@rizom/ops 0.2.0-alpha.190 → 0.2.0-alpha.192

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rizom/ops",
-  "version": "0.2.0-alpha.190",
+  "version": "0.2.0-alpha.192",
   "description": "Operator CLI for managing private brain fleet registry repos",
   "keywords": [
     "brains",

package/templates/rover-pilot/.github/workflows/deploy.yml

@@ -211,11 +211,16 @@ jobs:
 
       - name: Update Cloudflare DNS
         env:
+          CF_ZONE_ID: ${{ steps.user_config.outputs.cloudflare_zone_id }}
           BRAIN_DOMAIN: ${{ steps.user_config.outputs.brain_domain }}
+          WWW_DOMAIN: ${{ steps.user_config.outputs.www_domain }}
           PREVIEW_DOMAIN: ${{ steps.user_config.outputs.preview_domain }}
           SERVER_IP: ${{ steps.provision.outputs.server_ip }}
         run: |
           bun deploy/scripts/update-dns.ts
+          if [ -n "$WWW_DOMAIN" ]; then
+            BRAIN_DOMAIN="$WWW_DOMAIN" bun deploy/scripts/update-dns.ts
+          fi
           BRAIN_DOMAIN="$PREVIEW_DOMAIN" bun deploy/scripts/update-dns.ts
 
       - name: Validate SSH key
@@ -243,6 +248,7 @@ jobs:
           IMAGE_REPOSITORY: ${{ steps.user_config.outputs.image_repository }}
           REGISTRY_USERNAME: ${{ steps.user_config.outputs.registry_username }}
           BRAIN_DOMAIN: ${{ steps.user_config.outputs.brain_domain }}
+          WWW_DOMAIN: ${{ steps.user_config.outputs.www_domain }}
           PREVIEW_DOMAIN: ${{ steps.user_config.outputs.preview_domain }}
           BRAIN_YAML_PATH: ${{ steps.user_config.outputs.brain_yaml_path }}
         run: kamal setup --skip-push -c deploy/kamal/deploy.yml
@@ -251,9 +257,13 @@ jobs:
         env:
           SERVER_IP: ${{ steps.provision.outputs.server_ip }}
           BRAIN_DOMAIN: ${{ steps.user_config.outputs.brain_domain }}
+          WWW_DOMAIN: ${{ steps.user_config.outputs.www_domain }}
           PREVIEW_DOMAIN: ${{ steps.user_config.outputs.preview_domain }}
         run: |
           curl -I -k --max-time 20 --resolve "$BRAIN_DOMAIN:443:$SERVER_IP" "https://$BRAIN_DOMAIN/health"
+          if [ -n "$WWW_DOMAIN" ]; then
+            curl -I -k --max-time 20 --resolve "$WWW_DOMAIN:443:$SERVER_IP" "https://$WWW_DOMAIN/"
+          fi
           curl -I -k --max-time 20 --resolve "$PREVIEW_DOMAIN:443:$SERVER_IP" "https://$PREVIEW_DOMAIN/"
 
       - name: Upload generated config

package/templates/rover-pilot/deploy/scripts/decrypt-user-secrets.ts

@@ -28,9 +28,19 @@ writeSecretGitHubEnv("DISCORD_BOT_TOKEN", secrets["discordBotToken"]);
 // Per-user AT Protocol publishing credential (optional; from the user's
 // encrypted secrets file). The scaffold wires this so a pilot can publish its
 // brain's agent card to its PDS; a deployment that doesn't publish simply
-// leaves it unset. TLS material (CERTIFICATE_PEM/PRIVATE_KEY_PEM) is handled by
-// the kamal proxy block via shared env, not here.
+// leaves it unset.
 writeSecretGitHubEnv("ATPROTO_APP_PASSWORD", secrets["atprotoAppPassword"]);
+// Per-user custom-domain TLS overrides the shared fleet certificate when a
+// complete certificate/key pair is present in the encrypted user secrets.
+const certificatePem = decodeEscapedSecret(secrets["certificatePem"]);
+const privateKeyPem = decodeEscapedSecret(secrets["privateKeyPem"]);
+if (Boolean(certificatePem) !== Boolean(privateKeyPem)) {
+  throw new Error(
+    "Custom-domain TLS secrets require both certificatePem and privateKeyPem",
+  );
+}
+writeSecretGitHubEnv("CERTIFICATE_PEM", certificatePem);
+writeSecretGitHubEnv("PRIVATE_KEY_PEM", privateKeyPem);
 
 writeGitHubOutput(
   "shared_ai_api_key_secret_name",
@@ -98,6 +108,10 @@ function parseFlatYaml(contents: string): Record<string, string> {
   return result;
 }
 
+function decodeEscapedSecret(value: string | undefined): string | undefined {
+  return value?.replace(/\\n/g, "\n");
+}
+
 function requireFlatValue(
   values: Record<string, string>,
   key: string,

package/templates/rover-pilot/deploy/scripts/resolve-user-config.ts

@@ -25,14 +25,23 @@ if (!brainDomain) {
   throw new Error(`Missing domain in ${brainYamlPath}`);
 }
 
-const zone =
-  brainDomain.startsWith(`${handle}.`) && brainDomain.length > handle.length + 1
-    ? brainDomain.slice(handle.length + 1)
-    : "";
-if (!zone) {
-  throw new Error(`Could not derive preview domain from ${brainDomain}`);
+const registry = await loadPilotRegistry(process.cwd());
+const user = registry.users.find((entry) => entry.handle === handle);
+if (!user) {
+  throw new Error(`Unknown user handle: ${handle}`);
 }
-const previewDomain = `${handle}-preview.${zone}`;
+const previewDomain = resolvePreviewDomain(
+  handle,
+  brainDomain,
+  registry.pilot.domainSuffix,
+);
+const wwwDomain = isFleetDomain(
+  handle,
+  brainDomain,
+  registry.pilot.domainSuffix,
+)
+  ? ""
+  : `www.${brainDomain}`;
 
 const brainVersion = envEntries["BRAIN_VERSION"] ?? "";
 
@@ -40,9 +49,7 @@ const brainVersion = envEntries["BRAIN_VERSION"] ?? "";
 // `brain-{version}` for a default instance, or its own `brain-{version}-sites-
 // {hash}` when it declares a siteOverride. Resolved through the same helper the
 // build uses so the tag we wait for and run matches exactly what was pushed.
-const registry = await loadPilotRegistry(process.cwd());
-const user = registry.users.find((entry) => entry.handle === handle);
-const sitePackages = sitePackagesFor(user?.siteOverride);
+const sitePackages = sitePackagesFor(user.siteOverride);
 const imageTag = siteImageTag(brainVersion, sitePackages);
 
 const outputs: Record<string, string> = {
@@ -50,6 +57,8 @@ const outputs: Record<string, string> = {
   content_repo: envEntries["CONTENT_REPO"] ?? "",
   brain_domain: brainDomain,
   preview_domain: previewDomain,
+  www_domain: wwwDomain,
+  cloudflare_zone_id: user.cloudflareZoneId ?? process.env["CF_ZONE_ID"] ?? "",
   brain_yaml_path: brainYamlPath,
   instance_name: `rover-${handle}`,
   image_repository: `ghcr.io/${repository}`,
@@ -67,3 +76,28 @@ for (const key of required) {
 for (const [key, value] of Object.entries(outputs)) {
   writeGitHubOutput(key, value);
 }
+
+function resolvePreviewDomain(
+  userHandle: string,
+  domain: string,
+  pilotDomainSuffix: string,
+): string {
+  if (!isFleetDomain(userHandle, domain, pilotDomainSuffix)) {
+    return `preview.${domain}`;
+  }
+
+  const fleetZone = pilotDomainSuffix.replace(/^\./, "");
+  if (!fleetZone) {
+    throw new Error(`Could not derive preview domain from ${domain}`);
+  }
+
+  return `${userHandle}-preview.${fleetZone}`;
+}
+
+function isFleetDomain(
+  userHandle: string,
+  domain: string,
+  pilotDomainSuffix: string,
+): boolean {
+  return domain === `${userHandle}${pilotDomainSuffix}`;
+}