@ossy/deployment-tools 1.17.6 → 1.17.8

package/CHANGELOG.md

@@ -3,6 +3,22 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## 1.17.8 (2026-05-25)
+
+**Note:** Version bump only for package @ossy/deployment-tools
+
+
+
+
+
+## 1.17.7 (2026-05-25)
+
+**Note:** Version bump only for package @ossy/deployment-tools
+
+
+
+
+
 ## 1.17.6 (2026-05-25)
 
 **Note:** Version bump only for package @ossy/deployment-tools

package/README.md

@@ -22,49 +22,49 @@ All services run as Docker containers managed by systemd. Service files are writ
 | Service | Unit file | Port | Auto-start |
 |---|---|---|---|
 | Caddy | `caddy-route53.service` | 80, 443 | Yes |
-| Ossy API | `ossy-api.service` | 3001 | Manual |
-| Ossy Runtime | `ossy-runtime.service` | 3000 | Manual |
+| Ossy API | `ossy-api.service` | 3001 | Yes |
+| Ossy Runtime | `ossy-runtime.service` | 3000 | Yes |
 
-The API and runtime are **not** auto-started because their Docker images must be built on the host first. After SSHing in and building the images, enable them once:
+All three services start automatically on first boot:
 
-```bash
-sudo systemctl enable --now ossy-api ossy-runtime
-```
+- **Runtime** — image built from the published `@ossy/platform` npm package (no repo needed)
+- **API** — image pulled from `ghcr.io/ossy-se/api:latest` (pushed by CI on every merge to main). The `ExecStartPre` in the service unit pulls the latest image before each start, so redeploying is just `systemctl restart ossy-api`
+
+> **TODO:** Pin `@ossy/platform` to a specific version at CDK deploy time (thread through `PlatformConfig`) rather than always pulling `@latest`.
 
 ## Bootstrapping a new host
 
-After CDK provisions the EC2 instance (Caddy starts automatically), SSH in and:
+CDK provisions the instance and starts all three services automatically. The only manual step is setting required environment variables on the host before the first start:
 
 ```bash
-# Clone the repo
-git clone <repo-url> ~/ossy
-cd ~/ossy
-
-# Build the API image
-docker build -t ossy-api:latest -f api/Dockerfile api
-
-# Build the runtime image
-docker build -t ossy-runtime:latest \
-  -f packages/runtime/Dockerfile packages/runtime
-
-# Start both services
-sudo systemctl enable --now ossy-api ossy-runtime
+# SSH in and edit /etc/environment:
+sudo tee -a /etc/environment << 'EOF'
+DB_URL=mongodb+srv://...
+DB_NAME=ossy
+TOKEN_SECRET=...
+MEDIA_REPOSITORY=...
+MEDIA_CDN_DOMAIN_NAME=...
+AWS_ACCESS_KEY_ID=...
+AWS_SECRET_ACCESS_KEY=...
+OSSY_API_KEY=...
+EOF
+
+# Restart services to pick up the new env vars
+sudo systemctl restart ossy-api ossy-runtime
 ```
 
-## Redeploying after a code change
+> Note: `OSSY_API_KEY` is used by the runtime to authenticate CMS reads. It should be a long-lived API token issued by the API itself.
 
-```bash
-cd ~/ossy && git pull
+## Redeploying after a code change
 
-# Rebuild whichever image changed
-docker build -t ossy-api:latest -f api/Dockerfile api
-# or
-docker build -t ossy-runtime:latest \
-  -f packages/runtime/Dockerfile packages/runtime
+Both services pull the latest image from GHCR on every restart — no manual build step needed.
 
-# Restart the service
+```bash
+# API — push to main triggers CI, which builds and pushes ghcr.io/ossy-se/api:latest
 sudo systemctl restart ossy-api
-# or
+
+# Runtime — merging to main in the ossy monorepo publishes npm packages and then
+# builds and pushes ghcr.io/ossy-se/platform:latest
 sudo systemctl restart ossy-runtime
 ```
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ossy/deployment-tools",
-  "version": "1.17.6",
+  "version": "1.17.8",
   "description": "Collection of scripts and tools to aid deployment of containers and static files to Amazon Web Services through GitHub Actions",
   "source": "./src/index.js",
   "main": "./src/index.js",
@@ -21,11 +21,10 @@
     "aws-cdk-lib": "^2.73.0",
     "constructs": "^10.1.304",
     "glob": "^9.3.2",
-    "nanoid": "^3.3.4",
-    "node-fetch": "^2.6.7"
+    "nanoid": "^3.3.4"
   },
   "devDependencies": {
     "jest": "^27.5.1"
   },
-  "gitHead": "236f9e8bddf2ae3ca992aea39e7d1a70c9377ea6"
+  "gitHead": "067a561ef254d7c0f51b7517a6b995ed53bd416e"
 }

package/src/infrastructure/container-deployment-target/caddy.service.js

@@ -6,12 +6,22 @@ const caddyfile = `
 }
 
 api.ossy.se {
+  tls {
+    dns route53 {
+      max_retries 10
+      profile ci-client
+    }
+  }
   reverse_proxy localhost:3001
 }
 
 :443 {
   tls {
     on_demand
+    dns route53 {
+      max_retries 10
+      profile ci-client
+    }
   }
   reverse_proxy localhost:3000
 }

package/src/infrastructure/container-deployment-target/container-deployment-target.js

@@ -132,9 +132,11 @@ class ContainerDeploymentTarget extends Construct {
     userData.addCommands(
       'sudo systemctl daemon-reload',
       ...CaddyService.enable(),
-      ...CaddyService.start()
-      // ossy-runtime and ossy-api are enabled manually after building images:
-      //   sudo systemctl enable --now ossy-runtime ossy-api
+      ...CaddyService.start(),
+      ...OssyRuntimeService.enable(),
+      ...OssyRuntimeService.start(),
+      ...OssyApiService.enable(),
+      ...OssyApiService.start()
     )
 
     const ec2Instance = new Instance(this, 'Ec2Instance', {

package/src/infrastructure/container-deployment-target/ossy-api.service.js

@@ -7,6 +7,7 @@ Requires=docker.service
 [Service]
 EnvironmentFile=/etc/environment
 ExecStartPre=-/usr/bin/docker rm -f ossy-api
+ExecStartPre=/usr/bin/docker pull ghcr.io/ossy-se/api:latest
 ExecStart=/usr/bin/docker run --name ossy-api \\
   --network ossy-network \\
   -p 3001:3001 \\
@@ -17,15 +18,17 @@ ExecStart=/usr/bin/docker run --name ossy-api \\
   -e MEDIA_CDN_DOMAIN_NAME=\${MEDIA_CDN_DOMAIN_NAME} \\
   -e AWS_ACCESS_KEY_ID=\${AWS_ACCESS_KEY_ID} \\
   -e AWS_SECRET_ACCESS_KEY=\${AWS_SECRET_ACCESS_KEY} \\
-  ossy-api:latest
+  ghcr.io/ossy-se/api:latest
 ExecStop=/usr/bin/docker stop ossy-api
 Restart=on-failure
 RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
 `
 
-// No [Install] section — service is enabled manually after the image is built.
-// SSH into the host, build the image, then:
-//   sudo systemctl enable --now ossy-api
+// The image is pulled automatically on every start via ExecStartPre, so the
+// service always runs the latest published version. To redeploy: systemctl restart ossy-api
 
 /**
   * @class
@@ -36,6 +39,14 @@ class OssyApiService {
     return [`sudo tee /etc/systemd/system/ossy-api.service > /dev/null << 'EOF'\n${systemdServiceFile}\nEOF`]
   }
 
+  static enable() {
+    return ['sudo systemctl enable ossy-api']
+  }
+
+  static start() {
+    return ['sudo systemctl start ossy-api']
+  }
+
 }
 
 module.exports = {

package/src/infrastructure/container-deployment-target/ossy-runtime.service.js

@@ -7,19 +7,22 @@ Requires=docker.service
 [Service]
 EnvironmentFile=/etc/environment
 ExecStartPre=-/usr/bin/docker rm -f ossy-runtime
+ExecStartPre=/usr/bin/docker pull ghcr.io/ossy-se/platform:latest
 ExecStart=/usr/bin/docker run --name ossy-runtime \\
   --network ossy-network \\
   -p 3000:3000 \\
   -e OSSY_API_KEY=\${OSSY_API_KEY} \\
-  ossy-runtime:latest
+  ghcr.io/ossy-se/platform:latest
 ExecStop=/usr/bin/docker stop ossy-runtime
 Restart=on-failure
 RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
 `
 
-// No [Install] section — service is enabled manually after the image is built.
-// SSH into the host, build the image, then:
-//   sudo systemctl enable --now ossy-runtime
+// The image is pulled automatically on every start via ExecStartPre, so the
+// service always runs the latest published version. To redeploy: systemctl restart ossy-runtime
 
 /**
   * @class
@@ -30,6 +33,14 @@ class OssyRuntimeService {
     return [`sudo tee /etc/systemd/system/ossy-runtime.service > /dev/null << 'EOF'\n${systemdServiceFile}\nEOF`]
   }
 
+  static enable() {
+    return ['sudo systemctl enable ossy-runtime']
+  }
+
+  static start() {
+    return ['sudo systemctl start ossy-runtime']
+  }
+
 }
 
 module.exports = {

package/src/caddy/caddy-config.js

@@ -1,88 +0,0 @@
-const Matchers = {
-  host: host => ({ host: [host] }),
-  path: path => ({ path: [path] })
-}
-
-const Handlers = {
-  reverseProxy: upstreamPort => ({
-    handler: 'reverse_proxy',
-    upstreams: [{ dial: `localhost:${upstreamPort}` }]
-  }),
-  subroute: routes => ({
-    handler: 'subroute',
-    routes
-  })
-}
-
-/**
-  * @class
-*/
-class CaddyConfigService {
-
-  static createServer() {
-    return {
-      apps: {
-        tls: CaddyConfigService.tlsIssuers(),
-        http: {
-          servers: {
-            'deployment-tools': {
-              listen: [':443'],
-              routes: []
-            }
-          }
-        },
-      }
-    }
-  }
-
-  static createProxyConfig(containerDeploymentTemplate) {
-    return {
-      '@id': containerDeploymentTemplate.domain,
-      match: [Matchers.host(containerDeploymentTemplate.domain)],
-      handle: [Handlers.subroute([{ handle: [Handlers.reverseProxy(containerDeploymentTemplate.hostPort)]}])]
-    }
-  }
-
-  static tlsIssuers() {
-    // add tls automation to the server config under apps.tls property
-    return {
-        automation: {
-          policies: [
-            {
-              subjects: [],
-              issuers:[
-                {
-                  challenges: {
-                    dns:{
-                      provider: {
-                        'max_retries': 10,
-                        name: 'route53',
-                        'aws_profile': 'ci-client'
-                      }
-                    }
-                  },
-                  module: 'acme'
-                },
-                {
-                  challenges:{
-                    dns:{
-                      provider:{
-                        'max_retries': 10,
-                        name: 'route53'
-                      }
-                    }
-                  },
-                  module: 'zerossl'
-                }
-              ]
-            }
-          ]
-        }
-      }
-  }
-
-}
-
-module.exports = {
-  CaddyConfigService
-}

package/src/caddy/caddy.js

@@ -1,113 +0,0 @@
-const fetch = require('node-fetch')
-const { logError, logInfo } = require('../log')
-const { CaddyConfigService } = require('./caddy-config')
-
-/**
-  * @class
-*/
-class CaddyService {
-
-  static loadServerConfig() {
-    const config = CaddyConfigService.createServer()
-    return fetch('http://localhost:2019/load', {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify(config)
-    })
-    .then(response => response?.error && logError({ message: '[CaddyService] Could not apply default caddy config', error }))
-    .catch(error => logError({ message: '[CaddyService] Could not apply default caddy config', error }))
-  }
-
-  static apply(containerDeploymentTemplate) {
-    return CaddyService.applyProxyConfig(containerDeploymentTemplate)
-      .then(() => CaddyService.applyTlsSubject(containerDeploymentTemplate))
-  }
-
-  static getConfig() {
-    return fetch('http://localhost:2019/config/', {
-      method: 'GET',
-      headers: { 'Content-Type': 'application/json' }
-    }).then(response => response.json())
-  }
-
-  static getTlsSubjects() {
-    return fetch('http://localhost:2019/config/apps/tls/automation/policies/0/subjects', {
-      method: 'GET',
-      headers: { 'Content-Type': 'application/json' }
-    })
-    .then(response => response.json())
-    .catch(error => logError({ message: '[CaddyService] Could not get tls subjects', error }))
-  }
-
-  static applyTlsSubject(containerDeploymentTemplate) {
-    return CaddyService.getTlsSubjects()
-      .then(tlsSubjects => {
-        const subjectExists = tlsSubjects.includes(containerDeploymentTemplate.domain)
-        return subjectExists
-          ? Promise.resolve()
-          : CaddyService.addTlsSubject(containerDeploymentTemplate)
-      })
-  }
-
-  static addTlsSubject(containerDeploymentTemplate) {
-    return fetch('http://localhost:2019/config/apps/tls/automation/policies/0/subjects', {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify(containerDeploymentTemplate.domain)
-    })
-    .then(response => response?.error && logError({ message: '[CaddyService] Could not add tls subject', error }))
-    .catch(error => logError({ message: '[CaddyService] Could not add tls subject', error }))
-  }
-
-  static getProxyConfig(containerDeploymentTemplate) {
-    logInfo({ message: `[CaddyService] Checking if a proxy for ${containerDeploymentTemplate.domain} exists` })
-    return fetch(`http://localhost:2019/id/${containerDeploymentTemplate.domain}`, {
-      method: 'GET',
-      headers: { 'Content-Type': 'application/json' }
-    })
-    .then(response => response.json())
-    .then(response => (!response || response?.error) ? Promise.reject() : response)
-    .catch(error => {
-      logInfo({ message: `[CaddyService] Could not find a proxy for ${containerDeploymentTemplate.domain}`, error })
-      return undefined
-    })
-  }
-
-  static applyProxyConfig(containerDeploymentTemplate) {
-    return CaddyService.getProxyConfig(containerDeploymentTemplate)
-      .then(proxyConfig => {
-          return proxyConfig
-              ? CaddyService.replaceProxyConfig(containerDeploymentTemplate)
-              : CaddyService.addProxyConfig(containerDeploymentTemplate)
-      })
-  }
-
-  static addProxyConfig(containerDeploymentTemplate) {
-    logInfo({ message: `[CaddyService] Adding proxy for ${containerDeploymentTemplate.domain}` })
-    const proxyConfig = CaddyConfigService.createProxyConfig(containerDeploymentTemplate)
-    return fetch('http://localhost:2019/config/apps/http/servers/deployment-tools/routes', {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify(proxyConfig)
-    })
-    .then(response => response?.error && logError({ message: '[CaddyService] Could not add proxy config', error }))
-    .catch(error => logError({ message: '[CaddyService] Could not add proxy config', error }))
-  }
-
-  static replaceProxyConfig(containerDeploymentTemplate) {
-    logInfo({ message: `[CaddyService] Replacing proxy for ${containerDeploymentTemplate.domain}` })
-    const proxyConfig = CaddyConfigService.createProxyConfig(containerDeploymentTemplate)
-    return fetch(`http://localhost:2019/id/${containerDeploymentTemplate.domain}`, {
-      method: 'PUT',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify(proxyConfig)
-    })
-    .then(response => response?.error && logError({ message: '[CaddyService] Could not add proxy config', error }))
-    .catch(error => logError({ message: '[CaddyService] Could not add proxy config', error }))
-  }
-
-}
-
-module.exports = {
-  CaddyService
-}

package/src/caddy/caddy.playground.js

@@ -1,31 +0,0 @@
-const { CaddyService } = require('./caddy')
-
-const containerDeploymentTemplate = {
-    "domain": "peter.ossy.se",
-    "image": "ossy-se/website-alex",
-    "targetDeploymentPlatform": "ossybot",
-    "type": "CONTAINER",
-    "hostPort": "3016"
-}
-
-
-// CaddyService.getProxyForDomain('alex.ossy.se')
-//  .then(x => console.log(JSON.stringify(x, null, 2)))
-
-//  CaddyService.getProxyForDomain('ossy.se')
-//   .then(x => console.log(JSON.stringify(x, null, 2)))
-
-// OnStartup
-// CaddyService.loadServerConfig()
-
-// Get config
-CaddyService.getConfig()
-    .then(x => console.log(JSON.stringify(x, null, 2)))
-//     .then(() => CaddyService.applyProxyConfig(containerDeploymentTemplate))
-//     .then(() => CaddyService.getConfig())
-//     .then(x => console.log(JSON.stringify(x, null, 2)))
-
-// CaddyService.getTlsSubjects()
-    // .then(x => console.log(JSON.stringify(x, null, 2)))
-
-// CaddyService.apply(containerDeploymentTemplate)

package/src/caddy/index.js

@@ -1,4 +0,0 @@
-module.exports = {
-  ...require('./caddy.js'),
-  ...require('./caddy-config.js')
-}

package/src/infrastructure/container-deployment-target/deployment-tools.service.js

@@ -1,40 +0,0 @@
-const systemdServiceFile = `
-[Unit]
-Description=D
-After=network.target caddy-route53.service
-
-[Service]
-EnvironmentFile=/etc/environment
-User=ubuntu
-Group=docker
-AmbientCapabilities=CAP_NET_BIND_SERVICE
-CapabilityBoundingSet=CAP_NET_BIND_SERVICE
-ExecStart=/usr/bin/npx --yes @ossy/deployment-tools server start --platforms /home/ubuntu/platform-config.json
-Restart=on-failure
-
-[Install]
-WantedBy=multi-user.target cloud-init.target
-`
-
-/**
-  * @class
-*/
-class DeploymentToolsService {
-
-  static install() {
-    return [`sudo echo "${systemdServiceFile}" >> /etc/systemd/system/deployment-tools.service`]
-  }
-
-  static enable() {
-    return ['sudo systemctl enable deployment-tools.service']
-  }
-
-  static start() {
-    return ['sudo systemctl start deployment-tools.service']
-  }
-
-}
-
-module.exports = {
-  DeploymentToolsService
-}