@mybase-dev/cli 1.0.2 → 1.0.4

package/dist/mybase.js

@@ -139,7 +139,7 @@ function parseDotenv(text) {
 // package.json
 var package_default = {
   name: "@mybase-dev/cli",
-  version: "1.0.2",
+  version: "1.0.4",
   description: "The mybase CLI: projects, keys, cron, queues, cache, rate limits, analytics, docs, and agent setup for a self-hosted mybase.",
   type: "module",
   repository: {
@@ -3724,8 +3724,21 @@ var compose_default = `# Runs mybase: the control plane (API + dashboard), the s
 #      Optionally POSTGRES_BIND=127.0.0.1, GARAGE_S3_BIND=127.0.0.1, and VALKEY_BIND=127.0.0.1 to stop exposing those ports on the LAN.
 #   5. docker compose up -d
 # Apps on serverless hosts reach Postgres at wss://mybase.<domain>/db with @neondatabase/serverless,
+# or, with a router port forward, at a normal postgres:// URL (public Postgres, below).
 # and the cache at https://mybase.<domain>/cache/<project> (@mybase-dev/sdk/cache or @upstash/redis).
 # Cloudflare's free plan caps request bodies at 100 MB: bigger dashboard uploads only work on the LAN.
+#
+# Public Postgres (any driver, from anywhere): \`mybase server database-public\` sets this up. By hand:
+#   1. On your router, forward TCP 5432 to this machine (it reveals your home IP; won't work behind CGNAT).
+#   2. Create a Cloudflare API token with Zone \u203A DNS \u203A Edit + Zone \u203A Zone \u203A Read for your zone.
+#   3. In .env:
+#        MYBASE_DB_PUBLIC=on
+#        MYBASE_DB_PUBLIC_HOST=db.<domain>
+#        MYBASE_DNS_TOKEN=<token>
+#   4. docker compose up -d
+# mybase then keeps an unproxied A record for db.<domain> on your public IP, gets a Let's Encrypt
+# certificate for it (DNS challenge, no port 80), and connection strings end in ?sslmode=require.
+# From the internet only project roles can sign in, to their own database, over TLS.
 name: mybase
 
 services:
@@ -3759,6 +3772,12 @@ services:
       MYBASE_PUBLIC_URL: \${MYBASE_PUBLIC_URL:-http://\${MYBASE_PUBLIC_HOST:-localhost}:\${MYBASE_PORT:-4000}}
       # Postgres over WebSocket, for apps that can't reach the Postgres port. Defaults to <MYBASE_PUBLIC_URL>/db.
       MYBASE_DB_WS_URL: \${MYBASE_DB_WS_URL:-}
+      # Public Postgres (see the top of this file): on + MYBASE_DB_PUBLIC_HOST + MYBASE_DNS_TOKEN.
+      MYBASE_DB_PUBLIC: \${MYBASE_DB_PUBLIC:-}
+      MYBASE_DNS_TOKEN: \${MYBASE_DNS_TOKEN:-}
+      # Optional: contact for Let's Encrypt, and 1 to use its staging CA (untrusted certs, for testing).
+      MYBASE_ACME_EMAIL: \${MYBASE_ACME_EMAIL:-}
+      MYBASE_ACME_STAGING: \${MYBASE_ACME_STAGING:-}
       MYBASE_MAX_UPLOAD: \${MYBASE_MAX_UPLOAD:-1073741824}
       VALKEY_HOST: valkey
       VALKEY_PORT: 6379
@@ -3935,6 +3954,10 @@ var SECTIONS = [
     keys: ["MYBASE_PORT", "MYBASE_PUBLIC_HOST", "MYBASE_PUBLIC_URL", "MYBASE_S3_PUBLIC_URL", "MYBASE_TRUST_PROXY", "POSTGRES_PORT", "GARAGE_S3_PORT", "VALKEY_PORT", "POSTGRES_BIND", "GARAGE_S3_BIND", "VALKEY_BIND"]
   },
   { title: "Cloudflare Tunnel (public HTTPS without opening router ports)", keys: ["COMPOSE_PROFILES", "CLOUDFLARE_TUNNEL_TOKEN"] },
+  {
+    title: "Public Postgres (router port forward; `mybase server database-public`)",
+    keys: ["MYBASE_DB_PUBLIC", "MYBASE_DB_PUBLIC_HOST", "MYBASE_DNS_TOKEN", "MYBASE_ACME_EMAIL", "MYBASE_ACME_STAGING"]
+  },
   { title: "Startup: `no` keeps mybase from starting again after a reboot or crash", keys: ["MYBASE_RESTART"] },
   { title: "Tuning", keys: ["CACHE_MAXMEMORY", "GARAGE_CAPACITY", "MYBASE_MAX_UPLOAD", "LOG_LEVEL"] }
 ];
@@ -4200,14 +4223,15 @@ import { homedir as homedir2, hostname as hostname3 } from "os";
 import { join as join3, resolve as resolve4 } from "path";
 import { styleText as styleText3 } from "util";
 
-// src/cloudflare.ts
+// ../../packages/shared/src/cloudflare.ts
 var API = "https://api.cloudflare.com/client/v4";
 var TOKEN_PERMISSIONS = ["Account \u203A Cloudflare Tunnel \u203A Edit", "Zone \u203A DNS \u203A Edit", "Zone \u203A Zone \u203A Read"];
+var DNS_TOKEN_PERMISSIONS = ["Zone \u203A DNS \u203A Edit", "Zone \u203A Zone \u203A Read"];
 var TOKEN_URL = "https://dash.cloudflare.com/profile/api-tokens";
 
 class CloudflareError extends Error {
 }
-function cloudflare(token, fetcher = fetch) {
+function cloudflare(token, fetcher = fetch, permissions = TOKEN_PERMISSIONS) {
   async function call(method, path, body) {
     const res = await fetcher(`${API}${path}`, {
       method,
@@ -4220,7 +4244,7 @@ function cloudflare(token, fetcher = fetch) {
     if (!res.ok || !data?.success) {
       const message = data?.errors?.map((e) => e.message).join("; ") || res.statusText;
       if (res.status === 401 || res.status === 403)
-        throw new CloudflareError(`Cloudflare refused the token (${message}). It needs: ${TOKEN_PERMISSIONS.join(", ")}.`);
+        throw new CloudflareError(`Cloudflare refused the token (${message}). It needs: ${permissions.join(", ")}.`);
       throw new CloudflareError(`Cloudflare: ${message}`);
     }
     return data.result;
@@ -4228,6 +4252,19 @@ function cloudflare(token, fetcher = fetch) {
   return {
     listAccounts: () => call("GET", "/accounts?per_page=50"),
     listZones: () => call("GET", "/zones?per_page=50&status=active"),
+    async zoneFor(host) {
+      const zones = await call("GET", "/zones?per_page=50&status=active");
+      return zoneOf(zones, host);
+    },
+    async upsertRecord(zoneId, record) {
+      const path = `/zones/${zoneId}/dns_records`;
+      const existing = await call("GET", `${path}?type=${record.type}&name=${encodeURIComponent(record.name)}`);
+      if (existing[0])
+        return call("PUT", `${path}/${existing[0].id}`, record);
+      return call("POST", path, record);
+    },
+    createRecord: (zoneId, record) => call("POST", `/zones/${zoneId}/dns_records`, record),
+    deleteRecord: (zoneId, id) => call("DELETE", `/zones/${zoneId}/dns_records/${id}`),
     async ensureTunnel(accountId, name) {
       const existing = await call("GET", `/accounts/${accountId}/cfd_tunnel?name=${encodeURIComponent(name)}&is_deleted=false`);
       if (existing[0])
@@ -4254,7 +4291,16 @@ function cloudflare(token, fetcher = fetch) {
   };
 }
 var pointsAtTunnel = (record, tunnelId) => record.content === `${tunnelId}.cfargotunnel.com`;
-
+function zoneOf(zones, host) {
+  const name = host.toLowerCase().replace(/\.$/, "");
+  let best = null;
+  for (const zone of zones) {
+    const z = zone.name.toLowerCase();
+    if ((name === z || name.endsWith(`.${z}`)) && z.length > (best?.name.length ?? -1))
+      best = zone;
+  }
+  return best;
+}
 // src/server-setup.ts
 var DEFAULT_DIR = join3(homedir2(), "mybase");
 var USERNAME_PATTERN = /^[a-zA-Z0-9_.@-]{1,64}$/;
@@ -4483,6 +4529,70 @@ async function bindStep(lan, existing) {
   }));
   return Object.fromEntries(BIND_KEYS.map((k) => [k, lock ? "127.0.0.1" : null]));
 }
+var DB_PUBLIC_KEYS = ["MYBASE_DB_PUBLIC", "MYBASE_DB_PUBLIC_HOST", "MYBASE_DNS_TOKEN", "MYBASE_ACME_EMAIL", "MYBASE_ACME_STAGING"];
+async function dbPublicStep(existing) {
+  ui.note([
+    `Apps anywhere get a normal postgres:// URL, with any driver. You need:`,
+    `\u2022 Your router to forward TCP port ${existing.POSTGRES_PORT || "5432"} to this machine. ${dim("Shows your home IP; not possible behind CGNAT.")}`,
+    `\u2022 A Cloudflare token that mybase keeps, to point db.<domain> at your IP and get a TLS certificate.`,
+    `  Create one at ${cyan(TOKEN_URL)} ${dim("(Custom token)")} with only:`,
+    ...DNS_TOKEN_PERMISSIONS.map((perm) => `     \u2022 ${perm}`)
+  ].join(`
+`), "Public Postgres");
+  const tunnelHost = URL.parse(existing.MYBASE_PUBLIC_URL ?? "")?.hostname ?? "";
+  for (;; ) {
+    const token = (await ask(password({ message: "Cloudflare API token (DNS edit)", validate: (v) => v?.trim() ? undefined : "required" }))).trim();
+    const cf = cloudflare(token, fetch, DNS_TOKEN_PERMISSIONS);
+    const s = ui.spinner();
+    s.start("Looking up your domains");
+    let zones;
+    try {
+      zones = await cf.listZones();
+    } catch (err) {
+      s.error(err.message);
+      if (await ask(confirm2({ message: "Try another token?" })))
+        continue;
+      throw new CliError("public Postgres not set up: no working token");
+    }
+    if (zones.length === 0) {
+      s.error("No active domains on this token");
+      if (await ask(confirm2({ message: "Try another token?" })))
+        continue;
+      throw new CliError("public Postgres not set up: the token can't see any domain");
+    }
+    s.stop(`Found ${zones.length} domain${zones.length === 1 ? "" : "s"}`);
+    const preferred = zoneOf(zones, existing.MYBASE_DB_PUBLIC_HOST || tunnelHost);
+    const zoneId = zones.length === 1 ? zones[0].id : await ask(select({ message: "Which domain?", options: zones.map((z) => ({ value: z.id, label: z.name })), initialValue: preferred?.id }));
+    const chosen = zones.find((z) => z.id === zoneId);
+    const suggested = existing.MYBASE_DB_PUBLIC_HOST && zoneOf([chosen], existing.MYBASE_DB_PUBLIC_HOST) ? existing.MYBASE_DB_PUBLIC_HOST : `db.${chosen.name}`;
+    const host = (await ask(text({
+      message: "Hostname for the database",
+      placeholder: suggested,
+      defaultValue: suggested,
+      validate: (v) => {
+        const h = (v || suggested).trim().toLowerCase();
+        if (validHost(h))
+          return validHost(h);
+        return zoneOf([chosen], h) ? undefined : `must end in ${chosen.name}`;
+      }
+    }))).trim().toLowerCase() || suggested;
+    const record = await cf.findRecord(chosen.id, host).catch(() => null);
+    if (record && record.type !== "A") {
+      const replace = await ask(confirm2({ message: `${host} already has a ${record.type} record (${record.content}). Replace it?`, initialValue: false }));
+      if (!replace)
+        continue;
+      await cf.deleteRecord(chosen.id, record.id);
+    }
+    const email = (await ask(text({ message: "Email for Let's Encrypt expiry notices (optional)", placeholder: "skip" }))).trim();
+    return {
+      MYBASE_DB_PUBLIC: "on",
+      MYBASE_DB_PUBLIC_HOST: host,
+      MYBASE_DNS_TOKEN: token,
+      MYBASE_ACME_EMAIL: email || null,
+      POSTGRES_BIND: null
+    };
+  }
+}
 async function adminStep() {
   const when = await ask(select({
     message: "Create the admin account now?",
@@ -4898,6 +5008,9 @@ var serverUsage = `  server setup [--dir <dir>]     Install mybase on this machi
   server status [--dir <dir>]    Containers, health, and whether mybase starts on boot
   server update [--dir <dir>]    Download new images and restart (also refreshes compose.yml)
   server tunnel [--dir <dir>]    Add or replace the Cloudflare Tunnel [--tunnel-token <t> --domain <d>] | --off
+  server database-public [--dir <dir>]   A normal postgres:// URL from anywhere: router port forward +
+                                 Let's Encrypt TLS + DNS kept on your IP (Cloudflare)
+    [--host <db.domain> --dns-token <t> [--email <e>] [--staging]] | --off
   server autostart on|off        Start mybase when this machine boots (and restart it after crashes)
   Default dir: the last one setup used, else ~/mybase`;
 var dim2 = (s) => styleText4("dim", s);
@@ -5004,6 +5117,101 @@ async function tunnel(args) {
     return print({ dir, version, publicUrl: host ? `https://${host}` : null }, () => {});
   outro(host ? `Public at https://${host}. Turn on two-factor sign-in in Settings if you haven't.` : "Tunnel off. mybase is reachable on this machine and your network only.");
 }
+async function databasePublic(args) {
+  const dir = await serverDir(args);
+  const { text, values } = await loadEnv(dir);
+  const interactive = !jsonMode && process.stdin.isTTY === true;
+  const off = args.includes("--off");
+  if (!jsonMode)
+    intro(`${styleText4("bold", " mybase ")} ${dim2("server database-public")}`);
+  let updates;
+  if (off) {
+    updates = Object.fromEntries(DB_PUBLIC_KEYS.map((k) => [k, null]));
+  } else if (flag(args, "--dns-token")) {
+    const host = flag(args, "--host");
+    if (!host)
+      throw usageError("--dns-token needs --host (like db.example.com)");
+    updates = {
+      MYBASE_DB_PUBLIC: "on",
+      MYBASE_DB_PUBLIC_HOST: host.toLowerCase(),
+      MYBASE_DNS_TOKEN: flag(args, "--dns-token"),
+      MYBASE_ACME_EMAIL: flag(args, "--email") ?? null,
+      MYBASE_ACME_STAGING: args.includes("--staging") ? "1" : null,
+      POSTGRES_BIND: null
+    };
+  } else if (interactive) {
+    updates = await dbPublicStep(values);
+  } else
+    throw usageError("without a terminal, pass --host <db.domain> --dns-token <t>, or --off");
+  if (!off && values.POSTGRES_BIND === "127.0.0.1")
+    ui.info("Postgres now listens on your network again (POSTGRES_BIND), so the router can reach it.");
+  await saveEnv(dir, mergeEnv(text, updates));
+  if (await writeCompose(dir, interactive, true))
+    ui.success(`compose.yml updated to this CLI's (${CLI_VERSION})`);
+  const version = await startStack(dir, values);
+  const status = off ? null : await waitForDbPublic(localUrl(values));
+  const port = values.POSTGRES_PORT || "5432";
+  const lan = addresses().find((a) => a.label.startsWith("LAN IP"))?.value ?? "<this machine's LAN IP>";
+  const host = off ? null : updates.MYBASE_DB_PUBLIC_HOST;
+  if (jsonMode)
+    return print({ dir, version, host, port: Number(port), forward: host ? `${lan}:${port}` : null, status }, () => {});
+  if (!host)
+    return outro("Public Postgres off. Connection strings point at your network address again. Remove the port forward on your router.");
+  ui.note([
+    `On your router (usually "Port forwarding" or "Virtual server"):`,
+    `  TCP ${port} (external) \u2192 ${lan}:${port}`,
+    ``,
+    dim2(status?.tls.active ? "DNS and the certificate are ready." : "Check progress in the dashboard (Database \u2192 Settings) or with `mybase doctor`.")
+  ].join(`
+`), "Last step");
+  outro(`New connection strings: postgres://<project>:<password>@${host}:${port}/<project>?sslmode=require`);
+}
+async function waitForDbPublic(url) {
+  const s = ui.spinner();
+  s.start("Pointing DNS at your public IP and getting a certificate (about a minute)");
+  const deadline = Date.now() + 150000;
+  let last = null;
+  for (;; ) {
+    try {
+      last = await api("/database/public", { url });
+    } catch (err) {
+      const status = err.status;
+      if (status === 401 || status === 403) {
+        s.stop("Can't check progress: this CLI isn't signed in to the server as admin");
+        return null;
+      }
+      if (status !== 404)
+        throw err;
+      last = null;
+    }
+    if (typeof last?.enabled !== "boolean") {
+      s.error("The server doesn't support public Postgres");
+      throw new CliError("the running mybase image is older than this CLI. Run `mybase server update` (or set MYBASE_IMAGE to a newer build), then this command again.");
+    }
+    if (!last.enabled) {
+      s.error("The server didn't get the settings");
+      throw new CliError("MYBASE_DB_PUBLIC isn't reaching the API. Check that compose.yml passes it (`mybase server update` refreshes compose.yml).");
+    }
+    if (last.problem) {
+      s.error(last.problem);
+      throw new CliError(last.problem);
+    }
+    if (last.dns.error || last.tls.error) {
+      s.error([last.dns.error && `DNS: ${last.dns.error}`, last.tls.error && `Certificate: ${last.tls.error}`].filter(Boolean).join("; "));
+      ui.info("mybase keeps retrying (certificate: in 1 h, 6 h, then daily). Fix the cause, then run `mybase server update` to retry now.");
+      return last;
+    }
+    if (last.tls.active) {
+      s.stop(`${last.host} \u2192 ${last.dns.ip}, certificate valid until ${last.tls.notAfter?.slice(0, 10)}`);
+      return last;
+    }
+    if (Date.now() > deadline) {
+      s.stop(`Still working (${last.dns.ip ? `DNS \u2192 ${last.dns.ip}` : "DNS pending"}, certificate pending)`);
+      return last;
+    }
+    await Bun.sleep(3000);
+  }
+}
 async function autostart(args) {
   const mode = args[0];
   if (mode !== "on" && mode !== "off")
@@ -5034,6 +5242,8 @@ async function server(command, args) {
     await update(args);
   else if (command === "tunnel")
     await tunnel(args);
+  else if (command === "database-public")
+    await databasePublic(args);
   else if (command === "autostart")
     await autostart(args);
   else

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mybase-dev/cli",
-  "version": "1.0.2",
+  "version": "1.0.4",
   "description": "The mybase CLI: projects, keys, cron, queues, cache, rate limits, analytics, docs, and agent setup for a self-hosted mybase.",
   "type": "module",
   "repository": {