProviderNotes, On as withRedisPassword, Qn as logsService, Rn as telemetryOf, S as recordRelease, Sn as withGeneratedSecrets, Tn as redisService, Vn as hostFor, Xn as LOGS_SERVICE, Xt as findBuildRoot, Zn as logsAccess, a as dnsResources, an as applyPostgres, at as suppliedOnly, bt as bucketClient, c as currentActor, ct as networkEnv, d as DeployJournal, er as withLogsPassword, et as devServicesUsed, fn as LOCAL_RABBITMQ_USER, ft as constructGlobs, hn as postgresSuperuser, in as applyPolicies, it as stageServiceDeclarations, kn as envFor, ln as postgresStatements, lt as workerEnvKeys, n as reportDatabaseRuns, nn as applyBuckets, nr as isMainFrontendApp, o as forgetDnsResource, on as bucketLifecycles, ot as appEnvKeys, pn as loadLocalCredentials, q as validateImageRef, qt as TURBO_VERSION, r as reportPlannedSeeds, rn as applyLifecycles, rr as resolveHost, s as recordDnsChanges, sn as bucketPolicies, t as DeploySeedsFailed, tn as workerUnits, tr as NoDomainForStage, tt as externalServices, v as createComposeState, vt as LEGACY_LOCAL_LOGIN, wn as STACK_CACHE, xt as pgClient, yt as ensurePostgresLogin, z as ensureDockerignore, zn as usesTelemetry } from "./seeds-Dv78P9LS.mjs";
 import { t as appKey } from "./derive-B4vDpzgP.mjs";
 import { n as subscriberRoute, s as DEFAULT_EVENTS } from "./SubscriberGenerator-y3pncae_.mjs";
 import { a as imageRef } from "./identity-CBXr4wNi.mjs";
@@ -684,7 +684,7 @@ function edgeCaddyfile(routes, options) {
 ` : tls.kind === "files" ? `
 	tls ${tls.certFile} ${tls.keyFile}
 ` : "";
-	const blocks = routes.map(({ host, upstreams, prefix, allow, paths, streaming }) => `https://${host} {${certificate}
+	const blocks = routes.map(({ host, upstreams, prefix, allow, auth, paths, streaming }) => `https://${host} {${certificate}
 	# gkm's own header, which only a service of this stack may send: the auth
 	# server rate-limits by the client address it carries.
 	request_header -${CLIENT_IP_HEADER}
@@ -693,6 +693,11 @@ ${allow ? `
 	# could set. Everything else is refused before it reaches the upstream.
 	@denied not remote_ip ${allow.join(" ")}
 	respond @denied 403
+` : ""}${auth ? `
+	# The stage's login, asked for before anything reaches the upstream.
+	basic_auth {
+		${auth.user} ${auth.hash}
+	}
 ` : ""}${paths ? `
 	# Only these paths answer. Everything else on this host is refused before
 	# it reaches the upstream.
@@ -720,7 +725,8 @@ const HEADER = `# Generated by gkm compose from the construct manifest — do no
 # One host per API and site, each in front of its own container, one per
 # file server in front of the stack's MinIO, one per worker SNS pushes to,
 # answering only those routes, and — when its logs are served publicly — one
-# for OpenObserve, to the addresses it allows.
+# for OpenObserve, to the addresses it allows. A site the stage puts behind a
+# password asks for its login first.
 `;
 //#endregion
 //#region src/compose/images.ts
@@ -1015,6 +1021,10 @@ function traefikDynamic(routes, options) {
 			middlewares[name(route, "allow")] = { ipAllowList: { sourceRange: [...route.allow] } };
 			chain.push(name(route, "allow"));
 		}
+		if (route.auth) {
+			middlewares[name(route, "auth")] = { basicAuth: { users: [`${route.auth.user}:${route.auth.hash}`] } };
+			chain.push(name(route, "auth"));
+		}
 		if (route.prefix) {
 			middlewares[name(route, "prefix")] = { addPrefix: { prefix: route.prefix } };
 			chain.push(name(route, "prefix"));
@@ -1647,6 +1657,11 @@ function composeStack(input) {
 		proxy,
 		edge: new Map([...edgeServices].map((service) => [service, hostOf(service)]))
 	});
+	if (!local) {
+		const sites = apps.filter((app) => app.kind === "site");
+		const chosen = passwordSites(workspace, stage, sites.map((app) => app.name));
+		for (const app of sites) if (chosen.includes(app.name)) app.auth = siteAuth(stage, app.name, custom);
+	}
 	const routes = [
 		...apps.map((app) => ({
 			name: app.name,
@@ -1656,6 +1671,10 @@ function composeStack(input) {
 				port: app.port
 			}],
 			streaming: true,
+			...app.auth ? { auth: {
+				user: app.auth.user,
+				hash: app.auth.hash
+			} } : {},
 			health: app.kind === "site" ? "/" : "/health"
 		})),
 		...[...fileServers.values()].map(({ route }) => route),
@@ -2166,12 +2185,14 @@ function deployedStackSecrets(workspace, stage, stored, manifest) {
 		secrets: withLogs.secrets,
 		generated: []
 	};
+	const withSites = withSitePasswords(withRedis.secrets, passwordSites(workspace, stage, siteNames(manifest)));
 	return {
-		secrets: withRedis.secrets,
+		secrets: withSites.secrets,
 		generated: [
 			...withSeed.generated,
 			...withLogs.generated,
-			...withRedis.generated
+			...withRedis.generated,
+			...withSites.generated
 		]
 	};
 }
@@ -2199,7 +2220,7 @@ var HealthRequestTimedOut = class extends GkmError {
 	}
 };
 /** The real probe: one HTTPS GET, the certificate verified. */
-const httpsProbe = ({ url, ca, connectTo, connectPort, timeoutMs, signal }) => {
+const httpsProbe = ({ url, ca, connectTo, connectPort, authorization, timeoutMs, signal }) => {
 	const target = new URL(url);
 	return new Promise((resolve, reject) => {
 		const req = request({
@@ -2208,7 +2229,10 @@ const httpsProbe = ({ url, ca, connectTo, connectPort, timeoutMs, signal }) => {
 			servername: target.hostname,
 			path: `${target.pathname}${target.search}`,
 			method: "GET",
-			headers: { host: target.host },
+			headers: {
+				host: target.host,
+				...authorization ? { authorization } : {}
+			},
 			...ca ? { ca } : {},
 			...signal ? { signal } : {},
 			timeout: timeoutMs
@@ -2477,7 +2501,8 @@ async function readyCompose(ctx, run, deps) {
 	}
 	if (stack.local) return;
 	if (run.server && !ctx.dryRun && !run.push) await deps.server.check(run.server);
-	await stageHostsDns(ctx, deps, stackHosts(stack).filter((host) => !isLocalHost(host)), run.secrets?.custom);
+	const prune = await stageHostsDns(ctx, deps, stackHosts(stack).filter((host) => !isLocalHost(host)), run.secrets?.custom);
+	if (prune) run.pruneDns = prune;
 }
 /** A stack whose caches are in Redis, built for an app that has no client. */
 var RedisClientMissing = class extends GkmError {
@@ -2510,7 +2535,8 @@ function assertRedisClient(workspace, stack, manifest, runnables) {
 * domain's provider in `dns` where they differ, read back from it, and
 * recorded in the stage's state; hosts no provider writes resolved with the
 * system resolver. A dry run prints the plan and writes nothing, and warns
-* rather than stops.
+* rather than stops. Returns the prune of the records gkm wrote for hosts the
+* stage no longer serves — which a dry run prints there and then.
 *
 * @throws {ServerAddressMissing} when the stage has a domain and no address
 * @throws {ServerAddressInvalid} for a value that is not an address
@@ -2531,11 +2557,13 @@ async function stageHostsDns(ctx, deps, hosts, custom) {
 	const log = (line) => ctx.logger.info(line);
 	if (workspace.dns) log(`🌐 DNS for '${stage}' → ${server.ipv4}${server.ipv6 ? ` / ${server.ipv6}` : ""}${ctx.dryRun ? " (dry run — nothing is written)" : ""}`);
 	try {
+		const stored = await ctx.state.read(stage);
 		const result = await stageDns({
 			stage,
 			hosts,
 			server,
 			dns: workspace.dns,
+			recorded: dnsResources(stored?.resources ?? {}),
 			credentials: ctx.credentials,
 			log,
 			lookup: deps.lookup ?? systemLookup,
@@ -2549,6 +2577,11 @@ async function stageHostsDns(ctx, deps, hosts, custom) {
 		}
 		const parts = [result.confirmed.length > 0 ? `${result.confirmed.length} host${result.confirmed.length === 1 ? "" : "s"} confirmed by the DNS provider` : "", result.resolved.length > 0 ? `${result.resolved.length} host${result.resolved.length === 1 ? "" : "s"} resolve${result.resolved.length === 1 ? "s" : ""} to ${server.ipv4}` : ""].filter(Boolean);
 		if (parts.length > 0) log(`🌐 ${parts.join(", ")}`);
+		if (ctx.dryRun) {
+			await result.prune();
+			return;
+		}
+		return result.recorded.stale.length > 0 ? result.prune : void 0;
 	} catch (error) {
 		if (ctx.dryRun && error instanceof HostNotPointingAtServer) {
 			ctx.logger.warn(`⚠ ${error.message}`);
@@ -2558,6 +2591,19 @@ async function stageHostsDns(ctx, deps, hosts, custom) {
 	}
 }
 /**
+* The records gkm wrote for hosts the stage no longer serves, deleted once it
+* answers on its new ones — and forgotten from its state, deleted or not:
+* none is gkm's to manage any more.
+*/
+async function pruneStageDns(ctx, run) {
+	if (!run.pruneDns) return;
+	const pruned = await run.pruneDns();
+	const journal = await DeployJournal.open(ctx.state, ctx.stage, () => createComposeState(ctx.stage));
+	for (const { record } of pruned) await forgetDnsResource(journal, record);
+	const deleted = pruned.filter((p) => p.action === "delete").length;
+	if (deleted > 0) ctx.logger.info(`🌐 ${deleted} record${deleted === 1 ? "" : "s"} deleted`);
+}
+/**
 * The stage's secrets — and, for a deployed stage, everything it generates
 * once: its seed, and each declared secret and keyring. Kept only once the
 * run goes ahead (`provision`), so a dry run, or a tag that is not there,
@@ -2915,7 +2961,7 @@ async function releaseCompose(ctx, run, deps) {
 		via: run.previous[worker.name] ? "recorded" : "created"
 	});
 	ctx.logger.info(`\n✅ ${stack.project} is running:`);
-	for (const app of stack.apps) ctx.logger.info(`   ${app.name.padEnd(12)} ${app.url}`);
+	for (const app of stack.apps) ctx.logger.info(`   ${app.name.padEnd(12)} ${app.url}${app.auth ? `  🔒 user: ${app.auth.user}, password: gkm secrets:show --stage ${ctx.stage} --reveal → ${app.auth.key}` : ""}`);
 	for (const worker of stack.workers) ctx.logger.info(`   ${worker.name.padEnd(12)} worker ${worker.id}`);
 	if (stack.local) ctx.logger.info(`\n🔐 Certificates are from Caddy's local CA: NODE_EXTRA_CA_CERTS=${join(stackDir(ctx.stage), "caddy-root.crt")}`);
 }
@@ -2964,6 +3010,7 @@ async function verifyCompose(ctx, run, deps) {
 		last
 	}));
 	if (down.length > 0) throw new ComposeAppsUnhealthy(stack.project, down, stack.proxy);
+	await pruneStageDns(ctx, run);
 	if (stack.logs) reportLogs(ctx, stack.logs, stack.local, run.server);
 }
 /**
@@ -3006,6 +3053,10 @@ async function checkContainer(ctx, run, deps, service) {
 		healthy: false
 	};
 }
+/** A login, as the `Authorization` header that carries it. */
+function basicAuthorization(auth) {
+	return `Basic ${Buffer.from(`${auth.user}:${auth.password}`).toString("base64")}`;
+}
 /** How to open the logs, printed — and as an event, for a headless caller. */
 function reportLogs(ctx, logs, local, server) {
 	const lines = logsAccess(logs, {
@@ -3043,6 +3094,7 @@ async function checkApp(ctx, app, deps, options) {
 			status = await deps.probe({
 				url,
 				...options.ca ? { ca: options.ca } : {},
+				...app.auth ? { authorization: basicAuthorization(app.auth) } : {},
 				...options.edge,
 				timeoutMs: 1e4,
 				signal: ctx.signal
@@ -3281,4 +3333,4 @@ function composeTarget(options = {}) {
 //#endregion
 export { dockerCompose as C, sshTarget as S, parseDigests as _, edgePorts as a, dockerHost as b, edgeRef as c, composeStack as d, derivedCredentials as f, edgeAlias as g, EDGE_PROJECT as h, ComposePushNeedsBuild as i, removeEdgeRoutes as l, stackPlan as m, compose_exports as n, stackOverrideFile as o, stackDir as p, ComposePinNeedsPull as r, deployedStackSecrets as s, composeTarget as t, composeProject as u, pinnedRef as v, projectNetwork as w, sshAccess as x, composeServer as y };
 
-//# sourceMappingURL=compose-C43c03WZ.mjs.map
+//# sourceMappingURL=compose-cHkF---f.mjs.map