@studiometa/trafic-agent 0.1.45 → 0.1.47

package/dist/setup/migrations/0016__wildcard_dns_challenge.d.ts

@@ -0,0 +1,63 @@
+import { type SetupIo } from "../io.js";
+import type { Migration } from "../types.js";
+import type { TlsConfig } from "../../types.js";
+/**
+ * Migration 0016: apply the wildcard DNS-01 certificate on servers that ask
+ * for one in their config.
+ *
+ * `tls.dns_provider` is read by `configureTraefik`, which setup runs on a
+ * fresh server. An existing server has the config but none of the files, so
+ * this writes them: the resolver in `static_config.trafic.yaml`, the default
+ * TLS store in `custom-global-config/0-trafic-tls.yaml`, and the provider
+ * credentials in `router-compose.trafic.yaml`.
+ *
+ * Why the router is removed and a project started, rather than restarted
+ * (the 0010 rationale, plus one more): Traefik reads its configuration from
+ * the ddev-global-cache volume, and DDEV only copies `~/.ddev/traefik` into
+ * that volume and merges `static_config.*.yaml` into `.static_config.yaml`
+ * when a project starts. And DDEV 1.25 reads `router-compose.*.yaml` only
+ * when it *recreates* the router: a running, healthy router just gets the
+ * Traefik config pushed (StartDdevRouter, `needsRecreation`). Seen on a live
+ * server — the static config was merged, the credentials never reached the
+ * container. Removing the router first forces the recreation; `ddev start`
+ * brings it back within seconds with the new environment.
+ *
+ * The container is found by its compose label, not by name: when compose
+ * recreates a container it renames the old one `<id>_ddev-router`, and a
+ * failed recreation can leave it that way. `docker restart ddev-router` then
+ * silently does nothing — also seen on that server.
+ *
+ * Two details this depends on:
+ * - Traefik's file provider keeps the FIRST `tls.stores.default` it reads in
+ *   directory order and logs "TLS store default already configured,
+ *   skipping" for the rest. DDEV writes an empty one in
+ *   `default_config.yaml`, so the agent's file is named `0-trafic-tls.yaml`
+ *   to sort ahead of it.
+ * - DDEV keeps `certResolver: acme-tlsChallenge` on every project router, and
+ *   that is fine: Traefik skips a per-host ACME request once the default
+ *   store already holds a certificate matching the host with wildcard
+ *   semantics. So `use_letsencrypt` stays true — the ACME account email comes
+ *   from it — and the per-host quota use stops on its own.
+ *
+ * `ddev poweroff` is deliberately not used: the server runs live previews and
+ * a project start is enough to regenerate the config and recreate the router.
+ *
+ * Idempotent: skipped when no DNS provider is configured, and when all three
+ * files are already in place.
+ */
+export declare const migration0016WildcardDnsChallenge: Migration;
+/**
+ * The migration body, with its effects injected so tests can drive it.
+ *
+ * `tls` defaults to the server's own config: the migration runs after setup
+ * wrote /etc/trafic/config.toml, so that file is the only source.
+ */
+export declare function runWildcardMigration(io?: SetupIo, tls?: TlsConfig): void;
+/**
+ * The ddev-router container id, whatever its current name.
+ *
+ * Compose labels survive the `<id>_ddev-router` rename a recreation leaves
+ * behind; the container name does not.
+ */
+export declare function findRouterContainer(io?: SetupIo): string | undefined;
+//# sourceMappingURL=0016__wildcard_dns_challenge.d.ts.map

package/dist/setup/migrations/0016__wildcard_dns_challenge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"0016__wildcard_dns_challenge.d.ts","sourceRoot":"","sources":["../../../src/setup/migrations/0016__wildcard_dns_challenge.ts"],"names":[],"mappings":"AASA,OAAO,EAAU,KAAK,OAAO,EAAE,MAAM,UAAU,CAAC;AAEhD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEhD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,eAAO,MAAM,iCAAiC,EAAE,SAO/C,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,EAAE,GAAE,OAAgB,EACpB,GAAG,GAAE,SAA4B,GAChC,IAAI,CAuCN;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,EAAE,GAAE,OAAgB,GAAG,MAAM,GAAG,SAAS,CAM5E"}

package/dist/setup/migrations/0018__docker_address_pools.d.ts

@@ -0,0 +1,29 @@
+import { type SetupIo } from "../io.js";
+import type { Migration } from "../types.js";
+/**
+ * Migration 0018: give Docker enough address space for one network per
+ * project.
+ *
+ * `setup` wrote a daemon.json without `default-address-pools`, so Docker
+ * used its built-in pools: about 31 networks. Each DDEV project creates its
+ * own `ddev-<name>_default` network, and a server with ~30 projects failed
+ * to start the next one with "all predefined address pools have been fully
+ * subnetted". The last 16 of those built-in networks are in 192.168.x,
+ * outside the 172.16.0.0/12 range the firewall allows to reach the agent.
+ *
+ * `configureDocker` now writes /24 pools in 172.16.0.0/12, which covers
+ * fresh installs. This migration adds them to existing servers.
+ *
+ * Docker reads the pools only at start, so the daemon is restarted.
+ * `live-restore`, set by setup, keeps the running containers up. Existing
+ * networks keep their subnets; only new networks get a /24, and Docker skips
+ * subnets an existing network already uses.
+ *
+ * Idempotent: does nothing when the config already sets pools.
+ */
+export declare const migration0018DockerAddressPools: Migration;
+/**
+ * The migration body, with its effects injected so tests can drive it.
+ */
+export declare function runDockerAddressPoolsMigration(io?: SetupIo): void;
+//# sourceMappingURL=0018__docker_address_pools.d.ts.map

package/dist/setup/migrations/0018__docker_address_pools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"0018__docker_address_pools.d.ts","sourceRoot":"","sources":["../../../src/setup/migrations/0018__docker_address_pools.ts"],"names":[],"mappings":"AACA,OAAO,EAAU,KAAK,OAAO,EAAE,MAAM,UAAU,CAAC;AAChD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE7C;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,+BAA+B,EAAE,SAO7C,CAAC;AAEF;;GAEG;AACH,wBAAgB,8BAA8B,CAAC,EAAE,GAAE,OAAgB,GAAG,IAAI,CAIzE"}

package/dist/setup/migrations/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/setup/migrations/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAgBjF,iDAAiD;AACjD,eAAO,MAAM,qBAAqB,iCAAiC,CAAC;AAEpE,+CAA+C;AAC/C,eAAO,MAAM,cAAc,EAAE,SAAS,EAerC,CAAC;AAMF;;;GAGG;AACH,wBAAgB,kBAAkB,IAAI,cAAc,CAqBnD;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,cAAc,GAAG,IAAI,CAG9D;AAMD;;GAEG;AACH,wBAAgB,cAAc,IAAI,kBAAkB,EAAE,CAMrD;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,UAAQ,GAAG,IAAI,CAyBzD;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,IAAI,IAAI,CAU/C"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/setup/migrations/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAmBjF,iDAAiD;AACjD,eAAO,MAAM,qBAAqB,iCAAiC,CAAC;AAEpE,+CAA+C;AAC/C,eAAO,MAAM,cAAc,EAAE,SAAS,EAkBrC,CAAC;AAMF;;;GAGG;AACH,wBAAgB,kBAAkB,IAAI,cAAc,CAqBnD;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,cAAc,GAAG,IAAI,CAG9D;AAMD;;GAEG;AACH,wBAAgB,cAAc,IAAI,kBAAkB,EAAE,CAMrD;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,UAAQ,GAAG,IAAI,CAyBzD;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,IAAI,IAAI,CAU/C"}

package/dist/setup/types.d.ts

@@ -31,6 +31,17 @@ export interface SetupOptions {
     tld: string;
     /** Email for Let's Encrypt certificates */
     email?: string;
+    /**
+     * DNS-01 provider name (lego), e.g. "cloudflare".
+     *
+     * Turns on the wildcard certificate: Traefik asks for `*.<tld>` once and
+     * serves it to every host, instead of one certificate per preview.
+     */
+    dnsProvider?: string;
+    /** Credentials for that provider, passed to the router container */
+    dnsEnv?: Record<string, string>;
+    /** ACME CA directory URL, kept from the config on a re-run */
+    caServer?: string;
     /** Skip hardening steps */
     noHardening?: boolean;
     /** Skip Docker installation (already installed) */

package/dist/setup/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/setup/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,WAAW,SAAS;IACxB,oDAAoD;IACpD,EAAE,EAAE,MAAM,CAAC;IACX,mEAAmE;IACnE,WAAW,EAAE,MAAM,CAAC;IACpB,iEAAiE;IACjE,GAAG,IAAI,IAAI,CAAC;CACb;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,4CAA4C;IAC5C,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,SAAS,CAAC;IACrB,MAAM,EAAE,SAAS,GAAG,SAAS,CAAC;CAC/B;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,uCAAuC;IACvC,GAAG,EAAE,MAAM,CAAC;IACZ,2CAA2C;IAC3C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2BAA2B;IAC3B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,mDAAmD;IACnD,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,iDAAiD;IACjD,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,oCAAoC;IACpC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,kFAAkF;IAClF,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,oDAAoD;IACpD,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/setup/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,WAAW,SAAS;IACxB,oDAAoD;IACpD,EAAE,EAAE,MAAM,CAAC;IACX,mEAAmE;IACnE,WAAW,EAAE,MAAM,CAAC;IACpB,iEAAiE;IACjE,GAAG,IAAI,IAAI,CAAC;CACb;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,4CAA4C;IAC5C,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,SAAS,CAAC;IACrB,MAAM,EAAE,SAAS,GAAG,SAAS,CAAC;CAC/B;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,uCAAuC;IACvC,GAAG,EAAE,MAAM,CAAC;IACZ,2CAA2C;IAC3C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oEAAoE;IACpE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,2BAA2B;IAC3B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,mDAAmD;IACnD,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,iDAAiD;IACjD,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,oCAAoC;IACpC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,kFAAkF;IAClF,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,oDAAoD;IACpD,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd"}