@stacksjs/ts-cloud 0.6.2 → 0.7.2

package/dist/drivers/hetzner/driver.d.ts

@@ -48,6 +48,29 @@ export declare class HetznerDriver implements CloudDriver {
      * over the private network (wired into their `.env` at deploy time).
      */
     private provisionFleet;
+    /**
+     * Provision a load-balanced **bun/node/deno** fleet: a private network, N
+     * app servers running the runtime directly (no local rpx gateway — the LB
+     * box reaches them over the private network), and ONE dedicated box running
+     * only the rpx gateway in load-balancing mode, fronting every `server-app`
+     * site's port across all app boxes (rpx v0.11.24+ multi-upstream routes with
+     * health-check failover — see {@link buildRpxLbConfig}).
+     *
+     * Mirrors {@link provisionFleet}'s idempotency/reconciliation/teardown
+     * patterns (reuse-by-label, create only the delta, destroy extras on
+     * scale-down), but fronts the app boxes with rpx instead of Hetzner's native
+     * Load Balancer product — this is the bun/rpx analogue of that PHP path.
+     *
+     * Edge case: a bun app that sets `compute.servicesServer` explicitly (wants
+     * a dedicated DB/cache box) but only ever runs one app server still lands
+     * here (see the `topology.dedicatedServices` dispatch condition) — in that
+     * case we still provision the dedicated services box (provider/runtime
+     * -agnostic infra, reusing the same PHP-fleet services-box mechanism is
+     * unnecessary since bun app servers need no PHP/nginx either way) but only
+     * stand up the rpx LB box when `topology.loadBalancer` is actually true
+     * (i.e. more than one app server, or `compute.server?.loadBalancer`).
+     */
+    private provisionBunFleet;
     /**
      * Tear down the compute — single server or full fleet (load balancer, all
      * app + services servers, firewalls, and the private network) — and clear

package/dist/drivers/hetzner/state.d.ts

@@ -13,6 +13,14 @@ export interface HetznerDriverState {
     loadBalancerId?: number;
     servicesServerId?: number;
     servicesPrivateIp?: string;
+    /**
+     * Bun+rpx fleet (see `HetznerDriver`'s bun-fleet path): the dedicated rpx
+     * load-balancer box (role `lb`) and the N app boxes (role `app`) it fronts.
+     * Distinct from {@link loadBalancerId} (a Hetzner-native Load Balancer
+     * resource, used by the PHP fleet path) — this is a real server running rpx.
+     */
+    lbServerId?: number;
+    appServerIds?: number[];
 }
 export declare function driverStatePath(stackName: string): string;
 export declare function readDriverState(stackName: string): Promise<HetznerDriverState | null>;

package/dist/drivers/shared/rpx-gateway.d.ts

@@ -17,7 +17,7 @@
  * It replaces the old Caddyfile generation — pantry/stacks use rpx (their own
  * tooling), so the gateway is rpx, not Caddy.
  */
-import type { ComputeProxyConfig, SiteConfig, SiteRedirectConfig } from '@ts-cloud/core';
+import type { ComputeProxyConfig, RpxLoadBalancerConfig, SiteConfig, SiteRedirectConfig } from '@ts-cloud/core';
 /** Default directory on the box that holds real per-domain TLS certs. */
 export declare const DEFAULT_RPX_CERTS_DIR = "/etc/rpx/certs";
 /** Default webroot the gateway serves ACME http-01 challenges from on `:80`. */
@@ -40,8 +40,14 @@ export interface RpxRoute {
     to: string;
     /** Path prefix within the host this route owns (e.g. `/api`). Omitted = `/`. */
     path?: string;
-    /** Upstream `host:port` for a `server-app` route. */
-    from?: string;
+    /**
+     * Upstream(s) for a `server-app` route: a single `host:port` for a co-located
+     * (single-box) deploy, or an array of `host:port` — one per app box — when the
+     * route is fronted by a dedicated load-balancer box (see
+     * {@link buildRpxLbConfig}). rpx turns an array into a real load-balanced pool
+     * with automatic health-check failover (see rpx's `ProxyFrom`/`UpstreamTarget`).
+     */
+    from?: string | string[];
     /** Absolute directory served for a `server-static` route (`/var/www/<name>`). */
     static?: string;
     /**
@@ -65,6 +71,12 @@ export interface RpxRoute {
         password: string;
         realm?: string;
     };
+    /**
+     * Load-balancing strategy/health-check tuning for a multi-upstream `from`
+     * (see {@link ComputeProxyConfig.loadBalancer}). Only meaningful when `from`
+     * is an array — rpx ignores it for a single-upstream route.
+     */
+    loadBalancer?: RpxLoadBalancerConfig;
     /** Stable id used when rpx registers the route. Derived from `to`+`path`. */
     id: string;
 }
@@ -143,8 +155,32 @@ export declare function deriveRouteId(to: string, path?: string): string;
  * Routes are grouped by domain so rpx's path-based routing can serve an app +
  * several static dirs under one host. Bucket sites and sites without a `domain`
  * (or a `server-app` without a `port`) are skipped.
+ *
+ * This is the single-box path: every `server-app` route always resolves to
+ * `localhost:<port>` — unchanged, byte-for-byte, from before load-balanced
+ * fleets existed. Use {@link buildRpxLbConfig} for a dedicated LB box fronting
+ * more than one app box.
  */
 export declare function buildRpxConfig(sites: Record<string, SiteConfig | undefined>, options: BuildRpxConfigOptions): RpxGatewayConfig;
+/** An app box's addresses, as known to the LB box building routes to it. */
+export interface RpxLbAppBox {
+    /** Private IP of the app box, reachable from the LB over the fleet's private network. Preferred. */
+    privateIp?: string;
+    /** Public IP of the app box — used only when no private IP is available. */
+    publicIp?: string;
+}
+/**
+ * Build the rpx gateway config for a **dedicated load-balancer box**: like
+ * {@link buildRpxConfig}, but every `server-app` route's `from` is an array of
+ * `host:port` — one per entry in `appBoxes` (private IP preferred, public IP as
+ * fallback) — instead of `localhost:<port>`. rpx turns that array into a real
+ * load-balanced pool with health-check failover (see rpx's `ProxyFrom`).
+ *
+ * `server-static`/`redirect` routes are unaffected (the LB box doesn't serve
+ * static files or own redirects itself in the primary bun-fleet flow — those
+ * kinds simply pass through unchanged if present in `sites`).
+ */
+export declare function buildRpxLbConfig(sites: Record<string, SiteConfig | undefined>, appBoxes: RpxLbAppBox[], options: BuildRpxConfigOptions): RpxGatewayConfig;
 /**
  * Render the rpx gateway config as a self-contained launcher TS module. The
  * systemd unit runs `bun <file>`, which imports `startProxies` from the

package/dist/index.js

@@ -85584,6 +85584,17 @@ ${servicesProvision.join(`
 # breaking a from-scratch provision (adopting an existing box masked it).
 export HOME="\${HOME:-/root}"
 export BUN_INSTALL="/root/.bun"
+# bun.sh's installer references $HOME internally and runs under this
+# script's \`set -u\` (inherited by the piped bash) — cloud-init's runcmd
+# environment doesn't export HOME by default, so without this the
+# installer dies with "HOME: unbound variable" partway through (after
+# the binary is already downloaded, so it looks like a partial success)
+# and \`set -e\` aborts everything after it: the bun symlink, /var/www +
+# /var/ts-cloud dirs, and the whole rpx gateway install/systemd setup
+# never run. Confirmed against a real Hetzner box (stacksjs/status#1
+# Phase 9 e2e deploy) — cloud-init reported success with none of that
+# actually done.
+export HOME="\${HOME:-/root}"
 curl -fsSL https://bun.sh/install | bash${runtimeVersion === "latest" ? "" : ` -s "bun-v${runtimeVersion}"`}
 ln -sf /root/.bun/bin/bun /usr/local/bin/bun
 echo 'export BUN_INSTALL="/root/.bun"' > /etc/profile.d/bun.sh
@@ -86230,9 +86241,15 @@ function deriveRouteId(to, path) {
   const cleaned = base.replace(/[^a-zA-Z0-9._-]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 128);
   return cleaned.length > 0 ? cleaned : "rpx";
 }
-function buildRpxConfig(sites, options) {
+function resolveServerAppFrom(port, appBoxes) {
+  if (!appBoxes || appBoxes.length === 0)
+    return `localhost:${port}`;
+  return appBoxes.map((box2) => `${box2.privateIp ?? box2.publicIp}:${port}`);
+}
+function buildRpxConfigInternal(sites, options, appBoxes) {
   const wwwRoot = (options.wwwRoot ?? "/var/www").replace(/\/+$/, "");
   const certsDir = options.proxy.certsDir ?? DEFAULT_RPX_CERTS_DIR;
+  const loadBalancer = options.proxy.loadBalancer;
   const proxies = [];
   const domains = new Set;
   for (const [name, site] of Object.entries(sites)) {
@@ -86252,7 +86269,15 @@ function buildRpxConfig(sites, options) {
     if (kind === "server-app") {
       if (typeof site.port !== "number")
         continue;
-      proxies.push({ to: site.domain, path, from: `localhost:${site.port}`, id, ...auth ? { auth } : {} });
+      const from = resolveServerAppFrom(site.port, appBoxes);
+      proxies.push({
+        to: site.domain,
+        path,
+        from,
+        id,
+        ...auth ? { auth } : {},
+        ...Array.isArray(from) && loadBalancer ? { loadBalancer } : {}
+      });
     } else {
       proxies.push({
         to: site.domain,
@@ -86299,6 +86324,12 @@ function buildRpxConfig(sites, options) {
   }
   return config6;
 }
+function buildRpxConfig(sites, options) {
+  return buildRpxConfigInternal(sites, options);
+}
+function buildRpxLbConfig(sites, appBoxes, options) {
+  return buildRpxConfigInternal(sites, options, appBoxes);
+}
 var RPX_DIR = "/etc/rpx";
 var RPX_INSTALL_DIR = "/opt/rpx-gateway";
 var RPX_LAUNCHER_PATH = "/etc/rpx/gateway.ts";
@@ -86637,9 +86668,11 @@ class HetznerDriver {
     }
     const stackName = resolveProjectStackName(config6, environment);
     const serverName = `${slug}-${environment}-app`;
+    const phpBox = compute.runtime === "php" || !!compute.php;
     const topology = resolveFleetTopology(compute);
-    if (topology.dedicatedServices || topology.appServers > 1)
-      return this.provisionFleet(options, topology);
+    if (topology.dedicatedServices || topology.appServers > 1) {
+      return phpBox ? this.provisionFleet(options, topology) : this.provisionBunFleet(options, topology);
+    }
     const existing = await readDriverState(stackName);
     if (existing?.serverId) {
       const server2 = await this.tryGetServer(existing.serverId);
@@ -86876,6 +86909,202 @@ class HetznerDriver {
       sshUser: this.sshUser
     };
   }
+  async provisionBunFleet(options, topology) {
+    const { config: config6, environment } = options;
+    const slug = config6.project.slug;
+    const compute = config6.infrastructure.compute;
+    const stackName = resolveProjectStackName(config6, environment);
+    const serverType = resolveHetznerServerType(compute.size);
+    const image = compute.image || config6.hetzner?.image || "ubuntu-24.04";
+    const location = config6.hetzner?.location || this.location;
+    const baked = compute.bakedImage === true;
+    const sites = config6.sites || {};
+    const existingState = await readDriverState(stackName);
+    if (existingState?.lbServerId) {
+      const lb = await this.tryGetServer(existingState.lbServerId);
+      if (lb && lb.status !== "off") {
+        return {
+          appPublicIp: lb.public_net.ipv4?.ip ?? existingState.publicIp,
+          loadBalancerIp: lb.public_net.ipv4?.ip ?? existingState.publicIp,
+          servicesPrivateIp: existingState.servicesPrivateIp,
+          deployStoragePath: "/var/ts-cloud/staging",
+          sshUser: this.sshUser
+        };
+      }
+    }
+    const sshKeyId = await this.ensureSshKey(slug, environment, tsCloudLabels(slug, environment, "app"));
+    const netName = `${slug}-${environment}-net`;
+    const networks = await this.client.listNetworks().catch(() => []);
+    const network = networks.find((n) => n.name === netName) ?? await this.client.createNetwork({ name: netName, labels: tsCloudLabels(slug, environment, "app") });
+    const sitePorts = this.collectUpstreamPorts(sites);
+    const { firewall: appFw } = await this.ensureFirewall(`${slug}-${environment}-app-fw`, tsCloudLabels(slug, environment, "app"), [
+      { direction: "in", protocol: "tcp", port: "22", source_ips: ["0.0.0.0/0", "::/0"] },
+      ...sitePorts.map((port) => ({
+        direction: "in",
+        protocol: "tcp",
+        port: String(port),
+        source_ips: [network.ip_range],
+        description: `ts-cloud port ${port} (private, LB-only)`
+      }))
+    ]);
+    const { firewall: lbFw } = await this.ensureFirewall(`${slug}-${environment}-lb-fw`, tsCloudLabels(slug, environment, "lb"), buildHetznerFirewallRules({ allowSsh: true, sitePorts: [] }));
+    const all = await this.client.listServers().catch(() => []);
+    const newServerIds = [];
+    let servicesServerId;
+    let servicesPrivateIp;
+    if (topology.dedicatedServices) {
+      const { firewall: svcFw } = await this.ensureFirewall(`${slug}-${environment}-services-fw`, tsCloudLabels(slug, environment, "services"), [
+        { direction: "in", protocol: "tcp", port: "22", source_ips: ["0.0.0.0/0", "::/0"] },
+        { direction: "in", protocol: "tcp", port: "3306", source_ips: [network.ip_range] },
+        { direction: "in", protocol: "tcp", port: "5432", source_ips: [network.ip_range] },
+        { direction: "in", protocol: "tcp", port: "6379", source_ips: [network.ip_range] },
+        { direction: "in", protocol: "tcp", port: "7700", source_ips: [network.ip_range] }
+      ]);
+      const servicesProvision = [
+        ...buildServicesProvisionScript(compute.managedServices ?? { mysql: true, redis: true }, { bindPrivate: true }),
+        ...buildDatabaseSetupScript(config6.infrastructure?.appDatabase, compute.managedServices ?? { mysql: true }),
+        ...buildAutoUpdatesScript(true),
+        ...buildMonitoringScript(true),
+        ...buildAuthorizedKeysScript(compute.sshKeys)
+      ];
+      const servicesUserData = wrapCloudInitUserData(buildUbuntuBootstrapScript({ runtime: "bun", servicesProvision, baked }));
+      let svcServer = all.find((s) => matchesTsCloudLabels(s.labels, slug, environment, "services"));
+      if (!svcServer) {
+        const { server, action } = await this.client.createServer({
+          name: `${slug}-${environment}-services`,
+          serverType: resolveHetznerServerType(typeof compute.servicesServer === "object" ? compute.servicesServer.size : compute.size),
+          image,
+          location,
+          userData: servicesUserData,
+          labels: tsCloudLabels(slug, environment, "services"),
+          sshKeys: sshKeyId ? [sshKeyId] : undefined,
+          firewalls: [{ firewall: svcFw.id }],
+          networks: [network.id]
+        });
+        await this.client.waitForAction(action.id);
+        svcServer = await this.client.waitForServerRunning(server.id);
+        newServerIds.push(server.id);
+      }
+      servicesServerId = svcServer.id;
+      servicesPrivateIp = svcServer.private_net?.[0]?.ip ?? (await this.client.getServer(servicesServerId)).private_net?.[0]?.ip;
+    }
+    const appProvisionScripts = buildComputeProvisionScripts(config6);
+    const appUserData = wrapCloudInitUserData(buildUbuntuBootstrapScript({
+      runtime: appProvisionScripts.runtime,
+      runtimeVersion: appProvisionScripts.runtimeVersion,
+      systemPackages: compute.systemPackages,
+      database: config6.infrastructure?.database,
+      servicesProvision: appProvisionScripts.servicesProvision,
+      baked
+    }));
+    const existingApp = all.filter((s) => matchesTsCloudLabels(s.labels, slug, environment, "app"));
+    const appServerIds = existingApp.map((s) => s.id);
+    if (existingApp.length > topology.appServers) {
+      for (const extra of existingApp.slice(topology.appServers)) {
+        await this.client.deleteServer(extra.id).catch(() => {});
+        appServerIds.splice(appServerIds.indexOf(extra.id), 1);
+      }
+    }
+    for (let i = existingApp.length;i < topology.appServers; i++) {
+      const { server, action } = await this.client.createServer({
+        name: `${slug}-${environment}-app-${i + 1}`,
+        serverType,
+        image,
+        location,
+        userData: appUserData,
+        labels: tsCloudLabels(slug, environment, "app"),
+        sshKeys: sshKeyId ? [sshKeyId] : undefined,
+        firewalls: [{ firewall: appFw.id }],
+        networks: [network.id]
+      });
+      await this.client.waitForAction(action.id);
+      appServerIds.push(server.id);
+      newServerIds.push(server.id);
+    }
+    if (this.waitForBoot && newServerIds.length > 0) {
+      await Promise.all(newServerIds.map(async (id) => {
+        const running = await this.client.waitForServerRunning(id);
+        const ip = running.public_net.ipv4?.ip;
+        if (ip) {
+          await this.waitForSshReady(ip);
+          await this.waitForCloudInit(ip);
+        }
+      }));
+    }
+    const appBoxes = [];
+    for (const id of appServerIds) {
+      let server = all.find((s) => s.id === id);
+      if (!server || !server.private_net?.[0]?.ip)
+        server = await this.client.getServer(id).catch(() => server);
+      appBoxes.push({ privateIp: server?.private_net?.[0]?.ip, publicIp: server?.public_net.ipv4?.ip });
+    }
+    const lbName = `${slug}-${environment}-lb`;
+    let lbId;
+    let lbIp;
+    if (topology.loadBalancer) {
+      let lbServer = all.find((s) => matchesTsCloudLabels(s.labels, slug, environment, "lb"));
+      if (!lbServer) {
+        const rpxProxy = compute.proxy?.engine === "rpx" ? compute.proxy : { engine: "rpx" };
+        const lbRpxProvision = buildRpxProvisionScript({
+          proxy: rpxProxy,
+          config: buildRpxLbConfig(sites, appBoxes, { proxy: rpxProxy }),
+          slug,
+          bunBin: appProvisionScripts.runtime === "node" || appProvisionScripts.runtime === "deno" ? undefined : "/usr/local/bin/bun"
+        });
+        const lbUserData = wrapCloudInitUserData(buildUbuntuBootstrapScript({
+          runtime: "bun",
+          rpxProvision: lbRpxProvision,
+          baked: false
+        }));
+        const lbSize = typeof compute.loadBalancer === "object" ? compute.loadBalancer.size : undefined;
+        const { server, action } = await this.client.createServer({
+          name: lbName,
+          serverType: resolveHetznerServerType(lbSize ?? "micro"),
+          image,
+          location,
+          userData: lbUserData,
+          labels: tsCloudLabels(slug, environment, "lb"),
+          sshKeys: sshKeyId ? [sshKeyId] : undefined,
+          firewalls: [{ firewall: lbFw.id }],
+          networks: [network.id]
+        });
+        await this.client.waitForAction(action.id);
+        lbServer = await this.client.waitForServerRunning(server.id);
+        if (this.waitForBoot) {
+          const ip = lbServer.public_net.ipv4?.ip;
+          if (ip) {
+            await this.waitForSshReady(ip);
+            await this.waitForCloudInit(ip);
+          }
+        }
+      }
+      lbId = lbServer.id;
+      lbIp = lbServer.public_net.ipv4?.ip;
+    }
+    const appPublicIp = lbIp ?? (await this.client.getServer(appServerIds[0]).catch(() => {
+      return;
+    }))?.public_net.ipv4?.ip;
+    const state = {
+      provider: "hetzner",
+      stackName,
+      networkId: network.id,
+      lbServerId: lbId,
+      appServerIds,
+      servicesServerId,
+      servicesPrivateIp,
+      publicIp: appPublicIp,
+      deployStoragePath: "/var/ts-cloud/staging",
+      sshUser: this.sshUser
+    };
+    await writeDriverState(stackName, state);
+    return {
+      appPublicIp,
+      loadBalancerIp: lbIp,
+      servicesPrivateIp,
+      deployStoragePath: "/var/ts-cloud/staging",
+      sshUser: this.sshUser
+    };
+  }
   async destroyCompute(options) {
     const { config: config6, environment } = options;
     const slug = config6.project.slug;
@@ -86894,13 +87123,17 @@ class HetznerDriver {
     const allServers = await this.client.listServers().catch(() => []);
     const serverIds = new Set;
     for (const s of allServers) {
-      if (matchesTsCloudLabels(s.labels, slug, environment, "app") || matchesTsCloudLabels(s.labels, slug, environment, "services"))
+      if (matchesTsCloudLabels(s.labels, slug, environment, "app") || matchesTsCloudLabels(s.labels, slug, environment, "services") || matchesTsCloudLabels(s.labels, slug, environment, "lb"))
         serverIds.add(s.id);
     }
     if (state?.serverId)
       serverIds.add(state.serverId);
     if (state?.servicesServerId)
       serverIds.add(state.servicesServerId);
+    if (state?.lbServerId)
+      serverIds.add(state.lbServerId);
+    for (const id of state?.appServerIds ?? [])
+      serverIds.add(id);
     for (const id of serverIds) {
       try {
         await this.client.deleteServer(id);
@@ -86908,7 +87141,7 @@ class HetznerDriver {
       } catch {}
     }
     const firewalls = await this.client.listFirewalls().catch(() => []);
-    for (const name of [`${slug}-${environment}-app-fw`, `${slug}-${environment}-services-fw`]) {
+    for (const name of [`${slug}-${environment}-app-fw`, `${slug}-${environment}-services-fw`, `${slug}-${environment}-lb-fw`]) {
       const fw = firewalls.find((f) => f.name === name);
       if (!fw)
         continue;
@@ -86946,6 +87179,15 @@ class HetznerDriver {
       const server = await this.client.getServer(state.serverId);
       return this.outputsFromState(state, server);
     }
+    if (state?.lbServerId) {
+      const lb = await this.tryGetServer(state.lbServerId);
+      const lbIp = lb?.public_net.ipv4?.ip ?? state.publicIp;
+      return {
+        ...this.outputsFromState(state),
+        appPublicIp: lbIp,
+        loadBalancerIp: lbIp
+      };
+    }
     if (state?.loadBalancerId || state?.servicesPrivateIp) {
       return this.outputsFromState(state);
     }
@@ -86971,7 +87213,8 @@ class HetznerDriver {
     if (targets.length === 0) {
       throw new Error("No Hetzner compute targets found for release upload");
     }
-    const remotePath = `/var/ts-cloud/staging/${options.remoteKey.split("/").pop()}`;
+    const stagingName = options.remoteKey.replace(/^releases\//, "").replace(/\//g, "-");
+    const remotePath = `/var/ts-cloud/staging/${stagingName}`;
     for (const target of targets) {
       if (!target.publicIp) {
         throw new Error(`Target ${target.id} has no public IP for SCP upload`);