@geekmidas/cli 10.0.0-alpha.84 → 10.0.0-alpha.86

package/dist/{compose-DqWh1TaO.cjs → compose-xw86kVYi.cjs}

@@ -1,10 +1,10 @@
 const require_rolldown_runtime = require("./rolldown-runtime-C0BPl7ul.cjs");
-const require_run = require("./run-fVZ-rLnc.cjs");
+const require_credentials = require("./credentials-tr26-KML.cjs");
 const require_discover = require("./discover-D1It5r_h.cjs");
 const require_derive = require("./derive-DAbo49sm.cjs");
-const require_workspace = require("./workspace-Bic_R3tz.cjs");
+const require_workspace = require("./workspace-CT0JM3Y8.cjs");
 const require_define = require("./define-DzRz8FgH.cjs");
-const require_seeds = require("./seeds-DQ0FG57Z.cjs");
+const require_seeds = require("./seeds-CsI0A_Ef.cjs");
 const require_SubscriberGenerator = require("./SubscriberGenerator-BVn7cQ-2.cjs");
 const require_drivers = require("./drivers-LYSdQDmd.cjs");
 const require_databases = require("./databases-BY-pEImp.cjs");
@@ -193,16 +193,16 @@ const dockerCompose = {
 		};
 	},
 	async build(stack, services) {
-		await require_run.run("docker", compose(stack, ["build", ...services]), runOptions(stack, {
+		await require_credentials.run("docker", compose(stack, ["build", ...services]), runOptions(stack, {
 			...process.env,
 			DOCKER_BUILDKIT: "1"
 		}));
 	},
 	async pull(stack, services) {
-		await require_run.run("docker", compose(stack, ["pull", ...services]), runOptions(stack));
+		await require_credentials.run("docker", compose(stack, ["pull", ...services]), runOptions(stack));
 	},
 	async up(stack, services) {
-		await require_run.run("docker", compose(stack, [
+		await require_credentials.run("docker", compose(stack, [
 			"up",
 			"-d",
 			"--wait",
@@ -212,10 +212,10 @@ const dockerCompose = {
 		]), runOptions(stack));
 	},
 	async down(stack) {
-		await require_run.run("docker", compose(stack, ["down"]), runOptions(stack));
+		await require_credentials.run("docker", compose(stack, ["down"]), runOptions(stack));
 	},
 	async port(stack, service, inside) {
-		const output = await require_run.runOutput("docker", compose(stack, [
+		const output = await require_credentials.runOutput("docker", compose(stack, [
 			"port",
 			service,
 			String(inside)
@@ -239,14 +239,14 @@ const dockerCompose = {
 	},
 	async copyOut(stack, service, from, to) {
 		await (0, node_fs_promises.mkdir)((0, node_path.dirname)(to), { recursive: true });
-		await require_run.run("docker", compose(stack, [
+		await require_credentials.run("docker", compose(stack, [
 			"cp",
 			`${service}:${from}`,
 			to
 		]), runOptions(stack));
 	},
 	async push(stack, ref) {
-		const output = await require_run.runOutput("docker", ["push", ref], {
+		const output = await require_credentials.runOutput("docker", ["push", ref], {
 			cwd: stack.cwd,
 			...stack.signal ? { signal: stack.signal } : {}
 		});
@@ -434,8 +434,10 @@ function traefikDynamic(routes, options) {
 	const routers = {};
 	const services = {};
 	const middlewares = {};
+	const strip = `${project}-strip-gkm-headers`;
+	if (routes.length > 0) middlewares[strip] = { headers: { customRequestHeaders: { [_geekmidas_manifest.CLIENT_IP_HEADER]: "" } } };
 	for (const route of routes) {
-		const chain = [];
+		const chain = [strip];
 		if (route.allow) {
 			middlewares[name(route, "allow")] = { ipAllowList: { sourceRange: [...route.allow] } };
 			chain.push(name(route, "allow"));
@@ -448,7 +450,7 @@ function traefikDynamic(routes, options) {
 			rule: `Host(\`${route.host}\`)`,
 			entryPoints: ["websecure"],
 			service: name(route),
-			...chain.length > 0 ? { middlewares: chain } : {},
+			middlewares: chain,
 			tls: tls.kind === "acme" ? { certResolver: ACME_RESOLVER } : {}
 		};
 		services[name(route)] = { loadBalancer: {
@@ -521,7 +523,7 @@ function yaml$1(value) {
 */
 /** The edge's directory on this machine. */
 function edgeDir(env = process.env) {
-	return (0, node_path.join)(require_run.gkmHome(env), "edge");
+	return (0, node_path.join)(require_credentials.gkmHome(env), "edge");
 }
 /** The edge's compose project, as docker is asked about it. */
 function edgeRef(dir, options = {}) {
@@ -793,6 +795,18 @@ function pinImages(file, digests, images) {
 }
 //#endregion
 //#region src/compose/caddyfile.ts
+/**
+* The stack's own edge, rendered for Caddy: one site block per route.
+*
+* Deployed, each host is the stage's real domain and Caddy gets it a
+* certificate from Let's Encrypt on first request — the same automatic HTTPS
+* it does anywhere, with nothing to configure but the name — or serves the
+* stage's own certificate (`deploy.compose.tls`). Locally the hosts are
+* `*.localhost` and the certificates come from Caddy's own CA, as the `gkm
+* dev` edge does, so a local stack is `https://` like a deployed one.
+*
+* Pure: the routes are data (`routes.ts`), and rendering them is one string.
+*/
 /** Where Caddy reads a stage's own certificate, inside its container. */
 const CADDY_TLS_DIR = "/etc/caddy/tls";
 /** An upstream on the stack's own network: its service name. */
@@ -815,7 +829,11 @@ function edgeCaddyfile(routes, options) {
 ` : tls.kind === "files" ? `
 	tls ${tls.certFile} ${tls.keyFile}
 ` : "";
-	const blocks = routes.map(({ host, upstreams, prefix, allow, streaming }) => `https://${host} {${certificate}${allow ? `
+	const blocks = routes.map(({ host, upstreams, prefix, allow, streaming }) => `https://${host} {${certificate}
+	# gkm's own header, which only a service of this stack may send: the auth
+	# server rate-limits by the client address it carries.
+	request_header -${_geekmidas_manifest.CLIENT_IP_HEADER}
+${allow ? `
 	# Only these addresses — the peer Caddy sees, never a header a client
 	# could set. Everything else is refused before it reaches the upstream.
 	@denied not remote_ip ${allow.join(" ")}
@@ -1120,13 +1138,17 @@ function composeStack(input) {
 		missing: [],
 		minio: plan.resources.filter((r) => r.kind === "objects").map((r) => r.id),
 		mailpit: plan.resources.filter((r) => r.kind === "email").map((r) => r.id)
-	} : require_seeds.assertExternalServices({
-		stage,
-		declarations: serviceDeclarations(plan, reads, owners),
-		supplied: custom,
-		allow: input.allowDevServices ?? [],
-		...domain ? { domain } : {}
-	});
+	} : (() => {
+		require_seeds.assertStageProvidersEnabled(workspace, manifest, stage);
+		return require_seeds.assertExternalServices({
+			stage,
+			declarations: serviceDeclarations(plan, reads, owners),
+			supplied: custom,
+			allow: input.allowDevServices === true,
+			...domain ? { domain } : {},
+			providers: require_seeds.stageProviderNotes(workspace, stage)
+		});
+	})();
 	const redis = require_seeds.stackRedis({
 		plan,
 		stage,
@@ -1776,7 +1798,7 @@ function stackOverrideFile(root, stage) {
 async function gitRevision(root) {
 	let sha;
 	try {
-		sha = (await require_run.runOutput("git", [
+		sha = (await require_credentials.runOutput("git", [
 			"rev-parse",
 			"--short",
 			"HEAD"
@@ -1785,7 +1807,7 @@ async function gitRevision(root) {
 		throw new NoGitRevision(root);
 	}
 	if (!sha) throw new NoGitRevision(root);
-	return (await require_run.runOutput("git", ["status", "--porcelain"], { cwd: root }).catch(() => "")).trim() ? `${sha}-dirty` : sha;
+	return (await require_credentials.runOutput("git", ["status", "--porcelain"], { cwd: root }).catch(() => "")).trim() ? `${sha}-dirty` : sha;
 }
 /** The edge's ports, from the environment — 443 and 80 when unset. */
 function edgePorts(env = process.env) {
@@ -1878,6 +1900,15 @@ async function validateCompose(ctx, deps, options = {}) {
 		...push ? { buildOnly: true } : {}
 	});
 	require_seeds.reportDevServices(ctx, composed.devServices);
+	if (!push && stage !== workspace.stages.local) {
+		const verified = await require_seeds.verifyStageProviders({
+			workspace,
+			manifest,
+			stage,
+			secrets: secrets?.custom ?? {}
+		});
+		for (const line of verified) ctx.logger.info(`✓ ${line} verified`);
+	}
 	if (mode === "build") assertRedisClient(workspace, composed);
 	const stack = options.pin ? withPinnedImages(composed, options.pin.file, options.pin.digests) : composed;
 	if (mode === "pull" && !ctx.dryRun) await assertImagesExist(deps.docker, tag, [...stack.apps, ...stack.workers]);
@@ -2705,4 +2736,4 @@ Object.defineProperty(exports, "stackOverrideFile", {
 	}
 });
 
-//# sourceMappingURL=compose-DqWh1TaO.cjs.map
+//# sourceMappingURL=compose-xw86kVYi.cjs.map