@geekmidas/cli 10.0.0-alpha.68 → 10.0.0-alpha.70

package/dist/{compose-DvsgumY2.cjs → compose-BJYHmuvx.cjs}

@@ -1,15 +1,20 @@
 const require_rolldown_runtime = require("./rolldown-runtime-C0BPl7ul.cjs");
 const require_run = require("./run-fVZ-rLnc.cjs");
-const require_discover = require("./discover-OEfZ9OkA.cjs");
+const require_discover = require("./discover-B4VjaFJk.cjs");
 const require_derive = require("./derive-DAbo49sm.cjs");
+const require_workspace = require("./workspace-vdrcRI-m.cjs");
 const require_define = require("./define-DzRz8FgH.cjs");
-const require_state = require("./state-CHZqCDRC.cjs");
+const require_state = require("./state-nS6I6s4u.cjs");
 const require_fakes = require("./fakes-zW-jNAbQ.cjs");
 const require_databases = require("./databases-C2p5LGAp.cjs");
+const require_credentialSchemas = require("./credentialSchemas-BcNL1N5R.cjs");
 let node_path = require("node:path");
+let node_fs = require("node:fs");
 let node_fs_promises = require("node:fs/promises");
+let node_os = require("node:os");
 let _geekmidas_manifest = require("@geekmidas/manifest");
 let node_child_process = require("node:child_process");
+let node_crypto = require("node:crypto");
 let yaml = require("yaml");
 let node_https = require("node:https");
 //#region src/compose/docker.ts
@@ -65,6 +70,7 @@ function compose(stack, args) {
 		stack.project,
 		"-f",
 		stack.file,
+		...(stack.overrides ?? []).flatMap((file) => ["-f", file]),
 		...args
 	];
 }
@@ -171,6 +177,16 @@ const dockerCompose = {
 		if (!Number.isInteger(port) || port <= 0) throw new ServicePortUnknown(service, inside, output);
 		return port;
 	},
+	async health(stack, service) {
+		const { code, stdout } = await capture("docker", [...compose(stack, [
+			"ps",
+			"--format",
+			"{{.Health}}",
+			service
+		])]);
+		if (code !== 0) return void 0;
+		return stdout.trim().split("\n")[0] || void 0;
+	},
 	async copyOut(stack, service, from, to) {
 		await (0, node_fs_promises.mkdir)((0, node_path.dirname)(to), { recursive: true });
 		await require_run.run("docker", compose(stack, [
@@ -250,6 +266,184 @@ async function assertImagesExist(docker, tag, images) {
 	if (missing.length > 0) throw new ImageTagNotFound(tag, missing);
 }
 //#endregion
+//#region src/compose/logs.ts
+/**
+* The stack's log UI: OpenObserve, run beside the apps when
+* `deploy.compose.logs` asks for it, and every backend's OpenTelemetry
+* pointed at it.
+*
+* The production server already exports its traces and pino logs over
+* OTLP/HTTP when `OTEL_EXPORTER_OTLP_ENDPOINT` is set. OpenObserve takes OTLP
+* at `/api/<org>/v1/{logs,traces}` with HTTP basic auth, so wiring an app is
+* two variables: the endpoint, `http://openobserve:5080/api/default`, and
+* the header that signs in as the root user.
+*
+* It is reached, by default, through an SSH tunnel: published on 127.0.0.1
+* only, because a port Docker publishes on every interface is opened in the
+* firewall by Docker itself, past ufw's rules. Served publicly, it is a host
+* on the stack's Caddy that refuses every address not allowed.
+*
+* Pure: the stack decides it, and the phases print and check it.
+*/
+/**
+* The image, pinned. A log store's on-disk format is the thing that must not
+* move under a running stack, so a new version is a change to this line.
+*/
+const OPENOBSERVE_IMAGE = "public.ecr.aws/zinclabs/openobserve:v1.0.4";
+/** Its compose service name — the host the apps send to. */
+const LOGS_SERVICE = "openobserve";
+/** The organisation every app's telemetry lands in. */
+const LOGS_ORG = "default";
+/** The stage secrets that sign in as OpenObserve's root user. */
+const LOGS_EMAIL_KEY = "ZO_ROOT_USER_EMAIL";
+const LOGS_PASSWORD_KEY = "ZO_ROOT_USER_PASSWORD";
+/** The stage sends its telemetry somewhere already, and logs are on too. */
+var LogsEndpointConflict = class extends Error {
+	stage;
+	keys;
+	constructor(stage, keys) {
+		super(`The stage '${stage}' sets ${keys.join(", ")} in its secrets, and deploy.compose.logs also runs OpenObserve for it — each backend can send its telemetry to one place. Either keep your own OTLP backend: remove logs from deploy.compose in gkm.config.ts; or use the bundled OpenObserve: remove ${keys.join(", ")} from the stage's secrets, and every backend is pointed at it.`);
+		this.stage = stage;
+		this.keys = keys;
+		this.name = "LogsEndpointConflict";
+	}
+};
+/** A root password OpenObserve would refuse to start with. */
+var LogsPasswordWeak = class extends Error {
+	stage;
+	constructor(stage) {
+		super(`The stage '${stage}' sets ${LOGS_PASSWORD_KEY}, and OpenObserve refuses it: a root password must be 8 to 128 characters with a lowercase letter, an uppercase letter, a digit and a symbol. Set another with gkm secrets:set ${LOGS_PASSWORD_KEY} '…' --stage ${stage}, or unset it to have one generated.`);
+		this.stage = stage;
+		this.name = "LogsPasswordWeak";
+	}
+};
+/** A deployed stage with logs on and no root password generated yet. */
+var LogsPasswordMissing = class extends Error {
+	stage;
+	constructor(stage) {
+		super(`The stage '${stage}' runs OpenObserve and has no ${LOGS_PASSWORD_KEY} in its secrets. Run gkm compose --stage ${stage} without --dry-run once to generate it, or set one: gkm secrets:set ${LOGS_PASSWORD_KEY} '…' --stage ${stage}`);
+		this.stage = stage;
+		this.name = "LogsPasswordMissing";
+	}
+};
+/** Whether OpenObserve accepts `password` for its root user. */
+function isStrongLogsPassword(password) {
+	return password.length >= 8 && password.length <= 128 && /[a-z]/.test(password) && /[A-Z]/.test(password) && /\d/.test(password) && /[^A-Za-z0-9]/.test(password);
+}
+/**
+* A root password: 192 random bits, with a fixed tail so every class
+* OpenObserve requires is present whatever the random part drew.
+*/
+function generateLogsPassword() {
+	return `${(0, node_crypto.randomBytes)(24).toString("base64url")}-Zo1`;
+}
+/**
+* The stage's secrets with a generated root password, where it has none.
+* Pure, like `withGeneratedSecrets`: the caller keeps the result once the
+* run goes ahead.
+*/
+function withLogsPassword(secrets) {
+	if (secrets.custom?.["ZO_ROOT_USER_PASSWORD"]) return {
+		secrets,
+		generated: []
+	};
+	return {
+		secrets: {
+			...secrets,
+			custom: {
+				...secrets.custom,
+				[LOGS_PASSWORD_KEY]: generateLogsPassword()
+			},
+			updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+		},
+		generated: [LOGS_PASSWORD_KEY]
+	};
+}
+/**
+* `OTEL_EXPORTER_OTLP_HEADERS` signing in as `email`.
+*
+* The variable's values are percent-decoded by the SDK (they follow the W3C
+* baggage format), so the space after `Basic` is written `%20`. Base64's own
+* `+`, `/` and `=` pass through decoding unchanged.
+*/
+function otlpHeaders(email, password) {
+	return `Authorization=Basic%20${Buffer.from(`${email}:${password}`).toString("base64")}`;
+}
+/** The stack's OpenObserve for one stage. */
+function stackLogs(options) {
+	const { config, stage, local, custom } = options;
+	const conflicting = Object.keys(custom).filter(require_state.isOtlpDestination).sort();
+	if (conflicting.length > 0) throw new LogsEndpointConflict(stage, conflicting);
+	if (!local && !options.domain) throw new require_state.NoDomainForStage(stage);
+	const email = custom["ZO_ROOT_USER_EMAIL"] ?? (local ? "admin@gkm.localhost" : `admin@${options.domain}`);
+	const set = custom[LOGS_PASSWORD_KEY];
+	if (!set && !local) throw new LogsPasswordMissing(stage);
+	const password = set ?? "Geekmidas-1";
+	if (!isStrongLogsPassword(password)) throw new LogsPasswordWeak(stage);
+	const host = config.public ? local ? `logs.${options.project}.localhost` : `logs.${options.domain}` : void 0;
+	const url = host ? `https://${host}${local && options.https !== 443 ? `:${options.https}` : ""}` : `http://localhost:${config.port}`;
+	return {
+		...config,
+		email,
+		password,
+		passwordFromSecrets: Boolean(set),
+		url,
+		...host ? { host } : {},
+		env: {
+			[LOGS_EMAIL_KEY]: email,
+			[LOGS_PASSWORD_KEY]: password,
+			ZO_DATA_DIR: "/data",
+			ZO_COMPACT_DATA_RETENTION_DAYS: String(config.retentionDays),
+			ZO_TELEMETRY: "false"
+		},
+		appEnv: {
+			OTEL_EXPORTER_OTLP_ENDPOINT: `http://${LOGS_SERVICE}:${require_workspace.LOGS_PORT}/api/${LOGS_ORG}`,
+			OTEL_EXPORTER_OTLP_HEADERS: otlpHeaders(email, password)
+		}
+	};
+}
+/**
+* OpenObserve's service. The image has no shell, `wget` or `curl`, so its
+* health check is its own binary asking the running server for its status —
+* which exits non-zero when nothing answers on its port.
+*/
+function logsService(logs) {
+	return {
+		image: OPENOBSERVE_IMAGE,
+		restart: "unless-stopped",
+		env_file: [{
+			path: `./${LOGS_SERVICE}.env`,
+			format: "raw"
+		}],
+		volumes: ["openobserve-data:/data"],
+		...logs.public ? {} : { ports: [`127.0.0.1:${logs.port}:${require_workspace.LOGS_PORT}`] },
+		healthcheck: {
+			test: [
+				"CMD",
+				"/openobserve",
+				"node",
+				"status"
+			],
+			interval: "10s",
+			timeout: "5s",
+			retries: 12,
+			start_period: "20s"
+		}
+	};
+}
+/** What `gkm compose` prints once the stack is up: how to open the logs. */
+function logsAccess(logs, ctx) {
+	const login = `login: ${logs.email}, password: ${ctx.local && !logs.passwordFromSecrets ? logs.password : `gkm secrets:show --stage ${ctx.stage} --reveal → ${LOGS_PASSWORD_KEY}`}`;
+	if (logs.public) return [`📜 Logs (OpenObserve): ${logs.url}  (${login})`, `     answered only for ${logs.public.allow.join(", ")}; every other address gets 403`];
+	return [
+		`📜 Logs (OpenObserve) on 127.0.0.1:${logs.port} — from your computer:`,
+		...ctx.local ? [`     on this machine, open http://localhost:${logs.port} directly; from another:`] : [],
+		`     ssh -N -L ${logs.port}:localhost:${logs.port} ${ctx.user}@${ctx.hostname}   (user and host are guesses: this machine's)`,
+		`     then open http://localhost:${logs.port}  (${login})`,
+		`⚠️  Docker-published ports bypass ufw, so OpenObserve is bound to 127.0.0.1 only — reach it through the tunnel, not by opening the port.`
+	];
+}
+//#endregion
 //#region src/compose/caddyfile.ts
 /** The Caddyfile for a stack's edge. */
 function edgeCaddyfile(sites, options) {
@@ -261,8 +455,13 @@ function edgeCaddyfile(sites, options) {
 }` : options.email ? `{
 	email ${options.email}
 }` : "";
-	const blocks = sites.map(({ host, upstream, rewrite }) => `https://${host} {${options.local ? `
+	const blocks = sites.map(({ host, upstream, rewrite, allow }) => `https://${host} {${options.local ? `
 	tls internal
+` : ""}${allow ? `
+	# Only these addresses — the peer Caddy sees, never a header a client
+	# could set. Everything else is refused before it reaches the upstream.
+	@denied not remote_ip ${allow.join(" ")}
+	respond @denied 403
 ` : ""}${rewrite ? `
 	# A bucket, served at a host of its own: the bucket is a prefix on MinIO,
 	# which routes and signs on the Host header — so it is sent the upstream's.
@@ -282,8 +481,9 @@ function edgeCaddyfile(sites, options) {
 }
 const HEADER = `# Generated by gkm compose from the construct manifest — do not edit.
 #
-# One host per API and site, each in front of its own container, and one per
-# file server in front of the stack's MinIO.
+# One host per API and site, each in front of its own container, one per
+# file server in front of the stack's MinIO, and — when its logs are served
+# publicly — one for OpenObserve, to the addresses it allows.
 `;
 //#endregion
 //#region src/compose/stack.ts
@@ -350,6 +550,20 @@ const STORAGE_KEYS = [
 	"AWS_SECRET_ACCESS_KEY",
 	"AWS_REGION"
 ];
+/**
+* Every service's Docker logs, rotated. The json-file driver keeps a
+* container's output in one file that grows until the disk is full — on a
+* small server, in weeks. Three files of 10 MB each per container is enough
+* to see what happened and never fills anything. A project's own override
+* file that sets `logging` wins over it.
+*/
+const LOG_ROTATION = {
+	driver: "json-file",
+	options: {
+		"max-size": "10m",
+		"max-file": "3"
+	}
+};
 /** A value only the stage's secrets can hold, and they do not. */
 var StageSecretMissing = class extends Error {
 	app;
@@ -459,6 +673,16 @@ function composeStack(input) {
 		reads.set(app.name, site?.kind === "site" ? Object.values((0, _geekmidas_manifest.publicEnvFor)(site, manifest)) : [...require_state.appEnvKeys(manifest, app.name, input.runnables) ?? []]);
 	}
 	const domain = workspace.deploy?.domains?.[stage];
+	const logsConfig = require_workspace.resolveLogs(workspace.deploy?.compose?.logs);
+	const logs = logsConfig ? stackLogs({
+		config: logsConfig,
+		stage,
+		local,
+		project: workspace.name,
+		...domain ? { domain } : {},
+		custom,
+		https
+	}) : void 0;
 	const services = local ? {
 		missing: [],
 		minio: plan.resources.filter((r) => r.kind === "objects").map((r) => r.id),
@@ -470,7 +694,7 @@ function composeStack(input) {
 		allow: input.allowDevServices ?? [],
 		...domain ? { domain } : {}
 	});
-	const infra = plan.containers.filter((c) => !NOT_RUN[c]).filter((c) => c !== "minio" || services.minio.length > 0).filter((c) => c !== "mailpit" || services.mailpit.length > 0).sort();
+	const infra = [...plan.containers.filter((c) => !NOT_RUN[c]).filter((c) => c !== "minio" || services.minio.length > 0).filter((c) => c !== "mailpit" || services.mailpit.length > 0), ...logs ? [LOGS_SERVICE] : []].sort();
 	const storage = infra.includes("minio") ? (() => {
 		const buckets = services.minio.map((id) => byId.get(id)?.name).filter((name) => Boolean(name)).sort();
 		return {
@@ -528,7 +752,7 @@ function composeStack(input) {
 			if (owner.kind === "file-server") return fileServers.get(owner.id)?.url;
 			return outside[key];
 		}
-		if (owner && suppliedBy(owner, key, local)) {
+		if (owner && require_state.suppliedOnly(owner.kind, owner.id, key, local)) {
 			const value = custom[key];
 			if (value === void 0) throw new StageSecretMissing(app.name, key, stage);
 			return value;
@@ -571,6 +795,10 @@ function composeStack(input) {
 		}
 		app.env = {
 			...values,
+			...require_state.otelEnv({
+				...custom,
+				...logs?.appEnv
+			}, app.name),
 			NODE_ENV: "production",
 			PORT: String(app.port),
 			STAGE: stage
@@ -585,16 +813,25 @@ function composeStack(input) {
 		apps,
 		master: credential.master,
 		...storage ? { storage } : {},
+		...logs ? { logs } : {},
 		https,
 		http,
 		composeDir: (0, node_path.join)(workspace.root, stackDir(stage)),
 		buildRoot: layout.buildRoot,
 		workspaceRoot: workspace.root
 	});
-	const caddyfile = edgeCaddyfile([...apps.map((app) => ({
-		host: app.host,
-		upstream: `${app.name}:${app.port}`
-	})), ...[...fileServers.values()].map(({ site }) => site)], { local });
+	const caddyfile = edgeCaddyfile([
+		...apps.map((app) => ({
+			host: app.host,
+			upstream: `${app.name}:${app.port}`
+		})),
+		...[...fileServers.values()].map(({ site }) => site),
+		...logs?.host && logs.public ? [{
+			host: logs.host,
+			upstream: `${LOGS_SERVICE}:${require_workspace.LOGS_PORT}`,
+			allow: logs.public.allow
+		}] : []
+	], { local });
 	const dockerfiles = {};
 	for (const app of apps) {
 		if (!app.build) continue;
@@ -616,15 +853,9 @@ function composeStack(input) {
 		plan,
 		credential,
 		...storage ? { storage } : {},
-		devServices: local ? [] : require_state.devServicesUsed(services)
+		devServices: local ? [] : require_state.devServicesUsed(services),
+		...logs ? { logs } : {}
 	};
-	/** Whether only the stage's secrets can supply `key` to `owner`. */
-	function suppliedBy(owner, key, isLocal) {
-		if (owner.kind === "credential") return true;
-		if (owner.kind === "external-api") return key === (0, _geekmidas_manifest.provideKey)(owner.id, "credentials");
-		if (isLocal) return false;
-		return owner.kind === "secret" || owner.kind === "encryption";
-	}
 }
 /**
 * The mail and storage constructs a deployed stage's apps read, with who
@@ -710,7 +941,8 @@ function hostOf(name, app, workspace, resource, options) {
 }
 /** The compose document: the infrastructure, the apps, and the edge. */
 function stackFile(options) {
-	const { project, plan, infra, apps } = options;
+	const { project, plan, apps } = options;
+	const infra = options.infra.filter((name) => name !== LOGS_SERVICE);
 	const derived = require_state.composeFor({
 		...plan,
 		containers: [...infra]
@@ -722,7 +954,8 @@ function stackFile(options) {
 	const volumes = {
 		...derived.volumes,
 		"caddy-data": {},
-		"caddy-config": {}
+		"caddy-config": {},
+		...options.logs ? { "openobserve-data": {} } : {}
 	};
 	for (const name of infra) {
 		const { ports: _ports, depends_on, profiles: _profiles, ...service } = derived.services[name];
@@ -748,6 +981,7 @@ function stackFile(options) {
 		};
 		minio.ports = ["127.0.0.1::9000"];
 	}
+	if (options.logs) services[LOGS_SERVICE] = logsService(options.logs);
 	for (const app of apps) services[app.name] = {
 		image: app.ref,
 		...app.build ? { build: {
@@ -790,6 +1024,10 @@ function stackFile(options) {
 			retries: 5
 		}
 	};
+	for (const service of Object.values(services)) service.logging = {
+		driver: LOG_ROTATION.driver,
+		options: { ...LOG_ROTATION.options }
+	};
 	return {
 		name: project,
 		services,
@@ -985,6 +1223,15 @@ var NoGitRevision = class extends Error {
 		this.name = "NoGitRevision";
 	}
 };
+/**
+* The project's own file merged over a stage's stack: `docker-compose.<stage>.yml`
+* at the workspace root. What the generated file cannot know — a port bound
+* to a tailnet address, another log driver — goes there, and is never
+* overwritten.
+*/
+function stackOverrideFile(root, stage) {
+	return (0, node_path.join)(root, `docker-compose.${stage}.yml`);
+}
 /** The commit HEAD is at, short — and `-dirty` when the tree has changes. */
 async function gitRevision(root) {
 	let sha;
@@ -1045,6 +1292,13 @@ async function validateCompose(ctx, deps, forced) {
 		runnables
 	});
 	const { secrets, generated } = await stageSecrets(ctx, manifest);
+	await require_credentialSchemas.assertStageCredentials({
+		root,
+		patterns: require_state.constructGlobs(workspace),
+		manifest,
+		stage,
+		supplied: secrets?.custom ?? {}
+	});
 	const masterKeys = {};
 	const layout = mode === "build" ? require_state.imageLayout(workspace) : void 0;
 	const composed = composeStack({
@@ -1083,7 +1337,14 @@ async function validateCompose(ctx, deps, forced) {
 	}
 	const stack = withBuildCredentials(composed, masterKeys);
 	if (mode === "pull" && !ctx.dryRun) await assertImagesExist(deps.docker, tag, stack.apps);
+	if (stack.logs && (!stack.local || stack.logs.passwordFromSecrets)) {
+		ctx.secrets.mask(stack.logs.password);
+		ctx.secrets.mask(stack.logs.appEnv.OTEL_EXPORTER_OTLP_HEADERS);
+	}
 	const dir = (0, node_path.join)(root, stackDir(stage));
+	const override = stackOverrideFile(root, stage);
+	const overrides = (0, node_fs.existsSync)(override) ? [override] : [];
+	if (overrides.length > 0) ctx.logger.info(`🧩 Merging docker-compose.${stage}.yml over the generated stack`);
 	const previous = Object.fromEntries(Object.entries((await ctx.state.read(stage))?.state.releases ?? {}).map(([name, releases]) => {
 		const { ref, tag, digest } = releases.current;
 		return [name, {
@@ -1099,6 +1360,7 @@ async function validateCompose(ctx, deps, forced) {
 		ref: {
 			project: composeProject(identity),
 			file: (0, node_path.join)(dir, "docker-compose.yml"),
+			...overrides.length > 0 ? { overrides } : {},
 			cwd: root,
 			output: ctx.childOutput,
 			signal: ctx.signal
@@ -1124,7 +1386,13 @@ async function stageSecrets(ctx, manifest) {
 		secrets: stored,
 		generated: []
 	};
-	const { secrets, generated } = require_state.withGeneratedSecrets(stored ?? require_state.initStageSecrets(ctx.stage), manifest);
+	const withSeed = require_state.withGeneratedSecrets(stored ?? require_state.initStageSecrets(ctx.stage), manifest);
+	const withLogs = require_workspace.resolveLogs(ctx.workspace.deploy?.compose?.logs) ? withLogsPassword(withSeed.secrets) : {
+		secrets: withSeed.secrets,
+		generated: []
+	};
+	const secrets = withLogs.secrets;
+	const generated = [...withSeed.generated, ...withLogs.generated];
 	if (secrets.seed) ctx.secrets.mask(secrets.seed);
 	for (const value of Object.values(secrets.custom ?? {})) ctx.secrets.mask(value);
 	return {
@@ -1336,15 +1604,83 @@ async function verifyCompose(ctx, run, deps) {
 	const { stack } = run;
 	const ca = stack.local ? await (0, node_fs_promises.readFile)(caFile(run), "utf-8").catch(() => void 0) : void 0;
 	ctx.logger.info("\n🩺 Checking each app through Caddy…");
-	const down = (await Promise.all(stack.apps.map((app) => checkApp(ctx, app, deps, {
+	const results = await Promise.all(stack.apps.map((app) => checkApp(ctx, app, deps, {
 		ca,
 		local: stack.local
-	})))).filter((result) => !result.healthy).map(({ app, url, last }) => ({
+	})));
+	if (stack.logs) results.push(await checkLogs(ctx, run, deps));
+	const down = results.filter((result) => !result.healthy).map(({ app, url, last }) => ({
 		app,
 		url,
 		last
 	}));
 	if (down.length > 0) throw new ComposeAppsUnhealthy(stack.project, down);
+	if (stack.logs) reportLogs(ctx, stack.logs, stack.local);
+}
+/**
+* OpenObserve's own health check, as Docker reports it. It is not asked
+* through the edge: by default it has no host there, and served publicly it
+* answers only the addresses it allows — which need not include this one.
+*/
+async function checkLogs(ctx, run, deps) {
+	const url = `docker:${LOGS_SERVICE}`;
+	let last = "not asked";
+	for (let attempt = 1; attempt <= deps.healthAttempts; attempt++) {
+		ctx.signal.throwIfAborted();
+		const health = await deps.docker.health(run.ref, LOGS_SERVICE).catch((error) => error instanceof Error ? error.message : String(error));
+		last = health ?? "not running";
+		const healthy = health === "healthy";
+		ctx.emit({
+			type: "health.checked",
+			app: LOGS_SERVICE,
+			url,
+			healthy,
+			attempt
+		});
+		if (healthy) {
+			ctx.logger.info(`   ✓ ${LOGS_SERVICE.padEnd(12)} ${url} (${last})`);
+			return {
+				app: LOGS_SERVICE,
+				url,
+				last,
+				healthy
+			};
+		}
+		if (attempt < deps.healthAttempts) await new Promise((resolve) => setTimeout(resolve, deps.healthIntervalMs));
+	}
+	ctx.logger.warn(`   ✗ ${LOGS_SERVICE.padEnd(12)} ${url} (${last})`);
+	return {
+		app: LOGS_SERVICE,
+		url,
+		last,
+		healthy: false
+	};
+}
+/** How to open the logs, printed — and as an event, for a headless caller. */
+function reportLogs(ctx, logs, local) {
+	const lines = logsAccess(logs, {
+		stage: ctx.stage,
+		local,
+		user: currentUser(),
+		hostname: (0, node_os.hostname)()
+	});
+	ctx.logger.info(`\n${lines.join("\n")}`);
+	ctx.emit({
+		type: "logs.ready",
+		service: LOGS_SERVICE,
+		access: logs.public ? "public" : "tunnel",
+		url: logs.url,
+		...logs.public ? { allow: [...logs.public.allow] } : { port: logs.port },
+		email: logs.email
+	});
+}
+/** This machine's user — a guess at who would SSH in. */
+function currentUser() {
+	try {
+		return (0, node_os.userInfo)().username;
+	} catch {
+		return process.env.USER ?? "user";
+	}
 }
 async function checkApp(ctx, app, deps, options) {
 	const url = `${app.url}${app.kind === "site" ? "/" : "/health"}`;
@@ -1449,6 +1785,7 @@ async function writeStack(root, dir, stack, credentials = {}) {
 	await write((0, node_path.join)(dir, "docker-compose.yml"), composeYaml(stack));
 	await write((0, node_path.join)(dir, "Caddyfile"), stack.caddyfile);
 	for (const app of stack.apps) if (app.env) await write((0, node_path.join)(dir, `${app.name}.env`), envFile(app.env), 384);
+	if (stack.logs) await write((0, node_path.join)(dir, `${LOGS_SERVICE}.env`), envFile(stack.logs.env), 384);
 	for (const [name, payload] of Object.entries(credentials)) await write((0, node_path.join)(dir, credentialsFile(name)), require_state.credentialsFileContent(payload), 384);
 	for (const [path, content] of Object.entries(stack.dockerfiles)) await write((0, node_path.join)(root, path), content);
 	await require_state.ensureDockerignore(require_state.findBuildRoot(root));
@@ -1562,5 +1899,11 @@ Object.defineProperty(exports, "stackDir", {
 		return stackDir;
 	}
 });
+Object.defineProperty(exports, "stackOverrideFile", {
+	enumerable: true,
+	get: function() {
+		return stackOverrideFile;
+	}
+});
 
-//# sourceMappingURL=compose-DvsgumY2.cjs.map
+//# sourceMappingURL=compose-BJYHmuvx.cjs.map