@nocobase/cli 2.1.0-beta.45 → 2.1.0-beta.47

package/dist/commands/proxy/nginx/start.js

@@ -0,0 +1,30 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+import { Command } from '@oclif/core';
+import { getNginxProxyDriver, resolveNginxProxyRuntimeContext, startNginxProxy } from '../../../lib/proxy-nginx.js';
+import { failTask, startTask, succeedTask } from '../../../lib/ui.js';
+export default class ProxyNginxStart extends Command {
+    static summary = 'Start the managed nginx proxy';
+    async run() {
+        await this.parse(ProxyNginxStart);
+        const driver = await getNginxProxyDriver();
+        const runtimeContext = await resolveNginxProxyRuntimeContext();
+        startTask(`Starting nginx proxy with the ${driver} driver...`);
+        try {
+            const result = await startNginxProxy(runtimeContext);
+            succeedTask(result === 'already-running'
+                ? `Nginx proxy is already running with the ${driver} driver.`
+                : `Nginx proxy started with the ${driver} driver.`);
+        }
+        catch (error) {
+            failTask(`Failed to start nginx proxy with the ${driver} driver.`);
+            this.error(error instanceof Error ? error.message : String(error));
+        }
+    }
+}

package/dist/commands/proxy/nginx/status.js

@@ -0,0 +1,19 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+import { Command } from '@oclif/core';
+import { formatNginxProxyStatusLines, getNginxProxyStatus, resolveNginxProxyRuntimeContext, } from '../../../lib/proxy-nginx.js';
+export default class ProxyNginxStatus extends Command {
+    static summary = 'Show the current nginx proxy runtime status';
+    async run() {
+        await this.parse(ProxyNginxStatus);
+        const runtimeContext = await resolveNginxProxyRuntimeContext();
+        const status = await getNginxProxyStatus(runtimeContext);
+        this.log(formatNginxProxyStatusLines(status).join('\n'));
+    }
+}

package/dist/commands/proxy/nginx/stop.js

@@ -0,0 +1,30 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+import { Command } from '@oclif/core';
+import { getNginxProxyDriver, resolveNginxProxyRuntimeContext, stopNginxProxy } from '../../../lib/proxy-nginx.js';
+import { failTask, startTask, succeedTask } from '../../../lib/ui.js';
+export default class ProxyNginxStop extends Command {
+    static summary = 'Stop the managed nginx proxy';
+    async run() {
+        await this.parse(ProxyNginxStop);
+        const driver = await getNginxProxyDriver();
+        const runtimeContext = await resolveNginxProxyRuntimeContext();
+        startTask(`Stopping nginx proxy with the ${driver} driver...`);
+        try {
+            const result = await stopNginxProxy(runtimeContext);
+            succeedTask(result === 'already-stopped'
+                ? `Nginx proxy is already stopped with the ${driver} driver.`
+                : `Nginx proxy stopped with the ${driver} driver.`);
+        }
+        catch (error) {
+            failTask(`Failed to stop nginx proxy with the ${driver} driver.`);
+            this.error(error instanceof Error ? error.message : String(error));
+        }
+    }
+}

package/dist/commands/proxy/nginx/use.js

@@ -0,0 +1,31 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+import { Args, Command } from '@oclif/core';
+import { NGINX_PROXY_DRIVER_OPTIONS, normalizeNginxProxyDriver } from '../../../lib/cli-config.js';
+import { setNginxProxyDriver } from '../../../lib/proxy-nginx.js';
+export default class ProxyNginxUse extends Command {
+    static summary = 'Choose whether nginx runs locally or in Docker';
+    static examples = ['<%= config.bin %> proxy nginx use local', '<%= config.bin %> proxy nginx use docker'];
+    static args = {
+        driver: Args.string({
+            description: 'Nginx runtime driver',
+            required: true,
+            options: [...NGINX_PROXY_DRIVER_OPTIONS],
+        }),
+    };
+    async run() {
+        const { args } = await this.parse(ProxyNginxUse);
+        const driver = normalizeNginxProxyDriver(args.driver);
+        if (!driver) {
+            this.error(`Unsupported nginx driver "${args.driver}". Use one of: ${NGINX_PROXY_DRIVER_OPTIONS.join(', ')}`);
+        }
+        const saved = await setNginxProxyDriver(driver);
+        this.log(saved);
+    }
+}

package/dist/commands/revision/create.js

@@ -9,6 +9,17 @@
 import { Args, Command, Flags } from '@oclif/core';
 import { executeRawApiRequest } from '../../lib/api-client.js';
 import { ensureCrossEnvConfirmed } from '../../lib/env-guard.js';
+const VERSION_CONTROL_PLUGIN_PACKAGE = '@nocobase/plugin-version-control';
+function isRecord(value) {
+    return typeof value === 'object' && value !== null;
+}
+function extractPluginList(data) {
+    const list = Array.isArray(data) ? data : isRecord(data) && Array.isArray(data.data) ? data.data : [];
+    return list.filter(isRecord).map((item) => ({
+        packageName: typeof item.packageName === 'string' ? item.packageName : undefined,
+        enabled: typeof item.enabled === 'boolean' ? item.enabled : undefined,
+    }));
+}
 export default class RevisionCreate extends Command {
     static summary = 'Save the current NocoBase build as a restorable revision';
     static examples = [
@@ -44,7 +55,7 @@ export default class RevisionCreate extends Command {
         'json-output': Flags.boolean({
             char: 'j',
             description: 'Print raw JSON response',
-            default: true,
+            default: false,
             allowNo: true,
         }),
     };
@@ -62,6 +73,24 @@ export default class RevisionCreate extends Command {
         if (!confirmed) {
             return;
         }
+        const pluginListResponse = await executeRawApiRequest({
+            envName: flags.env,
+            baseUrl: flags['api-base-url'],
+            role: flags.role,
+            token: flags.token,
+            method: 'GET',
+            path: '/pm:list',
+            query: {
+                mode: 'summary',
+            },
+        });
+        if (!pluginListResponse.ok) {
+            this.error(`Failed to check plugin status with status ${pluginListResponse.status}\n${JSON.stringify(pluginListResponse.data, null, 2)}`);
+        }
+        const versionControlPlugin = extractPluginList(pluginListResponse.data).find((plugin) => plugin.packageName === VERSION_CONTROL_PLUGIN_PACKAGE);
+        if (!versionControlPlugin?.enabled) {
+            this.error(`The ${VERSION_CONTROL_PLUGIN_PACKAGE} plugin is not enabled. Enable it first with \`nb plugin enable ${VERSION_CONTROL_PLUGIN_PACKAGE}\`.`);
+        }
         const response = await executeRawApiRequest({
             envName: flags.env,
             baseUrl: flags['api-base-url'],
@@ -84,6 +113,6 @@ export default class RevisionCreate extends Command {
             this.log(JSON.stringify(response.data, null, 2));
             return;
         }
-        this.log(`HTTP ${response.status}`);
+        this.log('Revision created successfully');
     }
 }

package/dist/lib/auth-store.js

@@ -132,11 +132,19 @@ function normalizeAuthConfig(config) {
                 }
                 : {}),
             ...(settings.proxy?.nbCliRoot ||
+                settings.proxy?.caddyDriver ||
+                settings.proxy?.nginxDriver ||
                 settings.proxy?.upstreamHost ||
                 settings.proxy?.host
                 ? {
                     proxy: {
                         ...(settings.proxy?.nbCliRoot ? { nbCliRoot: normalizeOptionalString(settings.proxy.nbCliRoot) } : {}),
+                        ...(settings.proxy?.caddyDriver
+                            ? { caddyDriver: normalizeOptionalString(settings.proxy.caddyDriver) }
+                            : {}),
+                        ...(settings.proxy?.nginxDriver
+                            ? { nginxDriver: normalizeOptionalString(settings.proxy.nginxDriver) }
+                            : {}),
                         ...(settings.proxy?.upstreamHost || settings.proxy?.host
                             ? {
                                 upstreamHost: normalizeOptionalString(settings.proxy?.upstreamHost ?? settings.proxy.host),

package/dist/lib/cli-config.js

@@ -18,6 +18,10 @@ export const DEFAULT_GIT_BIN = 'git';
 export const DEFAULT_NGINX_BIN = 'nginx';
 export const PROXY_PROVIDER_OPTIONS = ['nginx', 'caddy'];
 export const DEFAULT_PROXY_PROVIDER = 'nginx';
+export const NGINX_PROXY_DRIVER_OPTIONS = ['local', 'docker'];
+export const DEFAULT_NGINX_PROXY_DRIVER = 'local';
+export const CADDY_PROXY_DRIVER_OPTIONS = ['local', 'docker'];
+export const DEFAULT_CADDY_PROXY_DRIVER = 'local';
 export const DEFAULT_PROXY_HOST = '127.0.0.1';
 export const DEFAULT_YARN_BIN = 'yarn';
 export const DEFAULT_LOG_RETENTION_DAYS = 14;
@@ -37,6 +41,8 @@ export const SUPPORTED_CLI_CONFIG_KEYS = [
     'bin.git',
     'bin.nginx',
     'proxy.nb-cli-root',
+    'proxy.caddy-driver',
+    'proxy.nginx-driver',
     'proxy.upstream-host',
     'bin.yarn',
     'log.enabled',
@@ -74,6 +80,24 @@ export function normalizeProxyProvider(value) {
     }
     return PROXY_PROVIDER_OPTIONS.includes(normalized) ? normalized : undefined;
 }
+export function normalizeNginxProxyDriver(value) {
+    const normalized = trimValue(value);
+    if (!normalized) {
+        return undefined;
+    }
+    return NGINX_PROXY_DRIVER_OPTIONS.includes(normalized)
+        ? normalized
+        : undefined;
+}
+export function normalizeCaddyProxyDriver(value) {
+    const normalized = trimValue(value);
+    if (!normalized) {
+        return undefined;
+    }
+    return CADDY_PROXY_DRIVER_OPTIONS.includes(normalized)
+        ? normalized
+        : undefined;
+}
 function cloneSettings(config) {
     return {
         ...(config.settings?.locale ? { locale: trimValue(config.settings.locale) } : {}),
@@ -116,7 +140,11 @@ function pruneSettings(config) {
         delete config.settings?.bin;
     }
     const proxy = config.settings?.proxy;
-    if (proxy && !trimValue(proxy.nbCliRoot) && !trimValue(proxy.upstreamHost)) {
+    if (proxy &&
+        !trimValue(proxy.nbCliRoot) &&
+        !trimValue(proxy.caddyDriver) &&
+        !trimValue(proxy.nginxDriver) &&
+        !trimValue(proxy.upstreamHost)) {
         delete config.settings?.proxy;
     }
     const log = config.settings?.log;
@@ -161,6 +189,10 @@ export function getExplicitCliConfigValue(config, key) {
             return trimValue(config.settings?.bin?.nginx);
         case 'proxy.nb-cli-root':
             return trimValue(config.settings?.proxy?.nbCliRoot);
+        case 'proxy.caddy-driver':
+            return normalizeCaddyProxyDriver(config.settings?.proxy?.caddyDriver);
+        case 'proxy.nginx-driver':
+            return normalizeNginxProxyDriver(config.settings?.proxy?.nginxDriver);
         case 'proxy.upstream-host':
             return trimValue(config.settings?.proxy?.upstreamHost);
         case 'bin.yarn':
@@ -203,6 +235,10 @@ export function getEffectiveCliConfigValue(config, key) {
             return DEFAULT_NGINX_BIN;
         case 'proxy.nb-cli-root':
             return explicit ?? resolveCliHomeRoot();
+        case 'proxy.caddy-driver':
+            return explicit ?? DEFAULT_CADDY_PROXY_DRIVER;
+        case 'proxy.nginx-driver':
+            return explicit ?? DEFAULT_NGINX_PROXY_DRIVER;
         case 'proxy.upstream-host':
             return explicit ?? DEFAULT_PROXY_HOST;
         case 'bin.yarn':
@@ -248,6 +284,20 @@ export function normalizeCliConfigValue(key, value) {
         }
         return normalized;
     }
+    if (key === 'proxy.nginx-driver') {
+        const driver = normalizeNginxProxyDriver(normalized);
+        if (!driver) {
+            throw new Error(`Config key "${key}" must be one of: ${NGINX_PROXY_DRIVER_OPTIONS.join(', ')}`);
+        }
+        return driver;
+    }
+    if (key === 'proxy.caddy-driver') {
+        const driver = normalizeCaddyProxyDriver(normalized);
+        if (!driver) {
+            throw new Error(`Config key "${key}" must be one of: ${CADDY_PROXY_DRIVER_OPTIONS.join(', ')}`);
+        }
+        return driver;
+    }
     return normalized;
 }
 export async function loadCliConfig(options = {}) {
@@ -343,6 +393,18 @@ export async function setCliConfigValue(key, value, options = {}) {
                 nbCliRoot: normalized,
             };
             break;
+        case 'proxy.caddy-driver':
+            config.settings.proxy = {
+                ...(config.settings.proxy ?? {}),
+                caddyDriver: normalized,
+            };
+            break;
+        case 'proxy.nginx-driver':
+            config.settings.proxy = {
+                ...(config.settings.proxy ?? {}),
+                nginxDriver: normalized,
+            };
+            break;
         case 'proxy.upstream-host':
             config.settings.proxy = {
                 ...(config.settings.proxy ?? {}),
@@ -439,6 +501,16 @@ export async function deleteCliConfigValue(key, options = {}) {
                 delete config.settings.proxy.nbCliRoot;
             }
             break;
+        case 'proxy.caddy-driver':
+            if (config.settings.proxy) {
+                delete config.settings.proxy.caddyDriver;
+            }
+            break;
+        case 'proxy.nginx-driver':
+            if (config.settings.proxy) {
+                delete config.settings.proxy.nginxDriver;
+            }
+            break;
         case 'proxy.upstream-host':
             if (config.settings.proxy) {
                 delete config.settings.proxy.upstreamHost;

package/dist/lib/env-proxy.js

@@ -109,8 +109,8 @@ export function buildManagedAppEntryGeneratedConfigBlock(provider, generatedConf
     return [
         `    ${MANAGED_APP_ENTRY_BLOCK_BEGIN}`,
         provider === 'caddy'
-            ? '    # Keep this import so `nb env proxy` can refresh managed routes.'
-            : '    # Keep this include so `nb env proxy` can refresh managed routes.',
+            ? '    # Keep this import so the CLI can refresh managed routes.'
+            : '    # Keep this include so the CLI can refresh managed routes.',
         `    ${referenceLine}`,
         `    ${MANAGED_APP_ENTRY_BLOCK_END}`,
     ].join('\n');
@@ -244,10 +244,11 @@ function applyCaddyAppEntryOptions(content, options) {
     }
     const currentAddress = parseCaddySiteAddress(content);
     const nextAddress = buildCaddySiteAddress(options, currentAddress);
+    let nextContent = content;
     if (currentAddress) {
-        return content.replace(currentAddress, nextAddress);
+        nextContent = nextContent.replace(/^([^\s#][^\n{]*)\s*\{/m, `${nextAddress} {`);
     }
-    return content;
+    return nextContent.replace(/^# host=.*$/m, `# host=${nextAddress}`);
 }
 export function applyEnvProxyAppEntryOptions(content, provider, options) {
     if (!trimValue(options?.host) && !trimValue(options?.port)) {
@@ -320,9 +321,15 @@ export async function resolveManagedProxyAppVersion(runtime) {
     return trimValue(runtime.env.config.downloadVersion);
 }
 export async function resolveProxyNbCliRoot(options) {
+    if (trimValue(options?.runtimeCliRoot)) {
+        return trimValue(options?.runtimeCliRoot);
+    }
     return await getCliConfigValue('proxy.nb-cli-root', { scope: options?.scope });
 }
 export async function resolveProxyUpstreamHost(options) {
+    if (trimValue(options?.upstreamHost)) {
+        return trimValue(options?.upstreamHost);
+    }
     return await getCliConfigValue('proxy.upstream-host', { scope: options?.scope });
 }
 function isPathInsideRoot(targetPath, rootPath) {
@@ -376,6 +383,19 @@ function ensureTrailingSlash(value) {
 function trimTrailingSlash(value) {
     return value.endsWith('/') ? value.slice(0, -1) : value;
 }
+function dedupeAssetPrefix(value, prefix) {
+    const normalizedPrefix = ensureTrailingSlash(prefix);
+    const nestedPrefix = normalizedPrefix.replace(/^\/+/, '');
+    if (!nestedPrefix) {
+        return value;
+    }
+    let result = value;
+    const duplicatePrefix = `${normalizedPrefix}${nestedPrefix}`;
+    while (result.startsWith(duplicatePrefix)) {
+        result = `${normalizedPrefix}${result.slice(duplicatePrefix.length)}`;
+    }
+    return result;
+}
 function renderTemplateString(template, values) {
     return template.replace(/{{\s*([\w.]+)\s*}}/g, (_match, key) => values[key] ?? '');
 }
@@ -413,6 +433,7 @@ function rewriteHtmlAssetPublicPath(html, currentPublicPath, nextPublicPath) {
     let rewritten = html.replace(new RegExp(`((?:src|href)=["'])${escapedCurrentPrefix}`, 'g'), `$1${nextPrefix}`);
     rewritten = rewritten.replace(/((?:src|href)=["'])(?:\.\/)?assets\//g, `$1${nextPrefix}assets/`);
     rewritten = rewritten.replace(/((?:src|href)=["'])\/assets\//g, `$1${nextPrefix}assets/`);
+    rewritten = rewritten.replace(/((?:src|href)=["'])([^"']+)/g, (_match, attributePrefix, assetPath) => `${attributePrefix}${dedupeAssetPrefix(assetPath, nextPrefix)}`);
     return rewritten.replace(new RegExp(`((?:src|href)=["'])${escapeRegExp(trimTrailingSlash(nextPrefix))}//+`, 'g'), '$1');
 }
 function buildNginxManagedConfigBlock(context) {
@@ -686,19 +707,11 @@ export async function buildEnvProxyCaddyBundle(runtime, options) {
     const sourceV2PublicPath = extractRuntimePublicPath(sourceIndexV2Content);
     const indexV1AssetPublicPath = context.cdnBaseUrl;
     const indexV2AssetPublicPath = `${trimTrailingSlash(context.cdnBaseUrl)}/${DEFAULT_MODERN_CLIENT_PREFIX}/`;
-    const generatedConfigPath = resolveEnvProxyOutputPath(runtime.envName, {
-        provider: 'caddy',
-        scope: options?.scope,
-    });
-    const renderedGeneratedConfigPath = await mapProxyPathFromCliRoot(generatedConfigPath, {
-        ...options,
-        provider: 'caddy',
-    });
     const appConfigPath = resolveEnvProxyAppOutputPath(runtime.envName, { scope: options?.scope, provider: 'caddy' });
     const entryDir = resolveEnvProxyEntryDir(runtime.envName, { scope: options?.scope, provider: 'caddy' });
     const publicDir = resolveEnvProxyCaddyPublicOutputDir(runtime.envName, { scope: options?.scope });
     const renderedPublicDir = await mapProxyPathFromCliRoot(publicDir, { ...options, provider: 'caddy' });
-    const generatedConfigContent = renderCaddyGeneratedTemplate({
+    const appConfigContent = renderCaddyAppTemplate(buildCaddySiteAddress(), {
         appPublicPath: context.appPublicPath,
         apiBasePath: context.apiBasePath,
         apiPort: context.apiPort,
@@ -717,7 +730,6 @@ export async function buildEnvProxyCaddyBundle(runtime, options) {
         entryDir,
         publicDir,
         appConfigPath,
-        generatedConfigPath,
         indexV1Path: resolveEnvProxyCaddyIndexOutputPath(runtime.envName, 'v1', { scope: options?.scope }),
         indexV2Path: resolveEnvProxyCaddyIndexOutputPath(runtime.envName, 'v2', { scope: options?.scope }),
         mainConfigPath: resolveEnvProxyMainOutputPath({ scope: options?.scope, provider: 'caddy' }),
@@ -729,8 +741,7 @@ export async function buildEnvProxyCaddyBundle(runtime, options) {
         activeVersion: context.activeVersion,
         cdnBaseUrl: context.cdnBaseUrl,
         backendUrl: context.backendUrl,
-        appConfigContent: buildEnvProxyAppConfig('caddy', renderedGeneratedConfigPath),
-        generatedConfigContent,
+        appConfigContent,
         mainConfigContent: await buildEnvProxyMainConfig({ provider: 'caddy', scope: options?.scope }),
         indexV1Content: injectRuntimeScriptIntoHtml(rewriteHtmlAssetPublicPath(sourceIndexV1Content, sourceV1PublicPath, indexV1AssetPublicPath), v1RuntimeScript),
         indexV2Content: injectRuntimeScriptIntoHtml(rewriteHtmlAssetPublicPath(sourceIndexV2Content, sourceV2PublicPath, indexV2AssetPublicPath), v2RuntimeScript),
@@ -957,11 +968,26 @@ ${renderNginxLocationTemplate(context)}}
 `;
 }
 function renderNginxGeneratedTemplate(context) {
-    return `# Managed by \`nb env proxy\`. Changes will be overwritten.
+    return `# Managed by NocoBase CLI. Changes will be overwritten.
 
 ${renderNginxLocationTemplate(context)}`;
 }
-function renderCaddyGeneratedTemplate(context, publicDir) {
+function buildCaddyContextCommentLines(siteAddress, context, publicDir) {
+    return [
+        '# Rendered by `nb proxy caddy generate`.',
+        '# Context:',
+        `# host=${siteAddress}`,
+        `# publicBasePath=${context.appPublicPath}`,
+        `# apiBasePath=${context.apiBasePath}`,
+        `# wsPath=${context.wsPath}`,
+        `# v2PublicPath=${context.v2PublicPath}`,
+        `# backendUrl=http://${context.proxyHost}:${context.apiPort}`,
+        `# uploadsDir=${context.uploadsPath}`,
+        `# distRootDir=${context.distClientRoot}`,
+        `# publicDir=${publicDir}`,
+    ];
+}
+function renderCaddyAppTemplate(siteAddress, context, publicDir) {
     const uploadsPath = `${context.appPublicPath}storage/uploads/`;
     const distPathMatcher = toCaddyPathMatcher(context.distPath);
     const uploadsPathMatcher = toCaddyPathMatcher(uploadsPath);
@@ -998,61 +1024,65 @@ function renderCaddyGeneratedTemplate(context, publicDir) {
     handle /${context.modernClientPrefix}/* {
         redir * ${appPublicPathNoTrailingSlash}{uri} 302
     }`;
-    return `# Managed by \`nb env proxy\`. Changes will be overwritten.
-
-route {
-    encode zstd gzip${rootRedirectBlock}${appPublicPathRedirectBlock}${modernClientRedirectBlock}${shorthandModernClientRedirectBlock}
-
-    handle_path ${uploadsPathMatcher} {
-        root * ${context.uploadsPath}
-        header Cache-Control public
-        header X-Content-Type-Options nosniff
-        file_server
-    }
-
-    handle_path ${distPathMatcher} {
-        root * ${context.distClientRoot}
-        header Cache-Control public
-        file_server
-    }
-
-    @oauth path_regexp oauth ^/\\.well-known/oauth-authorization-server/(.+)$
-    handle @oauth {
-        rewrite * /{re.oauth.1}/.well-known/oauth-authorization-server
-        reverse_proxy ${context.proxyHost}:${context.apiPort}
-    }
-
-    @openid path_regexp openid ^/\\.well-known/openid-configuration/(.+)$
-    handle @openid {
-        rewrite * /{re.openid.1}/.well-known/openid-configuration
-        reverse_proxy ${context.proxyHost}:${context.apiPort}
-    }
-
-    handle ${apiPathMatcher} {
-        reverse_proxy ${context.proxyHost}:${context.apiPort}
-    }
-
-    handle ${context.wsPath} {
-        reverse_proxy ${context.proxyHost}:${context.apiPort}
-    }
-
-    handle_path ${toCaddyPathMatcher(context.v2PublicPath)} {
-        root * ${publicDir}
-        header Cache-Control "no-store, no-cache, must-revalidate"
-        header X-Robots-Tag "noindex, nofollow"
-        try_files {path} /index-v2.html
-        file_server
-    }
-
-    handle_path ${toCaddyPathMatcher(context.appPublicPath)} {
-        root * ${publicDir}
-        header Cache-Control "no-store, no-cache, must-revalidate"
-        header X-Robots-Tag "noindex, nofollow"
-        try_files {path} /index-v1.html
-        file_server
-    }
-}
-`;
+    return [
+        ...buildCaddyContextCommentLines(siteAddress, context, publicDir),
+        '',
+        `${siteAddress} {`,
+        `    encode zstd gzip${rootRedirectBlock}${appPublicPathRedirectBlock}${modernClientRedirectBlock}${shorthandModernClientRedirectBlock}`,
+        '',
+        `    handle_path ${uploadsPathMatcher} {`,
+        `        root * ${context.uploadsPath}`,
+        '        header Cache-Control public',
+        '        header X-Content-Type-Options nosniff',
+        '        file_server',
+        '    }',
+        '',
+        `    handle_path ${distPathMatcher} {`,
+        `        root * ${context.distClientRoot}`,
+        '        header Cache-Control public',
+        '        file_server',
+        '    }',
+        '',
+        '    @oauth path_regexp oauth ^/\\.well-known/oauth-authorization-server/(.+)$',
+        '    handle @oauth {',
+        '        rewrite * /{re.oauth.1}/.well-known/oauth-authorization-server',
+        `        reverse_proxy ${context.proxyHost}:${context.apiPort}`,
+        '    }',
+        '',
+        '    @openid path_regexp openid ^/\\.well-known/openid-configuration/(.+)$',
+        '    handle @openid {',
+        '        rewrite * /{re.openid.1}/.well-known/openid-configuration',
+        `        reverse_proxy ${context.proxyHost}:${context.apiPort}`,
+        '    }',
+        '',
+        '    # Keep API and WS routes above the SPA fallbacks.',
+        `    handle ${apiPathMatcher} {`,
+        `        reverse_proxy ${context.proxyHost}:${context.apiPort}`,
+        '    }',
+        '',
+        `    handle ${context.wsPath} {`,
+        `        reverse_proxy ${context.proxyHost}:${context.apiPort}`,
+        '    }',
+        '',
+        '    # Keep the v2 SPA route above the fallback SPA route.',
+        `    handle_path ${toCaddyPathMatcher(context.v2PublicPath)} {`,
+        `        root * ${publicDir}`,
+        '        header Cache-Control "no-store, no-cache, must-revalidate"',
+        '        header X-Robots-Tag "noindex, nofollow"',
+        '        try_files {path} /index-v2.html',
+        '        file_server',
+        '    }',
+        '',
+        `    handle_path ${toCaddyPathMatcher(context.appPublicPath)} {`,
+        `        root * ${publicDir}`,
+        '        header Cache-Control "no-store, no-cache, must-revalidate"',
+        '        header X-Robots-Tag "noindex, nofollow"',
+        '        try_files {path} /index-v1.html',
+        '        file_server',
+        '    }',
+        '}',
+        '',
+    ].join('\n');
 }
 export function buildEnvProxyAppConfig(provider, generatedConfigPath, options) {
     if (provider === 'caddy') {
@@ -1082,7 +1112,7 @@ export function appConfigIncludesGeneratedConfig(content, generatedConfigPath, p
     return new RegExp(`\\binclude\\s+${escapedReference}\\s*;`).test(content);
 }
 function renderCaddyMainTemplate(appConfigImportPath) {
-    return `# Managed by \`nb env proxy\`. Changes will be overwritten.
+    return `# Managed by NocoBase CLI. Changes will be overwritten.
 
 import ${appConfigImportPath}
 `;
@@ -1146,7 +1176,7 @@ export async function buildEnvProxyConfig(runtime, options) {
     return {
         ...base,
         content: provider === 'caddy'
-            ? renderCaddyGeneratedTemplate(templateContext, publicDir ?? '')
+            ? renderCaddyAppTemplate(buildCaddySiteAddress(), templateContext, publicDir ?? '')
             : renderNginxGeneratedTemplate(templateContext),
     };
 }