@geekmidas/cli 10.0.0-alpha.69 → 10.0.0-alpha.71

package/dist/{cli-IoM2-x48.cjs.map → cli-MMgBrHx7.cjs.map}

@@ -1 +1 @@
-{"version":3,"file":"cli-IoM2-x48.cjs","names":["targetForProvider","formatError","parseDevServices","deploy","storedCredentials","terminalCredentials"],"sources":["../src/deploy/cli.ts"],"sourcesContent":["/**\n * `gkm deploy`: the terminal around `deploy()`. CLI layer only.\n *\n * Everything that belongs to a person at a terminal lives here and nowhere\n * below it: prompting for a missing login (and storing it), printing progress,\n * and turning the outcome into an exit code. The deploy itself is the same\n * `deploy()` a host calls.\n */\n\nimport { formatError } from '../debug';\nimport { targetForProvider } from '../target/provider';\nimport { storedCredentials } from './credentials';\nimport { deploy } from './deploy';\nimport { type DevService, parseDevServices } from './devServices';\nimport { terminalCredentials } from './terminal';\n\nexport interface DeployCliOptions {\n\t/** The project directory: `--cwd`, else where the command was run. */\n\tcwd: string;\n\t/** `--target`: where to deploy. Defaults to `deploy.default`. */\n\ttarget?: string;\n\t/** `--provider`, deprecated: `dokploy` means `--target dokploy`. */\n\tprovider?: string;\n\tstage: string;\n\ttag?: string;\n\t/**\n\t * Print each event as one JSON object per line on stdout, instead of the\n\t * progress lines. Nothing prompts: a missing credential fails the run.\n\t */\n\tjson?: boolean;\n\t/** Plan only: create, change, build and push nothing. */\n\tdryRun?: boolean;\n\t/** On a failed release, roll back every app, not only the failed ones. */\n\tatomic?: boolean;\n\t/** `--allow-dev-services minio,mailpit`, as typed. */\n\tallowDevServices?: string;\n}\n\n/** Where the command writes. The process's own streams, outside tests. */\nexport interface DeployCliStreams {\n\tstdout: Pick<NodeJS.WriteStream, 'write'>;\n}\n\n/**\n * Run `gkm deploy` and resolve with its exit code: 0 when the run finished,\n * 1 when anything stopped it.\n */\nexport async function deployCli(\n\toptions: DeployCliOptions,\n\tstreams: DeployCliStreams = { stdout: process.stdout },\n): Promise<number> {\n\tlet target = options.target;\n\tif (options.provider !== undefined && target === undefined) {\n\t\ttry {\n\t\t\t// On stderr, so a `--json` run's stdout still carries only events.\n\t\t\ttarget = targetForProvider(options.provider, (message) =>\n\t\t\t\tconsole.warn(message),\n\t\t\t);\n\t\t} catch (error) {\n\t\t\tconsole.error(formatError(error));\n\t\t\treturn 1;\n\t\t}\n\t}\n\n\tlet allowDevServices: DevService[];\n\ttry {\n\t\tallowDevServices = parseDevServices(options.allowDevServices);\n\t} catch (error) {\n\t\tconsole.error(formatError(error));\n\t\treturn 1;\n\t}\n\n\tconst input = {\n\t\tcwd: options.cwd,\n\t\tstage: options.stage,\n\t\t...(target ? { target } : {}),\n\t\t...(options.tag ? { tag: options.tag } : {}),\n\t\t...(options.dryRun ? { dryRun: true } : {}),\n\t\t...(options.atomic ? { atomic: true } : {}),\n\t\t...(allowDevServices.length > 0 ? { allowDevServices } : {}),\n\t};\n\n\tif (options.json) {\n\t\t// stdout carries the events and nothing else: docker's own output goes\n\t\t// to stderr, and nobody is asked anything — a prompt would be written\n\t\t// into the stream a program is parsing.\n\t\tconst run = deploy({\n\t\t\t...input,\n\t\t\tcredentials: storedCredentials(),\n\t\t\tchildOutput: 'stderr',\n\t\t});\n\t\tfor await (const event of run) {\n\t\t\tstreams.stdout.write(`${JSON.stringify(event)}\\n`);\n\t\t}\n\t\treturn run.result.then(\n\t\t\t() => 0,\n\t\t\t(error) => {\n\t\t\t\tconsole.error(formatError(error));\n\t\t\t\treturn 1;\n\t\t\t},\n\t\t);\n\t}\n\n\t// The lines arrive as they are written, rather than as events read back a\n\t// tick later, so they interleave with a prompt exactly as they always did.\n\tconst run = deploy({\n\t\t...input,\n\t\tcredentials: terminalCredentials(storedCredentials()),\n\t\tlogger: {\n\t\t\tinfo: (message) => console.log(message),\n\t\t\twarn: (message) => console.warn(message),\n\t\t\terror: (message) => console.error(message),\n\t\t},\n\t});\n\n\ttry {\n\t\tawait run.result;\n\t\treturn 0;\n\t} catch (error) {\n\t\tconsole.error(formatError(error));\n\t\treturn 1;\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AA+CA,eAAsB,UACrB,SACA,UAA4B,EAAE,QAAQ,QAAQ,OAAO,GACnC;CAClB,IAAI,SAAS,QAAQ;CACrB,IAAI,QAAQ,aAAa,KAAA,KAAa,WAAW,KAAA,GAChD,IAAI;EAEH,SAASA,iBAAAA,kBAAkB,QAAQ,WAAW,YAC7C,QAAQ,KAAK,OAAO,CACrB;CACD,SAAS,OAAO;EACf,QAAQ,MAAMC,cAAAA,YAAY,KAAK,CAAC;EAChC,OAAO;CACR;CAGD,IAAI;CACJ,IAAI;EACH,mBAAmBC,cAAAA,iBAAiB,QAAQ,gBAAgB;CAC7D,SAAS,OAAO;EACf,QAAQ,MAAMD,cAAAA,YAAY,KAAK,CAAC;EAChC,OAAO;CACR;CAEA,MAAM,QAAQ;EACb,KAAK,QAAQ;EACb,OAAO,QAAQ;EACf,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;EAC3B,GAAI,QAAQ,MAAM,EAAE,KAAK,QAAQ,IAAI,IAAI,CAAC;EAC1C,GAAI,QAAQ,SAAS,EAAE,QAAQ,KAAK,IAAI,CAAC;EACzC,GAAI,QAAQ,SAAS,EAAE,QAAQ,KAAK,IAAI,CAAC;EACzC,GAAI,iBAAiB,SAAS,IAAI,EAAE,iBAAiB,IAAI,CAAC;CAC3D;CAEA,IAAI,QAAQ,MAAM;EAIjB,MAAM,MAAME,eAAAA,OAAO;GAClB,GAAG;GACH,aAAaC,oBAAAA,kBAAkB;GAC/B,aAAa;EACd,CAAC;EACD,WAAW,MAAM,SAAS,KACzB,QAAQ,OAAO,MAAM,GAAG,KAAK,UAAU,KAAK,EAAE,GAAG;EAElD,OAAO,IAAI,OAAO,WACX,IACL,UAAU;GACV,QAAQ,MAAMH,cAAAA,YAAY,KAAK,CAAC;GAChC,OAAO;EACR,CACD;CACD;CAIA,MAAM,MAAME,eAAAA,OAAO;EAClB,GAAG;EACH,aAAaE,iBAAAA,oBAAoBD,oBAAAA,kBAAkB,CAAC;EACpD,QAAQ;GACP,OAAO,YAAY,QAAQ,IAAI,OAAO;GACtC,OAAO,YAAY,QAAQ,KAAK,OAAO;GACvC,QAAQ,YAAY,QAAQ,MAAM,OAAO;EAC1C;CACD,CAAC;CAED,IAAI;EACH,MAAM,IAAI;EACV,OAAO;CACR,SAAS,OAAO;EACf,QAAQ,MAAMH,cAAAA,YAAY,KAAK,CAAC;EAChC,OAAO;CACR;AACD"}
+{"version":3,"file":"cli-MMgBrHx7.cjs","names":["targetForProvider","formatError","parseDevServices","deploy","storedCredentials","terminalCredentials"],"sources":["../src/deploy/cli.ts"],"sourcesContent":["/**\n * `gkm deploy`: the terminal around `deploy()`. CLI layer only.\n *\n * Everything that belongs to a person at a terminal lives here and nowhere\n * below it: prompting for a missing login (and storing it), printing progress,\n * and turning the outcome into an exit code. The deploy itself is the same\n * `deploy()` a host calls.\n */\n\nimport { formatError } from '../debug';\nimport { targetForProvider } from '../target/provider';\nimport { storedCredentials } from './credentials';\nimport { deploy } from './deploy';\nimport { type DevService, parseDevServices } from './devServices';\nimport { terminalCredentials } from './terminal';\n\nexport interface DeployCliOptions {\n\t/** The project directory: `--cwd`, else where the command was run. */\n\tcwd: string;\n\t/** `--target`: where to deploy. Defaults to `deploy.default`. */\n\ttarget?: string;\n\t/** `--provider`, deprecated: `dokploy` means `--target dokploy`. */\n\tprovider?: string;\n\tstage: string;\n\ttag?: string;\n\t/**\n\t * Print each event as one JSON object per line on stdout, instead of the\n\t * progress lines. Nothing prompts: a missing credential fails the run.\n\t */\n\tjson?: boolean;\n\t/** Plan only: create, change, build and push nothing. */\n\tdryRun?: boolean;\n\t/** On a failed release, roll back every app, not only the failed ones. */\n\tatomic?: boolean;\n\t/** `--allow-dev-services minio,mailpit`, as typed. */\n\tallowDevServices?: string;\n}\n\n/** Where the command writes. The process's own streams, outside tests. */\nexport interface DeployCliStreams {\n\tstdout: Pick<NodeJS.WriteStream, 'write'>;\n}\n\n/**\n * Run `gkm deploy` and resolve with its exit code: 0 when the run finished,\n * 1 when anything stopped it.\n */\nexport async function deployCli(\n\toptions: DeployCliOptions,\n\tstreams: DeployCliStreams = { stdout: process.stdout },\n): Promise<number> {\n\tlet target = options.target;\n\tif (options.provider !== undefined && target === undefined) {\n\t\ttry {\n\t\t\t// On stderr, so a `--json` run's stdout still carries only events.\n\t\t\ttarget = targetForProvider(options.provider, (message) =>\n\t\t\t\tconsole.warn(message),\n\t\t\t);\n\t\t} catch (error) {\n\t\t\tconsole.error(formatError(error));\n\t\t\treturn 1;\n\t\t}\n\t}\n\n\tlet allowDevServices: DevService[];\n\ttry {\n\t\tallowDevServices = parseDevServices(options.allowDevServices);\n\t} catch (error) {\n\t\tconsole.error(formatError(error));\n\t\treturn 1;\n\t}\n\n\tconst input = {\n\t\tcwd: options.cwd,\n\t\tstage: options.stage,\n\t\t...(target ? { target } : {}),\n\t\t...(options.tag ? { tag: options.tag } : {}),\n\t\t...(options.dryRun ? { dryRun: true } : {}),\n\t\t...(options.atomic ? { atomic: true } : {}),\n\t\t...(allowDevServices.length > 0 ? { allowDevServices } : {}),\n\t};\n\n\tif (options.json) {\n\t\t// stdout carries the events and nothing else: docker's own output goes\n\t\t// to stderr, and nobody is asked anything — a prompt would be written\n\t\t// into the stream a program is parsing.\n\t\tconst run = deploy({\n\t\t\t...input,\n\t\t\tcredentials: storedCredentials(),\n\t\t\tchildOutput: 'stderr',\n\t\t});\n\t\tfor await (const event of run) {\n\t\t\tstreams.stdout.write(`${JSON.stringify(event)}\\n`);\n\t\t}\n\t\treturn run.result.then(\n\t\t\t() => 0,\n\t\t\t(error) => {\n\t\t\t\tconsole.error(formatError(error));\n\t\t\t\treturn 1;\n\t\t\t},\n\t\t);\n\t}\n\n\t// The lines arrive as they are written, rather than as events read back a\n\t// tick later, so they interleave with a prompt exactly as they always did.\n\tconst run = deploy({\n\t\t...input,\n\t\tcredentials: terminalCredentials(storedCredentials()),\n\t\tlogger: {\n\t\t\tinfo: (message) => console.log(message),\n\t\t\twarn: (message) => console.warn(message),\n\t\t\terror: (message) => console.error(message),\n\t\t},\n\t});\n\n\ttry {\n\t\tawait run.result;\n\t\treturn 0;\n\t} catch (error) {\n\t\tconsole.error(formatError(error));\n\t\treturn 1;\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AA+CA,eAAsB,UACrB,SACA,UAA4B,EAAE,QAAQ,QAAQ,OAAO,GACnC;CAClB,IAAI,SAAS,QAAQ;CACrB,IAAI,QAAQ,aAAa,KAAA,KAAa,WAAW,KAAA,GAChD,IAAI;EAEH,SAASA,iBAAAA,kBAAkB,QAAQ,WAAW,YAC7C,QAAQ,KAAK,OAAO,CACrB;CACD,SAAS,OAAO;EACf,QAAQ,MAAMC,cAAAA,YAAY,KAAK,CAAC;EAChC,OAAO;CACR;CAGD,IAAI;CACJ,IAAI;EACH,mBAAmBC,cAAAA,iBAAiB,QAAQ,gBAAgB;CAC7D,SAAS,OAAO;EACf,QAAQ,MAAMD,cAAAA,YAAY,KAAK,CAAC;EAChC,OAAO;CACR;CAEA,MAAM,QAAQ;EACb,KAAK,QAAQ;EACb,OAAO,QAAQ;EACf,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;EAC3B,GAAI,QAAQ,MAAM,EAAE,KAAK,QAAQ,IAAI,IAAI,CAAC;EAC1C,GAAI,QAAQ,SAAS,EAAE,QAAQ,KAAK,IAAI,CAAC;EACzC,GAAI,QAAQ,SAAS,EAAE,QAAQ,KAAK,IAAI,CAAC;EACzC,GAAI,iBAAiB,SAAS,IAAI,EAAE,iBAAiB,IAAI,CAAC;CAC3D;CAEA,IAAI,QAAQ,MAAM;EAIjB,MAAM,MAAME,eAAAA,OAAO;GAClB,GAAG;GACH,aAAaC,oBAAAA,kBAAkB;GAC/B,aAAa;EACd,CAAC;EACD,WAAW,MAAM,SAAS,KACzB,QAAQ,OAAO,MAAM,GAAG,KAAK,UAAU,KAAK,EAAE,GAAG;EAElD,OAAO,IAAI,OAAO,WACX,IACL,UAAU;GACV,QAAQ,MAAMH,cAAAA,YAAY,KAAK,CAAC;GAChC,OAAO;EACR,CACD;CACD;CAIA,MAAM,MAAME,eAAAA,OAAO;EAClB,GAAG;EACH,aAAaE,iBAAAA,oBAAoBD,oBAAAA,kBAAkB,CAAC;EACpD,QAAQ;GACP,OAAO,YAAY,QAAQ,IAAI,OAAO;GACtC,OAAO,YAAY,QAAQ,KAAK,OAAO;GACvC,QAAQ,YAAY,QAAQ,MAAM,OAAO;EAC1C;CACD,CAAC;CAED,IAAI;EACH,MAAM,IAAI;EACV,OAAO;CACR,SAAS,OAAO;EACf,QAAQ,MAAMH,cAAAA,YAAY,KAAK,CAAC;EAChC,OAAO;CACR;AACD"}

package/dist/{compose-DfIioFX0.cjs → compose-B-MME-4C.cjs}

@@ -2,15 +2,19 @@ const require_rolldown_runtime = require("./rolldown-runtime-C0BPl7ul.cjs");
 const require_run = require("./run-fVZ-rLnc.cjs");
 const require_discover = require("./discover-B4VjaFJk.cjs");
 const require_derive = require("./derive-DAbo49sm.cjs");
+const require_workspace = require("./workspace-vdrcRI-m.cjs");
 const require_define = require("./define-DzRz8FgH.cjs");
-const require_state = require("./state-8RgXeX5Y.cjs");
+const require_state = require("./state-CCuTJNRH.cjs");
 const require_fakes = require("./fakes-zW-jNAbQ.cjs");
 const require_databases = require("./databases-C2p5LGAp.cjs");
 const require_credentialSchemas = require("./credentialSchemas-BcNL1N5R.cjs");
 let node_path = require("node:path");
+let node_fs = require("node:fs");
 let node_fs_promises = require("node:fs/promises");
+let node_os = require("node:os");
 let _geekmidas_manifest = require("@geekmidas/manifest");
 let node_child_process = require("node:child_process");
+let node_crypto = require("node:crypto");
 let yaml = require("yaml");
 let node_https = require("node:https");
 //#region src/compose/docker.ts
@@ -66,6 +70,7 @@ function compose(stack, args) {
 		stack.project,
 		"-f",
 		stack.file,
+		...(stack.overrides ?? []).flatMap((file) => ["-f", file]),
 		...args
 	];
 }
@@ -172,6 +177,16 @@ const dockerCompose = {
 		if (!Number.isInteger(port) || port <= 0) throw new ServicePortUnknown(service, inside, output);
 		return port;
 	},
+	async health(stack, service) {
+		const { code, stdout } = await capture("docker", [...compose(stack, [
+			"ps",
+			"--format",
+			"{{.Health}}",
+			service
+		])]);
+		if (code !== 0) return void 0;
+		return stdout.trim().split("\n")[0] || void 0;
+	},
 	async copyOut(stack, service, from, to) {
 		await (0, node_fs_promises.mkdir)((0, node_path.dirname)(to), { recursive: true });
 		await require_run.run("docker", compose(stack, [
@@ -251,6 +266,184 @@ async function assertImagesExist(docker, tag, images) {
 	if (missing.length > 0) throw new ImageTagNotFound(tag, missing);
 }
 //#endregion
+//#region src/compose/logs.ts
+/**
+* The stack's log UI: OpenObserve, run beside the apps when
+* `deploy.compose.logs` asks for it, and every backend's OpenTelemetry
+* pointed at it.
+*
+* The production server already exports its traces and pino logs over
+* OTLP/HTTP when `OTEL_EXPORTER_OTLP_ENDPOINT` is set. OpenObserve takes OTLP
+* at `/api/<org>/v1/{logs,traces}` with HTTP basic auth, so wiring an app is
+* two variables: the endpoint, `http://openobserve:5080/api/default`, and
+* the header that signs in as the root user.
+*
+* It is reached, by default, through an SSH tunnel: published on 127.0.0.1
+* only, because a port Docker publishes on every interface is opened in the
+* firewall by Docker itself, past ufw's rules. Served publicly, it is a host
+* on the stack's Caddy that refuses every address not allowed.
+*
+* Pure: the stack decides it, and the phases print and check it.
+*/
+/**
+* The image, pinned. A log store's on-disk format is the thing that must not
+* move under a running stack, so a new version is a change to this line.
+*/
+const OPENOBSERVE_IMAGE = "public.ecr.aws/zinclabs/openobserve:v1.0.4";
+/** Its compose service name — the host the apps send to. */
+const LOGS_SERVICE = "openobserve";
+/** The organisation every app's telemetry lands in. */
+const LOGS_ORG = "default";
+/** The stage secrets that sign in as OpenObserve's root user. */
+const LOGS_EMAIL_KEY = "ZO_ROOT_USER_EMAIL";
+const LOGS_PASSWORD_KEY = "ZO_ROOT_USER_PASSWORD";
+/** The stage sends its telemetry somewhere already, and logs are on too. */
+var LogsEndpointConflict = class extends Error {
+	stage;
+	keys;
+	constructor(stage, keys) {
+		super(`The stage '${stage}' sets ${keys.join(", ")} in its secrets, and deploy.compose.logs also runs OpenObserve for it — each backend can send its telemetry to one place. Either keep your own OTLP backend: remove logs from deploy.compose in gkm.config.ts; or use the bundled OpenObserve: remove ${keys.join(", ")} from the stage's secrets, and every backend is pointed at it.`);
+		this.stage = stage;
+		this.keys = keys;
+		this.name = "LogsEndpointConflict";
+	}
+};
+/** A root password OpenObserve would refuse to start with. */
+var LogsPasswordWeak = class extends Error {
+	stage;
+	constructor(stage) {
+		super(`The stage '${stage}' sets ${LOGS_PASSWORD_KEY}, and OpenObserve refuses it: a root password must be 8 to 128 characters with a lowercase letter, an uppercase letter, a digit and a symbol. Set another with gkm secrets:set ${LOGS_PASSWORD_KEY} '…' --stage ${stage}, or unset it to have one generated.`);
+		this.stage = stage;
+		this.name = "LogsPasswordWeak";
+	}
+};
+/** A deployed stage with logs on and no root password generated yet. */
+var LogsPasswordMissing = class extends Error {
+	stage;
+	constructor(stage) {
+		super(`The stage '${stage}' runs OpenObserve and has no ${LOGS_PASSWORD_KEY} in its secrets. Run gkm compose --stage ${stage} without --dry-run once to generate it, or set one: gkm secrets:set ${LOGS_PASSWORD_KEY} '…' --stage ${stage}`);
+		this.stage = stage;
+		this.name = "LogsPasswordMissing";
+	}
+};
+/** Whether OpenObserve accepts `password` for its root user. */
+function isStrongLogsPassword(password) {
+	return password.length >= 8 && password.length <= 128 && /[a-z]/.test(password) && /[A-Z]/.test(password) && /\d/.test(password) && /[^A-Za-z0-9]/.test(password);
+}
+/**
+* A root password: 192 random bits, with a fixed tail so every class
+* OpenObserve requires is present whatever the random part drew.
+*/
+function generateLogsPassword() {
+	return `${(0, node_crypto.randomBytes)(24).toString("base64url")}-Zo1`;
+}
+/**
+* The stage's secrets with a generated root password, where it has none.
+* Pure, like `withGeneratedSecrets`: the caller keeps the result once the
+* run goes ahead.
+*/
+function withLogsPassword(secrets) {
+	if (secrets.custom?.["ZO_ROOT_USER_PASSWORD"]) return {
+		secrets,
+		generated: []
+	};
+	return {
+		secrets: {
+			...secrets,
+			custom: {
+				...secrets.custom,
+				[LOGS_PASSWORD_KEY]: generateLogsPassword()
+			},
+			updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+		},
+		generated: [LOGS_PASSWORD_KEY]
+	};
+}
+/**
+* `OTEL_EXPORTER_OTLP_HEADERS` signing in as `email`.
+*
+* The variable's values are percent-decoded by the SDK (they follow the W3C
+* baggage format), so the space after `Basic` is written `%20`. Base64's own
+* `+`, `/` and `=` pass through decoding unchanged.
+*/
+function otlpHeaders(email, password) {
+	return `Authorization=Basic%20${Buffer.from(`${email}:${password}`).toString("base64")}`;
+}
+/** The stack's OpenObserve for one stage. */
+function stackLogs(options) {
+	const { config, stage, local, custom } = options;
+	const conflicting = Object.keys(custom).filter(require_state.isOtlpDestination).sort();
+	if (conflicting.length > 0) throw new LogsEndpointConflict(stage, conflicting);
+	if (!local && !options.domain) throw new require_state.NoDomainForStage(stage);
+	const email = custom["ZO_ROOT_USER_EMAIL"] ?? (local ? "admin@gkm.localhost" : `admin@${options.domain}`);
+	const set = custom[LOGS_PASSWORD_KEY];
+	if (!set && !local) throw new LogsPasswordMissing(stage);
+	const password = set ?? "Geekmidas-1";
+	if (!isStrongLogsPassword(password)) throw new LogsPasswordWeak(stage);
+	const host = config.public ? local ? `logs.${options.project}.localhost` : `logs.${options.domain}` : void 0;
+	const url = host ? `https://${host}${local && options.https !== 443 ? `:${options.https}` : ""}` : `http://localhost:${config.port}`;
+	return {
+		...config,
+		email,
+		password,
+		passwordFromSecrets: Boolean(set),
+		url,
+		...host ? { host } : {},
+		env: {
+			[LOGS_EMAIL_KEY]: email,
+			[LOGS_PASSWORD_KEY]: password,
+			ZO_DATA_DIR: "/data",
+			ZO_COMPACT_DATA_RETENTION_DAYS: String(config.retentionDays),
+			ZO_TELEMETRY: "false"
+		},
+		appEnv: {
+			OTEL_EXPORTER_OTLP_ENDPOINT: `http://${LOGS_SERVICE}:${require_workspace.LOGS_PORT}/api/${LOGS_ORG}`,
+			OTEL_EXPORTER_OTLP_HEADERS: otlpHeaders(email, password)
+		}
+	};
+}
+/**
+* OpenObserve's service. The image has no shell, `wget` or `curl`, so its
+* health check is its own binary asking the running server for its status —
+* which exits non-zero when nothing answers on its port.
+*/
+function logsService(logs) {
+	return {
+		image: OPENOBSERVE_IMAGE,
+		restart: "unless-stopped",
+		env_file: [{
+			path: `./${LOGS_SERVICE}.env`,
+			format: "raw"
+		}],
+		volumes: ["openobserve-data:/data"],
+		...logs.public ? {} : { ports: [`127.0.0.1:${logs.port}:${require_workspace.LOGS_PORT}`] },
+		healthcheck: {
+			test: [
+				"CMD",
+				"/openobserve",
+				"node",
+				"status"
+			],
+			interval: "10s",
+			timeout: "5s",
+			retries: 12,
+			start_period: "20s"
+		}
+	};
+}
+/** What `gkm compose` prints once the stack is up: how to open the logs. */
+function logsAccess(logs, ctx) {
+	const login = `login: ${logs.email}, password: ${ctx.local && !logs.passwordFromSecrets ? logs.password : `gkm secrets:show --stage ${ctx.stage} --reveal → ${LOGS_PASSWORD_KEY}`}`;
+	if (logs.public) return [`📜 Logs (OpenObserve): ${logs.url}  (${login})`, `     answered only for ${logs.public.allow.join(", ")}; every other address gets 403`];
+	return [
+		`📜 Logs (OpenObserve) on 127.0.0.1:${logs.port} — from your computer:`,
+		...ctx.local ? [`     on this machine, open http://localhost:${logs.port} directly; from another:`] : [],
+		`     ssh -N -L ${logs.port}:localhost:${logs.port} ${ctx.user}@${ctx.hostname}   (user and host are guesses: this machine's)`,
+		`     then open http://localhost:${logs.port}  (${login})`,
+		`⚠️  Docker-published ports bypass ufw, so OpenObserve is bound to 127.0.0.1 only — reach it through the tunnel, not by opening the port.`
+	];
+}
+//#endregion
 //#region src/compose/caddyfile.ts
 /** The Caddyfile for a stack's edge. */
 function edgeCaddyfile(sites, options) {
@@ -262,8 +455,13 @@ function edgeCaddyfile(sites, options) {
 }` : options.email ? `{
 	email ${options.email}
 }` : "";
-	const blocks = sites.map(({ host, upstream, rewrite }) => `https://${host} {${options.local ? `
+	const blocks = sites.map(({ host, upstream, rewrite, allow }) => `https://${host} {${options.local ? `
 	tls internal
+` : ""}${allow ? `
+	# Only these addresses — the peer Caddy sees, never a header a client
+	# could set. Everything else is refused before it reaches the upstream.
+	@denied not remote_ip ${allow.join(" ")}
+	respond @denied 403
 ` : ""}${rewrite ? `
 	# A bucket, served at a host of its own: the bucket is a prefix on MinIO,
 	# which routes and signs on the Host header — so it is sent the upstream's.
@@ -283,8 +481,9 @@ function edgeCaddyfile(sites, options) {
 }
 const HEADER = `# Generated by gkm compose from the construct manifest — do not edit.
 #
-# One host per API and site, each in front of its own container, and one per
-# file server in front of the stack's MinIO.
+# One host per API and site, each in front of its own container, one per
+# file server in front of the stack's MinIO, and — when its logs are served
+# publicly — one for OpenObserve, to the addresses it allows.
 `;
 //#endregion
 //#region src/compose/stack.ts
@@ -351,6 +550,20 @@ const STORAGE_KEYS = [
 	"AWS_SECRET_ACCESS_KEY",
 	"AWS_REGION"
 ];
+/**
+* Every service's Docker logs, rotated. The json-file driver keeps a
+* container's output in one file that grows until the disk is full — on a
+* small server, in weeks. Three files of 10 MB each per container is enough
+* to see what happened and never fills anything. A project's own override
+* file that sets `logging` wins over it.
+*/
+const LOG_ROTATION = {
+	driver: "json-file",
+	options: {
+		"max-size": "10m",
+		"max-file": "3"
+	}
+};
 /** A value only the stage's secrets can hold, and they do not. */
 var StageSecretMissing = class extends Error {
 	app;
@@ -460,6 +673,16 @@ function composeStack(input) {
 		reads.set(app.name, site?.kind === "site" ? Object.values((0, _geekmidas_manifest.publicEnvFor)(site, manifest)) : [...require_state.appEnvKeys(manifest, app.name, input.runnables) ?? []]);
 	}
 	const domain = workspace.deploy?.domains?.[stage];
+	const logsConfig = require_workspace.resolveLogs(workspace.deploy?.compose?.logs);
+	const logs = logsConfig ? stackLogs({
+		config: logsConfig,
+		stage,
+		local,
+		project: workspace.name,
+		...domain ? { domain } : {},
+		custom,
+		https
+	}) : void 0;
 	const services = local ? {
 		missing: [],
 		minio: plan.resources.filter((r) => r.kind === "objects").map((r) => r.id),
@@ -471,7 +694,7 @@ function composeStack(input) {
 		allow: input.allowDevServices ?? [],
 		...domain ? { domain } : {}
 	});
-	const infra = plan.containers.filter((c) => !NOT_RUN[c]).filter((c) => c !== "minio" || services.minio.length > 0).filter((c) => c !== "mailpit" || services.mailpit.length > 0).sort();
+	const infra = [...plan.containers.filter((c) => !NOT_RUN[c]).filter((c) => c !== "minio" || services.minio.length > 0).filter((c) => c !== "mailpit" || services.mailpit.length > 0), ...logs ? [LOGS_SERVICE] : []].sort();
 	const storage = infra.includes("minio") ? (() => {
 		const buckets = services.minio.map((id) => byId.get(id)?.name).filter((name) => Boolean(name)).sort();
 		return {
@@ -572,6 +795,10 @@ function composeStack(input) {
 		}
 		app.env = {
 			...values,
+			...require_state.otelEnv({
+				...custom,
+				...logs?.appEnv
+			}, app.name),
 			NODE_ENV: "production",
 			PORT: String(app.port),
 			STAGE: stage
@@ -586,16 +813,25 @@ function composeStack(input) {
 		apps,
 		master: credential.master,
 		...storage ? { storage } : {},
+		...logs ? { logs } : {},
 		https,
 		http,
 		composeDir: (0, node_path.join)(workspace.root, stackDir(stage)),
 		buildRoot: layout.buildRoot,
 		workspaceRoot: workspace.root
 	});
-	const caddyfile = edgeCaddyfile([...apps.map((app) => ({
-		host: app.host,
-		upstream: `${app.name}:${app.port}`
-	})), ...[...fileServers.values()].map(({ site }) => site)], { local });
+	const caddyfile = edgeCaddyfile([
+		...apps.map((app) => ({
+			host: app.host,
+			upstream: `${app.name}:${app.port}`
+		})),
+		...[...fileServers.values()].map(({ site }) => site),
+		...logs?.host && logs.public ? [{
+			host: logs.host,
+			upstream: `${LOGS_SERVICE}:${require_workspace.LOGS_PORT}`,
+			allow: logs.public.allow
+		}] : []
+	], { local });
 	const dockerfiles = {};
 	for (const app of apps) {
 		if (!app.build) continue;
@@ -617,7 +853,8 @@ function composeStack(input) {
 		plan,
 		credential,
 		...storage ? { storage } : {},
-		devServices: local ? [] : require_state.devServicesUsed(services)
+		devServices: local ? [] : require_state.devServicesUsed(services),
+		...logs ? { logs } : {}
 	};
 }
 /**
@@ -704,7 +941,8 @@ function hostOf(name, app, workspace, resource, options) {
 }
 /** The compose document: the infrastructure, the apps, and the edge. */
 function stackFile(options) {
-	const { project, plan, infra, apps } = options;
+	const { project, plan, apps } = options;
+	const infra = options.infra.filter((name) => name !== LOGS_SERVICE);
 	const derived = require_state.composeFor({
 		...plan,
 		containers: [...infra]
@@ -716,7 +954,8 @@ function stackFile(options) {
 	const volumes = {
 		...derived.volumes,
 		"caddy-data": {},
-		"caddy-config": {}
+		"caddy-config": {},
+		...options.logs ? { "openobserve-data": {} } : {}
 	};
 	for (const name of infra) {
 		const { ports: _ports, depends_on, profiles: _profiles, ...service } = derived.services[name];
@@ -742,6 +981,7 @@ function stackFile(options) {
 		};
 		minio.ports = ["127.0.0.1::9000"];
 	}
+	if (options.logs) services[LOGS_SERVICE] = logsService(options.logs);
 	for (const app of apps) services[app.name] = {
 		image: app.ref,
 		...app.build ? { build: {
@@ -784,6 +1024,10 @@ function stackFile(options) {
 			retries: 5
 		}
 	};
+	for (const service of Object.values(services)) service.logging = {
+		driver: LOG_ROTATION.driver,
+		options: { ...LOG_ROTATION.options }
+	};
 	return {
 		name: project,
 		services,
@@ -979,6 +1223,15 @@ var NoGitRevision = class extends Error {
 		this.name = "NoGitRevision";
 	}
 };
+/**
+* The project's own file merged over a stage's stack: `docker-compose.<stage>.yml`
+* at the workspace root. What the generated file cannot know — a port bound
+* to a tailnet address, another log driver — goes there, and is never
+* overwritten.
+*/
+function stackOverrideFile(root, stage) {
+	return (0, node_path.join)(root, `docker-compose.${stage}.yml`);
+}
 /** The commit HEAD is at, short — and `-dirty` when the tree has changes. */
 async function gitRevision(root) {
 	let sha;
@@ -1084,7 +1337,14 @@ async function validateCompose(ctx, deps, forced) {
 	}
 	const stack = withBuildCredentials(composed, masterKeys);
 	if (mode === "pull" && !ctx.dryRun) await assertImagesExist(deps.docker, tag, stack.apps);
+	if (stack.logs && (!stack.local || stack.logs.passwordFromSecrets)) {
+		ctx.secrets.mask(stack.logs.password);
+		ctx.secrets.mask(stack.logs.appEnv.OTEL_EXPORTER_OTLP_HEADERS);
+	}
 	const dir = (0, node_path.join)(root, stackDir(stage));
+	const override = stackOverrideFile(root, stage);
+	const overrides = (0, node_fs.existsSync)(override) ? [override] : [];
+	if (overrides.length > 0) ctx.logger.info(`🧩 Merging docker-compose.${stage}.yml over the generated stack`);
 	const previous = Object.fromEntries(Object.entries((await ctx.state.read(stage))?.state.releases ?? {}).map(([name, releases]) => {
 		const { ref, tag, digest } = releases.current;
 		return [name, {
@@ -1100,6 +1360,7 @@ async function validateCompose(ctx, deps, forced) {
 		ref: {
 			project: composeProject(identity),
 			file: (0, node_path.join)(dir, "docker-compose.yml"),
+			...overrides.length > 0 ? { overrides } : {},
 			cwd: root,
 			output: ctx.childOutput,
 			signal: ctx.signal
@@ -1125,7 +1386,13 @@ async function stageSecrets(ctx, manifest) {
 		secrets: stored,
 		generated: []
 	};
-	const { secrets, generated } = require_state.withGeneratedSecrets(stored ?? require_state.initStageSecrets(ctx.stage), manifest);
+	const withSeed = require_state.withGeneratedSecrets(stored ?? require_state.initStageSecrets(ctx.stage), manifest);
+	const withLogs = require_workspace.resolveLogs(ctx.workspace.deploy?.compose?.logs) ? withLogsPassword(withSeed.secrets) : {
+		secrets: withSeed.secrets,
+		generated: []
+	};
+	const secrets = withLogs.secrets;
+	const generated = [...withSeed.generated, ...withLogs.generated];
 	if (secrets.seed) ctx.secrets.mask(secrets.seed);
 	for (const value of Object.values(secrets.custom ?? {})) ctx.secrets.mask(value);
 	return {
@@ -1337,15 +1604,83 @@ async function verifyCompose(ctx, run, deps) {
 	const { stack } = run;
 	const ca = stack.local ? await (0, node_fs_promises.readFile)(caFile(run), "utf-8").catch(() => void 0) : void 0;
 	ctx.logger.info("\n🩺 Checking each app through Caddy…");
-	const down = (await Promise.all(stack.apps.map((app) => checkApp(ctx, app, deps, {
+	const results = await Promise.all(stack.apps.map((app) => checkApp(ctx, app, deps, {
 		ca,
 		local: stack.local
-	})))).filter((result) => !result.healthy).map(({ app, url, last }) => ({
+	})));
+	if (stack.logs) results.push(await checkLogs(ctx, run, deps));
+	const down = results.filter((result) => !result.healthy).map(({ app, url, last }) => ({
 		app,
 		url,
 		last
 	}));
 	if (down.length > 0) throw new ComposeAppsUnhealthy(stack.project, down);
+	if (stack.logs) reportLogs(ctx, stack.logs, stack.local);
+}
+/**
+* OpenObserve's own health check, as Docker reports it. It is not asked
+* through the edge: by default it has no host there, and served publicly it
+* answers only the addresses it allows — which need not include this one.
+*/
+async function checkLogs(ctx, run, deps) {
+	const url = `docker:${LOGS_SERVICE}`;
+	let last = "not asked";
+	for (let attempt = 1; attempt <= deps.healthAttempts; attempt++) {
+		ctx.signal.throwIfAborted();
+		const health = await deps.docker.health(run.ref, LOGS_SERVICE).catch((error) => error instanceof Error ? error.message : String(error));
+		last = health ?? "not running";
+		const healthy = health === "healthy";
+		ctx.emit({
+			type: "health.checked",
+			app: LOGS_SERVICE,
+			url,
+			healthy,
+			attempt
+		});
+		if (healthy) {
+			ctx.logger.info(`   ✓ ${LOGS_SERVICE.padEnd(12)} ${url} (${last})`);
+			return {
+				app: LOGS_SERVICE,
+				url,
+				last,
+				healthy
+			};
+		}
+		if (attempt < deps.healthAttempts) await new Promise((resolve) => setTimeout(resolve, deps.healthIntervalMs));
+	}
+	ctx.logger.warn(`   ✗ ${LOGS_SERVICE.padEnd(12)} ${url} (${last})`);
+	return {
+		app: LOGS_SERVICE,
+		url,
+		last,
+		healthy: false
+	};
+}
+/** How to open the logs, printed — and as an event, for a headless caller. */
+function reportLogs(ctx, logs, local) {
+	const lines = logsAccess(logs, {
+		stage: ctx.stage,
+		local,
+		user: currentUser(),
+		hostname: (0, node_os.hostname)()
+	});
+	ctx.logger.info(`\n${lines.join("\n")}`);
+	ctx.emit({
+		type: "logs.ready",
+		service: LOGS_SERVICE,
+		access: logs.public ? "public" : "tunnel",
+		url: logs.url,
+		...logs.public ? { allow: [...logs.public.allow] } : { port: logs.port },
+		email: logs.email
+	});
+}
+/** This machine's user — a guess at who would SSH in. */
+function currentUser() {
+	try {
+		return (0, node_os.userInfo)().username;
+	} catch {
+		return process.env.USER ?? "user";
+	}
 }
 async function checkApp(ctx, app, deps, options) {
 	const url = `${app.url}${app.kind === "site" ? "/" : "/health"}`;
@@ -1450,6 +1785,7 @@ async function writeStack(root, dir, stack, credentials = {}) {
 	await write((0, node_path.join)(dir, "docker-compose.yml"), composeYaml(stack));
 	await write((0, node_path.join)(dir, "Caddyfile"), stack.caddyfile);
 	for (const app of stack.apps) if (app.env) await write((0, node_path.join)(dir, `${app.name}.env`), envFile(app.env), 384);
+	if (stack.logs) await write((0, node_path.join)(dir, `${LOGS_SERVICE}.env`), envFile(stack.logs.env), 384);
 	for (const [name, payload] of Object.entries(credentials)) await write((0, node_path.join)(dir, credentialsFile(name)), require_state.credentialsFileContent(payload), 384);
 	for (const [path, content] of Object.entries(stack.dockerfiles)) await write((0, node_path.join)(root, path), content);
 	await require_state.ensureDockerignore(require_state.findBuildRoot(root));
@@ -1563,5 +1899,11 @@ Object.defineProperty(exports, "stackDir", {
 		return stackDir;
 	}
 });
+Object.defineProperty(exports, "stackOverrideFile", {
+	enumerable: true,
+	get: function() {
+		return stackOverrideFile;
+	}
+});
 
-//# sourceMappingURL=compose-DfIioFX0.cjs.map
+//# sourceMappingURL=compose-B-MME-4C.cjs.map