@podosoft/podokit 0.10.0 → 0.10.2

package/dist/templates/fullstack-nest-svelte/README.md

@@ -39,3 +39,11 @@ Want a worked example? Generate the `todo` template instead:
 
 Docker Compose in `infra/docker`; example k3s manifests in `infra/k3s`
 (use `secret.example.yaml` as a template — never commit real secrets).
+
+Build production images from the workspace root so Docker can use the committed
+lockfile and all workspace package manifests:
+
+```bash
+docker build -f apps/api/Dockerfile -t {{projectName}}-api .
+docker build -f apps/web/Dockerfile -t {{projectName}}-web .
+```

package/dist/templates/fullstack-nest-svelte/apps/api/Dockerfile

@@ -1,22 +1,26 @@
 # syntax=docker/dockerfile:1
-FROM node:20-alpine AS deps
+FROM node:22-alpine AS deps
 WORKDIR /app
-COPY package.json ./
-RUN npm install --omit=dev=false --no-audit --no-fund
+COPY package.json package-lock.json ./
+COPY apps/api/package.json ./apps/api/package.json
+COPY apps/web/package.json ./apps/web/package.json
+COPY tests/package.json ./tests/package.json
+RUN npm ci --no-audit --no-fund
 
-FROM node:20-alpine AS build
+FROM node:22-alpine AS build
 WORKDIR /app
 COPY --from=deps /app/node_modules ./node_modules
 COPY . .
-RUN npm run build
+RUN npm run build --workspace=apps/api
 
-FROM node:20-alpine AS runtime
+FROM node:22-alpine AS runtime
 WORKDIR /app
 ENV NODE_ENV=production
 RUN addgroup -S app && adduser -S app -G app
-COPY --from=build /app/dist ./dist
 COPY --from=build /app/node_modules ./node_modules
-COPY package.json ./
+COPY --from=deps /app/apps/api ./apps/api
+COPY --from=build /app/apps/api/dist ./apps/api/dist
+WORKDIR /app/apps/api
 USER app
 EXPOSE 3000
 CMD ["node", "dist/main"]

package/dist/templates/fullstack-nest-svelte/apps/api/src/health/health.controller.ts

@@ -1,4 +1,4 @@
-import { Controller, Get } from "@nestjs/common";
+import { Controller, Get, ServiceUnavailableException } from "@nestjs/common";
 import { InjectDataSource } from "@nestjs/typeorm";
 import { DataSource } from "typeorm";
 
@@ -17,7 +17,7 @@ export class HealthController {
       await this.dataSource.query("SELECT 1");
       return { status: "ready", db: "up" };
     } catch {
-      return { status: "degraded", db: "down" };
+      throw new ServiceUnavailableException({ status: "degraded", db: "down" });
     }
   }
 }

package/dist/templates/fullstack-nest-svelte/apps/web/Dockerfile

@@ -1,22 +1,26 @@
 # syntax=docker/dockerfile:1
-FROM node:20-alpine AS deps
+FROM node:22-alpine AS deps
 WORKDIR /app
-COPY package.json ./
-RUN npm install --no-audit --no-fund
+COPY package.json package-lock.json ./
+COPY apps/api/package.json ./apps/api/package.json
+COPY apps/web/package.json ./apps/web/package.json
+COPY tests/package.json ./tests/package.json
+RUN npm ci --no-audit --no-fund
 
-FROM node:20-alpine AS build
+FROM node:22-alpine AS build
 WORKDIR /app
 COPY --from=deps /app/node_modules ./node_modules
 COPY . .
-RUN npm run build
+RUN npm run build --workspace=apps/web
 
-FROM node:20-alpine AS runtime
+FROM node:22-alpine AS runtime
 WORKDIR /app
 ENV NODE_ENV=production
 RUN addgroup -S app && adduser -S app -G app
-COPY --from=build /app/build ./build
 COPY --from=build /app/node_modules ./node_modules
-COPY package.json ./
+COPY --from=deps /app/apps/web ./apps/web
+COPY --from=build /app/apps/web/build ./apps/web/build
+WORKDIR /app/apps/web
 USER app
 EXPOSE 3000
 CMD ["node", "build"]

package/dist/templates/fullstack-nest-svelte/apps/web/src/lib/server/api.ts

@@ -1,14 +1,16 @@
 import type { RequestEvent } from "@sveltejs/kit";
 import { createApiClient, type ApiClient } from "@podosoft/podokit-api-client";
-import { backendBaseUrl } from "./backend-proxy";
+import { backendBaseUrl, normalizeClientIp } from "./backend-proxy";
 
 // Server-side client for load functions and hooks: points at the internal
 // backend URL and forwards the incoming request's cookies.
 export function serverApiClient(event: RequestEvent): ApiClient {
   const cookie = event.request.headers.get("cookie") ?? "";
+  const clientIp = normalizeClientIp(event.getClientAddress());
   const fetchWithCookies: typeof fetch = (input, init) => {
     const headers = new Headers(init?.headers);
     if (cookie) headers.set("cookie", cookie);
+    if (clientIp) headers.set("x-forwarded-for", clientIp);
     return event.fetch(input, { ...init, headers });
   };
   return createApiClient({

package/dist/templates/fullstack-nest-svelte/apps/web/src/lib/server/backend-proxy.ts

@@ -12,7 +12,7 @@ export function backendBaseUrl(): string {
 // IPv4 as-is but anonymizes IPv6 (masks the host bits), so an IPv6 loopback would
 // be recorded as "::" — map loopback to 127.0.0.1 for a clean local value, and
 // unwrap IPv4-mapped addresses.
-function normalizeClientIp(address: string | undefined): string | undefined {
+export function normalizeClientIp(address: string | undefined): string | undefined {
   if (!address) return undefined;
   if (address === "::1" || address === "::") return "127.0.0.1";
   if (address.startsWith("::ffff:")) return address.slice("::ffff:".length);

package/dist/templates/fullstack-nest-svelte/compose.dev.yaml

@@ -48,6 +48,10 @@ services:
     environment:
       - VITE_DOCKER=1
       - BACKEND_INTERNAL_URL=http://api:5002
+      # One trusted Traefik proxy sits in front of SvelteKit. This keeps
+      # getClientAddress() tied to the visitor instead of the proxy container.
+      - ADDRESS_HEADER=x-forwarded-for
+      - XFF_DEPTH=1
       # Match Traefik's published port so HMR's WebSocket targets the right port
       # (default 80). Without this, HMR connects to :80 and a non-80 stack falls
       # back to a full page reload on every edit.

package/dist/templates/fullstack-nest-svelte/infra/k3s/configmap.yaml

@@ -8,3 +8,5 @@ data:
   PORT: "3000"
   CORS_ORIGIN: "https://example.com"
   BACKEND_INTERNAL_URL: "http://api:3000"
+  ADDRESS_HEADER: "x-forwarded-for"
+  XFF_DEPTH: "1"

package/dist/templates/fullstack-nest-svelte/package.json

@@ -3,7 +3,7 @@
   "version": "0.0.0",
   "private": true,
   "engines": {
-    "node": ">=20"
+    "node": ">=22.22.1"
   },
   "workspaces": [
     "apps/*",

package/dist/templates/modules/admin-dashboard/files/apps/web/src/hooks.server.ts

@@ -5,6 +5,14 @@ import { applySearchIndexingHeaders } from "$lib/server/search-indexing";
 import type { SiteSettings } from "$lib/site.svelte";
 
 export const handle: Handle = async ({ event, resolve }) => {
+  // Static assets and API proxy requests do not render application layouts.
+  // Avoid multiplying settings/session API calls for every asset and proxied
+  // request; page and data routes still receive the complete runtime context.
+  if (event.route.id === null || event.url.pathname.startsWith("/api/")) {
+    const response = await resolve(event);
+    return applySearchIndexingHeaders(response, event.url.pathname);
+  }
+
   // Public site settings (branding, locale/timezone defaults, maintenance, …),
   // loaded once here and reused by the layout load. A visitor with no locale
   // cookie falls back to the admin-configured site locale, then the app default.

package/dist/templates/modules/admin-dashboard/files/tests/ui/appearance.ui.spec.ts

@@ -5,14 +5,15 @@ import { ready } from "../helpers/hydration";
 // own "Appearance" settings tab.
 async function openAppearance(page: import("@playwright/test").Page): Promise<void> {
   await ready(page, "/admin/settings");
-  await page.getByRole("tab", { name: "Appearance" }).click();
+  const tab = page.getByRole("tab", { name: "Appearance" });
+  await expect(async () => {
+    await tab.click();
+    await expect(tab).toHaveAttribute("data-state", "active");
+  }).toPass();
 }
 
 test("appearance: has its own tab with theme controls @smoke", async ({ page }) => {
-  await ready(page, "/admin/settings");
-  await expect(page.getByRole("tab", { name: "Appearance" })).toBeVisible();
-  await page.getByRole("tab", { name: "Appearance" }).click();
-  await expect(page.getByRole("heading", { name: "Appearance" })).toBeVisible();
+  await openAppearance(page);
   await expect(page.getByRole("heading", { name: "Featured themes" })).toBeVisible();
   await expect(page.getByRole("button", { name: "Default", exact: true })).toBeVisible();
   await expect(page.getByRole("button", { name: "Violet" })).toBeVisible();

package/dist/templates/modules/admin-dashboard/files/tests/ui/general-effects.ui.spec.ts

@@ -8,12 +8,23 @@ import { ready } from "../helpers/hydration";
 // toggle-then-restore pattern safe for the rest of the suite; restores run in a
 // `finally` so a mid-test failure still leaves the shared site settings clean.
 
-async function saveGeneral(page: Page): Promise<void> {
-  const saved = page.waitForResponse(
-    (response) => response.url().endsWith("/api/site/settings") && response.request().method() === "PUT",
-  );
-  await page.getByRole("button", { name: "Save changes" }).click();
-  expect((await saved).ok()).toBeTruthy();
+async function saveGeneral(
+  page: Page,
+  prepare?: () => Promise<void>,
+  expected?: Record<string, string>,
+): Promise<void> {
+  const button = page.getByRole("button", { name: "Save changes" });
+  await expect(async () => {
+    await prepare?.();
+    const saved = page.waitForResponse(
+      (response) => response.url().endsWith("/api/site/settings") && response.request().method() === "PUT",
+      { timeout: 3_000 },
+    );
+    await button.click();
+    const response = await saved;
+    expect(response.ok()).toBeTruthy();
+    if (expected) expect(await response.json()).toMatchObject(expected);
+  }).toPass({ timeout: 10_000 });
   await expect(page.getByText("General settings saved.").last()).toBeVisible();
 }
 
@@ -24,9 +35,14 @@ test("general: footer text and links render on public pages @smoke", async ({ pa
   const support = page.getByLabel("Support email");
   const origFooter = await footer.inputValue();
   const origSupport = await support.inputValue();
-  await footer.fill("© 2026 PodoKit Test");
-  await support.fill("help@example.com");
-  await saveGeneral(page);
+  await saveGeneral(
+    page,
+    async () => {
+      await footer.fill("© 2026 PodoKit Test");
+      await support.fill("help@example.com");
+    },
+    { footerText: "© 2026 PodoKit Test", supportEmail: "help@example.com" },
+  );
   try {
     const ctx = await browser.newContext({ storageState: anonState });
     const anon = await ctx.newPage();
@@ -36,9 +52,14 @@ test("general: footer text and links render on public pages @smoke", async ({ pa
     await ctx.close();
   } finally {
     await ready(page, "/admin/settings");
-    await page.getByLabel("Footer text").fill(origFooter);
-    await page.getByLabel("Support email").fill(origSupport);
-    await saveGeneral(page);
+    await saveGeneral(
+      page,
+      async () => {
+        await page.getByLabel("Footer text").fill(origFooter);
+        await page.getByLabel("Support email").fill(origSupport);
+      },
+      { footerText: origFooter, supportEmail: origSupport },
+    );
   }
 });
 

package/dist/templates/modules/admin-dashboard/files/tests/ui/settings.ui.spec.ts

@@ -56,8 +56,8 @@ test("sidebar: back-to-home link returns to the landing page @smoke", async ({ p
   // the home link lives in the sidebar footer, above the user menu
   await page.getByRole("link", { name: "Back to home" }).click();
   await expect(page).toHaveURL(/\/$/);
-  // The starter landing route is app-owned and remains intact when the module is added.
-  await expect(page.getByRole("heading", { name: "app" })).toBeVisible();
+  // Landing routes are app-owned, so only verify the shared page shell.
+  await expect(page.locator("main").first()).toBeVisible();
 });
 
 test("settings is reachable from the sidebar @smoke", async ({ page }) => {

package/dist/templates/modules/auth/files/apps/api/src/health/health.controller.ts

@@ -1,4 +1,4 @@
-import { Controller, Get } from "@nestjs/common";
+import { Controller, Get, ServiceUnavailableException } from "@nestjs/common";
 import { InjectDataSource } from "@nestjs/typeorm";
 import { DataSource } from "typeorm";
 import { Public } from "@thallesp/nestjs-better-auth";
@@ -20,7 +20,7 @@ export class HealthController {
       await this.dataSource.query("SELECT 1");
       return { status: "ready", db: "up" };
     } catch {
-      return { status: "degraded", db: "down" };
+      throw new ServiceUnavailableException({ status: "degraded", db: "down" });
     }
   }
 }

package/dist/templates/modules/auth/files/apps/api/src/migrate.ts

@@ -0,0 +1,22 @@
+import { getMigrations } from "better-auth/db/migration";
+import { auth } from "./auth/auth";
+import { pool } from "./auth/db";
+import dataSource from "./database/data-source";
+
+async function runMigrations(): Promise<void> {
+  const authMigrations = await getMigrations(auth.options);
+  await authMigrations.runMigrations();
+
+  await dataSource.initialize();
+  await dataSource.runMigrations();
+}
+
+runMigrations()
+  .catch((error: unknown) => {
+    console.error("Run database migrations failed", error);
+    process.exitCode = 1;
+  })
+  .finally(async (): Promise<void> => {
+    if (dataSource.isInitialized) await dataSource.destroy();
+    await pool.end();
+  });

package/dist/templates/modules/auth/module.manifest.json

@@ -16,6 +16,9 @@
   "devDependencies": {
     "@types/pg": "^8.11.10"
   },
+  "scripts": {
+    "migrate:all": "node dist/migrate"
+  },
   "env": [
     "# \u2500\u2500 Auth (better-auth) \u2014 the only required secrets \u2500\u2500",
     "# BETTER_AUTH_SECRET also derives the key that encrypts config secrets stored in the",
@@ -101,13 +104,14 @@
       "file": "AGENTS.md",
       "marker": "<!-- podokit:end:agents-modules -->",
       "optional": true,
-      "text": "### auth (better-auth)\n- The API is **secure by default**: every route needs a session except `/health` and `/api/auth/*`. Opt a route out with `@Public()`; read the user with `@Session()`.\n- Configure OAuth providers, SMTP, and the server toggles on the admin **Settings** page (DB-backed, applied live \u2014 not via env). Only `BETTER_AUTH_SECRET` and `BETTER_AUTH_URL` are required env vars.\n- Create the auth tables: `npx @better-auth/cli migrate -y --config apps/api/src/auth/auth.ts`.\n"
+      "text": "### auth (better-auth)\n- The API is **secure by default**: every route needs a session except `/health` and `/api/auth/*`. Opt a route out with `@Public()`; read the user with `@Session()`.\n- Configure OAuth providers, SMTP, and the server toggles on the admin **Settings** page (DB-backed, applied live \u2014 not via env). Only `BETTER_AUTH_SECRET` and `BETTER_AUTH_URL` are required env vars.\n- Development setup: create auth tables with `npx @better-auth/cli migrate -y --config apps/api/src/auth/auth.ts`, then run TypeORM migrations. Production images can run both from compiled output with `npm run migrate:all`.\n"
     }
   ],
   "instructions": [
     "Set BETTER_AUTH_SECRET in .env (>= 32 chars). This also derives the key that encrypts config secrets stored in the DB, so keep it stable and secret.",
     "Create the auth tables:  npx @better-auth/cli migrate -y --config apps/api/src/auth/auth.ts",
     "Create the app tables (auth_config, app_setting):  npm run migration:run",
+    "After building a production image, run all Better Auth and TypeORM migrations:  npm run migrate:all",
     "Sign up:  curl -c cookies.txt -XPOST localhost:5002/api/auth/sign-up/email -H 'content-type: application/json' -d '{\"email\":\"a@example.com\",\"password\":\"password123\",\"name\":\"A\"}'",
     "Call a protected route with the session:  curl -b cookies.txt localhost:5002/account/me",
     "Everything is protected by default; mark public routes with @Public(). Configure OAuth (Google/GitHub), SMTP, and server-enforced toggles on the admin Settings page \u2014 stored encrypted in the DB and applied live (no restart). Environment variables (GOOGLE_CLIENT_*, SMTP_*, AUTH_*) still work as an optional fallback/override."

package/dist/templates/modules/bullmq/files/infra/docker/worker.compose.example.yml

@@ -8,7 +8,8 @@
 services:
   worker:
     build:
-      context: ../../apps/api
+      context: ../..
+      dockerfile: apps/api/Dockerfile
     command: ["node", "dist/main-worker"]
     environment:
       REDIS_HOST: redis

package/dist/templates/modules/rate-limit/files/apps/api/src/rate-limit/rate-limit.module.ts

@@ -1,11 +1,50 @@
-import { Module } from "@nestjs/common";
+import { Injectable, Module } from "@nestjs/common";
 import { APP_GUARD } from "@nestjs/core";
-import { ThrottlerGuard, ThrottlerModule } from "@nestjs/throttler";
+import {
+  ThrottlerGuard,
+  ThrottlerModule,
+  type ThrottlerRequest,
+} from "@nestjs/throttler";
 import { ThrottlerStorageRedisService } from "@nest-lab/throttler-storage-redis";
 import Redis from "ioredis";
 
 const ttlSeconds = Number(process.env.RATE_LIMIT_TTL ?? 60);
 const limit = Number(process.env.RATE_LIMIT_MAX ?? 100);
+const runtimeLimit = Number(process.env.RATE_LIMIT_RUNTIME_MAX ?? 1000);
+const unthrottledHealthPaths = new Set(["/health", "/health/ready"]);
+
+function forwardedClient(headers: unknown): string | undefined {
+  if (!headers || typeof headers !== "object") return undefined;
+  const value = (headers as Record<string, unknown>)["x-forwarded-for"];
+  const first = Array.isArray(value) ? value[0] : value;
+  if (typeof first !== "string") return undefined;
+  return first.split(",")[0]?.trim() || undefined;
+}
+
+// PodoKit exposes the API through its web proxy, which replaces x-forwarded-for
+// with SvelteKit's resolved client address. Track that address instead of the
+// web container so unrelated visitors do not share one global counter.
+@Injectable()
+class ProxyAwareThrottlerGuard extends ThrottlerGuard {
+  protected override handleRequest(requestProps: ThrottlerRequest): Promise<boolean> {
+    const { req } = this.getRequestResponse(requestProps.context);
+    const method = typeof req.method === "string" ? req.method : "";
+    const path = typeof req.path === "string" ? req.path : "";
+    if (method === "GET" && unthrottledHealthPaths.has(path)) {
+      return Promise.resolve(true);
+    }
+    if (method === "GET" && path === "/site/settings") {
+      return super.handleRequest({ ...requestProps, limit: runtimeLimit });
+    }
+    return super.handleRequest(requestProps);
+  }
+
+  protected override getTracker(request: Record<string, unknown>): Promise<string> {
+    const forwarded = forwardedClient(request.headers);
+    const direct = typeof request.ip === "string" ? request.ip : "unknown";
+    return Promise.resolve(forwarded ?? direct);
+  }
+}
 
 // Distributed rate limiting: the counter lives in Redis, so the limit holds
 // across API replicas. Registers a global guard (429 when exceeded).
@@ -21,6 +60,6 @@ const limit = Number(process.env.RATE_LIMIT_MAX ?? 100);
       ),
     }),
   ],
-  providers: [{ provide: APP_GUARD, useClass: ThrottlerGuard }],
+  providers: [{ provide: APP_GUARD, useClass: ProxyAwareThrottlerGuard }],
 })
 export class RateLimitModule {}

package/dist/templates/modules/rate-limit/files/tests/api/rate-limit.api.spec.ts

@@ -13,19 +13,28 @@ const origin = { origin: base };
 // to the module default and allow a little headroom.
 const limit = Number(process.env.RATE_LIMIT_MAX ?? 100);
 
-test("rate limit: exceeding the window returns 429 @smoke", async ({ playwright }) => {
+test("rate limit: health probes stay available while ordinary routes return 429 @smoke", async ({
+  playwright,
+}) => {
   const ctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
-  // /health is public — no session needed. If the first hit is a 5xx the
-  // throttler's Redis backing isn't reachable; nothing to assert.
-  const probe = await ctx.get("/api/health");
+  for (const path of ["/api/health", "/api/health/ready"]) {
+    for (let i = 0; i < limit + 5; i++) {
+      const response = await ctx.get(path);
+      expect(response.status(), `${path} request ${i + 1}`).toBe(200);
+    }
+  }
+
+  // The redis module is added automatically and exposes a public demo cache
+  // route, so it provides a stable ordinary endpoint for the global limit.
+  const probe = await ctx.get("/api/cache/rate-limit-probe");
   test.skip(probe.status() >= 500, "throttler storage (redis) not reachable");
 
   let seen200 = probe.status() === 200;
   let got429 = false;
   for (let i = 0; i < limit + 5 && !got429; i++) {
-    const r = await ctx.get("/api/health");
-    if (r.status() === 200) seen200 = true;
-    if (r.status() === 429) got429 = true;
+    const response = await ctx.get("/api/cache/rate-limit-probe");
+    if (response.status() === 200) seen200 = true;
+    if (response.status() === 429) got429 = true;
   }
   // A fresh window serves the first requests (200) and rejects once the limit is
   // crossed (429).

package/dist/templates/modules/rate-limit/module.manifest.json

@@ -10,7 +10,9 @@
   "env": [
     "# rate limit (window in seconds, max requests per window per client)",
     "RATE_LIMIT_TTL=60",
-    "RATE_LIMIT_MAX=100"
+    "RATE_LIMIT_MAX=100",
+    "# higher ceiling for SSR runtime settings reads (maintenance, sign-up, branding)",
+    "RATE_LIMIT_RUNTIME_MAX=1000"
   ],
   "inject": [
     { "file": "apps/api/src/app.module.ts", "marker": "// podokit:end:imports", "text": "import { RateLimitModule } from \"./rate-limit/rate-limit.module\";" },
@@ -18,8 +20,10 @@
   ],
   "instructions": [
     "Ensure Redis is running:  docker compose -f infra/docker/docker-compose.yml up -d",
-    "Tune RATE_LIMIT_TTL / RATE_LIMIT_MAX in .env.",
+    "Tune RATE_LIMIT_TTL / RATE_LIMIT_MAX / RATE_LIMIT_RUNTIME_MAX in .env.",
     "Exceeding the limit returns HTTP 429. Skip a route with @SkipThrottle() or tune it with @Throttle().",
-    "The limit is shared across API replicas because it is stored in Redis."
+    "GET /health and GET /health/ready bypass request quotas so orchestrator probes remain reliable.",
+    "The limit is shared across API replicas because it is stored in Redis.",
+    "PodoKit's web proxy forwards the resolved client address, so visitors receive independent counters."
   ]
 }

package/dist/templates/todo/apps/api/Dockerfile

@@ -1,22 +1,26 @@
 # syntax=docker/dockerfile:1
-FROM node:20-alpine AS deps
+FROM node:22-alpine AS deps
 WORKDIR /app
-COPY package.json ./
-RUN npm install --omit=dev=false --no-audit --no-fund
+COPY package.json package-lock.json ./
+COPY apps/api/package.json ./apps/api/package.json
+COPY apps/web/package.json ./apps/web/package.json
+COPY tests/package.json ./tests/package.json
+RUN npm ci --no-audit --no-fund
 
-FROM node:20-alpine AS build
+FROM node:22-alpine AS build
 WORKDIR /app
 COPY --from=deps /app/node_modules ./node_modules
 COPY . .
-RUN npm run build
+RUN npm run build --workspace=apps/api
 
-FROM node:20-alpine AS runtime
+FROM node:22-alpine AS runtime
 WORKDIR /app
 ENV NODE_ENV=production
 RUN addgroup -S app && adduser -S app -G app
-COPY --from=build /app/dist ./dist
 COPY --from=build /app/node_modules ./node_modules
-COPY package.json ./
+COPY --from=deps /app/apps/api ./apps/api
+COPY --from=build /app/apps/api/dist ./apps/api/dist
+WORKDIR /app/apps/api
 USER app
 EXPOSE 3000
 CMD ["node", "dist/main"]

package/dist/templates/todo/apps/api/src/health/health.controller.ts

@@ -1,4 +1,4 @@
-import { Controller, Get } from "@nestjs/common";
+import { Controller, Get, ServiceUnavailableException } from "@nestjs/common";
 import { InjectDataSource } from "@nestjs/typeorm";
 import { DataSource } from "typeorm";
 
@@ -17,7 +17,7 @@ export class HealthController {
       await this.dataSource.query("SELECT 1");
       return { status: "ready", db: "up" };
     } catch {
-      return { status: "degraded", db: "down" };
+      throw new ServiceUnavailableException({ status: "degraded", db: "down" });
     }
   }
 }

package/dist/templates/todo/apps/web/Dockerfile

@@ -1,22 +1,26 @@
 # syntax=docker/dockerfile:1
-FROM node:20-alpine AS deps
+FROM node:22-alpine AS deps
 WORKDIR /app
-COPY package.json ./
-RUN npm install --no-audit --no-fund
+COPY package.json package-lock.json ./
+COPY apps/api/package.json ./apps/api/package.json
+COPY apps/web/package.json ./apps/web/package.json
+COPY tests/package.json ./tests/package.json
+RUN npm ci --no-audit --no-fund
 
-FROM node:20-alpine AS build
+FROM node:22-alpine AS build
 WORKDIR /app
 COPY --from=deps /app/node_modules ./node_modules
 COPY . .
-RUN npm run build
+RUN npm run build --workspace=apps/web
 
-FROM node:20-alpine AS runtime
+FROM node:22-alpine AS runtime
 WORKDIR /app
 ENV NODE_ENV=production
 RUN addgroup -S app && adduser -S app -G app
-COPY --from=build /app/build ./build
 COPY --from=build /app/node_modules ./node_modules
-COPY package.json ./
+COPY --from=deps /app/apps/web ./apps/web
+COPY --from=build /app/apps/web/build ./apps/web/build
+WORKDIR /app/apps/web
 USER app
 EXPOSE 3000
 CMD ["node", "build"]

package/dist/templates/todo/apps/web/src/lib/server/api.ts

@@ -1,14 +1,16 @@
 import type { RequestEvent } from "@sveltejs/kit";
 import { createApiClient, type ApiClient } from "@podosoft/podokit-api-client";
-import { backendBaseUrl } from "./backend-proxy";
+import { backendBaseUrl, normalizeClientIp } from "./backend-proxy";
 
 // Server-side client for load functions and hooks: points at the internal
 // backend URL and forwards the incoming request's cookies.
 export function serverApiClient(event: RequestEvent): ApiClient {
   const cookie = event.request.headers.get("cookie") ?? "";
+  const clientIp = normalizeClientIp(event.getClientAddress());
   const fetchWithCookies: typeof fetch = (input, init) => {
     const headers = new Headers(init?.headers);
     if (cookie) headers.set("cookie", cookie);
+    if (clientIp) headers.set("x-forwarded-for", clientIp);
     return event.fetch(input, { ...init, headers });
   };
   return createApiClient({

package/dist/templates/todo/apps/web/src/lib/server/backend-proxy.ts

@@ -12,7 +12,7 @@ export function backendBaseUrl(): string {
 // IPv4 as-is but anonymizes IPv6 (masks the host bits), so an IPv6 loopback would
 // be recorded as "::" — map loopback to 127.0.0.1 for a clean local value, and
 // unwrap IPv4-mapped addresses.
-function normalizeClientIp(address: string | undefined): string | undefined {
+export function normalizeClientIp(address: string | undefined): string | undefined {
   if (!address) return undefined;
   if (address === "::1" || address === "::") return "127.0.0.1";
   if (address.startsWith("::ffff:")) return address.slice("::ffff:".length);

package/dist/templates/todo/compose.dev.yaml

@@ -48,6 +48,10 @@ services:
     environment:
       - VITE_DOCKER=1
       - BACKEND_INTERNAL_URL=http://api:5002
+      # One trusted Traefik proxy sits in front of SvelteKit. This keeps
+      # getClientAddress() tied to the visitor instead of the proxy container.
+      - ADDRESS_HEADER=x-forwarded-for
+      - XFF_DEPTH=1
       # Match Traefik's published port so HMR's WebSocket targets the right port
       # (default 80). Without this, HMR connects to :80 and a non-80 stack falls
       # back to a full page reload on every edit.

package/dist/templates/todo/infra/k3s/configmap.yaml

@@ -8,3 +8,5 @@ data:
   PORT: "3000"
   CORS_ORIGIN: "https://example.com"
   BACKEND_INTERNAL_URL: "http://api:3000"
+  ADDRESS_HEADER: "x-forwarded-for"
+  XFF_DEPTH: "1"

package/dist/templates/todo/package.json

@@ -3,7 +3,7 @@
   "version": "0.0.0",
   "private": true,
   "engines": {
-    "node": ">=20"
+    "node": ">=22.22.1"
   },
   "workspaces": [
     "apps/*",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@podosoft/podokit",
-  "version": "0.10.0",
+  "version": "0.10.2",
   "description": "An opinionated but extensible starter toolkit and CLI for full-stack TypeScript apps with NestJS, SvelteKit, TailwindCSS, shadcn-svelte, Docker, and k3s.",
   "license": "Apache-2.0",
   "repository": {