@stacksjs/ts-cloud 0.2.23 → 0.2.25

package/dist/index.js

@@ -81449,204 +81449,6 @@ import { homedir as homedir7 } from "node:os";
 import { join as join13 } from "node:path";
 import { execSync } from "node:child_process";
 
-// src/drivers/shared/caddyfile.ts
-function isOnDemandDomain(domain) {
-  return domain === "*" || domain.includes("*");
-}
-function isStaticApp(app) {
-  return typeof app.root === "string" && app.root.length > 0;
-}
-function isProxyApp(app) {
-  return typeof app.port === "number";
-}
-function staticSiteServerRoot(name) {
-  return `/var/www/${name}`;
-}
-function normalizeOnDemandTls(onDemandTls) {
-  if (!onDemandTls)
-    return;
-  if (onDemandTls === true)
-    return {};
-  return onDemandTls;
-}
-function wrapInHandle(body, path, indent) {
-  const inner = body.split(`
-`).map((line) => `  ${line}`).join(`
-`);
-  return `${indent}handle ${path} {
-${inner}
-${indent}}`;
-}
-function renderUpstreamBlock(app, indent) {
-  const host = app.upstreamHost || "localhost";
-  const upstream = `${host}:${app.port}`;
-  const directives = app.reverseProxyDirectives ?? [];
-  const proxyLine = directives.length === 0 ? `${indent}reverse_proxy ${upstream}` : [
-    `${indent}reverse_proxy ${upstream} {`,
-    ...directives.map((d) => `${indent}  ${d}`),
-    `${indent}}`
-  ].join(`
-`);
-  const isCatchAll = !app.path || app.path === "/";
-  if (isCatchAll)
-    return proxyLine;
-  return wrapInHandle(proxyLine, app.path, indent);
-}
-function renderStaticBlock(app, indent) {
-  const root = app.root;
-  const lines = [`${indent}root * ${root}`];
-  if (app.cache?.enabled) {
-    const maxAge = app.cache.maxAge ?? 3600;
-    lines.push(`${indent}header Cache-Control "public, max-age=${maxAge}"`);
-  }
-  if (app.spa) {
-    lines.push(`${indent}try_files {path} /index.html`);
-  } else if (app.pathRewriteStyle === "flat") {
-    lines.push(`${indent}try_files {path} {path}.html {path}/index.html`);
-  } else {
-    lines.push(`${indent}try_files {path} {path}/index.html {path}.html`);
-  }
-  lines.push(`${indent}file_server`);
-  const body = lines.join(`
-`);
-  const isCatchAll = !app.path || app.path === "/";
-  if (isCatchAll)
-    return body;
-  return wrapInHandle(body, app.path, indent);
-}
-function renderAppBlock(app, indent) {
-  return isStaticApp(app) ? renderStaticBlock(app, indent) : renderUpstreamBlock(app, indent);
-}
-function groupAppsByDomains(apps) {
-  const groups = new Map;
-  for (const app of apps) {
-    const domains = [...app.domains].filter(Boolean);
-    if (domains.length === 0)
-      continue;
-    const key = [...domains].sort().join(" ");
-    const group = groups.get(key) ?? { domains, apps: [] };
-    group.apps.push(app);
-    groups.set(key, group);
-  }
-  return [...groups.values()];
-}
-function sortAppsByPath(apps) {
-  return [...apps].sort((a, b) => {
-    const aCatchAll = !a.path || a.path === "/";
-    const bCatchAll = !b.path || b.path === "/";
-    if (aCatchAll && !bCatchAll)
-      return 1;
-    if (!aCatchAll && bCatchAll)
-      return -1;
-    return (b.path?.length ?? 0) - (a.path?.length ?? 0);
-  });
-}
-function buildCaddyfileFromProxy(proxy) {
-  if (proxy.raw && proxy.raw.trim())
-    return proxy.raw.trim();
-  const apps = (proxy.apps ?? []).filter((app) => app.domains.length > 0 && (isProxyApp(app) || isStaticApp(app)));
-  if (apps.length === 0)
-    return;
-  const onDemand = normalizeOnDemandTls(proxy.onDemandTls);
-  const hasOnDemandDomain = apps.some((app) => app.domains.some(isOnDemandDomain));
-  const globalLines = [];
-  if (proxy.email)
-    globalLines.push(`email ${proxy.email}`);
-  if (proxy.staging)
-    globalLines.push("acme_ca https://acme-staging-v02.api.letsencrypt.org/directory");
-  if (onDemand) {
-    if (onDemand.ask || onDemand.interval || onDemand.burst != null) {
-      const inner = [];
-      if (onDemand.ask)
-        inner.push(`  ask ${onDemand.ask}`);
-      if (onDemand.interval || onDemand.burst != null) {
-        const rl = [];
-        if (onDemand.interval)
-          rl.push(`    interval ${onDemand.interval}`);
-        if (onDemand.burst != null)
-          rl.push(`    burst ${onDemand.burst}`);
-        inner.push(`  rate_limit {
-${rl.join(`
-`)}
-  }`);
-      }
-      globalLines.push(`on_demand_tls {
-${inner.join(`
-`)}
-}`);
-    } else {
-      globalLines.push(`on_demand_tls {
-}`);
-    }
-  }
-  for (const directive of proxy.globalDirectives ?? [])
-    globalLines.push(directive);
-  const blocks = [];
-  if (globalLines.length > 0)
-    blocks.push(`{
-${globalLines.map((line) => `  ${line}`).join(`
-`)}
-}`);
-  for (const group of groupAppsByDomains(apps)) {
-    const sorted = sortAppsByPath(group.apps);
-    const body = sorted.map((app) => renderAppBlock(app, "  ")).join(`
-`);
-    const needsOnDemand = onDemand && group.domains.some(isOnDemandDomain);
-    const tlsBlock = needsOnDemand ? `
-  tls {
-    on_demand
-  }` : "";
-    blocks.push(`${group.domains.join(", ")} {
-${body}${tlsBlock}
-}`);
-  }
-  if (hasOnDemandDomain && !onDemand) {
-    blocks.unshift(`# WARNING: wildcard/catch-all domain present but on_demand_tls is not enabled.
-` + "# Caddy cannot provision TLS for these hosts. Set compute.proxy.onDemandTls.");
-  }
-  return blocks.join(`
-
-`);
-}
-function proxyConfigFromSites(sites) {
-  const apps = [];
-  for (const [name, site] of Object.entries(sites)) {
-    if (typeof site.domain !== "string" || !site.domain)
-      continue;
-    if (typeof site.port === "number" && site.deploy !== "bucket") {
-      apps.push({
-        name,
-        domains: [site.domain],
-        port: site.port,
-        path: site.path
-      });
-    } else if (resolveSiteKind(site) === "server-static") {
-      apps.push({
-        name,
-        domains: [site.domain],
-        root: staticSiteServerRoot(name),
-        path: site.path,
-        spa: site.spa,
-        pathRewriteStyle: site.pathRewriteStyle,
-        cache: site.cache
-      });
-    }
-  }
-  return { apps };
-}
-function resolveCaddyfile(sites, proxy) {
-  if (proxy) {
-    if (proxy.raw && proxy.raw.trim())
-      return proxy.raw.trim();
-    const resolved = proxy.apps && proxy.apps.length > 0 ? proxy : { ...proxy, apps: proxyConfigFromSites(sites).apps };
-    return buildCaddyfileFromProxy(resolved);
-  }
-  return buildCaddyfileFromProxy(proxyConfigFromSites(sites));
-}
-function buildCaddyfile(sites) {
-  return buildCaddyfileFromProxy(proxyConfigFromSites(sites));
-}
-
 // src/drivers/hetzner/client.ts
 var DEFAULT_API_URL = "https://api.hetzner.cloud/v1";
 
@@ -81798,7 +81600,8 @@ function generateUbuntuAppCloudInit(options = {}) {
     runtimeVersion = "latest",
     systemPackages = [],
     database,
-    caddyfile
+    caddyfile,
+    rpxProvision
   } = options;
   const packages = new Set(systemPackages);
   if (database === "sqlite")
@@ -81890,6 +81693,13 @@ CADDY_CONFIG_EOF
 systemctl daemon-reload
 systemctl enable caddy
 systemctl start caddy
+`;
+  }
+  if (rpxProvision && rpxProvision.length > 0) {
+    const body = rpxProvision[0] === "set -euo pipefail" ? rpxProvision.slice(1) : rpxProvision;
+    script += `
+${body.join(`
+`)}
 `;
   }
   script += `
@@ -81914,6 +81724,129 @@ runcmd:
 `;
 }
 
+// src/drivers/shared/rpx-gateway.ts
+var DEFAULT_RPX_CERTS_DIR = "/etc/rpx/certs";
+function normalizeRoutePath(path) {
+  if (!path || path === "/")
+    return;
+  let p = `/${path}`.replace(/\/+/g, "/").replace(/\/+$/, "");
+  if (!p.startsWith("/"))
+    p = `/${p}`;
+  return p === "" || p === "/" ? undefined : p;
+}
+function deriveRouteId(to, path) {
+  const base = path ? `${to}${path}` : to;
+  const cleaned = base.replace(/[^a-zA-Z0-9._-]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 128);
+  return cleaned.length > 0 ? cleaned : "rpx";
+}
+function buildRpxConfig(sites, options) {
+  const wwwRoot = (options.wwwRoot ?? "/var/www").replace(/\/+$/, "");
+  const certsDir = options.proxy.certsDir ?? DEFAULT_RPX_CERTS_DIR;
+  const proxies = [];
+  const domains = new Set;
+  for (const [name, site] of Object.entries(sites)) {
+    if (!site || !site.domain)
+      continue;
+    const kind = resolveSiteKind(site);
+    if (kind === "bucket")
+      continue;
+    const path = normalizeRoutePath(site.path);
+    const id = deriveRouteId(site.domain, path);
+    if (kind === "server-app") {
+      if (typeof site.port !== "number")
+        continue;
+      proxies.push({ to: site.domain, path, from: `localhost:${site.port}`, id });
+    } else {
+      proxies.push({
+        to: site.domain,
+        path,
+        static: `${wwwRoot}/${name}`,
+        cleanUrls: site.pathRewriteStyle !== "flat",
+        spa: site.spa ?? false,
+        id
+      });
+    }
+    domains.add(site.domain);
+  }
+  proxies.sort((a, b) => {
+    if (a.to !== b.to)
+      return a.to.localeCompare(b.to);
+    return (b.path?.length ?? 0) - (a.path?.length ?? 0);
+  });
+  const config6 = {
+    proxies,
+    productionCerts: { certsDir },
+    https: true,
+    hostsManagement: false,
+    cleanup: { hosts: false, certs: false }
+  };
+  if (options.proxy.onDemandTls && domains.size > 0) {
+    config6.onDemandTls = {
+      enabled: true,
+      allowedSuffixes: [...domains],
+      email: options.proxy.onDemandTlsEmail,
+      certsDir
+    };
+  }
+  return config6;
+}
+function renderRpxLauncher(config6) {
+  const json = JSON.stringify(config6, null, 2);
+  return `// Generated by ts-cloud — rpx reverse-proxy gateway.
+// Routes are derived from the \`sites\` model on every \`buddy deploy\`.
+import { startProxies } from '@stacksjs/rpx'
+
+const config = ${json} as const
+
+await startProxies(config as any)
+`;
+}
+var RPX_DIR = "/etc/rpx";
+var RPX_LAUNCHER_PATH = "/etc/rpx/gateway.ts";
+var RPX_SERVICE_NAME = "rpx-gateway.service";
+function writeFileHeredoc(path, content, delimiter) {
+  return [
+    `cat > ${path} <<'${delimiter}'`,
+    content,
+    delimiter
+  ];
+}
+function buildRpxProvisionScript(options) {
+  const { config: config6, proxy } = options;
+  const bunBin = options.bunBin ?? "/usr/local/bin/bun";
+  const version2 = proxy.version ?? "latest";
+  const certsDir = config6.productionCerts.certsDir;
+  const launcher = renderRpxLauncher(config6);
+  return [
+    "set -euo pipefail",
+    `mkdir -p ${RPX_DIR} ${certsDir}`,
+    `${bunBin} add -g @stacksjs/rpx@${version2}`,
+    ...writeFileHeredoc(RPX_LAUNCHER_PATH, launcher, "TS_CLOUD_RPX_EOF"),
+    ...writeFileHeredoc(`/etc/systemd/system/${RPX_SERVICE_NAME}`, [
+      "[Unit]",
+      "Description=rpx reverse-proxy gateway (managed by ts-cloud)",
+      "After=network.target network-online.target",
+      "Wants=network-online.target",
+      "",
+      "[Service]",
+      "Type=simple",
+      `ExecStart=${bunBin} ${RPX_LAUNCHER_PATH}`,
+      `Environment=BUN_INSTALL=/root/.bun`,
+      "Restart=always",
+      "RestartSec=5",
+      "LimitNOFILE=1048576",
+      "AmbientCapabilities=CAP_NET_BIND_SERVICE",
+      "",
+      "[Install]",
+      "WantedBy=multi-user.target"
+    ].join(`
+`), "TS_CLOUD_RPX_UNIT_EOF"),
+    "systemctl daemon-reload",
+    `systemctl enable ${RPX_SERVICE_NAME}`,
+    `systemctl restart ${RPX_SERVICE_NAME}`
+  ];
+}
+
 // src/drivers/hetzner/firewall-rules.ts
 function buildHetznerFirewallRules(config6) {
   const openPorts = new Set([80, 443, ...config6.sitePorts]);
@@ -82049,14 +81982,18 @@ class HetznerDriver {
       return this.outputsFromState(rehydrated, alreadyRunning);
     }
     const sites = config6.sites || {};
-    const caddyfile = resolveCaddyfile(sites, compute.proxy);
-    const sitePorts = caddyfile ? [] : this.collectUpstreamPorts(sites, compute.proxy);
+    const sitePorts = this.collectUpstreamPorts(sites);
+    const rpxProvision = compute.proxy?.engine === "rpx" ? buildRpxProvisionScript({
+      proxy: compute.proxy,
+      config: buildRpxConfig(sites, { proxy: compute.proxy }),
+      bunBin: compute.runtime === "node" || compute.runtime === "deno" ? undefined : "/usr/local/bin/bun"
+    }) : undefined;
     const bootstrap = generateUbuntuAppCloudInit({
       runtime: compute.runtime || "bun",
       runtimeVersion: compute.runtimeVersion || "latest",
       systemPackages: compute.systemPackages,
       database: config6.infrastructure?.database,
-      caddyfile
+      rpxProvision
     });
     const userData = wrapCloudInitUserData(bootstrap);
     const serverType = resolveHetznerServerType(compute.size);
@@ -82222,12 +82159,8 @@ class HetznerDriver {
     const { firewall } = await this.client.createFirewall({ name, labels, rules });
     return { firewall };
   }
-  collectUpstreamPorts(sites, proxy) {
+  collectUpstreamPorts(sites) {
     const ports = new Set;
-    for (const app of proxy?.apps ?? []) {
-      if (typeof app.port === "number")
-        ports.add(app.port);
-    }
     for (const site of Object.values(sites)) {
       if (typeof site.port === "number")
         ports.add(site.port);
@@ -82548,6 +82481,48 @@ async function deployAllComputeSites(options) {
       }
     }
   }
+  const reloaded = await reloadRpxGateway(options);
+  if (!reloaded)
+    return false;
+  return true;
+}
+async function reloadRpxGateway(options) {
+  const { config: config6, environment, driver, logger: logger4 = noopLogger } = options;
+  const proxy = config6.infrastructure?.compute?.proxy;
+  if (proxy?.engine !== "rpx")
+    return true;
+  const sites = config6.sites || {};
+  const rpxConfig = buildRpxConfig(sites, { proxy });
+  if (rpxConfig.proxies.length === 0) {
+    logger4.warn("rpx gateway: no server sites with a domain to route — skipping gateway reload.");
+    return true;
+  }
+  const targets = await driver.findComputeTargets({
+    slug: config6.project.slug,
+    environment,
+    role: "app"
+  });
+  if (targets.length === 0) {
+    logger4.warn("rpx gateway: no compute targets found — skipping gateway reload.");
+    return true;
+  }
+  logger4.step(`Reloading rpx gateway with ${rpxConfig.proxies.length} route(s)...`);
+  const script = buildRpxProvisionScript({ proxy, config: rpxConfig });
+  const result = await driver.runRemoteDeploy({
+    targets,
+    commands: script,
+    comment: `ts-cloud rpx gateway reload ${config6.project.slug}`,
+    tags: {
+      Project: config6.project.slug,
+      Environment: environment,
+      Role: "app"
+    }
+  });
+  if (!result.success) {
+    logger4.error(`rpx gateway reload failed: ${result.error || "unknown error"}`);
+    return false;
+  }
+  logger4.success(`rpx gateway reloaded on ${result.instanceCount} target(s)`);
   return true;
 }
 // src/index.ts
@@ -82581,7 +82556,6 @@ export {
   suggestFlags,
   suggestCommand,
   storageAdvancedManager,
-  staticSiteServerRoot,
   staticSiteManager,
   stackDependencyManager,
   signRequestAsync,
@@ -82613,14 +82587,12 @@ export {
   resolveDeployBucketName,
   resolveCredentials,
   resolveCloudProvider,
-  resolveCaddyfile,
   requiresReplacement,
   replicaManager,
   remapKey,
   regionPairManager,
   quickHash,
   queueManagementManager,
-  proxyConfigFromSites,
   providerEndpoint,
   progressiveDeploymentManager,
   processInChunks,
@@ -82655,7 +82627,6 @@ export {
   keyMatchesFilters,
   isWebCryptoAvailable,
   isValidRegion,
-  isOnDemandDomain,
   isNodeCryptoAvailable,
   isLocalDevelopment,
   isLikelyTypo,
@@ -82808,8 +82779,6 @@ export {
   buildSiteDeployScript,
   buildOptimizationManager,
   buildCloudFormationTemplate,
-  buildCaddyfileFromProxy,
-  buildCaddyfile,
   bounceComplaintHandler,
   blueGreenManager,
   batchProcessingManager,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@stacksjs/ts-cloud",
   "type": "module",
-  "version": "0.2.23",
+  "version": "0.2.25",
   "description": "A lightweight, performant infrastructure-as-code library and CLI for deploying both server-based (EC2) and serverless applications.",
   "author": "Chris Breuer <chris@stacksjs.com>",
   "license": "MIT",
@@ -89,8 +89,8 @@
     "test": "bun test"
   },
   "dependencies": {
-    "@ts-cloud/aws-types": "0.2.23",
-    "@ts-cloud/core": "0.2.23",
+    "@ts-cloud/aws-types": "0.2.25",
+    "@ts-cloud/core": "0.2.25",
     "@stacksjs/ts-xml": "^0.1.0"
   },
   "devDependencies": {

package/dist/drivers/shared/caddyfile.d.ts

@@ -1,46 +0,0 @@
-import type { CaddyAppConfig, CaddyProxyConfig, SiteConfig } from '@ts-cloud/core';
-/** A domain is "on-demand" (needs lazy TLS) if it's a wildcard or bare catch-all. */
-export declare function isOnDemandDomain(domain: string): boolean;
-/**
- * The on-server install path a static site's `root` is shipped to. Mirrors the
- * release layout used by the systemd app deploy (`/var/www/<name>`), so a box
- * can host both proxied apps and file-served static sites side by side.
- */
-export declare function staticSiteServerRoot(name: string): string;
-/**
- * Build a complete Caddyfile from a typed {@link CaddyProxyConfig}.
- *
- * Produces:
- *  - a global options block (ACME email, on-demand TLS `ask`, staging CA, extras);
- *  - one site block per unique domain set, each performing host-based routing to
- *    its upstream app(s);
- *  - `tls { on_demand }` inside any block whose domains are wildcards/catch-all.
- *
- * Returns `undefined` when there's nothing to route (no apps, no raw).
- */
-export declare function buildCaddyfileFromProxy(proxy: CaddyProxyConfig): string | undefined;
-/**
- * Derive a {@link CaddyProxyConfig} from the legacy `sites` map: every site
- * that declares a `domain` + `port` becomes a Caddy app. Keeps single-app /
- * sites-driven deploys working without an explicit `compute.proxy` block.
- */
-export declare function proxyConfigFromSites(sites: Record<string, SiteConfig>): CaddyProxyConfig & {
-    apps: CaddyAppConfig[];
-};
-/**
- * Resolve the final Caddyfile for a deploy. Prefers the typed `compute.proxy`
- * config (merging in `sites`-derived apps when `proxy.apps` is omitted), and
- * falls back to deriving everything from `sites`.
- *
- * Returns `undefined` when there's nothing to route.
- */
-export declare function resolveCaddyfile(sites: Record<string, SiteConfig>, proxy?: CaddyProxyConfig): string | undefined;
-/**
- * Build a Caddyfile from site configs. Sites sharing a domain are grouped;
- * explicit paths are ordered before catch-all routes.
- *
- * @deprecated Prefer {@link resolveCaddyfile} / {@link buildCaddyfileFromProxy},
- * which support multi-app host routing and on-demand TLS. Retained for
- * backward compatibility.
- */
-export declare function buildCaddyfile(sites: Record<string, SiteConfig>): string | undefined;