@geekmidas/cli 10.0.0-alpha.84 → 10.0.0-alpha.85

package/dist/{seeds-DQ0FG57Z.cjs → seeds-B_Beuv0o.cjs}

@@ -6,7 +6,7 @@ const require_workspace = require("./workspace-Bic_R3tz.cjs");
 const require_config = require("./config.cjs");
 const require_EndpointGenerator = require("./EndpointGenerator-CwLjBCFE.cjs");
 const require_SubscriberGenerator = require("./SubscriberGenerator-BVn7cQ-2.cjs");
-const require_resolve = require("./resolve-T2I-5FcT.cjs");
+const require_resolve = require("./resolve-CztIqBOI.cjs");
 let node_path = require("node:path");
 let node_fs = require("node:fs");
 let node_fs_promises = require("node:fs/promises");
@@ -1371,6 +1371,30 @@ function siteClientTelemetry(manifest, appName, workspace, stage) {
 //#endregion
 //#region src/reconcile/caddyfile.ts
 /**
+* The Caddy configuration a plan implies.
+*
+* A file server is a *domain that serves a bucket*, and locally it had neither:
+* `UPLOADS_SERVER_URL` resolved to MinIO's path-style address, which works and
+* is not the deployed shape. MinIO's own virtual-host mode cannot fix that —
+* it reads the leading label *as the bucket name*, so it produces the right
+* shape only when the server's id and the bucket's happen to agree, and never
+* for a server fronting two buckets.
+*
+* So the mapping lives in front of MinIO instead: one host per file server,
+* rewriting the bucket in as a path prefix. That is the whole of it — no
+* caching, because caching is not what is missing locally, and a caching proxy
+* would add an invalidation story a local stack has no use for.
+*
+* What it buys beyond the shape is a certificate. Caddy issues one per host
+* from its own CA, so a local address is `https://` like the deployed one, and
+* everything downstream of that — `Secure` cookies, `SameSite`, a cookie domain
+* with more than one host under it — starts behaving the way it will in
+* production rather than the way `http://localhost` allows.
+*
+* Pure, like `composeFor`: what should exist is data, and rendering it is one
+* line at the edge.
+*/
+/**
 * The kinds the edge serves.
 *
 * Everything that owns a *public address*. Deployed, each of these has a real
@@ -1517,6 +1541,10 @@ function toCaddyfile(sites) {
 https://${host} {
 	tls internal
 
+	# gkm's own header, which only a service of this stack may send: the auth
+	# server rate-limits by the client address it carries.
+	request_header -${_geekmidas_manifest.CLIENT_IP_HEADER}
+
 	reverse_proxy ${upstream} {${rewrite ? `
 		rewrite ${rewrite}
 		# MinIO routes and signs on the Host header, so forwarding the requested
@@ -8455,4 +8483,4 @@ Object.defineProperty(exports, "workspace_exports", {
 	}
 });
 
-//# sourceMappingURL=seeds-DQ0FG57Z.cjs.map
+//# sourceMappingURL=seeds-B_Beuv0o.cjs.map