@geekmidas/cli 10.0.0-alpha.83 → 10.0.0-alpha.85

package/dist/{compose-BPJ9bUKp.mjs → compose-CQK6StuE.mjs}

@@ -2,18 +2,18 @@ import { t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
 import { a as runOutput, i as run, s as gkmHome } from "./run-BJLIerMM.mjs";
 import { r as discover } from "./discover-BPelzeGW.mjs";
 import { t as appKey } from "./derive-B4vDpzgP.mjs";
-import { F as certificateFor, I as proxyFor, L as LOGS_PORT, P as ComposeTlsFileMissing, R as resolveLogs } from "./workspace-DD9mtPy8.mjs";
+import { B as certificateFor, F as resolveStageTelemetry, L as telemetryEnv, P as otlpTelemetryEnv, R as LOGS_PORT, V as proxyFor, z as ComposeTlsFileMissing } from "./workspace-Drz4jsvy.mjs";
 import { t as defineTarget } from "./define-DR8xGYfL.mjs";
-import { $ as postgresSuperuser, $t as EMULATOR_ACCESS_KEY_ID, At as appEnvKeys, Bt as imageLayout, C as workerDockerfile, Dt as ensurePostgresLogin, En as imageRef, Et as LEGACY_LOCAL_LOGIN, Ft as localRolePassword, Ht as WORKER_PORT, I as reportDevServices, It as planFor, M as devServicesUsed, Mt as networkEnv, Nt as workerEnvKeys, Ot as bucketClient, Pt as envFor, Q as loadLocalCredentials, Qt as composeFor, R as suppliedOnly, Rt as hostFor, S as ensureDockerignore, St as bucketPolicies, T as validateImageRef, Vt as TURBO_VERSION, Wt as findBuildRoot, Z as LOCAL_RABBITMQ_USER, _ as DeployJournal, a as createEmptyState, an as primaryPortKey, at as runsRedis, b as appDockerfile, bt as applyPolicies, ct as LOGS_SERVICE, dt as stackLogs, en as DEFAULT_IMAGES, ft as withLogsPassword, gt as otelEnv, ht as resolveHost, i as assertNoStaleSecrets, it as redisService, j as assertExternalServices, jn as initStageSecrets, kt as pgClient, l as recordRelease, lt as logsAccess, mt as isMainFrontendApp, n as reportDatabaseRuns, nt as REDIS_SERVICE, ot as stackRedis, pt as NoDomainForStage, q as constructGlobs, r as reportPlannedSeeds, rn as portKeys, rt as STACK_CACHE, st as withRedisPassword, t as DeploySeedsFailed, tt as withGeneratedSecrets, ut as logsService, wt as postgresStatements, xt as applyPostgres, yt as applyBuckets, z as workerUnits, zt as composeBuildPaths } from "./seeds-BoKQ74Od.mjs";
-import { i as DEFAULT_EVENTS } from "./SubscriberGenerator-DQZeGkDW.mjs";
-import { i as installedFrom } from "./drivers-B4RP2B2O.mjs";
+import { $ as postgresSuperuser, At as WORKER_PORT, Bn as NoDomainForStage, Bt as composeFor, C as workerDockerfile, Ct as networkEnv, Dt as composeBuildPaths, Et as localRolePassword, Fn as LOGS_SERVICE, Gt as hostFor, Hn as resolveHost, I as reportDevServices, In as logsAccess, Jt as scopeTelemetryEnv, Ln as logsService, M as devServicesUsed, Mt as findBuildRoot, Ot as imageLayout, Q as loadLocalCredentials, Qt as DEFAULT_IMAGES, R as suppliedOnly, Rn as stackLogs, S as ensureDockerignore, T as validateImageRef, Tt as envFor, Ut as planFor, Vn as isMainFrontendApp, Vt as EMULATOR_ACCESS_KEY_ID, Xt as telemetryOf, Z as LOCAL_RABBITMQ_USER, Zt as usesTelemetry, _ as DeployJournal, _t as LEGACY_LOCAL_LOGIN, a as createEmptyState, at as runsRedis, b as appDockerfile, bt as pgClient, dt as applyPolicies, ft as applyPostgres, ht as postgresStatements, i as assertNoStaleSecrets, it as redisService, j as assertExternalServices, kn as initStageSecrets, kt as TURBO_VERSION, l as recordRelease, n as reportDatabaseRuns, nt as REDIS_SERVICE, ot as stackRedis, pt as bucketPolicies, q as constructGlobs, qt as isTelemetryKey, r as reportPlannedSeeds, rn as primaryPortKey, rt as STACK_CACHE, st as withRedisPassword, t as DeploySeedsFailed, tn as portKeys, tt as withGeneratedSecrets, ut as applyBuckets, vt as ensurePostgresLogin, wn as imageRef, wt as workerEnvKeys, xt as appEnvKeys, yt as bucketClient, z as workerUnits, zn as withLogsPassword } from "./seeds-9C5CkDon.mjs";
+import { i as DEFAULT_EVENTS } from "./SubscriberGenerator-BPqQf8fB.mjs";
+import { i as installedFrom } from "./drivers-DTZzxeIl.mjs";
 import { f as plannedSeeds, o as SeedFailed, p as seedDatabases, u as migrateDatabases } from "./databases-CzszQV0N.mjs";
 import { n as assertStageCredentials } from "./credentialSchemas-BJqRJNK4.mjs";
 import { dirname, join } from "node:path";
 import { existsSync } from "node:fs";
 import { chmod, copyFile, mkdir, readFile, readdir, rename, rm, writeFile } from "node:fs/promises";
 import { hostname, userInfo } from "node:os";
-import { provideKey, provisionOrder, publicEnvFor } from "@geekmidas/manifest";
+import { CLIENT_IP_HEADER, provideKey, provisionOrder, publicEnvFor } from "@geekmidas/manifest";
 import { spawn } from "node:child_process";
 import { createHash } from "node:crypto";
 import { stringify } from "yaml";
@@ -434,8 +434,10 @@ function traefikDynamic(routes, options) {
 	const routers = {};
 	const services = {};
 	const middlewares = {};
+	const strip = `${project}-strip-gkm-headers`;
+	if (routes.length > 0) middlewares[strip] = { headers: { customRequestHeaders: { [CLIENT_IP_HEADER]: "" } } };
 	for (const route of routes) {
-		const chain = [];
+		const chain = [strip];
 		if (route.allow) {
 			middlewares[name(route, "allow")] = { ipAllowList: { sourceRange: [...route.allow] } };
 			chain.push(name(route, "allow"));
@@ -448,7 +450,7 @@ function traefikDynamic(routes, options) {
 			rule: `Host(\`${route.host}\`)`,
 			entryPoints: ["websecure"],
 			service: name(route),
-			...chain.length > 0 ? { middlewares: chain } : {},
+			middlewares: chain,
 			tls: tls.kind === "acme" ? { certResolver: ACME_RESOLVER } : {}
 		};
 		services[name(route)] = { loadBalancer: {
@@ -793,6 +795,18 @@ function pinImages(file, digests, images) {
 }
 //#endregion
 //#region src/compose/caddyfile.ts
+/**
+* The stack's own edge, rendered for Caddy: one site block per route.
+*
+* Deployed, each host is the stage's real domain and Caddy gets it a
+* certificate from Let's Encrypt on first request — the same automatic HTTPS
+* it does anywhere, with nothing to configure but the name — or serves the
+* stage's own certificate (`deploy.compose.tls`). Locally the hosts are
+* `*.localhost` and the certificates come from Caddy's own CA, as the `gkm
+* dev` edge does, so a local stack is `https://` like a deployed one.
+*
+* Pure: the routes are data (`routes.ts`), and rendering them is one string.
+*/
 /** Where Caddy reads a stage's own certificate, inside its container. */
 const CADDY_TLS_DIR = "/etc/caddy/tls";
 /** An upstream on the stack's own network: its service name. */
@@ -815,7 +829,11 @@ function edgeCaddyfile(routes, options) {
 ` : tls.kind === "files" ? `
 	tls ${tls.certFile} ${tls.keyFile}
 ` : "";
-	const blocks = routes.map(({ host, upstreams, prefix, allow, streaming }) => `https://${host} {${certificate}${allow ? `
+	const blocks = routes.map(({ host, upstreams, prefix, allow, streaming }) => `https://${host} {${certificate}
+	# gkm's own header, which only a service of this stack may send: the auth
+	# server rate-limits by the client address it carries.
+	request_header -${CLIENT_IP_HEADER}
+${allow ? `
 	# Only these addresses — the peer Caddy sees, never a header a client
 	# could set. Everything else is refused before it reaches the upstream.
 	@denied not remote_ip ${allow.join(" ")}
@@ -880,6 +898,12 @@ const EDGE_PORT_ENV = {
 	http: "GKM_COMPOSE_HTTP_PORT"
 };
 /**
+* The variable that moves the local stage's OpenObserve off its loopback
+* port, 5080 — which the local stage takes from nowhere else, since it
+* ignores `deploy.telemetry`. Another stack, or another tool, may hold 5080.
+*/
+const LOGS_PORT_ENV = "GKM_COMPOSE_LOGS_PORT";
+/**
 * Containers this target does not run.
 *
 * The AWS emulator never applies: a stack is a server target, whose events
@@ -956,6 +980,10 @@ function derivedCredentials(project, plan, seed) {
 		emulator: {
 			accessKeyId: EMULATOR_ACCESS_KEY_ID,
 			secretAccessKey: derive("emulator")
+		},
+		logs: {
+			email: `admin@${project}`,
+			password: derive("logs")
 		}
 	};
 }
@@ -1084,9 +1112,20 @@ function composeStack(input) {
 	}
 	for (const worker of workers) reads.set(worker.name, [...workerEnvKeys(manifest, worker.id, input.runnables) ?? []]);
 	const domain = workspace.deploy?.domains?.[stage];
-	const logsConfig = resolveLogs(workspace.deploy?.compose?.logs);
-	const logsBase = logsConfig ? stackLogs({
-		config: logsConfig,
+	const telemetry = resolveStageTelemetry({
+		...workspace.deploy?.telemetry ? { telemetry: workspace.deploy.telemetry } : {},
+		stage,
+		local,
+		target: "compose",
+		runtime: "server",
+		selfHosted: true,
+		used: usesTelemetry(manifest)
+	});
+	const logsBase = telemetry?.provider === "self-hosted" ? stackLogs({
+		config: local && input.ports?.logs ? {
+			...telemetry.selfHosted,
+			port: input.ports.logs
+		} : telemetry.selfHosted,
 		stage,
 		local,
 		project: workspace.name,
@@ -1113,7 +1152,7 @@ function composeStack(input) {
 		custom,
 		...local ? { localPassword: input.localCredentials.redis.password } : {}
 	});
-	const infra = [...plan.containers.filter((c) => !NOT_RUN[c]).filter((c) => c !== "minio" || services.minio.length > 0).filter((c) => c !== "mailpit" || services.mailpit.length > 0).filter((c) => c !== "redis" || redis !== void 0), ...logsBase ? [LOGS_SERVICE] : []].sort();
+	const infra = [...plan.containers.filter((c) => !NOT_RUN[c]).filter((c) => c !== LOGS_SERVICE).filter((c) => c !== "minio" || services.minio.length > 0).filter((c) => c !== "mailpit" || services.mailpit.length > 0).filter((c) => c !== "redis" || redis !== void 0), ...logsBase ? [LOGS_SERVICE] : []].sort();
 	const storage = infra.includes("minio") ? (() => {
 		const buckets = services.minio.map((id) => byId.get(id)?.name).filter((name) => Boolean(name)).sort();
 		return {
@@ -1199,10 +1238,15 @@ function composeStack(input) {
 		if (app.kind === "rest-api" && surface && surface !== app.id) return inside[key];
 		return outside[key];
 	};
+	const telemetryValues = logs ? telemetryEnv({
+		endpoint: logs.appEnv.OTEL_EXPORTER_OTLP_ENDPOINT,
+		headers: logs.appEnv.OTEL_EXPORTER_OTLP_HEADERS
+	}, telemetry?.sampleRate ?? 1) : telemetry?.provider === "otlp" ? otlpTelemetryEnv(telemetry) : void 0;
 	/** Each key one backend process reads, resolved for this stage. */
 	const valuesFor = (app, keys) => {
 		const values = {};
 		for (const key of [...keys].sort()) {
+			if (isTelemetryKey(key)) continue;
 			const owner = owners.get(key) ?? storageOwner(key, plan);
 			if (!local && owner?.kind === "email" && key.endsWith("_INBOX_URL")) continue;
 			if (STORAGE_KEYS.includes(key)) {
@@ -1237,11 +1281,11 @@ function composeStack(input) {
 			values[trusted] = [...new Set(origins)].join(",");
 		}
 		app.env = {
-			...values,
-			...otelEnv({
-				...custom,
-				...logs?.appEnv
-			}, app.name),
+			...scopeTelemetryEnv(values, {
+				uses: telemetryOf(manifest, app.id) !== void 0,
+				serviceName: app.name,
+				...telemetryValues ? { telemetry: telemetryValues } : {}
+			}),
 			NODE_ENV: "production",
 			PORT: String(app.port),
 			STAGE: stage
@@ -1251,15 +1295,15 @@ function composeStack(input) {
 	for (const worker of input.buildOnly ? [] : workers) {
 		const keys = workerEnvKeys(manifest, worker.id, input.runnables) ?? /* @__PURE__ */ new Set();
 		worker.env = {
-			...valuesFor({
+			...scopeTelemetryEnv(valuesFor({
 				name: worker.name,
 				id: worker.id,
 				kind: "rest-api"
-			}, keys),
-			...otelEnv({
-				...custom,
-				...logs?.appEnv
-			}, worker.name),
+			}, keys), {
+				uses: telemetryOf(manifest, worker.id) !== void 0,
+				serviceName: worker.name,
+				...telemetryValues ? { telemetry: telemetryValues } : {}
+			}),
 			NODE_ENV: "production",
 			PORT: String(worker.port),
 			STAGE: stage
@@ -1326,7 +1370,9 @@ function composeStack(input) {
 			workspaceRoot: workspace.root,
 			apps: workspace.apps,
 			manifest,
-			cache: STACK_CACHE
+			cache: STACK_CACHE,
+			workspace,
+			stage
 		});
 	}
 	for (const worker of workers) {
@@ -1362,6 +1408,7 @@ function composeStack(input) {
 		...storage ? { storage } : {},
 		devServices: local ? [] : devServicesUsed(services),
 		...logs ? { logs } : {},
+		...telemetry ? { telemetry } : {},
 		...redis ? { redis } : {}
 	};
 }
@@ -1767,9 +1814,11 @@ function edgePorts(env = process.env) {
 		if (!Number.isInteger(port) || port < 1 || port > 65535) throw new EdgePortInvalid(variable, value);
 		return port;
 	};
+	const logs = env["GKM_COMPOSE_LOGS_PORT"] ? read(LOGS_PORT_ENV, 0) : void 0;
 	return {
 		https: read(EDGE_PORT_ENV.https, 443),
-		http: read(EDGE_PORT_ENV.http, 80)
+		http: read(EDGE_PORT_ENV.http, 80),
+		...logs ? { logs } : {}
 	};
 }
 /**
@@ -1927,7 +1976,15 @@ async function stageSecrets(ctx, manifest) {
 		generated: []
 	};
 	const withSeed = withGeneratedSecrets(stored ?? initStageSecrets(ctx.stage), manifest);
-	const withLogs = resolveLogs(ctx.workspace.deploy?.compose?.logs) ? withLogsPassword(withSeed.secrets) : {
+	const withLogs = resolveStageTelemetry({
+		...ctx.workspace.deploy?.telemetry ? { telemetry: ctx.workspace.deploy.telemetry } : {},
+		stage: ctx.stage,
+		local: false,
+		target: "compose",
+		runtime: "server",
+		selfHosted: true,
+		used: usesTelemetry(manifest)
+	})?.provider === "self-hosted" ? withLogsPassword(withSeed.secrets) : {
 		secrets: withSeed.secrets,
 		generated: []
 	};
@@ -2565,7 +2622,8 @@ function composeTarget(options = {}) {
 			rollback: false,
 			migrations: "target",
 			images: true,
-			localStage: true
+			localStage: true,
+			selfHostedTelemetry: true
 		},
 		credentials: [],
 		tag: ({ cwd }) => deps.revision(cwd),
@@ -2588,4 +2646,4 @@ function composeTarget(options = {}) {
 //#endregion
 export { stackOverrideFile as a, parseDigests as c, removeEdgeRoutes as d, EDGE_PROJECT as f, ComposePushNeedsBuild as i, pinnedRef as l, compose_exports as n, composeProject as o, dockerCompose as p, ComposePinNeedsPull as r, stackDir as s, composeTarget as t, edgeDir as u };
 
-//# sourceMappingURL=compose-BPJ9bUKp.mjs.map
+//# sourceMappingURL=compose-CQK6StuE.mjs.map