@serve.zone/appstore 0.3.1 → 1.1.0

package/ts_client/classes.appstoreresolver.ts

@@ -1,4 +1,4 @@
-import type * as interfaces from '@serve.zone/interfaces';
+import * as interfaces from '@serve.zone/interfaces';
 import packageJson from '../package.json' with { type: 'json' };
 import { appStorePackageData } from './data.generated.js';
 import type {
@@ -213,18 +213,60 @@ export class AppStoreResolver {
     if (!configArg.image || typeof configArg.image !== 'string') {
       throw new Error(`Invalid ${labelArg}: image is required`);
     }
-    this.assertValidPort(configArg.port, `${labelArg} port`);
+    if (configArg.port !== undefined) {
+      this.assertValidPort(configArg.port, `${labelArg} port`);
+    }
+    this.validateTargetPortModel(configArg, labelArg);
+    const containerArgErrors = interfaces.data.validateServiceContainerArgs(configArg.containerArgs);
+    if (containerArgErrors.length > 0) {
+      throw new Error(`Invalid ${labelArg}: ${containerArgErrors.join('; ')}`);
+    }
 
+    const envVarKeys = new Set<string>();
+    const secretEnvVarKeys = new Set<string>();
     for (const envVar of configArg.envVars || []) {
       if (!envVar.key || !/^[A-Za-z_][A-Za-z0-9_]*$/.test(envVar.key)) {
         throw new Error(`Invalid ${labelArg}: env var key '${envVar.key}' is not valid`);
       }
+      if (envVarKeys.has(envVar.key)) {
+        throw new Error(`Invalid ${labelArg}: env var key '${envVar.key}' is duplicated`);
+      }
+      envVarKeys.add(envVar.key);
       if (envVar.value !== undefined && typeof envVar.value !== 'string') {
         throw new Error(`Invalid ${labelArg}: env var '${envVar.key}' value must be a string`);
       }
+      if (envVar.secret) {
+        secretEnvVarKeys.add(envVar.key);
+        if (envVar.value !== undefined) {
+          throw new Error(`Invalid ${labelArg}: secret '${envVar.key}' must not define a template value`);
+        }
+      }
+      if (envVar.generate) {
+        if (!envVar.secret
+          || envVar.generate.type !== 'randomHex'
+          || !Number.isInteger(envVar.generate.bytes)
+          || envVar.generate.bytes < 16
+          || envVar.generate.bytes > 64) {
+          throw new Error(`Invalid ${labelArg}: secret generator '${envVar.key}' is invalid`);
+        }
+      }
     }
 
-    this.normalizeVolumes(configArg.volumes);
+    const normalizedVolumes = this.normalizeVolumes(configArg.volumes);
+    const secretFileErrors = interfaces.data.validateServiceSecretFiles(
+      configArg.secretFiles,
+      normalizedVolumes.map((volumeArg) => volumeArg.mountPath),
+    );
+    if (secretFileErrors.length > 0) {
+      throw new Error(`Invalid ${labelArg}: ${secretFileErrors.join('; ')}`);
+    }
+    for (const secretFile of configArg.secretFiles || []) {
+      if (!secretEnvVarKeys.has(secretFile.sourceKey)) {
+        throw new Error(
+          `Invalid ${labelArg}: secret file source '${secretFile.sourceKey}' must reference a declared secret input`,
+        );
+      }
+    }
     this.validatePublishedPorts(configArg.publishedPorts || [], labelArg);
   }
 
@@ -579,6 +621,31 @@ export class AppStoreResolver {
     }
   }
 
+  private validateTargetPortModel(
+    configArg: TAppStoreVersionConfig,
+    labelArg: string,
+  ): void {
+    const config = configArg as TAppStoreVersionConfig & {
+      targetPorts?: any[];
+      domains?: any[];
+      publicPortMappings?: any[];
+    };
+    if (config.port === undefined && (!config.targetPorts || config.targetPorts.length === 0)) {
+      throw new Error(`Invalid ${labelArg}: either port or targetPorts is required`);
+    }
+    try {
+      (interfaces.data as any).normalizeServicePortConfig({
+        name: labelArg,
+        ports: config.port !== undefined ? { web: config.port } : undefined,
+        targetPorts: config.targetPorts,
+        domains: config.domains,
+        publicPortMappings: config.publicPortMappings,
+      });
+    } catch (error) {
+      throw new Error(`Invalid ${labelArg}: ${(error as Error).message}`);
+    }
+  }
+
   private assertValidPort(portArg: number, labelArg: string): void {
     if (!Number.isInteger(portArg) || portArg < 1 || portArg > 65535) {
       throw new Error(`Invalid ${labelArg}: ${portArg}. Expected an integer port between 1 and 65535.`);

package/ts_client/data.generated.ts

@@ -19,7 +19,14 @@ export const appStorePackageData: IAppStorePackageData = {
     },
     "apps/adminer/versions/1.0.0/config.json": {
       "image": "adminer:latest",
-      "port": 8080
+      "targetPorts": [
+        {
+          "name": "web",
+          "port": 8080,
+          "protocol": "http",
+          "default": true
+        }
+      ]
     },
     "apps/cloudly/app.json": {
       "id": "cloudly",
@@ -39,7 +46,14 @@ export const appStorePackageData: IAppStorePackageData = {
     },
     "apps/cloudly/versions/1.0.0/config.json": {
       "image": "code.foss.global/serve.zone/cloudly:latest",
-      "port": 3000,
+      "targetPorts": [
+        {
+          "name": "web",
+          "port": 3000,
+          "protocol": "http",
+          "default": true
+        }
+      ],
       "envVars": [
         {
           "key": "SERVEZONE_ENVIRONMENT",
@@ -146,7 +160,14 @@ export const appStorePackageData: IAppStorePackageData = {
     },
     "apps/ghost/versions/1.0.0/config.json": {
       "image": "ghost:latest",
-      "port": 2368,
+      "targetPorts": [
+        {
+          "name": "web",
+          "port": 2368,
+          "protocol": "http",
+          "default": true
+        }
+      ],
       "envVars": [
         {
           "key": "database__client",
@@ -202,7 +223,14 @@ export const appStorePackageData: IAppStorePackageData = {
     },
     "apps/gitea/versions/1.0.0/config.json": {
       "image": "gitea/gitea:latest",
-      "port": 3000,
+      "targetPorts": [
+        {
+          "name": "web",
+          "port": 3000,
+          "protocol": "http",
+          "default": true
+        }
+      ],
       "envVars": [
         {
           "key": "GITEA__database__DB_TYPE",
@@ -252,7 +280,14 @@ export const appStorePackageData: IAppStorePackageData = {
     },
     "apps/gitops/versions/1.0.0/config.json": {
       "image": "code.foss.global/serve.zone/gitops:2.13.0",
-      "port": 3000,
+      "targetPorts": [
+        {
+          "name": "web",
+          "port": 3000,
+          "protocol": "http",
+          "default": true
+        }
+      ],
       "envVars": [
         {
           "key": "GITOPS_PORT",
@@ -292,7 +327,14 @@ export const appStorePackageData: IAppStorePackageData = {
     },
     "apps/grafana/versions/1.0.0/config.json": {
       "image": "grafana/grafana:latest",
-      "port": 3000,
+      "targetPorts": [
+        {
+          "name": "web",
+          "port": 3000,
+          "protocol": "http",
+          "default": true
+        }
+      ],
       "envVars": [
         {
           "key": "GF_SECURITY_ADMIN_PASSWORD",
@@ -316,7 +358,14 @@ export const appStorePackageData: IAppStorePackageData = {
     },
     "apps/mariadb/versions/1.0.0/config.json": {
       "image": "mariadb:latest",
-      "port": 3306,
+      "targetPorts": [
+        {
+          "name": "db",
+          "port": 3306,
+          "protocol": "tcp",
+          "default": true
+        }
+      ],
       "envVars": [
         {
           "key": "MARIADB_ROOT_PASSWORD",
@@ -340,7 +389,14 @@ export const appStorePackageData: IAppStorePackageData = {
     },
     "apps/mattermost/versions/1.0.0/config.json": {
       "image": "mattermost/mattermost-team-edition:latest",
-      "port": 8065
+      "targetPorts": [
+        {
+          "name": "web",
+          "port": 8065,
+          "protocol": "http",
+          "default": true
+        }
+      ]
     },
     "apps/n8n/app.json": {
       "id": "n8n",
@@ -356,7 +412,14 @@ export const appStorePackageData: IAppStorePackageData = {
     },
     "apps/n8n/versions/1.0.0/config.json": {
       "image": "n8nio/n8n:latest",
-      "port": 5678
+      "targetPorts": [
+        {
+          "name": "web",
+          "port": 5678,
+          "protocol": "http",
+          "default": true
+        }
+      ]
     },
     "apps/nextcloud/app.json": {
       "id": "nextcloud",
@@ -372,7 +435,14 @@ export const appStorePackageData: IAppStorePackageData = {
     },
     "apps/nextcloud/versions/1.0.0/config.json": {
       "image": "nextcloud:latest",
-      "port": 80,
+      "targetPorts": [
+        {
+          "name": "web",
+          "port": 80,
+          "protocol": "http",
+          "default": true
+        }
+      ],
       "envVars": [
         {
           "key": "MYSQL_HOST",
@@ -414,7 +484,84 @@ export const appStorePackageData: IAppStorePackageData = {
     },
     "apps/nginx/versions/1.0.0/config.json": {
       "image": "nginx:alpine",
-      "port": 80
+      "targetPorts": [
+        {
+          "name": "web",
+          "port": 80,
+          "protocol": "http",
+          "default": true
+        }
+      ]
+    },
+    "apps/openbao/app.json": {
+      "id": "openbao",
+      "name": "OpenBao",
+      "description": "Open-source secrets management, encryption, and identity security platform",
+      "category": "Security",
+      "iconName": "shield",
+      "latestVersion": "1.0.0",
+      "versions": [
+        "1.0.0"
+      ],
+      "maintainer": "serve.zone",
+      "links": {
+        "documentation": "https://openbao.org/docs/",
+        "source": "https://github.com/openbao/openbao"
+      }
+    },
+    "apps/openbao/versions/1.0.0/config.json": {
+      "image": "openbao/openbao:2.6.0",
+      "containerArgs": [
+        "server"
+      ],
+      "targetPorts": [
+        {
+          "name": "web",
+          "port": 8200,
+          "protocol": "http",
+          "default": true
+        }
+      ],
+      "envVars": [
+        {
+          "key": "BAO_LOCAL_CONFIG",
+          "value": "{\"ui\":true,\"disable_mlock\":true,\"api_addr\":\"http://127.0.0.1:8200\",\"cluster_addr\":\"http://127.0.0.1:8201\",\"storage\":{\"raft\":{\"path\":\"/openbao/file\",\"node_id\":\"openbao-1\",\"performance_multiplier\":1}},\"listener\":[{\"tcp\":{\"address\":\"0.0.0.0:8200\",\"cluster_address\":\"0.0.0.0:8201\",\"tls_disable\":true}}],\"seal\":{\"static\":{\"current_key_id\":\"cloudly-v1\",\"current_key\":\"file:///run/secrets/openbao-static-seal-key\"}}}",
+          "description": "OpenBao server configuration for single-node Raft storage and static auto-unseal.",
+          "required": true
+        },
+        {
+          "key": "BAO_STATIC_SEAL_KEY",
+          "description": "Cloudly generates 32 random bytes and stores them only in this service's secret bundle.",
+          "required": true,
+          "secret": true,
+          "generate": {
+            "type": "randomHex",
+            "bytes": 32
+          }
+        }
+      ],
+      "secretFiles": [
+        {
+          "sourceKey": "BAO_STATIC_SEAL_KEY",
+          "targetPath": "/run/secrets/openbao-static-seal-key",
+          "uid": 100,
+          "gid": 1000,
+          "mode": 256
+        }
+      ],
+      "volumes": [
+        {
+          "name": "openbao-data",
+          "mountPath": "/openbao/file",
+          "backup": true
+        }
+      ],
+      "minCloudlyVersion": "13.4.0",
+      "healthCheck": {
+        "path": "/v1/sys/health?standbyok=true&sealedcode=200&uninitcode=200",
+        "port": 8200,
+        "expectedStatus": 200
+      }
     },
     "apps/plausible/app.json": {
       "id": "plausible",
@@ -430,7 +577,14 @@ export const appStorePackageData: IAppStorePackageData = {
     },
     "apps/plausible/versions/1.0.0/config.json": {
       "image": "plausible/analytics:latest",
-      "port": 8000,
+      "targetPorts": [
+        {
+          "name": "web",
+          "port": 8000,
+          "protocol": "http",
+          "default": true
+        }
+      ],
       "platformRequirements": {
         "clickhouse": true
       }
@@ -449,7 +603,14 @@ export const appStorePackageData: IAppStorePackageData = {
     },
     "apps/portainer/versions/1.0.0/config.json": {
       "image": "portainer/portainer-ce:latest",
-      "port": 9000
+      "targetPorts": [
+        {
+          "name": "web",
+          "port": 9000,
+          "protocol": "http",
+          "default": true
+        }
+      ]
     },
     "apps/postgres/app.json": {
       "id": "postgres",
@@ -465,7 +626,14 @@ export const appStorePackageData: IAppStorePackageData = {
     },
     "apps/postgres/versions/1.0.0/config.json": {
       "image": "postgres:16-alpine",
-      "port": 5432,
+      "targetPorts": [
+        {
+          "name": "db",
+          "port": 5432,
+          "protocol": "tcp",
+          "default": true
+        }
+      ],
       "envVars": [
         {
           "key": "POSTGRES_PASSWORD",
@@ -503,7 +671,14 @@ export const appStorePackageData: IAppStorePackageData = {
     },
     "apps/rustdesk-server/versions/1.0.0/config.json": {
       "image": "rustdesk/rustdesk-server-s6:latest",
-      "port": 21116,
+      "targetPorts": [
+        {
+          "name": "relay",
+          "port": 21116,
+          "protocol": "tcp",
+          "default": true
+        }
+      ],
       "envVars": [
         {
           "key": "RELAY",
@@ -536,7 +711,40 @@ export const appStorePackageData: IAppStorePackageData = {
     },
     "apps/siprouter/versions/1.0.0/config.json": {
       "image": "code.foss.global/serve.zone/siprouter:1.28.0",
-      "port": 3060,
+      "targetPorts": [
+        {
+          "name": "web",
+          "port": 3060,
+          "protocol": "http",
+          "default": true
+        },
+        {
+          "name": "sip-udp",
+          "port": 5070,
+          "protocol": "udp"
+        },
+        {
+          "name": "sip-tcp",
+          "port": 5070,
+          "protocol": "tcp"
+        },
+        {
+          "name": "sips-udp",
+          "port": 5061,
+          "protocol": "udp"
+        },
+        {
+          "name": "sips-tcp",
+          "port": 5061,
+          "protocol": "tcp"
+        },
+        {
+          "name": "rtp",
+          "port": 20000,
+          "portEnd": 20200,
+          "protocol": "udp"
+        }
+      ],
       "envVars": [
         {
           "key": "SIPROUTER_LAN_IP",
@@ -598,38 +806,42 @@ export const appStorePackageData: IAppStorePackageData = {
           "required": true
         }
       ],
-      "publishedPorts": [
+      "publicPortMappings": [
         {
-          "targetPort": 3060,
-          "publishedPort": 3060,
-          "protocol": "tcp"
+          "name": "sip-udp",
+          "publicPort": 5070,
+          "targetPort": "sip-udp",
+          "protocol": "udp",
+          "exclusive": true
         },
         {
-          "targetPort": 5070,
-          "publishedPort": 5070,
-          "protocol": "udp"
+          "name": "sip-tcp",
+          "publicPort": 5070,
+          "targetPort": "sip-tcp",
+          "protocol": "tcp",
+          "exclusive": true
         },
         {
-          "targetPort": 5070,
-          "publishedPort": 5070,
-          "protocol": "tcp"
+          "name": "sips-udp",
+          "publicPort": 5061,
+          "targetPort": "sips-udp",
+          "protocol": "udp",
+          "exclusive": true
         },
         {
-          "targetPort": 5061,
-          "publishedPort": 5061,
-          "protocol": "udp"
+          "name": "sips-tcp",
+          "publicPort": 5061,
+          "targetPort": "sips-tcp",
+          "protocol": "tcp",
+          "exclusive": true
         },
         {
-          "targetPort": 5061,
-          "publishedPort": 5061,
-          "protocol": "tcp"
-        },
-        {
-          "targetPort": 20000,
-          "targetPortEnd": 20200,
-          "publishedPort": 20000,
-          "publishedPortEnd": 20200,
-          "protocol": "udp"
+          "name": "rtp",
+          "publicPort": 20000,
+          "publicPortEnd": 20200,
+          "targetPort": "rtp",
+          "protocol": "udp",
+          "exclusive": true
         }
       ],
       "platformRequirements": {
@@ -652,7 +864,14 @@ export const appStorePackageData: IAppStorePackageData = {
     },
     "apps/uptime-kuma/versions/1.0.0/config.json": {
       "image": "louislam/uptime-kuma:latest",
-      "port": 3001
+      "targetPorts": [
+        {
+          "name": "web",
+          "port": 3001,
+          "protocol": "http",
+          "default": true
+        }
+      ]
     },
     "apps/valkey/app.json": {
       "id": "valkey",
@@ -668,7 +887,14 @@ export const appStorePackageData: IAppStorePackageData = {
     },
     "apps/valkey/versions/1.0.0/config.json": {
       "image": "valkey/valkey:9.1.0-alpine",
-      "port": 6379
+      "targetPorts": [
+        {
+          "name": "cache",
+          "port": 6379,
+          "protocol": "tcp",
+          "default": true
+        }
+      ]
     },
     "apps/vaultwarden/app.json": {
       "id": "vaultwarden",
@@ -684,7 +910,14 @@ export const appStorePackageData: IAppStorePackageData = {
     },
     "apps/vaultwarden/versions/1.0.0/config.json": {
       "image": "vaultwarden/server:latest",
-      "port": 80
+      "targetPorts": [
+        {
+          "name": "web",
+          "port": 80,
+          "protocol": "http",
+          "default": true
+        }
+      ]
     },
     "apps/wordpress/app.json": {
       "id": "wordpress",
@@ -700,7 +933,14 @@ export const appStorePackageData: IAppStorePackageData = {
     },
     "apps/wordpress/versions/1.0.0/config.json": {
       "image": "wordpress:latest",
-      "port": 80,
+      "targetPorts": [
+        {
+          "name": "web",
+          "port": 80,
+          "protocol": "http",
+          "default": true
+        }
+      ],
       "envVars": [
         {
           "key": "WORDPRESS_DB_HOST",
@@ -729,7 +969,7 @@ export const appStorePackageData: IAppStorePackageData = {
     },
     "appstore.json": {
       "schemaVersion": 1,
-      "updatedAt": "2026-06-07T00:00:00Z",
+      "updatedAt": "2026-07-21T00:00:00Z",
       "apps": [
         {
           "id": "nginx",
@@ -853,6 +1093,20 @@ export const appStorePackageData: IAppStorePackageData = {
             "passwords"
           ]
         },
+        {
+          "id": "openbao",
+          "name": "OpenBao",
+          "description": "Open-source secrets management, encryption, and identity security platform.",
+          "category": "Security",
+          "iconName": "shield",
+          "latestVersion": "1.0.0",
+          "tags": [
+            "security",
+            "secrets",
+            "encryption",
+            "identity"
+          ]
+        },
         {
           "id": "n8n",
           "name": "N8N",