@r8s/recipes 0.1.0

package/dist/database.js

@@ -0,0 +1,212 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Database = Database;
+const core_1 = require("@r8s/core");
+const defaults_1 = require("@r8s/core/defaults");
+const operators_1 = require("./operators");
+/**
+ * CloudNativePG PostgreSQL database.
+ *
+ * @title Database
+ * @category Data & Analytics
+ *
+ * Creates a dedicated 3-instance HA CloudNativePG cluster for this database.
+ * When wrapped in a `<Database>` component, child components receive the
+ * connection info via DatabaseContext automatically.
+ *
+ * Credentials are managed by the secrets backend configured on the Platform.
+ * Without a secrets backend, CNPG manages the bootstrap secret automatically.
+ *
+ * @example
+ * import { Database } from '@r8s/recipes'
+ *
+ * export default <Database name="app-db" storage="10Gi" />
+ *
+ * @example
+ * import { Platform, Database, WebService } from '@r8s/recipes'
+ *
+ * export default (
+ *   <Platform secrets={{ backend: 'openbao' }}>
+ *     <Database name="app-db" storage="10Gi">
+ *       <WebService name="api" image="myapp/api:v1" />
+ *     </Database>
+ *   </Platform>
+ * )
+ */
+function Database(props) {
+    const { name, namespace: namespaceProp, storage = '10Gi', operatorVersion, password, children, } = props;
+    // Inherit namespace from <Platform> context if not explicitly set
+    const contextNamespace = (0, core_1.useContext)(defaults_1.Namespace);
+    const namespace = namespaceProp ?? (contextNamespace !== 'default' ? contextNamespace : undefined) ?? 'default';
+    const clusterConfig = (0, core_1.useContext)(defaults_1.ClusterContext);
+    const secretProvider = (0, core_1.useContext)(defaults_1.SecretContext);
+    const sharedOperators = (0, core_1.useContext)(defaults_1.OperatorContext);
+    const secretName = `${name}-db-credentials`;
+    const resources = [];
+    if (clusterConfig) {
+        // Shared cluster — reuse connection info from the surrounding Cluster
+        const connection = {
+            host: clusterConfig.host,
+            port: 5432,
+            database: name,
+            username: name,
+            passwordSecret: { name: secretName, key: 'password' },
+            passwordKey: 'password',
+            vendor: 'postgres',
+        };
+        resources.push(...createSecretResources(name, namespace, secretName, secretProvider, password, clusterConfig.host));
+        if (children) {
+            resources.push((0, core_1.jsx)(defaults_1.DatabaseContext.Provider, { value: connection, children }));
+        }
+    }
+    else {
+        // Dedicated cluster — create full CNPG cluster
+        const hasCNPG = sharedOperators.some((op) => op.name === 'cnpg');
+        const cluster = {
+            apiVersion: 'postgresql.cnpg.io/v1',
+            kind: 'Cluster',
+            metadata: { name, namespace },
+            spec: {
+                instances: 3,
+                storage: { size: storage },
+                bootstrap: {
+                    initdb: {
+                        database: name,
+                        owner: name,
+                        secret: { name: secretName },
+                    },
+                },
+                monitoring: { enablePodMonitor: true },
+            },
+        };
+        const connection = {
+            host: `${name}-rw`,
+            port: 5432,
+            database: name,
+            username: name,
+            passwordSecret: { name: secretName, key: 'password' },
+            passwordKey: 'password',
+            vendor: 'postgres',
+        };
+        if (!hasCNPG) {
+            resources.push((0, core_1.declareOperator)((0, operators_1.cnpgOperator)(operatorVersion)));
+        }
+        resources.push((0, core_1.jsx)('Cluster', cluster));
+        // For dedicated clusters with a secrets backend, the backend manages
+        // credentials. For kubernetes backend, CNPG manages the bootstrap secret
+        // automatically — but we still validate that a password was provided
+        // when kubernetes backend is explicitly chosen.
+        if (secretProvider) {
+            resources.push(...createSecretResources(name, namespace, secretName, secretProvider, password, `${name}-rw`));
+        }
+        if (children) {
+            resources.push((0, core_1.jsx)(defaults_1.DatabaseContext.Provider, { value: connection, children }));
+        }
+    }
+    return resources;
+}
+/**
+ * Create the secret resources for a database based on the active secrets
+ * backend. Throws a descriptive error when a password is needed but not
+ * provided, or when the backend is not configured.
+ */
+function createSecretResources(name, namespace, secretName, secretProvider, password, host) {
+    const resources = [];
+    if (!secretProvider) {
+        if (!password) {
+            throw new Error(`Database "${name}" has no secrets backend configured and no password provided.\n` +
+                `\n` +
+                `Fix: either set a secrets backend on the Platform:\n` +
+                `  <Platform secrets={{ backend: 'openbao' }}>\n` +
+                `    <Database name="${name}" />\n` +
+                `  </Platform>\n` +
+                `\n` +
+                `Or provide a password directly (not recommended for production):\n` +
+                `  <Database name="${name}" password="..." />`);
+        }
+        resources.push((0, core_1.jsx)('Secret', {
+            apiVersion: 'v1',
+            kind: 'Secret',
+            metadata: { name: secretName, namespace },
+            stringData: {
+                password,
+                username: name,
+                uri: `postgresql://${name}:${password}@${host}:5432/${name}`,
+            },
+        }));
+        return resources;
+    }
+    switch (secretProvider.backend) {
+        case 'vault':
+            resources.push((0, core_1.jsx)('VaultStaticSecret', {
+                apiVersion: 'secrets.hashicorp.com/v1beta1',
+                kind: 'VaultStaticSecret',
+                metadata: { name: `${name}-db-secret`, namespace },
+                spec: {
+                    vaultAuthRef: secretProvider.authRef,
+                    mount: secretProvider.mount,
+                    type: 'kv-v2',
+                    path: `${secretProvider.path}/${name}`,
+                    destination: { create: true, name: secretName },
+                },
+            }));
+            break;
+        case 'openbao':
+            resources.push((0, core_1.jsx)('OpenBaoStaticSecret', {
+                apiVersion: 'secrets.openbao.org/v1beta1',
+                kind: 'OpenBaoStaticSecret',
+                metadata: { name: `${name}-db-secret`, namespace },
+                spec: {
+                    openbaoAuthRef: secretProvider.authRef,
+                    mount: secretProvider.mount,
+                    type: 'kv-v2',
+                    path: `${secretProvider.path}/${name}`,
+                    destination: { create: true, name: secretName },
+                },
+            }));
+            break;
+        case 'sealed-secrets':
+            // Sealed Secrets: the user provides a sealed secret that was encrypted
+            // with the cluster's public key. We reference it — we never see the
+            // plaintext. The user must pre-create the SealedSecret.
+            resources.push((0, core_1.jsx)('SealedSecret', {
+                apiVersion: 'bitnami.com/v1alpha1',
+                kind: 'SealedSecret',
+                metadata: { name: secretName, namespace },
+                spec: {
+                    encryptedData: {
+                        // Placeholder — the user replaces this with their sealed value
+                        password: 'REPLACE_WITH_SEALED_VALUE',
+                    },
+                },
+            }));
+            break;
+        case 'kubernetes':
+            if (!password) {
+                throw new Error(`Database "${name}" uses the 'kubernetes' secrets backend, which requires a password.\n` +
+                    `\n` +
+                    `The kubernetes backend stores credentials as plain Kubernetes Secrets.\n` +
+                    `For production, use a managed backend instead:\n` +
+                    `  <Platform secrets={{ backend: 'openbao' }}>\n` +
+                    `\n` +
+                    `Or provide a password explicitly:\n` +
+                    `  <Database name="${name}" password="..." />`);
+            }
+            resources.push((0, core_1.jsx)('Secret', {
+                apiVersion: 'v1',
+                kind: 'Secret',
+                metadata: { name: secretName, namespace },
+                stringData: {
+                    password,
+                    username: name,
+                    uri: `postgresql://${name}:${password}@${host}:5432/${name}`,
+                },
+            }));
+            break;
+        default:
+            throw new Error(`Database "${name}" has an unknown secrets backend "${secretProvider.backend}".\n` +
+                `Supported backends: 'openbao', 'vault', 'sealed-secrets', 'kubernetes'`);
+    }
+    return resources;
+}
+//# sourceMappingURL=database.js.map

package/dist/database.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"database.js","sourceRoot":"","sources":["../src/database.tsx"],"names":[],"mappings":";;AA2DA,4BA6GC;AAxKD,oCAA4D;AAE5D,iDAM2B;AAC3B,2CAA0C;AAqB1C;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,SAAgB,QAAQ,CAAC,KAAoB;IAC3C,MAAM,EACJ,IAAI,EACJ,SAAS,EAAE,aAAa,EACxB,OAAO,GAAG,MAAM,EAChB,eAAe,EACf,QAAQ,EACR,QAAQ,GACT,GAAG,KAAK,CAAA;IAET,kEAAkE;IAClE,MAAM,gBAAgB,GAAG,IAAA,iBAAU,EAAC,oBAAS,CAAC,CAAA;IAC9C,MAAM,SAAS,GACb,aAAa,IAAI,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,SAAS,CAAA;IAE/F,MAAM,aAAa,GAAG,IAAA,iBAAU,EAAC,yBAAc,CAAC,CAAA;IAChD,MAAM,cAAc,GAAG,IAAA,iBAAU,EAAC,wBAAa,CAAC,CAAA;IAChD,MAAM,eAAe,GAAG,IAAA,iBAAU,EAAC,0BAAe,CAAC,CAAA;IACnD,MAAM,UAAU,GAAG,GAAG,IAAI,iBAAiB,CAAA;IAE3C,MAAM,SAAS,GAA6B,EAAE,CAAA;IAE9C,IAAI,aAAa,EAAE,CAAC;QAClB,sEAAsE;QACtE,MAAM,UAAU,GAAG;YACjB,IAAI,EAAE,aAAa,CAAC,IAAI;YACxB,IAAI,EAAE,IAAI;YACV,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,IAAI;YACd,cAAc,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,EAAE;YACrD,WAAW,EAAE,UAAU;YACvB,MAAM,EAAE,UAAmB;SAC5B,CAAA;QAED,SAAS,CAAC,IAAI,CACZ,GAAG,qBAAqB,CACtB,IAAI,EACJ,SAAS,EACT,UAAU,EACV,cAAc,EACd,QAAQ,EACR,aAAa,CAAC,IAAI,CACnB,CACF,CAAA;QAED,IAAI,QAAQ,EAAE,CAAC;YACb,SAAS,CAAC,IAAI,CAAC,IAAA,UAAG,EAAC,0BAAe,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAA;QAChF,CAAC;IACH,CAAC;SAAM,CAAC;QACN,+CAA+C;QAC/C,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,KAAK,MAAM,CAAC,CAAA;QAEhE,MAAM,OAAO,GAAY;YACvB,UAAU,EAAE,uBAAuB;YACnC,IAAI,EAAE,SAAS;YACf,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;YAC7B,IAAI,EAAE;gBACJ,SAAS,EAAE,CAAC;gBACZ,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;gBAC1B,SAAS,EAAE;oBACT,MAAM,EAAE;wBACN,QAAQ,EAAE,IAAI;wBACd,KAAK,EAAE,IAAI;wBACX,MAAM,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE;qBAC7B;iBACF;gBACD,UAAU,EAAE,EAAE,gBAAgB,EAAE,IAAI,EAAE;aACvC;SACF,CAAA;QAED,MAAM,UAAU,GAAG;YACjB,IAAI,EAAE,GAAG,IAAI,KAAK;YAClB,IAAI,EAAE,IAAI;YACV,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,IAAI;YACd,cAAc,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,EAAE;YACrD,WAAW,EAAE,UAAU;YACvB,MAAM,EAAE,UAAmB;SAC5B,CAAA;QAED,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,SAAS,CAAC,IAAI,CAAC,IAAA,sBAAe,EAAC,IAAA,wBAAY,EAAC,eAAe,CAAC,CAAC,CAAC,CAAA;QAChE,CAAC;QAED,SAAS,CAAC,IAAI,CAAC,IAAA,UAAG,EAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAA;QAEvC,qEAAqE;QACrE,yEAAyE;QACzE,qEAAqE;QACrE,gDAAgD;QAChD,IAAI,cAAc,EAAE,CAAC;YACnB,SAAS,CAAC,IAAI,CACZ,GAAG,qBAAqB,CACtB,IAAI,EACJ,SAAS,EACT,UAAU,EACV,cAAc,EACd,QAAQ,EACR,GAAG,IAAI,KAAK,CACb,CACF,CAAA;QACH,CAAC;QAED,IAAI,QAAQ,EAAE,CAAC;YACb,SAAS,CAAC,IAAI,CAAC,IAAA,UAAG,EAAC,0BAAe,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAA;QAChF,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;GAIG;AACH,SAAS,qBAAqB,CAC5B,IAAY,EACZ,SAAiB,EACjB,UAAkB,EAClB,cAA2F,EAC3F,QAA4B,EAC5B,IAAY;IAEZ,MAAM,SAAS,GAA6B,EAAE,CAAA;IAE9C,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CACb,aAAa,IAAI,iEAAiE;gBAChF,IAAI;gBACJ,sDAAsD;gBACtD,iDAAiD;gBACjD,uBAAuB,IAAI,QAAQ;gBACnC,iBAAiB;gBACjB,IAAI;gBACJ,oEAAoE;gBACpE,qBAAqB,IAAI,qBAAqB,CACjD,CAAA;QACH,CAAC;QACD,SAAS,CAAC,IAAI,CACZ,IAAA,UAAG,EAAC,QAAQ,EAAE;YACZ,UAAU,EAAE,IAAI;YAChB,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE;YACzC,UAAU,EAAE;gBACV,QAAQ;gBACR,QAAQ,EAAE,IAAI;gBACd,GAAG,EAAE,gBAAgB,IAAI,IAAI,QAAQ,IAAI,IAAI,SAAS,IAAI,EAAE;aAC7D;SACF,CAAC,CACH,CAAA;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,QAAQ,cAAc,CAAC,OAAO,EAAE,CAAC;QAC/B,KAAK,OAAO;YACV,SAAS,CAAC,IAAI,CACZ,IAAA,UAAG,EAAC,mBAAmB,EAAE;gBACvB,UAAU,EAAE,+BAA+B;gBAC3C,IAAI,EAAE,mBAAmB;gBACzB,QAAQ,EAAE,EAAE,IAAI,EAAE,GAAG,IAAI,YAAY,EAAE,SAAS,EAAE;gBAClD,IAAI,EAAE;oBACJ,YAAY,EAAE,cAAc,CAAC,OAAO;oBACpC,KAAK,EAAE,cAAc,CAAC,KAAK;oBAC3B,IAAI,EAAE,OAAO;oBACb,IAAI,EAAE,GAAG,cAAc,CAAC,IAAI,IAAI,IAAI,EAAE;oBACtC,WAAW,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE;iBAChD;aACF,CAAC,CACH,CAAA;YACD,MAAK;QAEP,KAAK,SAAS;YACZ,SAAS,CAAC,IAAI,CACZ,IAAA,UAAG,EAAC,qBAAqB,EAAE;gBACzB,UAAU,EAAE,6BAA6B;gBACzC,IAAI,EAAE,qBAAqB;gBAC3B,QAAQ,EAAE,EAAE,IAAI,EAAE,GAAG,IAAI,YAAY,EAAE,SAAS,EAAE;gBAClD,IAAI,EAAE;oBACJ,cAAc,EAAE,cAAc,CAAC,OAAO;oBACtC,KAAK,EAAE,cAAc,CAAC,KAAK;oBAC3B,IAAI,EAAE,OAAO;oBACb,IAAI,EAAE,GAAG,cAAc,CAAC,IAAI,IAAI,IAAI,EAAE;oBACtC,WAAW,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE;iBAChD;aACF,CAAC,CACH,CAAA;YACD,MAAK;QAEP,KAAK,gBAAgB;YACnB,uEAAuE;YACvE,oEAAoE;YACpE,wDAAwD;YACxD,SAAS,CAAC,IAAI,CACZ,IAAA,UAAG,EAAC,cAAc,EAAE;gBAClB,UAAU,EAAE,sBAAsB;gBAClC,IAAI,EAAE,cAAc;gBACpB,QAAQ,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE;gBACzC,IAAI,EAAE;oBACJ,aAAa,EAAE;wBACb,+DAA+D;wBAC/D,QAAQ,EAAE,2BAA2B;qBACtC;iBACF;aACF,CAAC,CACH,CAAA;YACD,MAAK;QAEP,KAAK,YAAY;YACf,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,KAAK,CACb,aAAa,IAAI,uEAAuE;oBACtF,IAAI;oBACJ,0EAA0E;oBAC1E,kDAAkD;oBAClD,iDAAiD;oBACjD,IAAI;oBACJ,qCAAqC;oBACrC,qBAAqB,IAAI,qBAAqB,CACjD,CAAA;YACH,CAAC;YACD,SAAS,CAAC,IAAI,CACZ,IAAA,UAAG,EAAC,QAAQ,EAAE;gBACZ,UAAU,EAAE,IAAI;gBAChB,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE;gBACzC,UAAU,EAAE;oBACV,QAAQ;oBACR,QAAQ,EAAE,IAAI;oBACd,GAAG,EAAE,gBAAgB,IAAI,IAAI,QAAQ,IAAI,IAAI,SAAS,IAAI,EAAE;iBAC7D;aACF,CAAC,CACH,CAAA;YACD,MAAK;QAEP;YACE,MAAM,IAAI,KAAK,CACb,aAAa,IAAI,qCAAqC,cAAc,CAAC,OAAO,MAAM;gBAChF,wEAAwE,CAC3E,CAAA;IACL,CAAC;IAED,OAAO,SAAS,CAAA;AAClB,CAAC"}

package/dist/dns-provider.d.ts

@@ -0,0 +1,110 @@
+/**
+ * ExternalDNS configuration component.
+ *
+ * Use as a value in DnsProvider when you need custom configuration:
+ * ```tsx
+ * <DnsProvider provider={<ExternalDns server="ns1.example.com" tsig={{ path: 'dns/tsig', key: 'secret' }} />}>
+ * ```
+ */
+export interface ExternalDnsProps {
+    /** DNS server for RFC 2136 updates (e.g., 'ns1.example.com') */
+    server?: string;
+    /** DNS zone name (e.g., 'example.com') */
+    zone?: string;
+    /** TSIG secret for secure updates */
+    tsig?: {
+        /** Vault/OpenBao path to the TSIG key */
+        path: string;
+        /** Key in the Vault/OpenBao secret */
+        key: string;
+        /** Kubernetes Secret name to create (default: 'external-dns-tsig') */
+        secretName?: string;
+    };
+    /** Cloud provider config (alternative to RFC 2136) */
+    cloud?: {
+        provider: 'aws' | 'google' | 'cloudflare';
+        /** Provider-specific options */
+        options?: Record<string, string>;
+    };
+    /**
+     * Explicit DNS targets (IPs or hostnames) for DNSEndpoint records.
+     * When set, Endpoint components create DNSEndpoint CRs with these targets.
+     * When omitted, Endpoints annotate Gateway/Ingress instead and let
+     * ExternalDNS discover hostnames via its gateway/ingress source.
+     */
+    targets?: string[];
+}
+export declare function ExternalDns(props: ExternalDnsProps): DnsConfig;
+/** DNS provider configuration */
+export interface DnsConfig {
+    /** DNS provider type */
+    provider: 'external-dns';
+    /** Provider-specific settings */
+    settings: ExternalDnsProps;
+}
+/** Union of all DNS provider configurations */
+export type DnsProviderValue = 'external-dns' | DnsConfig;
+export declare const DnsContext: import("../../core/src/context").Context<DnsConfig | null>;
+export interface DnsProviderProps {
+    /**
+     * DNS provider — string for simple cases, component for advanced config.
+     *
+     * @example
+     * // Simple string
+     * <DnsProvider provider="external-dns">
+     *
+     * @example
+     * // Advanced component
+     * <DnsProvider provider={<ExternalDns server="ns1.example.com" tsig={{ path: 'dns/tsig', key: 'secret' }} />}>
+     */
+    provider: DnsProviderValue;
+    /** Child components */
+    children?: unknown;
+}
+/**
+ * DnsProvider — cluster-level DNS configuration.
+ *
+ * Sets up ExternalDNS with the specified provider and credentials.
+ * All Endpoint/App children automatically create DNS records.
+ *
+ * @example
+ * import { DnsProvider, SecretProvider, App } from '@r8s/recipes'
+ *
+ * export default (
+ *   <SecretProvider provider="openbao">
+ *     <DnsProvider provider="external-dns">
+ *       <App name="api" image="myapp:v1" host="api.example.com" />
+ *     </DnsProvider>
+ *   </SecretProvider>
+ * )
+ *
+ * @example
+ * import { DnsProvider, ExternalDns, SecretProvider, App } from '@r8s/recipes'
+ *
+ * export default (
+ *   <SecretProvider provider="openbao">
+ *     <DnsProvider provider={
+ *       <ExternalDns
+ *         server="ns1.example.com"
+ *         zone="example.com"
+ *         tsig={{ path: 'dns/tsig', key: 'secret' }}
+ *       />
+ *     }>
+ *       <App name="api" image="myapp:v1" host="api.example.com" />
+ *     </DnsProvider>
+ *   </SecretProvider>
+ * )
+ *
+ * @example
+ * import { DnsProvider, ExternalDns, App } from '@r8s/recipes'
+ *
+ * export default (
+ *   <DnsProvider provider={
+ *     <ExternalDns cloud={{ provider: 'google', options: { project: 'my-project' } }} />
+ *   }>
+ *     <App name="api" image="myapp:v1" host="api.example.com" />
+ *   </DnsProvider>
+ * )
+ */
+export declare function DnsProvider(props: DnsProviderProps): import("@r8s/core").r8sElement;
+//# sourceMappingURL=dns-provider.d.ts.map

package/dist/dns-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dns-provider.d.ts","sourceRoot":"","sources":["../src/dns-provider.tsx"],"names":[],"mappings":"AAKA;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB;IAC/B,gEAAgE;IAChE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,0CAA0C;IAC1C,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,qCAAqC;IACrC,IAAI,CAAC,EAAE;QACL,yCAAyC;QACzC,IAAI,EAAE,MAAM,CAAA;QACZ,sCAAsC;QACtC,GAAG,EAAE,MAAM,CAAA;QACX,sEAAsE;QACtE,UAAU,CAAC,EAAE,MAAM,CAAA;KACpB,CAAA;IACD,sDAAsD;IACtD,KAAK,CAAC,EAAE;QACN,QAAQ,EAAE,KAAK,GAAG,QAAQ,GAAG,YAAY,CAAA;QACzC,gCAAgC;QAChC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KACjC,CAAA;IACD;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;CACnB;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,SAAS,CAK9D;AAED,iCAAiC;AACjC,MAAM,WAAW,SAAS;IACxB,wBAAwB;IACxB,QAAQ,EAAE,cAAc,CAAA;IACxB,iCAAiC;IACjC,QAAQ,EAAE,gBAAgB,CAAA;CAC3B;AAED,+CAA+C;AAC/C,MAAM,MAAM,gBAAgB,GAAG,cAAc,GAAG,SAAS,CAAA;AAEzD,eAAO,MAAM,UAAU,4DAAwC,CAAA;AAE/D,MAAM,WAAW,gBAAgB;IAC/B;;;;;;;;;;OAUG;IACH,QAAQ,EAAE,gBAAgB,CAAA;IAC1B,uBAAuB;IACvB,QAAQ,CAAC,EAAE,OAAO,CAAA;CACnB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,gBAAgB,kCAqElD"}

package/dist/dns-provider.js

@@ -0,0 +1,121 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DnsContext = void 0;
+exports.ExternalDns = ExternalDns;
+exports.DnsProvider = DnsProvider;
+const core_1 = require("@r8s/core");
+const defaults_1 = require("@r8s/core/defaults");
+const defaults_2 = require("@r8s/core/defaults");
+const crds_1 = require("@r8s/crds");
+function ExternalDns(props) {
+    return {
+        provider: 'external-dns',
+        settings: props,
+    };
+}
+exports.DnsContext = (0, defaults_1.createContext)(null);
+/**
+ * DnsProvider — cluster-level DNS configuration.
+ *
+ * Sets up ExternalDNS with the specified provider and credentials.
+ * All Endpoint/App children automatically create DNS records.
+ *
+ * @example
+ * import { DnsProvider, SecretProvider, App } from '@r8s/recipes'
+ *
+ * export default (
+ *   <SecretProvider provider="openbao">
+ *     <DnsProvider provider="external-dns">
+ *       <App name="api" image="myapp:v1" host="api.example.com" />
+ *     </DnsProvider>
+ *   </SecretProvider>
+ * )
+ *
+ * @example
+ * import { DnsProvider, ExternalDns, SecretProvider, App } from '@r8s/recipes'
+ *
+ * export default (
+ *   <SecretProvider provider="openbao">
+ *     <DnsProvider provider={
+ *       <ExternalDns
+ *         server="ns1.example.com"
+ *         zone="example.com"
+ *         tsig={{ path: 'dns/tsig', key: 'secret' }}
+ *       />
+ *     }>
+ *       <App name="api" image="myapp:v1" host="api.example.com" />
+ *     </DnsProvider>
+ *   </SecretProvider>
+ * )
+ *
+ * @example
+ * import { DnsProvider, ExternalDns, App } from '@r8s/recipes'
+ *
+ * export default (
+ *   <DnsProvider provider={
+ *     <ExternalDns cloud={{ provider: 'google', options: { project: 'my-project' } }} />
+ *   }>
+ *     <App name="api" image="myapp:v1" host="api.example.com" />
+ *   </DnsProvider>
+ * )
+ */
+function DnsProvider(props) {
+    const { provider, children } = props;
+    const sharedOperators = (0, core_1.useContext)(defaults_2.OperatorContext);
+    const secrets = (0, core_1.useContext)(defaults_2.SecretContext);
+    // Resolve provider config
+    let config;
+    if (typeof provider === 'string') {
+        config = { provider, settings: {} };
+    }
+    else if ('settings' in provider) {
+        config = provider;
+    }
+    else if (provider &&
+        typeof provider === 'object' &&
+        'type' in provider &&
+        provider.type === ExternalDns) {
+        // r8s JSX element — call the component with its props
+        config = ExternalDns(provider.props);
+    }
+    else {
+        config = { provider: 'external-dns', settings: provider };
+    }
+    const resources = [];
+    // Declare external-dns operator
+    const hasExternalDNS = sharedOperators.some((op) => op.name === 'external-dns');
+    if (!hasExternalDNS) {
+        resources.push((0, core_1.declareOperator)(crds_1.operators['external-dns']()));
+    }
+    // TSIG secret via VSO
+    if (config.settings.tsig) {
+        if (!secrets || (secrets.backend !== 'vault' && secrets.backend !== 'openbao')) {
+            throw new Error(`DnsProvider: tsig requires SecretProvider with backend 'vault' or 'openbao'. ` +
+                `Current: ${secrets?.backend ?? 'none'}. ` +
+                `Fix: wrap in <SecretProvider provider="openbao"> or remove tsig.`);
+        }
+        const secretName = config.settings.tsig.secretName ?? 'external-dns-tsig';
+        const mount = secrets.mount ?? 'secret';
+        const basePath = secrets.path ?? '';
+        const fullPath = basePath
+            ? `${basePath}/${config.settings.tsig.path}`
+            : config.settings.tsig.path;
+        const SecretKind = secrets.backend === 'openbao' ? 'OpenBaoStaticSecret' : 'VaultStaticSecret';
+        resources.push((0, core_1.jsx)(SecretKind, {
+            apiVersion: 'secrets.hashicorp.com/v1alpha1',
+            kind: SecretKind,
+            metadata: { name: secretName, namespace: 'external-dns' },
+            spec: {
+                mount,
+                path: fullPath,
+                type: 'kv-v2',
+                destination: { name: secretName, create: true },
+                refreshAfter: '1h',
+            },
+        }));
+    }
+    return (0, core_1.jsx)(core_1.Fragment, {
+        children: [...resources, (0, core_1.jsx)(exports.DnsContext.Provider, { value: config, children })],
+    });
+}
+//# sourceMappingURL=dns-provider.js.map

package/dist/dns-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dns-provider.js","sourceRoot":"","sources":["../src/dns-provider.tsx"],"names":[],"mappings":";;;AA0CA,kCAKC;AA6ED,kCAqEC;AAjMD,oCAAsE;AACtE,iDAAkD;AAClD,iDAAmE;AACnE,oCAAqC;AAuCrC,SAAgB,WAAW,CAAC,KAAuB;IACjD,OAAO;QACL,QAAQ,EAAE,cAAc;QACxB,QAAQ,EAAE,KAAK;KAChB,CAAA;AACH,CAAC;AAaY,QAAA,UAAU,GAAG,IAAA,wBAAa,EAAmB,IAAI,CAAC,CAAA;AAmB/D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,SAAgB,WAAW,CAAC,KAAuB;IACjD,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAA;IAEpC,MAAM,eAAe,GAAG,IAAA,iBAAU,EAAC,0BAAe,CAAC,CAAA;IACnD,MAAM,OAAO,GAAG,IAAA,iBAAU,EAAC,wBAAa,CAAC,CAAA;IAEzC,0BAA0B;IAC1B,IAAI,MAAiB,CAAA;IACrB,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjC,MAAM,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAA;IACrC,CAAC;SAAM,IAAI,UAAU,IAAI,QAAQ,EAAE,CAAC;QAClC,MAAM,GAAG,QAAQ,CAAA;IACnB,CAAC;SAAM,IACL,QAAQ;QACR,OAAO,QAAQ,KAAK,QAAQ;QAC5B,MAAM,IAAI,QAAQ;QACjB,QAAgB,CAAC,IAAI,KAAK,WAAW,EACtC,CAAC;QACD,sDAAsD;QACtD,MAAM,GAAG,WAAW,CAAE,QAAgB,CAAC,KAAK,CAAC,CAAA;IAC/C,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,EAAE,QAAQ,EAAE,cAAc,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAA;IAC3D,CAAC;IAED,MAAM,SAAS,GAA6B,EAAE,CAAA;IAE9C,gCAAgC;IAChC,MAAM,cAAc,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,KAAK,cAAc,CAAC,CAAA;IAC/E,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,SAAS,CAAC,IAAI,CAAC,IAAA,sBAAe,EAAC,gBAAS,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,CAAA;IAC9D,CAAC;IAED,sBAAsB;IACtB,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACzB,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,KAAK,OAAO,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,EAAE,CAAC;YAC/E,MAAM,IAAI,KAAK,CACb,+EAA+E;gBAC7E,YAAY,OAAO,EAAE,OAAO,IAAI,MAAM,IAAI;gBAC1C,kEAAkE,CACrE,CAAA;QACH,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,IAAI,mBAAmB,CAAA;QACzE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,QAAQ,CAAA;QACvC,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,IAAI,EAAE,CAAA;QACnC,MAAM,QAAQ,GAAG,QAAQ;YACvB,CAAC,CAAC,GAAG,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE;YAC5C,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAA;QAE7B,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,mBAAmB,CAAA;QAC9F,SAAS,CAAC,IAAI,CACZ,IAAA,UAAG,EAAC,UAAU,EAAE;YACd,UAAU,EAAE,gCAAgC;YAC5C,IAAI,EAAE,UAAU;YAChB,QAAQ,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,cAAc,EAAE;YACzD,IAAI,EAAE;gBACJ,KAAK;gBACL,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,OAAO;gBACb,WAAW,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE;gBAC/C,YAAY,EAAE,IAAI;aACnB;SACF,CAAC,CACH,CAAA;IACH,CAAC;IAED,OAAO,IAAA,UAAG,EAAC,eAAQ,EAAE;QACnB,QAAQ,EAAE,CAAC,GAAG,SAAS,EAAE,IAAA,UAAG,EAAC,kBAAU,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;KAChF,CAAC,CAAA;AACJ,CAAC"}

package/dist/endpoint-provider.d.ts

@@ -0,0 +1,121 @@
+/**
+ * Nginx Ingress configuration component.
+ *
+ * Use as a value in EndpointProvider when you need custom configuration:
+ * ```tsx
+ * <EndpointProvider provider={<Nginx className="nginx-internal" />}>
+ * ```
+ */
+export interface NginxProps {
+    /** Ingress class name (default: 'nginx') */
+    className?: string;
+    /** Default TLS configuration */
+    tls?: {
+        /** ClusterIssuer for cert-manager */
+        clusterIssuer?: string;
+    };
+}
+export declare function Nginx(props: NginxProps): EndpointConfig;
+/**
+ * Envoy Gateway configuration component.
+ *
+ * Use as a value in EndpointProvider when you need custom configuration:
+ * ```tsx
+ * <EndpointProvider provider={<EnvoyGateway className="eg" tls={{ clusterIssuer: 'letsencrypt' }} />}>
+ * ```
+ */
+export interface EnvoyGatewayProps {
+    /** Gateway class name (default: 'eg') */
+    className?: string;
+    /** Default TLS configuration */
+    tls?: {
+        /** ClusterIssuer for cert-manager */
+        clusterIssuer?: string;
+    };
+}
+export declare function EnvoyGateway(props: EnvoyGatewayProps): EndpointConfig;
+/** Endpoint provider configuration */
+export interface EndpointConfig {
+    /** Routing implementation */
+    provider: 'nginx' | 'envoy-gateway';
+    /** Provider-specific settings */
+    settings?: {
+        /** Gateway class name (envoy-gateway only) */
+        gatewayClassName?: string;
+        /** Ingress class name (nginx only) */
+        ingressClassName?: string;
+        /** Default TLS configuration */
+        tls?: {
+            clusterIssuer?: string;
+        };
+    };
+}
+/** Union of all endpoint provider configurations */
+export type EndpointProviderValue = 'nginx' | 'envoy-gateway' | EndpointConfig;
+export declare const EndpointContext: import("../../core/src/context").Context<EndpointConfig>;
+export interface EndpointProviderProps {
+    /**
+     * Endpoint provider — string for simple cases, component for advanced config.
+     *
+     * @example
+     * // Simple string provider
+     * import { EndpointProvider, App } from '@r8s/recipes'
+     *
+     * export default (
+     *   <EndpointProvider provider="nginx">
+     *     <App name="api" image="myapp:v1" host="api.example.com" />
+     *   </EndpointProvider>
+     * )
+     *
+     * @example
+     * // Advanced component provider
+     * import { EndpointProvider, Nginx, App } from '@r8s/recipes'
+     *
+     * export default (
+     *   <EndpointProvider provider={<Nginx className="nginx-internal" />}>
+     *     <App name="api" image="myapp:v1" host="api.example.com" />
+     *   </EndpointProvider>
+     * )
+     */
+    provider: EndpointProviderValue;
+    /** Child components */
+    children?: unknown;
+}
+/**
+ * EndpointProvider — cluster-level routing configuration.
+ *
+ * Sets whether endpoints use nginx Ingress or Envoy Gateway (Gateway API).
+ * All Endpoint/App children read this context.
+ *
+ * @example
+ * // Simple string provider
+ * import { EndpointProvider, App } from '@r8s/recipes'
+ *
+ * export default (
+ *   <EndpointProvider provider="nginx">
+ *     <App name="api" image="myapp:v1" host="api.example.com" />
+ *   </EndpointProvider>
+ * )
+ *
+ * @example
+ * // Nginx with custom class and TLS
+ * import { EndpointProvider, Nginx, App } from '@r8s/recipes'
+ *
+ * export default (
+ *   <EndpointProvider provider={<Nginx className="nginx-internal" tls={{ clusterIssuer: 'letsencrypt' }} />}>
+ *     <App name="api" image="myapp:v1" host="api.example.com" />
+ *   </EndpointProvider>
+ * )
+ *
+ * @example
+ * // Envoy Gateway with TLS
+ * import { EndpointProvider, EnvoyGateway, App } from '@r8s/recipes'
+ *
+ * export default (
+ *   <EndpointProvider provider={<EnvoyGateway className="eg" tls={{ clusterIssuer: 'letsencrypt-prod' }} />}>
+ *     <App name="api" image="myapp:v1" host="api.example.com" />
+ *   </EndpointProvider>
+ * )
+ */
+export declare function EndpointProvider(props: EndpointProviderProps): import("@r8s/core").r8sElement;
+//# sourceMappingURL=endpoint-provider.d.ts.map

package/dist/endpoint-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"endpoint-provider.d.ts","sourceRoot":"","sources":["../src/endpoint-provider.tsx"],"names":[],"mappings":"AAIA;;;;;;;GAOG;AACH,MAAM,WAAW,UAAU;IACzB,4CAA4C;IAC5C,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,gCAAgC;IAChC,GAAG,CAAC,EAAE;QACJ,qCAAqC;QACrC,aAAa,CAAC,EAAE,MAAM,CAAA;KACvB,CAAA;CACF;AAED,wBAAgB,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,cAAc,CAQvD;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,iBAAiB;IAChC,yCAAyC;IACzC,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,gCAAgC;IAChC,GAAG,CAAC,EAAE;QACJ,qCAAqC;QACrC,aAAa,CAAC,EAAE,MAAM,CAAA;KACvB,CAAA;CACF;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,iBAAiB,GAAG,cAAc,CAQrE;AAED,sCAAsC;AACtC,MAAM,WAAW,cAAc;IAC7B,6BAA6B;IAC7B,QAAQ,EAAE,OAAO,GAAG,eAAe,CAAA;IACnC,iCAAiC;IACjC,QAAQ,CAAC,EAAE;QACT,8CAA8C;QAC9C,gBAAgB,CAAC,EAAE,MAAM,CAAA;QACzB,sCAAsC;QACtC,gBAAgB,CAAC,EAAE,MAAM,CAAA;QACzB,gCAAgC;QAChC,GAAG,CAAC,EAAE;YACJ,aAAa,CAAC,EAAE,MAAM,CAAA;SACvB,CAAA;KACF,CAAA;CACF;AAED,oDAAoD;AACpD,MAAM,MAAM,qBAAqB,GAAG,OAAO,GAAG,eAAe,GAAG,cAAc,CAAA;AAE9E,eAAO,MAAM,eAAe,0DAAuD,CAAA;AAEnF,MAAM,WAAW,qBAAqB;IACpC;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,QAAQ,EAAE,qBAAqB,CAAA;IAC/B,uBAAuB;IACvB,QAAQ,CAAC,EAAE,OAAO,CAAA;CACnB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,qBAAqB,kCAgB5D"}

package/dist/endpoint-provider.js

@@ -0,0 +1,79 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EndpointContext = void 0;
+exports.Nginx = Nginx;
+exports.EnvoyGateway = EnvoyGateway;
+exports.EndpointProvider = EndpointProvider;
+const core_1 = require("@r8s/core");
+const defaults_1 = require("@r8s/core/defaults");
+const defaults_2 = require("@r8s/core/defaults");
+function Nginx(props) {
+    return {
+        provider: 'nginx',
+        settings: {
+            ingressClassName: props.className ?? 'nginx',
+            tls: props.tls,
+        },
+    };
+}
+function EnvoyGateway(props) {
+    return {
+        provider: 'envoy-gateway',
+        settings: {
+            gatewayClassName: props.className ?? 'eg',
+            tls: props.tls,
+        },
+    };
+}
+exports.EndpointContext = (0, defaults_1.createContext)({ provider: 'nginx' });
+/**
+ * EndpointProvider — cluster-level routing configuration.
+ *
+ * Sets whether endpoints use nginx Ingress or Envoy Gateway (Gateway API).
+ * All Endpoint/App children read this context.
+ *
+ * @example
+ * // Simple string provider
+ * import { EndpointProvider, App } from '@r8s/recipes'
+ *
+ * export default (
+ *   <EndpointProvider provider="nginx">
+ *     <App name="api" image="myapp:v1" host="api.example.com" />
+ *   </EndpointProvider>
+ * )
+ *
+ * @example
+ * // Nginx with custom class and TLS
+ * import { EndpointProvider, Nginx, App } from '@r8s/recipes'
+ *
+ * export default (
+ *   <EndpointProvider provider={<Nginx className="nginx-internal" tls={{ clusterIssuer: 'letsencrypt' }} />}>
+ *     <App name="api" image="myapp:v1" host="api.example.com" />
+ *   </EndpointProvider>
+ * )
+ *
+ * @example
+ * // Envoy Gateway with TLS
+ * import { EndpointProvider, EnvoyGateway, App } from '@r8s/recipes'
+ *
+ * export default (
+ *   <EndpointProvider provider={<EnvoyGateway className="eg" tls={{ clusterIssuer: 'letsencrypt-prod' }} />}>
+ *     <App name="api" image="myapp:v1" host="api.example.com" />
+ *   </EndpointProvider>
+ * )
+ */
+function EndpointProvider(props) {
+    const { provider, children } = props;
+    // Resolve provider config
+    const config = typeof provider === 'string' ? { provider } : provider;
+    // Map to RoutingContext for backward compatibility
+    const routing = {
+        mode: config.provider === 'envoy-gateway' ? 'gateway' : 'ingress',
+        gatewayClassName: config.settings?.gatewayClassName ?? 'eg',
+    };
+    return (0, core_1.jsx)(defaults_2.RoutingContext.Provider, {
+        value: routing,
+        children: (0, core_1.jsx)(exports.EndpointContext.Provider, { value: config, children }),
+    });
+}
+//# sourceMappingURL=endpoint-provider.js.map