@geekmidas/cli 10.0.0-alpha.122 → 10.0.0-alpha.123

package/dist/{compose-CgBPA44v.mjs → compose-cHkF---f.mjs}

@@ -1,10 +1,10 @@
 import { t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
 import { t as GkmError } from "./errors-D8Gwp5kU.mjs";
 import { a as runOutput, i as run } from "./run-BJLIerMM.mjs";
-import { B as LOGS_PORT, I as otlpTelemetryEnv, L as resolveStageTelemetry, at as certificateFor, ft as SERVER_IPV4_KEY, ht as isReservedStageKey, it as ComposeTlsFileMissing, ot as proxyFor, z as telemetryEnv } from "./workspace-D1QbNd55.mjs";
-import { a as serverAddressHint, h as stackBackups, i as requiredServerAddress, l as systemLookup, m as backupsService, o as stackHosts, p as backupsRoleStatements, r as isLocalHost, s as stageDns, t as HostNotPointingAtServer, u as BACKUPS_SERVICE, x as stageBackups } from "./dns-BgxvvcQa.mjs";
+import { B as LOGS_PORT, I as otlpTelemetryEnv, L as resolveStageTelemetry, at as certificateFor, ft as SERVER_IPV4_KEY, ht as isReservedStageKey, it as ComposeTlsFileMissing, ot as proxyFor, z as telemetryEnv } from "./workspace-DUnnVjqC.mjs";
+import { E as stageBackups, a as serverAddressHint, b as stackBackups, d as passwordSites, f as siteAuth, h as BACKUPS_SERVICE, i as requiredServerAddress, l as systemLookup, m as withSitePasswords, o as stackHosts, p as siteNames, r as isLocalHost, s as stageDns, t as HostNotPointingAtServer, v as backupsRoleStatements, y as backupsService } from "./dns-DFvO5a53.mjs";
 import { t as defineTarget } from "./define-6poNqm5O.mjs";
-import { $n as stackLogs, $t as publicBuildValues, An as localRolePassword, B as workerDockerfile, Bn as EMULATOR_ACCESS_KEY_ID, Bt as initStageSecrets, Cn as REDIS_SERVICE, Ct as composeFor, Dn as stackRedis, En as runsRedis, Fn as isTelemetryKey, Gn as portKeys, Gt as composeBuildPaths, Hn as DEFAULT_IMAGES, In as scopeTelemetryEnv, Jn as primaryPortKey, Jt as WORKER_PORT, Kt as imageLayout, L as appDockerfile, Mn as planFor, N as stageProviderNotes, On as withRedisPassword, Qn as logsService, Rn as telemetryOf, S as recordRelease, Sn as withGeneratedSecrets, Tn as redisService, Vn as hostFor, Xn as LOGS_SERVICE, Xt as findBuildRoot, Zn as logsAccess, a as dnsResources, an as applyPostgres, at as suppliedOnly, bt as bucketClient, c as currentActor, ct as networkEnv, d as DeployJournal, er as withLogsPassword, et as devServicesUsed, fn as LOCAL_RABBITMQ_USER, ft as constructGlobs, hn as postgresSuperuser, in as applyPolicies, it as stageServiceDeclarations, kn as envFor, ln as postgresStatements, lt as workerEnvKeys, n as reportDatabaseRuns, nn as applyBuckets, nr as isMainFrontendApp, o as forgetDnsResource, on as bucketLifecycles, ot as appEnvKeys, pn as loadLocalCredentials, q as validateImageRef, qt as TURBO_VERSION, r as reportPlannedSeeds, rn as applyLifecycles, rr as resolveHost, s as recordDnsChanges, sn as bucketPolicies, t as DeploySeedsFailed, tn as workerUnits, tr as NoDomainForStage, tt as externalServices, v as createComposeState, vt as LEGACY_LOCAL_LOGIN, wn as STACK_CACHE, xt as pgClient, yt as ensurePostgresLogin, z as ensureDockerignore, zn as usesTelemetry } from "./seeds-oY0qDqui.mjs";
+import { $n as stackLogs, $t as publicBuildValues, An as localRolePassword, B as workerDockerfile, Bn as EMULATOR_ACCESS_KEY_ID, Bt as initStageSecrets, Cn as REDIS_SERVICE, Ct as composeFor, Dn as stackRedis, En as runsRedis, Fn as isTelemetryKey, Gn as portKeys, Gt as composeBuildPaths, Hn as DEFAULT_IMAGES, In as scopeTelemetryEnv, Jn as primaryPortKey, Jt as WORKER_PORT, Kt as imageLayout, L as appDockerfile, Mn as planFor, N as stageProviderNotes, On as withRedisPassword, Qn as logsService, Rn as telemetryOf, S as recordRelease, Sn as withGeneratedSecrets, Tn as redisService, Vn as hostFor, Xn as LOGS_SERVICE, Xt as findBuildRoot, Zn as logsAccess, a as dnsResources, an as applyPostgres, at as suppliedOnly, bt as bucketClient, c as currentActor, ct as networkEnv, d as DeployJournal, er as withLogsPassword, et as devServicesUsed, fn as LOCAL_RABBITMQ_USER, ft as constructGlobs, hn as postgresSuperuser, in as applyPolicies, it as stageServiceDeclarations, kn as envFor, ln as postgresStatements, lt as workerEnvKeys, n as reportDatabaseRuns, nn as applyBuckets, nr as isMainFrontendApp, o as forgetDnsResource, on as bucketLifecycles, ot as appEnvKeys, pn as loadLocalCredentials, q as validateImageRef, qt as TURBO_VERSION, r as reportPlannedSeeds, rn as applyLifecycles, rr as resolveHost, s as recordDnsChanges, sn as bucketPolicies, t as DeploySeedsFailed, tn as workerUnits, tr as NoDomainForStage, tt as externalServices, v as createComposeState, vt as LEGACY_LOCAL_LOGIN, wn as STACK_CACHE, xt as pgClient, yt as ensurePostgresLogin, z as ensureDockerignore, zn as usesTelemetry } from "./seeds-Dv78P9LS.mjs";
 import { t as appKey } from "./derive-B4vDpzgP.mjs";
 import { n as subscriberRoute, s as DEFAULT_EVENTS } from "./SubscriberGenerator-y3pncae_.mjs";
 import { a as imageRef } from "./identity-CBXr4wNi.mjs";
@@ -684,7 +684,7 @@ function edgeCaddyfile(routes, options) {
 ` : tls.kind === "files" ? `
 	tls ${tls.certFile} ${tls.keyFile}
 ` : "";
-	const blocks = routes.map(({ host, upstreams, prefix, allow, paths, streaming }) => `https://${host} {${certificate}
+	const blocks = routes.map(({ host, upstreams, prefix, allow, auth, paths, streaming }) => `https://${host} {${certificate}
 	# gkm's own header, which only a service of this stack may send: the auth
 	# server rate-limits by the client address it carries.
 	request_header -${CLIENT_IP_HEADER}
@@ -693,6 +693,11 @@ ${allow ? `
 	# could set. Everything else is refused before it reaches the upstream.
 	@denied not remote_ip ${allow.join(" ")}
 	respond @denied 403
+` : ""}${auth ? `
+	# The stage's login, asked for before anything reaches the upstream.
+	basic_auth {
+		${auth.user} ${auth.hash}
+	}
 ` : ""}${paths ? `
 	# Only these paths answer. Everything else on this host is refused before
 	# it reaches the upstream.
@@ -720,7 +725,8 @@ const HEADER = `# Generated by gkm compose from the construct manifest — do no
 # One host per API and site, each in front of its own container, one per
 # file server in front of the stack's MinIO, one per worker SNS pushes to,
 # answering only those routes, and — when its logs are served publicly — one
-# for OpenObserve, to the addresses it allows.
+# for OpenObserve, to the addresses it allows. A site the stage puts behind a
+# password asks for its login first.
 `;
 //#endregion
 //#region src/compose/images.ts
@@ -1015,6 +1021,10 @@ function traefikDynamic(routes, options) {
 			middlewares[name(route, "allow")] = { ipAllowList: { sourceRange: [...route.allow] } };
 			chain.push(name(route, "allow"));
 		}
+		if (route.auth) {
+			middlewares[name(route, "auth")] = { basicAuth: { users: [`${route.auth.user}:${route.auth.hash}`] } };
+			chain.push(name(route, "auth"));
+		}
 		if (route.prefix) {
 			middlewares[name(route, "prefix")] = { addPrefix: { prefix: route.prefix } };
 			chain.push(name(route, "prefix"));
@@ -1647,6 +1657,11 @@ function composeStack(input) {
 		proxy,
 		edge: new Map([...edgeServices].map((service) => [service, hostOf(service)]))
 	});
+	if (!local) {
+		const sites = apps.filter((app) => app.kind === "site");
+		const chosen = passwordSites(workspace, stage, sites.map((app) => app.name));
+		for (const app of sites) if (chosen.includes(app.name)) app.auth = siteAuth(stage, app.name, custom);
+	}
 	const routes = [
 		...apps.map((app) => ({
 			name: app.name,
@@ -1656,6 +1671,10 @@ function composeStack(input) {
 				port: app.port
 			}],
 			streaming: true,
+			...app.auth ? { auth: {
+				user: app.auth.user,
+				hash: app.auth.hash
+			} } : {},
 			health: app.kind === "site" ? "/" : "/health"
 		})),
 		...[...fileServers.values()].map(({ route }) => route),
@@ -2166,12 +2185,14 @@ function deployedStackSecrets(workspace, stage, stored, manifest) {
 		secrets: withLogs.secrets,
 		generated: []
 	};
+	const withSites = withSitePasswords(withRedis.secrets, passwordSites(workspace, stage, siteNames(manifest)));
 	return {
-		secrets: withRedis.secrets,
+		secrets: withSites.secrets,
 		generated: [
 			...withSeed.generated,
 			...withLogs.generated,
-			...withRedis.generated
+			...withRedis.generated,
+			...withSites.generated
 		]
 	};
 }
@@ -2199,7 +2220,7 @@ var HealthRequestTimedOut = class extends GkmError {
 	}
 };
 /** The real probe: one HTTPS GET, the certificate verified. */
-const httpsProbe = ({ url, ca, connectTo, connectPort, timeoutMs, signal }) => {
+const httpsProbe = ({ url, ca, connectTo, connectPort, authorization, timeoutMs, signal }) => {
 	const target = new URL(url);
 	return new Promise((resolve, reject) => {
 		const req = request({
@@ -2208,7 +2229,10 @@ const httpsProbe = ({ url, ca, connectTo, connectPort, timeoutMs, signal }) => {
 			servername: target.hostname,
 			path: `${target.pathname}${target.search}`,
 			method: "GET",
-			headers: { host: target.host },
+			headers: {
+				host: target.host,
+				...authorization ? { authorization } : {}
+			},
 			...ca ? { ca } : {},
 			...signal ? { signal } : {},
 			timeout: timeoutMs
@@ -2937,7 +2961,7 @@ async function releaseCompose(ctx, run, deps) {
 		via: run.previous[worker.name] ? "recorded" : "created"
 	});
 	ctx.logger.info(`\n✅ ${stack.project} is running:`);
-	for (const app of stack.apps) ctx.logger.info(`   ${app.name.padEnd(12)} ${app.url}`);
+	for (const app of stack.apps) ctx.logger.info(`   ${app.name.padEnd(12)} ${app.url}${app.auth ? `  🔒 user: ${app.auth.user}, password: gkm secrets:show --stage ${ctx.stage} --reveal → ${app.auth.key}` : ""}`);
 	for (const worker of stack.workers) ctx.logger.info(`   ${worker.name.padEnd(12)} worker ${worker.id}`);
 	if (stack.local) ctx.logger.info(`\n🔐 Certificates are from Caddy's local CA: NODE_EXTRA_CA_CERTS=${join(stackDir(ctx.stage), "caddy-root.crt")}`);
 }
@@ -3029,6 +3053,10 @@ async function checkContainer(ctx, run, deps, service) {
 		healthy: false
 	};
 }
+/** A login, as the `Authorization` header that carries it. */
+function basicAuthorization(auth) {
+	return `Basic ${Buffer.from(`${auth.user}:${auth.password}`).toString("base64")}`;
+}
 /** How to open the logs, printed — and as an event, for a headless caller. */
 function reportLogs(ctx, logs, local, server) {
 	const lines = logsAccess(logs, {
@@ -3066,6 +3094,7 @@ async function checkApp(ctx, app, deps, options) {
 			status = await deps.probe({
 				url,
 				...options.ca ? { ca: options.ca } : {},
+				...app.auth ? { authorization: basicAuthorization(app.auth) } : {},
 				...options.edge,
 				timeoutMs: 1e4,
 				signal: ctx.signal
@@ -3304,4 +3333,4 @@ function composeTarget(options = {}) {
 //#endregion
 export { dockerCompose as C, sshTarget as S, parseDigests as _, edgePorts as a, dockerHost as b, edgeRef as c, composeStack as d, derivedCredentials as f, edgeAlias as g, EDGE_PROJECT as h, ComposePushNeedsBuild as i, removeEdgeRoutes as l, stackPlan as m, compose_exports as n, stackOverrideFile as o, stackDir as p, ComposePinNeedsPull as r, deployedStackSecrets as s, composeTarget as t, composeProject as u, pinnedRef as v, projectNetwork as w, sshAccess as x, composeServer as y };
 
-//# sourceMappingURL=compose-CgBPA44v.mjs.map
+//# sourceMappingURL=compose-cHkF---f.mjs.map