@podosoft/podokit 0.9.0 → 0.10.1

package/dist/templates/modules/bullmq/files/infra/docker/worker.compose.example.yml

@@ -8,7 +8,8 @@
 services:
   worker:
     build:
-      context: ../../apps/api
+      context: ../..
+      dockerfile: apps/api/Dockerfile
     command: ["node", "dist/main-worker"]
     environment:
       REDIS_HOST: redis

package/dist/templates/modules/bullmq/files/tests/api/jobs.api.spec.ts

@@ -0,0 +1,38 @@
+import { expect, test } from "@playwright/test";
+
+const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
+const origin = { origin: base };
+
+async function session(playwright: import("@playwright/test").PlaywrightWorkerArgs["playwright"]) {
+  const ctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  const email = `jobs-${Date.now()}-${Math.random().toString(36).slice(2, 8)}@example.com`;
+  await ctx.post("/api/auth/sign-up/email", { data: { email, password: "Podokit3e-Str0ng!pw", name: "J" } }).catch(() => undefined);
+  return ctx;
+}
+
+test("bullmq: enqueue a job, read its status, 404 for unknown @smoke", async ({ playwright }) => {
+  const ctx = await session(playwright);
+  const res = await ctx.post("/api/jobs", { data: { text: "hello" } });
+  test.skip(res.status() >= 500, "redis not reachable");
+  expect(res.ok()).toBeTruthy();
+  const { id } = await res.json();
+  expect(typeof id).toBe("string");
+
+  const status = await (await ctx.get(`/api/jobs/${id}`)).json();
+  expect(["waiting", "active", "completed", "delayed", "prioritized", "waiting-children"]).toContain(status.state);
+
+  const missing = await ctx.get(`/api/jobs/does-not-exist-${Date.now()}`);
+  expect(missing.status()).toBe(404);
+
+  // When a worker is running, the demo job completes with an uppercased result;
+  // without a worker it stays waiting (this stays green either way).
+  let final = status.state;
+  const deadline = Date.now() + 6000;
+  while (Date.now() < deadline && final !== "completed") {
+    const s = await (await ctx.get(`/api/jobs/${id}`)).json();
+    final = s.state;
+    if (final === "completed") expect(s.result).toMatchObject({ upper: "HELLO" });
+    else await new Promise((r) => setTimeout(r, 400));
+  }
+  await ctx.dispose();
+});

package/dist/templates/modules/file-upload/files/tests/api/files.api.spec.ts

@@ -0,0 +1,31 @@
+import { expect, test } from "@playwright/test";
+
+const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
+const origin = { origin: base };
+
+async function session(playwright: import("@playwright/test").PlaywrightWorkerArgs["playwright"]) {
+  const ctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  const email = `files-${Date.now()}-${Math.random().toString(36).slice(2, 8)}@example.com`;
+  await ctx.post("/api/auth/sign-up/email", { data: { email, password: "Podokit3e-Str0ng!pw", name: "F" } }).catch(() => undefined);
+  return ctx;
+}
+
+test("file upload: multipart upload returns a key and url @smoke", async ({ playwright }) => {
+  const ctx = await session(playwright);
+  const res = await ctx.post("/api/files", {
+    multipart: { file: { name: "hello.txt", mimeType: "text/plain", buffer: Buffer.from("hi there") } },
+  });
+  test.skip(res.status() >= 500, "object storage (MinIO/S3) not reachable");
+  expect(res.ok()).toBeTruthy();
+  const body = await res.json();
+  expect(typeof body.key).toBe("string");
+  expect(String(body.url)).toContain("http");
+  await ctx.dispose();
+});
+
+test("file upload: a request with no file is a 400 @smoke", async ({ playwright }) => {
+  const ctx = await session(playwright);
+  const res = await ctx.post("/api/files", { multipart: { notfile: "x" } });
+  expect(res.status()).toBe(400);
+  await ctx.dispose();
+});

package/dist/templates/modules/job-progress/files/tests/api/progress.api.spec.ts

@@ -0,0 +1,22 @@
+import { expect, test } from "@playwright/test";
+
+const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
+const origin = { origin: base };
+
+async function session(playwright: import("@playwright/test").PlaywrightWorkerArgs["playwright"]) {
+  const ctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  const email = `progress-${Date.now()}-${Math.random().toString(36).slice(2, 8)}@example.com`;
+  await ctx.post("/api/auth/sign-up/email", { data: { email, password: "Podokit3e-Str0ng!pw", name: "P" } }).catch(() => undefined);
+  return ctx;
+}
+
+// The end-to-end progress stream (worker → Redis pub/sub → SSE) needs the worker
+// process running; this asserts the API contract (a job is enqueued).
+test("job-progress: starting a job returns a job id @smoke", async ({ playwright }) => {
+  const ctx = await session(playwright);
+  const res = await ctx.post("/api/progress", { data: { steps: 3 } });
+  test.skip(res.status() >= 500, "redis not reachable");
+  expect(res.ok()).toBeTruthy();
+  expect(typeof (await res.json()).jobId).toBe("string");
+  await ctx.dispose();
+});

package/dist/templates/modules/object-storage-s3/files/tests/api/storage.api.spec.ts

@@ -0,0 +1,28 @@
+import { expect, test } from "@playwright/test";
+
+const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
+const origin = { origin: base };
+
+async function session(playwright: import("@playwright/test").PlaywrightWorkerArgs["playwright"]) {
+  const ctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  const email = `storage-${Date.now()}-${Math.random().toString(36).slice(2, 8)}@example.com`;
+  await ctx.post("/api/auth/sign-up/email", { data: { email, password: "Podokit3e-Str0ng!pw", name: "S" } }).catch(() => undefined);
+  return ctx;
+}
+
+test("object storage: put, get, and presign @smoke", async ({ playwright }) => {
+  const ctx = await session(playwright);
+  const key = `obj-${Date.now()}`;
+  const put = await ctx.put(`/api/storage/${key}`, { data: { content: "hello world" } });
+  test.skip(put.status() >= 500, "object storage (MinIO/S3) not reachable");
+  expect(put.ok()).toBeTruthy();
+  expect(await put.json()).toMatchObject({ key });
+
+  const got = await (await ctx.get(`/api/storage/${key}`)).json();
+  expect(got).toMatchObject({ key, content: "hello world" });
+
+  const pre = await (await ctx.get(`/api/storage/${key}/presigned`)).json();
+  expect(String(pre.url)).toContain(key);
+
+  await ctx.dispose();
+});

package/dist/templates/modules/rate-limit/files/apps/api/src/rate-limit/rate-limit.module.ts

@@ -1,11 +1,46 @@
-import { Module } from "@nestjs/common";
+import { Injectable, Module } from "@nestjs/common";
 import { APP_GUARD } from "@nestjs/core";
-import { ThrottlerGuard, ThrottlerModule } from "@nestjs/throttler";
+import {
+  ThrottlerGuard,
+  ThrottlerModule,
+  type ThrottlerRequest,
+} from "@nestjs/throttler";
 import { ThrottlerStorageRedisService } from "@nest-lab/throttler-storage-redis";
 import Redis from "ioredis";
 
 const ttlSeconds = Number(process.env.RATE_LIMIT_TTL ?? 60);
 const limit = Number(process.env.RATE_LIMIT_MAX ?? 100);
+const runtimeLimit = Number(process.env.RATE_LIMIT_RUNTIME_MAX ?? 1000);
+
+function forwardedClient(headers: unknown): string | undefined {
+  if (!headers || typeof headers !== "object") return undefined;
+  const value = (headers as Record<string, unknown>)["x-forwarded-for"];
+  const first = Array.isArray(value) ? value[0] : value;
+  if (typeof first !== "string") return undefined;
+  return first.split(",")[0]?.trim() || undefined;
+}
+
+// PodoKit exposes the API through its web proxy, which replaces x-forwarded-for
+// with SvelteKit's resolved client address. Track that address instead of the
+// web container so unrelated visitors do not share one global counter.
+@Injectable()
+class ProxyAwareThrottlerGuard extends ThrottlerGuard {
+  protected override handleRequest(requestProps: ThrottlerRequest): Promise<boolean> {
+    const { req } = this.getRequestResponse(requestProps.context);
+    const method = typeof req.method === "string" ? req.method : "";
+    const path = typeof req.path === "string" ? req.path : "";
+    if (method === "GET" && path === "/site/settings") {
+      return super.handleRequest({ ...requestProps, limit: runtimeLimit });
+    }
+    return super.handleRequest(requestProps);
+  }
+
+  protected override getTracker(request: Record<string, unknown>): Promise<string> {
+    const forwarded = forwardedClient(request.headers);
+    const direct = typeof request.ip === "string" ? request.ip : "unknown";
+    return Promise.resolve(forwarded ?? direct);
+  }
+}
 
 // Distributed rate limiting: the counter lives in Redis, so the limit holds
 // across API replicas. Registers a global guard (429 when exceeded).
@@ -21,6 +56,6 @@ const limit = Number(process.env.RATE_LIMIT_MAX ?? 100);
       ),
     }),
   ],
-  providers: [{ provide: APP_GUARD, useClass: ThrottlerGuard }],
+  providers: [{ provide: APP_GUARD, useClass: ProxyAwareThrottlerGuard }],
 })
 export class RateLimitModule {}

package/dist/templates/modules/rate-limit/files/tests/api/rate-limit.api.spec.ts

@@ -0,0 +1,35 @@
+import { expect, test } from "@playwright/test";
+
+const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
+const origin = { origin: base };
+
+// rate-limit installs a global throttler guard (default RATE_LIMIT_MAX requests
+// per RATE_LIMIT_TTL seconds, per client). This module ships a global guard, so
+// it never joins the shared Outer smoke app (it would throttle every other
+// spec); this spec ships with the module and runs against a dedicated app.
+//
+// Honor RATE_LIMIT_MAX when the test runner has it (a dedicated app sets a small
+// value so the window is crossed in a handful of requests); otherwise fall back
+// to the module default and allow a little headroom.
+const limit = Number(process.env.RATE_LIMIT_MAX ?? 100);
+
+test("rate limit: exceeding the window returns 429 @smoke", async ({ playwright }) => {
+  const ctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  // /health is public — no session needed. If the first hit is a 5xx the
+  // throttler's Redis backing isn't reachable; nothing to assert.
+  const probe = await ctx.get("/api/health");
+  test.skip(probe.status() >= 500, "throttler storage (redis) not reachable");
+
+  let seen200 = probe.status() === 200;
+  let got429 = false;
+  for (let i = 0; i < limit + 5 && !got429; i++) {
+    const r = await ctx.get("/api/health");
+    if (r.status() === 200) seen200 = true;
+    if (r.status() === 429) got429 = true;
+  }
+  // A fresh window serves the first requests (200) and rejects once the limit is
+  // crossed (429).
+  expect(seen200).toBe(true);
+  expect(got429).toBe(true);
+  await ctx.dispose();
+});

package/dist/templates/modules/rate-limit/module.manifest.json

@@ -10,7 +10,9 @@
   "env": [
     "# rate limit (window in seconds, max requests per window per client)",
     "RATE_LIMIT_TTL=60",
-    "RATE_LIMIT_MAX=100"
+    "RATE_LIMIT_MAX=100",
+    "# higher ceiling for SSR runtime settings reads (maintenance, sign-up, branding)",
+    "RATE_LIMIT_RUNTIME_MAX=1000"
   ],
   "inject": [
     { "file": "apps/api/src/app.module.ts", "marker": "// podokit:end:imports", "text": "import { RateLimitModule } from \"./rate-limit/rate-limit.module\";" },
@@ -18,8 +20,9 @@
   ],
   "instructions": [
     "Ensure Redis is running:  docker compose -f infra/docker/docker-compose.yml up -d",
-    "Tune RATE_LIMIT_TTL / RATE_LIMIT_MAX in .env.",
+    "Tune RATE_LIMIT_TTL / RATE_LIMIT_MAX / RATE_LIMIT_RUNTIME_MAX in .env.",
     "Exceeding the limit returns HTTP 429. Skip a route with @SkipThrottle() or tune it with @Throttle().",
-    "The limit is shared across API replicas because it is stored in Redis."
+    "The limit is shared across API replicas because it is stored in Redis.",
+    "PodoKit's web proxy forwards the resolved client address, so visitors receive independent counters."
   ]
 }

package/dist/templates/modules/redis/files/tests/api/redis.api.spec.ts

@@ -0,0 +1,30 @@
+import { expect, test } from "@playwright/test";
+
+const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
+const origin = { origin: base };
+
+// Self-contained: sign up + sign in a disposable account so the test works when
+// `auth`'s global guard is installed (the common case). Harmless if the API is open.
+async function session(playwright: import("@playwright/test").PlaywrightWorkerArgs["playwright"]) {
+  const ctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  const email = `redis-${Date.now()}-${Math.random().toString(36).slice(2, 8)}@example.com`;
+  await ctx.post("/api/auth/sign-up/email", { data: { email, password: "Podokit3e-Str0ng!pw", name: "R" } }).catch(() => undefined);
+  return ctx;
+}
+
+test("redis cache: set, get, and miss @smoke", async ({ playwright }) => {
+  const ctx = await session(playwright);
+  const key = `k-${Date.now()}`;
+  const put = await ctx.put(`/api/cache/${key}`, { data: { value: "hello", ttl: 60 } });
+  test.skip(put.status() >= 500, "redis not reachable");
+  expect(put.ok()).toBeTruthy();
+  expect(await put.json()).toMatchObject({ key });
+
+  const got = await (await ctx.get(`/api/cache/${key}`)).json();
+  expect(got).toMatchObject({ key, value: "hello" });
+
+  const miss = await (await ctx.get(`/api/cache/missing-${Date.now()}`)).json();
+  expect(miss.value).toBeNull();
+
+  await ctx.dispose();
+});

package/dist/templates/modules/sse/files/tests/api/events.api.spec.ts

@@ -0,0 +1,46 @@
+import { expect, test } from "@playwright/test";
+
+const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
+const origin = { origin: base };
+
+async function session(playwright: import("@playwright/test").PlaywrightWorkerArgs["playwright"]) {
+  const ctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  const email = `sse-${Date.now()}-${Math.random().toString(36).slice(2, 8)}@example.com`;
+  await ctx.post("/api/auth/sign-up/email", { data: { email, password: "Podokit3e-Str0ng!pw", name: "E" } }).catch(() => undefined);
+  return ctx;
+}
+
+test("sse: publish accepts a message @smoke", async ({ playwright }) => {
+  const ctx = await session(playwright);
+  const pub = await ctx.post("/api/events", { data: { message: `hi-${Date.now()}` } });
+  expect(pub.ok()).toBeTruthy();
+  expect(await pub.json()).toMatchObject({ ok: true });
+  await ctx.dispose();
+});
+
+test("sse: a published message is delivered over the event stream @smoke", async ({ playwright }) => {
+  const ctx = await session(playwright);
+  // The stream is behind the auth guard — carry the session cookie on the raw fetch.
+  const cookies = (await ctx.storageState()).cookies.map((c) => `${c.name}=${c.value}`).join("; ");
+  const ac = new AbortController();
+  const stream = await fetch(`${base}/api/events/stream`, { headers: { ...origin, cookie: cookies }, signal: ac.signal }).catch(() => null);
+  test.skip(!stream || !stream.ok || !stream.body, "sse stream not reachable");
+  expect(stream!.headers.get("content-type")).toContain("text/event-stream");
+
+  // Subscriber is attached now; publish, then read until the message arrives.
+  const msg = `sse-${Date.now()}`;
+  await ctx.post("/api/events", { data: { message: msg } });
+
+  const reader = stream!.body!.getReader();
+  const decoder = new TextDecoder();
+  let seen = false;
+  const deadline = Date.now() + 8000;
+  while (Date.now() < deadline && !seen) {
+    const { value, done } = await reader.read();
+    if (done) break;
+    if (decoder.decode(value).includes(msg)) seen = true;
+  }
+  ac.abort();
+  expect(seen).toBe(true);
+  await ctx.dispose();
+});

package/dist/templates/todo/apps/api/Dockerfile

@@ -1,22 +1,26 @@
 # syntax=docker/dockerfile:1
-FROM node:20-alpine AS deps
+FROM node:22-alpine AS deps
 WORKDIR /app
-COPY package.json ./
-RUN npm install --omit=dev=false --no-audit --no-fund
+COPY package.json package-lock.json ./
+COPY apps/api/package.json ./apps/api/package.json
+COPY apps/web/package.json ./apps/web/package.json
+COPY tests/package.json ./tests/package.json
+RUN npm ci --no-audit --no-fund
 
-FROM node:20-alpine AS build
+FROM node:22-alpine AS build
 WORKDIR /app
 COPY --from=deps /app/node_modules ./node_modules
 COPY . .
-RUN npm run build
+RUN npm run build --workspace=apps/api
 
-FROM node:20-alpine AS runtime
+FROM node:22-alpine AS runtime
 WORKDIR /app
 ENV NODE_ENV=production
 RUN addgroup -S app && adduser -S app -G app
-COPY --from=build /app/dist ./dist
 COPY --from=build /app/node_modules ./node_modules
-COPY package.json ./
+COPY --from=deps /app/apps/api ./apps/api
+COPY --from=build /app/apps/api/dist ./apps/api/dist
+WORKDIR /app/apps/api
 USER app
 EXPOSE 3000
 CMD ["node", "dist/main"]

package/dist/templates/todo/apps/api/src/health/health.controller.ts

@@ -1,4 +1,4 @@
-import { Controller, Get } from "@nestjs/common";
+import { Controller, Get, ServiceUnavailableException } from "@nestjs/common";
 import { InjectDataSource } from "@nestjs/typeorm";
 import { DataSource } from "typeorm";
 
@@ -17,7 +17,7 @@ export class HealthController {
       await this.dataSource.query("SELECT 1");
       return { status: "ready", db: "up" };
     } catch {
-      return { status: "degraded", db: "down" };
+      throw new ServiceUnavailableException({ status: "degraded", db: "down" });
     }
   }
 }

package/dist/templates/todo/apps/web/Dockerfile

@@ -1,22 +1,26 @@
 # syntax=docker/dockerfile:1
-FROM node:20-alpine AS deps
+FROM node:22-alpine AS deps
 WORKDIR /app
-COPY package.json ./
-RUN npm install --no-audit --no-fund
+COPY package.json package-lock.json ./
+COPY apps/api/package.json ./apps/api/package.json
+COPY apps/web/package.json ./apps/web/package.json
+COPY tests/package.json ./tests/package.json
+RUN npm ci --no-audit --no-fund
 
-FROM node:20-alpine AS build
+FROM node:22-alpine AS build
 WORKDIR /app
 COPY --from=deps /app/node_modules ./node_modules
 COPY . .
-RUN npm run build
+RUN npm run build --workspace=apps/web
 
-FROM node:20-alpine AS runtime
+FROM node:22-alpine AS runtime
 WORKDIR /app
 ENV NODE_ENV=production
 RUN addgroup -S app && adduser -S app -G app
-COPY --from=build /app/build ./build
 COPY --from=build /app/node_modules ./node_modules
-COPY package.json ./
+COPY --from=deps /app/apps/web ./apps/web
+COPY --from=build /app/apps/web/build ./apps/web/build
+WORKDIR /app/apps/web
 USER app
 EXPOSE 3000
 CMD ["node", "build"]

package/dist/templates/todo/apps/web/src/lib/components/site-runtime.svelte

@@ -0,0 +1,7 @@
+<script lang="ts">
+  // Modules can replace this managed component with global site behavior while
+  // the surrounding route layout remains application-owned.
+  import { ModeWatcher } from "mode-watcher";
+</script>
+
+<ModeWatcher />

package/dist/templates/todo/apps/web/src/lib/server/api.ts

@@ -1,14 +1,16 @@
 import type { RequestEvent } from "@sveltejs/kit";
 import { createApiClient, type ApiClient } from "@podosoft/podokit-api-client";
-import { backendBaseUrl } from "./backend-proxy";
+import { backendBaseUrl, normalizeClientIp } from "./backend-proxy";
 
 // Server-side client for load functions and hooks: points at the internal
 // backend URL and forwards the incoming request's cookies.
 export function serverApiClient(event: RequestEvent): ApiClient {
   const cookie = event.request.headers.get("cookie") ?? "";
+  const clientIp = normalizeClientIp(event.getClientAddress());
   const fetchWithCookies: typeof fetch = (input, init) => {
     const headers = new Headers(init?.headers);
     if (cookie) headers.set("cookie", cookie);
+    if (clientIp) headers.set("x-forwarded-for", clientIp);
     return event.fetch(input, { ...init, headers });
   };
   return createApiClient({

package/dist/templates/todo/apps/web/src/lib/server/backend-proxy.ts

@@ -12,7 +12,7 @@ export function backendBaseUrl(): string {
 // IPv4 as-is but anonymizes IPv6 (masks the host bits), so an IPv6 loopback would
 // be recorded as "::" — map loopback to 127.0.0.1 for a clean local value, and
 // unwrap IPv4-mapped addresses.
-function normalizeClientIp(address: string | undefined): string | undefined {
+export function normalizeClientIp(address: string | undefined): string | undefined {
   if (!address) return undefined;
   if (address === "::1" || address === "::") return "127.0.0.1";
   if (address.startsWith("::ffff:")) return address.slice("::ffff:".length);
@@ -37,7 +37,9 @@ export async function proxyRequest(
   const upstream = await fetch(targetUrl, {
     method: request.method,
     headers,
-    body: hasBody ? await request.text() : undefined,
+    // Preserve multipart uploads and other binary bodies byte-for-byte. Reading
+    // them as text corrupts bytes that are not valid UTF-8 before forwarding.
+    body: hasBody ? await request.arrayBuffer() : undefined,
     redirect: "manual",
   });
 

package/dist/templates/todo/apps/web/src/routes/+layout.svelte

@@ -1,9 +1,9 @@
 <script lang="ts">
   import "../app.css";
-  import { ModeWatcher } from "mode-watcher";
+  import SiteRuntime from "$lib/components/site-runtime.svelte";
 
   let { children } = $props();
 </script>
 
-<ModeWatcher />
+<SiteRuntime />
 {@render children()}

package/dist/templates/todo/compose.dev.yaml

@@ -48,6 +48,10 @@ services:
     environment:
       - VITE_DOCKER=1
       - BACKEND_INTERNAL_URL=http://api:5002
+      # One trusted Traefik proxy sits in front of SvelteKit. This keeps
+      # getClientAddress() tied to the visitor instead of the proxy container.
+      - ADDRESS_HEADER=x-forwarded-for
+      - XFF_DEPTH=1
       # Match Traefik's published port so HMR's WebSocket targets the right port
       # (default 80). Without this, HMR connects to :80 and a non-80 stack falls
       # back to a full page reload on every edit.

package/dist/templates/todo/dot-gitignore

@@ -12,3 +12,9 @@ build/
 tests/playwright/
 tests/playwright-report/
 tests/test-results/
+playwright/.auth/
+playwright-report/
+test-results/
+
+# local performance reports
+output/lighthouse/

package/dist/templates/todo/infra/k3s/configmap.yaml

@@ -8,3 +8,5 @@ data:
   PORT: "3000"
   CORS_ORIGIN: "https://example.com"
   BACKEND_INTERNAL_URL: "http://api:3000"
+  ADDRESS_HEADER: "x-forwarded-for"
+  XFF_DEPTH: "1"

package/dist/templates/todo/infra/k3s/ingress.yaml

@@ -1,8 +1,18 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: compression
+  namespace: podokit
+spec:
+  compress: {}
+---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   name: app
   namespace: podokit
+  annotations:
+    traefik.ingress.kubernetes.io/router.middlewares: podokit-compression@kubernetescrd
 spec:
   rules:
     - host: example.com

package/dist/templates/todo/infra/traefik/dynamic.yml

@@ -5,7 +5,11 @@ http:
     web:
       rule: "PathPrefix(`/`)"  # any host on this dedicated proxy -> web
       entryPoints: [web]
+      middlewares: [compression]
       service: web
+  middlewares:
+    compression:
+      compress: {}
   services:
     web:
       loadBalancer:

package/dist/templates/todo/package.json

@@ -3,7 +3,7 @@
   "version": "0.0.0",
   "private": true,
   "engines": {
-    "node": ">=20"
+    "node": ">=22.22.1"
   },
   "workspaces": [
     "apps/*",