@stacksjs/ts-cloud 0.7.81 → 0.7.83

package/dist/{chunk-5z0an6q8.js → chunk-838t87x3.js}

@@ -399,10 +399,9 @@ function buildMonitoringScript(monitoring = true) {
     "set -uo pipefail",
     `LOAD=$(cut -d' ' -f1 /proc/loadavg)`,
     "CPUS=$(nproc)",
-    `MEM_TOTAL=$(free -m | awk '/^Mem:/{print $2}')`,
-    `MEM_USED=$(free -m | awk '/^Mem:/{print $3}')`,
-    `SWAP_TOTAL=$(free -m | awk '/^Swap:/{print $2}')`,
-    `SWAP_USED=$(free -m | awk '/^Swap:/{print $3}')`,
+    `read MEM_TOTAL MEM_USED SWAP_TOTAL SWAP_USED <<EOF
+$(free -m | awk '/^Mem:/{total=$2; used=$3} /^Swap:/{print total, used, $2, $3}')
+EOF`,
     `DISK_PCT=$(df -P / | awk 'NR==2{gsub("%","",$5); print $5}')`,
     `UPTIME_SEC=$(cut -d' ' -f1 /proc/uptime | cut -d. -f1)`,
     `RX_BYTES=$(awk -F'[: ]+' 'NR>2 && $2!="lo"{rx+=$3} END{print rx+0}' /proc/net/dev)`,
@@ -1112,7 +1111,7 @@ function buildRpxConfigInternal(sites, options, appBoxes) {
   });
   const config = {
     proxies,
-    productionCerts: { certsDir },
+    productionCerts: { certsDir, certsDirServerNames: [...domains] },
     https: true,
     hostsManagement: false,
     cleanup: { hosts: false, certs: false }
@@ -1221,7 +1220,13 @@ for (const f of files) {
 }
 const config = {
   proxies,
-  productionCerts: { certsDir },
+  productionCerts: {
+    certsDir,
+    // A shared host's cert directory also contains mail and retired-site PEMs.
+    // Keep those files on disk for their owners, but do not turn them into live
+    // OpenSSL SNI contexts when no current route can select them.
+    certsDirServerNames: [...new Set(proxies.map(p => p.to).filter(Boolean))],
+  },
   https: true,
   hostsManagement: false,
   cleanup: { hosts: false, certs: false },
@@ -1390,7 +1395,10 @@ function buildRpxProvisionScript(options) {
 `), "TS_CLOUD_RPX_UNIT_EOF"),
     "systemctl daemon-reload",
     "systemctl disable --now bun-gateway.service 2>/dev/null || true",
+    "systemctl disable --now bun-gateway-renew.timer bun-gateway-renew.service 2>/dev/null || true",
+    "rm -f /etc/systemd/system/bun-gateway-renew.timer /etc/systemd/system/bun-gateway-renew.service",
     "systemctl disable --now ts-cloud-nginx.service 2>/dev/null || true",
+    `for timer in /etc/systemd/system/rpx-cert-renew-*.timer; do [ -e "$timer" ] || continue; unit="$(basename "$timer")"; tenant="\${unit#rpx-cert-renew-}"; tenant="\${tenant%.timer}"; [ -f "${RPX_SITES_DIR}/$tenant.json" ] && continue; systemctl disable --now "$unit" 2>/dev/null || true; rm -f "$timer" "/etc/systemd/system/rpx-cert-renew-$tenant.service" "${RPX_DIR}/renew-certs-$tenant.sh"; done`,
     `systemctl enable ${RPX_SERVICE_NAME}`,
     `systemctl restart ${RPX_SERVICE_NAME}`,
     ...buildCertManagementCommands(options)
@@ -5757,9 +5765,46 @@ async function deploySiteRelease(driver, options, logger = noopLogger2) {
 function shellSingleQuote(value) {
   return `'${value.replaceAll("'", "'\\''")}'`;
 }
-function buildManagementDashboardServiceReconciliationScript(slug, desiredSiteNames, serverOwner = false) {
+function buildManagementDashboardServiceReconciliationScript(slug, desiredSiteNames, serverOwner = false, desiredDomains = []) {
   const prefix = `${slug}-dashboard-`;
   const desiredUnits = desiredSiteNames.map((siteName) => `${slug}-${siteName}.service`);
+  const routeReconciliation = serverOwner ? [
+    `export TS_CLOUD_DASHBOARD_KEEP_DOMAINS=${shellSingleQuote(JSON.stringify(desiredDomains))}`,
+    "rm -f /run/ts-cloud-dashboard-routes-changed",
+    `/usr/local/bin/bun --bun -e ${shellSingleQuote(`
+          const { chmodSync, existsSync, readdirSync, readFileSync, renameSync, statSync, writeFileSync } = require('node:fs')
+          const { basename, join } = require('node:path')
+          const root = '/etc/rpx/sites.d'
+          const keep = new Set(JSON.parse(process.env.TS_CLOUD_DASHBOARD_KEEP_DOMAINS || '[]'))
+          let changed = false
+          for (const name of existsSync(root) ? readdirSync(root) : []) {
+            if (!name.endsWith('.json')) continue
+            const file = join(root, name)
+            let config
+            try { config = JSON.parse(readFileSync(file, 'utf8')) } catch { continue }
+            if (!Array.isArray(config.proxies)) continue
+            const project = basename(name, '.json')
+            const proxies = config.proxies.filter((route) => {
+              const domain = typeof route?.to === 'string' ? route.to.toLowerCase() : ''
+              if (!/^(?:dashboard|cloud)\\./.test(domain) || keep.has(domain)) return true
+              const siteName = domain.replace(/[^a-z0-9]+/g, '-').replace(/^-|-$/g, '')
+              return !existsSync('/var/www/' + project + '-' + siteName)
+            })
+            if (proxies.length === config.proxies.length) continue
+            const temporary = file + '.tmp-' + process.pid
+            const mode = statSync(file).mode & 0o777
+            writeFileSync(temporary, JSON.stringify({ ...config, proxies }, null, 2) + '\\n', { mode })
+            chmodSync(temporary, mode)
+            renameSync(temporary, file)
+            changed = true
+          }
+          if (changed) writeFileSync('/run/ts-cloud-dashboard-routes-changed', '')
+        `)}`,
+    "if [ -e /run/ts-cloud-dashboard-routes-changed ]; then",
+    "  systemctl restart rpx-gateway.service",
+    "  rm -f /run/ts-cloud-dashboard-routes-changed",
+    "fi"
+  ] : [];
   return [
     "set -euo pipefail",
     `TS_CLOUD_DASHBOARD_PREFIX=${shellSingleQuote(prefix)}`,
@@ -5784,7 +5829,8 @@ function buildManagementDashboardServiceReconciliationScript(slug, desiredSiteNa
     "  esac",
     "done",
     "systemctl daemon-reload",
-    "systemctl reset-failed"
+    "systemctl reset-failed",
+    ...routeReconciliation
   ];
 }
 async function reconcileManagementDashboardServices(driver, options, desiredSiteNames, logger) {
@@ -5796,7 +5842,7 @@ async function reconcileManagementDashboardServices(driver, options, desiredSite
     return true;
   const result = await driver.runRemoteDeploy({
     targets,
-    commands: buildManagementDashboardServiceReconciliationScript(slug, desiredSiteNames, !config.cloud?.attachTo),
+    commands: buildManagementDashboardServiceReconciliationScript(slug, desiredSiteNames, !config.cloud?.attachTo, desiredSiteNames.map((siteName) => config.sites?.[siteName]?.domain).filter((domain) => typeof domain === "string")),
     comment: `ts-cloud reconcile management dashboard ${slug}`,
     tags: {
       Project: slug,

package/dist/{chunk-ng8hbbmy.js → chunk-ptf1hhsd.js}

@@ -45,7 +45,7 @@ import {
   resolveSiteKind,
   resolveUiSource,
   siteInstallBase
-} from "./chunk-5z0an6q8.js";
+} from "./chunk-838t87x3.js";
 import {
   artifactKey,
   buildCloudFormationTemplate,
@@ -38547,28 +38547,34 @@ for (const route of routes) console.log('DISCOVERED_SITE=' + Buffer.from(JSON.st
 const serviceOutput = Bun.spawnSync([
   'systemctl', 'list-units', '--type=service', '--state=running', '--no-legend', '--plain',
 ]).stdout.toString()
-for (const line of serviceOutput.split('\n')) {
-  const unit = line.trim().split(/\s+/)[0]
-  if (!unit) continue
-  const properties = Bun.spawnSync([
+const runningUnits = serviceOutput
+  .split('\n')
+  .map(line => line.trim().split(/\s+/)[0])
+  .filter(Boolean)
+if (runningUnits.length > 0) {
+  const propertiesOutput = Bun.spawnSync([
     'systemctl',
     'show',
-    unit,
-    '--property=WorkingDirectory,ExecStart,MemoryCurrent,UnitFileState,ActiveEnterTimestamp',
+    ...runningUnits,
+    '--property=Id,WorkingDirectory,ExecStart,MemoryCurrent,UnitFileState,ActiveEnterTimestamp',
   ]).stdout.toString()
-  const values = Object.fromEntries(properties.split('\n').filter(Boolean).map(value => {
-    const separator = value.indexOf('=')
-    return separator < 0 ? [value, ''] : [value.slice(0, separator), value.slice(separator + 1)]
-  }))
-  if (!/^\/var\/www\/|^\/opt\/ts-cloud\//.test(values.WorkingDirectory || '') && !/\/var\/www\/|\/opt\/ts-cloud\//.test(values.ExecStart || '')) continue
-  console.log([
-    'SVC',
-    unit,
-    'active',
-    values.MemoryCurrent || '0',
-    values.UnitFileState || '-',
-    values.ActiveEnterTimestamp || '-',
-  ].join('='))
+  for (const properties of propertiesOutput.split(/\n\n+/)) {
+    const values = Object.fromEntries(properties.split('\n').filter(Boolean).map(value => {
+      const separator = value.indexOf('=')
+      return separator < 0 ? [value, ''] : [value.slice(0, separator), value.slice(separator + 1)]
+    }))
+    const unit = values.Id
+    if (!unit) continue
+    if (!/^\/var\/www\/|^\/opt\/ts-cloud\//.test(values.WorkingDirectory || '') && !/\/var\/www\/|\/opt\/ts-cloud\//.test(values.ExecStart || '')) continue
+    console.log([
+      'SVC',
+      unit,
+      'active',
+      values.MemoryCurrent || '0',
+      values.UnitFileState || '-',
+      values.ActiveEnterTimestamp || '-',
+    ].join('='))
+  }
 }
 `;
   return `echo '${Buffer.from(source).toString("base64")}' | base64 -d | bun -`;
@@ -38588,15 +38594,21 @@ EOF`,
     `echo "LOAD=$(cut -d' ' -f1 /proc/loadavg 2>/dev/null || echo 0)"`,
     `echo "LOAD5=$(cut -d' ' -f2 /proc/loadavg 2>/dev/null || echo 0)"`,
     `echo "LOAD15=$(cut -d' ' -f3 /proc/loadavg 2>/dev/null || echo 0)"`,
-    `echo "MEMTOTAL=$(free -m 2>/dev/null | awk '/^Mem:/{print $2}')"`,
-    `echo "MEMUSED=$(free -m 2>/dev/null | awk '/^Mem:/{print $3}')"`,
-    `echo "MEMAVAILABLE=$(free -m 2>/dev/null | awk '/^Mem:/{print $7}')"`,
-    `echo "MEMCACHE=$(free -m 2>/dev/null | awk '/^Mem:/{print $6}')"`,
-    `echo "SWAPTOTAL=$(free -m 2>/dev/null | awk '/^Swap:/{print $2}')"`,
-    `echo "SWAPUSED=$(free -m 2>/dev/null | awk '/^Swap:/{print $3}')"`,
-    `echo "DISKPCT=$(df -P / 2>/dev/null | awk 'NR==2{gsub("%","",$5);print $5}')"`,
-    `echo "DISKUSEDG=$(df -BG / 2>/dev/null | awk 'NR==2{gsub("G","",$3);print $3}')"`,
-    `echo "DISKTOTG=$(df -BG / 2>/dev/null | awk 'NR==2{gsub("G","",$2);print $2}')"`,
+    `read MEMTOTAL MEMUSED MEMAVAILABLE MEMCACHE SWAPTOTAL SWAPUSED <<EOF
+$(free -m 2>/dev/null | awk '/^Mem:/{total=$2; used=$3; available=$7; cache=$6} /^Swap:/{print total, used, available, cache, $2, $3}')
+EOF`,
+    'echo "MEMTOTAL=${MEMTOTAL:-0}"',
+    'echo "MEMUSED=${MEMUSED:-0}"',
+    'echo "MEMAVAILABLE=${MEMAVAILABLE:-0}"',
+    'echo "MEMCACHE=${MEMCACHE:-0}"',
+    'echo "SWAPTOTAL=${SWAPTOTAL:-0}"',
+    'echo "SWAPUSED=${SWAPUSED:-0}"',
+    `read DISKTOTG DISKUSEDG DISKPCT <<EOF
+$(df -BG -P / 2>/dev/null | awk 'NR==2{gsub("G","",$2); gsub("G","",$3); gsub("%","",$5); print $2, $3, $5}')
+EOF`,
+    'echo "DISKPCT=${DISKPCT:-0}"',
+    'echo "DISKUSEDG=${DISKUSEDG:-0}"',
+    'echo "DISKTOTG=${DISKTOTG:-0}"',
     `echo "INODEPCT=$(df -Pi / 2>/dev/null | awk 'NR==2{gsub("%","",$5);print $5}')"`,
     `echo "NETRX=$(awk -F'[: ]+' 'NR>2 && $2!="lo"{sum+=$3} END{print sum+0}' /proc/net/dev 2>/dev/null)"`,
     `echo "NETTX=$(awk -F'[: ]+' 'NR>2 && $2!="lo"{sum+=$11} END{print sum+0}' /proc/net/dev 2>/dev/null)"`,

package/dist/deploy/index.js

@@ -32,7 +32,7 @@ import {
   synchronizeDashboardUsers,
   trackDashboardOperation,
   verifyStaticApiOrigin
-} from "../chunk-ng8hbbmy.js";
+} from "../chunk-ptf1hhsd.js";
 import {
   deleteStaticSite,
   deployStaticSite,
@@ -65,7 +65,7 @@ import {
   shipsARelease,
   siteInstallBase,
   validateDeploymentConfig
-} from "../chunk-5z0an6q8.js";
+} from "../chunk-838t87x3.js";
 import"../chunk-1qjyqrc5.js";
 import"../chunk-703nkybg.js";
 import"../chunk-4cjrg98a.js";

package/dist/drivers/index.js

@@ -68,7 +68,7 @@ import {
   waitForSsh,
   wrapCloudInitUserData,
   writeResizeCheckpoint
-} from "../chunk-5z0an6q8.js";
+} from "../chunk-838t87x3.js";
 import"../chunk-1qjyqrc5.js";
 import"../chunk-703nkybg.js";
 import"../chunk-4cjrg98a.js";

package/dist/drivers/shared/compute-deploy.d.ts

@@ -42,7 +42,7 @@ export interface DeployAllSitesOptions {
  * and can keep crash-looping on its old port. Release data and shared dashboard
  * state stay on disk for recovery.
  */
-export declare function buildManagementDashboardServiceReconciliationScript(slug: string, desiredSiteNames: string[], serverOwner?: boolean): string[];
+export declare function buildManagementDashboardServiceReconciliationScript(slug: string, desiredSiteNames: string[], serverOwner?: boolean, desiredDomains?: string[]): string[];
 /**
  * Deploy every site that targets the compute server — both dynamic apps
  * (`server` + `start`, run as systemd services) and static sites (`server`

package/dist/drivers/shared/rpx-gateway.d.ts

@@ -108,6 +108,7 @@ export interface RpxGatewayConfig {
      */
     productionCerts: {
         certsDir: string;
+        certsDirServerNames?: string[];
     };
     /**
      * On-demand TLS (opt-in): lazily issue a real cert for an approved host the

package/dist/index.js

@@ -285,7 +285,7 @@ import {
   volumeCapabilities,
   webhookEndpoint,
   zeroCapacity
-} from "./chunk-ng8hbbmy.js";
+} from "./chunk-ptf1hhsd.js";
 import {
   deleteStaticSite,
   deployStaticSite,
@@ -398,7 +398,7 @@ import {
   waitForCloudInit,
   waitForSsh,
   wrapCloudInitUserData
-} from "./chunk-5z0an6q8.js";
+} from "./chunk-838t87x3.js";
 import {
   ABTestManager,
   AI,