@geekmidas/cli 10.0.0-alpha.67 → 10.0.0-alpha.68

package/dist/{engine-Cx_dvx9q.cjs → engine-BM9Dy_DT.cjs}

@@ -4,7 +4,7 @@ const require_discover = require("./discover-OEfZ9OkA.cjs");
 const require_sandbox = require("./sandbox-CL--ZDui.cjs");
 const require_derive = require("./derive-DAbo49sm.cjs");
 const require_workspace = require("./workspace-ON-bqiJz.cjs");
-const require_state = require("./state-DgmM4EKq.cjs");
+const require_state = require("./state-CHZqCDRC.cjs");
 const require_sniffer = require("./sniffer-D66HIvi9.cjs");
 const require_provider = require("./provider-B3Sv_a74.cjs");
 let node_path = require("node:path");
@@ -507,34 +507,47 @@ const PROVISIONERS = {
 		return { provides: { [(0, _geekmidas_manifest.provideKey)(declaration.id, "url")]: url.toString() } };
 	},
 	/**
-	* A bucket, as a MinIO stack on the box.
+	* A bucket: the stage's own, or — allowed — a MinIO stack on the box.
+	*
+	* A deployed stage's bucket is an external one — S3, R2, any S3-compatible
+	* store — whose URL and key pair the stage's secrets hold. Only with
+	* `--allow-dev-services minio` does this target run MinIO for one, and
+	* then only for a bucket whose URL the stage did not set.
 	*
 	* Dokploy has first-class primitives for Postgres and Redis and none for
-	* object storage, so this is the one kind whose infrastructure this target
-	* *writes* rather than configures — a compose file with one service in it.
+	* object storage, so MinIO is the one kind whose infrastructure this
+	* target *writes* rather than configures — a compose file with one
+	* service in it.
 	*
 	* The service is named `cloudName(...)` like everything else, which is not
 	* cosmetic here: containers on `dokploy-network` resolve each other by
 	* service name, so the name is the address. Calling it `minio` would work
 	* for exactly one project on the box and then collide.
 	*
-	* `s3://` carries no credentials, deliberately — deployed on AWS the SDK
-	* reads them from an execution role, so a URL that embedded a key would be
-	* one more thing to rotate and leak. There is no role here, so the same
-	* chain reads `AWS_ACCESS_KEY_ID` beside the URL, exactly as it does
-	* locally.
+	* A stage's own bucket URL may carry a key scoped to that bucket
+	* (`s3://KEY:SECRET@bucket`), which the client signs with; the shared
+	* `AWS_ACCESS_KEY_ID` pair is passed beside it when the stage set one, for
+	* a bucket whose URL has none. The MinIO this provisions uses that pair —
+	* the stage's, or one derived for it.
 	*/
 	objects: async (declaration, context) => {
 		if (declaration.kind !== "objects") throw new WrongKind(declaration.kind);
+		const key = (0, _geekmidas_manifest.provideKey)(declaration.id, "url");
+		const given = context.supplied?.[key];
+		if (given !== void 0) return { provides: {
+			[key]: given,
+			...storageKeys(context.supplied)
+		} };
 		const backend = context.storage ?? "minio";
 		if (backend !== "minio") throw new UnprovisionableBucket(declaration.id, backend);
+		if (!context.devServices?.includes("minio")) throw notConfigured(declaration.id, "objects", context);
 		const service = serviceName({
 			stage: context.stage,
 			app: context.scope ?? context.project
 		}, declaration.id);
 		const bucket = require_state.resourceName(declaration.id, declaration.kind, context.stage);
-		const user = `${bucket}-root`;
-		const password = derivedPassword(context, `objects:${declaration.id}`);
+		const user = context.supplied?.AWS_ACCESS_KEY_ID ?? `${bucket}-root`;
+		const password = context.supplied?.AWS_SECRET_ACCESS_KEY ?? derivedPassword(context, `objects:${declaration.id}`);
 		const { compose } = await context.api.findOrCreateCompose(service, context.projectId, context.environmentId, minioCompose({
 			service,
 			bucket,
@@ -543,33 +556,67 @@ const PROVISIONERS = {
 		}));
 		await context.api.deployCompose(compose.composeId);
 		return { provides: {
-			[(0, _geekmidas_manifest.provideKey)(declaration.id, "url")]: s3Url(service, bucket),
+			[key]: s3Url(service, bucket),
 			AWS_ACCESS_KEY_ID: user,
 			AWS_SECRET_ACCESS_KEY: password,
-			AWS_REGION: MINIO_REGION
+			AWS_REGION: context.supplied?.AWS_REGION ?? MINIO_REGION
 		} };
 	},
 	/**
 	* The address a bucket's objects are served on.
 	*
-	* Nothing is provisioned: Dokploy runs Traefik, so a second reverse proxy
-	* behind the first would terminate TLS twice — which is why the local
-	* target's Caddy has no equivalent here. What this resolves is the address,
-	* and the `open` prefixes are applied to the bucket rather than to an edge,
-	* so a policy is what makes them public wherever the bucket lives.
+	* The stage's own — a CDN, the bucket's domain — when its secrets hold
+	* one, which a bucket that is not MinIO's needs.
 	*
-	* Until a Traefik rule exists it answers on MinIO directly, path-style,
-	* which is honest about the shape it has today: the bucket is in the path
-	* rather than fronted by a host of its own.
+	* Over MinIO nothing is provisioned: Dokploy runs Traefik, so a second
+	* reverse proxy behind the first would terminate TLS twice — which is why
+	* the local target's Caddy has no equivalent here. What this resolves is
+	* the address, and the `open` prefixes are applied to the bucket rather
+	* than to an edge, so a policy is what makes them public wherever the
+	* bucket lives. Until a Traefik rule exists it answers on MinIO directly,
+	* path-style, which is honest about the shape it has today: the bucket is
+	* in the path rather than fronted by a host of its own.
 	*/
 	"file-server": async (declaration, context) => {
 		if (declaration.kind !== "file-server") throw new WrongKind(declaration.kind);
+		const key = (0, _geekmidas_manifest.provideKey)(declaration.id, "url");
+		const given = context.supplied?.[key];
+		if (given !== void 0) return { provides: { [key]: given } };
 		const parentUrl = context.provisioned[declaration.of]?.provides[(0, _geekmidas_manifest.provideKey)(declaration.of, "url")];
 		if (!parentUrl) throw new UnresolvedParent(declaration.id, declaration.of);
 		const endpoint = new URL(parentUrl).searchParams.get("endpoint");
 		const bucket = new URL(parentUrl).hostname;
 		if (!endpoint) throw new UnresolvedParent(declaration.id, declaration.of);
-		return { provides: { [(0, _geekmidas_manifest.provideKey)(declaration.id, "url")]: `${endpoint}/${bucket}` } };
+		return { provides: { [key]: `${endpoint}/${bucket}` } };
+	},
+	/**
+	* Mail: the stage's own SMTP server, or — allowed — Mailpit on the box.
+	*
+	* Every provider speaks SMTP, so the provider is whatever the stage's
+	* `<ID>_URL` names, with the address it sends from beside it. Only with
+	* `--allow-dev-services mailpit`, and only where the stage set no URL,
+	* does this run Mailpit — which catches every message and delivers none.
+	*/
+	email: async (declaration, context) => {
+		if (declaration.kind !== "email") throw new WrongKind(declaration.kind);
+		const key = (0, _geekmidas_manifest.provideKey)(declaration.id, "url");
+		const from = (0, _geekmidas_manifest.provideKey)(declaration.id, "from");
+		const given = context.supplied?.[key];
+		if (given !== void 0) return { provides: {
+			[key]: given,
+			[from]: supplied(declaration.id, from, context)
+		} };
+		if (!context.devServices?.includes("mailpit")) throw notConfigured(declaration.id, "email", context);
+		const service = serviceName({
+			stage: context.stage,
+			app: context.scope ?? context.project
+		}, declaration.id);
+		const { compose } = await context.api.findOrCreateCompose(service, context.projectId, context.environmentId, mailpitCompose(service));
+		await context.api.deployCompose(compose.composeId);
+		return { provides: {
+			[key]: `smtp://${service}:1025`,
+			[from]: context.supplied?.[from] ?? `noreply@${context.domain ?? "localhost"}`
+		} };
 	},
 	/**
 	* A topic, and below it a queue — the same broker either way.
@@ -807,6 +854,56 @@ function minioCompose(options) {
 		""
 	].join("\n");
 }
+/**
+* A one-service compose file for Mailpit, on `dokploy-network` so the apps
+* reach it by its service name. It accepts mail from anything on the network
+* and delivers none of it.
+*/
+function mailpitCompose(service) {
+	return [
+		"services:",
+		`  ${service}:`,
+		"    image: axllent/mailpit:latest",
+		"    environment:",
+		"      MP_SMTP_AUTH_ACCEPT_ANY: '1'",
+		"      MP_SMTP_AUTH_ALLOW_INSECURE: '1'",
+		"    networks:",
+		"      - dokploy-network",
+		"networks:",
+		"  dokploy-network:",
+		"    external: true",
+		""
+	].join("\n");
+}
+/**
+* The S3 client's shared keys the stage set, for a bucket that is its own —
+* none when it set none, since a bucket's URL may carry its own key.
+*/
+function storageKeys(values) {
+	const keys = {};
+	for (const key of [...require_state.STORAGE_KEY_PAIR, "AWS_REGION"]) {
+		const value = values?.[key];
+		if (value !== void 0) keys[key] = value;
+	}
+	return keys;
+}
+/**
+* The error for a bucket or mail the stage configured nothing for — what
+* `validate` already refused, should a provisioner be reached without it.
+*/
+function notConfigured(id, kind, context) {
+	const { missing } = require_state.externalServices({
+		stage: context.stage,
+		declarations: [{
+			id,
+			kind
+		}],
+		supplied: context.supplied ?? {},
+		allow: [],
+		...context.domain ? { domain: context.domain } : {}
+	});
+	return new require_state.ExternalServicesNotConfigured(context.stage, missing);
+}
 /** Whether anything reads through a reader on this construct. */
 function readsFrom(manifest, id) {
 	return Object.values(manifest).some((declaration) => declaration.kind === "database-reader" && declaration.of === id);
@@ -995,6 +1092,8 @@ async function provisionDeclared(options) {
 		cache: require_state.cacheBackendFor(require_state.providerOf(workspace)),
 		events: require_state.eventsBackendFor(require_state.providerOf(workspace)),
 		storage: require_state.storageBackendFor(require_state.providerOf(workspace)),
+		...options.devServices ? { devServices: options.devServices } : {},
+		...workspace.deploy?.domains?.[options.stage] ? { domain: workspace.deploy.domains[options.stage] } : {},
 		addresses: surfaceAddresses(manifest, options.appUrls),
 		seed: options.seed,
 		...options.supplied ? { supplied: options.supplied } : {},
@@ -1986,8 +2085,18 @@ async function validateDokploy(phase) {
 		secrets: phase.secrets,
 		ctx
 	};
+	const stored = await phase.secrets.read();
+	const services = require_state.assertExternalServices({
+		stage,
+		declarations: require_state.manifestServiceDeclarations(phase.manifest),
+		supplied: stored?.custom ?? {},
+		allow: phase.allowDevServices,
+		...workspace.deploy?.domains?.[stage] ? { domain: workspace.deploy.domains[stage] } : {}
+	});
+	require_state.reportDevServices(phase, require_state.devServicesUsed(services));
 	return {
 		...run,
+		allowDevServices: phase.allowDevServices,
 		preflight: await preflight(run),
 		verify: verifySettings(workspace.deploy.dokploy?.verify),
 		atomic: phase.atomic,
@@ -2167,7 +2276,8 @@ async function provision(run) {
 			appUrls,
 			supplied: stageSecrets.custom,
 			seed: stageSecrets.seed,
-			manifest
+			manifest,
+			devServices: run.allowDevServices
 		});
 		declaredEnv = declared.env;
 		declaredClusters = declared.clusters;
@@ -3098,4 +3208,4 @@ Object.defineProperty(exports, "verifySettings", {
 	}
 });
 
-//# sourceMappingURL=engine-Cx_dvx9q.cjs.map
+//# sourceMappingURL=engine-BM9Dy_DT.cjs.map