@smi-digital/create-smi-app 2.7.5 → 2.8.0

package/dist/index.js

@@ -504,6 +504,14 @@ async function createApps(projectRoot, targets) {
           `Could not normalize config/plugins.ts: ${error instanceof Error ? error.message : String(error)}`
         );
       }
+      await runStep(
+        "Adding Postgres driver (pg) for production",
+        async () => runCommandQuiet(
+          "npm",
+          ["install", "pg"],
+          join4(projectRoot, target.directory)
+        )
+      );
     }
     await runSequentially(index + 1);
   };
@@ -590,7 +598,14 @@ async function createIntegrations(options, projectRoot, templatesDir) {
       api_token_salt: generateSecret(),
       admin_jwt_secret: generateSecret(),
       transfer_token_salt: generateSecret(),
-      jwt_secret: generateSecret()
+      jwt_secret: generateSecret(),
+      // Postgres identifier derived from app_name (hyphens -> underscores), so
+      // the role/database name needs no quoting.
+      db_name: String(options.integrationInputs?.app_name ?? "").replaceAll(
+        "-",
+        "_"
+      ),
+      db_password: generateSecret()
       /* eslint-enable camelcase */
     };
     return copyTemplateFile(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@smi-digital/create-smi-app",
-  "version": "2.7.5",
+  "version": "2.8.0",
   "description": "",
   "main": "dist/index.js",
   "bin": {

package/templates/integrations/strapi-astro/.github/workflows/deploy.yml.template

@@ -13,6 +13,9 @@ jobs:
       project_domain: __PROJECT_DOMAIN__
       backend_domain: __BACKEND_DOMAIN__
       app_name: __APP_NAME__
+      # Optional: 301-redirect extra domains to project_domain (space-separated).
+      # Each must have DNS pointing at the server so Traefik can issue its cert.
+      # redirect_domains: "old-domain.com www.old-domain.com"
     secrets:
       # Per-repo secrets (Settings → Secrets and variables → Actions).
       # WEBSERVER_SSH_KEY and ZOT_PASSWORD are shared across all projects;

package/templates/integrations/strapi-astro/databases.yml.template

@@ -0,0 +1,15 @@
+# Databases this project needs on the shared Postgres instance.
+# The deploy provisions each one (login role + database) automatically — no
+# manual step, no SSH. This file is the GitOps source of truth for the project's
+# databases; passwords live (encrypted) in production.backend.env.
+#
+#   - name:         the database AND login-role name (Postgres-safe identifier)
+#   - password_env: the variable in production.backend.env holding its password
+#
+# To add an app-managed database (e.g. a separate dataset the site reads), add an
+# entry here and its connection vars to production.backend.env:
+#   - name: my_dataset
+#     password_env: MY_DATASET_DATABASE_PASSWORD
+databases:
+  - name: __DB_NAME__
+    password_env: DATABASE_PASSWORD

package/templates/integrations/strapi-astro/docker-compose.yml.template

@@ -6,9 +6,9 @@ services:
     restart: unless-stopped
     env_file:
       - ./backend.env
-    volumes: 
+    volumes:
+      # Uploads stay on local disk for now; DB lives in Postgres (no sqlite volume).
       - ./data/uploads:/opt/app/public/uploads
-      - ./data/database:/opt/app/.tmp
     networks:
       - agency_shared_network
     healthcheck:
@@ -27,7 +27,10 @@ services:
       - "traefik.http.services.__APP_NAME__-strapi.loadbalancer.server.port=1337"
       # Strapi requires larger body sizes for media uploads (25MB)
       - "traefik.http.middlewares.__APP_NAME__-strapi-limit.buffering.maxRequestBodyBytes=25000000"
-      - "traefik.http.routers.__APP_NAME__-strapi.middlewares=__APP_NAME__-strapi-limit"
+      # Global middlewares (defined in webhosting-infra/traefik/dynamic) + the local
+      # body-size limit. rate-limit first so abusive traffic is dropped early; this
+      # matters most on the public Strapi admin/API.
+      - "traefik.http.routers.__APP_NAME__-strapi.middlewares=rate-limit@file,secure-headers@file,__APP_NAME__-strapi-limit"
 
   __APP_NAME__-astro:
     container_name: __APP_NAME__-astro
@@ -75,6 +78,8 @@ services:
       # Listen on both www and non-www
       - "traefik.http.routers.__APP_NAME__-astro.rule=Host(`__PROJECT_DOMAIN__`) || Host(`www.__PROJECT_DOMAIN__`)"
       - "traefik.http.routers.__APP_NAME__-astro.tls.certresolver=letsencrypt"
+      # Global middlewares (defined in webhosting-infra/traefik/dynamic)
+      - "traefik.http.routers.__APP_NAME__-astro.middlewares=secure-headers@file,rate-limit@file"
       # Route traffic to the Nginx Cache (Port 80) instead of Astro directly
       - "traefik.http.services.__APP_NAME__-astro.loadbalancer.server.port=80"
 

package/templates/integrations/strapi-astro/integration.config.json

@@ -29,12 +29,6 @@
         "default": "my-new-client",
         "required": true,
         "validate": "slug"
-      },
-      {
-        "key": "include_www",
-        "message": "Include www domain?",
-        "type": "confirm",
-        "default": false
       }
     ]
   },
@@ -90,6 +84,10 @@
     {
       "template": "production.backend.env.template",
       "target": "production.backend.env"
+    },
+    {
+      "template": "databases.yml.template",
+      "target": "databases.yml"
     }
   ]
 }

package/templates/integrations/strapi-astro/production.backend.env.template

@@ -17,6 +17,17 @@ ADMIN_JWT_SECRET=__ADMIN_JWT_SECRET__
 TRANSFER_TOKEN_SALT=__TRANSFER_TOKEN_SALT__
 JWT_SECRET=__JWT_SECRET__
 
+# Database — production uses Postgres (local dev defaults to SQLite).
+# A matching role + database must exist on the shared Postgres instance,
+# reachable as DATABASE_HOST on the agency_shared_network.
+DATABASE_CLIENT=postgres
+DATABASE_HOST=postgres
+DATABASE_PORT=5432
+DATABASE_NAME=__DB_NAME__
+DATABASE_USERNAME=__DB_NAME__
+DATABASE_PASSWORD=__DB_PASSWORD__
+DATABASE_SSL=false
+
 # Production Settings
 HOST=0.0.0.0
 PORT=1337