@podosoft/podokit 1.4.2 → 1.6.0

package/dist/deploy-compose-profile.js

@@ -170,6 +170,7 @@ function parseComposeProfile(value) {
         "port",
         "webSocketPaths",
         "apiPaths",
+        "edgeProxies",
         "trustedProxyCidrs",
         "gatewayImage",
     ], "exposure");
@@ -201,6 +202,8 @@ function parseComposeProfile(value) {
         throw new Error("Deployment exposure.port must be a TCP port.");
     const webSocketPaths = (0, websocket_paths_1.parseExactWebSocketPaths)(exposure.webSocketPaths ?? [], "exposure.webSocketPaths");
     const apiPaths = (0, api_paths_1.parseApiPaths)(exposure.apiPaths ?? [], "exposure.apiPaths", webSocketPaths);
+    // A reverse proxy on the host is the expected front door, as bindAddress assumes.
+    const edgeProxies = (0, deploy_schema_1.parseEdgeProxies)(exposure, 1);
     const trustedProxyCidrs = parseTrustedProxyCidrs(exposure.trustedProxyCidrs ?? [], "exposure.trustedProxyCidrs");
     if (trustedProxyCidrs.length > 0 && webSocketPaths.length === 0 && apiPaths.length === 0) {
         throw new Error("Deployment exposure.trustedProxyCidrs requires at least one exposure.webSocketPaths or exposure.apiPaths entry.");
@@ -231,6 +234,12 @@ function parseComposeProfile(value) {
     if (typeof secrets.registryLogin !== "boolean") {
         throw new Error("Deployment secrets.registryLogin must be a boolean.");
     }
+    const runtimeConfig = (0, deploy_schema_1.parseRuntimeConfig)((0, deploy_schema_1.requiredRecord)(value, "runtimeConfig"));
+    const postgresRecord = (0, deploy_schema_1.requiredRecord)(dependencies, "postgres");
+    const postgres = {
+        ...parseComposeDependency(postgresRecord, "dependencies.postgres", ["maxConnections", "appPools"]),
+        ...(0, deploy_schema_1.parsePostgresBudget)(postgresRecord, "dependencies.postgres", runtimeConfig),
+    };
     const profile = {
         schemaVersion: 1,
         driver: "docker-compose",
@@ -243,6 +252,7 @@ function parseComposeProfile(value) {
             port,
             webSocketPaths,
             apiPaths,
+            edgeProxies,
             trustedProxyCidrs,
             gatewayImage,
         },
@@ -254,7 +264,7 @@ function parseComposeProfile(value) {
                 : parseComposeWorkload((0, deploy_schema_1.requiredRecord)(workloads, "worker"), "workloads.worker"),
         },
         dependencies: {
-            postgres: parseComposeDependency((0, deploy_schema_1.requiredRecord)(dependencies, "postgres"), "dependencies.postgres"),
+            postgres,
             redis: parseComposeDependency((0, deploy_schema_1.requiredRecord)(dependencies, "redis"), "dependencies.redis"),
             objectStorage,
         },
@@ -267,7 +277,7 @@ function parseComposeProfile(value) {
             ? { migration: { command: (0, deploy_schema_1.parseCommand)(migration.command, "migration.command") } }
             : {}),
         ...(sync ? { sync: parseSyncProfile(sync, "sync") } : {}),
-        runtimeConfig: (0, deploy_schema_1.parseRuntimeConfig)((0, deploy_schema_1.requiredRecord)(value, "runtimeConfig")),
+        runtimeConfig,
         verification: (0, deploy_schema_1.parseVerification)((0, deploy_schema_1.requiredRecord)(value, "verification")),
     };
     return profile;
@@ -308,6 +318,7 @@ function buildDefaultComposeProfile(projectName, options) {
             port: 8080,
             webSocketPaths: [],
             apiPaths: [],
+            edgeProxies: 1,
             trustedProxyCidrs: [],
             gatewayImage: "caddy:2.10-alpine",
         },
@@ -355,8 +366,6 @@ function buildDefaultComposeProfile(projectName, options) {
         runtimeConfig: {
             NODE_ENV: "production",
             CORS_ORIGIN: `https://${host}`,
-            ADDRESS_HEADER: "x-forwarded-for",
-            XFF_DEPTH: "1",
         },
         verification: {
             baseUrl: `https://${host}`,
@@ -410,6 +419,8 @@ function initializeComposeProfile(projectRoot, name, options) {
     draft.runtimeConfig = {
         ...draft.runtimeConfig,
         ...(usesAuth ? { BETTER_AUTH_URL: `https://${host}` } : {}),
+        // The API's fallback until an administrator saves the setting.
+        ...(modules.has("audit-log") ? { AUDIT_LOG_ENABLED: "true" } : {}),
         ...(modules.has("rate-limit")
             ? {
                 RATE_LIMIT_TTL: "60",
@@ -418,8 +429,6 @@ function initializeComposeProfile(projectRoot, name, options) {
                 RATE_LIMIT_AUTH_TTL: "60",
                 RATE_LIMIT_AUTH_MAX: "20",
                 RATE_LIMIT_RUNTIME_MAX: "1000",
-                RATE_LIMIT_TRUSTED_PROXY_HOPS: "1",
-                RATE_LIMIT_PROXY_HEADER: "x-forwarded-for",
                 RATE_LIMIT_STORAGE_TIMEOUT_MS: "1000",
                 RATE_LIMIT_UNAVAILABLE_RETRY_AFTER: "1",
             }

package/dist/deploy-compose-render.d.ts

@@ -1,4 +1,5 @@
 import { type DockerComposeProfileV1 } from "./deploy-compose-profile";
+import { type AppProxyTimeouts } from "./app-proxy-timeouts";
 /**
  * Compose project rendering.
  *
@@ -29,7 +30,14 @@ export declare function serviceName(profile: DockerComposeProfileV1, role: strin
  * Configuration PodoKit derives rather than accepts, so a profile cannot point the
  * app at the wrong service or port.
  */
-export declare function derivedRuntimeConfig(profile: DockerComposeProfileV1): Record<string, string>;
+export declare function derivedRuntimeConfig(profile: DockerComposeProfileV1, proxyTimeouts: AppProxyTimeouts): Record<string, string>;
+/**
+ * The gateway replaces X-Forwarded-For with the one address it resolved. It keeps
+ * a trusted proxy's X-Forwarded-Proto and X-Forwarded-Host and otherwise writes its
+ * own, which name its plain-HTTP listener: behind an edge proxy it does not trust,
+ * the web server keeps its default origin (https and the Host header) instead.
+ */
+export declare function composeProxyTrust(profile: DockerComposeProfileV1): Record<string, string>;
 /**
  * Identity of everything the containers read but Compose cannot see a change in.
  *
@@ -38,12 +46,12 @@ export declare function derivedRuntimeConfig(profile: DockerComposeProfileV1): R
  * secret or a changed runtime config a definition change, so `up` actually rolls
  * the containers instead of leaving stale values running.
  */
-export declare function rolloutStateDigest(profile: DockerComposeProfileV1, secretIdentities: Record<string, string>): string;
-export declare function renderComposeDocument(profile: DockerComposeProfileV1, release: string, images: ComposeImages, stateDigest: string, workerCommand?: string[]): string;
+export declare function rolloutStateDigest(profile: DockerComposeProfileV1, secretIdentities: Record<string, string>, proxyTimeouts: AppProxyTimeouts): string;
+export declare function renderComposeDocument(profile: DockerComposeProfileV1, release: string, images: ComposeImages, stateDigest: string, proxyTimeouts: AppProxyTimeouts, workerCommand?: string[]): string;
 /**
  * The migration runs as its own Compose project so it can be started, waited on,
  * and removed without touching the running application definition.
  */
-export declare function renderMigrationDocument(profile: DockerComposeProfileV1, release: string, images: ComposeImages, defaultCommand?: string[]): string;
+export declare function renderMigrationDocument(profile: DockerComposeProfileV1, release: string, images: ComposeImages, proxyTimeouts: AppProxyTimeouts, defaultCommand?: string[]): string;
 export declare function defaultComposeImages(profile: DockerComposeProfileV1, release: string): ComposeImages;
 export declare function renderComposeDeployment(projectRoot: string, profileName: string, profile: DockerComposeProfileV1, release: string, resolvedImages?: ComposeImages, stateDigest?: string): ComposeRuntime;

package/dist/deploy-compose-render.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.serviceName = serviceName;
 exports.derivedRuntimeConfig = derivedRuntimeConfig;
+exports.composeProxyTrust = composeProxyTrust;
 exports.rolloutStateDigest = rolloutStateDigest;
 exports.renderComposeDocument = renderComposeDocument;
 exports.renderMigrationDocument = renderMigrationDocument;
@@ -12,6 +13,7 @@ const node_fs_1 = require("node:fs");
 const node_path_1 = require("node:path");
 const api_paths_1 = require("./api-paths");
 const deploy_compose_profile_1 = require("./deploy-compose-profile");
+const app_proxy_timeouts_1 = require("./app-proxy-timeouts");
 const deploy_schema_1 = require("./deploy-schema");
 const lockfile_1 = require("./lockfile");
 const toolchain_1 = require("./toolchain");
@@ -33,10 +35,12 @@ function serviceName(profile, role) {
  * Configuration PodoKit derives rather than accepts, so a profile cannot point the
  * app at the wrong service or port.
  */
-function derivedRuntimeConfig(profile) {
+function derivedRuntimeConfig(profile, proxyTimeouts) {
     const result = {
         PORT: String(CONTAINER_PORT),
         BACKEND_INTERNAL_URL: `http://${serviceName(profile, "api")}:${CONTAINER_PORT}`,
+        ...(0, deploy_schema_1.idleTimeoutConfig)(profile.runtimeConfig, proxyTimeouts),
+        ...composeProxyTrust(profile),
         ...profile.runtimeConfig,
     };
     if (profile.dependencies.postgres.mode === "managed") {
@@ -54,6 +58,18 @@ function derivedRuntimeConfig(profile) {
     }
     return result;
 }
+/**
+ * The gateway replaces X-Forwarded-For with the one address it resolved. It keeps
+ * a trusted proxy's X-Forwarded-Proto and X-Forwarded-Host and otherwise writes its
+ * own, which name its plain-HTTP listener: behind an edge proxy it does not trust,
+ * the web server keeps its default origin (https and the Host header) instead.
+ */
+function composeProxyTrust(profile) {
+    const { edgeProxies, trustedProxyCidrs } = profile.exposure;
+    return (0, deploy_compose_profile_1.composeHasGateway)(profile)
+        ? (0, deploy_schema_1.proxyTrustConfig)(1, edgeProxies === 0 || trustedProxyCidrs.length > 0)
+        : (0, deploy_schema_1.proxyTrustConfig)(edgeProxies);
+}
 function sortedEnvironment(config) {
     return Object.entries(config).sort(([left], [right]) => left.localeCompare(right));
 }
@@ -73,10 +89,10 @@ function environmentBlock(config, indent) {
  * secret or a changed runtime config a definition change, so `up` actually rolls
  * the containers instead of leaving stale values running.
  */
-function rolloutStateDigest(profile, secretIdentities) {
+function rolloutStateDigest(profile, secretIdentities, proxyTimeouts) {
     return digest([
         "compose-rollout-state",
-        JSON.stringify(sortedEnvironment(derivedRuntimeConfig(profile))),
+        JSON.stringify(sortedEnvironment(derivedRuntimeConfig(profile, proxyTimeouts))),
         JSON.stringify(Object.entries(secretIdentities).sort(([l], [r]) => l.localeCompare(r))),
     ]);
 }
@@ -120,8 +136,13 @@ function dependencyService(profile, role, dependency, image, extra) {
         extra.healthcheck);
 }
 function postgresService(profile, image) {
+    const { maxConnections } = profile.dependencies.postgres;
     return dependencyService(profile, "postgres", profile.dependencies.postgres, image, {
         dataPath: "/var/lib/postgresql/data",
+        // The image's entry point runs postgres with arguments that start with "-".
+        ...(maxConnections === undefined
+            ? {}
+            : { command: `["-c", ${quote(`max_connections=${maxConnections}`)}]` }),
         healthcheck: `    healthcheck:\n` +
             `      test: ["CMD-SHELL", "pg_isready -U \\"$$POSTGRES_USER\\" -d \\"$$POSTGRES_DB\\""]\n` +
             `      interval: 10s\n      timeout: 5s\n      retries: 10\n      start_period: 20s\n`,
@@ -195,7 +216,7 @@ function objectStorageInitService(profile, clientImage) {
         `    entrypoint: ["sh", "-c", ${quote(script)}]\n` +
         `    networks: [${profile.target.project}]\n`);
 }
-function applicationService(profile, role, image, release, stateDigest, options) {
+function applicationService(profile, role, image, release, stateDigest, environment, options) {
     const workload = role === "worker" ? profile.workloads.worker : profile.workloads[role];
     if (!workload)
         return "";
@@ -221,7 +242,7 @@ function applicationService(profile, role, image, release, stateDigest, options)
         `    restart: unless-stopped\n` +
         (options.command ? `    command: ${options.command}\n` : "") +
         (envFile ? `    env_file:\n      - ${quote(envFile.path)}\n` : "") +
-        environmentBlock(derivedRuntimeConfig(profile), "    ") +
+        environmentBlock(environment, "    ") +
         (dependsOn.length
             ? `    depends_on:\n${dependsOn
                 .map(([name, condition]) => `      ${name}:\n        condition: ${condition}\n`)
@@ -252,10 +273,17 @@ function gatewayService(profile, image, release, stateDigest) {
 `
         : "";
     const api = `${serviceName(profile, "api")}:${CONTAINER_PORT}`;
+    // Caddy appends the peer to X-Forwarded-For, so behind a trusted proxy web and
+    // API would get "client, proxy" and record the proxy at one trusted hop. Send
+    // the client address Caddy resolved instead: the client behind a trusted proxy,
+    // the peer otherwise.
+    const reverseProxy = (upstream) => `    reverse_proxy ${upstream} {\n` +
+        `      header_up X-Forwarded-For {client_ip}\n` +
+        `    }\n`;
     const webSocketRoutes = profile.exposure.webSocketPaths.length
         ? `  @api_websockets path ${profile.exposure.webSocketPaths.join(" ")}\n` +
             `  handle @api_websockets {\n` +
-            `    reverse_proxy ${api}\n` +
+            reverseProxy(api) +
             `  }\n`
         : "";
     const apiPathRoutes = profile.exposure.apiPaths.length
@@ -264,7 +292,7 @@ function gatewayService(profile, image, release, stateDigest) {
             .join(" ")}\n` +
             `  handle @api_paths {\n` +
             `    uri strip_prefix ${api_paths_1.API_PATH_PREFIX}\n` +
-            `    reverse_proxy ${api}\n` +
+            reverseProxy(api) +
             `  }\n`
         : "";
     const caddyfile = globalOptions +
@@ -272,7 +300,7 @@ function gatewayService(profile, image, release, stateDigest) {
         webSocketRoutes +
         apiPathRoutes +
         `  handle {\n` +
-        `    reverse_proxy ${serviceName(profile, "web")}:${CONTAINER_PORT}\n` +
+        reverseProxy(`${serviceName(profile, "web")}:${CONTAINER_PORT}`) +
         `  }\n` +
         `}\n`;
     const start = "printf '%s' \"$${CADDYFILE_CONTENT}\" > /tmp/Caddyfile\n" +
@@ -292,7 +320,8 @@ function gatewayService(profile, image, release, stateDigest) {
         `      interval: 10s\n      timeout: 5s\n      retries: 6\n      start_period: 10s\n` +
         labelsBlock(profile, release, stateDigest, "    "));
 }
-function renderComposeDocument(profile, release, images, stateDigest, workerCommand = ["bun", "dist/main-worker.js"]) {
+function renderComposeDocument(profile, release, images, stateDigest, proxyTimeouts, workerCommand = ["bun", "dist/main-worker.js"]) {
+    const environment = derivedRuntimeConfig(profile, proxyTimeouts);
     const services = [];
     const hasGateway = (0, deploy_compose_profile_1.composeHasGateway)(profile);
     if (profile.dependencies.postgres.mode === "managed" && images.postgres) {
@@ -307,10 +336,10 @@ function renderComposeDocument(profile, release, images, stateDigest, workerComm
             services.push(objectStorageInitService(profile, images.objectStorageClient));
         }
     }
-    services.push(applicationService(profile, "api", images.api, release, stateDigest, {
+    services.push(applicationService(profile, "api", images.api, release, stateDigest, environment, {
         healthcheckPath: "/health/ready",
     }));
-    services.push(applicationService(profile, "web", images.web, release, stateDigest, {
+    services.push(applicationService(profile, "web", images.web, release, stateDigest, environment, {
         // The web server's own route: an API outage must not mark it unhealthy.
         healthcheckPath: "/healthz",
         publish: !hasGateway,
@@ -324,7 +353,7 @@ function renderComposeDocument(profile, release, images, stateDigest, workerComm
     if (profile.workloads.worker) {
         // The worker runs the API image with a different entry point, exactly as the
         // Kubernetes driver does.
-        services.push(applicationService(profile, "worker", images.api, release, stateDigest, {
+        services.push(applicationService(profile, "worker", images.api, release, stateDigest, environment, {
             command: `[${workerCommand.map((part) => quote(part)).join(", ")}]`,
         }));
     }
@@ -349,7 +378,7 @@ function renderComposeDocument(profile, release, images, stateDigest, workerComm
  * The migration runs as its own Compose project so it can be started, waited on,
  * and removed without touching the running application definition.
  */
-function renderMigrationDocument(profile, release, images, defaultCommand = ["bun", "run", "migrate:all"]) {
+function renderMigrationDocument(profile, release, images, proxyTimeouts, defaultCommand = ["bun", "run", "migrate:all"]) {
     const command = profile.migration?.command ?? defaultCommand;
     return (`# Generated by PodoKit. One-shot migration for ${release}.\n` +
         `name: ${profile.target.project}-migrate\n` +
@@ -359,7 +388,7 @@ function renderMigrationDocument(profile, release, images, defaultCommand = ["bu
         `    restart: "no"\n` +
         `    command: [${command.map((part) => quote(part)).join(", ")}]\n` +
         `    env_file:\n      - ${quote(profile.secrets.api.path)}\n` +
-        environmentBlock(derivedRuntimeConfig(profile), "    ") +
+        environmentBlock(derivedRuntimeConfig(profile, proxyTimeouts), "    ") +
         `    networks: [${profile.target.project}]\n` +
         `networks:\n  ${profile.target.project}:\n    name: ${profile.target.project}\n    external: true\n`);
 }
@@ -383,13 +412,14 @@ function defaultComposeImages(profile, release) {
 function renderComposeDeployment(projectRoot, profileName, profile, release, resolvedImages, stateDigest) {
     (0, deploy_schema_1.profilePath)(projectRoot, profileName);
     const images = resolvedImages ?? defaultComposeImages(profile, release);
-    const effectiveStateDigest = stateDigest ?? rolloutStateDigest(profile, {});
+    const proxyTimeouts = (0, app_proxy_timeouts_1.readAppProxyTimeouts)(projectRoot);
+    const effectiveStateDigest = stateDigest ?? rolloutStateDigest(profile, {}, proxyTimeouts);
     const root = (0, node_path_1.join)((0, node_path_1.resolve)(projectRoot), ".podokit", "runtime", "deploy", profileName);
     (0, node_fs_1.rmSync)(root, { recursive: true, force: true });
     (0, node_fs_1.mkdirSync)(root, { recursive: true });
     const toolchain = (0, lockfile_1.readManifest)(projectRoot)?.toolchain ?? (0, toolchain_1.resolveToolchain)();
-    const composeDocument = renderComposeDocument(profile, release, images, effectiveStateDigest, (0, toolchain_1.toolchainWorkerCommand)(toolchain));
-    const migrationDocument = renderMigrationDocument(profile, release, images, (0, toolchain_1.toolchainMigrationCommand)(toolchain));
+    const composeDocument = renderComposeDocument(profile, release, images, effectiveStateDigest, proxyTimeouts, (0, toolchain_1.toolchainWorkerCommand)(toolchain));
+    const migrationDocument = renderMigrationDocument(profile, release, images, proxyTimeouts, (0, toolchain_1.toolchainMigrationCommand)(toolchain));
     const composeFile = (0, node_path_1.join)(root, "compose.yaml");
     const migrationFile = (0, node_path_1.join)(root, "compose.migrate.yaml");
     (0, node_fs_1.writeFileSync)(composeFile, composeDocument);

package/dist/deploy-compose.d.ts

@@ -1,3 +1,4 @@
+import { type DeployFinding } from "./deploy-checks";
 import type { CommandRunner } from "./dev";
 import { type ComposeSyncDrift } from "./deploy-compose-sync";
 import { type ComposeImages } from "./deploy-compose-render";
@@ -10,11 +11,7 @@ import { type ComposeImages } from "./deploy-compose-render";
  * lock file in a state volume replaces the Kubernetes Lease, and a release ledger in
  * that same volume replaces Helm revisions.
  */
-export interface ComposeDoctorFinding {
-    code: string;
-    ok: boolean;
-    message: string;
-}
+export type ComposeDoctorFinding = DeployFinding;
 export interface ComposePlanAction {
     order: number;
     kind: "dependencies" | "migration" | "application" | "verification" | "rollback";

package/dist/deploy-compose.js

@@ -12,6 +12,8 @@ exports.composeRuntimeRoot = composeRuntimeRoot;
 const node_crypto_1 = require("node:crypto");
 const node_path_1 = require("node:path");
 const api_paths_1 = require("./api-paths");
+const app_proxy_timeouts_1 = require("./app-proxy-timeouts");
+const deploy_checks_1 = require("./deploy-checks");
 const deploy_driver_1 = require("./deploy-driver");
 const deploy_compose_exec_1 = require("./deploy-compose-exec");
 const deploy_compose_sync_1 = require("./deploy-compose-sync");
@@ -171,7 +173,7 @@ function managedDependencyServices(profile) {
 }
 function doctorComposeDeployment(projectRoot, profileName, runner = deploy_compose_exec_1.defaultRunner, release) {
     const profile = (0, deploy_driver_1.loadComposeProfile)(projectRoot, profileName);
-    const findings = [];
+    const findings = (0, deploy_checks_1.profileFindings)(projectRoot, profile);
     const record = (code, ok, message) => {
         findings.push({ code, ok, message });
     };
@@ -351,7 +353,7 @@ function planComposeDeployment(projectRoot, profileName, release, runner = deplo
         ]));
         secretIdentities[label] = output.trim();
     }
-    const stateDigest = (0, deploy_compose_render_1.rolloutStateDigest)(profile, secretIdentities);
+    const stateDigest = (0, deploy_compose_render_1.rolloutStateDigest)(profile, secretIdentities, (0, app_proxy_timeouts_1.readAppProxyTimeouts)(projectRoot));
     const runtime = (0, deploy_compose_render_1.renderComposeDeployment)(projectRoot, profileName, profile, release, images, stateDigest);
     const composeDocumentDigest = digest(["compose-document", runtime.composeDocument]);
     const psOutput = composePs(profile, runner);
@@ -386,6 +388,9 @@ function planComposeDeployment(projectRoot, profileName, release, runner = deplo
         warnings.push(`Release ${release} is already the current revision; apply will recreate containers whose definition changed.`);
     }
     warnings.push("The migration runs before the new containers start, so it must be compatible with the release currently serving traffic.");
+    const budgetWarning = (0, deploy_checks_1.connectionBudgetWarning)(profile, (0, deploy_checks_1.installedModules)(projectRoot));
+    if (budgetWarning)
+        warnings.push(budgetWarning);
     const profileDigest = (0, deploy_compose_profile_1.composeProfileDigest)(profile);
     const planHash = digest([
         "compose-plan",

package/dist/deploy-profile.d.ts

@@ -1,4 +1,4 @@
-import { MigrationProfile, VerificationCheckProfile } from "./deploy-schema";
+import { MigrationProfile, PostgresBudgetProfile, VerificationCheckProfile } from "./deploy-schema";
 export { profileDirectory, profilePath } from "./deploy-schema";
 export type { MigrationProfile, VerificationCheckProfile } from "./deploy-schema";
 export type DependencyMode = "inCluster" | "external" | "disabled";
@@ -20,6 +20,8 @@ export interface StatefulDependencyProfile {
     storageSize: string;
 }
 export type RedisDependencyProfile = StatefulDependencyProfile;
+export interface PostgresDependencyProfile extends StatefulDependencyProfile, PostgresBudgetProfile {
+}
 export interface ObjectStorageDependencyProfile extends StatefulDependencyProfile {
     bucket: string;
     clientImage: string;
@@ -52,6 +54,8 @@ export interface DeployProfileV1 {
         webSocketPaths: string[];
         /** Path prefixes under /api/ that the Ingress sends to the API with /api removed. */
         apiPaths: string[];
+        /** Reverse proxies in front of the Ingress controller or NodePort that append to X-Forwarded-For. */
+        edgeProxies: number;
     };
     workloads: {
         api: WorkloadProfile;
@@ -59,7 +63,7 @@ export interface DeployProfileV1 {
         worker: WorkloadProfile | null;
     };
     dependencies: {
-        postgres: StatefulDependencyProfile;
+        postgres: PostgresDependencyProfile;
         redis: RedisDependencyProfile;
         objectStorage: ObjectStorageDependencyProfile;
     };

package/dist/deploy-profile.js

@@ -119,7 +119,7 @@ function parseDeploymentProfile(value) {
     const runtimeConfig = (0, deploy_schema_1.requiredRecord)(value, "runtimeConfig");
     (0, deploy_schema_1.assertOnlyKeys)(target, ["context", "clusterFingerprint", "namespace", "release", "createNamespace"], "target");
     (0, deploy_schema_1.assertOnlyKeys)(release, ["strategy", "tagPattern", "apiRepository", "webRepository"], "release");
-    (0, deploy_schema_1.assertOnlyKeys)(exposure, ["mode", "host", "ingressClassName", "tlsSecretName", "webSocketPaths", "apiPaths"], "exposure");
+    (0, deploy_schema_1.assertOnlyKeys)(exposure, ["mode", "host", "ingressClassName", "tlsSecretName", "webSocketPaths", "apiPaths", "edgeProxies"], "exposure");
     (0, deploy_schema_1.assertOnlyKeys)(workloads, ["api", "web", "worker"], "workloads");
     (0, deploy_schema_1.assertOnlyKeys)(dependencies, ["postgres", "redis", "objectStorage"], "dependencies");
     (0, deploy_schema_1.assertOnlyKeys)(secrets, ["api", "web", "imagePull"], "secrets");
@@ -173,7 +173,12 @@ function parseDeploymentProfile(value) {
     if (exposureMode === "nodePort" && apiPaths.length > 0) {
         throw new Error("Deployment exposure.apiPaths requires exposure.mode ingress.");
     }
-    const postgres = parseStatefulDependency((0, deploy_schema_1.requiredRecord)(dependencies, "postgres"), "dependencies.postgres");
+    const parsedConfig = (0, deploy_schema_1.parseRuntimeConfig)(runtimeConfig);
+    const postgresRecord = (0, deploy_schema_1.requiredRecord)(dependencies, "postgres");
+    const postgres = {
+        ...parseStatefulDependency(postgresRecord, "dependencies.postgres", ["maxConnections", "appPools"]),
+        ...(0, deploy_schema_1.parsePostgresBudget)(postgresRecord, "dependencies.postgres", parsedConfig),
+    };
     const redis = parseRedisDependency((0, deploy_schema_1.requiredRecord)(dependencies, "redis"), "dependencies.redis");
     const objectStorageRecord = (0, deploy_schema_1.requiredRecord)(dependencies, "objectStorage");
     (0, deploy_schema_1.assertOnlyKeys)(objectStorageRecord, [
@@ -192,7 +197,6 @@ function parseDeploymentProfile(value) {
     };
     (0, deploy_schema_1.validateDnsLabel)(objectStorage.bucket, "dependencies.objectStorage.bucket");
     (0, deploy_schema_1.validateImage)(objectStorage.clientImage, "dependencies.objectStorage.clientImage");
-    const parsedConfig = (0, deploy_schema_1.parseRuntimeConfig)(runtimeConfig);
     const { baseUrl, checks } = (0, deploy_schema_1.parseVerification)(verification);
     const profile = {
         schemaVersion: 1,
@@ -217,6 +221,7 @@ function parseDeploymentProfile(value) {
             tlsSecretName,
             webSocketPaths,
             apiPaths,
+            edgeProxies: (0, deploy_schema_1.parseEdgeProxies)(exposure, 0),
         },
         workloads: {
             api: parseWorkload((0, deploy_schema_1.requiredRecord)(workloads, "api"), "workloads.api"),
@@ -327,6 +332,7 @@ function initializeDeploymentProfile(projectRoot, name, options) {
             tlsSecretName: null,
             webSocketPaths: [],
             apiPaths: (0, api_paths_1.installedApiPaths)(manifest.modules),
+            edgeProxies: 0,
         },
         workloads: {
             api: {
@@ -395,9 +401,9 @@ function initializeDeploymentProfile(projectRoot, name, options) {
         runtimeConfig: {
             NODE_ENV: "production",
             CORS_ORIGIN: `https://${host}`,
-            ADDRESS_HEADER: "x-forwarded-for",
-            XFF_DEPTH: "1",
             ...(usesAuth ? { BETTER_AUTH_URL: `https://${host}` } : {}),
+            // The API's fallback until an administrator saves the setting.
+            ...(modules.has("audit-log") ? { AUDIT_LOG_ENABLED: "true" } : {}),
             ...(modules.has("rate-limit")
                 ? {
                     RATE_LIMIT_TTL: "60",
@@ -406,8 +412,6 @@ function initializeDeploymentProfile(projectRoot, name, options) {
                     RATE_LIMIT_AUTH_TTL: "60",
                     RATE_LIMIT_AUTH_MAX: "20",
                     RATE_LIMIT_RUNTIME_MAX: "1000",
-                    RATE_LIMIT_TRUSTED_PROXY_HOPS: "1",
-                    RATE_LIMIT_PROXY_HEADER: "x-forwarded-for",
                     RATE_LIMIT_STORAGE_TIMEOUT_MS: "1000",
                     RATE_LIMIT_UNAVAILABLE_RETRY_AFTER: "1",
                 }

package/dist/deploy-render.d.ts

@@ -1,4 +1,5 @@
 import type { DeployProfileV1 } from "./deploy-profile";
+import { type AppProxyTimeouts } from "./app-proxy-timeouts";
 export interface DeploymentRuntime {
     root: string;
     dependencyChart: string;
@@ -15,4 +16,6 @@ export interface DeploymentImages {
     objectStorage: string | null;
     objectStorageClient: string | null;
 }
-export declare function renderDeployment(projectRoot: string, profileName: string, profile: DeployProfileV1, release: string, resolvedImages?: DeploymentImages, rolloutStateDigest?: string): DeploymentRuntime;
+/** The Ingress controller appends its peer: the client, or the last edge proxy. */
+export declare function kubernetesProxyTrust(profile: DeployProfileV1): Record<string, string>;
+export declare function renderDeployment(projectRoot: string, profileName: string, profile: DeployProfileV1, release: string, resolvedImages?: DeploymentImages, rolloutStateDigest?: string, proxyTimeouts?: AppProxyTimeouts): DeploymentRuntime;

package/dist/deploy-render.js

@@ -1,11 +1,14 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.kubernetesProxyTrust = kubernetesProxyTrust;
 exports.renderDeployment = renderDeployment;
 const node_fs_1 = require("node:fs");
 const node_crypto_1 = require("node:crypto");
 const node_path_1 = require("node:path");
 const deploy_profile_1 = require("./deploy-profile");
 const api_paths_1 = require("./api-paths");
+const app_proxy_timeouts_1 = require("./app-proxy-timeouts");
+const deploy_schema_1 = require("./deploy-schema");
 const lockfile_1 = require("./lockfile");
 const toolchain_1 = require("./toolchain");
 function quote(value) {
@@ -111,7 +114,7 @@ ${labels(name, 8)}    spec:
         - name: postgres
           image: ${quote(image ?? dependency.image)}
           imagePullPolicy: IfNotPresent
-          env:
+${dependency.maxConnections === undefined ? "" : `          args: ["-c", ${quote(`max_connections=${dependency.maxConnections}`)}]\n`}          env:
             - name: POSTGRES_USER
               valueFrom:
                 secretKeyRef: { name: ${dependency.secretName}, key: POSTGRES_USER }
@@ -350,12 +353,16 @@ function dependencyManifest(profile, images, rolloutStateDigest) {
         .filter(Boolean)
         .join("\n---\n");
 }
-function derivedRuntimeConfig(profile) {
+/** The Ingress controller appends its peer: the client, or the last edge proxy. */
+function kubernetesProxyTrust(profile) {
+    return (0, deploy_schema_1.proxyTrustConfig)(profile.exposure.edgeProxies + (profile.exposure.mode === "ingress" ? 1 : 0));
+}
+function derivedRuntimeConfig(profile, proxyTimeouts) {
     const result = {
         PORT: "3000",
         BACKEND_INTERNAL_URL: `http://${profile.target.release}-api:3000`,
-        PROTOCOL_HEADER: "x-forwarded-proto",
-        HOST_HEADER: "x-forwarded-host",
+        ...(0, deploy_schema_1.idleTimeoutConfig)(profile.runtimeConfig, proxyTimeouts),
+        ...kubernetesProxyTrust(profile),
         ...profile.runtimeConfig,
     };
     if (profile.dependencies.postgres.mode === "inCluster") {
@@ -373,12 +380,11 @@ function derivedRuntimeConfig(profile) {
     }
     return result;
 }
-function derivedRuntimeConfigDigest(profile) {
-    const entries = Object.entries(derivedRuntimeConfig(profile)).sort(([left], [right]) => left.localeCompare(right));
-    return digest(["runtime-config", JSON.stringify(entries)]);
+function sortedRuntimeConfig(runtimeConfig) {
+    return Object.entries(runtimeConfig).sort(([left], [right]) => left.localeCompare(right));
 }
-function configMap(profile) {
-    const entries = Object.entries(derivedRuntimeConfig(profile)).sort(([left], [right]) => left.localeCompare(right));
+function configMap(profile, runtimeConfig) {
+    const entries = sortedRuntimeConfig(runtimeConfig);
     return `apiVersion: v1
 kind: ConfigMap
 metadata:
@@ -626,10 +632,10 @@ ${webSocketPaths}          - path: /
                 port: { number: 3000 }
 ${apiPathIngress(profile, tls)}`;
 }
-function applicationManifest(profile, images, rolloutStateDigest, workerCommand) {
-    const runtimeConfigDigest = derivedRuntimeConfigDigest(profile);
+function applicationManifest(profile, images, rolloutStateDigest, workerCommand, runtimeConfig) {
+    const runtimeConfigDigest = digest(["runtime-config", JSON.stringify(sortedRuntimeConfig(runtimeConfig))]);
     return [
-        configMap(profile),
+        configMap(profile, runtimeConfig),
         deployment(profile, "api", profile.workloads.api, images.api, rolloutStateDigest, runtimeConfigDigest),
         deployment(profile, "web", profile.workloads.web, images.web, rolloutStateDigest, runtimeConfigDigest),
         workerDeployment(profile, images.api, rolloutStateDigest, runtimeConfigDigest, workerCommand),
@@ -641,14 +647,13 @@ function applicationManifest(profile, images, rolloutStateDigest, workerCommand)
         .filter(Boolean)
         .join("\n---\n");
 }
-function migrationRuntimeEnv(profile) {
-    return Object.entries(derivedRuntimeConfig(profile))
-        .sort(([left], [right]) => left.localeCompare(right))
+function migrationRuntimeEnv(runtimeConfig) {
+    return sortedRuntimeConfig(runtimeConfig)
         .map(([key, value]) => `            - name: ${key}
               value: ${quote(value)}`)
         .join("\n");
 }
-function migrationManifest(profile, release, images, defaultCommand) {
+function migrationManifest(profile, release, images, defaultCommand, runtimeConfig) {
     const releaseSlug = release.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
     const command = profile.migration?.command ?? defaultCommand;
     return `apiVersion: batch/v1
@@ -678,7 +683,7 @@ ${labels(`${profile.target.release}-migration`, 8)}    spec:
           imagePullPolicy: IfNotPresent
           command: ${yamlStringSequence(command)}
           env:
-${migrationRuntimeEnv(profile)}
+${migrationRuntimeEnv(runtimeConfig)}
           envFrom:
             - secretRef: { name: ${profile.secrets.api.name} }
           securityContext:
@@ -692,7 +697,9 @@ function chart(directory, name, manifest) {
     (0, node_fs_1.writeFileSync)((0, node_path_1.join)(directory, "resources.yaml"), manifest || "# No resources\n");
     (0, node_fs_1.writeFileSync)((0, node_path_1.join)(directory, "templates", "resources.yaml"), '{{ .Files.Get "resources.yaml" }}\n');
 }
-function renderDeployment(projectRoot, profileName, profile, release, resolvedImages, rolloutStateDigest) {
+function renderDeployment(projectRoot, profileName, profile, release, resolvedImages, rolloutStateDigest, 
+// Planning renders into a scratch directory, so it reads these from the project.
+proxyTimeouts = (0, app_proxy_timeouts_1.readAppProxyTimeouts)(projectRoot)) {
     (0, deploy_profile_1.profilePath)(projectRoot, profileName);
     const images = resolvedImages ?? {
         api: `${profile.release.apiRepository}:${release}`,
@@ -717,8 +724,9 @@ function renderDeployment(projectRoot, profileName, profile, release, resolvedIm
     const effectiveRolloutStateDigest = rolloutStateDigest ?? offlineRolloutStateDigest(profile);
     const dependencies = dependencyManifest(profile, images, effectiveRolloutStateDigest);
     const toolchain = (0, lockfile_1.readManifest)(projectRoot)?.toolchain ?? (0, toolchain_1.resolveToolchain)();
-    const application = applicationManifest(profile, images, effectiveRolloutStateDigest, (0, toolchain_1.toolchainWorkerCommand)(toolchain));
-    const migration = migrationManifest(profile, release, images, (0, toolchain_1.toolchainMigrationCommand)(toolchain));
+    const runtimeConfig = derivedRuntimeConfig(profile, proxyTimeouts);
+    const application = applicationManifest(profile, images, effectiveRolloutStateDigest, (0, toolchain_1.toolchainWorkerCommand)(toolchain), runtimeConfig);
+    const migration = migrationManifest(profile, release, images, (0, toolchain_1.toolchainMigrationCommand)(toolchain), runtimeConfig);
     chart(dependencyChart, "podokit-dependencies", dependencies);
     chart(applicationChart, "podokit-application", application);
     (0, node_fs_1.writeFileSync)((0, node_path_1.join)(root, "migration.yaml"), migration);