@ossy/deployment-tools 3.7.0 → 3.13.0

package/CHANGELOG.md

@@ -3,6 +3,24 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# [3.13.0](https://github.com/ossy-se/ossy/compare/v3.12.0...v3.13.0) (2026-09-06)
+
+### Features
+
+* **platform:** download GeoLite2-Country at startServer boot ([#804](https://github.com/ossy-se/ossy/issues/804)) ([#818](https://github.com/ossy-se/ossy/issues/818)) ([6629ad0](https://github.com/ossy-se/ossy/commit/6629ad07277cfa8350759f2a775110a00743c393))
+
+
+# [3.12.0](https://github.com/ossy-se/ossy/compare/v3.11.1...v3.12.0) (2026-09-06)
+
+### Bug Fixes
+
+* default the API to same-origin and drop api.ossy.se ([#794](https://github.com/ossy-se/ossy/issues/794)) ([397a06f](https://github.com/ossy-se/ossy/commit/397a06f88b01e297fb76f35c429f3e687bdd6af9))
+
+### Features
+
+* **analytics:** Host visitor locations from connection geo ([#772](https://github.com/ossy-se/ossy/issues/772)) ([a565c1b](https://github.com/ossy-se/ossy/commit/a565c1b5078219ef412148d77dc33697f2079612)), closes [#769](https://github.com/ossy-se/ossy/issues/769) [#797](https://github.com/ossy-se/ossy/issues/797) [#797](https://github.com/ossy-se/ossy/issues/797) [#797](https://github.com/ossy-se/ossy/issues/797) [#797](https://github.com/ossy-se/ossy/issues/797) [#769](https://github.com/ossy-se/ossy/issues/769) [#797](https://github.com/ossy-se/ossy/issues/797) [#769](https://github.com/ossy-se/ossy/issues/769)
+
+
 # [3.7.0](https://github.com/ossy-se/ossy/compare/v3.6.2...v3.7.0) (2026-08-22)
 
 ### Features

package/README.md

@@ -9,7 +9,7 @@ Infrastructure and CDK tooling for the Ossy platform.
 ```
 Internet → CloudFront (ACM TLS, us-east-1) → WAF → ALB (:80)
              ├── host rules from platforms.json `services[].hosts|domain`
-             │     e.g. ossy.se, api.ossy.se → website-ossy Fargate service
+             │     e.g. ossy.se → website-ossy Fargate service
              ├── other known hosts / *.ossy.se → platform-runtime Fargate service
              └── default action → platform-runtime
 ```
@@ -35,7 +35,7 @@ Every deployable Ossy HTTP image exposes an unauthenticated liveness probe at **
 
 **ALB target groups** probe `GET /health`. **ECS container health checks** run an exec-form Node one-liner (`ecsContainerHealthCheckCommand`) that `fetch`es the same path on `PORT` and aborts after `HEALTHCHECK_FETCH_TIMEOUT_MS` (4s). Do not point probes at `/`, `/status`, or authenticated routes.
 
-Task definitions also set plain env `PORT`, `OSSY_SERVICE_NAME`, `NODE_ENV`, and media bucket vars via `containerEnvironment`. Those keys are **filtered out** of Secrets Manager injection (`secretEnvKeysForEcsContainer`) so ECS cannot reject duplicate environment/secret keys.
+Task definitions also set plain env `PORT`, `OSSY_SERVICE_NAME`, `NODE_ENV`, media bucket vars, and `GEOLITE2_COUNTRY_MMDB` (`/tmp/GeoLite2-Country.mmdb`, #804) via `containerEnvironment`. Those keys are **filtered out** of Secrets Manager injection (`secretEnvKeysForEcsContainer`) so ECS cannot reject duplicate environment/secret keys.
 
 ## Configuration — `platforms.json`
 
@@ -64,7 +64,7 @@ HTTP services (default) become Fargate services with ALB host rules. The contain
     "name": "ossy-website-ossy",
     "domain": "ossy.se",
     "image": "ghcr.io/ossy-se/website-ossy:latest",
-    "hosts": ["ossy.se", "api.ossy.se"]
+    "hosts": ["ossy.se"]
   }
 ]
 ```
@@ -73,7 +73,7 @@ HTTP services (default) become Fargate services with ALB host rules. The contain
 |---|---|
 | `name` | Unique service name — Secrets Manager / ECS key strips a leading `ossy-` (`website-ossy`). |
 | `domain` | Primary hostname (default ALB host when `hosts` is omitted). |
-| `hosts` | Optional ALB host-header list. Example: `["ossy.se","api.ossy.se"]` so the website image serves apex and API host. Defaults to `[domain]`. |
+| `hosts` | Optional ALB host-header list. Example: `["ossy.se"]` so the website image serves the apex. Defaults to `[domain]`. |
 | `image` | Docker image to pull and run (GHCR). |
 
 **Built-in (always present):**
@@ -264,6 +264,10 @@ Other common env vars:
 | `AWS_SECRET_ACCESS_KEY` | API | AWS credentials for S3 |
 | `OSSY_API_KEY` | Platform, websites | API JWT for CMS reads |
 | `OSSY_COOKIE_SECRET` | Websites | Cookie signing secret |
+| `GEOLITE2_COUNTRY_MMDB` | App (`@ossy/analytics` location projection) | Absolute path to MaxMind GeoLite2-Country `.mmdb` (#769 / #804). Set on every ECS task as `/tmp/GeoLite2-Country.mmdb`. `startServer` downloads the file there when `MAXMIND_LICENSE_KEY` is set. Optional; without the file `countryCode` is omitted (IP still stored on the event). |
+| `MAXMIND_LICENSE_KEY` | App (`startServer` GeoLite2 download) | MaxMind license key. Add to `platforms.json` `env` and `npm run sync-secrets` so **every** website image (ossy.se, plexus-sanitas, …) can download GeoLite2-Country at boot (#804). Free signup: https://www.maxmind.com/en/geolite2/signup |
+| `MAXMIND_ACCOUNT_ID` | App (`startServer` GeoLite2 download) | Optional MaxMind account id. When set with the license key, download uses the permalink + HTTP Basic auth API. |
+| `OSSY_TRUST_PROXY_HOPS` | Platform / websites | Express `trust proxy` hop count behind CloudFront→ALB (default: `2`). |
 | `OPENAI_API_KEY` | Worker | OpenAI API key |
 | `OPENAI_ORGANIZATION` | Worker | OpenAI organisation ID |
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ossy/deployment-tools",
-  "version": "3.7.0",
+  "version": "3.13.0",
   "description": "Collection of scripts and tools to aid deployment of containers and static files to Amazon Web Services through GitHub Actions",
   "source": "./src/index.js",
   "main": "./src/index.js",
@@ -24,5 +24,5 @@
   "devDependencies": {
     "jest": "^30.4.2"
   },
-  "gitHead": "622d97535abad08415963405ace2f5aaaecd7ca4"
+  "gitHead": "7a02d1e056b731aa36f72e3f8d6df941101dbd50"
 }

package/src/ecs/platform-ecs-services.js

@@ -31,8 +31,12 @@ const CONTAINER_ENVIRONMENT_KEYS = Object.freeze([
   'OSSY_SERVICE_NAME',
   'MEDIA_REPOSITORY',
   'MEDIA_CDN_DOMAIN_NAME',
+  'GEOLITE2_COUNTRY_MMDB',
 ])
 
+/** Keep in sync with `@ossy/platform` `GEOLITE2_COUNTRY_MMDB_PATH` (#804). */
+const GEOLITE2_COUNTRY_MMDB_PATH = '/tmp/GeoLite2-Country.mmdb'
+
 /**
  * @typedef {Object} PlatformEcsService
  * @property {string} key - short key (`runtime`, `website-ossy`, …) — matches Secrets Manager
@@ -96,6 +100,7 @@ function containerEnvironment({
     OSSY_SERVICE_NAME: serviceKey,
     MEDIA_REPOSITORY: mediaRepository,
     MEDIA_CDN_DOMAIN_NAME: mediaCdnDomainName,
+    GEOLITE2_COUNTRY_MMDB: GEOLITE2_COUNTRY_MMDB_PATH,
     ...(nodeOptions ? { NODE_OPTIONS: nodeOptions } : {}),
   }
 }
@@ -212,6 +217,7 @@ module.exports = {
   CONTAINER_PORT,
   HEALTH_PATH,
   HEALTHCHECK_FETCH_TIMEOUT_MS,
+  GEOLITE2_COUNTRY_MMDB_PATH,
   CONTAINER_ENVIRONMENT_KEYS,
   secretEnvKeysForEcsContainer,
   containerEnvironment,

package/src/ecs/platform-ecs-services.spec.js

@@ -6,6 +6,7 @@ const {
   CONTAINER_PORT,
   HEALTH_PATH,
   HEALTHCHECK_FETCH_TIMEOUT_MS,
+  GEOLITE2_COUNTRY_MMDB_PATH,
   RUNTIME_IMAGE,
   containerEnvironment,
   ecsContainerHealthCheckCommand,
@@ -27,6 +28,17 @@ describe('shared health constants', () => {
   })
 })
 
+describe('GeoLite2-Country path (#804)', () => {
+  it('stays aligned with @ossy/platform geolite2-country-path.js', () => {
+    const src = fs.readFileSync(
+      path.join(__dirname, '../../../platform/src/geoip/geolite2-country-path.js'),
+      'utf8'
+    )
+    expect(src).toContain(`export const GEOLITE2_COUNTRY_MMDB_PATH = '${GEOLITE2_COUNTRY_MMDB_PATH}'`)
+    expect(GEOLITE2_COUNTRY_MMDB_PATH).toBe('/tmp/GeoLite2-Country.mmdb')
+  })
+})
+
 describe('ecsContainerHealthCheckCommand', () => {
   it('probes HEALTH_PATH with Node fetch and abort timeout', () => {
     const command = ecsContainerHealthCheckCommand()
@@ -60,6 +72,7 @@ describe('containerEnvironment', () => {
       OSSY_SERVICE_NAME: 'website-ossy',
       MEDIA_REPOSITORY: 'media-bucket',
       MEDIA_CDN_DOMAIN_NAME: 'https://cdn.example',
+      GEOLITE2_COUNTRY_MMDB: '/tmp/GeoLite2-Country.mmdb',
     })
   })
 
@@ -92,6 +105,7 @@ describe('secretEnvKeysForEcsContainer', () => {
       'TOKEN_SECRET',
       'NODE_ENV',
       'MEDIA_REPOSITORY',
+      'GEOLITE2_COUNTRY_MMDB',
       'NODE_OPTIONS',
       'DB_URL',
     ])).toEqual(['TOKEN_SECRET', 'DB_URL'])
@@ -106,8 +120,8 @@ describe('hostsFromServiceEntry', () => {
   it('uses hosts when provided', () => {
     expect(hostsFromServiceEntry({
       domain: 'ossy.se',
-      hosts: ['ossy.se', 'api.ossy.se'],
-    })).toEqual(['ossy.se', 'api.ossy.se'])
+      hosts: ['ossy.se', 'www.ossy.se'],
+    })).toEqual(['ossy.se', 'www.ossy.se'])
   })
 
   it('falls back to domain', () => {
@@ -120,7 +134,6 @@ describe('listPlatformEcsServices', () => {
     const services = listPlatformEcsServices({
       platformName: 'ossybot',
       domains: [
-        'api.ossy.se',
         'ossy.se',
         '*.ossy.se',
         'www.plexus-sanitas.com',
@@ -130,7 +143,7 @@ describe('listPlatformEcsServices', () => {
         {
           name: 'ossy-website-ossy',
           domain: 'ossy.se',
-          hosts: ['ossy.se', 'api.ossy.se'],
+          hosts: ['ossy.se'],
           image: 'ghcr.io/ossy-se/website-ossy:latest',
           cpu: 1024,
           memoryLimitMiB: 4096,
@@ -165,7 +178,7 @@ describe('listPlatformEcsServices', () => {
 
     const website = services.find(s => s.key === 'website-ossy')
     expect(website.isDefault).toBe(false)
-    expect(website.hosts).toEqual(['ossy.se', 'api.ossy.se'])
+    expect(website.hosts).toEqual(['ossy.se'])
     expect(website.image).toBe('ghcr.io/ossy-se/website-ossy:latest')
     expect(website.secretName).toBe('ossybot/website-ossy')
     expect(website.cpu).toBe(1024)

package/src/infrastructure/platform-ecs-stack.js

@@ -193,7 +193,7 @@ class PlatformEcsStack extends Stack {
           streamPrefix: service.key,
           logGroup,
         }),
-        // Labels `/health` via OSSY_SERVICE_NAME; keys stay in CONTAINER_ENVIRONMENT_KEYS.
+        // Labels `/health` via OSSY_SERVICE_NAME; GeoLite2 path (#804). Keys stay in CONTAINER_ENVIRONMENT_KEYS.
         environment: containerEnvironment({
           serviceKey: service.key,
           containerPort: service.containerPort,
@@ -281,7 +281,7 @@ class PlatformEcsStack extends Stack {
     })
 
     // Lower priority number = evaluated first. Specific hosts before wildcards
-    // so `api.ossy.se` is not swallowed by `*.ossy.se`.
+    // so `ossy.se` is not swallowed by `*.ossy.se`.
     // Priorities are hash-stable per host — sequential 10,11,12… renumbers
     // every insert and CloudFormation cannot swap ALB priorities in one update.
     const usedPriorities = new Set()