@ossy/deployment-tools 3.12.0 → 3.13.0

package/CHANGELOG.md

@@ -3,6 +3,13 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# [3.13.0](https://github.com/ossy-se/ossy/compare/v3.12.0...v3.13.0) (2026-09-06)
+
+### Features
+
+* **platform:** download GeoLite2-Country at startServer boot ([#804](https://github.com/ossy-se/ossy/issues/804)) ([#818](https://github.com/ossy-se/ossy/issues/818)) ([6629ad0](https://github.com/ossy-se/ossy/commit/6629ad07277cfa8350759f2a775110a00743c393))
+
+
 # [3.12.0](https://github.com/ossy-se/ossy/compare/v3.11.1...v3.12.0) (2026-09-06)
 
 ### Bug Fixes

package/README.md

@@ -35,7 +35,7 @@ Every deployable Ossy HTTP image exposes an unauthenticated liveness probe at **
 
 **ALB target groups** probe `GET /health`. **ECS container health checks** run an exec-form Node one-liner (`ecsContainerHealthCheckCommand`) that `fetch`es the same path on `PORT` and aborts after `HEALTHCHECK_FETCH_TIMEOUT_MS` (4s). Do not point probes at `/`, `/status`, or authenticated routes.
 
-Task definitions also set plain env `PORT`, `OSSY_SERVICE_NAME`, `NODE_ENV`, and media bucket vars via `containerEnvironment`. Those keys are **filtered out** of Secrets Manager injection (`secretEnvKeysForEcsContainer`) so ECS cannot reject duplicate environment/secret keys.
+Task definitions also set plain env `PORT`, `OSSY_SERVICE_NAME`, `NODE_ENV`, media bucket vars, and `GEOLITE2_COUNTRY_MMDB` (`/tmp/GeoLite2-Country.mmdb`, #804) via `containerEnvironment`. Those keys are **filtered out** of Secrets Manager injection (`secretEnvKeysForEcsContainer`) so ECS cannot reject duplicate environment/secret keys.
 
 ## Configuration — `platforms.json`
 
@@ -264,7 +264,9 @@ Other common env vars:
 | `AWS_SECRET_ACCESS_KEY` | API | AWS credentials for S3 |
 | `OSSY_API_KEY` | Platform, websites | API JWT for CMS reads |
 | `OSSY_COOKIE_SECRET` | Websites | Cookie signing secret |
-| `GEOLITE2_COUNTRY_MMDB` | App (`@ossy/analytics` location projection) | Absolute path to MaxMind GeoLite2-Country `.mmdb` (#769). Used by `PageViewLocationProjection` / `ProjectionRebuild` — not at ingest. Optional; without it `countryCode` is omitted (IP still stored on the event). |
+| `GEOLITE2_COUNTRY_MMDB` | App (`@ossy/analytics` location projection) | Absolute path to MaxMind GeoLite2-Country `.mmdb` (#769 / #804). Set on every ECS task as `/tmp/GeoLite2-Country.mmdb`. `startServer` downloads the file there when `MAXMIND_LICENSE_KEY` is set. Optional; without the file `countryCode` is omitted (IP still stored on the event). |
+| `MAXMIND_LICENSE_KEY` | App (`startServer` GeoLite2 download) | MaxMind license key. Add to `platforms.json` `env` and `npm run sync-secrets` so **every** website image (ossy.se, plexus-sanitas, …) can download GeoLite2-Country at boot (#804). Free signup: https://www.maxmind.com/en/geolite2/signup |
+| `MAXMIND_ACCOUNT_ID` | App (`startServer` GeoLite2 download) | Optional MaxMind account id. When set with the license key, download uses the permalink + HTTP Basic auth API. |
 | `OSSY_TRUST_PROXY_HOPS` | Platform / websites | Express `trust proxy` hop count behind CloudFront→ALB (default: `2`). |
 | `OPENAI_API_KEY` | Worker | OpenAI API key |
 | `OPENAI_ORGANIZATION` | Worker | OpenAI organisation ID |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ossy/deployment-tools",
-  "version": "3.12.0",
+  "version": "3.13.0",
   "description": "Collection of scripts and tools to aid deployment of containers and static files to Amazon Web Services through GitHub Actions",
   "source": "./src/index.js",
   "main": "./src/index.js",
@@ -24,5 +24,5 @@
   "devDependencies": {
     "jest": "^30.4.2"
   },
-  "gitHead": "c2650803219ad1831559b512848358d9550ffad2"
+  "gitHead": "7a02d1e056b731aa36f72e3f8d6df941101dbd50"
 }

package/src/ecs/platform-ecs-services.js

@@ -31,8 +31,12 @@ const CONTAINER_ENVIRONMENT_KEYS = Object.freeze([
   'OSSY_SERVICE_NAME',
   'MEDIA_REPOSITORY',
   'MEDIA_CDN_DOMAIN_NAME',
+  'GEOLITE2_COUNTRY_MMDB',
 ])
 
+/** Keep in sync with `@ossy/platform` `GEOLITE2_COUNTRY_MMDB_PATH` (#804). */
+const GEOLITE2_COUNTRY_MMDB_PATH = '/tmp/GeoLite2-Country.mmdb'
+
 /**
  * @typedef {Object} PlatformEcsService
  * @property {string} key - short key (`runtime`, `website-ossy`, …) — matches Secrets Manager
@@ -96,6 +100,7 @@ function containerEnvironment({
     OSSY_SERVICE_NAME: serviceKey,
     MEDIA_REPOSITORY: mediaRepository,
     MEDIA_CDN_DOMAIN_NAME: mediaCdnDomainName,
+    GEOLITE2_COUNTRY_MMDB: GEOLITE2_COUNTRY_MMDB_PATH,
     ...(nodeOptions ? { NODE_OPTIONS: nodeOptions } : {}),
   }
 }
@@ -212,6 +217,7 @@ module.exports = {
   CONTAINER_PORT,
   HEALTH_PATH,
   HEALTHCHECK_FETCH_TIMEOUT_MS,
+  GEOLITE2_COUNTRY_MMDB_PATH,
   CONTAINER_ENVIRONMENT_KEYS,
   secretEnvKeysForEcsContainer,
   containerEnvironment,

package/src/ecs/platform-ecs-services.spec.js

@@ -6,6 +6,7 @@ const {
   CONTAINER_PORT,
   HEALTH_PATH,
   HEALTHCHECK_FETCH_TIMEOUT_MS,
+  GEOLITE2_COUNTRY_MMDB_PATH,
   RUNTIME_IMAGE,
   containerEnvironment,
   ecsContainerHealthCheckCommand,
@@ -27,6 +28,17 @@ describe('shared health constants', () => {
   })
 })
 
+describe('GeoLite2-Country path (#804)', () => {
+  it('stays aligned with @ossy/platform geolite2-country-path.js', () => {
+    const src = fs.readFileSync(
+      path.join(__dirname, '../../../platform/src/geoip/geolite2-country-path.js'),
+      'utf8'
+    )
+    expect(src).toContain(`export const GEOLITE2_COUNTRY_MMDB_PATH = '${GEOLITE2_COUNTRY_MMDB_PATH}'`)
+    expect(GEOLITE2_COUNTRY_MMDB_PATH).toBe('/tmp/GeoLite2-Country.mmdb')
+  })
+})
+
 describe('ecsContainerHealthCheckCommand', () => {
   it('probes HEALTH_PATH with Node fetch and abort timeout', () => {
     const command = ecsContainerHealthCheckCommand()
@@ -60,6 +72,7 @@ describe('containerEnvironment', () => {
       OSSY_SERVICE_NAME: 'website-ossy',
       MEDIA_REPOSITORY: 'media-bucket',
       MEDIA_CDN_DOMAIN_NAME: 'https://cdn.example',
+      GEOLITE2_COUNTRY_MMDB: '/tmp/GeoLite2-Country.mmdb',
     })
   })
 
@@ -92,6 +105,7 @@ describe('secretEnvKeysForEcsContainer', () => {
       'TOKEN_SECRET',
       'NODE_ENV',
       'MEDIA_REPOSITORY',
+      'GEOLITE2_COUNTRY_MMDB',
       'NODE_OPTIONS',
       'DB_URL',
     ])).toEqual(['TOKEN_SECRET', 'DB_URL'])

package/src/infrastructure/platform-ecs-stack.js

@@ -193,7 +193,7 @@ class PlatformEcsStack extends Stack {
           streamPrefix: service.key,
           logGroup,
         }),
-        // Labels `/health` via OSSY_SERVICE_NAME; keys stay in CONTAINER_ENVIRONMENT_KEYS.
+        // Labels `/health` via OSSY_SERVICE_NAME; GeoLite2 path (#804). Keys stay in CONTAINER_ENVIRONMENT_KEYS.
         environment: containerEnvironment({
           serviceKey: service.key,
           containerPort: service.containerPort,