@stacksjs/buddy 0.70.74 → 0.70.76

package/dist/commands/create.js

@@ -106,6 +106,10 @@ async function install(path, options) {
     log.error(result.error);
     process.exit(ExitCode.FatalError);
   }
+  log.info("Removing template-encrypted env files...");
+  const { rm } = await import("node:fs/promises");
+  for (const stale of [".env.development", ".env.staging", ".env.production", ".env.keys"])
+    await rm(`${path}/${stale}`, { force: !0 });
   log.info("Generating application key...");
   const keyResult = await runAction(Action.KeyGenerate, { ...options, cwd: path });
   if (keyResult.isErr) {

package/dist/commands/deploy.d.ts

@@ -71,8 +71,10 @@ export declare function provisionMailTenant(ip: string, logger: typeof log): Pro
  * per record): MX → the mail host, SPF authorizing the box IP, the domain's DKIM
  * public key at `mail._domainkey`, and a DMARC policy. Best-effort — logged, not
  * thrown. No-op without Porkbun credentials (the records are printed to add by
- * hand). MX targets the shared mail host (`mail.stacksjs.com`), so no per-domain
- * mail A record or extra TLS SAN is needed.
+ * hand). MX targets the tenant's own `mail.<domain>` when that name already
+ * resolves to the box (own-brand mail host; requires the mail cert to cover it
+ * as a SAN), and falls back to the shared mail host (`mail.stacksjs.com`)
+ * otherwise, where no per-domain mail A record or extra TLS SAN is needed.
  */
 export declare function reconcileMailDns(res: MailTenantResult, ip: string, logger: typeof log): Promise<void>;
 export declare function deploy(buddy: CLI): void;

package/dist/commands/deploy.js

@@ -4,8 +4,8 @@ import { join } from "node:path";
 import process from "node:process";
 import { runAction } from "@stacksjs/actions";
 import { italic, onUnknownSubcommand, outro, prompts, runCommand } from "@stacksjs/cli";
-import { app, email as emailConfig, cloud as cloudConfig } from "@stacksjs/config";
-import { addDomain, hasUserDomainBeenAddedToCloud } from "@stacksjs/dns";
+import { app, dns as dnsConfig, email as emailConfig, cloud as cloudConfig } from "@stacksjs/config";
+import { addDomain, hasUserDomainBeenAddedToCloud, syncDnsConfig } from "@stacksjs/dns";
 import { encryptEnv, env } from "@stacksjs/env";
 import { Action } from "@stacksjs/enums";
 import { path as p } from "@stacksjs/path";
@@ -691,7 +691,7 @@ async function runHetznerDeploy(args) {
     log.info(`Attaching to '${attachTo}' box '${box.serverName}' (${ip}) \u2014 skipping provisioning`);
     const compute = (tsCloudConfig.infrastructure ??= {}).compute ??= {};
     compute.webServer = "rpx";
-    compute.proxy = { ...compute.proxy ?? {}, engine: "rpx" };
+    compute.proxy = { onDemandTls: !0, ...compute.proxy ?? {}, engine: "rpx" };
     const stackName = tsCloudConfig.project?.stackName || `${tsCloudConfig.project?.slug || "app"}-${environment}`, stateDir = join(process.cwd(), ".ts-cloud", "state");
     mkdirSync(stateDir, { recursive: !0 });
     writeFileSync(join(stateDir, `${stackName}.json`), `${JSON.stringify({
@@ -760,7 +760,7 @@ async function runHetznerDeploy(args) {
     }
     const root = site.root || ".", tarballPath = join(tmpdir(), `${slug}-${siteName}-${sha}.tar.gz`);
     log.info(`Packaging ${root} \u2192 ${tarballPath}...`);
-    execSync(`tar czf "${tarballPath}" ${tarExcludes.join(" ")} -C "${root}" .`, { stdio: verbose ? "inherit" : "pipe" });
+    execSync(`tar czf "${tarballPath}" ${tarExcludes.join(" ")} -C "${root}" .`, { stdio: verbose ? "inherit" : "pipe", env: { ...process.env, COPYFILE_DISABLE: "1" } });
     const sizeMb = Math.max(1, Math.round(statSync(tarballPath).size / 1048576));
     log.info(`Release tarball: ~${sizeMb} MB`);
     tarballs.set(siteName, tarballPath);
@@ -796,6 +796,8 @@ async function runHetznerDeploy(args) {
   });
   if (ok)
     await reconcileHetznerDns(onlySite ? { [onlySite]: sites[onlySite] } : sites, ip, log);
+  if (ok)
+    await reconcileConfigDns(onlySite ? { [onlySite]: sites[onlySite] } : sites, log);
   if (ok) {
     const mailRes = await provisionMailTenant(ip, log);
     if (mailRes)
@@ -967,7 +969,14 @@ if [ "$ENV_CHANGED" = 1 ]; then systemctl restart mail 2>/dev/null || true; echo
   }
 }
 export async function reconcileMailDns(res, ip, logger) {
-  const { domain, mailHost, dkimPubB64 } = res, spf = `v=spf1 ip4:${ip} ~all`, dmarc = `v=DMARC1; p=quarantine; rua=mailto:chris@${domain}`, dkim = dkimPubB64 ? `v=DKIM1; k=rsa; p=${dkimPubB64}` : void 0, apiKey = process.env.PORKBUN_API_KEY, secretKey = process.env.PORKBUN_SECRET_KEY;
+  const { domain, dkimPubB64 } = res;
+  let { mailHost } = res;
+  try {
+    const dns = await import("node:dns"), own = `mail.${domain}`;
+    if (own !== mailHost && (await dns.promises.resolve4(own)).includes(ip))
+      mailHost = own;
+  } catch {}
+  const spf = `v=spf1 ip4:${ip} ~all`, cfg = emailConfig || {}, firstBox = resolveMailboxes(cfg.mailboxes, domain)[0]?.address, dmarc = `v=DMARC1; p=quarantine; rua=mailto:${(typeof cfg.from?.address === "string" && cfg.from.address.includes("@") ? cfg.from.address : void 0) || firstBox || `chris@${domain}`}`, dkim = dkimPubB64 ? `v=DKIM1; k=rsa; p=${dkimPubB64}` : void 0, apiKey = process.env.PORKBUN_API_KEY, secretKey = process.env.PORKBUN_SECRET_KEY;
   if (!apiKey || !secretKey) {
     logger.warn(`Mail DNS: no Porkbun credentials \u2014 add these records for ${domain} by hand:`);
     logger.info(`  MX    @                 10 ${mailHost}`);
@@ -1001,6 +1010,24 @@ export async function reconcileMailDns(res, ip, logger) {
     logger.warn(`Mail DNS reconcile skipped for ${domain}: ${getErrorMessage(err)}`);
   }
 }
+async function reconcileConfigDns(sites, logger) {
+  if (["a", "aaaa", "cname", "mx", "txt"].reduce((total, key) => total + (Array.isArray(dnsConfig?.[key]) ? dnsConfig[key].length : 0), 0) === 0)
+    return;
+  const domains = new Set;
+  for (const site of Object.values(sites))
+    if (site?.domain && typeof site.domain === "string")
+      domains.add(site.domain.replace(/^www\./, ""));
+  for (const domain of domains)
+    try {
+      const result = await syncDnsConfig(domain, dnsConfig);
+      if (!result.provider)
+        continue;
+      if (result.created || result.failed)
+        logger.info(`DNS (config/dns.ts) ${domain}: ${result.created} created, ${result.kept} kept${result.failed ? `, ${result.failed} failed` : ""}`);
+    } catch (err) {
+      logger.warn(`DNS (config/dns.ts) reconcile for ${domain} failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+}
 async function reconcileHetznerDns(sites, ip, logger) {
   const domains = new Set;
   for (const site of Object.values(sites))

package/dist/commands/dns.js

@@ -1,6 +1,7 @@
 import process from "node:process";
 import { log, onUnknownSubcommand } from "@stacksjs/cli";
 import { config } from "@stacksjs/config";
+import { renderDnsConfig, resolveLiveRecords, syncDnsConfig } from "@stacksjs/dns";
 import { ExitCode } from "@stacksjs/types";
 export function dns(buddy) {
   const descriptions = {
@@ -58,5 +59,44 @@ export function dns(buddy) {
     }
     process.exit(ExitCode.Success);
   });
+  const bareDomain = (input) => (input || config.app.url || "").replace(/^[a-z]+:\/\//i, "").replace(/[/:].*$/, "");
+  buddy.command("dns:pull [domain]", "Print a domain's live DNS records as a config/dns.ts block").option("--verbose", descriptions.verbose, { default: !1 }).action(async (domain, options) => {
+    const target = bareDomain(domain);
+    log.debug(`Running \`buddy dns:pull ${target}\` ...`, options);
+    const records = await resolveLiveRecords(target);
+    if (!records.length) {
+      log.error(`No DNS records resolved for ${target}.`);
+      process.exit(ExitCode.FatalError);
+    }
+    console.log(renderDnsConfig(target, records));
+    process.exit(ExitCode.Success);
+  });
+  buddy.command("dns:diff [domain]", "Show which config/dns.ts records are missing from the live zone").option("--verbose", descriptions.verbose, { default: !1 }).action(async (domain, options) => {
+    const target = bareDomain(domain);
+    log.debug(`Running \`buddy dns:diff ${target}\` ...`, options);
+    const { plan, provider } = await syncDnsConfig(target, config.dns, { dryRun: !0 });
+    for (const item of plan.items) {
+      const detail = item.record.type === "TXT" || item.record.type === "MX" ? ` ${item.record.content}` : ` \u2192 ${item.record.content}`;
+      console.log(`  ${item.action === "create" ? "+ create" : "  keep  "} ${item.record.type.padEnd(5)} ${item.record.name}${detail}`);
+    }
+    console.log(`
+${plan.create.length} to create, ${plan.keep.length} already present (${provider ? `registrar: ${provider}` : "public DNS"})`);
+    process.exit(ExitCode.Success);
+  });
+  buddy.command("dns:sync [domain]", "Additively sync config/dns.ts to the registrar (creates missing records; never deletes or overwrites)").option("--dry-run", "Show the plan without writing any records", { default: !1 }).option("--verbose", descriptions.verbose, { default: !1 }).action(async (domain, options) => {
+    const target = bareDomain(domain);
+    log.debug(`Running \`buddy dns:sync ${target}\` ...`, options);
+    const result = await syncDnsConfig(target, config.dns, { dryRun: options.dryRun });
+    if (!result.provider && !options.dryRun) {
+      log.warn(`No DNS provider credentials found (e.g. PORKBUN_API_KEY / PORKBUN_SECRET_KEY) \u2014 nothing was synced. ${result.plan.create.length} record(s) would be created.`);
+      process.exit(ExitCode.Success);
+    }
+    for (const record of result.plan.create)
+      console.log(`  ${result.applied ? "created" : "would create"} ${record.type.padEnd(5)} ${record.name} \u2192 ${record.content}`);
+    const verb = result.applied ? "created" : "to create", count = result.applied ? result.created : result.plan.create.length;
+    console.log(`
+dns:sync ${target}: ${count} ${verb}, ${result.kept} kept${result.failed ? `, ${result.failed} failed` : ""}${result.provider ? ` (${result.provider})` : ""}`);
+    process.exit(result.failed > 0 ? ExitCode.FatalError : ExitCode.Success);
+  });
   onUnknownSubcommand(buddy, "dns");
 }

package/dist/lazy-commands.js

@@ -15,6 +15,9 @@ const commandRegistry = {
   deploy: { path: "./commands/deploy.js", exportName: "deploy" },
   dev: { path: "./commands/dev.js", exportName: "dev" },
   dns: { path: "./commands/dns.js", exportName: "dns" },
+  "dns:pull": { path: "./commands/dns.js", exportName: "dns" },
+  "dns:diff": { path: "./commands/dns.js", exportName: "dns" },
+  "dns:sync": { path: "./commands/dns.js", exportName: "dns" },
   doctor: { path: "./commands/doctor.js", exportName: "doctor" },
   domains: { path: "./commands/domains.js", exportName: "domains" },
   email: { path: "./commands/email.js", exportName: "email" },

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@stacksjs/buddy",
   "type": "module",
-  "version": "0.70.74",
+  "version": "0.70.76",
   "description": "Meet Buddy. The Stacks runtime.",
   "author": "Chris Breuer",
   "contributors": [
@@ -135,7 +135,7 @@
     "@stacksjs/ui": "^0.70.23",
     "@stacksjs/utils": "^0.70.23",
     "@stacksjs/validation": "^0.70.23",
-    "@stacksjs/ts-cloud": "^0.7.14"
+    "@stacksjs/ts-cloud": "^0.7.15"
   },
   "devDependencies": {
     "better-dx": "^0.2.16"