@geekmidas/cli 10.0.0-alpha.76 → 10.0.0-alpha.78

package/dist/{compose-Dq4VCtu5.mjs → compose-DByK353T.mjs}

@@ -1,21 +1,21 @@
 import { t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
-import { a as runOutput, i as run } from "./run-BJLIerMM.mjs";
+import { a as runOutput, i as run, s as gkmHome } from "./run-BJLIerMM.mjs";
 import { r as discover } from "./discover-BPelzeGW.mjs";
 import { t as appKey } from "./derive-B4vDpzgP.mjs";
-import { M as LOGS_PORT, N as resolveLogs } from "./workspace-QUTqYmVy.mjs";
+import { F as LOGS_PORT, I as resolveLogs, M as ComposeTlsFileMissing, N as certificateFor, P as proxyFor } from "./workspace-BBdqmkch.mjs";
 import { t as defineTarget } from "./define-DR8xGYfL.mjs";
-import { B as suppliedOnly, C as NoDomainForStage, Ct as WORKER_PORT, D as otelEnv, E as isOtlpDestination, Ft as portKeys, It as primaryPortKey, Mt as DEFAULT_IMAGES, N as assertExternalServices, P as devServicesUsed, R as reportDevServices, S as validateImageRef, St as TURBO_VERSION, T as resolveHost, Tt as findBuildRoot, V as workerUnits, Y as constructGlobs, _ as appDockerfile, _t as planFor, a as recordRelease, b as workerDockerfile, bt as composeBuildPaths, ct as composeFor, dt as appEnvKeys, gt as localRolePassword, ht as envFor, it as bucketPolicies, lt as bucketClient, m as withGeneratedSecrets, mt as workerEnvKeys, nn as imageRef, nt as applyPolicies, ot as postgresStatements, p as DeployJournal, pt as networkEnv, rt as applyPostgres, sn as initStageSecrets, t as createEmptyState, tt as applyBuckets, ut as pgClient, w as isMainFrontendApp, xt as imageLayout, y as ensureDockerignore, yt as hostFor } from "./state-CUecOCNJ.mjs";
+import { C as validateImageRef, Ct as TURBO_VERSION, D as isOtlpDestination, E as resolveHost, Et as findBuildRoot, F as devServicesUsed, H as workerUnits, It as portKeys, Lt as primaryPortKey, Nt as DEFAULT_IMAGES, O as otelEnv, P as assertExternalServices, St as imageLayout, T as isMainFrontendApp, V as suppliedOnly, X as constructGlobs, _t as localRolePassword, at as bucketPolicies, b as ensureDockerignore, bt as hostFor, cn as initStageSecrets, dt as pgClient, ft as appEnvKeys, gt as envFor, h as withGeneratedSecrets, ht as workerEnvKeys, it as applyPostgres, lt as composeFor, m as DeployJournal, mt as networkEnv, n as createEmptyState, nt as applyBuckets, o as recordRelease, rn as imageRef, rt as applyPolicies, st as postgresStatements, t as assertNoStaleSecrets, ut as bucketClient, v as appDockerfile, vt as planFor, w as NoDomainForStage, wt as WORKER_PORT, x as workerDockerfile, xt as composeBuildPaths, z as reportDevServices } from "./stale-C5FqIVc8.mjs";
 import { i as DEFAULT_EVENTS } from "./SubscriberGenerator-5looQ3gB.mjs";
 import { i as installedFrom } from "./drivers-Ch1rJitn.mjs";
 import { u as migrateDatabases } from "./databases-hUHTuwhx.mjs";
 import { n as assertStageCredentials } from "./credentialSchemas-BJqRJNK4.mjs";
 import { dirname, join } from "node:path";
 import { existsSync } from "node:fs";
-import { chmod, mkdir, readFile, readdir, rm, writeFile } from "node:fs/promises";
+import { chmod, copyFile, mkdir, readFile, readdir, rename, rm, writeFile } from "node:fs/promises";
 import { hostname, userInfo } from "node:os";
 import { provideKey, provisionOrder, publicEnvFor } from "@geekmidas/manifest";
 import { spawn } from "node:child_process";
-import { randomBytes } from "node:crypto";
+import { createHash, randomBytes } from "node:crypto";
 import { stringify } from "yaml";
 import { request } from "node:https";
 //#region src/compose/docker.ts
@@ -49,6 +49,27 @@ function runOptions(stack, env) {
 		...stack.signal ? { signal: stack.signal } : {}
 	};
 }
+/**
+* The host ports a `docker ps` Ports column publishes: `0.0.0.0:443->443/tcp,
+* [::]:443->443/tcp, 0.0.0.0:9000-9001->9000-9001/tcp`.
+*/
+function publishedPorts(column) {
+	const ports = /* @__PURE__ */ new Set();
+	for (const match of column.matchAll(/(?:[\d.]+|\[[^\]]*\]):(\d+)(?:-(\d+))?->/g)) {
+		const first = Number(match[1]);
+		const last = match[2] ? Number(match[2]) : first;
+		for (let port = first; port <= last; port++) ports.add(port);
+	}
+	return [...ports];
+}
+/** Each line `docker ps` printed, as the containers holding `port`. */
+function portHolders(output, port) {
+	return output.split("\n").filter(Boolean).map((line) => line.split("	")).filter(([, , , column = ""]) => publishedPorts(column).includes(port)).map(([container = "", project, service]) => ({
+		container,
+		...project ? { project } : {},
+		...service ? { service } : {}
+	}));
+}
 /** How long a stack has to pass its health checks. */
 const WAIT_TIMEOUT_S = 180;
 /** `docker compose port` printed nothing a port can be read from. */
@@ -249,8 +270,389 @@ const dockerCompose = {
 			if (match) return match.slice(repository.length + 1);
 		} catch {}
 		return id || void 0;
+	},
+	async ensureNetwork(name) {
+		const { code } = await capture("docker", [
+			"network",
+			"inspect",
+			name
+		]);
+		if (code === 0) return;
+		const created = await capture("docker", [
+			"network",
+			"create",
+			name
+		]);
+		if (created.code !== 0 && !/already exists/.test(created.stderr)) throw new NetworkCreateFailed(name, created.stderr);
+	},
+	async publishers(port) {
+		const { stdout } = await capture("docker", [
+			"ps",
+			"--format",
+			"{{.Names}}	{{.Label \"com.docker.compose.project\"}}	{{.Label \"com.docker.compose.service\"}}	{{.Ports}}"
+		]);
+		return portHolders(stdout, port);
 	}
 };
+/** `docker network create` failed. */
+var NetworkCreateFailed = class extends Error {
+	network;
+	output;
+	constructor(network, output) {
+		super(`Could not create the Docker network '${network}' (docker said: ${output.trim() || "nothing"}). Create it by hand with \`docker network create ${network}\` and run again.`);
+		this.network = network;
+		this.output = output;
+		this.name = "NetworkCreateFailed";
+	}
+};
+//#endregion
+//#region src/compose/traefik.ts
+/**
+* The server's shared edge, rendered for Traefik: what the edge itself runs
+* with, and what one stack registers with it.
+*
+* One Traefik per server owns 80 and 443, the ACME state and the redirect to
+* HTTPS. It is configured through its file provider alone: each stack writes
+* one file — its routers, services and middlewares, every name prefixed with
+* its compose project — into a directory the edge watches, and removes it
+* when it stops. There is no Docker socket: the edge never learns what runs
+* on the server except from those files.
+*
+* The edge and the stacks meet on one external Docker network. Only a
+* stack's public services join it, each under an alias prefixed with its
+* project (`<project>-api`), because the network is shared: a bare service
+* name there would be answered by every stack's `api`.
+*
+* Pure: the documents are data, and the edge's side effects are `edge.ts`'s.
+*/
+/**
+* The image, pinned: the edge is every stack's way in, so a new version is a
+* change to this line, not whatever `latest` is on the day a server starts.
+*/
+const TRAEFIK_IMAGE = "traefik:v3.7.13";
+/** The edge's compose project, one per server. */
+const EDGE_PROJECT = "gkm-edge";
+/** The external network the edge and every stack's public services share. */
+const EDGE_NETWORK = "gkm-edge";
+/** The edge's compose service. */
+const EDGE_SERVICE = "traefik";
+/** Inside the edge's container: what it watches, and where certificates are. */
+const EDGE_DYNAMIC_DIR = "/etc/gkm-edge/dynamic";
+const EDGE_CERTS_DIR = "/etc/gkm-edge/certs";
+/** The certificate resolver every deployed route without its own certificate uses. */
+const ACME_RESOLVER = "letsencrypt";
+/** The internal entrypoint the edge's health check asks; never published. */
+const PING_PORT = 8082;
+/** A stack's service, as the edge — and the stack itself — reach it. */
+function edgeAlias(project, service) {
+	return `${project}-${service}`;
+}
+/** A stack's certificate, as the edge's container reads it. */
+function edgeCertificatePaths(project) {
+	return {
+		certFile: `${EDGE_CERTS_DIR}/${project}.crt`,
+		keyFile: `${EDGE_CERTS_DIR}/${project}.key`
+	};
+}
+/**
+* The edge's static configuration: the entrypoints, the redirect, ACME, and
+* the directory it watches. No API and no dashboard — nothing about the edge
+* is reachable but the routes stacks register.
+*/
+function traefikStatic(ports) {
+	return {
+		global: {
+			checkNewVersion: false,
+			sendAnonymousUsage: false
+		},
+		entryPoints: {
+			web: {
+				address: ":80",
+				http: { redirections: { entryPoint: {
+					to: ports.https === 443 ? "websecure" : `:${ports.https}`,
+					scheme: "https",
+					permanent: true
+				} } }
+			},
+			websecure: { address: ":443" },
+			ping: { address: `:${PING_PORT}` }
+		},
+		ping: { entryPoint: "ping" },
+		providers: { file: {
+			directory: EDGE_DYNAMIC_DIR,
+			watch: true
+		} },
+		certificatesResolvers: { [ACME_RESOLVER]: { acme: {
+			storage: "/acme/acme.json",
+			httpChallenge: { entryPoint: "web" }
+		} } },
+		log: { level: "INFO" }
+	};
+}
+/** The edge's compose document. */
+function edgeCompose(options) {
+	const { dir, ports } = options;
+	return {
+		name: EDGE_PROJECT,
+		services: { [EDGE_SERVICE]: {
+			image: TRAEFIK_IMAGE,
+			restart: "unless-stopped",
+			ports: [`${ports.https}:443`, `${ports.http}:80`],
+			volumes: [
+				`${dir}/traefik.yml:/etc/traefik/traefik.yml:ro`,
+				`${dir}/dynamic:${EDGE_DYNAMIC_DIR}:ro`,
+				`${dir}/certs:${EDGE_CERTS_DIR}:ro`,
+				"acme:/acme"
+			],
+			labels: { "dev.geekmidas.edge.config": createHash("sha256").update(options.staticConfig).digest("hex").slice(0, 16) },
+			networks: ["edge"],
+			healthcheck: {
+				test: [
+					"CMD",
+					"traefik",
+					"healthcheck",
+					"--ping"
+				],
+				interval: "10s",
+				timeout: "5s",
+				retries: 5
+			},
+			logging: options.logging
+		} },
+		volumes: { acme: {} },
+		networks: { edge: {
+			name: EDGE_NETWORK,
+			external: true
+		} }
+	};
+}
+/** A stack's dynamic configuration, as an object. */
+function traefikDynamic(routes, options) {
+	const { project, tls } = options;
+	const name = (route, suffix) => `${project}-${route.name}${suffix ? `-${suffix}` : ""}`;
+	const url = ({ service, port }) => `http://${edgeAlias(project, service)}:${port}`;
+	const routers = {};
+	const services = {};
+	const middlewares = {};
+	for (const route of routes) {
+		const chain = [];
+		if (route.allow) {
+			middlewares[name(route, "allow")] = { ipAllowList: { sourceRange: [...route.allow] } };
+			chain.push(name(route, "allow"));
+		}
+		if (route.prefix) {
+			middlewares[name(route, "prefix")] = { addPrefix: { prefix: route.prefix } };
+			chain.push(name(route, "prefix"));
+		}
+		routers[name(route)] = {
+			rule: `Host(\`${route.host}\`)`,
+			entryPoints: ["websecure"],
+			service: name(route),
+			...chain.length > 0 ? { middlewares: chain } : {},
+			tls: tls.kind === "acme" ? { certResolver: ACME_RESOLVER } : {}
+		};
+		services[name(route)] = { loadBalancer: {
+			servers: route.upstreams.map((upstream) => ({ url: url(upstream) })),
+			...route.prefix ? { passHostHeader: false } : {},
+			...route.streaming ? { responseForwarding: { flushInterval: "-1ms" } } : {},
+			...route.health ? { healthCheck: {
+				path: route.health,
+				interval: "5s",
+				timeout: "3s"
+			} } : {}
+		} };
+	}
+	return {
+		http: {
+			routers,
+			services,
+			...Object.keys(middlewares).length > 0 ? { middlewares } : {}
+		},
+		...tls.kind === "files" ? { tls: { certificates: [{
+			certFile: tls.certFile,
+			keyFile: tls.keyFile
+		}] } } : {}
+	};
+}
+/** A stack's dynamic configuration file, as written to the edge's directory. */
+function traefikDynamicFile(routes, options) {
+	return `# Generated by gkm compose for ${options.project} — do not edit.
+# The shared edge (${EDGE_PROJECT}) reads every file in this directory; this
+# one is removed by gkm compose --down.
+${yaml(traefikDynamic(routes, options))}`;
+}
+/** The edge's static configuration file. */
+function traefikStaticFile(ports) {
+	return `# Generated by gkm compose — the server's shared edge. Do not edit.
+${yaml(traefikStatic(ports))}`;
+}
+/** The edge's compose file. */
+function edgeComposeFile(options) {
+	return `# Generated by gkm compose — the server's shared edge. Do not edit.
+#
+# Started by the first stack that runs with proxy: 'traefik', and left
+# running by gkm compose --down. Stop it, once nothing uses it, with:
+#
+#   docker compose -p ${EDGE_PROJECT} -f ${options.dir}/docker-compose.yml down
+${yaml(edgeCompose(options))}`;
+}
+function yaml(value) {
+	return stringify(value, {
+		lineWidth: 0,
+		aliasDuplicateObjects: false
+	});
+}
+//#endregion
+//#region src/compose/edge.ts
+/**
+* The server's shared Traefik edge, on disk and in Docker: started when a
+* stack needs it, and each stack's routes written to — and removed from —
+* the directory it watches.
+*
+* The edge lives in the deploy user's gkm home (`$GKM_HOME/edge`, else
+* `~/.gkm/edge`): the user who runs `gkm compose` owns it, so nothing needs
+* root, and it sits beside the stage keys that same user already keeps.
+*
+*   ~/.gkm/edge/
+*     docker-compose.yml   the edge's compose project (gkm-edge)
+*     traefik.yml          its static configuration
+*     dynamic/<project>.yml  one per stack: its routers, services, middlewares
+*     certs/<project>.crt|.key  a stack's own certificate, where it has one
+*/
+/** The edge's directory on this machine. */
+function edgeDir(env = process.env) {
+	return join(gkmHome(env), "edge");
+}
+/** The edge's compose project, as docker is asked about it. */
+function edgeRef(dir, options = {}) {
+	return {
+		project: EDGE_PROJECT,
+		file: join(dir, "docker-compose.yml"),
+		cwd: dir,
+		...options
+	};
+}
+/**
+* Something other than the proxy a stack is set to holds the edge's ports.
+*
+* With `proxy: 'traefik'`, the stack's own Caddy — still running from before
+* the switch — or any other container; with `proxy: 'caddy'`, the shared
+* edge, or another stack's Caddy. Refused before anything is started, so the
+* stack is never left half on one proxy and half on the other.
+*/
+var ComposeProxyClash = class extends Error {
+	project;
+	proxy;
+	port;
+	holder;
+	constructor(project, proxy, port, holder) {
+		const by = holder.project ? `${holder.container} (compose project ${holder.project})` : holder.container;
+		const fix = proxy === "traefik" ? holder.project === project && holder.service === "caddy" ? `That is this stack's own Caddy, from before it was switched to proxy: 'traefik'. Move it once: stop it (docker compose -p ${project} stop caddy), then run gkm compose again — the shared edge takes 80/443 and the stack registers with it.` : `The shared edge needs ports 80 and 443. Stop ${holder.container}${holder.project ? ` (docker compose -p ${holder.project} down, or its own gkm compose --down)` : ""}, or move the edge with GKM_COMPOSE_HTTPS_PORT/GKM_COMPOSE_HTTP_PORT.` : holder.project === "gkm-edge" ? `That is the server's shared Traefik edge, which other stacks register with. Set deploy.compose.proxy to 'traefik' for this stage so the stack registers with it too, or stop the edge once nothing uses it (docker compose -p ${EDGE_PROJECT} down).` : `Stop ${holder.container}, or publish this stack's Caddy elsewhere with GKM_COMPOSE_HTTPS_PORT/GKM_COMPOSE_HTTP_PORT.`;
+		super(`${project} is set to proxy: '${proxy}', and port ${port} is held by ${by}. ${fix}`);
+		this.project = project;
+		this.proxy = proxy;
+		this.port = port;
+		this.holder = holder;
+		this.name = "ComposeProxyClash";
+	}
+};
+/**
+* Refuse a stack whose edge ports are held by anything but its own proxy:
+* the shared edge for `'traefik'`, the stack's own Caddy for `'caddy'`.
+*/
+async function assertEdgePorts(docker, options) {
+	const { project, proxy, ports } = options;
+	for (const port of [ports.https, ports.http]) for (const holder of await docker.publishers(port)) if (!(proxy === "traefik" ? holder.project === "gkm-edge" : holder.project === project && holder.service === "caddy")) throw new ComposeProxyClash(project, proxy, port, holder);
+}
+/** Write a file whole or not at all: a temporary file, then a rename. */
+async function writeAtomic(path, content, mode = 420) {
+	const temporary = `${path}.${process.pid}.tmp`;
+	await writeFile(temporary, content, { mode });
+	await chmod(temporary, mode);
+	await rename(temporary, path);
+}
+/** Write a file only when its content changed; whether it did. */
+async function writeIfChanged(path, content) {
+	if (await readFile(path, "utf-8").catch(() => void 0) === content) return false;
+	await writeAtomic(path, content);
+	return true;
+}
+/**
+* The edge, up: its network, its files, and its container — started when it
+* is not running, and recreated when its configuration changed. Idempotent:
+* on a server where it already runs as configured, `up` changes nothing.
+*/
+async function ensureEdge(docker, options) {
+	const { dir, ports } = options;
+	await mkdir(join(dir, "dynamic"), { recursive: true });
+	await mkdir(join(dir, "certs"), {
+		recursive: true,
+		mode: 448
+	});
+	const staticConfig = traefikStaticFile(ports);
+	await writeIfChanged(join(dir, "traefik.yml"), staticConfig);
+	await writeIfChanged(join(dir, "docker-compose.yml"), edgeComposeFile({
+		dir,
+		ports,
+		staticConfig,
+		logging: options.logging
+	}));
+	await docker.ensureNetwork(EDGE_NETWORK);
+	await docker.up(edgeRef(dir, {
+		...options.output ? { output: options.output } : {},
+		...options.signal ? { signal: options.signal } : {}
+	}), [EDGE_SERVICE]);
+	return [join(dir, "traefik.yml"), join(dir, "docker-compose.yml")];
+}
+/** A stack's file in the edge's directory. */
+function routesFile(dir, project) {
+	return join(dir, "dynamic", `${project}.yml`);
+}
+/**
+* Register a stack with the edge: its certificate first, where it has one,
+* so the routes that need it never load without it — then its routes, in one
+* rename the edge picks up whole.
+*/
+async function writeEdgeRoutes(dir, project, routes, certificate) {
+	const files = [];
+	if (certificate) {
+		const certs = join(dir, "certs");
+		await mkdir(certs, {
+			recursive: true,
+			mode: 448
+		});
+		const crt = join(certs, `${project}.crt`);
+		const key = join(certs, `${project}.key`);
+		await copyFile(certificate.certFile, `${crt}.tmp`);
+		await rename(`${crt}.tmp`, crt);
+		await copyFile(certificate.keyFile, `${key}.tmp`);
+		await chmod(`${key}.tmp`, 384);
+		await rename(`${key}.tmp`, key);
+		files.push(crt, key);
+	} else await removeCertificate(dir, project);
+	await mkdir(join(dir, "dynamic"), { recursive: true });
+	const file = routesFile(dir, project);
+	await writeAtomic(file, routes);
+	files.push(file);
+	return files;
+}
+/** What a stack's file holds for the moment between emptying and removal. */
+const UNREGISTERED = "# Unregistered by gkm compose --down.\n";
+async function removeCertificate(dir, project) {
+	for (const ext of ["crt", "key"]) await rm(join(dir, "certs", `${project}.${ext}`), { force: true });
+}
+/**
+* Unregister a stack: its routes, then its certificate. Whether there was
+* anything to remove.
+*/
+async function removeEdgeRoutes(dir, project) {
+	const file = routesFile(dir, project);
+	const existed = existsSync(file);
+	if (existed) await writeAtomic(file, UNREGISTERED);
+	await rm(file, { force: true });
+	await removeCertificate(dir, project);
+	return existed;
+}
 //#endregion
 //#region src/compose/images.ts
 /**
@@ -715,9 +1117,16 @@ function redisService(redis) {
 }
 //#endregion
 //#region src/compose/caddyfile.ts
+/** Where Caddy reads a stage's own certificate, inside its container. */
+const CADDY_TLS_DIR = "/etc/caddy/tls";
+/** An upstream on the stack's own network: its service name. */
+function address({ service, port }) {
+	return `${service}:${port}`;
+}
 /** The Caddyfile for a stack's edge. */
-function edgeCaddyfile(sites, options) {
-	const global = options.local ? `{
+function edgeCaddyfile(routes, options) {
+	const { tls } = options;
+	const global = tls.kind === "internal" ? `{
 	# No ACME and no public DNS: the CA is Caddy's own and the names resolve
 	# to this machine.
 	local_certs
@@ -725,27 +1134,30 @@ function edgeCaddyfile(sites, options) {
 }` : options.email ? `{
 	email ${options.email}
 }` : "";
-	const blocks = sites.map(({ host, upstream, rewrite, allow }) => `https://${host} {${options.local ? `
+	const certificate = tls.kind === "internal" ? `
 	tls internal
-` : ""}${allow ? `
+` : tls.kind === "files" ? `
+	tls ${tls.certFile} ${tls.keyFile}
+` : "";
+	const blocks = routes.map(({ host, upstreams, prefix, allow, streaming }) => `https://${host} {${certificate}${allow ? `
 	# Only these addresses — the peer Caddy sees, never a header a client
 	# could set. Everything else is refused before it reaches the upstream.
 	@denied not remote_ip ${allow.join(" ")}
 	respond @denied 403
-` : ""}${rewrite ? `
+` : ""}${prefix ? `
 	# A bucket, served at a host of its own: the bucket is a prefix on MinIO,
 	# which routes and signs on the Host header — so it is sent the upstream's.
-	reverse_proxy ${upstream} {
-		rewrite ${rewrite}
+	reverse_proxy ${upstreams.map(address).join(" ")} {
+		rewrite ${prefix}{uri}
 		header_up Host {upstream_hostport}
 	}` : `
 	# Host and X-Forwarded-* are passed through as Caddy does by default, so
 	# an app builds redirects, cookies and links on the address a caller used.
-	reverse_proxy ${upstream} {
+	reverse_proxy ${upstreams.map(address).join(" ")}${streaming ? ` {
 		# Never buffer: a streamed response — server-sent events, a Next.js
 		# RSC payload — reaches the client as each chunk is written.
 		flush_interval -1
-	}`}
+	}` : ""}`}
 }`);
 	return `${HEADER}${global ? `${global}\n\n` : ""}${blocks.join("\n\n")}\n`;
 }
@@ -907,6 +1319,8 @@ function composeStack(input) {
 	const custom = input.secrets?.custom ?? {};
 	const https = input.ports?.https ?? 443;
 	const http = input.ports?.http ?? 80;
+	const proxy = proxyFor(workspace.deploy?.compose, stage, local);
+	const certificate = local ? void 0 : certificateFor(workspace.deploy?.compose, stage, workspace.root);
 	const plan = planFor(manifest, stage, provisionOrder(manifest), {
 		localStage: workspace.stages.local,
 		events: DEFAULT_EVENTS.server,
@@ -950,7 +1364,7 @@ function composeStack(input) {
 	for (const worker of workers) reads.set(worker.name, [...workerEnvKeys(manifest, worker.id, input.runnables) ?? []]);
 	const domain = workspace.deploy?.domains?.[stage];
 	const logsConfig = resolveLogs(workspace.deploy?.compose?.logs);
-	const logs = logsConfig ? stackLogs({
+	const logsBase = logsConfig ? stackLogs({
 		config: logsConfig,
 		stage,
 		local,
@@ -976,7 +1390,7 @@ function composeStack(input) {
 		local,
 		custom
 	});
-	const infra = [...plan.containers.filter((c) => !NOT_RUN[c]).filter((c) => c !== "minio" || services.minio.length > 0).filter((c) => c !== "mailpit" || services.mailpit.length > 0).filter((c) => c !== "redis" || redis !== void 0), ...logs ? [LOGS_SERVICE] : []].sort();
+	const infra = [...plan.containers.filter((c) => !NOT_RUN[c]).filter((c) => c !== "minio" || services.minio.length > 0).filter((c) => c !== "mailpit" || services.mailpit.length > 0).filter((c) => c !== "redis" || redis !== void 0), ...logsBase ? [LOGS_SERVICE] : []].sort();
 	const storage = infra.includes("minio") ? (() => {
 		const buckets = services.minio.map((id) => byId.get(id)?.name).filter((name) => Boolean(name)).sort();
 		return {
@@ -986,20 +1400,6 @@ function composeStack(input) {
 			policies: bucketPolicies(plan).filter((p) => buckets.includes(p.bucket))
 		};
 	})() : void 0;
-	const derivation = {
-		project: workspace.name,
-		master: credential.master,
-		...credential.seed ? { seed: credential.seed } : {},
-		...!local && domain ? { mailFrom: `noreply@${domain}` } : {}
-	};
-	const outside = networkEnv(plan, {
-		...derivation,
-		addresses: Object.fromEntries(apps.map((app) => [app.id, app.url]))
-	});
-	const inside = networkEnv(plan, {
-		...derivation,
-		addresses: Object.fromEntries(apps.map((app) => [app.id, `http://${app.name}:${app.port}`]))
-	});
 	const fileServers = /* @__PURE__ */ new Map();
 	if (storage) for (const resource of plan.resources) {
 		if (resource.kind !== "file-server" || !resource.of) continue;
@@ -1015,13 +1415,45 @@ function composeStack(input) {
 		}
 		fileServers.set(resource.id, {
 			url: `https://${host}${local && https !== 443 ? `:${https}` : ""}`,
-			site: {
+			route: {
+				name: `files-${appKey(resource.id)}`,
 				host,
-				upstream: "minio:9000",
-				rewrite: `/${bucket.name}{uri}`
+				upstreams: [{
+					service: "minio",
+					port: 9e3
+				}],
+				streaming: false,
+				prefix: `/${bucket.name}`
 			}
 		});
 	}
+	const edgeServices = new Set(proxy === "traefik" ? [
+		...apps.map((app) => app.name),
+		...fileServers.size > 0 ? ["minio"] : [],
+		...logsBase?.host && logsBase.public ? [LOGS_SERVICE] : []
+	] : []);
+	const hostOf = (service) => edgeServices.has(service) ? edgeAlias(project, service) : service;
+	const logs = logsBase && {
+		...logsBase,
+		appEnv: {
+			...logsBase.appEnv,
+			OTEL_EXPORTER_OTLP_ENDPOINT: logsBase.appEnv.OTEL_EXPORTER_OTLP_ENDPOINT.replace(`//openobserve:`, `//${hostOf("openobserve")}:`)
+		}
+	};
+	const derivation = {
+		project: workspace.name,
+		master: credential.master,
+		...credential.seed ? { seed: credential.seed } : {},
+		...!local && domain ? { mailFrom: `noreply@${domain}` } : {}
+	};
+	const outside = networkEnv(plan, {
+		...derivation,
+		addresses: Object.fromEntries(apps.map((app) => [app.id, app.url]))
+	}, hostOf);
+	const inside = networkEnv(plan, {
+		...derivation,
+		addresses: Object.fromEntries(apps.map((app) => [app.id, `http://${hostOf(app.name)}:${app.port}`]))
+	}, hostOf);
 	const surfaceUrls = new Map(plan.resources.filter((r) => r.kind === "rest-api" || r.kind === "site").map((r) => [r.envKey, r.id]));
 	const appById = new Map(apps.map((app) => [app.id, app]));
 	/**
@@ -1078,7 +1510,7 @@ function composeStack(input) {
 		const values = valuesFor(app, keys);
 		const trusted = provideKey(app.id, "trustedOrigins");
 		if (keys.has(trusted)) {
-			const internal = (byId.get(app.id)?.callers ?? []).map((caller) => appById.get(caller)).filter((caller) => caller?.kind === "rest-api").map((caller) => `http://${caller.name}:${caller.port}`);
+			const internal = (byId.get(app.id)?.callers ?? []).map((caller) => appById.get(caller)).filter((caller) => caller?.kind === "rest-api").map((caller) => `http://${hostOf(caller.name)}:${caller.port}`);
 			const origins = [...(values[trusted] ?? "").split(",").filter(Boolean), ...internal];
 			values[trusted] = [...new Set(origins)].join(",");
 		}
@@ -1112,6 +1544,14 @@ function composeStack(input) {
 		};
 		for (const [key, value] of Object.entries(worker.env)) if (/[\r\n]/.test(value)) throw new EnvValueMultiline(worker.name, key);
 	}
+	const deployedTls = certificate ? {
+		kind: "files",
+		...proxy === "caddy" ? {
+			certFile: `${CADDY_TLS_DIR}/cert.pem`,
+			keyFile: `${CADDY_TLS_DIR}/key.pem`
+		} : edgeCertificatePaths(project)
+	} : { kind: "acme" };
+	const tls = local ? { kind: "internal" } : deployedTls;
 	const layout = input.layout ?? defaultLayout(workspace.root);
 	const compose = stackFile({
 		project,
@@ -1128,20 +1568,34 @@ function composeStack(input) {
 		composeDir: join(workspace.root, stackDir(stage)),
 		buildRoot: layout.buildRoot,
 		workspaceRoot: workspace.root,
-		envFiles: !input.buildOnly
+		envFiles: !input.buildOnly,
+		proxy,
+		edge: new Map([...edgeServices].map((service) => [service, hostOf(service)])),
+		tls: certificate !== void 0
 	});
-	const caddyfile = edgeCaddyfile([
+	const routes = [
 		...apps.map((app) => ({
+			name: app.name,
 			host: app.host,
-			upstream: `${app.name}:${app.port}`
+			upstreams: [{
+				service: app.name,
+				port: app.port
+			}],
+			streaming: true,
+			health: app.kind === "site" ? "/" : "/health"
 		})),
-		...[...fileServers.values()].map(({ site }) => site),
+		...[...fileServers.values()].map(({ route }) => route),
 		...logs?.host && logs.public ? [{
+			name: LOGS_SERVICE,
 			host: logs.host,
-			upstream: `${LOGS_SERVICE}:${LOGS_PORT}`,
+			upstreams: [{
+				service: LOGS_SERVICE,
+				port: LOGS_PORT
+			}],
+			streaming: true,
 			allow: logs.public.allow
 		}] : []
-	], { local });
+	];
 	const dockerfiles = {};
 	for (const app of apps) {
 		if (!app.build) continue;
@@ -1173,7 +1627,13 @@ function composeStack(input) {
 		workers,
 		infra,
 		compose,
-		caddyfile,
+		proxy,
+		routes,
+		...proxy === "caddy" ? { caddyfile: edgeCaddyfile(routes, { tls }) } : { traefik: traefikDynamicFile(routes, {
+			project,
+			tls: deployedTls
+		}) },
+		...certificate ? { tls: certificate } : {},
 		dockerfiles,
 		plan,
 		credential,
@@ -1292,8 +1752,10 @@ function stackFile(options) {
 	const services = {};
 	const volumes = {
 		...derived.volumes,
-		"caddy-data": {},
-		"caddy-config": {},
+		...options.proxy === "caddy" ? {
+			"caddy-data": {},
+			"caddy-config": {}
+		} : {},
 		...options.logs ? { "openobserve-data": {} } : {}
 	};
 	for (const name of infra) {
@@ -1359,14 +1821,15 @@ function stackFile(options) {
 		...infra.length ? { depends_on: Object.fromEntries(infra.map((name) => [name, HEALTHY])) } : {},
 		healthcheck: probe(worker.port, "/health")
 	};
-	services.caddy = {
+	if (options.proxy === "caddy") services.caddy = {
 		image: DEFAULT_IMAGES.caddy,
 		restart: "unless-stopped",
 		ports: [`${options.https}:443`, `${options.http}:80`],
 		volumes: [
 			"./Caddyfile:/etc/caddy/Caddyfile:ro",
 			"caddy-data:/data",
-			"caddy-config:/config"
+			"caddy-config:/config",
+			...options.tls ? [`./tls:${CADDY_TLS_DIR}:ro`] : []
 		],
 		depends_on: Object.fromEntries(apps.map((app) => [app.name, HEALTHY])),
 		healthcheck: {
@@ -1380,6 +1843,14 @@ function stackFile(options) {
 			retries: 5
 		}
 	};
+	for (const [service, alias] of options.edge) {
+		const definition = services[service];
+		if (!definition) continue;
+		definition.networks = {
+			default: { aliases: [alias] },
+			edge: { aliases: [alias] }
+		};
+	}
 	for (const service of Object.values(services)) {
 		if (!options.envFiles) delete service.env_file;
 		service.logging = {
@@ -1390,7 +1861,11 @@ function stackFile(options) {
 	return {
 		name: project,
 		services,
-		volumes
+		volumes,
+		...options.edge.size > 0 ? { networks: { edge: {
+			name: EDGE_NETWORK,
+			external: true
+		} } } : {}
 	};
 }
 /**
@@ -1437,12 +1912,12 @@ var HealthRequestTimedOut = class extends Error {
 	}
 };
 /** The real probe: one HTTPS GET, the certificate verified. */
-const httpsProbe = ({ url, ca, connectTo, timeoutMs, signal }) => {
+const httpsProbe = ({ url, ca, connectTo, connectPort, timeoutMs, signal }) => {
 	const target = new URL(url);
 	return new Promise((resolve, reject) => {
 		const req = request({
 			host: connectTo ?? target.hostname,
-			port: target.port || 443,
+			port: connectPort ?? (target.port || 443),
 			servername: target.hostname,
 			path: `${target.pathname}${target.search}`,
 			method: "GET",
@@ -1468,10 +1943,13 @@ function isHealthy(status) {
 var ComposeAppsUnhealthy = class extends Error {
 	project;
 	apps;
-	constructor(project, apps) {
-		super(`${project} started, but ${apps.length === 1 ? "this app does" : "these apps do"} not answer through Caddy:\n` + apps.map(({ url, last }) => `  - ${url}: ${last}`).join("\n") + `\nSee why with \`docker compose -p ${project} logs caddy ${apps.map((a) => a.app).join(" ")}\`.`);
+	proxy;
+	constructor(project, apps, proxy = "caddy") {
+		const names = apps.map((a) => a.app).join(" ");
+		super(`${project} started, but ${apps.length === 1 ? "this app does" : "these apps do"} not answer through ${proxy === "caddy" ? "Caddy" : "the shared Traefik edge"}:\n` + apps.map(({ url, last }) => `  - ${url}: ${last}`).join("\n") + (proxy === "caddy" ? `\nSee why with \`docker compose -p ${project} logs caddy ${names}\`.` : `\nSee why with \`docker compose -p gkm-edge logs traefik\` and \`docker compose -p ${project} logs ${names}\`.`));
 		this.project = project;
 		this.apps = apps;
+		this.proxy = proxy;
 		this.name = "ComposeAppsUnhealthy";
 	}
 };
@@ -1614,13 +2092,20 @@ async function validateCompose(ctx, deps, options = {}) {
 		background
 	});
 	const { secrets, generated } = await stageSecrets(ctx, manifest);
-	if (!push) await assertStageCredentials({
-		root,
-		patterns: constructGlobs(workspace),
-		manifest,
-		stage,
-		supplied: secrets?.custom ?? {}
-	});
+	if (!push) {
+		assertNoStaleSecrets({
+			manifest,
+			stage,
+			supplied: secrets?.custom ?? {}
+		});
+		await assertStageCredentials({
+			root,
+			patterns: constructGlobs(workspace),
+			manifest,
+			stage,
+			supplied: secrets?.custom ?? {}
+		});
+	}
 	const layout = mode === "build" ? imageLayout(workspace) : void 0;
 	const composed = composeStack({
 		workspace,
@@ -1644,6 +2129,9 @@ async function validateCompose(ctx, deps, options = {}) {
 	if (mode === "build") assertRedisClient(workspace, composed);
 	const stack = options.pin ? withPinnedImages(composed, options.pin.file, options.pin.digests) : composed;
 	if (mode === "pull" && !ctx.dryRun) await assertImagesExist(deps.docker, tag, [...stack.apps, ...stack.workers]);
+	if (stack.tls && !push) {
+		for (const file of [stack.tls.certFile, stack.tls.keyFile]) if (!existsSync(file)) throw new ComposeTlsFileMissing(stage, file);
+	}
 	if (stack.redis && !stack.local) ctx.secrets.mask(stack.redis.password);
 	if (stack.logs && (!stack.local || stack.logs.passwordFromSecrets)) {
 		ctx.secrets.mask(stack.logs.password);
@@ -1812,7 +2300,7 @@ async function planCompose(ctx, run) {
 		});
 	}
 	if (!run.push) planned({
-		key: "service:caddy",
+		key: run.stack.proxy === "caddy" ? "service:caddy" : `service:${EDGE_PROJECT}/${EDGE_SERVICE}`,
 		resourceType: "service",
 		action: "ensure"
 	});
@@ -1829,8 +2317,35 @@ async function provisionCompose(ctx, run, deps) {
 		await ctx.secrets.write(run.secrets);
 		ctx.logger.info(`🔑 Generated for "${ctx.stage}" (${ctx.secrets.store}): ${run.generated.join(", ")}`);
 	}
+	const ports = edgePorts(deps.env);
+	await assertEdgePorts(deps.docker, {
+		project: stack.project,
+		proxy: stack.proxy,
+		ports
+	});
 	run.files = await writeStack(ctx.cwd, run.dir, stack);
 	printPlan(ctx, run);
+	if (stack.proxy === "traefik") {
+		const dir = edgeDir(deps.env);
+		ctx.logger.info(`\n🌐 Starting the shared edge (${EDGE_PROJECT}) from ${dir}…`);
+		run.files.push(...await ensureEdge(deps.docker, {
+			dir,
+			ports,
+			logging: {
+				driver: LOG_ROTATION.driver,
+				options: { ...LOG_ROTATION.options }
+			},
+			...ref.output ? { output: ref.output } : {},
+			...ref.signal ? { signal: ref.signal } : {}
+		}));
+		applied(ctx, run, {
+			key: `service:${EDGE_PROJECT}/${EDGE_SERVICE}`,
+			resourceType: "service",
+			action: "ensure",
+			id: `${EDGE_PROJECT}/${EDGE_SERVICE}`,
+			via: "found"
+		});
+	}
 	if (stack.infra.length > 0) {
 		ctx.logger.info(`\n🗄️  Starting ${stack.infra.join(", ")}…`);
 		await deps.docker.up(ref, stack.infra);
@@ -1940,6 +2455,12 @@ async function releaseCompose(ctx, run, deps) {
 	if (run.push) return;
 	ctx.logger.info("\n🚀 Starting the stack…");
 	await deps.docker.up(ref);
+	const edge = edgeDir(deps.env);
+	if (stack.proxy === "traefik" && stack.traefik) {
+		const written = await writeEdgeRoutes(edge, stack.project, stack.traefik, stack.tls);
+		run.files.push(...written);
+		ctx.logger.info(`🌐 Registered ${stack.routes.length} route(s) with ${EDGE_PROJECT}: ${written.at(-1)}`);
+	} else await removeEdgeRoutes(edge, stack.project);
 	if (stack.local) await deps.docker.copyOut(ref, "caddy", "/data/caddy/pki/authorities/local/root.crt", caFile(run)).catch(() => {});
 	await recordImages(ctx, run);
 	for (const app of stack.apps) {
@@ -1998,10 +2519,14 @@ async function verifyCompose(ctx, run, deps) {
 	const { stack } = run;
 	if (run.push) return;
 	const ca = stack.local ? await readFile(caFile(run), "utf-8").catch(() => void 0) : void 0;
-	ctx.logger.info("\n🩺 Checking each app through Caddy…");
+	ctx.logger.info(`\n🩺 Checking each app through ${stack.proxy === "caddy" ? "Caddy" : "the shared edge"}…`);
+	const edge = stack.local || stack.proxy === "traefik" ? {
+		connectTo: "127.0.0.1",
+		...stack.local ? {} : { connectPort: edgePorts(deps.env).https }
+	} : void 0;
 	const results = await Promise.all(stack.apps.map((app) => checkApp(ctx, app, deps, {
 		ca,
-		local: stack.local
+		edge
 	})));
 	results.push(...await Promise.all(stack.workers.map((worker) => checkContainer(ctx, run, deps, worker.name))));
 	if (stack.logs) results.push(await checkContainer(ctx, run, deps, LOGS_SERVICE));
@@ -2010,7 +2535,7 @@ async function verifyCompose(ctx, run, deps) {
 		url,
 		last
 	}));
-	if (down.length > 0) throw new ComposeAppsUnhealthy(stack.project, down);
+	if (down.length > 0) throw new ComposeAppsUnhealthy(stack.project, down, stack.proxy);
 	if (stack.logs) reportLogs(ctx, stack.logs, stack.local);
 }
 /**
@@ -2089,7 +2614,7 @@ async function checkApp(ctx, app, deps, options) {
 			status = await deps.probe({
 				url,
 				...options.ca ? { ca: options.ca } : {},
-				...options.local ? { connectTo: "127.0.0.1" } : {},
+				...options.edge,
 				timeoutMs: 1e4,
 				signal: ctx.signal
 			});
@@ -2190,7 +2715,22 @@ async function writeStack(root, dir, stack) {
 		files.push(path);
 	};
 	await write(join(dir, "docker-compose.yml"), composeYaml(stack));
-	await write(join(dir, "Caddyfile"), stack.caddyfile);
+	if (stack.caddyfile !== void 0) {
+		await write(join(dir, "Caddyfile"), stack.caddyfile);
+		await rm(join(dir, "traefik.yml"), { force: true });
+	} else await rm(join(dir, "Caddyfile"), { force: true });
+	if (stack.traefik !== void 0) await write(join(dir, "traefik.yml"), stack.traefik);
+	if (stack.proxy === "caddy" && stack.tls) {
+		await mkdir(join(dir, "tls"), {
+			recursive: true,
+			mode: 448
+		});
+		await write(join(dir, "tls", "cert.pem"), await readFile(stack.tls.certFile, "utf-8"));
+		await write(join(dir, "tls", "key.pem"), await readFile(stack.tls.keyFile, "utf-8"), 384);
+	} else await rm(join(dir, "tls"), {
+		recursive: true,
+		force: true
+	});
 	for (const app of [...stack.apps, ...stack.workers]) if (app.env) await write(join(dir, `${app.name}.env`), envFile(app.env), 384);
 	if (stack.logs && stack.compose.services["openobserve"]?.env_file) await write(join(dir, `${LOGS_SERVICE}.env`), envFile(stack.logs.env), 384);
 	if (stack.redis && stack.compose.services["redis"]?.env_file) await write(join(dir, `${REDIS_SERVICE}.env`), envFile(stack.redis.env), 384);
@@ -2202,7 +2742,7 @@ async function writeStack(root, dir, stack) {
 function composeYaml(stack) {
 	const stage = ` --stage ${stack.stage}`;
 	return `# Generated by gkm compose from the construct manifest — do not edit.
-# The ${stack.stage} stage's APIs and sites behind one Caddy, and its workers.
+# The ${stack.stage} stage's APIs and sites behind ${stack.proxy === "caddy" ? "one Caddy" : `the shared Traefik edge (${EDGE_PROJECT})`}, and its workers.
 # Each backend and worker reads exactly the keys in its own env file beside
 # this one.
 #
@@ -2286,6 +2826,6 @@ function composeTarget(options = {}) {
 	});
 }
 //#endregion
-export { stackOverrideFile as a, parseDigests as c, ComposePushNeedsBuild as i, pinnedRef as l, compose_exports as n, composeProject as o, ComposePinNeedsPull as r, stackDir as s, composeTarget as t, dockerCompose as u };
+export { stackOverrideFile as a, parseDigests as c, removeEdgeRoutes as d, EDGE_PROJECT as f, ComposePushNeedsBuild as i, pinnedRef as l, compose_exports as n, composeProject as o, dockerCompose as p, ComposePinNeedsPull as r, stackDir as s, composeTarget as t, edgeDir as u };
 
-//# sourceMappingURL=compose-Dq4VCtu5.mjs.map
+//# sourceMappingURL=compose-DByK353T.mjs.map