@geekmidas/cli 10.0.0-alpha.73 → 10.0.0-alpha.74

package/dist/{compose-9II-0IsK.mjs → compose-DZp8DJ0A.mjs}

@@ -4,8 +4,9 @@ import { r as discover } from "./discover-BPelzeGW.mjs";
 import { t as appKey } from "./derive-B4vDpzgP.mjs";
 import { M as LOGS_PORT, N as resolveLogs } from "./workspace-C7NqCsQF.mjs";
 import { t as defineTarget } from "./define-DR8xGYfL.mjs";
-import { $ as constructGlobs, C as validateImageRef, Ct as composeBuildPaths, D as isOtlpDestination, E as resolveHost, Et as WORKER_PORT, F as devServicesUsed, H as workerUnits, It as portKeys, Lt as primaryPortKey, Nt as DEFAULT_IMAGES, O as otelEnv, Ot as findBuildRoot, P as assertExternalServices, St as hostFor, T as isMainFrontendApp, Tt as TURBO_VERSION, U as encryptSecrets, V as suppliedOnly, _t as workerEnvKeys, a as recordRelease, at as applyBuckets, b as ensureDockerignore, bt as planFor, ct as bucketPolicies, ft as composeFor, g as credentialsFileContent, gt as networkEnv, h as credentialsBuildArg, ht as appEnvKeys, m as withGeneratedSecrets, mt as pgClient, nn as imageRef, ot as applyPolicies, p as DeployJournal, pt as bucketClient, sn as initStageSecrets, st as applyPostgres, t as createEmptyState, ut as postgresStatements, v as appDockerfile, vt as envFor, w as NoDomainForStage, wt as imageLayout, x as workerDockerfile, yt as localRolePassword, z as reportDevServices } from "./state-DtS2HEfi.mjs";
-import { i as DEFAULT_EVENTS, r as DEFAULT_CACHE } from "./SubscriberGenerator-DZk_pKDh.mjs";
+import { $ as constructGlobs, C as validateImageRef, Ct as composeBuildPaths, D as isOtlpDestination, E as resolveHost, Et as WORKER_PORT, F as devServicesUsed, H as workerUnits, It as portKeys, Lt as primaryPortKey, Nt as DEFAULT_IMAGES, O as otelEnv, Ot as findBuildRoot, P as assertExternalServices, St as hostFor, T as isMainFrontendApp, Tt as TURBO_VERSION, U as encryptSecrets, V as suppliedOnly, _t as workerEnvKeys, a as recordRelease, at as applyBuckets, b as ensureDockerignore, bt as planFor, ct as bucketPolicies, ft as composeFor, g as credentialsFileContent, gt as networkEnv, h as credentialsBuildArg, ht as appEnvKeys, m as withGeneratedSecrets, mt as pgClient, nn as imageRef, ot as applyPolicies, p as DeployJournal, pt as bucketClient, sn as initStageSecrets, st as applyPostgres, t as createEmptyState, ut as postgresStatements, v as appDockerfile, vt as envFor, w as NoDomainForStage, wt as imageLayout, x as workerDockerfile, yt as localRolePassword, z as reportDevServices } from "./state-DpkxSwzI.mjs";
+import { i as DEFAULT_EVENTS } from "./SubscriberGenerator-5looQ3gB.mjs";
+import { i as installedFrom } from "./drivers-Ch1rJitn.mjs";
 import { u as migrateDatabases } from "./databases-hUHTuwhx.mjs";
 import { n as assertStageCredentials } from "./credentialSchemas-BJqRJNK4.mjs";
 import { dirname, join } from "node:path";
@@ -444,6 +445,152 @@ function logsAccess(logs, ctx) {
 	];
 }
 //#endregion
+//#region src/compose/redis.ts
+/**
+* The stack's Redis: what every declared cache lives in when a workspace runs
+* as a `gkm compose` stack, on the local stage and on a deployed one alike.
+*
+* A cache is the one store whose contents can always be rebuilt, so unlike
+* Mailpit and MinIO it is a production service, not a dev stand-in: it runs
+* for every stage, on the compose network only, with nothing published. It
+* is bounded (`maxmemory`, evicting the least recently used key), persisted
+* (an append-only file on a named volume, kept by `--down`) and password
+* protected — the stage's own password, generated once like its seed.
+*
+* A stage that sets a cache's URL in its secrets — a managed Redis — keeps
+* it, and a stack whose every cache is set that way runs no Redis at all.
+*
+* Pure: the stack decides it, and the phases keep the password.
+*/
+/**
+* Where a stack's caches live: its own Redis, whatever the deploy target's
+* default is. A stack is one machine running containers, and a Redis beside
+* the apps is cheaper for a cache than a table in the database they share.
+*/
+const STACK_CACHE = "redis";
+/** Its compose service name — the host every cache URL points at. */
+const REDIS_SERVICE = "redis";
+/** The port it answers on, inside the network. */
+const REDIS_PORT = 6379;
+/** Reconcile's pin, so `gkm dev` and the stack run one Redis. */
+const REDIS_IMAGE = DEFAULT_IMAGES.redis;
+/**
+* How much it may hold before it evicts. A cache that grows until the box
+* runs out of memory takes the apps with it; 256 MB is a lot of sessions and
+* little of a small server. A project's `docker-compose.<stage>.yml` can
+* replace the command to change it.
+*/
+const REDIS_MAXMEMORY = "256mb";
+/** The stage secret holding its password. */
+const REDIS_PASSWORD_KEY = "REDIS_PASSWORD";
+/** Redis's own count of logical databases, before `--databases` raises it. */
+const REDIS_DATABASES = 16;
+/** A deployed stage that runs the stack's Redis and has no password yet. */
+var RedisPasswordMissing = class extends Error {
+	stage;
+	constructor(stage) {
+		super(`The stage '${stage}' runs the stack's Redis and has no ${REDIS_PASSWORD_KEY} in its secrets. Run gkm compose --stage ${stage} without --dry-run once to generate it, or set one: gkm secrets:set ${REDIS_PASSWORD_KEY} '…' --stage ${stage}`);
+		this.stage = stage;
+		this.name = "RedisPasswordMissing";
+	}
+};
+/**
+* Whether a stage's stack runs Redis: a cache is declared and the stage's
+* secrets do not set the URL of every one.
+*/
+function runsRedis(manifest, custom) {
+	return Object.values(manifest).some((declaration) => declaration?.kind === "cache" && (declaration.provides ?? []).some((key) => custom[key] === void 0));
+}
+/** A password: 256 random bits, URL-safe, so it sits in a URL unescaped. */
+function generateRedisPassword() {
+	return randomBytes(32).toString("base64url");
+}
+/**
+* The stage's secrets with a generated Redis password, where it has none.
+* Pure, like `withGeneratedSecrets`: the caller keeps the result once the run
+* goes ahead.
+*/
+function withRedisPassword(secrets) {
+	if (secrets.custom?.["REDIS_PASSWORD"]) return {
+		secrets,
+		generated: []
+	};
+	return {
+		secrets: {
+			...secrets,
+			custom: {
+				...secrets.custom,
+				[REDIS_PASSWORD_KEY]: generateRedisPassword()
+			},
+			updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+		},
+		generated: [REDIS_PASSWORD_KEY]
+	};
+}
+/**
+* The stack's Redis for one stage, or nothing where no cache needs it.
+*
+* Each cache it holds gets a logical database of its own, by the order of
+* their ids, so two caches never read each other's keys.
+*/
+function stackRedis(options) {
+	const { plan, stage, local, custom } = options;
+	const caches = plan.resources.filter((r) => r.kind === "cache" && custom[r.envKey] === void 0).sort((a, b) => a.id.localeCompare(b.id));
+	if (caches.length === 0) return void 0;
+	const set = custom[REDIS_PASSWORD_KEY];
+	if (!set && !local) throw new RedisPasswordMissing(stage);
+	const password = set ?? "geekmidas";
+	const auth = encodeURIComponent(password);
+	return {
+		password,
+		passwordFromSecrets: Boolean(set),
+		urls: Object.fromEntries(caches.map((cache, index) => [cache.envKey, `redis://:${auth}@${REDIS_SERVICE}:${REDIS_PORT}/${index}`])),
+		env: {
+			[REDIS_PASSWORD_KEY]: password,
+			REDISCLI_AUTH: password
+		},
+		databases: Math.max(REDIS_DATABASES, caches.length)
+	};
+}
+/**
+* Redis's service: bounded, persisted and password protected, on the
+* network alone.
+*
+* The command runs the image's own entrypoint with `redis-server` first, so
+* it still drops to the `redis` user and owns `/data`; the password is read
+* from the env file by the shell (`$$` is compose's escape for `$`), so
+* neither the compose file nor the container's command holds it.
+*/
+function redisService(redis) {
+	const flags = [
+		`--requirepass "$$${REDIS_PASSWORD_KEY}"`,
+		`--maxmemory ${REDIS_MAXMEMORY}`,
+		"--maxmemory-policy allkeys-lru",
+		"--appendonly yes",
+		...redis.databases > REDIS_DATABASES ? [`--databases ${redis.databases}`] : []
+	];
+	return {
+		image: REDIS_IMAGE,
+		restart: "unless-stopped",
+		command: [
+			"sh",
+			"-c",
+			`exec docker-entrypoint.sh redis-server ${flags.join(" ")}`
+		],
+		env_file: [{
+			path: `./${REDIS_SERVICE}.env`,
+			format: "raw"
+		}],
+		volumes: ["redis-data:/data"],
+		healthcheck: {
+			test: ["CMD-SHELL", "redis-cli ping | grep -q PONG"],
+			interval: "5s",
+			timeout: "3s",
+			retries: 10
+		}
+	};
+}
+//#endregion
 //#region src/compose/caddyfile.ts
 /** The Caddyfile for a stack's edge. */
 function edgeCaddyfile(sites, options) {
@@ -640,7 +787,7 @@ function composeStack(input) {
 	const plan = planFor(manifest, stage, provisionOrder(manifest), {
 		localStage: workspace.stages.local,
 		events: DEFAULT_EVENTS.server,
-		cache: DEFAULT_CACHE.server,
+		cache: STACK_CACHE,
 		edge: false
 	});
 	const byId = new Map(plan.resources.map((r) => [r.id, r]));
@@ -700,7 +847,13 @@ function composeStack(input) {
 		allow: input.allowDevServices ?? [],
 		...domain ? { domain } : {}
 	});
-	const infra = [...plan.containers.filter((c) => !NOT_RUN[c]).filter((c) => c !== "minio" || services.minio.length > 0).filter((c) => c !== "mailpit" || services.mailpit.length > 0), ...logs ? [LOGS_SERVICE] : []].sort();
+	const redis = stackRedis({
+		plan,
+		stage,
+		local,
+		custom
+	});
+	const infra = [...plan.containers.filter((c) => !NOT_RUN[c]).filter((c) => c !== "minio" || services.minio.length > 0).filter((c) => c !== "mailpit" || services.mailpit.length > 0).filter((c) => c !== "redis" || redis !== void 0), ...logs ? [LOGS_SERVICE] : []].sort();
 	const storage = infra.includes("minio") ? (() => {
 		const buckets = services.minio.map((id) => byId.get(id)?.name).filter((name) => Boolean(name)).sort();
 		return {
@@ -764,6 +917,7 @@ function composeStack(input) {
 			return value;
 		}
 		if (custom[key] !== void 0) return custom[key];
+		if (owner?.kind === "cache") return redis?.urls[key];
 		const surface = surfaceUrls.get(key);
 		if (app.kind === "rest-api" && surface && surface !== app.id) return inside[key];
 		return outside[key];
@@ -844,6 +998,7 @@ function composeStack(input) {
 		master: credential.master,
 		...storage ? { storage } : {},
 		...logs ? { logs } : {},
+		...redis ? { redis } : {},
 		https,
 		http,
 		composeDir: join(workspace.root, stackDir(stage)),
@@ -868,7 +1023,8 @@ function composeStack(input) {
 		dockerfiles[app.build.dockerfile] = appDockerfile(app.name, workspace.apps[app.name], {
 			layout,
 			workspaceRoot: workspace.root,
-			manifest
+			manifest,
+			cache: STACK_CACHE
 		});
 	}
 	for (const worker of workers) {
@@ -879,7 +1035,8 @@ function composeStack(input) {
 			app: worker.host
 		}, workspace.apps[worker.host], {
 			layout,
-			workspaceRoot: workspace.root
+			workspaceRoot: workspace.root,
+			cache: STACK_CACHE
 		});
 	}
 	return {
@@ -896,7 +1053,8 @@ function composeStack(input) {
 		credential,
 		...storage ? { storage } : {},
 		devServices: local ? [] : devServicesUsed(services),
-		...logs ? { logs } : {}
+		...logs ? { logs } : {},
+		...redis ? { redis } : {}
 	};
 }
 /**
@@ -1036,6 +1194,7 @@ function stackFile(options) {
 		};
 		minio.ports = ["127.0.0.1::9000"];
 	}
+	if (services["redis"] && options.redis) services[REDIS_SERVICE] = redisService(options.redis);
 	if (options.logs) services[LOGS_SERVICE] = logsService(options.logs);
 	for (const app of apps) services[app.name] = {
 		image: app.ref,
@@ -1421,6 +1580,7 @@ async function validateCompose(ctx, deps, forced) {
 		...layout ? { layout } : {}
 	});
 	reportDevServices(ctx, composed.devServices);
+	if (mode === "build") assertRedisClient(workspace, composed);
 	const credentials = {};
 	if (mode === "build") {
 		for (const app of composed.apps) {
@@ -1458,6 +1618,7 @@ async function validateCompose(ctx, deps, forced) {
 	}
 	const stack = withBuildCredentials(composed, masterKeys);
 	if (mode === "pull" && !ctx.dryRun) await assertImagesExist(deps.docker, tag, [...stack.apps, ...stack.workers]);
+	if (stack.redis && !stack.local) ctx.secrets.mask(stack.redis.password);
 	if (stack.logs && (!stack.local || stack.logs.passwordFromSecrets)) {
 		ctx.secrets.mask(stack.logs.password);
 		ctx.secrets.mask(stack.logs.appEnv.OTEL_EXPORTER_OTLP_HEADERS);
@@ -1495,6 +1656,28 @@ async function validateCompose(ctx, deps, forced) {
 		changes: []
 	};
 }
+/** A stack whose caches are in Redis, built for an app that has no client. */
+var RedisClientMissing = class extends Error {
+	apps;
+	constructor(apps) {
+		super(`The stack keeps every cache in Redis, and ${apps.join(", ")} ${apps.length === 1 ? "does" : "do"} not depend on ioredis, the client the generated server reaches it with. Add it to the workspace: pnpm add ioredis`);
+		this.apps = apps;
+		this.name = "RedisClientMissing";
+	}
+};
+/**
+* Every backend and worker image built for a stack with a cache can resolve
+* `ioredis` — listed by its app or a directory above it, the way Node and
+* the image's install find it.
+*/
+function assertRedisClient(workspace, stack) {
+	if (!stack.plan.resources.some((r) => r.kind === "cache")) return;
+	const missing = [.../* @__PURE__ */ new Set([...stack.apps.filter((app) => app.kind === "rest-api").map((a) => a.name), ...stack.workers.map((worker) => worker.host)])].filter((name) => {
+		const app = workspace.apps[name];
+		return app && !installedFrom(join(workspace.root, app.path), "ioredis");
+	}).sort();
+	if (missing.length > 0) throw new RedisClientMissing(missing);
+}
 /**
 * The stage's secrets — and, for a deployed stage, everything it generates
 * once: its seed, and each declared secret and keyring. Kept only once the
@@ -1512,8 +1695,16 @@ async function stageSecrets(ctx, manifest) {
 		secrets: withSeed.secrets,
 		generated: []
 	};
-	const secrets = withLogs.secrets;
-	const generated = [...withSeed.generated, ...withLogs.generated];
+	const withRedis = runsRedis(manifest, withLogs.secrets.custom ?? {}) ? withRedisPassword(withLogs.secrets) : {
+		secrets: withLogs.secrets,
+		generated: []
+	};
+	const secrets = withRedis.secrets;
+	const generated = [
+		...withSeed.generated,
+		...withLogs.generated,
+		...withRedis.generated
+	];
 	if (secrets.seed) ctx.secrets.mask(secrets.seed);
 	for (const value of Object.values(secrets.custom ?? {})) ctx.secrets.mask(value);
 	return {
@@ -1941,6 +2132,7 @@ async function writeStack(root, dir, stack, credentials = {}) {
 	await write(join(dir, "Caddyfile"), stack.caddyfile);
 	for (const app of [...stack.apps, ...stack.workers]) if (app.env) await write(join(dir, `${app.name}.env`), envFile(app.env), 384);
 	if (stack.logs) await write(join(dir, `${LOGS_SERVICE}.env`), envFile(stack.logs.env), 384);
+	if (stack.redis) await write(join(dir, `${REDIS_SERVICE}.env`), envFile(stack.redis.env), 384);
 	for (const [name, payload] of Object.entries(credentials)) await write(join(dir, credentialsFile(name)), credentialsFileContent(payload), 384);
 	for (const [path, content] of Object.entries(stack.dockerfiles)) await write(join(root, path), content);
 	await ensureDockerignore(findBuildRoot(root));
@@ -2028,4 +2220,4 @@ function composeTarget(options = {}) {
 //#endregion
 export { stackDir as a, composeProject as i, compose_exports as n, dockerCompose as o, stackOverrideFile as r, composeTarget as t };
 
-//# sourceMappingURL=compose-9II-0IsK.mjs.map
+//# sourceMappingURL=compose-DZp8DJ0A.mjs.map