@geekmidas/cli 10.0.0-alpha.80 → 10.0.0-alpha.82

package/dist/{compose-Bn4OJONR.cjs → compose-qnDyPJNp.cjs}

@@ -4,9 +4,9 @@ const require_discover = require("./discover-D1It5r_h.cjs");
 const require_derive = require("./derive-DAbo49sm.cjs");
 const require_workspace = require("./workspace-Bp8FEkF-.cjs");
 const require_define = require("./define-DzRz8FgH.cjs");
-const require_seeds = require("./seeds-ZljwYV_p.cjs");
-const require_SubscriberGenerator = require("./SubscriberGenerator-CajwOa5W.cjs");
-const require_drivers = require("./drivers-BdvtCKc7.cjs");
+const require_seeds = require("./seeds-BLzrSwEr.cjs");
+const require_SubscriberGenerator = require("./SubscriberGenerator-CYriX5BV.cjs");
+const require_drivers = require("./drivers-CJx76mcb.cjs");
 const require_databases = require("./databases-BY-pEImp.cjs");
 const require_credentialSchemas = require("./credentialSchemas-DCR4Wd1W.cjs");
 let node_path = require("node:path");
@@ -792,330 +792,6 @@ function pinImages(file, digests, images) {
 	});
 }
 //#endregion
-//#region src/compose/logs.ts
-/**
-* The stack's log UI: OpenObserve, run beside the apps when
-* `deploy.compose.logs` asks for it, and every backend's OpenTelemetry
-* pointed at it.
-*
-* The production server already exports its traces and pino logs over
-* OTLP/HTTP when `OTEL_EXPORTER_OTLP_ENDPOINT` is set. OpenObserve takes OTLP
-* at `/api/<org>/v1/{logs,traces}` with HTTP basic auth, so wiring an app is
-* two variables: the endpoint, `http://openobserve:5080/api/default`, and
-* the header that signs in as the root user.
-*
-* It is reached, by default, through an SSH tunnel: published on 127.0.0.1
-* only, because a port Docker publishes on every interface is opened in the
-* firewall by Docker itself, past ufw's rules. Served publicly, it is a host
-* on the stack's Caddy that refuses every address not allowed.
-*
-* Pure: the stack decides it, and the phases print and check it.
-*/
-/**
-* The image, pinned. A log store's on-disk format is the thing that must not
-* move under a running stack, so a new version is a change to this line.
-*/
-const OPENOBSERVE_IMAGE = "public.ecr.aws/zinclabs/openobserve:v1.0.4";
-/** Its compose service name — the host the apps send to. */
-const LOGS_SERVICE = "openobserve";
-/** The organisation every app's telemetry lands in. */
-const LOGS_ORG = "default";
-/** The stage secrets that sign in as OpenObserve's root user. */
-const LOGS_EMAIL_KEY = "ZO_ROOT_USER_EMAIL";
-const LOGS_PASSWORD_KEY = "ZO_ROOT_USER_PASSWORD";
-/** The stage sends its telemetry somewhere already, and logs are on too. */
-var LogsEndpointConflict = class extends Error {
-	stage;
-	keys;
-	constructor(stage, keys) {
-		super(`The stage '${stage}' sets ${keys.join(", ")} in its secrets, and deploy.compose.logs also runs OpenObserve for it — each backend can send its telemetry to one place. Either keep your own OTLP backend: remove logs from deploy.compose in gkm.config.ts; or use the bundled OpenObserve: remove ${keys.join(", ")} from the stage's secrets, and every backend is pointed at it.`);
-		this.stage = stage;
-		this.keys = keys;
-		this.name = "LogsEndpointConflict";
-	}
-};
-/** A root password OpenObserve would refuse to start with. */
-var LogsPasswordWeak = class extends Error {
-	stage;
-	constructor(stage) {
-		super(`The stage '${stage}' sets ${LOGS_PASSWORD_KEY}, and OpenObserve refuses it: a root password must be 8 to 128 characters with a lowercase letter, an uppercase letter, a digit and a symbol. Set another with gkm secrets:set ${LOGS_PASSWORD_KEY} '…' --stage ${stage}, or unset it to have one generated.`);
-		this.stage = stage;
-		this.name = "LogsPasswordWeak";
-	}
-};
-/** A deployed stage with logs on and no root password generated yet. */
-var LogsPasswordMissing = class extends Error {
-	stage;
-	constructor(stage) {
-		super(`The stage '${stage}' runs OpenObserve and has no ${LOGS_PASSWORD_KEY} in its secrets. Run gkm compose --stage ${stage} without --dry-run once to generate it, or set one: gkm secrets:set ${LOGS_PASSWORD_KEY} '…' --stage ${stage}`);
-		this.stage = stage;
-		this.name = "LogsPasswordMissing";
-	}
-};
-/** Whether OpenObserve accepts `password` for its root user. */
-function isStrongLogsPassword(password) {
-	return password.length >= 8 && password.length <= 128 && /[a-z]/.test(password) && /[A-Z]/.test(password) && /\d/.test(password) && /[^A-Za-z0-9]/.test(password);
-}
-/**
-* A root password: 192 random bits, with a fixed tail so every class
-* OpenObserve requires is present whatever the random part drew.
-*/
-function generateLogsPassword() {
-	return `${(0, node_crypto.randomBytes)(24).toString("base64url")}-Zo1`;
-}
-/**
-* The stage's secrets with a generated root password, where it has none.
-* Pure, like `withGeneratedSecrets`: the caller keeps the result once the
-* run goes ahead.
-*/
-function withLogsPassword(secrets) {
-	if (secrets.custom?.["ZO_ROOT_USER_PASSWORD"]) return {
-		secrets,
-		generated: []
-	};
-	return {
-		secrets: {
-			...secrets,
-			custom: {
-				...secrets.custom,
-				[LOGS_PASSWORD_KEY]: generateLogsPassword()
-			},
-			updatedAt: (/* @__PURE__ */ new Date()).toISOString()
-		},
-		generated: [LOGS_PASSWORD_KEY]
-	};
-}
-/**
-* `OTEL_EXPORTER_OTLP_HEADERS` signing in as `email`.
-*
-* The variable's values are percent-decoded by the SDK (they follow the W3C
-* baggage format), so the space after `Basic` is written `%20`. Base64's own
-* `+`, `/` and `=` pass through decoding unchanged.
-*/
-function otlpHeaders(email, password) {
-	return `Authorization=Basic%20${Buffer.from(`${email}:${password}`).toString("base64")}`;
-}
-/** The stack's OpenObserve for one stage. */
-function stackLogs(options) {
-	const { config, stage, local, custom } = options;
-	const conflicting = Object.keys(custom).filter(require_seeds.isOtlpDestination).sort();
-	if (conflicting.length > 0) throw new LogsEndpointConflict(stage, conflicting);
-	if (!local && !options.domain) throw new require_seeds.NoDomainForStage(stage);
-	const email = custom["ZO_ROOT_USER_EMAIL"] ?? (local ? "admin@gkm.localhost" : `admin@${options.domain}`);
-	const set = custom[LOGS_PASSWORD_KEY];
-	if (!set && !local) throw new LogsPasswordMissing(stage);
-	const password = set ?? "Geekmidas-1";
-	if (!isStrongLogsPassword(password)) throw new LogsPasswordWeak(stage);
-	const host = config.public ? local ? `logs.${options.project}.localhost` : `logs.${options.domain}` : void 0;
-	const url = host ? `https://${host}${local && options.https !== 443 ? `:${options.https}` : ""}` : `http://localhost:${config.port}`;
-	return {
-		...config,
-		email,
-		password,
-		passwordFromSecrets: Boolean(set),
-		url,
-		...host ? { host } : {},
-		env: {
-			[LOGS_EMAIL_KEY]: email,
-			[LOGS_PASSWORD_KEY]: password,
-			ZO_DATA_DIR: "/data",
-			ZO_COMPACT_DATA_RETENTION_DAYS: String(config.retentionDays),
-			ZO_TELEMETRY: "false"
-		},
-		appEnv: {
-			OTEL_EXPORTER_OTLP_ENDPOINT: `http://${LOGS_SERVICE}:${require_workspace.LOGS_PORT}/api/${LOGS_ORG}`,
-			OTEL_EXPORTER_OTLP_HEADERS: otlpHeaders(email, password)
-		}
-	};
-}
-/**
-* OpenObserve's service. The image has no shell, `wget` or `curl`, so its
-* health check is its own binary asking the running server for its status —
-* which exits non-zero when nothing answers on its port.
-*/
-function logsService(logs) {
-	return {
-		image: OPENOBSERVE_IMAGE,
-		restart: "unless-stopped",
-		env_file: [{
-			path: `./${LOGS_SERVICE}.env`,
-			format: "raw"
-		}],
-		volumes: ["openobserve-data:/data"],
-		...logs.public ? {} : { ports: [`127.0.0.1:${logs.port}:${require_workspace.LOGS_PORT}`] },
-		healthcheck: {
-			test: [
-				"CMD",
-				"/openobserve",
-				"node",
-				"status"
-			],
-			interval: "10s",
-			timeout: "5s",
-			retries: 12,
-			start_period: "20s"
-		}
-	};
-}
-/** What `gkm compose` prints once the stack is up: how to open the logs. */
-function logsAccess(logs, ctx) {
-	const login = `login: ${logs.email}, password: ${ctx.local && !logs.passwordFromSecrets ? logs.password : `gkm secrets:show --stage ${ctx.stage} --reveal → ${LOGS_PASSWORD_KEY}`}`;
-	if (logs.public) return [`📜 Logs (OpenObserve): ${logs.url}  (${login})`, `     answered only for ${logs.public.allow.join(", ")}; every other address gets 403`];
-	return [
-		`📜 Logs (OpenObserve) on 127.0.0.1:${logs.port} — from your computer:`,
-		...ctx.local ? [`     on this machine, open http://localhost:${logs.port} directly; from another:`] : [],
-		`     ssh -N -L ${logs.port}:localhost:${logs.port} ${ctx.user}@${ctx.hostname}   (user and host are guesses: this machine's)`,
-		`     then open http://localhost:${logs.port}  (${login})`,
-		`⚠️  Docker-published ports bypass ufw, so OpenObserve is bound to 127.0.0.1 only — reach it through the tunnel, not by opening the port.`
-	];
-}
-//#endregion
-//#region src/compose/redis.ts
-/**
-* The stack's Redis: what every declared cache lives in when a workspace runs
-* as a `gkm compose` stack, on the local stage and on a deployed one alike.
-*
-* A cache is the one store whose contents can always be rebuilt, so unlike
-* Mailpit and MinIO it is a production service, not a dev stand-in: it runs
-* for every stage, on the compose network only, with nothing published. It
-* is bounded (`maxmemory`, evicting the least recently used key), persisted
-* (an append-only file on a named volume, kept by `--down`) and password
-* protected — the stage's own password, generated once like its seed.
-*
-* A stage that sets a cache's URL in its secrets — a managed Redis — keeps
-* it, and a stack whose every cache is set that way runs no Redis at all.
-*
-* Pure: the stack decides it, and the phases keep the password.
-*/
-/**
-* Where a stack's caches live: its own Redis, whatever the deploy target's
-* default is. A stack is one machine running containers, and a Redis beside
-* the apps is cheaper for a cache than a table in the database they share.
-*/
-const STACK_CACHE = "redis";
-/** Its compose service name — the host every cache URL points at. */
-const REDIS_SERVICE = "redis";
-/** The port it answers on, inside the network. */
-const REDIS_PORT = 6379;
-/** Reconcile's pin, so `gkm dev` and the stack run one Redis. */
-const REDIS_IMAGE = require_seeds.DEFAULT_IMAGES.redis;
-/**
-* How much it may hold before it evicts. A cache that grows until the box
-* runs out of memory takes the apps with it; 256 MB is a lot of sessions and
-* little of a small server. A project's `docker-compose.<stage>.yml` can
-* replace the command to change it.
-*/
-const REDIS_MAXMEMORY = "256mb";
-/** The stage secret holding its password. */
-const REDIS_PASSWORD_KEY = "REDIS_PASSWORD";
-/** Redis's own count of logical databases, before `--databases` raises it. */
-const REDIS_DATABASES = 16;
-/** A deployed stage that runs the stack's Redis and has no password yet. */
-var RedisPasswordMissing = class extends Error {
-	stage;
-	constructor(stage) {
-		super(`The stage '${stage}' runs the stack's Redis and has no ${REDIS_PASSWORD_KEY} in its secrets. Run gkm compose --stage ${stage} without --dry-run once to generate it, or set one: gkm secrets:set ${REDIS_PASSWORD_KEY} '…' --stage ${stage}`);
-		this.stage = stage;
-		this.name = "RedisPasswordMissing";
-	}
-};
-/**
-* Whether a stage's stack runs Redis: a cache is declared and the stage's
-* secrets do not set the URL of every one.
-*/
-function runsRedis(manifest, custom) {
-	return Object.values(manifest).some((declaration) => declaration?.kind === "cache" && (declaration.provides ?? []).some((key) => custom[key] === void 0));
-}
-/** A password: 256 random bits, URL-safe, so it sits in a URL unescaped. */
-function generateRedisPassword() {
-	return (0, node_crypto.randomBytes)(32).toString("base64url");
-}
-/**
-* The stage's secrets with a generated Redis password, where it has none.
-* Pure, like `withGeneratedSecrets`: the caller keeps the result once the run
-* goes ahead.
-*/
-function withRedisPassword(secrets) {
-	if (secrets.custom?.["REDIS_PASSWORD"]) return {
-		secrets,
-		generated: []
-	};
-	return {
-		secrets: {
-			...secrets,
-			custom: {
-				...secrets.custom,
-				[REDIS_PASSWORD_KEY]: generateRedisPassword()
-			},
-			updatedAt: (/* @__PURE__ */ new Date()).toISOString()
-		},
-		generated: [REDIS_PASSWORD_KEY]
-	};
-}
-/**
-* The stack's Redis for one stage, or nothing where no cache needs it.
-*
-* Each cache it holds gets a logical database of its own, by the order of
-* their ids, so two caches never read each other's keys.
-*/
-function stackRedis(options) {
-	const { plan, stage, local, custom } = options;
-	const caches = plan.resources.filter((r) => r.kind === "cache" && custom[r.envKey] === void 0).sort((a, b) => a.id.localeCompare(b.id));
-	if (caches.length === 0) return void 0;
-	const set = custom[REDIS_PASSWORD_KEY];
-	if (!set && !local) throw new RedisPasswordMissing(stage);
-	const password = set ?? "geekmidas";
-	const auth = encodeURIComponent(password);
-	return {
-		password,
-		passwordFromSecrets: Boolean(set),
-		urls: Object.fromEntries(caches.map((cache, index) => [cache.envKey, `redis://:${auth}@${REDIS_SERVICE}:${REDIS_PORT}/${index}`])),
-		env: {
-			[REDIS_PASSWORD_KEY]: password,
-			REDISCLI_AUTH: password
-		},
-		databases: Math.max(REDIS_DATABASES, caches.length)
-	};
-}
-/**
-* Redis's service: bounded, persisted and password protected, on the
-* network alone.
-*
-* The command runs the image's own entrypoint with `redis-server` first, so
-* it still drops to the `redis` user and owns `/data`; the password is read
-* from the env file by the shell (`$$` is compose's escape for `$`), so
-* neither the compose file nor the container's command holds it.
-*/
-function redisService(redis) {
-	const flags = [
-		`--requirepass "$$${REDIS_PASSWORD_KEY}"`,
-		`--maxmemory ${REDIS_MAXMEMORY}`,
-		"--maxmemory-policy allkeys-lru",
-		"--appendonly yes",
-		...redis.databases > REDIS_DATABASES ? [`--databases ${redis.databases}`] : []
-	];
-	return {
-		image: REDIS_IMAGE,
-		restart: "unless-stopped",
-		command: [
-			"sh",
-			"-c",
-			`exec docker-entrypoint.sh redis-server ${flags.join(" ")}`
-		],
-		env_file: [{
-			path: `./${REDIS_SERVICE}.env`,
-			format: "raw"
-		}],
-		volumes: ["redis-data:/data"],
-		healthcheck: {
-			test: ["CMD-SHELL", "redis-cli ping | grep -q PONG"],
-			interval: "5s",
-			timeout: "3s",
-			retries: 10
-		}
-	};
-}
-//#endregion
 //#region src/compose/caddyfile.ts
 /** Where Caddy reads a stage's own certificate, inside its container. */
 const CADDY_TLS_DIR = "/etc/caddy/tls";
@@ -1246,6 +922,43 @@ const LOG_ROTATION = {
 		"max-file": "3"
 	}
 };
+/** The local stage's stack, without the logins `gkm dev` generates. */
+var LocalCredentialsMissing = class extends Error {
+	stage;
+	constructor(stage) {
+		super(`The local stage '${stage}' runs with this machine's generated logins, and none were passed. Load them with loadLocalCredentials(workspace) and pass them as localCredentials.`);
+		this.stage = stage;
+		this.name = "LocalCredentialsMissing";
+	}
+};
+/**
+* A deployed stage's container logins, derived from its seed like its role
+* passwords — so every deploy of the stage computes the same ones, and no one
+* reading the repo can.
+*/
+function derivedCredentials(project, plan, seed) {
+	const derive = (purpose) => require_seeds.localRolePassword(project, plan, purpose, seed);
+	return {
+		postgres: {
+			user: require_seeds.postgresSuperuser(project),
+			password: derive("master")
+		},
+		minio: {
+			user: `${project}-minio`,
+			password: derive("minio")
+		},
+		rabbitmq: {
+			user: require_seeds.LOCAL_RABBITMQ_USER,
+			password: derive("rabbitmq")
+		},
+		redis: { password: derive("redis") },
+		cacheToken: derive("cache-token"),
+		emulator: {
+			accessKeyId: require_seeds.EMULATOR_ACCESS_KEY_ID,
+			secretAccessKey: derive("emulator")
+		}
+	};
+}
 /** A value only the stage's secrets can hold, and they do not. */
 var StageSecretMissing = class extends Error {
 	app;
@@ -1324,15 +1037,23 @@ function composeStack(input) {
 	const plan = require_seeds.planFor(manifest, stage, (0, _geekmidas_manifest.provisionOrder)(manifest), {
 		localStage: workspace.stages.local,
 		events: require_SubscriberGenerator.DEFAULT_EVENTS.server,
-		cache: STACK_CACHE,
+		cache: require_seeds.STACK_CACHE,
 		edge: false
 	});
 	const byId = new Map(plan.resources.map((r) => [r.id, r]));
-	const seed = local ? void 0 : input.secrets?.seed;
-	if (!local && !seed) throw new StageSeedMissing(stage);
+	if (local && !input.localCredentials) throw new LocalCredentialsMissing(stage);
+	const seed = local ? input.localCredentials.seed : input.secrets?.seed;
+	if (!seed) throw new StageSeedMissing(stage);
+	const containers = local ? input.localCredentials : derivedCredentials(workspace.name, plan, seed);
 	const credential = {
-		master: local ? "geekmidas" : require_seeds.localRolePassword(workspace.name, plan, "master", seed),
-		...seed ? { seed } : {}
+		containers: {
+			...containers,
+			minio: {
+				user: custom.AWS_ACCESS_KEY_ID ?? containers.minio.user,
+				password: custom.AWS_SECRET_ACCESS_KEY ?? containers.minio.password
+			}
+		},
+		seed
 	};
 	const apps = stackApps(workspace, manifest, plan, {
 		local,
@@ -1364,14 +1085,15 @@ function composeStack(input) {
 	for (const worker of workers) reads.set(worker.name, [...require_seeds.workerEnvKeys(manifest, worker.id, input.runnables) ?? []]);
 	const domain = workspace.deploy?.domains?.[stage];
 	const logsConfig = require_workspace.resolveLogs(workspace.deploy?.compose?.logs);
-	const logsBase = logsConfig ? stackLogs({
+	const logsBase = logsConfig ? require_seeds.stackLogs({
 		config: logsConfig,
 		stage,
 		local,
 		project: workspace.name,
 		...domain ? { domain } : {},
 		custom,
-		https
+		https,
+		...local ? { localLogin: input.localCredentials.logs } : {}
 	}) : void 0;
 	const services = local ? {
 		missing: [],
@@ -1384,18 +1106,18 @@ function composeStack(input) {
 		allow: input.allowDevServices ?? [],
 		...domain ? { domain } : {}
 	});
-	const redis = stackRedis({
+	const redis = require_seeds.stackRedis({
 		plan,
 		stage,
 		local,
-		custom
+		custom,
+		...local ? { localPassword: input.localCredentials.redis.password } : {}
 	});
-	const infra = [...plan.containers.filter((c) => !NOT_RUN[c]).filter((c) => c !== "minio" || services.minio.length > 0).filter((c) => c !== "mailpit" || services.mailpit.length > 0).filter((c) => c !== "redis" || redis !== void 0), ...logsBase ? [LOGS_SERVICE] : []].sort();
+	const infra = [...plan.containers.filter((c) => !NOT_RUN[c]).filter((c) => c !== "minio" || services.minio.length > 0).filter((c) => c !== "mailpit" || services.mailpit.length > 0).filter((c) => c !== "redis" || redis !== void 0), ...logsBase ? [require_seeds.LOGS_SERVICE] : []].sort();
 	const storage = infra.includes("minio") ? (() => {
 		const buckets = services.minio.map((id) => byId.get(id)?.name).filter((name) => Boolean(name)).sort();
 		return {
-			user: custom.AWS_ACCESS_KEY_ID ?? (local ? "geekmidas" : `${workspace.name}-minio`),
-			password: custom.AWS_SECRET_ACCESS_KEY ?? (local ? "geekmidas" : require_seeds.localRolePassword(workspace.name, plan, "minio", seed)),
+			...credential.containers.minio,
 			buckets,
 			policies: require_seeds.bucketPolicies(plan).filter((p) => buckets.includes(p.bucket))
 		};
@@ -1430,7 +1152,7 @@ function composeStack(input) {
 	const edgeServices = new Set(proxy === "traefik" ? [
 		...apps.map((app) => app.name),
 		...fileServers.size > 0 ? ["minio"] : [],
-		...logsBase?.host && logsBase.public ? [LOGS_SERVICE] : []
+		...logsBase?.host && logsBase.public ? [require_seeds.LOGS_SERVICE] : []
 	] : []);
 	const hostOf = (service) => edgeServices.has(service) ? edgeAlias(project, service) : service;
 	const logs = logsBase && {
@@ -1442,8 +1164,8 @@ function composeStack(input) {
 	};
 	const derivation = {
 		project: workspace.name,
-		master: credential.master,
-		...credential.seed ? { seed: credential.seed } : {},
+		credentials: credential.containers,
+		seed: credential.seed,
 		...!local && domain ? { mailFrom: `noreply@${domain}` } : {}
 	};
 	const outside = require_seeds.networkEnv(plan, {
@@ -1559,7 +1281,7 @@ function composeStack(input) {
 		infra,
 		apps,
 		workers,
-		master: credential.master,
+		credentials: credential.containers,
 		...storage ? { storage } : {},
 		...logs ? { logs } : {},
 		...redis ? { redis } : {},
@@ -1586,10 +1308,10 @@ function composeStack(input) {
 		})),
 		...[...fileServers.values()].map(({ route }) => route),
 		...logs?.host && logs.public ? [{
-			name: LOGS_SERVICE,
+			name: require_seeds.LOGS_SERVICE,
 			host: logs.host,
 			upstreams: [{
-				service: LOGS_SERVICE,
+				service: require_seeds.LOGS_SERVICE,
 				port: require_workspace.LOGS_PORT
 			}],
 			streaming: true,
@@ -1604,7 +1326,7 @@ function composeStack(input) {
 			workspaceRoot: workspace.root,
 			apps: workspace.apps,
 			manifest,
-			cache: STACK_CACHE
+			cache: require_seeds.STACK_CACHE
 		});
 	}
 	for (const worker of workers) {
@@ -1616,7 +1338,7 @@ function composeStack(input) {
 		}, workspace.apps[worker.host], {
 			layout,
 			workspaceRoot: workspace.root,
-			cache: STACK_CACHE
+			cache: require_seeds.STACK_CACHE
 		});
 	}
 	return {
@@ -1741,13 +1463,14 @@ function hostOf(name, app, workspace, resource, options) {
 /** The compose document: the infrastructure, the apps, and the edge. */
 function stackFile(options) {
 	const { project, plan, apps } = options;
-	const infra = options.infra.filter((name) => name !== LOGS_SERVICE);
+	const infra = options.infra.filter((name) => name !== require_seeds.LOGS_SERVICE);
 	const derived = require_seeds.composeFor({
 		...plan,
 		containers: [...infra]
 	}, {
 		project,
-		ports: Object.fromEntries(require_seeds.portKeys(infra, plan.fakes).map((key) => [key, 0]))
+		ports: Object.fromEntries(require_seeds.portKeys(infra, plan.fakes).map((key) => [key, 0])),
+		credentials: options.credentials
 	});
 	const services = {};
 	const volumes = {
@@ -1766,13 +1489,7 @@ function stackFile(options) {
 		};
 	}
 	const postgres = services.postgres;
-	if (postgres) {
-		postgres.environment = {
-			...postgres.environment,
-			POSTGRES_PASSWORD: options.master
-		};
-		postgres.ports = ["127.0.0.1::5432"];
-	}
+	if (postgres) postgres.ports = ["127.0.0.1::5432"];
 	const minio = services.minio;
 	if (minio && options.storage) {
 		minio.environment = {
@@ -1782,8 +1499,8 @@ function stackFile(options) {
 		};
 		minio.ports = ["127.0.0.1::9000"];
 	}
-	if (services["redis"] && options.redis) services[REDIS_SERVICE] = redisService(options.redis);
-	if (options.logs) services[LOGS_SERVICE] = logsService(options.logs);
+	if (services["redis"] && options.redis) services[require_seeds.REDIS_SERVICE] = require_seeds.redisService(options.redis);
+	if (options.logs) services[require_seeds.LOGS_SERVICE] = require_seeds.logsService(options.logs);
 	for (const app of apps) services[app.name] = {
 		image: app.ref,
 		...app.build ? { build: {
@@ -2064,6 +1781,7 @@ const defaultDeps = {
 	revision: gitRevision,
 	sql: require_seeds.pgClient,
 	buckets: require_seeds.bucketClient,
+	logins: require_seeds.ensurePostgresLogin,
 	migrate: require_databases.migrateDatabases,
 	seed: require_databases.seedDatabases,
 	probe: httpsProbe,
@@ -2122,6 +1840,7 @@ async function validateCompose(ctx, deps, options = {}) {
 			...registry ? { registry } : {}
 		},
 		secrets,
+		...stage === workspace.stages.local ? { localCredentials: (await require_seeds.loadLocalCredentials(workspace)).credentials } : {},
 		allowDevServices: ctx.allowDevServices,
 		ports: edgePorts(deps.env),
 		...layout ? { layout } : {},
@@ -2208,11 +1927,11 @@ async function stageSecrets(ctx, manifest) {
 		generated: []
 	};
 	const withSeed = require_seeds.withGeneratedSecrets(stored ?? require_seeds.initStageSecrets(ctx.stage), manifest);
-	const withLogs = require_workspace.resolveLogs(ctx.workspace.deploy?.compose?.logs) ? withLogsPassword(withSeed.secrets) : {
+	const withLogs = require_workspace.resolveLogs(ctx.workspace.deploy?.compose?.logs) ? require_seeds.withLogsPassword(withSeed.secrets) : {
 		secrets: withSeed.secrets,
 		generated: []
 	};
-	const withRedis = runsRedis(manifest, withLogs.secrets.custom ?? {}) ? withRedisPassword(withLogs.secrets) : {
+	const withRedis = require_seeds.runsRedis(manifest, withLogs.secrets.custom ?? {}) ? require_seeds.withRedisPassword(withLogs.secrets) : {
 		secrets: withLogs.secrets,
 		generated: []
 	};
@@ -2390,10 +2109,20 @@ async function prepareDatabases(ctx, run, deps) {
 	const { stack } = run;
 	const workspace = ctx.workspace;
 	const port = await deps.docker.port(run.ref, "postgres", 5432);
+	const superuser = stack.credential.containers.postgres;
+	const login = await deps.logins({
+		port,
+		login: superuser,
+		legacy: [{
+			user: require_seeds.LEGACY_LOCAL_LOGIN.user,
+			password: superuser.password
+		}, ...stack.local ? [require_seeds.LEGACY_LOCAL_LOGIN] : []]
+	});
+	if (login.notice) ctx.logger.info(login.notice);
 	const statements = require_seeds.postgresStatements(stack.plan, workspace.name, stack.credential.seed);
 	if (statements.length > 0) {
 		ctx.logger.info("🗄️  Creating databases, roles and grants…");
-		await require_seeds.applyPostgres(deps.sql(port, stack.credential.master), statements);
+		await require_seeds.applyPostgres(deps.sql(port, login.login), statements);
 	}
 	const sources = {};
 	const manifest = await require_discover.discover({
@@ -2404,8 +2133,11 @@ async function prepareDatabases(ctx, run, deps) {
 	const env = require_seeds.envFor(stack.plan, {
 		ports: { [require_seeds.primaryPortKey("postgres")]: port },
 		project: workspace.name,
-		master: stack.credential.master,
-		...stack.credential.seed ? { seed: stack.credential.seed } : {}
+		credentials: {
+			...stack.credential.containers,
+			postgres: login.login
+		},
+		seed: stack.credential.seed
 	});
 	const options = {
 		root: workspace.root,
@@ -2557,7 +2289,7 @@ async function verifyCompose(ctx, run, deps) {
 		edge
 	})));
 	results.push(...await Promise.all(stack.workers.map((worker) => checkContainer(ctx, run, deps, worker.name))));
-	if (stack.logs) results.push(await checkContainer(ctx, run, deps, LOGS_SERVICE));
+	if (stack.logs) results.push(await checkContainer(ctx, run, deps, require_seeds.LOGS_SERVICE));
 	const down = results.filter((result) => !result.healthy).map(({ app, url, last }) => ({
 		app,
 		url,
@@ -2608,7 +2340,7 @@ async function checkContainer(ctx, run, deps, service) {
 }
 /** How to open the logs, printed — and as an event, for a headless caller. */
 function reportLogs(ctx, logs, local) {
-	const lines = logsAccess(logs, {
+	const lines = require_seeds.logsAccess(logs, {
 		stage: ctx.stage,
 		local,
 		user: currentUser(),
@@ -2617,7 +2349,7 @@ function reportLogs(ctx, logs, local) {
 	ctx.logger.info(`\n${lines.join("\n")}`);
 	ctx.emit({
 		type: "logs.ready",
-		service: LOGS_SERVICE,
+		service: require_seeds.LOGS_SERVICE,
 		access: logs.public ? "public" : "tunnel",
 		url: logs.url,
 		...logs.public ? { allow: [...logs.public.allow] } : { port: logs.port },
@@ -2760,8 +2492,8 @@ async function writeStack(root, dir, stack) {
 		force: true
 	});
 	for (const app of [...stack.apps, ...stack.workers]) if (app.env) await write((0, node_path.join)(dir, `${app.name}.env`), envFile(app.env), 384);
-	if (stack.logs && stack.compose.services["openobserve"]?.env_file) await write((0, node_path.join)(dir, `${LOGS_SERVICE}.env`), envFile(stack.logs.env), 384);
-	if (stack.redis && stack.compose.services["redis"]?.env_file) await write((0, node_path.join)(dir, `${REDIS_SERVICE}.env`), envFile(stack.redis.env), 384);
+	if (stack.logs && stack.compose.services["openobserve"]?.env_file) await write((0, node_path.join)(dir, `${require_seeds.LOGS_SERVICE}.env`), envFile(stack.logs.env), 384);
+	if (stack.redis && stack.compose.services["redis"]?.env_file) await write((0, node_path.join)(dir, `${require_seeds.REDIS_SERVICE}.env`), envFile(stack.redis.env), 384);
 	for (const entry of await (0, node_fs_promises.readdir)(dir)) if (entry.endsWith(".credentials")) await (0, node_fs_promises.rm)((0, node_path.join)(dir, entry));
 	for (const [path, content] of Object.entries(stack.dockerfiles)) await write((0, node_path.join)(root, path), content);
 	await require_seeds.ensureDockerignore(require_seeds.findBuildRoot(root));
@@ -2933,4 +2665,4 @@ Object.defineProperty(exports, "stackOverrideFile", {
 	}
 });
 
-//# sourceMappingURL=compose-Bn4OJONR.cjs.map
+//# sourceMappingURL=compose-qnDyPJNp.cjs.map