@stacksjs/ts-cloud 0.5.0 → 0.5.2

package/dist/index.js

@@ -25946,15 +25946,21 @@ function composeServerlessAppTemplate(opts) {
     TSCLOUD_LAMBDA_MODE: mode,
     TSCLOUD_ENV: environment,
     ...app.octane ? { TSCLOUD_OCTANE: "1" } : {},
+    ...app.scheduler === "sub-minute" ? { TSCLOUD_SCHEDULER: "sub-minute" } : {},
     ...cacheEnabled ? { TSCLOUD_CACHE_TABLE: `${slug}-${environment}-cache` } : {},
     ...hasQueue ? { TSCLOUD_QUEUE: queueNames[0] } : {},
     ...app.env ?? {}
   });
+  const efsEnabled = Boolean(app.efs);
+  const efsOpts = typeof app.efs === "object" ? app.efs : {};
+  const efsMountPath = efsOpts.mountPath ?? "/mnt/local";
+  const efsProvision = efsEnabled && !efsOpts.accessPointArn;
+  const efsAccessPoint = efsOpts.accessPointArn ?? (efsProvision ? Fn2.getAtt("EfsAccessPoint", "Arn") : undefined);
   const subnets = app.vpc?.subnets ?? [];
   const hasVpc = subnets.length > 0;
-  const needsDataVpc = app.cache?.driver === "elasticache" || app.database?.connection === "aurora-serverless" || Boolean(app.rdsProxy);
+  const needsDataVpc = app.cache?.driver === "elasticache" || app.database?.connection === "aurora-serverless" || Boolean(app.rdsProxy) || efsEnabled;
   if (needsDataVpc && !hasVpc) {
-    throw new Error("serverless app: elasticache / aurora-serverless / rdsProxy require app.vpc.subnets (private subnets) to be set.");
+    throw new Error("serverless app: elasticache / aurora-serverless / rdsProxy / efs require app.vpc.subnets (private subnets) to be set.");
   }
   const vpcConfig = hasVpc ? {
     VpcConfig: {
@@ -25965,7 +25971,16 @@ function composeServerlessAppTemplate(opts) {
       ]
     }
   } : {};
-  function addFunction(logicalId, name, handler8, mode, memory, timeout, reservedConcurrency) {
+  const efsDependsOn = efsProvision ? subnets.map((_, i) => `EfsMountTarget${i}`) : [];
+  const efsConfig = efsEnabled ? { FileSystemConfigs: [{ Arn: efsAccessPoint, LocalMountPath: efsMountPath }] } : {};
+  if (efsEnabled) {
+    inlinePolicies[0].PolicyDocument.Statement.push({
+      Effect: "Allow",
+      Action: ["elasticfilesystem:ClientMount", "elasticfilesystem:ClientWrite", "elasticfilesystem:ClientRootAccess", "elasticfilesystem:DescribeMountTargets"],
+      Resource: "*"
+    });
+  }
+  function addFunction(logicalId, name, handler8, mode, memory, timeout, reservedConcurrency, tmp = tmpStorage) {
     resources[`${logicalId}LogGroup`] = {
       Type: "AWS::Logs::LogGroup",
       Properties: { LogGroupName: `/aws/lambda/${name}`, RetentionInDays: 14 }
@@ -25982,7 +25997,7 @@ function composeServerlessAppTemplate(opts) {
     };
     resources[logicalId] = {
       Type: "AWS::Lambda::Function",
-      DependsOn: [`${logicalId}LogGroup`],
+      DependsOn: [`${logicalId}LogGroup`, ...efsDependsOn],
       Properties: {
         FunctionName: name,
         Architectures: [architecture],
@@ -25990,17 +26005,18 @@ function composeServerlessAppTemplate(opts) {
         Timeout: timeout,
         Role: Fn2.getAtt("AppRole", "Arn"),
         Environment: { Variables: baseEnv(mode) },
-        EphemeralStorage: { Size: tmpStorage },
+        EphemeralStorage: { Size: tmp },
         ...codeProps,
         ...reservedConcurrency !== undefined ? { ReservedConcurrentExecutions: reservedConcurrency } : {},
-        ...vpcConfig
+        ...vpcConfig,
+        ...efsConfig
       }
     };
   }
-  addFunction("HttpFunction", functionNames.http, handlers.http, "http", app.memory ?? 1024, app.timeout ?? 28, app.concurrency);
-  addFunction("CliFunction", functionNames.cli, handlers.cli, "cli", app.cliMemory ?? 1024, app.cliTimeout ?? 900);
+  addFunction("HttpFunction", functionNames.http, handlers.http, "http", app.memory ?? 1024, app.timeout ?? 28, app.concurrency, tmpStorage);
+  addFunction("CliFunction", functionNames.cli, handlers.cli, "cli", app.cliMemory ?? 1024, app.cliTimeout ?? 900, undefined, app.cliTmpStorage ?? tmpStorage);
   if (hasQueue)
-    addFunction("QueueFunction", functionNames.queue, handlers.queue, "queue", app.queueMemory ?? 1024, app.queueTimeout ?? 120);
+    addFunction("QueueFunction", functionNames.queue, handlers.queue, "queue", app.queueMemory ?? 1024, app.queueTimeout ?? 120, undefined, app.queueTmpStorage ?? tmpStorage);
   resources.HttpApi = {
     Type: "AWS::ApiGatewayV2::Api",
     Properties: {
@@ -26047,6 +26063,59 @@ function composeServerlessAppTemplate(opts) {
     Value: Fn2.getAtt("HttpApi", "ApiEndpoint")
   };
   outputs.HttpApiId = { Description: "HTTP API id", Value: Fn2.ref("HttpApi") };
+  const domains = (Array.isArray(app.domain) ? app.domain : app.domain ? [app.domain] : []).filter(Boolean);
+  if (domains.length) {
+    if (!app.certificateArn && !app.hostedZoneId) {
+      throw new Error("serverless app: a custom `domain` needs either `certificateArn` (pre-issued, regional) or `hostedZoneId` (to auto-issue + validate an ACM cert).");
+    }
+    let certRef = app.certificateArn;
+    if (!certRef) {
+      resources.HttpCertificate = {
+        Type: "AWS::CertificateManager::Certificate",
+        Properties: {
+          DomainName: domains[0],
+          ...domains.length > 1 ? { SubjectAlternativeNames: domains.slice(1) } : {},
+          ValidationMethod: "DNS",
+          DomainValidationOptions: domains.map((d) => ({ DomainName: d, HostedZoneId: app.hostedZoneId }))
+        }
+      };
+      certRef = Fn2.ref("HttpCertificate");
+    }
+    domains.forEach((d, i) => {
+      const dn = `HttpDomain${i}`;
+      resources[dn] = {
+        Type: "AWS::ApiGatewayV2::DomainName",
+        Properties: {
+          DomainName: d,
+          DomainNameConfigurations: [{ CertificateArn: certRef, EndpointType: "REGIONAL" }]
+        }
+      };
+      resources[`HttpApiMapping${i}`] = {
+        Type: "AWS::ApiGatewayV2::ApiMapping",
+        DependsOn: ["HttpStage"],
+        Properties: { ApiId: Fn2.ref("HttpApi"), DomainName: Fn2.ref(dn), Stage: "$default" }
+      };
+      if (app.hostedZoneId) {
+        resources[`HttpDomainRecord${i}`] = {
+          Type: "AWS::Route53::RecordSet",
+          Properties: {
+            HostedZoneId: app.hostedZoneId,
+            Name: d,
+            Type: "A",
+            AliasTarget: {
+              DNSName: Fn2.getAtt(dn, "RegionalDomainName"),
+              HostedZoneId: Fn2.getAtt(dn, "RegionalHostedZoneId")
+            }
+          }
+        };
+      }
+      outputs[`CustomDomain${i}`] = { Description: `Custom domain ${d}`, Value: d };
+      outputs[`CustomDomainTarget${i}`] = {
+        Description: `Point ${d} (CNAME/alias) at this APIGW regional domain`,
+        Value: Fn2.getAtt(dn, "RegionalDomainName")
+      };
+    });
+  }
   if (hasQueue) {
     resources.AppQueueDlq = {
       Type: "AWS::SQS::Queue",
@@ -26189,10 +26258,37 @@ function composeServerlessAppTemplate(opts) {
             DomainName: Fn2.getAtt("AssetsBucket", "RegionalDomainName"),
             OriginAccessControlId: Fn2.ref("AssetsOAC"),
             S3OriginConfig: { OriginAccessIdentity: "" }
-          }]
+          }],
+          ...app.assetDomain ? {
+            Aliases: [app.assetDomain],
+            ViewerCertificate: {
+              AcmCertificateArn: app.assetCertificateArn,
+              SslSupportMethod: "sni-only",
+              MinimumProtocolVersion: "TLSv1.2_2021"
+            }
+          } : {}
         }
       }
     };
+    if (app.assetDomain) {
+      if (!app.assetCertificateArn)
+        throw new Error("serverless app: `assetDomain` requires `assetCertificateArn` (a us-east-1 ACM cert — CloudFront only accepts certs from us-east-1).");
+      if (app.hostedZoneId) {
+        resources.AssetsDomainRecord = {
+          Type: "AWS::Route53::RecordSet",
+          Properties: {
+            HostedZoneId: app.hostedZoneId,
+            Name: app.assetDomain,
+            Type: "A",
+            AliasTarget: {
+              DNSName: Fn2.getAtt("AssetsDistribution", "DomainName"),
+              HostedZoneId: "Z2FDTNDATAQYW2"
+            }
+          }
+        };
+      }
+      outputs.AssetDomain = { Description: "Custom asset CDN host", Value: app.assetDomain };
+    }
     resources.AssetsBucketPolicy = {
       Type: "AWS::S3::BucketPolicy",
       Properties: {
@@ -26271,6 +26367,37 @@ function composeServerlessAppTemplate(opts) {
       }
     };
   }
+  if (efsProvision) {
+    resources.EfsFileSystem = {
+      Type: "AWS::EFS::FileSystem",
+      Properties: {
+        Encrypted: true,
+        FileSystemTags: [{ Key: "Name", Value: `${slug}-${environment}-efs` }]
+      }
+    };
+    subnets.forEach((subnetId, i) => {
+      resources[`EfsMountTarget${i}`] = {
+        Type: "AWS::EFS::MountTarget",
+        Properties: {
+          FileSystemId: Fn2.ref("EfsFileSystem"),
+          SubnetId: subnetId,
+          SecurityGroups: [Fn2.getAtt("DataSecurityGroup", "GroupId")]
+        }
+      };
+    });
+    resources.EfsAccessPoint = {
+      Type: "AWS::EFS::AccessPoint",
+      Properties: {
+        FileSystemId: Fn2.ref("EfsFileSystem"),
+        PosixUser: { Uid: 1001, Gid: 1001 },
+        RootDirectory: {
+          Path: "/lambda",
+          CreationInfo: { OwnerUid: 1001, OwnerGid: 1001, Permissions: "0755" }
+        }
+      }
+    };
+    outputs.EfsFileSystemId = { Description: "EFS file system id", Value: Fn2.ref("EfsFileSystem") };
+  }
   if (app.cache?.driver === "elasticache") {
     resources.CacheSubnetGroup = {
       Type: "AWS::ElastiCache::SubnetGroup",
@@ -83078,6 +83205,8 @@ function buildFunctionEnv(app, ctx, environment, mode, secrets, assetUrl, queueN
     TSCLOUD_ENV: environment,
     MAINTENANCE_MODE: "0",
     ...app.octane ? { TSCLOUD_OCTANE: "1" } : {},
+    ...app.serveAssets ? { TSCLOUD_SERVE_ASSETS: "1" } : {},
+    ...app.redirectRobotsTxt === false ? { TSCLOUD_REDIRECT_ROBOTS_TXT: "0" } : {},
     ...laravelDefaults,
     ...infraEnv,
     ...ctx.app.cache?.driver !== "elasticache" ? { TSCLOUD_CACHE_TABLE: `${ctx.slug}-${environment}-cache` } : {},
@@ -83118,13 +83247,15 @@ function* walk3(dir) {
       yield full;
   }
 }
-async function uploadAssets(s32, bucket, dir, prefix) {
+async function uploadAssets(s32, bucket, dir, prefix, includeDotfiles = false) {
   let count = 0;
   for (const file of walk3(dir)) {
-    const key = `${prefix}/${relative6(dir, file).replace(/\\/g, "/")}`;
+    const rel = relative6(dir, file).replace(/\\/g, "/");
+    if (!includeDotfiles && rel.split("/").some((seg) => seg.startsWith(".")))
+      continue;
     await s32.putObject({
       bucket,
-      key,
+      key: `${prefix}/${rel}`,
       body: readFileSync13(file),
       contentType: contentType(file),
       cacheControl: "public, max-age=31536000, immutable"
@@ -83230,10 +83361,10 @@ async function deployServerlessApp(config6, environment, opts = {}) {
   if (app.assets) {
     const assetsDir3 = join16(projectRoot, app.assets);
     if (existsSync17(assetsDir3)) {
-      const cdn = outputs.AssetsCdnDomain;
+      const cdn = app.assetDomain || outputs.AssetsCdnDomain;
       assetUrl = cdn ? `https://${cdn}/${artifactSha}` : undefined;
       step(`Syncing assets from ${app.assets}`);
-      const n = await uploadAssets(s32, ctx.assetsBucket, assetsDir3, artifactSha);
+      const n = await uploadAssets(s32, ctx.assetsBucket, assetsDir3, artifactSha, app.dotFilesAsAssets);
       info(`Uploaded ${n} asset(s)${assetUrl ? ` → ${assetUrl}` : ""}`);
     } else {
       warn(`Assets directory not found: ${assetsDir3}`);
@@ -83487,31 +83618,63 @@ function buildDatabaseSetupScript(database, services = {}) {
   if (usePostgres && !useMysql && !useMariadb) {
     const pgIdent = (v) => `"${v.replace(/"/g, '""')}"`;
     const pgLit = (v) => `'${v.replace(/'/g, "''")}'`;
+    const pgEnsureRole = (u, p) => [
+      "DO $$ BEGIN",
+      `  IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = ${pgLit(u)}) THEN`,
+      `    CREATE ROLE ${pgIdent(u)} LOGIN PASSWORD ${pgLit(p)};`,
+      "  ELSE",
+      `    ALTER ROLE ${pgIdent(u)} LOGIN PASSWORD ${pgLit(p)};`,
+      "  END IF;",
+      "END $$;"
+    ];
+    const pgGrant = (u) => {
+      const dbs = u.databases && u.databases.length > 0 ? u.databases : [name];
+      const lines = [];
+      for (const db of dbs) {
+        if (u.access === "readonly") {
+          lines.push(`GRANT CONNECT ON DATABASE ${pgIdent(db)} TO ${pgIdent(u.username)};`, `\\connect ${pgIdent(db)}`, `GRANT USAGE ON SCHEMA public TO ${pgIdent(u.username)};`, `GRANT SELECT ON ALL TABLES IN SCHEMA public TO ${pgIdent(u.username)};`, `ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON TABLES TO ${pgIdent(u.username)};`, "\\connect postgres");
+        } else {
+          lines.push(`GRANT ALL PRIVILEGES ON DATABASE ${pgIdent(db)} TO ${pgIdent(u.username)};`);
+        }
+      }
+      return lines;
+    };
+    const extraUsers2 = database.users || [];
     return [
       pantryEnvActivation(),
       "for i in $(seq 1 30); do pg_isready -h 127.0.0.1 -p 5432 -q && break; sleep 2; done",
       "psql -h 127.0.0.1 -p 5432 -U postgres <<'TS_CLOUD_PG_EOF'",
-      "DO $$ BEGIN",
-      `  IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = ${pgLit(user)}) THEN`,
-      `    CREATE ROLE ${pgIdent(user)} LOGIN PASSWORD ${pgLit(pass)};`,
-      "  END IF;",
-      "END $$;",
+      ...pgEnsureRole(user, pass),
       `SELECT 'CREATE DATABASE ${pgIdent(name)} OWNER ${pgIdent(user)}' ` + `WHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = ${pgLit(name)})\\gexec`,
+      ...extraUsers2.flatMap((u) => [...pgEnsureRole(u.username, u.password), ...pgGrant(u)]),
       "TS_CLOUD_PG_EOF"
     ];
   }
   const sock = useMariadb ? "/var/lib/pantry/mariadb/mariadbd.sock" : "/var/lib/pantry/mysql/mysqld.sock";
   const ident = (v) => v.replace(/`/g, "``");
   const lit = (v) => v.replace(/\\/g, "\\\\").replace(/'/g, "\\'");
+  const mysqlUser = (u) => {
+    const dbs = u.databases && u.databases.length > 0 ? u.databases : [name];
+    const priv = u.access === "readonly" ? "SELECT" : "ALL PRIVILEGES";
+    const lines = [
+      `CREATE USER IF NOT EXISTS '${lit(u.username)}'@'%' IDENTIFIED BY '${lit(u.password)}';`,
+      `CREATE USER IF NOT EXISTS '${lit(u.username)}'@'localhost' IDENTIFIED BY '${lit(u.password)}';`,
+      `ALTER USER '${lit(u.username)}'@'%' IDENTIFIED BY '${lit(u.password)}';`,
+      `ALTER USER '${lit(u.username)}'@'localhost' IDENTIFIED BY '${lit(u.password)}';`
+    ];
+    for (const db of dbs) {
+      lines.push(`GRANT ${priv} ON \`${ident(db)}\`.* TO '${lit(u.username)}'@'%';`, `GRANT ${priv} ON \`${ident(db)}\`.* TO '${lit(u.username)}'@'localhost';`);
+    }
+    return lines;
+  };
+  const extraUsers = database.users || [];
   return [
     pantryEnvActivation(),
     `for i in $(seq 1 30); do mysqladmin --socket=${sock} -u root ping 2>/dev/null | grep -q alive && break; sleep 2; done`,
     `mysql --socket=${sock} -u root <<'TS_CLOUD_SQL_EOF'`,
     `CREATE DATABASE IF NOT EXISTS \`${ident(name)}\` CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;`,
-    `CREATE USER IF NOT EXISTS '${lit(user)}'@'%' IDENTIFIED BY '${lit(pass)}';`,
-    `CREATE USER IF NOT EXISTS '${lit(user)}'@'localhost' IDENTIFIED BY '${lit(pass)}';`,
-    `GRANT ALL PRIVILEGES ON \`${ident(name)}\`.* TO '${lit(user)}'@'%';`,
-    `GRANT ALL PRIVILEGES ON \`${ident(name)}\`.* TO '${lit(user)}'@'localhost';`,
+    ...mysqlUser({ username: user, password: pass }),
+    ...extraUsers.flatMap(mysqlUser),
     "FLUSH PRIVILEGES;",
     "TS_CLOUD_SQL_EOF"
   ];
@@ -83535,6 +83698,19 @@ function buildManagedDbEnv(database) {
 }
 
 // src/drivers/shared/php-provision.ts
+var PRODUCTION_PHP_INI = {
+  "opcache.enable": "1",
+  "opcache.enable_cli": "1",
+  "opcache.memory_consumption": "256",
+  "opcache.interned_strings_buffer": "16",
+  "opcache.max_accelerated_files": "20000",
+  "opcache.validate_timestamps": "0",
+  "opcache.revalidate_freq": "0",
+  "opcache.save_comments": "1",
+  "opcache.fast_shutdown": "1",
+  realpath_cache_size: "4096K",
+  realpath_cache_ttl: "600"
+};
 var PHP_FPM_LISTEN = "127.0.0.1:9074";
 function phpFpmSocketPath(_version) {
   return PHP_FPM_LISTEN;
@@ -83543,6 +83719,45 @@ function resolveDefaultPhpVersion(options = {}) {
   const versions = options.versions?.length ? options.versions : ["8.3"];
   return options.default && versions.includes(options.default) ? options.default : versions[0];
 }
+function resolvePhpIni(options = {}) {
+  const base = options.optimizeForProduction === false ? {} : { ...PRODUCTION_PHP_INI };
+  return { ...base, ...options.ini || {} };
+}
+function buildPhpTuningScript(options = {}) {
+  const ini = resolvePhpIni(options);
+  const keys = Object.keys(ini);
+  if (keys.length === 0)
+    return [];
+  const body = keys.map((k) => `${k}=${ini[k]}`);
+  const marker = "ts-cloud-managed";
+  return [
+    pantryEnvActivation(),
+    "TS_CLOUD_SCAN_DIR=$(php -i 2>/dev/null | awk -F' => ' '/^Scan this dir for additional .ini files/{print $2}' | head -1)",
+    `TS_CLOUD_LOADED_INI=$(php -r 'echo php_ini_loaded_file() ?: "";' 2>/dev/null)`,
+    'if [ -n "$TS_CLOUD_SCAN_DIR" ] && [ "$TS_CLOUD_SCAN_DIR" != "(none)" ]; then',
+    '  mkdir -p "$TS_CLOUD_SCAN_DIR"',
+    '  TS_CLOUD_PHP_INI="$TS_CLOUD_SCAN_DIR/zz-ts-cloud.ini"',
+    `  cat > "$TS_CLOUD_PHP_INI" <<'TS_CLOUD_PHPINI_EOF'`,
+    `; ${marker} — production PHP tuning`,
+    ...body,
+    "TS_CLOUD_PHPINI_EOF",
+    "else",
+    '  if [ -z "$TS_CLOUD_LOADED_INI" ]; then',
+    "    TS_CLOUD_INI_DIR=$(php -i 2>/dev/null | awk -F' => ' '/^Configuration File \\(php.ini\\) Path/{print $2}' | head -1)",
+    '    TS_CLOUD_LOADED_INI="$TS_CLOUD_INI_DIR/php.ini"',
+    '    mkdir -p "$TS_CLOUD_INI_DIR"',
+    '    touch "$TS_CLOUD_LOADED_INI"',
+    "  fi",
+    `  sed -i '/; ${marker} BEGIN/,/; ${marker} END/d' "$TS_CLOUD_LOADED_INI"`,
+    `  cat >> "$TS_CLOUD_LOADED_INI" <<'TS_CLOUD_PHPINI_EOF'`,
+    `; ${marker} BEGIN`,
+    ...body,
+    `; ${marker} END`,
+    "TS_CLOUD_PHPINI_EOF",
+    "fi",
+    `(cd ${PANTRY_PROJECT_DIR} && pantry restart php-fpm) 2>/dev/null || true`
+  ];
+}
 function buildPhpProvisionScript(options = {}) {
   const defaultVersion = resolveDefaultPhpVersion(options);
   const installNginx = options.installNginx !== false;
@@ -83554,11 +83769,22 @@ function buildPhpProvisionScript(options = {}) {
     specs.push("nginx.org");
   return [
     ...buildPantryInstallScript(specs),
-    ...buildPantryServiceScript(["php-fpm"])
+    ...buildPantryServiceScript(["php-fpm"]),
+    ...buildPhpTuningScript(options)
   ];
 }
 
 // src/drivers/shared/nginx-vhost.ts
+function resolveNginxSnippet(nginx, templates) {
+  if (!nginx)
+    return [];
+  const out = [];
+  if (nginx.template && templates?.[nginx.template])
+    out.push(...templates[nginx.template]);
+  if (nginx.serverSnippet)
+    out.push(...nginx.serverSnippet);
+  return out;
+}
 function htpasswdPath(siteName) {
   return `/etc/nginx/.htpasswd-${siteName}`;
 }
@@ -83591,6 +83817,9 @@ function vhostBody(options) {
     "    charset utf-8;",
     ""
   ];
+  if (options.clientMaxBodySize) {
+    lines.push(`    client_max_body_size ${options.clientMaxBodySize};`, "");
+  }
   if (options.auth) {
     lines.push(`    auth_basic "${options.auth.realm || "Restricted"}";`, `    auth_basic_user_file ${htpasswdPath(options.siteName)};`, "");
   }
@@ -83606,6 +83835,11 @@ function vhostBody(options) {
   } else {
     lines.push("    location / {", "        try_files $uri $uri/ =404;", "    }");
   }
+  if (options.serverSnippet && options.serverSnippet.length > 0) {
+    lines.push("");
+    for (const line of options.serverSnippet)
+      lines.push(line ? `    ${line}` : "");
+  }
   return lines;
 }
 function buildNginxVhost(options) {
@@ -83730,6 +83964,12 @@ function buildNginxServiceScript(projectDir = "/opt/pantry") {
     "    fastcgi_temp_path /var/lib/nginx/fastcgi;",
     "    uwsgi_temp_path /var/lib/nginx/uwsgi;",
     "    scgi_temp_path /var/lib/nginx/scgi;",
+    "    server {",
+    "        listen 80 default_server;",
+    "        listen [::]:80 default_server;",
+    "        server_name _;",
+    "        return 444;",
+    "    }",
     "    include /etc/nginx/sites-enabled/*;",
     "}",
     "TS_CLOUD_NGINXCONF_EOF",
@@ -84057,7 +84297,9 @@ function buildComputeProvisionScripts(config6) {
       versions: compute.php?.versions,
       default: compute.php?.default,
       extensions: compute.php?.extensions,
-      installNginx: useNginx
+      installNginx: useNginx,
+      optimizeForProduction: compute.php?.optimizeForProduction,
+      ini: compute.php?.ini
     }),
     ...useNginx ? buildNginxServiceScript() : []
   ] : undefined;
@@ -85177,7 +85419,9 @@ class HetznerDriver {
       versions: compute.php?.versions,
       default: compute.php?.default,
       extensions: compute.php?.extensions,
-      installNginx: compute.webServer !== "rpx"
+      installNginx: compute.webServer !== "rpx",
+      optimizeForProduction: compute.php?.optimizeForProduction,
+      ini: compute.php?.ini
     });
     const appUserData = wrapCloudInitUserData(buildUbuntuBootstrapScript({ runtime: "php", phpProvision: appPhp, servicesProvision: appProvision, baked }));
     const existingApp = all.filter((s) => matchesTsCloudLabels(s.labels, slug, environment, "app"));
@@ -85673,10 +85917,22 @@ function resolveSslProvider(site) {
     return site.ssl.provider;
   return site.domain ? "letsencrypt" : "none";
 }
-function buildCertbotInstallScript() {
+var DNS_PLUGINS = {
+  cloudflare: { pkg: "python3-certbot-dns-cloudflare", plugin: "dns-cloudflare" },
+  route53: { pkg: "python3-certbot-dns-route53", plugin: "dns-route53" },
+  digitalocean: { pkg: "python3-certbot-dns-digitalocean", plugin: "dns-digitalocean" },
+  google: { pkg: "python3-certbot-dns-google", plugin: "dns-google" }
+};
+function dnsCredentialsPath(provider) {
+  return `/etc/letsencrypt/ts-cloud-${provider}.ini`;
+}
+function buildCertbotInstallScript(dns2) {
+  const plugin = dns2 ? DNS_PLUGINS[dns2.provider] : undefined;
+  const pkgs = ["certbot", "python3-certbot-nginx", ...plugin ? [plugin.pkg] : []].join(" ");
+  const installLine = plugin ? `apt-get update -y && apt-get install -y ${pkgs}` : `command -v certbot >/dev/null 2>&1 || { apt-get update -y && apt-get install -y ${pkgs}; }`;
   return [
     "export DEBIAN_FRONTEND=noninteractive",
-    "command -v certbot >/dev/null 2>&1 || { apt-get update -y && apt-get install -y certbot python3-certbot-nginx; }",
+    installLine,
     "mkdir -p /etc/letsencrypt/renewal-hooks/deploy",
     "cat > /etc/letsencrypt/renewal-hooks/deploy/reload-nginx.sh <<'TS_CLOUD_HOOK_EOF'",
     "#!/bin/sh",
@@ -85687,15 +85943,34 @@ function buildCertbotInstallScript() {
     "systemctl start certbot.timer 2>/dev/null || true"
   ];
 }
-function buildCertbotIssueScript(options) {
-  const domains = [options.domain, ...options.aliases || []].filter(Boolean);
-  const args = [
-    "certbot --nginx",
-    "--non-interactive",
-    "--agree-tos",
-    "--keep-until-expiring",
-    options.redirect === false ? "--no-redirect" : "--redirect"
+function buildDnsCredentialsScript(dns2) {
+  if (!dns2.credentials || Object.keys(dns2.credentials).length === 0)
+    return [];
+  const file = dnsCredentialsPath(dns2.provider);
+  const lines = Object.entries(dns2.credentials).map(([k, v]) => `${k} = ${v}`).join(`
+`);
+  return [
+    `cat > ${file} <<'TS_CLOUD_DNSCREDS_EOF'`,
+    lines,
+    "TS_CLOUD_DNSCREDS_EOF",
+    `chmod 600 ${file}`
   ];
+}
+function buildCertbotIssueScript(options) {
+  const dns2 = options.dns;
+  const domains = options.wildcard ? [`*.${options.domain}`, options.domain] : [options.domain, ...options.aliases || []].filter(Boolean);
+  const args = ["certbot", "--non-interactive", "--agree-tos", "--keep-until-expiring"];
+  if (dns2) {
+    const plugin = DNS_PLUGINS[dns2.provider].plugin;
+    args.push(`--${plugin}`);
+    if (dns2.provider !== "route53" && dns2.credentials)
+      args.push(`--${plugin}-credentials ${dnsCredentialsPath(dns2.provider)}`);
+    if (typeof dns2.propagationSeconds === "number" && dns2.provider !== "route53")
+      args.push(`--${plugin}-propagation-seconds ${dns2.propagationSeconds}`);
+    args.push("certonly");
+  } else {
+    args.push("--nginx", options.redirect === false ? "--no-redirect" : "--redirect");
+  }
   if (options.email)
     args.push(`-m ${options.email}`);
   else
@@ -85707,12 +85982,20 @@ function buildCertbotIssueScript(options) {
 function buildSslScript(site) {
   if (resolveSslProvider(site) !== "letsencrypt" || !site.domain)
     return [];
+  const ssl = site.ssl;
+  const dns2 = ssl?.dns;
+  const wildcard = ssl?.wildcard === true;
+  if (wildcard && !dns2)
+    return [];
   return [
-    ...buildCertbotInstallScript(),
+    ...buildCertbotInstallScript(dns2),
+    ...dns2 ? buildDnsCredentialsScript(dns2) : [],
     ...buildCertbotIssueScript({
       domain: site.domain,
       aliases: site.aliases,
-      email: site.ssl?.email
+      email: ssl?.email,
+      wildcard,
+      dns: dns2
     })
   ];
 }
@@ -85752,6 +86035,16 @@ function shellQuote(value) {
 // src/drivers/shared/releases.ts
 var DEFAULT_SHARED_PATHS = ["storage", ".env"];
 var DEFAULT_KEEP_RELEASES = 4;
+var DEFAULT_KEEP_DEPLOY_LOGS = 20;
+function deployMetaDir(base) {
+  return `${base.replace(/\/+$/, "")}/.ts-cloud`;
+}
+function deployHistoryPath(base) {
+  return `${deployMetaDir(base)}/deploy-history.log`;
+}
+function deployLogPath(base, releaseId) {
+  return `${deployMetaDir(base)}/deploys/${releaseId}.log`;
+}
 function releasePaths(base, releaseId) {
   const root = base.replace(/\/+$/, "");
   return {
@@ -85805,6 +86098,26 @@ function buildPruneReleases(paths, keep = DEFAULT_KEEP_RELEASES) {
     "done"
   ];
 }
+function buildDeployHistoryHeader(base, options) {
+  const meta = deployMetaDir(base);
+  const log4 = deployLogPath(base, options.releaseId);
+  const history = deployHistoryPath(base);
+  const keepLogs = Math.max(1, options.keepLogs ?? DEFAULT_KEEP_DEPLOY_LOGS);
+  const commit = options.commit || "";
+  const branch = options.branch || "";
+  return [
+    `mkdir -p ${meta}/deploys`,
+    `exec > >(tee -a ${log4}) 2>&1`,
+    `echo "[ts-cloud] deploy ${options.releaseId} commit=${commit} branch=${branch} starting $(date -u +%Y-%m-%dT%H:%M:%SZ)"`,
+    "ts_cloud_record_deploy() {",
+    "  TS_CLOUD_RC=$?",
+    '  if [ "$TS_CLOUD_RC" -eq 0 ]; then TS_CLOUD_ST=success; else TS_CLOUD_ST=failed; fi',
+    `  printf '%s\\t%s\\t%s\\t%s\\trc=%s\\n' "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "${options.releaseId}" "${commit}" "$TS_CLOUD_ST" "$TS_CLOUD_RC" >> ${history}`,
+    "}",
+    "trap ts_cloud_record_deploy EXIT",
+    `ls -1t ${meta}/deploys/*.log 2>/dev/null | tail -n +${keepLogs + 1} | while read -r TS_CLOUD_OLDLOG; do rm -f "$TS_CLOUD_OLDLOG"; done`
+  ];
+}
 
 // src/drivers/shared/laravel-deploy.ts
 var MACRO_CREATE_RELEASE = "$CREATE_RELEASE";
@@ -85857,6 +86170,21 @@ function writeSharedEnv(sharedEnvPath, env2) {
     `chmod 600 ${sharedEnvPath}`
   ];
 }
+function writeFileHeredoc2(path, body, marker) {
+  return [`cat > ${path} <<'${marker}'`, body.replace(/\n$/, ""), marker, `chmod 600 ${path}`];
+}
+function buildCredentialFiles(releaseDir, creds) {
+  if (!creds)
+    return [];
+  const out = [];
+  if (creds.composerAuth) {
+    const json = typeof creds.composerAuth === "string" ? creds.composerAuth : JSON.stringify(creds.composerAuth, null, 2);
+    out.push(...writeFileHeredoc2(`${releaseDir}/auth.json`, json, "TS_CLOUD_AUTHJSON_EOF"));
+  }
+  if (creds.npmrc)
+    out.push(...writeFileHeredoc2(`${releaseDir}/.npmrc`, creds.npmrc, "TS_CLOUD_NPMRC_EOF"));
+  return out;
+}
 function buildLaravelDeployScript(options) {
   const { siteName, site, releaseId, commit } = options;
   if (!site.repository?.url)
@@ -85874,6 +86202,12 @@ function buildLaravelDeployScript(options) {
     "export COMPOSER_ALLOW_SUPERUSER=1",
     pantryEnvActivation()
   ];
+  out.push(...buildDeployHistoryHeader(base, {
+    releaseId,
+    commit,
+    branch: site.repository.branch,
+    keepLogs: keepReleases
+  }));
   out.push(...buildEnsureReleaseLayout(paths, sharedPaths));
   if (site.env && Object.keys(site.env).length > 0)
     out.push(...writeSharedEnv(`${paths.shared}/.env`, site.env));
@@ -85883,6 +86217,7 @@ function buildLaravelDeployScript(options) {
       out.push(...buildGitCheckoutScript({ repository: site.repository, releaseDir: paths.release, commit }));
       out.push(...buildLinkSharedPaths(paths, sharedPaths));
       out.push(`cd ${paths.release}`);
+      out.push(...buildCredentialFiles(paths.release, site.credentials));
       out.push(`chown -R www-data:www-data ${paths.shared}/storage 2>/dev/null || true`, `[ -d ${paths.release}/bootstrap/cache ] && chown -R www-data:www-data ${paths.release}/bootstrap/cache 2>/dev/null || true`, `chmod -R ug+rwX ${paths.shared}/storage 2>/dev/null || true`);
     } else if (line === MACRO_ACTIVATE_RELEASE) {
       out.push(...buildActivateRelease(paths));
@@ -85905,6 +86240,9 @@ function pantryExec(cmd) {
 function reEscape(value) {
   return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
+function cronQuote(value) {
+  return `'${value.split("'").join("'\\''")}'`;
+}
 function slugify(value) {
   return value.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") || "unnamed";
 }
@@ -86006,9 +86344,18 @@ function buildSiteServicesScript(options) {
     out.push(`systemctl enable ${name}.service`, `systemctl restart ${name}.service`);
   }
   const cronPath = schedulerCronPath(slug, siteName);
-  if (site.scheduler) {
-    const cron = `* * * * * root cd ${current} && ${PANTRY_ENV_EVAL} && ${phpBin} artisan schedule:run >> /dev/null 2>&1
-`;
+  const scheduler2 = site.scheduler;
+  const schedulerEnabled = scheduler2 === true || typeof scheduler2 === "object" && scheduler2 !== null;
+  if (schedulerEnabled) {
+    const heartbeat = typeof scheduler2 === "object" && scheduler2 !== null ? scheduler2 : undefined;
+    let command = `cd ${current} && ${PANTRY_ENV_EVAL} && ${phpBin} artisan schedule:run >> /dev/null 2>&1`;
+    if (heartbeat?.heartbeatUrl) {
+      const method = heartbeat.heartbeatMethod || "GET";
+      const methodFlag = method === "GET" ? "" : `-X ${method} `;
+      command += ` && curl -fsS -m 10 ${methodFlag}${cronQuote(heartbeat.heartbeatUrl)} >/dev/null 2>&1`;
+    }
+    const cron = `* * * * * root ${command}
+`.replace(/%/g, "\\%");
     out.push(`cat > ${cronPath} <<'TS_CLOUD_CRON_EOF'`, cron.replace(/\n$/, ""), "TS_CLOUD_CRON_EOF", `chmod 644 ${cronPath}`);
   } else {
     out.push(`rm -f ${cronPath}`);
@@ -86076,7 +86423,9 @@ async function deploySiteRelease(driver, options, logger4 = noopLogger) {
       phpVersion,
       redirects: site.redirects,
       ssl: customCert,
-      auth: site.auth && site.auth.enabled !== false && site.auth.password ? { username: site.auth.username || "admin", password: site.auth.password, realm: site.auth.realm } : undefined
+      auth: site.auth && site.auth.enabled !== false && site.auth.password ? { username: site.auth.username || "admin", password: site.auth.password, realm: site.auth.realm } : undefined,
+      serverSnippet: resolveNginxSnippet(site.nginx, compute2?.nginxTemplates),
+      clientMaxBodySize: site.nginx?.clientMaxBodySize
     }) : [];
     const sslScript = useNginx ? buildSslScript(site) : [];
     const servicesScript = siteHasServices(site) ? buildSiteServicesScript({ slug, siteName, site, phpVersion, appBase }) : [];
@@ -86139,7 +86488,9 @@ async function deploySiteRelease(driver, options, logger4 = noopLogger) {
     appDir: `/var/www/${siteName}`,
     webDirectory: "",
     redirects: site.redirects,
-    auth: site.auth && site.auth.enabled !== false && site.auth.password ? { username: site.auth.username || "admin", password: site.auth.password, realm: site.auth.realm } : undefined
+    auth: site.auth && site.auth.enabled !== false && site.auth.password ? { username: site.auth.username || "admin", password: site.auth.password, realm: site.auth.realm } : undefined,
+    serverSnippet: resolveNginxSnippet(site.nginx, compute?.nginxTemplates),
+    clientMaxBodySize: site.nginx?.clientMaxBodySize
   }) : [];
   const staticSsl = wantsNginxStatic ? buildSslScript(site) : [];
   const remoteScript = [...baseScript, ...staticVhost, ...staticSsl];