@monster-orange/den 0.2.8 → 0.3.0

package/src/shared/edge/included.ts

@@ -0,0 +1,169 @@
+/**
+ * The routers in the distribution's included dynamic-config files (`edge
+ * include`, e.g. `edge/dynamic/*.yml`): Traefik serves them beside the
+ * routes Den generates, so `edge routes`, /api/edge and the Edge page list
+ * them too, each marked by its source file (PL-SPEC §10, a consumer's review).
+ *
+ * Read-only: the files are parsed, never written, and only `http.routers`
+ * is read. The same files `edge up` copies in (top-level YAML, not the
+ * generated edge.yml, not a stack's own route file).
+ *
+ * Since 0.3.0-dev.32 (a consumer's finding) also the stacks' own route
+ * files: Den writes `stack-<project>.yml` into the edge's dynamic directory
+ * when a stack comes up, and those routers are neither Den's host routes
+ * nor included files, so nothing listed them.
+ */
+import * as fs from "fs";
+import * as path from "path";
+import { parse } from "yaml";
+import { includeFiles, isOwnedElsewhere, isStackRoutes } from "./runtime.js";
+import type { EdgeConfig } from "./types.js";
+
+export interface IncludedRouter {
+  /** The router's key under `http.routers`. */
+  name: string;
+  /** The included file it comes from (its name, as Traefik reads it). */
+  file: string;
+  rule: string;
+  service: string;
+  entryPoints: string[];
+  /** The hosts its rule names (`Host(...)`), for links. */
+  hosts: string[];
+  tls: boolean;
+  /**
+   * Served over https: the router has TLS or is on the websecure
+   * entrypoint (0.3.0-dev.33). Its URLs are https://, else http://.
+   */
+  secure: boolean;
+  /**
+   * Where it sends traffic: its service's loadBalancer server URL(s) when
+   * the same file defines that service, else the service's name
+   * (0.3.0-dev.33).
+   */
+  upstream: string;
+}
+
+/** A router's URLs: one per host, with its scheme; none without a Host(). */
+export function routerUrls(r: Pick<IncludedRouter, "hosts" | "secure">) {
+  const scheme = r.secure ? "https://" : "http://";
+  return r.hosts.map((h) => scheme + h);
+}
+
+export interface IncludedRouters {
+  routers: IncludedRouter[];
+  /** Files that could not be read or parsed: listed, never fatal. */
+  errors: { file: string; error: string }[];
+}
+
+/** The hosts a Traefik rule names: every quoted argument of Host(...). */
+export function ruleHosts(rule: string): string[] {
+  const out: string[] = [];
+  for (const m of rule.matchAll(/\bHost\(([^)]*)\)/g))
+    for (const q of m[1].matchAll(/[`"']([^`"']+)[`"']/g))
+      if (!out.includes(q[1])) out.push(q[1]);
+  return out;
+}
+
+const str = (v: unknown): string => (typeof v === "string" ? v : "");
+
+/** The routers in one dynamic-config document's `http.routers`. */
+export function routersOf(doc: unknown, file: string): IncludedRouter[] {
+  const http = (
+    doc as { http?: { routers?: unknown; services?: unknown } } | null
+  )?.http;
+  const routers = http?.routers;
+  if (!routers || typeof routers !== "object" || Array.isArray(routers))
+    return [];
+  const services = obj(http?.services);
+  return Object.entries(routers as Record<string, unknown>).map(([name, r]) => {
+    const o = obj(r);
+    const rule = str(o.rule);
+    const service = str(o.service);
+    const entryPoints = Array.isArray(o.entryPoints)
+      ? o.entryPoints.filter((e): e is string => typeof e === "string")
+      : [];
+    const tls = o.tls !== undefined && o.tls !== null && o.tls !== false;
+    return {
+      name,
+      file,
+      rule,
+      service,
+      entryPoints,
+      hosts: ruleHosts(rule),
+      tls,
+      secure: tls || entryPoints.includes("websecure"),
+      upstream: serverUrls(services[service]).join(", ") || service,
+    };
+  });
+}
+
+const obj = (v: unknown): Record<string, unknown> =>
+  v && typeof v === "object" && !Array.isArray(v)
+    ? (v as Record<string, unknown>)
+    : {};
+
+/** A Traefik service's loadBalancer server URLs (none: not a load balancer). */
+function serverUrls(svc: unknown): string[] {
+  const servers = obj(obj(svc).loadBalancer).servers;
+  return Array.isArray(servers)
+    ? servers.map((x) => str(obj(x).url)).filter(Boolean)
+    : [];
+}
+
+/** Every router in the edge's included files, in file then key order. */
+export function includedRouters(cfg: EdgeConfig): IncludedRouters {
+  const out: IncludedRouters = { routers: [], errors: [] };
+  if (!cfg.include) return out;
+  let files: string[];
+  try {
+    files = includeFiles(cfg.include).filter((f) => !isOwnedElsewhere(f));
+  } catch (e) {
+    out.errors.push({
+      file: path.basename(cfg.include),
+      error: (e as Error).message,
+    });
+    return out;
+  }
+  for (const file of files) {
+    try {
+      const doc: unknown = parse(
+        fs.readFileSync(path.join(cfg.include, file), "utf-8"),
+      );
+      out.routers.push(...routersOf(doc, file));
+    } catch (e) {
+      out.errors.push({ file, error: (e as Error).message.split("\n")[0] });
+    }
+  }
+  return out;
+}
+
+/**
+ * Every router in the stacks' route files (`stack-*.yml` in the edge's
+ * dynamic directory, which `stack up` writes and `stack down` removes), in
+ * file then key order. No directory yet: none.
+ */
+export function stackRouters(cfg: EdgeConfig): IncludedRouters {
+  const out: IncludedRouters = { routers: [], errors: [] };
+  const dyn = path.join(cfg.stateDir, "dynamic");
+  let files: string[];
+  try {
+    files = fs
+      .readdirSync(dyn, { withFileTypes: true })
+      .filter((e) => e.isFile() && isStackRoutes(e.name))
+      .map((e) => e.name)
+      .sort();
+  } catch {
+    return out;
+  }
+  for (const file of files) {
+    try {
+      const doc: unknown = parse(
+        fs.readFileSync(path.join(dyn, file), "utf-8"),
+      );
+      out.routers.push(...routersOf(doc, file));
+    } catch (e) {
+      out.errors.push({ file, error: (e as Error).message.split("\n")[0] });
+    }
+  }
+  return out;
+}

package/src/shared/edge/render.ts

@@ -38,12 +38,34 @@ function hostRule(name: string, cfg: EdgeConfig): string {
     .join(" || ");
 }
 
-/** Public URL for a route, including the port when it isn't 443. */
+/** True when the edge serves https: every edge.tls strategy but `none`. */
+export function edgeHttps(cfg: EdgeConfig): boolean {
+  return cfg.tls.strategy !== "none";
+}
+
+/** The entrypoint routes listen on: websecure, or web for `tls: none`. */
+export function routeEntryPoint(cfg: EdgeConfig): "web" | "websecure" {
+  return edgeHttps(cfg) ? "websecure" : "web";
+}
+
+/** A router's TLS block: `{ tls: {} }`, or nothing for `tls: none`. */
+export function routerTls(cfg: EdgeConfig): { tls?: Record<string, never> } {
+  return edgeHttps(cfg) ? { tls: {} } : {};
+}
+
+/**
+ * Public URL for a route, including the port when it isn't the default
+ * (443, or 80 for an http-only edge).
+ */
 export function routeUrl(
   name: string,
   cfg: EdgeConfig,
   domain = cfg.domain,
 ): string {
+  if (!edgeHttps(cfg)) {
+    const h = cfg.ports?.http ?? 80;
+    return `http://${routeHost(name, domain)}${h === 80 ? "" : `:${h}`}`;
+  }
   const p = cfg.ports?.https ?? 443;
   return `https://${routeHost(name, domain)}${p === 443 ? "" : `:${p}`}`;
 }
@@ -64,12 +86,20 @@ export function certNames(cfg: EdgeConfig): string[] {
   ]);
 }
 
-/** Dynamic config: TLS cert, HTTP→HTTPS redirect, dashboard, routes. */
+/**
+ * Dynamic config: TLS cert, HTTP→HTTPS redirect, dashboard, routes. With
+ * `tls: none` every router is on the http entrypoint, with no TLS and no
+ * redirect.
+ */
 export function renderEdgeDynamic(cfg: EdgeConfig): string {
   const httpsPort = cfg.ports?.https ?? 443;
   const redirectPort = httpsPort !== 443 ? { port: String(httpsPort) } : {};
+  const https = edgeHttps(cfg);
+  const redirect = https && cfg.httpsRedirect;
+  // Fresh objects per router: a shared one would render as a YAML anchor.
+  const entryPoints = () => [routeEntryPoint(cfg)];
   const routers: Record<string, unknown> = {
-    ...(cfg.httpsRedirect
+    ...(redirect
       ? {
           "to-https": {
             entryPoints: ["web"],
@@ -81,10 +111,10 @@ export function renderEdgeDynamic(cfg: EdgeConfig): string {
         }
       : {}),
     dashboard: {
-      entryPoints: ["websecure"],
+      entryPoints: entryPoints(),
       rule: hostRule("edge", cfg),
       service: "api@internal",
-      tls: {},
+      ...routerTls(cfg),
     },
   };
   const services: Record<string, unknown> = {};
@@ -97,10 +127,10 @@ export function renderEdgeDynamic(cfg: EdgeConfig): string {
       );
     const key = `route-${slug(name)}`;
     routers[key] = {
-      entryPoints: ["websecure"],
+      entryPoints: entryPoints(),
       rule: hostRule(name, cfg),
       service: key,
-      tls: {},
+      ...routerTls(cfg),
     };
     services[key] = { loadBalancer: { servers: [{ url }] } };
   }
@@ -113,7 +143,7 @@ export function renderEdgeDynamic(cfg: EdgeConfig): string {
     yaml.stringify({
       http: {
         routers,
-        ...(cfg.httpsRedirect
+        ...(redirect
           ? {
               middlewares: {
                 "to-https": {
@@ -128,7 +158,7 @@ export function renderEdgeDynamic(cfg: EdgeConfig): string {
           : {}),
         ...(Object.keys(services).length ? { services } : {}),
       },
-      ...(cfg.issueCert
+      ...(cfg.tls.strategy === "mkcert"
         ? {
             tls: {
               stores: { default: { defaultCertificate: cert } },
@@ -145,8 +175,25 @@ export function dockerProxyName(org: string): string {
   return `${edgeNames(org).container}-docker`;
 }
 
-/** Compose file for the edge; publishes host ports only when configured. */
-export function renderEdgeCompose(cfg: EdgeConfig): string {
+/**
+ * Compose file for the edge; publishes host ports only when configured.
+ * With `tls: none` there is no https entrypoint, port or cert volume.
+ */
+/** The labels that say which state dir and org own the edge container. */
+export const EDGE_ROOT_LABEL = "den.edge.root";
+export const EDGE_ORG_LABEL = "den.edge.org";
+
+/**
+ * The edge's compose.yml. Its container carries `den.edge.root` (the state
+ * dir that owns it, `ownerRoot`: edgeUp passes its realpath) and
+ * `den.edge.org` (0.3.0-dev.40): edgeUp and `edge down` touch an existing
+ * edge only when its root is theirs.
+ */
+export function renderEdgeCompose(
+  cfg: EdgeConfig,
+  ownerRoot: string = cfg.stateDir,
+): string {
+  const https = edgeHttps(cfg);
   const n = edgeNames(cfg.org);
   const proxy = dockerProxyName(cfg.org);
   const labels = cfg.dockerLabels;
@@ -159,10 +206,11 @@ export function renderEdgeCompose(cfg: EdgeConfig): string {
       image: cfg.image,
       container_name: n.container,
       restart: "unless-stopped",
+      labels: { [EDGE_ROOT_LABEL]: ownerRoot, [EDGE_ORG_LABEL]: cfg.org },
       ...(labels ? { depends_on: ["docker-proxy"] } : {}),
       command: [
         "--entrypoints.web.address=:80",
-        "--entrypoints.websecure.address=:443",
+        ...(https ? ["--entrypoints.websecure.address=:443"] : []),
         "--providers.file.directory=/etc/edge/dynamic",
         "--providers.file.watch=true",
         ...(labels
@@ -179,12 +227,19 @@ export function renderEdgeCompose(cfg: EdgeConfig): string {
         ...cfg.args,
       ],
       ...(cfg.ports
-        ? { ports: [`${cfg.ports.http}:80`, `${cfg.ports.https}:443`] }
+        ? {
+            ports: [
+              `${cfg.ports.http}:80`,
+              ...(https ? [`${cfg.ports.https}:443`] : []),
+            ],
+          }
         : {}),
       extra_hosts: ["host.docker.internal:host-gateway"],
       volumes: [
         "./dynamic:/etc/edge/dynamic:ro",
-        ...(cfg.issueCert ? ["./certs:/etc/edge/certs:ro"] : []),
+        ...(cfg.tls.strategy === "mkcert"
+          ? ["./certs:/etc/edge/certs:ro"]
+          : []),
         ...Object.entries(cfg.mounts)
           .sort(([a], [b]) => a.localeCompare(b))
           .map(([host, target]) => `${host}:${target}:ro`),

package/src/shared/edge/runtime.ts

@@ -1,47 +1,30 @@
 /**
- * Side effects for the edge: docker, mkcert, files. Thin on purpose — every
- * routing decision lives in render.ts.
+ * Side effects for the edge: docker, files, and the TLS strategy's (tls.ts).
+ * Thin on purpose — every routing decision lives in render.ts.
  */
-import { spawnSync } from "child_process";
 import * as fs from "fs";
 import * as net from "net";
 import * as path from "path";
+import { must, sh } from "./exec.js";
 import {
-  certNames,
+  EDGE_ROOT_LABEL,
   edgeNames,
   renderEdgeCompose,
   renderEdgeDynamic,
 } from "./render.js";
+import {
+  assertCaUsable,
+  caDir,
+  caTrusted,
+  edgeTrust,
+  edgeUntrust,
+  sharedCa,
+  tlsStrategyFor,
+  warnImplicitTlsOnce,
+} from "./tls.js";
 import type { EdgeConfig } from "./types.js";
 
-function sh(
-  cmd: string,
-  args: string[],
-  opts: { env?: NodeJS.ProcessEnv; inherit?: boolean } = {},
-) {
-  const r = spawnSync(cmd, args, {
-    encoding: "utf-8",
-    env: { ...process.env, ...opts.env },
-    stdio: opts.inherit ? "inherit" : "pipe",
-  });
-  if (r.error) throw new Error(`${cmd} is not installed (${r.error.message})`);
-  return {
-    code: r.status ?? 1,
-    out: (r.stdout ?? "").trim(),
-    err: (r.stderr ?? "").trim(),
-  };
-}
-
-function must(
-  cmd: string,
-  args: string[],
-  opts: { env?: NodeJS.ProcessEnv } = {},
-): string {
-  const r = sh(cmd, args, opts);
-  if (r.code !== 0)
-    throw new Error(`${cmd} ${args.join(" ")} failed:\n${r.err || r.out}`);
-  return r.out;
-}
+export { assertCaUsable, caDir, caTrusted, sharedCa };
 
 function write(file: string, content: string): void {
   fs.mkdirSync(path.dirname(file), { recursive: true });
@@ -68,102 +51,25 @@ export function portInUse(port: number): Promise<boolean> {
   });
 }
 
-// ── Certificates (org-scoped CA) ─────────────────────────────────────────────
+// ── Certificates (the edge.tls strategy, see tls.ts) ────────────────────────
 
-export function caDir(cfg: EdgeConfig): string {
-  return cfg.caroot ?? path.join(cfg.stateDir, "ca");
-}
-
-/** True when the edge uses an existing CA (`caroot`) rather than its own. */
-export function sharedCa(cfg: EdgeConfig): boolean {
-  return cfg.caroot !== null;
-}
-
-/**
- * A shared CA must already exist with its key: mkcert silently creates a new
- * CA in an empty CAROOT, and devices that trust the shared one would not
- * trust that. The org's own CA may be created on first use.
- */
-export function assertCaUsable(cfg: EdgeConfig): void {
-  if (!sharedCa(cfg)) return;
-  const dir = caDir(cfg);
-  if (!fs.existsSync(dir))
-    throw new Error(
-      `edge.caroot ${dir} does not exist. The edge never creates a CA there; ` +
-        `point caroot at the existing CA (\`mkcert -CAROOT\`).`,
-    );
-  for (const f of ["rootCA.pem", "rootCA-key.pem"])
-    if (!fs.existsSync(path.join(dir, f)))
-      throw new Error(
-        `edge.caroot ${dir} has no ${f}. Refusing to run: mkcert would mint a ` +
-          `new CA that other devices don't trust.`,
-      );
-}
-
-function mkcertEnv(cfg: EdgeConfig): NodeJS.ProcessEnv {
-  return { CAROOT: caDir(cfg) };
-}
-
-/** Issue (or re-issue when names changed) the edge cert from the org's own CA. */
+/** Make sure the edge's cert exists, as its TLS strategy does it. */
 export function ensureCerts(cfg: EdgeConfig): {
   issued: boolean;
   names: string[];
 } {
-  const names = certNames(cfg);
-  if (!cfg.issueCert) return { issued: false, names: [] };
-  assertCaUsable(cfg);
-  const dir = path.join(cfg.stateDir, "certs");
-  const stamp = path.join(dir, "names.txt");
-  const want = names.join("\n");
-  if (
-    fs.existsSync(path.join(dir, "edge.pem")) &&
-    fs.existsSync(stamp) &&
-    fs.readFileSync(stamp, "utf-8") === want
-  )
-    return { issued: false, names };
-  fs.mkdirSync(dir, { recursive: true });
-  if (!sharedCa(cfg))
-    fs.mkdirSync(caDir(cfg), { recursive: true, mode: 0o700 });
-  must(
-    "mkcert",
-    [
-      "-cert-file",
-      path.join(dir, "edge.pem"),
-      "-key-file",
-      path.join(dir, "edge-key.pem"),
-      ...names,
-    ],
-    { env: mkcertEnv(cfg) },
-  );
-  write(stamp, want);
-  return { issued: true, names };
+  const r = tlsStrategyFor(cfg).capabilities.ensure(cfg);
+  return { issued: r.issued, names: r.names };
 }
 
-/** Install the org CA into the system + browser trust stores (prompts for a password). */
+/** `edge trust`: install the CA (mkcert only; prompts for a password). */
 export function trustCa(cfg: EdgeConfig): number {
-  assertCaUsable(cfg);
-  if (!sharedCa(cfg))
-    fs.mkdirSync(caDir(cfg), { recursive: true, mode: 0o700 });
-  return sh("mkcert", ["-install"], { env: mkcertEnv(cfg), inherit: true })
-    .code;
+  return edgeTrust(cfg);
 }
 
+/** `edge untrust` (mkcert only; never a shared CA). */
 export function untrustCa(cfg: EdgeConfig): number {
-  if (sharedCa(cfg))
-    throw new Error(
-      `edge.caroot is a shared CA (${caDir(cfg)}); other tools and devices ` +
-        `rely on it being trusted, so the edge never uninstalls it.`,
-    );
-  return sh("mkcert", ["-uninstall"], { env: mkcertEnv(cfg), inherit: true })
-    .code;
-}
-
-/** Whether the org CA is in the macOS system keychain (null: can't tell). */
-export function caTrusted(cfg: EdgeConfig): boolean | null {
-  const pem = path.join(caDir(cfg), "rootCA.pem");
-  if (!fs.existsSync(pem)) return false;
-  if (process.platform !== "darwin") return null;
-  return sh("security", ["verify-cert", "-c", pem]).code === 0;
+  return edgeUntrust(cfg);
 }
 
 // ── Included dynamic config ─────────────────────────────────────────────────
@@ -188,9 +94,13 @@ export function includeFiles(dir: string | null): string[] {
  */
 const INCLUDED_LEDGER = "included.json";
 
+/** A stack's own route file (`stack-<project>.yml`, stacks/runtime.ts). */
+export const isStackRoutes = (f: string): boolean =>
+  /^stack-.*\.ya?ml$/.test(f);
+
 /** Files other writers own in the dynamic directory: never copied over or pruned. */
-const isOwnedElsewhere = (f: string): boolean =>
-  f === GENERATED || /^stack-.*\.ya?ml$/.test(f);
+export const isOwnedElsewhere = (f: string): boolean =>
+  f === GENERATED || isStackRoutes(f);
 
 function readLedger(stateDir: string): string[] {
   try {
@@ -228,7 +138,101 @@ export function syncIncluded(cfg: EdgeConfig): string[] {
 
 // ── Edge ─────────────────────────────────────────────────────────────────────
 
-export async function edgeUp(cfg: EdgeConfig) {
+/** Where the dynamic config mounts in the edge container (render.ts). */
+const DYNAMIC_TARGET = "/etc/edge/dynamic";
+
+/** An existing container of the edge's name: who owns it, as it says. */
+export interface ExistingEdge {
+  /** Its `den.edge.root` label, or null for an unlabelled (legacy) edge. */
+  root: string | null;
+  /** The dir its dynamic-config mount comes from, when it has one. */
+  mountsDir: string | null;
+}
+
+/** The container named `name`, any state; null when there is none. */
+export function existingEdge(name: string): ExistingEdge | null {
+  const r = sh("docker", [
+    "inspect",
+    "--type",
+    "container",
+    "-f",
+    `{{index .Config.Labels "${EDGE_ROOT_LABEL}"}}|{{range .Mounts}}{{.Source}}>{{.Destination}};{{end}}`,
+    name,
+  ]);
+  // A container always prints the separator; nothing at all is no answer.
+  if (r.code !== 0 || !r.out.includes("|")) return null;
+  const [label, mounts] = r.out.split("|");
+  const root = label && label !== "<no value>" ? label : null;
+  let mountsDir: string | null = null;
+  for (const m of (mounts ?? "").split(";")) {
+    const [src, dst] = m.split(">");
+    if (src && dst === DYNAMIC_TARGET) mountsDir = path.dirname(src);
+  }
+  return { root, mountsDir };
+}
+
+function realOrSelf(p: string): string {
+  try {
+    return fs.realpathSync(p);
+  } catch {
+    return path.resolve(p);
+  }
+}
+
+/**
+ * Whether this invocation may create, recreate or stop the edge
+ * (0.3.0-dev.40, P1: a scratch root with its own DEN_EDGE_DIR but the real
+ * edge.org recreated the user's real edge with the scratch certs and
+ * routes; the container and project are named by org). An existing edge is
+ * ours only when its `den.edge.root` label is this state dir; an
+ * unlabelled (legacy) one is adopted only from the default state dir, never
+ * under a DEN_EDGE_DIR that overrides it. `takeOver` (`edge up
+ * --take-over`) is the only override. Nothing is touched; only paths are
+ * said.
+ */
+export function assertEdgeOwnedHere(
+  cfg: EdgeConfig,
+  opts: {
+    takeOver?: boolean;
+    warn?: (line: string) => void;
+    /** What a refusal says it won't do: "replacing" (up), "stopping" (down). */
+    verb?: "replacing" | "stopping";
+  } = {},
+): void {
+  const n = edgeNames(cfg.org);
+  const found = existingEdge(n.container);
+  if (!found) return;
+  const here = realOrSelf(cfg.stateDir);
+  const ours = found.root
+    ? realOrSelf(found.root) === here
+    : !cfg.defaultStateDir; // legacy: only from the default state dir
+  if (ours) return;
+  const other = found.root ?? found.mountsDir ?? "another state dir";
+  const warn = opts.warn ?? ((l: string) => console.warn(l));
+  // A scratch root on the real org: the name is the org's, so only another
+  // org isolates it.
+  if (cfg.defaultStateDir)
+    warn(
+      `Warning: DEN_EDGE_DIR (${cfg.stateDir}) is not this config's edge dir, ` +
+        `and edge.org "${cfg.org}" names an edge that exists already. ` +
+        `Give this root a distinct edge.org.`,
+    );
+  if (opts.takeOver) {
+    warn(`Taking over edge ${n.container} from ${other} (--take-over).`);
+    return;
+  }
+  throw new Error(
+    `edge ${n.container} belongs to ${other}; not ${opts.verb ?? "replacing"} it`,
+  );
+}
+
+export async function edgeUp(
+  cfg: EdgeConfig,
+  opts: { takeOver?: boolean } = {},
+) {
+  // Before anything is written or started: an edge of this name that
+  // another state dir owns is never replaced.
+  assertEdgeOwnedHere(cfg, opts);
   const n = edgeNames(cfg.org);
   if (cfg.ports && containerState(n.container) !== "running") {
     for (const p of [cfg.ports.http, cfg.ports.https])
@@ -240,6 +244,7 @@ export async function edgeUp(cfg: EdgeConfig) {
         );
   }
   assertCaUsable(cfg);
+  warnImplicitTlsOnce(cfg);
   ensureNetwork(n.network);
   for (const net of [
     ...(cfg.dockerLabels ? [cfg.dockerLabels.network] : []),
@@ -256,12 +261,14 @@ export async function edgeUp(cfg: EdgeConfig) {
   const included = syncIncluded(cfg);
   write(path.join(cfg.stateDir, "dynamic", GENERATED), renderEdgeDynamic(cfg));
   const compose = path.join(cfg.stateDir, "compose.yml");
-  write(compose, renderEdgeCompose(cfg));
+  write(compose, renderEdgeCompose(cfg, realOrSelf(cfg.stateDir)));
   must("docker", ["compose", "-f", compose, "up", "-d", "--remove-orphans"]);
   return { certs, included };
 }
 
 export function edgeDown(cfg: EdgeConfig): void {
+  // The project is named by org too: another dir's edge is not ours to stop.
+  assertEdgeOwnedHere(cfg, { verb: "stopping" });
   const compose = path.join(cfg.stateDir, "compose.yml");
   if (fs.existsSync(compose))
     must("docker", ["compose", "-f", compose, "down"]);