@highstate/library 0.21.1 → 0.26.0

package/src/third-party/yandex.ts

@@ -8,6 +8,7 @@ import {
   z,
 } from "@highstate/contract"
 import { serverEntity, serverOutputs, vmSecrets, vmSshArgs } from "../common"
+import { l4EndpointEntity, portSchema } from "../network"
 import * as ssh from "../ssh"
 
 export const connectionEntity = defineEntity({
@@ -77,7 +78,7 @@ export const connection = defineUnit({
            * The default availability zone in ru-central1 to place resources in.
            */
           defaultZone: z
-            .enum(["ru-central1-a", "ru-central1-b", "ru-central1-d"])
+            .enum(["ru-central1-a", "ru-central1-b", "ru-central1-d", "ru-central1-e"])
             .default("ru-central1-d"),
         }),
         z.object({
@@ -222,6 +223,91 @@ export const disk = defineUnit({
   },
 })
 
+export const publicAddressEntity = defineEntity({
+  type: "yandex.public-address.v1",
+
+  schema: z.object({
+    /**
+     * The global ID of the public address.
+     */
+    id: z.string(),
+
+    /**
+     * The name of the public address.
+     */
+    name: z.string(),
+
+    /**
+     * The IPv4 address value.
+     */
+    address: z.string(),
+  }),
+
+  meta: {
+    title: "YC Public Address",
+    icon: "simple-icons:yandexcloud",
+    iconColor: "#0080ff",
+    secondaryIcon: "mdi:ip-network-outline",
+  },
+})
+
+/**
+ * The reserved public IPv4 address on Yandex Cloud.
+ */
+export const publicAddress = defineUnit({
+  type: "yandex.public-address.v1",
+
+  args: {
+    /**
+     * The name of the public address in the folder.
+     * If not specified, the name of the unit will be used.
+     */
+    addressName: z.string().optional(),
+
+    /**
+     * The ID of the cloud to create the public address in.
+     * If not specified, will use the cloud from the connection.
+     */
+    cloudId: z.string().optional(),
+
+    /**
+     * The ID of the folder to create the public address in.
+     * If not specified, will use the default folder from the connection.
+     */
+    folderId: z.string().optional(),
+
+    /**
+     * The availability zone to reserve the address in.
+     * If not specified, will use the default zone from the connection.
+     */
+    zone: z.string().optional(),
+  },
+
+  inputs: {
+    connection: connectionEntity,
+  },
+
+  outputs: {
+    /**
+     * The public address entity.
+     */
+    publicAddress: publicAddressEntity,
+  },
+
+  meta: {
+    title: "YC Public Address",
+    category: "Yandex Cloud",
+    icon: "simple-icons:yandexcloud",
+    iconColor: "#0080ff",
+    secondaryIcon: "mdi:ip-network-outline",
+  },
+
+  source: {
+    package: "@highstate/yandex",
+    path: "public-address",
+  },
+})
+
 export const imageEntity = defineEntity({
   type: "yandex.image.v1",
 
@@ -378,6 +464,65 @@ const vmArgs = $args({
   preemptible: z.boolean().default(false),
 })
 
+const nlbArgs = z.object({
+  /**
+   * Whether to create a network load balancer for the instance group.
+   */
+  enabled: z.boolean().default(false),
+
+  /**
+   * The name of the network load balancer.
+   * If not specified, the instance group name will be used.
+   */
+  name: z.string().optional(),
+
+  /**
+   * The load-balanced ports to expose through the shared public address.
+   *
+   * Each listener must use `protocol:source=>target` format, for example `tcp:80=>8080`.
+   *
+   * If the source and target ports are the same, use `protocol:port` shorthand, for example `tcp:80`.
+   *
+   * When SSH is enabled, the `tcp:<ssh-port>` listener is included automatically.
+   */
+  listeners: z.string().array().default([]),
+
+  /**
+   * The health check protocol.
+   */
+  healthCheckProtocol: z.enum(["tcp", "http"]).default("tcp"),
+
+  /**
+   * The port to use for health checks.
+   */
+  healthCheckPort: portSchema.default(22),
+
+  /**
+   * The HTTP path to use for health checks.
+   */
+  healthCheckPath: z.string().default("/"),
+
+  /**
+   * The interval between health checks in seconds.
+   */
+  healthCheckInterval: z.number().int().min(1).max(60).default(2),
+
+  /**
+   * The timeout for health check responses in seconds.
+   */
+  healthCheckTimeout: z.number().int().min(1).max(60).default(1),
+
+  /**
+   * The number of successful checks required to mark a target healthy.
+   */
+  healthCheckHealthyThreshold: z.number().int().default(2),
+
+  /**
+   * The number of failed checks required to mark a target unhealthy.
+   */
+  healthCheckUnhealthyThreshold: z.number().int().default(2),
+})
+
 /**
  * The virtual machine on Yandex Cloud.
  */
@@ -413,6 +558,23 @@ export const virtualMachine = defineUnit({
   inputs: {
     connection: connectionEntity,
     image: imageEntity,
+
+    /**
+     * The reserved public address to attach to the virtual machine.
+     */
+    publicAddress: {
+      entity: publicAddressEntity,
+      required: false,
+    },
+
+    /**
+     * The endpoint of the SSH jump host used to connect to the virtual machine.
+     */
+    sshProxyEndpoint: {
+      entity: l4EndpointEntity,
+      required: false,
+    },
+
     ...ssh.inputs,
   },
 
@@ -462,6 +624,17 @@ export const instanceGroup = defineUnit({
      */
     size: z.number().default(1),
 
+    /**
+     * The zones to spread instances across.
+     * If not specified, will use the default zone from the connection.
+     */
+    zones: z.string().array().optional(),
+
+    /**
+     * The network load balancer configuration.
+     */
+    nlb: nlbArgs.prefault({}),
+
     ...vmArgs,
   },
 
@@ -472,6 +645,33 @@ export const instanceGroup = defineUnit({
   inputs: {
     connection: connectionEntity,
     image: imageEntity,
+
+    /**
+     * The public addresses to attach to instances.
+     * Addresses are sorted by name and assigned to instances in that order.
+     */
+    publicAddresses: {
+      entity: publicAddressEntity,
+      required: false,
+      multiple: true,
+    },
+
+    /**
+     * The reserved public address to use for the network load balancer.
+     */
+    nlbPublicAddress: {
+      entity: publicAddressEntity,
+      required: false,
+    },
+
+    /**
+     * The endpoint of the SSH jump host used to connect to the instances.
+     */
+    sshProxyEndpoint: {
+      entity: l4EndpointEntity,
+      required: false,
+    },
+
     ...ssh.inputs,
   },
 
@@ -480,6 +680,12 @@ export const instanceGroup = defineUnit({
       entity: serverEntity,
       multiple: true,
     },
+
+    nlbEndpoints: {
+      entity: l4EndpointEntity,
+      multiple: true,
+      required: false,
+    },
   },
 
   meta: {
@@ -502,5 +708,8 @@ export type ConnectionInput = EntityInput<typeof connectionEntity>
 export type Disk = EntityValue<typeof diskEntity>
 export type DiskInput = EntityInput<typeof diskEntity>
 
+export type PublicAddress = EntityValue<typeof publicAddressEntity>
+export type PublicAddressInput = EntityInput<typeof publicAddressEntity>
+
 export type Image = EntityValue<typeof imageEntity>
 export type ImageInput = EntityInput<typeof imageEntity>

package/src/tls.ts

@@ -1,22 +1,151 @@
-import { defineEntity, z } from "@highstate/contract"
-import { fileEntity } from "./common"
+import {
+  defineEntity,
+  defineUnit,
+  type EntityInput,
+  type EntityValue,
+  z,
+} from "@highstate/contract"
+import { fileEntity, tlsIssuerEntity } from "./common"
+
+export const privateKeyAlgorithmSchema = z.enum(["RSA", "ECDSA", "Ed25519"])
+
+export const privateKeySchema = z
+  .object({
+    /**
+     * The private key algorithm.
+     */
+    algorithm: privateKeyAlgorithmSchema.default("RSA"),
+
+    /**
+     * The private key size in bits.
+     */
+    size: z.number().int().positive().optional(),
+  })
+  .default({
+    algorithm: "RSA",
+    size: 4096,
+  })
+
+export const certificateUsageSchema = z.enum([
+  "digitalSignature",
+  "keyEncipherment",
+  "serverAuth",
+  "clientAuth",
+])
+
+export const certificateChainEntity = defineEntity({
+  type: "tls.certificate-chain.v1",
+
+  includes: {
+    /**
+     * The file containing the certificate chain (leaf and intermediate certificates) in PEM format.
+     */
+    chain: fileEntity,
+
+    /**
+     * The file containing the root certificate in PEM format.
+     * May be omitted if the root certificate is already trusted by the system.
+     */
+    root: {
+      entity: fileEntity,
+      required: false,
+    },
+  },
+
+  schema: z.unknown(),
+
+  meta: {
+    title: "TLS Certificate Chain",
+    color: "#2E7D32",
+    icon: "mdi:certificate",
+    iconColor: "#2E7D32",
+  },
+})
 
 export const certificateEntity = defineEntity({
   type: "tls.certificate.v1",
 
   includes: {
     /**
-     * The file containing the certificate in PEM format.
+     * The public chain of the certificate.
+     */
+    chain: certificateChainEntity,
+
+    /**
+     * The private key of the certificate in PEM format.
      */
-    file: fileEntity,
+    privateKey: fileEntity,
   },
 
   schema: z.unknown(),
 
   meta: {
     title: "TLS Certificate",
-    color: "#4caf50",
+    color: "#4CAF50",
     icon: "mdi:certificate",
-    iconColor: "#4caf50",
+    iconColor: "#4CAF50",
   },
 })
+
+/**
+ * Issues a TLS certificate using the provided TLS issuer.
+ */
+export const certificate = defineUnit({
+  type: "tls.certificate.v1",
+
+  args: {
+    /**
+     * The common name for the certificate.
+     */
+    commonName: z.string().optional(),
+
+    /**
+     * The alternative DNS names for the certificate.
+     */
+    dnsNames: z.string().array().default([]),
+
+    /**
+     * The private key configuration for the certificate.
+     */
+    privateKey: privateKeySchema,
+
+    /**
+     * The requested key usages for the certificate.
+     *
+     * If not provided, the issuer default usages will be used.
+     */
+    usages: certificateUsageSchema.array().default(["digitalSignature", "keyEncipherment"]),
+  },
+
+  inputs: {
+    /**
+     * The TLS issuer used to issue the certificate.
+     */
+    issuer: tlsIssuerEntity,
+  },
+
+  outputs: {
+    certificate: certificateEntity,
+  },
+
+  meta: {
+    title: "TLS Certificate",
+    icon: "mdi:certificate",
+    category: "Security",
+  },
+
+  source: {
+    package: "@highstate/common",
+    path: "units/tls/certificate",
+  },
+})
+
+export type CertificateChain = EntityValue<typeof certificateChainEntity>
+export type CertificateChainInput = EntityInput<typeof certificateChainEntity>
+
+export type Certificate = EntityValue<typeof certificateEntity>
+export type CertificateInput = EntityInput<typeof certificateEntity>
+
+export type PrivateKeyAlgorithm = z.infer<typeof privateKeyAlgorithmSchema>
+export type PrivateKeySpec = z.infer<typeof privateKeySchema>
+export type CertificateUsage = z.infer<typeof certificateUsageSchema>

package/src/utils.ts

@@ -1,4 +1,9 @@
-import { type FullComponentArgumentOptions, genericNameSchema, z } from "@highstate/contract"
+import {
+  type FullComponentArgumentOptions,
+  genericNameSchema,
+  objectMetaSchema,
+  z,
+} from "@highstate/contract"
 import { mapValues } from "remeda"
 
 type PrefixWith<TString extends string, TPrefix extends string> = TPrefix extends ""
@@ -101,3 +106,13 @@ export const metadataSchema = z.record(metadataKeySchema, z.unknown())
 export type Metadata = z.infer<typeof metadataSchema>
 export type MetadataKey = z.infer<typeof metadataKeySchema>
 export type MetadataContainer = { metadata?: Metadata }
+
+export const entityMetaArgsSchema = objectMetaSchema
+  .pick({
+    title: true,
+    description: true,
+    icon: true,
+    iconColor: true,
+  })
+  .partial()
+  .prefault({})