@omnitron-dev/omnitron 0.1.3 → 0.3.0

package/dist/infrastructure/phantom-endpoint-janitor.d.ts

@@ -0,0 +1,92 @@
+/**
+ * Phantom-endpoint janitor (T#75).
+ *
+ * Docker networks accumulate "phantom endpoint" records when a
+ * container is removed while the dockerd daemon is restarting,
+ * during host suspend/resume cycles, or when a `docker rm -f`
+ * arrives mid-network-disconnect. The network's internal endpoint
+ * table keeps a stale row pointing at a container that no longer
+ * exists. The visible symptom is a recreation failure with:
+ *
+ *     Error response from daemon: endpoint with name X
+ *     already exists in network managed-net
+ *
+ * The existing T#58 work avoids the bridge default to sidestep the
+ * worst class of this. The managed network is still susceptible
+ * after dockerd / host restarts, just less frequently. T#75 is the
+ * active cleanup: every interval, list the endpoints in each
+ * managed network, look each one up as a container, and force-
+ * disconnect every endpoint whose container has vanished.
+ *
+ * Implementation notes:
+ *   - We shell out to `docker network inspect` / `docker network
+ *     disconnect` rather than the engine adapter — the adapter
+ *     doesn't expose network APIs and this code path is rare
+ *     (one sweep per `intervalMs`).
+ *   - The whole loop is wrapped in a single in-flight guard so
+ *     two overlapping sweeps can't both try to disconnect the
+ *     same endpoint and produce noisy errors.
+ *   - All errors are caught and logged — a docker-daemon hiccup
+ *     during one sweep must NOT prevent the next one from running.
+ */
+import type { ILogger } from '@omnitron-dev/titan/module/logger';
+export interface PhantomEndpointJanitorOptions {
+    /** Network name(s) the daemon manages and should sweep. */
+    networks: string[];
+    /** Sweep interval in ms. Default: 60_000 (every minute). */
+    intervalMs?: number;
+    /** Logger for cleanup events. */
+    logger: ILogger;
+    /**
+     * Optional sink for "phantoms found" / "phantoms cleaned" so an
+     * observability bridge can wire it to a counter. Called with the
+     * number of phantoms acted on in the just-completed sweep.
+     */
+    onCleanup?: (network: string, cleaned: number) => void;
+}
+export declare class PhantomEndpointJanitor {
+    private readonly opts;
+    private timer;
+    private sweeping;
+    constructor(opts: PhantomEndpointJanitorOptions);
+    start(): void;
+    stop(): void;
+    /** Run a single sweep across every managed network. Public for tests + ops triggers. */
+    sweepAll(): Promise<number>;
+    private sweepNetwork;
+    /**
+     * Decide whether a container exists, is definitively gone, or cannot be
+     * determined right now.
+     *
+     * This distinction is the whole point of the module's safety. The
+     * original code asked `docker inspect` and treated ANY non-zero exit as
+     * "gone" — so a 10s timeout (trivially reachable when the host disk is
+     * full and dockerd crawls), a spawn failure, or an unreachable daemon
+     * all read as "phantom". On 2026-09-04 that fired nine times in six
+     * minutes against RUNNING containers: the janitor force-disconnected
+     * acme-dev-pg, -redis, -postgres, -minio, -tor, -tiles, -nominatim and
+     * both monero containers from the managed network, which drops their
+     * host port publication until the container is recreated. The container
+     * IDs in those log lines matched the live containers exactly — they were
+     * never phantoms.
+     *
+     * `disconnect --force` is destructive and unrecoverable without a
+     * recreate, so 'unknown' must never be treated as 'absent'.
+     */
+    private containerVerdict;
+    /**
+     * Run `docker <args>` and return stdout/stderr/exit-code. Never throws —
+     * a missing docker binary or a hung daemon shouldn't crash the daemon.
+     *
+     * Visible for testing via subclassing — overrides go through this
+     * single seam so tests can drive deterministic responses without
+     * needing a real Docker daemon. Production callers should not
+     * subclass.
+     */
+    protected runDocker(args: string[]): Promise<{
+        ok: boolean;
+        stdout: string;
+        stderr: string;
+    }>;
+}
+//# sourceMappingURL=phantom-endpoint-janitor.d.ts.map

package/dist/infrastructure/phantom-endpoint-janitor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"phantom-endpoint-janitor.d.ts","sourceRoot":"","sources":["../../src/infrastructure/phantom-endpoint-janitor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAGH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mCAAmC,CAAC;AAEjE,MAAM,WAAW,6BAA6B;IAC5C,2DAA2D;IAC3D,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,4DAA4D;IAC5D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iCAAiC;IACjC,MAAM,EAAE,OAAO,CAAC;IAChB;;;;OAIG;IACH,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACxD;AAED,qBAAa,sBAAsB;IAIrB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAHjC,OAAO,CAAC,KAAK,CAA+B;IAC5C,OAAO,CAAC,QAAQ,CAAS;IAEzB,YAA6B,IAAI,EAAE,6BAA6B,EAAI;IAEpE,KAAK,IAAI,IAAI,CAaZ;IAED,IAAI,IAAI,IAAI,CAIX;IAED,wFAAwF;IAClF,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,CAqBhC;YAEa,YAAY;IAsE1B;;;;;;;;;;;;;;;;;;OAkBG;YACW,gBAAgB;IAS9B;;;;;;;;OAQG;IACH,SAAS,CAAC,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAoB5F;CACF"}

package/dist/infrastructure/phantom-endpoint-janitor.js

@@ -0,0 +1,199 @@
+/**
+ * Phantom-endpoint janitor (T#75).
+ *
+ * Docker networks accumulate "phantom endpoint" records when a
+ * container is removed while the dockerd daemon is restarting,
+ * during host suspend/resume cycles, or when a `docker rm -f`
+ * arrives mid-network-disconnect. The network's internal endpoint
+ * table keeps a stale row pointing at a container that no longer
+ * exists. The visible symptom is a recreation failure with:
+ *
+ *     Error response from daemon: endpoint with name X
+ *     already exists in network managed-net
+ *
+ * The existing T#58 work avoids the bridge default to sidestep the
+ * worst class of this. The managed network is still susceptible
+ * after dockerd / host restarts, just less frequently. T#75 is the
+ * active cleanup: every interval, list the endpoints in each
+ * managed network, look each one up as a container, and force-
+ * disconnect every endpoint whose container has vanished.
+ *
+ * Implementation notes:
+ *   - We shell out to `docker network inspect` / `docker network
+ *     disconnect` rather than the engine adapter — the adapter
+ *     doesn't expose network APIs and this code path is rare
+ *     (one sweep per `intervalMs`).
+ *   - The whole loop is wrapped in a single in-flight guard so
+ *     two overlapping sweeps can't both try to disconnect the
+ *     same endpoint and produce noisy errors.
+ *   - All errors are caught and logged — a docker-daemon hiccup
+ *     during one sweep must NOT prevent the next one from running.
+ */
+import { spawn } from 'node:child_process';
+export class PhantomEndpointJanitor {
+    opts;
+    timer = null;
+    sweeping = false;
+    constructor(opts) {
+        this.opts = opts;
+    }
+    start() {
+        if (this.timer)
+            return;
+        const intervalMs = this.opts.intervalMs ?? 60_000;
+        this.timer = setInterval(() => {
+            void this.sweepAll().catch((err) => {
+                this.opts.logger.error({ err }, 'phantom-endpoint janitor: sweep loop crashed');
+            });
+        }, intervalMs);
+        this.timer.unref();
+        this.opts.logger.info({ networks: this.opts.networks, intervalMs }, 'phantom-endpoint janitor: started (T#75)');
+    }
+    stop() {
+        if (!this.timer)
+            return;
+        clearInterval(this.timer);
+        this.timer = null;
+    }
+    /** Run a single sweep across every managed network. Public for tests + ops triggers. */
+    async sweepAll() {
+        if (this.sweeping)
+            return 0;
+        this.sweeping = true;
+        let totalCleaned = 0;
+        try {
+            for (const net of this.opts.networks) {
+                try {
+                    const cleaned = await this.sweepNetwork(net);
+                    totalCleaned += cleaned;
+                    this.opts.onCleanup?.(net, cleaned);
+                }
+                catch (err) {
+                    this.opts.logger.warn({ err, network: net }, 'phantom-endpoint janitor: per-network sweep failed (continuing)');
+                }
+            }
+        }
+        finally {
+            this.sweeping = false;
+        }
+        return totalCleaned;
+    }
+    async sweepNetwork(network) {
+        const inspect = await this.runDocker(['network', 'inspect', network]);
+        if (!inspect.ok) {
+            // Network doesn't exist or docker daemon unreachable. Either
+            // way, nothing to clean.
+            return 0;
+        }
+        let networks = [];
+        try {
+            networks = JSON.parse(inspect.stdout);
+        }
+        catch {
+            return 0;
+        }
+        const endpoints = Object.entries(networks[0]?.Containers ?? {});
+        if (endpoints.length === 0)
+            return 0;
+        // One authoritative listing instead of an inspect per endpoint: it is
+        // a single docker round-trip (this loop used to make N), and it gives
+        // the sweep a positive fact — "these containers exist" — to reason
+        // from. If the listing itself fails we know nothing about anything, so
+        // the only safe move is to skip the sweep entirely and retry next tick.
+        const listing = await this.runDocker(['ps', '-aq', '--no-trunc']);
+        if (!listing.ok) {
+            this.opts.logger.warn({ network, stderr: listing.stderr }, 'phantom-endpoint janitor: could not list containers — skipping sweep (nothing disconnected)');
+            return 0;
+        }
+        const liveContainerIds = new Set(listing.stdout
+            .split('\n')
+            .map((line) => line.trim())
+            .filter(Boolean));
+        let cleaned = 0;
+        for (const [containerId, info] of endpoints) {
+            if (liveContainerIds.has(containerId))
+                continue;
+            // Absent from the listing is not yet proof: the container may have
+            // been created between the listing and now. Confirm per-endpoint,
+            // and require docker to SAY the object is gone.
+            const verdict = await this.containerVerdict(containerId);
+            if (verdict !== 'absent') {
+                this.opts.logger.warn({ network, containerId, name: info?.Name, verdict }, 'phantom-endpoint janitor: could not confirm container is gone — leaving endpoint alone');
+                continue;
+            }
+            // Phantom — force-disconnect.
+            const disconnect = await this.runDocker(['network', 'disconnect', network, containerId, '--force']);
+            if (disconnect.ok) {
+                cleaned++;
+                this.opts.logger.info({ network, containerId, name: info?.Name }, 'phantom-endpoint janitor: disconnected phantom endpoint (T#75)');
+            }
+            else {
+                this.opts.logger.warn({ network, containerId, stderr: disconnect.stderr }, 'phantom-endpoint janitor: failed to disconnect phantom — will retry next sweep');
+            }
+        }
+        return cleaned;
+    }
+    /**
+     * Decide whether a container exists, is definitively gone, or cannot be
+     * determined right now.
+     *
+     * This distinction is the whole point of the module's safety. The
+     * original code asked `docker inspect` and treated ANY non-zero exit as
+     * "gone" — so a 10s timeout (trivially reachable when the host disk is
+     * full and dockerd crawls), a spawn failure, or an unreachable daemon
+     * all read as "phantom". On 2026-09-04 that fired nine times in six
+     * minutes against RUNNING containers: the janitor force-disconnected
+     * acme-dev-pg, -redis, -postgres, -minio, -tor, -tiles, -nominatim and
+     * both monero containers from the managed network, which drops their
+     * host port publication until the container is recreated. The container
+     * IDs in those log lines matched the live containers exactly — they were
+     * never phantoms.
+     *
+     * `disconnect --force` is destructive and unrecoverable without a
+     * recreate, so 'unknown' must never be treated as 'absent'.
+     */
+    async containerVerdict(containerId) {
+        const result = await this.runDocker(['inspect', '--type=container', '--format', '{{.Id}}', containerId]);
+        if (result.ok)
+            return 'exists';
+        // Docker answered, and its answer was "there is no such object".
+        if (/no such (object|container)/i.test(result.stderr))
+            return 'absent';
+        // Timeout, spawn error, daemon unreachable, permission problem, …
+        return 'unknown';
+    }
+    /**
+     * Run `docker <args>` and return stdout/stderr/exit-code. Never throws —
+     * a missing docker binary or a hung daemon shouldn't crash the daemon.
+     *
+     * Visible for testing via subclassing — overrides go through this
+     * single seam so tests can drive deterministic responses without
+     * needing a real Docker daemon. Production callers should not
+     * subclass.
+     */
+    runDocker(args) {
+        return new Promise((resolve) => {
+            const child = spawn('docker', args, { stdio: ['ignore', 'pipe', 'pipe'] });
+            let stdout = '';
+            let stderr = '';
+            const timeout = setTimeout(() => {
+                try {
+                    child.kill('SIGKILL');
+                }
+                catch { /* */ }
+                resolve({ ok: false, stdout, stderr: stderr + '\n[janitor: timeout]' });
+            }, 10_000);
+            child.stdout?.on('data', (c) => { stdout += c.toString(); });
+            child.stderr?.on('data', (c) => { stderr += c.toString(); });
+            child.on('error', () => {
+                clearTimeout(timeout);
+                resolve({ ok: false, stdout, stderr: stderr + '\n[janitor: spawn error]' });
+            });
+            child.on('close', (code) => {
+                clearTimeout(timeout);
+                resolve({ ok: code === 0, stdout, stderr });
+            });
+        });
+    }
+}
+//# sourceMappingURL=phantom-endpoint-janitor.js.map

package/dist/infrastructure/phantom-endpoint-janitor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"phantom-endpoint-janitor.js","sourceRoot":"","sources":["../../src/infrastructure/phantom-endpoint-janitor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAkB3C,MAAM,OAAO,sBAAsB;IAIJ,IAAI;IAHzB,KAAK,GAA0B,IAAI,CAAC;IACpC,QAAQ,GAAG,KAAK,CAAC;IAEzB,YAA6B,IAAmC;oBAAnC,IAAI;IAAkC,CAAC;IAEpE,KAAK;QACH,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO;QACvB,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC;QAClD,IAAI,CAAC,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;YAC5B,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBACjC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,8CAA8C,CAAC,CAAC;YAClF,CAAC,CAAC,CAAC;QACL,CAAC,EAAE,UAAU,CAAC,CAAC;QACf,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACnB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CACnB,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,EAC5C,0CAA0C,CAC3C,CAAC;IACJ,CAAC;IAED,IAAI;QACF,IAAI,CAAC,IAAI,CAAC,KAAK;YAAE,OAAO;QACxB,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;IACpB,CAAC;IAED,wFAAwF;IACxF,KAAK,CAAC,QAAQ;QACZ,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,CAAC,CAAC;QAC5B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,IAAI,CAAC;YACH,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACrC,IAAI,CAAC;oBACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;oBAC7C,YAAY,IAAI,OAAO,CAAC;oBACxB,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;gBACtC,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CACnB,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,EACrB,iEAAiE,CAClE,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC;QACxB,CAAC;QACD,OAAO,YAAY,CAAC;IACtB,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,OAAe;QACxC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;QACtE,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,6DAA6D;YAC7D,yBAAyB;YACzB,OAAO,CAAC,CAAC;QACX,CAAC;QACD,IAAI,QAAQ,GAA8D,EAAE,CAAC;QAC7E,IAAI,CAAC;YACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAoB,CAAC;QAC3D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC;QACX,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,UAAU,IAAI,EAAE,CAAC,CAAC;QAChE,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,CAAC,CAAC;QAErC,sEAAsE;QACtE,sEAAsE;QACtE,mEAAmE;QACnE,uEAAuE;QACvE,wEAAwE;QACxE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC;QAClE,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CACnB,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,EACnC,6FAA6F,CAC9F,CAAC;YACF,OAAO,CAAC,CAAC;QACX,CAAC;QACD,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAC9B,OAAO,CAAC,MAAM;aACX,KAAK,CAAC,IAAI,CAAC;aACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;aAC1B,MAAM,CAAC,OAAO,CAAC,CACnB,CAAC;QAEF,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,KAAK,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,SAAS,EAAE,CAAC;YAC5C,IAAI,gBAAgB,CAAC,GAAG,CAAC,WAAW,CAAC;gBAAE,SAAS;YAEhD,mEAAmE;YACnE,kEAAkE;YAClE,gDAAgD;YAChD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;YACzD,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;gBACzB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CACnB,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,EACnD,wFAAwF,CACzF,CAAC;gBACF,SAAS;YACX,CAAC;YAED,8BAA8B;YAC9B,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC,SAAS,EAAE,YAAY,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC;YACpG,IAAI,UAAU,CAAC,EAAE,EAAE,CAAC;gBAClB,OAAO,EAAE,CAAC;gBACV,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CACnB,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EAC1C,gEAAgE,CACjE,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CACnB,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,EACnD,gFAAgF,CACjF,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACK,KAAK,CAAC,gBAAgB,CAAC,WAAmB;QAChD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC,SAAS,EAAE,kBAAkB,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;QACzG,IAAI,MAAM,CAAC,EAAE;YAAE,OAAO,QAAQ,CAAC;QAC/B,iEAAiE;QACjE,IAAI,6BAA6B,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;YAAE,OAAO,QAAQ,CAAC;QACvE,kEAAkE;QAClE,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;;;;OAQG;IACO,SAAS,CAAC,IAAc;QAChC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;YAC3E,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC9B,IAAI,CAAC;oBAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC;gBAC9C,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,sBAAsB,EAAE,CAAC,CAAC;YAC1E,CAAC,EAAE,MAAM,CAAC,CAAC;YACX,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,MAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7D,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,MAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7D,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;gBACrB,YAAY,CAAC,OAAO,CAAC,CAAC;gBACtB,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,0BAA0B,EAAE,CAAC,CAAC;YAC9E,CAAC,CAAC,CAAC;YACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;gBACzB,YAAY,CAAC,OAAO,CAAC,CAAC;gBACtB,OAAO,CAAC,EAAE,EAAE,EAAE,IAAI,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;YAC9C,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/infrastructure/presets/gateway-openresty.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gateway-openresty.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/presets/gateway-openresty.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,eAAO,MAAM,sBAAsB,EAAE,cAwBpC,CAAC"}
+{"version":3,"file":"gateway-openresty.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/presets/gateway-openresty.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,eAAO,MAAM,sBAAsB,EAAE,cAkDpC,CAAC"}

package/dist/infrastructure/presets/gateway-openresty.js

@@ -9,11 +9,37 @@ export const gatewayOpenrestyPreset = {
     name: 'openresty',
     type: 'gateway',
     defaultImage: 'openresty/openresty:alpine',
-    defaultPorts: { http: 8080 },
+    // 80 — the port nginx listens on inside this image. It is a fact about
+    // the image, not something a stack config can change; a config naming
+    // `http` is saying where to PUBLISH it. Declared as 8080 here, the
+    // container published 8080→8080 while the server was on 80, and every
+    // connection was refused.
+    defaultPorts: { http: 80 },
     defaultSecrets: {},
+    /**
+     * Accepting connections, not serving a particular path.
+     *
+     * This asked for `/nginx-health`, an endpoint a reverse proxy's config may
+     * or may not define — and the config is the operator's, mounted from their
+     * repository. The one omnitron was pointed at has no such location, so the
+     * check could never pass: measured on the test node, a gateway reporting
+     * unhealthy for hours while serving an onion address that answered HTTP
+     * 200 through the Tor network.
+     *
+     * A preset must not assert the contents of a config it does not own. What
+     * it can assert is that the server it started is up and accepting
+     * connections on the port it declares — which is the whole of what this
+     * preset is responsible for. Whether a given route answers is the
+     * operator's config, and a health check that fails on their routing is a
+     * report about the wrong thing.
+     *
+     * `resolveGateway` reached the same conclusion for the same image and
+     * checked the nginx pid file. This checks the socket, which is one step
+     * stronger: a master process can be alive with no listener.
+     */
     defaultHealthCheck: {
-        type: 'http',
-        target: '/nginx-health',
+        type: 'command',
+        target: 'nc -z 127.0.0.1 80 || exit 1',
         interval: '10s',
         timeout: '5s',
         retries: 3,

package/dist/infrastructure/presets/gateway-openresty.js.map

@@ -1 +1 @@
-{"version":3,"file":"gateway-openresty.js","sourceRoot":"","sources":["../../../src/infrastructure/presets/gateway-openresty.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,MAAM,CAAC,MAAM,sBAAsB,GAAmB;IACpD,IAAI,EAAE,WAAW;IACjB,IAAI,EAAE,SAAS;IACf,YAAY,EAAE,4BAA4B;IAC1C,YAAY,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;IAC5B,cAAc,EAAE,EAAE;IAElB,kBAAkB,EAAE;QAClB,IAAI,EAAE,MAAM;QACZ,MAAM,EAAE,eAAe;QACvB,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,CAAC;KACX;IAED,aAAa,EAAE;IACb,yEAAyE;KAC1E;IAED,oBAAoB;QAClB,OAAO;YACL,WAAW,EAAE,6BAA6B;SAC3C,CAAC;IACJ,CAAC;CACF,CAAC"}
+{"version":3,"file":"gateway-openresty.js","sourceRoot":"","sources":["../../../src/infrastructure/presets/gateway-openresty.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,MAAM,CAAC,MAAM,sBAAsB,GAAmB;IACpD,IAAI,EAAE,WAAW;IACjB,IAAI,EAAE,SAAS;IACf,YAAY,EAAE,4BAA4B;IAC1C,uEAAuE;IACvE,sEAAsE;IACtE,mEAAmE;IACnE,sEAAsE;IACtE,0BAA0B;IAC1B,YAAY,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;IAC1B,cAAc,EAAE,EAAE;IAElB;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,kBAAkB,EAAE;QAClB,IAAI,EAAE,SAAS;QACf,MAAM,EAAE,8BAA8B;QACtC,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,CAAC;KACX;IAED,aAAa,EAAE;IACb,yEAAyE;KAC1E;IAED,oBAAoB;QAClB,OAAO;YACL,WAAW,EAAE,6BAA6B;SAC3C,CAAC;IACJ,CAAC;CACF,CAAC"}

package/dist/infrastructure/presets/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/presets/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,YAAY,EAAE,cAAc,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAE9F,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAM/C;;GAEG;AACH,wBAAgB,qBAAqB,IAAI,cAAc,CAStD"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/presets/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,YAAY,EAAE,cAAc,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAE9F,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAO/C;;GAEG;AACH,wBAAgB,qBAAqB,IAAI,cAAc,CAUtD"}

package/dist/infrastructure/presets/index.js

@@ -10,6 +10,7 @@ import { postgresPreset } from './postgres.js';
 import { redisPreset } from './redis.js';
 import { minioPreset } from './minio.js';
 import { gatewayOpenrestyPreset } from './gateway-openresty.js';
+import { torPreset } from './tor.js';
 /**
  * Create a PresetRegistry populated with all built-in presets.
  */
@@ -19,6 +20,7 @@ export function createDefaultRegistry() {
     registry.register(redisPreset);
     registry.register(minioPreset);
     registry.register(gatewayOpenrestyPreset);
+    registry.register(torPreset);
     return registry;
 }
 //# sourceMappingURL=index.js.map

package/dist/infrastructure/presets/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/infrastructure/presets/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAG/C,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAEhE;;GAEG;AACH,MAAM,UAAU,qBAAqB;IACnC,MAAM,QAAQ,GAAG,IAAI,cAAc,EAAE,CAAC;IAEtC,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;IAClC,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC/B,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC/B,QAAQ,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC;IAE1C,OAAO,QAAQ,CAAC;AAClB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/infrastructure/presets/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAG/C,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAErC;;GAEG;AACH,MAAM,UAAU,qBAAqB;IACnC,MAAM,QAAQ,GAAG,IAAI,cAAc,EAAE,CAAC;IAEtC,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;IAClC,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC/B,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC/B,QAAQ,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC;IAC1C,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAE7B,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/infrastructure/presets/minio.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"minio.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/presets/minio.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyB,MAAM,YAAY,CAAC;AAExE,eAAO,MAAM,WAAW,EAAE,cAuDzB,CAAC"}
+{"version":3,"file":"minio.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/presets/minio.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyB,MAAM,YAAY,CAAC;AAExE,eAAO,MAAM,WAAW,EAAE,cA0FzB,CAAC"}

package/dist/infrastructure/presets/minio.js

@@ -8,7 +8,23 @@
 export const minioPreset = {
     name: 'minio',
     type: 'storage',
-    defaultImage: 'minio/minio',
+    /**
+     * quay.io, and pinned.
+     *
+     * `minio/minio` on Docker Hub answers `pull access denied ... repository
+     * does not exist or may require 'docker login'` — for `:latest` and for an
+     * exact RELEASE tag alike. The image is still in the local cache of every
+     * machine that pulled it before the change, which is why nothing noticed:
+     * the development host runs it happily and a NEW node cannot get it at
+     * all. Measured provisioning the test server, where MinIO was the one
+     * service of three that did not come up.
+     *
+     * Pinned rather than `:latest`, because an unpinned tag is how this
+     * arrived: a config that names no version cannot be reasoned about after
+     * the registry changes under it, and "it worked yesterday" stops being
+     * evidence of anything.
+     */
+    defaultImage: 'quay.io/minio/minio:RELEASE.2025-09-07T16-13-09Z',
     defaultPorts: { api: 9000, console: 9001 },
     defaultSecrets: { accessKey: 'minioadmin', secretKey: 'minioadmin' },
     defaultHealthCheck: {
@@ -41,11 +57,28 @@ export const minioPreset = {
                     'http://localhost:9000', accessKey, secretKey,
                 ]);
                 await ctx.execInContainer(['mc', 'mb', '--ignore-existing', `local/${bucket}`]);
-                await ctx.execInContainer(['mc', 'anonymous', 'set', 'public', `local/${bucket}`]);
-                ctx.logger.info({ bucket }, 'Created MinIO bucket');
             }
             catch (err) {
                 ctx.logger.warn({ bucket, error: err.message }, 'Failed to create bucket');
+                continue;
+            }
+            // No anonymous access — `none`, set on every provisioning, so a bucket
+            // an earlier omnitron made `public` is closed on the next one.
+            //
+            // `public` was set here on every bucket: anonymous read AND write, to
+            // anything that could reach :9000 — every container on the stack's
+            // network — past the storage service's moderation, metadata scrubbing
+            // and safe delivery. Nothing reads MinIO anonymously: the storage
+            // service signs every request with the credentials above, the gateway
+            // has no route to MinIO, and the port is published on loopback
+            // (`portArg`). Measured on daos, 2026-09-23, before ad creatives made
+            // "whose bytes are these" a question with money on it.
+            try {
+                await ctx.execInContainer(['mc', 'anonymous', 'set', 'none', `local/${bucket}`]);
+                ctx.logger.info({ bucket, anonymous: 'none' }, 'MinIO bucket ready — no anonymous access');
+            }
+            catch (err) {
+                ctx.logger.error({ bucket, error: err.message }, 'Could not close anonymous access to this MinIO bucket — it keeps whatever policy it had, which an earlier omnitron set to public');
             }
         }
     },

package/dist/infrastructure/presets/minio.js.map

@@ -1 +1 @@
-{"version":3,"file":"minio.js","sourceRoot":"","sources":["../../../src/infrastructure/presets/minio.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,MAAM,CAAC,MAAM,WAAW,GAAmB;IACzC,IAAI,EAAE,OAAO;IACb,IAAI,EAAE,SAAS;IACf,YAAY,EAAE,aAAa;IAC3B,YAAY,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE;IAC1C,cAAc,EAAE,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE;IAEpE,kBAAkB,EAAE;QAClB,IAAI,EAAE,SAAS;QACf,MAAM,EAAE,gBAAgB;QACxB,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,CAAC;KACX;IAED,aAAa,EAAE;QACb,OAAO,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,mBAAmB,EAAE,OAAO,CAAC;QAC1D,WAAW,EAAE;YACX,eAAe,EAAE,qBAAqB;YACtC,mBAAmB,EAAE,qBAAqB;SAC3C;QACD,OAAO,EAAE;YACP,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE;SACtC;KACF;IAED,KAAK,CAAC,aAAa,CAAC,GAA0B;QAC5C,MAAM,OAAO,GAAG,GAAG,CAAC,UAAU,CAAC,SAAS,CAAyB,CAAC;QAClE,IAAI,CAAC,OAAO,EAAE,MAAM;YAAE,OAAO;QAE7B,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,YAAY,CAAC;QAC3D,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,YAAY,CAAC;QAE3D,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,CAAC;gBACH,MAAM,GAAG,CAAC,eAAe,CAAC;oBACxB,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO;oBAC7B,uBAAuB,EAAE,SAAS,EAAE,SAAS;iBAC9C,CAAC,CAAC;gBACH,MAAM,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;gBAChF,MAAM,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;gBACnF,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,sBAAsB,CAAC,CAAC;YACtD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,EAAE,yBAAyB,CAAC,CAAC;YACxF,CAAC;QACH,CAAC;IACH,CAAC;IAED,oBAAoB;QAClB,OAAO;YACL,WAAW,EAAE,4BAA4B;YACzC,aAAa,EAAE,qBAAqB;YACpC,aAAa,EAAE,qBAAqB;SACrC,CAAC;IACJ,CAAC;CACF,CAAC"}
+{"version":3,"file":"minio.js","sourceRoot":"","sources":["../../../src/infrastructure/presets/minio.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,MAAM,CAAC,MAAM,WAAW,GAAmB;IACzC,IAAI,EAAE,OAAO;IACb,IAAI,EAAE,SAAS;IACf;;;;;;;;;;;;;;;OAeG;IACH,YAAY,EAAE,kDAAkD;IAChE,YAAY,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE;IAC1C,cAAc,EAAE,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE;IAEpE,kBAAkB,EAAE;QAClB,IAAI,EAAE,SAAS;QACf,MAAM,EAAE,gBAAgB;QACxB,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,CAAC;KACX;IAED,aAAa,EAAE;QACb,OAAO,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,mBAAmB,EAAE,OAAO,CAAC;QAC1D,WAAW,EAAE;YACX,eAAe,EAAE,qBAAqB;YACtC,mBAAmB,EAAE,qBAAqB;SAC3C;QACD,OAAO,EAAE;YACP,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE;SACtC;KACF;IAED,KAAK,CAAC,aAAa,CAAC,GAA0B;QAC5C,MAAM,OAAO,GAAG,GAAG,CAAC,UAAU,CAAC,SAAS,CAAyB,CAAC;QAClE,IAAI,CAAC,OAAO,EAAE,MAAM;YAAE,OAAO;QAE7B,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,YAAY,CAAC;QAC3D,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,YAAY,CAAC;QAE3D,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,CAAC;gBACH,MAAM,GAAG,CAAC,eAAe,CAAC;oBACxB,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO;oBAC7B,uBAAuB,EAAE,SAAS,EAAE,SAAS;iBAC9C,CAAC,CAAC;gBACH,MAAM,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;YAClF,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,EAAE,yBAAyB,CAAC,CAAC;gBACtF,SAAS;YACX,CAAC;YACD,uEAAuE;YACvE,+DAA+D;YAC/D,EAAE;YACF,sEAAsE;YACtE,mEAAmE;YACnE,sEAAsE;YACtE,kEAAkE;YAClE,sEAAsE;YACtE,+DAA+D;YAC/D,sEAAsE;YACtE,uDAAuD;YACvD,IAAI,CAAC;gBACH,MAAM,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;gBACjF,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,0CAA0C,CAAC,CAAC;YAC7F,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,MAAM,CAAC,KAAK,CACd,EAAE,MAAM,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,EACzC,kIAAkI,CACnI,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,oBAAoB;QAClB,OAAO;YACL,WAAW,EAAE,4BAA4B;YACzC,aAAa,EAAE,qBAAqB;YACpC,aAAa,EAAE,qBAAqB;SACrC,CAAC;IACJ,CAAC;CACF,CAAC"}

package/dist/infrastructure/presets/postgres.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"postgres.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/presets/postgres.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyB,MAAM,YAAY,CAAC;AAExE,eAAO,MAAM,cAAc,EAAE,cA2E5B,CAAC"}
+{"version":3,"file":"postgres.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/presets/postgres.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyB,MAAM,YAAY,CAAC;AAExE,eAAO,MAAM,cAAc,EAAE,cA4H5B,CAAC"}

package/dist/infrastructure/presets/postgres.js

@@ -11,20 +11,55 @@ export const postgresPreset = {
     defaultPorts: { main: 5432 },
     defaultSecrets: { user: 'postgres', password: 'postgres' },
     defaultHealthCheck: {
+        // pg_isready returns 0 the moment the postmaster accepts connections
+        // — but the moment isn't quite app-ready: WAL replay or extension
+        // creation can still be running. Use a real `SELECT 1` against
+        // postgres user (always exists) so we don't mark healthy until the
+        // executor is functional. Higher retry count covers slow boots
+        // (volume create + WAL replay can take 15s+).
         type: 'command',
-        target: 'pg_isready -U postgres',
-        interval: '5s',
+        target: 'sh -c "psql -U postgres -d postgres -h /var/run/postgresql -tAc \\"SELECT 1\\" | grep -q 1"',
+        interval: '3s',
         timeout: '5s',
-        retries: 5,
+        retries: 30,
+    },
+    buildCommand(userConfig) {
+        const cfg = (userConfig['config'] ?? {});
+        const command = ['postgres'];
+        const set = (key, value) => {
+            if (value === undefined || value === null || value === '')
+                return;
+            command.push('-c', `${key}=${value}`);
+        };
+        set('max_connections', cfg.maxConnections ?? 200);
+        set('shared_buffers', cfg.sharedBuffers ?? '256MB');
+        // Optional with no default: unset means "let postgres decide", which is
+        // a better answer than a number picked without knowing the machine.
+        set('effective_cache_size', cfg.effectiveCacheSize);
+        set('work_mem', cfg.workMem);
+        set('maintenance_work_mem', cfg.maintenanceWorkMem);
+        set('log_statement', 'none');
+        // -1 disables slow-query logging, and is a value an operator may mean —
+        // so `?? 1000` rather than a truthiness test, which would treat 0 and -1
+        // as absent and silently restore the default.
+        set('log_min_duration_statement', cfg.logMinDurationStatement ?? 1000);
+        // Safety: kill leaked connections from crashed/restarted processes.
+        // Not configurable — these protect the daemon from its own clients.
+        set('idle_in_transaction_session_timeout', 60000);
+        set('tcp_keepalives_idle', 60);
+        set('tcp_keepalives_interval', 10);
+        set('tcp_keepalives_count', 3);
+        return command;
     },
     defaultDocker: {
+        // Mirrors `buildCommand({})`. Kept because `defaultDocker` is the
+        // fallback for any path that does not run the builder.
         command: [
             'postgres',
             '-c', 'max_connections=200',
             '-c', 'shared_buffers=256MB',
             '-c', 'log_statement=none',
             '-c', 'log_min_duration_statement=1000',
-            // Safety: kill leaked connections from crashed/restarted processes
             '-c', 'idle_in_transaction_session_timeout=60000',
             '-c', 'tcp_keepalives_idle=60',
             '-c', 'tcp_keepalives_interval=10',
@@ -43,7 +78,7 @@ export const postgresPreset = {
         const user = ctx.secrets['user'] ?? 'postgres';
         const maxRetries = 5;
         const retryDelay = 2000;
-        for (const dbName of Object.keys(databases)) {
+        for (const [dbName, dbConfig] of Object.entries(databases)) {
             let created = false;
             for (let attempt = 0; attempt < maxRetries && !created; attempt++) {
                 try {
@@ -69,6 +104,8 @@ export const postgresPreset = {
                     }
                 }
             }
+            if (created)
+                await createExtensions(ctx, user, dbName, dbConfig?.extensions ?? []);
         }
     },
     generateEnvTemplates(_userConfig) {
@@ -77,4 +114,40 @@ export const postgresPreset = {
         };
     },
 };
+/**
+ * Create the extensions a database declared, inside that database.
+ *
+ * `omnitronConfig.database.extensions` was declared in the type and in the
+ * zod schema and read by nothing: the resolver took `dialect` and `pool` and
+ * dropped the rest. An app asking for postgis got a plain container and
+ * failed on its first spatial query with `$libdir/postgis-3: No such file` —
+ * a message about a shared library, three layers away from the setting that
+ * was ignored. The workaround was to override the image by hand in the stack
+ * config, which is why the gap survived: it looked like an image problem.
+ *
+ * A missing extension is reported here, at provisioning time, naming the
+ * extension and the fact that the image has to carry it. Failing to create
+ * one does not abort the rest — the other databases and the other extensions
+ * are still worth having, and the app's own startup will fail loudly enough
+ * if it truly cannot run without it.
+ */
+async function createExtensions(ctx, user, dbName, extensions) {
+    for (const ext of extensions) {
+        // Extension names come from a config file, not from a request, but they
+        // are interpolated into SQL — so keep them to what an identifier can be.
+        if (!/^[a-zA-Z][a-zA-Z0-9_-]*$/.test(ext)) {
+            ctx.logger.warn({ database: dbName, extension: ext }, 'Skipped extension: not a valid identifier');
+            continue;
+        }
+        try {
+            await ctx.execInContainer([
+                'psql', '-U', user, '-d', dbName, '-c', `CREATE EXTENSION IF NOT EXISTS "${ext}"`,
+            ]);
+            ctx.logger.info({ database: dbName, extension: ext }, 'Ensured PostgreSQL extension');
+        }
+        catch (err) {
+            ctx.logger.error({ database: dbName, extension: ext, error: err.message }, `Could not create extension "${ext}" — the image must ship it (postgres:17-alpine has the contrib set, not postgis; use an image override for those)`);
+        }
+    }
+}
 //# sourceMappingURL=postgres.js.map

package/dist/infrastructure/presets/postgres.js.map

@@ -1 +1 @@
-{"version":3,"file":"postgres.js","sourceRoot":"","sources":["../../../src/infrastructure/presets/postgres.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,MAAM,CAAC,MAAM,cAAc,GAAmB;IAC5C,IAAI,EAAE,UAAU;IAChB,IAAI,EAAE,UAAU;IAChB,YAAY,EAAE,oBAAoB;IAClC,YAAY,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;IAC5B,cAAc,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE;IAE1D,kBAAkB,EAAE;QAClB,IAAI,EAAE,SAAS;QACf,MAAM,EAAE,wBAAwB;QAChC,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,CAAC;KACX;IAED,aAAa,EAAE;QACb,OAAO,EAAE;YACP,UAAU;YACV,IAAI,EAAE,qBAAqB;YAC3B,IAAI,EAAE,sBAAsB;YAC5B,IAAI,EAAE,oBAAoB;YAC1B,IAAI,EAAE,iCAAiC;YACvC,mEAAmE;YACnE,IAAI,EAAE,2CAA2C;YACjD,IAAI,EAAE,wBAAwB;YAC9B,IAAI,EAAE,4BAA4B;YAClC,IAAI,EAAE,wBAAwB;SAC/B;QACD,WAAW,EAAE,EAAE;QACf,OAAO,EAAE;YACP,IAAI,EAAE,EAAE,MAAM,EAAE,0BAA0B,EAAE,MAAM,EAAE,EAAE,EAAE;SACzD;QACD,OAAO,EAAE,MAAM;KAChB;IAED,KAAK,CAAC,aAAa,CAAC,GAA0B;QAC5C,MAAM,SAAS,GAAG,GAAG,CAAC,UAAU,CAAC,WAAW,CAAwC,CAAC;QACrF,IAAI,CAAC,SAAS;YAAE,OAAO;QAEvB,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC;QAC/C,MAAM,UAAU,GAAG,CAAC,CAAC;QACrB,MAAM,UAAU,GAAG,IAAI,CAAC;QAExB,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC5C,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,UAAU,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC;gBAClE,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,eAAe,CAAC;wBACvC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM;wBAC1B,4CAA4C,MAAM,GAAG;qBACtD,CAAC,CAAC;oBACH,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;wBACnB,MAAM,GAAG,CAAC,eAAe,CAAC;4BACxB,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,oBAAoB,MAAM,GAAG;yBACxD,CAAC,CAAC;wBACH,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,6BAA6B,CAAC,CAAC;oBACvE,CAAC;oBACD,OAAO,GAAG,IAAI,CAAC;gBACjB,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,OAAO,GAAG,UAAU,GAAG,CAAC,EAAE,CAAC;wBAC7B,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,CAAC,EAAE,EAAE,+BAA+B,CAAC,CAAC;wBAC9F,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC;oBACtD,CAAC;yBAAM,CAAC;wBACN,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,EAAE,2BAA2B,CAAC,CAAC;oBACpG,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,oBAAoB,CAAC,WAAoC;QACvD,OAAO;YACL,YAAY,EAAE,+EAA+E;SAC9F,CAAC;IACJ,CAAC;CACF,CAAC"}
+{"version":3,"file":"postgres.js","sourceRoot":"","sources":["../../../src/infrastructure/presets/postgres.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,MAAM,CAAC,MAAM,cAAc,GAAmB;IAC5C,IAAI,EAAE,UAAU;IAChB,IAAI,EAAE,UAAU;IAChB,YAAY,EAAE,oBAAoB;IAClC,YAAY,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;IAC5B,cAAc,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE;IAE1D,kBAAkB,EAAE;QAClB,qEAAqE;QACrE,kEAAkE;QAClE,+DAA+D;QAC/D,mEAAmE;QACnE,+DAA+D;QAC/D,8CAA8C;QAC9C,IAAI,EAAE,SAAS;QACf,MAAM,EAAE,6FAA6F;QACrG,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,EAAE;KACZ;IAED,YAAY,CAAC,UAAmC;QAC9C,MAAM,GAAG,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,EAAE,CAOtC,CAAC;QAEF,MAAM,OAAO,GAAG,CAAC,UAAU,CAAC,CAAC;QAC7B,MAAM,GAAG,GAAG,CAAC,GAAW,EAAE,KAAkC,EAAQ,EAAE;YACpE,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE;gBAAE,OAAO;YAClE,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC;QACxC,CAAC,CAAC;QAEF,GAAG,CAAC,iBAAiB,EAAE,GAAG,CAAC,cAAc,IAAI,GAAG,CAAC,CAAC;QAClD,GAAG,CAAC,gBAAgB,EAAE,GAAG,CAAC,aAAa,IAAI,OAAO,CAAC,CAAC;QACpD,wEAAwE;QACxE,oEAAoE;QACpE,GAAG,CAAC,sBAAsB,EAAE,GAAG,CAAC,kBAAkB,CAAC,CAAC;QACpD,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QAC7B,GAAG,CAAC,sBAAsB,EAAE,GAAG,CAAC,kBAAkB,CAAC,CAAC;QACpD,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QAC7B,wEAAwE;QACxE,yEAAyE;QACzE,8CAA8C;QAC9C,GAAG,CAAC,4BAA4B,EAAE,GAAG,CAAC,uBAAuB,IAAI,IAAI,CAAC,CAAC;QACvE,oEAAoE;QACpE,oEAAoE;QACpE,GAAG,CAAC,qCAAqC,EAAE,KAAK,CAAC,CAAC;QAClD,GAAG,CAAC,qBAAqB,EAAE,EAAE,CAAC,CAAC;QAC/B,GAAG,CAAC,yBAAyB,EAAE,EAAE,CAAC,CAAC;QACnC,GAAG,CAAC,sBAAsB,EAAE,CAAC,CAAC,CAAC;QAE/B,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,aAAa,EAAE;QACb,kEAAkE;QAClE,uDAAuD;QACvD,OAAO,EAAE;YACP,UAAU;YACV,IAAI,EAAE,qBAAqB;YAC3B,IAAI,EAAE,sBAAsB;YAC5B,IAAI,EAAE,oBAAoB;YAC1B,IAAI,EAAE,iCAAiC;YACvC,IAAI,EAAE,2CAA2C;YACjD,IAAI,EAAE,wBAAwB;YAC9B,IAAI,EAAE,4BAA4B;YAClC,IAAI,EAAE,wBAAwB;SAC/B;QACD,WAAW,EAAE,EAAE;QACf,OAAO,EAAE;YACP,IAAI,EAAE,EAAE,MAAM,EAAE,0BAA0B,EAAE,MAAM,EAAE,EAAE,EAAE;SACzD;QACD,OAAO,EAAE,MAAM;KAChB;IAED,KAAK,CAAC,aAAa,CAAC,GAA0B;QAC5C,MAAM,SAAS,GAAG,GAAG,CAAC,UAAU,CAAC,WAAW,CAE/B,CAAC;QACd,IAAI,CAAC,SAAS;YAAE,OAAO;QAEvB,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC;QAC/C,MAAM,UAAU,GAAG,CAAC,CAAC;QACrB,MAAM,UAAU,GAAG,IAAI,CAAC;QAExB,KAAK,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3D,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,UAAU,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC;gBAClE,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,eAAe,CAAC;wBACvC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM;wBAC1B,4CAA4C,MAAM,GAAG;qBACtD,CAAC,CAAC;oBACH,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;wBACnB,MAAM,GAAG,CAAC,eAAe,CAAC;4BACxB,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,oBAAoB,MAAM,GAAG;yBACxD,CAAC,CAAC;wBACH,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,6BAA6B,CAAC,CAAC;oBACvE,CAAC;oBACD,OAAO,GAAG,IAAI,CAAC;gBACjB,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,OAAO,GAAG,UAAU,GAAG,CAAC,EAAE,CAAC;wBAC7B,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,CAAC,EAAE,EAAE,+BAA+B,CAAC,CAAC;wBAC9F,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC;oBACtD,CAAC;yBAAM,CAAC;wBACN,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,EAAE,2BAA2B,CAAC,CAAC;oBACpG,CAAC;gBACH,CAAC;YACH,CAAC;YAED,IAAI,OAAO;gBAAE,MAAM,gBAAgB,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,IAAI,EAAE,CAAC,CAAC;QACrF,CAAC;IACH,CAAC;IAED,oBAAoB,CAAC,WAAoC;QACvD,OAAO;YACL,YAAY,EAAE,+EAA+E;SAC9F,CAAC;IACJ,CAAC;CACF,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,KAAK,UAAU,gBAAgB,CAC7B,GAA0B,EAC1B,IAAY,EACZ,MAAc,EACd,UAAoB;IAEpB,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,wEAAwE;QACxE,yEAAyE;QACzE,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1C,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,2CAA2C,CAAC,CAAC;YACnG,SAAS;QACX,CAAC;QACD,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,eAAe,CAAC;gBACxB,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,mCAAmC,GAAG,GAAG;aAClF,CAAC,CAAC;YACH,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,8BAA8B,CAAC,CAAC;QACxF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,MAAM,CAAC,KAAK,CACd,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,EACnE,+BAA+B,GAAG,mHAAmH,CACtJ,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/infrastructure/presets/redis.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"redis.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/presets/redis.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,eAAO,MAAM,WAAW,EAAE,cA2BzB,CAAC"}
+{"version":3,"file":"redis.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/presets/redis.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,eAAO,MAAM,WAAW,EAAE,cAmDzB,CAAC"}