@stacksjs/buddy 0.70.90 → 0.70.91

package/dist/commands/deploy.js

@@ -692,7 +692,7 @@ async function runHetznerDeploy(args) {
     const compute = (tsCloudConfig.infrastructure ??= {}).compute ??= {};
     compute.webServer = "rpx";
     compute.proxy = { onDemandTls: !0, ...compute.proxy ?? {}, engine: "rpx" };
-    const stackName = tsCloudConfig.project?.stackName || `${tsCloudConfig.project?.slug || "app"}-${environment}`, stateDir = join(process.cwd(), ".ts-cloud", "state");
+    const stackName = tsCloudConfig.project?.stackName || `${tsCloudConfig.project?.slug || "app"}-${environment}`, stateDir = join(process.cwd(), "storage", "cloud", "state");
     mkdirSync(stateDir, { recursive: !0 });
     writeFileSync(join(stateDir, `${stackName}.json`), `${JSON.stringify({
       stackName,
@@ -950,7 +950,60 @@ if [ -n "$FWD_B64" ] && [ -x /usr/local/bin/bun ]; then
   rm -f /tmp/.mailtenant-fwd.json /tmp/.mailtenant-readme.txt
 fi
 FWD_STATE=nochange; grep -q FWDCHANGED /tmp/.mailtenant-res 2>/dev/null && FWD_STATE=updated; rm -f /tmp/.mailtenant-res
-# 5) Restart only when the startup-read env actually changed (domain or DKIM key).
+# 5) Keep the shared daemon recoverable if it crashes or stops accepting mail.
+mkdir -p /etc/systemd/system/mail.service.d
+cat > /etc/systemd/system/mail.service.d/reliability.conf <<'EOF'
+[Unit]
+StartLimitIntervalSec=60
+StartLimitBurst=10
+
+[Service]
+Restart=always
+RestartSec=2
+TimeoutStartSec=30
+TimeoutStopSec=30
+LimitCORE=infinity
+EOF
+cat > /usr/local/sbin/mail-health-check <<'EOF'
+#!/bin/sh
+set -eu
+exec 9>/run/mail-health-check.lock
+flock -n 9 || exit 0
+systemctl is-active --quiet mail || { systemctl restart mail; exit 0; }
+for port in 25 143 587 993; do
+  ss -H -ltn "sport = :$port" | grep -q . || {
+    logger -t mail-health "required TCP port $port is not listening; restarting mail"
+    systemctl restart mail
+    exit 0
+  }
+done
+EOF
+chmod 755 /usr/local/sbin/mail-health-check
+cat > /etc/systemd/system/mail-health.service <<'EOF'
+[Unit]
+Description=Check the Stacks mail daemon listeners
+After=mail.service
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/sbin/mail-health-check
+EOF
+cat > /etc/systemd/system/mail-health.timer <<'EOF'
+[Unit]
+Description=Check the Stacks mail daemon every minute
+
+[Timer]
+OnBootSec=2min
+OnUnitActiveSec=1min
+AccuracySec=10s
+Persistent=true
+
+[Install]
+WantedBy=timers.target
+EOF
+systemctl daemon-reload
+systemctl enable --now mail-health.timer >/dev/null 2>&1
+# 6) Restart only when the startup-read env actually changed (domain or DKIM key).
 if [ "$ENV_CHANGED" = 1 ]; then systemctl restart mail 2>/dev/null || true; echo "MAILTENANT:env-changed+restarted,forwards=$FWD_STATE"; else echo "MAILTENANT:current,forwards=$FWD_STATE"; fi`;
   try {
     const out = execSync(`ssh ${sshArgs.map((a) => `'${a}'`).join(" ")} bash -s`, {

package/dist/commands/dev.js

@@ -6,6 +6,7 @@ import { bold, cyan, dim, green, intro, log, onUnknownSubcommand, outro, prompts
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
+import { promises as dns } from "node:dns";
 import { Action } from "@stacksjs/enums";
 import { libsPath, projectPath } from "@stacksjs/path";
 import { ExitCode } from "@stacksjs/types";
@@ -813,7 +814,14 @@ async function unregisterRpxProxies(ids) {
   } catch {}
 }
 async function prepareRpxTlsForDev(input) {
-  const { domain, includeDashboard, options } = input, verbose = options.verbose ?? !1, hosts = [
+  const { domain, includeDashboard, options } = input, verbose = options.verbose ?? !1;
+  if (process.env.STACKS_DEV_ALLOW_PUBLIC_DOMAIN !== "1") {
+    if ((await dns.resolve4(domain).catch(() => [])).some((address) => !address.startsWith("127."))) {
+      log.warn(`Skipping local DNS override for public domain ${domain}; use a .localhost/.test domain for development`);
+      return;
+    }
+  }
+  const hosts = [
     domain,
     ...includeDashboard ? [`dashboard.${domain}`] : []
   ], hostsNeedingFile = hosts.filter((host) => {

package/dist/commands/mail.d.ts

@@ -1,2 +1,4 @@
 import { CLI } from '@stacksjs/clapp';
+export declare function resolveDirectMailHost(env?: NodeJS.ProcessEnv): string | undefined;
+export declare function sanitizeLineCount(value?: string): string;
 export declare function mailCommands(buddy: CLI): void;

package/dist/commands/mail.js

@@ -5,6 +5,41 @@ import { CLI } from "@stacksjs/clapp";
 import { createHash, createHmac, randomBytes } from "crypto";
 import { readFileSync, existsSync } from "node:fs";
 import { execSync } from "node:child_process";
+export function resolveDirectMailHost(env = process.env) {
+  let configured = env.MAIL_SERVER_HOST || (env.HCLOUD_TOKEN || env.HETZNER_API_TOKEN ? env.MAIL_HOST : void 0);
+  if (configured && ["127.0.0.1", "localhost", "mailpit"].includes(configured))
+    configured = env.MAIL_DOMAIN ? `mail.${env.MAIL_DOMAIN}` : void 0;
+  if (!configured || configured === "127.0.0.1" || configured === "localhost")
+    return;
+  return configured.replace(/^https?:\/\//, "").split("/")[0]?.split(":")[0];
+}
+export function sanitizeLineCount(value) {
+  const count = Number.parseInt(value || "50", 10);
+  return String(Number.isFinite(count) ? Math.min(5000, Math.max(1, count)) : 50);
+}
+function shellQuote(value) {
+  return `'${value.replace(/'/g, "'\\''")}'`;
+}
+async function resolveOperationalMailHost() {
+  if (process.env.MAIL_SERVER_HOST)
+    return resolveDirectMailHost();
+  const token = process.env.HCLOUD_TOKEN || process.env.HETZNER_API_TOKEN;
+  if (!token)
+    return;
+  const appName = (process.env.APP_NAME || "stacks").toLowerCase().replace(/[^a-z0-9-]/g, "-");
+  try {
+    const ip = (await (await fetch(`https://api.hetzner.cloud/v1/servers?name=${encodeURIComponent(`${appName}-production-app`)}`, {
+      headers: { Authorization: `Bearer ${token}` }
+    })).json()).servers?.[0]?.public_net?.ipv4?.ip;
+    if (ip)
+      return ip;
+  } catch {}
+  const configured = resolveDirectMailHost();
+  if (configured)
+    return configured;
+  const { email } = await import("@stacksjs/config");
+  return email?.domain ? `mail.${email.domain}` : void 0;
+}
 export function mailCommands(buddy) {
   buddy.command("mail:provision", "Provision this app's mail from config/email.ts onto the shared mail server (domain + DKIM + mailboxes + MX/SPF/DKIM/DMARC DNS). Reusable + idempotent; the same reconcile buddy deploy runs.").option("--ip <ip>", "Mail server IP (defaults to the A record of config.email.domain)").action(async (options) => {
     const { email: emailConfig } = await import("@stacksjs/config"), domain = emailConfig?.domain;
@@ -198,6 +233,18 @@ Shutting down proxy...`);
   });
   buddy.command("mail:logs", "Show mail server logs from production").option("-n, --lines <count>", "Number of log lines to show", { default: "50" }).option("-f, --follow", "Follow log output (poll every 5s)").option("--filter <pattern>", "Filter logs by pattern (e.g. AUTH, LOGIN, error)").action(async (options) => {
     loadEnvFiles();
+    const directHost = await resolveOperationalMailHost();
+    if (directHost) {
+      const lines = sanitizeLineCount(options.lines), filter = options.filter ? options.filter.replace(/[^a-zA-Z0-9_.@\s-]/g, "") : "", command = `journalctl -u mail --no-pager -n ${lines}${filter ? ` | grep -iE ${shellQuote(filter)}` : ""}`;
+      try {
+        const output = execSync(`ssh -o BatchMode=yes -o ConnectTimeout=10 root@${shellQuote(directHost)} ${shellQuote(command)}`, { encoding: "utf8" });
+        console.log(output);
+        process.exit(ExitCode.Success);
+      } catch (error) {
+        log.error(`Failed to fetch logs from ${directHost}: ${getErrorMessage(error)}`);
+        process.exit(ExitCode.FatalError);
+      }
+    }
     const region = process.env.AWS_REGION || "us-east-1", appName = (process.env.APP_NAME || "stacks").toLowerCase().replace(/[^a-z0-9-]/g, "-");
     try {
       const { EC2Client, SSMClient } = await import("@stacksjs/ts-cloud"), ec2 = new EC2Client(region), ssm = new SSMClient(region);
@@ -214,7 +261,7 @@ Shutting down proxy...`);
         process.exit(ExitCode.FatalError);
       }
       log.info(`Found instance: ${instanceId}`);
-      const lines = options.lines || "50", sanitizedFilter = options.filter ? options.filter.replace(/[^a-zA-Z0-9_.@\s-]/g, "") : "", filterCmd = sanitizedFilter ? ` | grep -iE '${sanitizedFilter}'` : "", fetchLogs = async () => {
+      const lines = sanitizeLineCount(options.lines), sanitizedFilter = options.filter ? options.filter.replace(/[^a-zA-Z0-9_.@\s-]/g, "") : "", filterCmd = sanitizedFilter ? ` | grep -iE '${sanitizedFilter}'` : "", fetchLogs = async () => {
         const cmd = `journalctl -u smtp-server -u mail-server --no-pager -n ${lines} --since "10 minutes ago" 2>&1${filterCmd}`, result = await ssm.runShellCommand(instanceId, [cmd], {
           timeoutSeconds: 30,
           maxWaitMs: 30000,
@@ -275,6 +322,18 @@ Shutting down proxy...`);
   });
   buddy.command("mail:status", "Show mail server status").action(async () => {
     loadEnvFiles();
+    const directHost = await resolveOperationalMailHost();
+    if (directHost) {
+      const command = 'systemctl is-active mail; systemctl show mail -p NRestarts -p ActiveEnterTimestamp --value; ss -H -ltn | grep -E "(:(25|143|465|587|993))\\b"; systemctl is-enabled mail-health.timer; systemctl is-active mail-health.timer';
+      try {
+        const output = execSync(`ssh -o BatchMode=yes -o ConnectTimeout=10 root@${shellQuote(directHost)} ${shellQuote(command)}`, { encoding: "utf8" });
+        console.log(output);
+        process.exit(ExitCode.Success);
+      } catch (error) {
+        log.error(`Mail server ${directHost} is unhealthy: ${getErrorMessage(error)}`);
+        process.exit(ExitCode.FatalError);
+      }
+    }
     const region = process.env.AWS_REGION || "us-east-1", appName = (process.env.APP_NAME || "stacks").toLowerCase().replace(/[^a-z0-9-]/g, "-");
     try {
       const { EC2Client, SSMClient } = await import("@stacksjs/ts-cloud"), ec2 = new EC2Client(region), ssm = new SSMClient(region), instanceId = (await ec2.describeInstances({

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/buddy",
   "type": "module",
   "sideEffects": false,
-  "version": "0.70.90",
+  "version": "0.70.91",
   "description": "Meet Buddy. The Stacks runtime.",
   "author": "Chris Breuer",
   "contributors": [