@ts-cloud/core 0.2.25 → 0.2.27

package/dist/drivers/types.d.ts

@@ -13,6 +13,10 @@ export interface ComputeStackOutputs {
     appInstanceId?: string;
     appPublicIp?: string;
     sshUser?: string;
+    /** Fleet: private IP of the dedicated services box (DB/cache/search). */
+    servicesPrivateIp?: string;
+    /** Fleet: public IP of the load balancer fronting the app servers. */
+    loadBalancerIp?: string;
 }
 export interface RemoteDeployInstanceResult {
     instanceId: string;
@@ -65,6 +69,15 @@ export interface CloudDriver {
     readonly usesCloudFormation: boolean;
     /** Provision compute infrastructure (Hetzner). AWS uses InfrastructureGenerator + CFN. */
     provisionComputeInfrastructure?(options: ProvisionComputeOptions): Promise<ComputeStackOutputs>;
+    /**
+     * Tear down the lightweight single-server compute (instance + security
+     * group/firewall + local state) provisioned by
+     * {@link provisionComputeInfrastructure}. Returns a human-readable summary of
+     * what was destroyed. Not for CloudFormation-managed stacks.
+     */
+    destroyCompute?(options: ProvisionComputeOptions): Promise<{
+        destroyed: string[];
+    }>;
     /** Read outputs needed for deploy (stack outputs, state file, or live API) */
     getComputeOutputs(options: ProvisionComputeOptions): Promise<ComputeStackOutputs>;
     /** Upload a release tarball to provider-specific staging storage */
@@ -81,8 +94,13 @@ export interface DeploySiteReleaseOptions {
     site: SiteConfig;
     slug: string;
     sha: string;
-    runtime: 'bun' | 'node' | 'deno';
-    localTarballPath: string;
+    runtime: 'bun' | 'node' | 'deno' | 'php';
+    /**
+     * Local release tarball to ship. Required for tarball deploys (bun/node/deno
+     * apps and server-static sites); omitted for PHP/Laravel sites, which clone
+     * from git on the box instead.
+     */
+    localTarballPath?: string;
 }
 export interface DeploySiteReleaseResult {
     success: boolean;

package/dist/index.d.ts

@@ -25,6 +25,8 @@ export * from './presets/realtime-app';
 export * from './presets/data-pipeline';
 export * from './presets/ml-api';
 export * from './presets/traditional-web-app';
+export * from './presets/laravel';
+export * from './presets/dashboard';
 export * from './presets/extend';
 export * from './aws/signature';
 export * from './aws/credentials';

package/dist/index.js

@@ -2567,7 +2567,7 @@ class Storage {
     for (const docsPath of docsPaths) {
       const fullPath = join(projectRoot, docsPath);
       if (existsSync(fullPath)) {
-        const distPaths = ["dist", "build", ".vitepress/dist", "_site", "out", "public"];
+        const distPaths = ["dist", "build", ".bunpress/dist", "_site", "out", "public"];
         for (const distPath of distPaths) {
           const fullDistPath = join(fullPath, distPath);
           if (existsSync(fullDistPath)) {
@@ -3408,7 +3408,7 @@ exports.handler = async (event) => {
   }
 
   // Try to determine if this is a directory or a file
-  // First, try appending .html (for VitePress clean URLs)
+  // First, try appending .html (for BunPress clean URLs)
   // If the file doesn't exist, CloudFront will try the directory with index.html
 
   // Check if the URI looks like a file path without extension
@@ -6041,7 +6041,8 @@ echo "Database tools installed!"
       java21: "java21",
       java17: "java17",
       go: "provided.al2023",
-      rust: "provided.al2023"
+      rust: "provided.al2023",
+      bun: "provided.al2023"
     },
     presets: {
       api: {
@@ -22145,6 +22146,77 @@ function createTraditionalWebAppPreset(options) {
     }
   };
 }
+// src/presets/laravel.ts
+function createLaravelPreset(options) {
+  const {
+    name,
+    slug,
+    domain,
+    repository,
+    phpVersion = "8.3",
+    size = "small",
+    database: database2 = slug.replace(/-/g, "_"),
+    databasePassword,
+    sslEmail,
+    deployStrategy = "push",
+    provider = "hetzner"
+  } = options;
+  return {
+    project: { name, slug, region: "us-east-1" },
+    mode: "server",
+    cloud: { provider },
+    environments: {
+      production: { type: "production", domain }
+    },
+    infrastructure: {
+      compute: {
+        mode: "server",
+        size,
+        runtime: "php",
+        webServer: "nginx",
+        php: { versions: [phpVersion], default: phpVersion },
+        managedServices: { mysql: true, redis: true },
+        firewall: { enabled: true },
+        autoUpdates: true,
+        monitoring: true,
+        backups: { enabled: true, schedule: "0 2 * * *", retentionCount: 7 }
+      },
+      appDatabase: {
+        engine: "mysql",
+        name: database2,
+        username: database2,
+        password: databasePassword
+      }
+    },
+    sites: {
+      main: {
+        root: ".",
+        type: "laravel",
+        domain,
+        phpVersion,
+        repository: { ...repository, strategy: deployStrategy },
+        scheduler: true,
+        queues: [{ connection: "redis", queue: "default", processes: 1 }],
+        ssl: { provider: "letsencrypt", email: sslEmail }
+      }
+    }
+  };
+}
+// src/presets/dashboard.ts
+function createDashboardSite(options) {
+  return {
+    root: options.root ?? "ui/dist",
+    deploy: "server",
+    type: "static",
+    domain: options.domain,
+    build: options.build ?? "cd ui && bun install && bun run build",
+    ssl: { provider: "letsencrypt" },
+    auth: {
+      username: options.username ?? "admin",
+      password: options.password
+    }
+  };
+}
 // src/presets/extend.ts
 function deepMerge(target, source) {
   const result = { ...target };
@@ -45580,10 +45652,12 @@ export {
   createMockAWS,
   createMicroservicesPreset,
   createMLApiPreset,
+  createLaravelPreset,
   createJamstackPreset,
   createFullStackAppPreset,
   createError,
   createDataPipelinePreset,
+  createDashboardSite,
   createCredentialProvider,
   createApiBackendPreset,
   containerRegistryManager,

package/dist/modules/cdn.d.ts

@@ -171,7 +171,7 @@ export declare class CDN {
      */
     static readonly EdgeFunctionTemplates: {
         /**
-         * Origin request handler for docs/VitePress routing
+         * Origin request handler for docs/BunPress routing
          */
         docsOriginRequest: string;
         /**

package/dist/modules/compute.d.ts

@@ -1073,6 +1073,7 @@ export declare class Compute {
             readonly java17: "java17";
             readonly go: "provided.al2023";
             readonly rust: "provided.al2023";
+            readonly bun: "provided.al2023";
         };
         /**
          * Common function configurations
@@ -1145,7 +1146,7 @@ export declare class Compute {
          *  - Multiple sites can share one EC2 instance
          */
         generateBunAppScript: (options: {
-            runtime?: "bun" | "node" | "deno";
+            runtime?: "bun" | "node" | "deno" | "php";
             runtimeVersion?: string;
             systemPackages?: string[];
             database?: "sqlite" | "mysql" | "postgres";
@@ -1269,7 +1270,13 @@ export declare class Compute {
         subnetId: string;
         instanceType?: string;
         imageId?: string;
-        keyName: string;
+        /**
+         * EC2 KeyName for SSH access. Optional — when omitted, no SSH key is
+         * associated with the instance and shell access goes via SSM Session
+         * Manager. The provided KeyName must already exist in EC2 or the
+         * launch fails with "key pair does not exist".
+         */
+        keyName?: string;
         domain?: string;
         userData?: string;
         allowedPorts?: number[];

package/dist/presets/dashboard.d.ts

@@ -0,0 +1,26 @@
+import type { SiteConfig } from '../types';
+/**
+ * The ts-cloud management dashboard (`@ts-cloud/ui`) as a deployable site —
+ * a static stx app served on the box by nginx, behind HTTP Basic auth whose
+ * password comes from an env value.
+ *
+ * Add it to your config's `sites` so `cloud deploy` builds + publishes it:
+ *
+ * ```ts
+ * sites: {
+ *   dashboard: createDashboardSite({ domain: 'dashboard.acme.com', password: process.env.TS_CLOUD_UI_PASSWORD }),
+ * }
+ * ```
+ */
+export declare function createDashboardSite(options: {
+    /** Domain the dashboard is served on (required for nginx vhost + SSL). */
+    domain: string;
+    /** Basic-auth password — typically `process.env.TS_CLOUD_UI_PASSWORD`. */
+    password?: string;
+    /** Basic-auth username. @default 'admin' */
+    username?: string;
+    /** Built UI output directory shipped to the box. @default 'ui/dist' */
+    root?: string;
+    /** Build command producing {@link root}. @default builds @ts-cloud/ui */
+    build?: string;
+}): SiteConfig;

package/dist/presets/index.d.ts

@@ -10,4 +10,5 @@ export { createRealtimeAppPreset } from './realtime-app';
 export { createDataPipelinePreset } from './data-pipeline';
 export { createMLApiPreset } from './ml-api';
 export { createTraditionalWebAppPreset } from './traditional-web-app';
+export { createLaravelPreset } from './laravel';
 export { extendPreset, composePresets, createPreset, mergeInfrastructure, withMonitoring, withSecurity, withDatabase, withCache, withCDN, withQueue, } from './extend';

package/dist/presets/laravel.d.ts

@@ -0,0 +1,36 @@
+import type { CloudConfig } from '../types';
+/**
+ * Laravel Preset — a Forge-style single server.
+ *
+ * Provisions one box (Hetzner by default) running nginx + php-fpm + Composer,
+ * MySQL + Redis on the box, host firewall (UFW), automatic security updates,
+ * monitoring, and scheduled backups. The app is deployed from git into atomic
+ * zero-downtime releases, served over HTTPS via Let's Encrypt, with the queue
+ * worker and scheduler enabled.
+ */
+export declare function createLaravelPreset(options: {
+    name: string;
+    slug: string;
+    /** App domain (also used for the Let's Encrypt cert). */
+    domain?: string;
+    /** Git repository to deploy. */
+    repository: {
+        url: string;
+        branch?: string;
+        provider?: 'github' | 'gitlab' | 'bitbucket' | 'custom';
+    };
+    /** PHP version. @default '8.3' */
+    phpVersion?: string;
+    /** Server size (provider-specific token). @default 'small' */
+    size?: string;
+    /** App database name. @default slug */
+    database?: string;
+    /** Database password (set via env in real configs). */
+    databasePassword?: string;
+    /** Contact email for Let's Encrypt. */
+    sslEmail?: string;
+    /** Deploy strategy. @default 'push' */
+    deployStrategy?: 'push' | 'tag';
+    /** Provider. @default 'hetzner' */
+    provider?: 'hetzner' | 'aws';
+}): Partial<CloudConfig>;

package/dist/types.d.ts

@@ -77,6 +77,12 @@ export interface CloudConfig {
     environments: Record<string, EnvironmentConfig>;
     infrastructure?: InfrastructureConfig;
     sites?: Record<string, SiteConfig>;
+    /**
+     * Notification channels for deploy, SSL, health-check, and backup events
+     * (Slack, Discord, Telegram, email, generic webhook). Project-wide default;
+     * a site may override via {@link SiteConfig.notifications}.
+     */
+    notifications?: NotificationsConfig;
     /**
      * AWS-specific configuration
      */
@@ -294,6 +300,14 @@ export interface InfrastructureConfig {
      * - `'postgres'` → RDS Postgres with sane defaults, DATABASE_URL injected into env
      */
     database?: 'sqlite' | 'mysql' | 'postgres';
+    /**
+     * Application database connection (object form) for the Forge-style on-box /
+     * managed database path. Provides the name/user/password that
+     * `compute.managedServices` creates on the box, and the `DB_*` values
+     * auto-wired into PHP sites' `.env`. Distinct from the {@link database}
+     * string shorthand.
+     */
+    appDatabase?: DatabaseConfig;
     cache?: CacheConfig;
     cdn?: Record<string, CdnItemConfig & ResourceConditions> | CdnItemConfig;
     /**
@@ -824,6 +838,252 @@ export interface SiteConfig {
      * Example: ['bun install --frozen-lockfile', 'bun run build']
      */
     preStart?: string[];
+    /**
+     * SSR only. tar `--exclude` patterns applied when packaging the release
+     * tarball. Keep host-specific / heavy paths out of the artifact — most
+     * importantly `node_modules` (host-built native binaries won't run on the
+     * target OS; install fresh via `preStart` instead), plus `.git`, dev caches,
+     * and the built frontend.
+     *
+     * Example: ['node_modules', '.git', 'dist']
+     */
+    exclude?: string[];
+    /**
+     * Application type. Drives the default deploy script and the nginx vhost
+     * template:
+     *  - `'laravel'` — `public/` web root, Laravel deploy script (composer,
+     *    artisan caches, migrate, storage:link, queue:restart).
+     *  - `'php'` — generic PHP app behind php-fpm (vanilla PHP, custom framework).
+     *  - `'statamic'` / `'wordpress'` — PHP apps with framework-specific defaults.
+     *  - `'static'` — plain static files served by nginx.
+     *  - `'spa'` — single-page app with a `try_files … /index.html` fallback.
+     *
+     * When omitted the legacy inference applies (`start` ⇒ a systemd runtime app,
+     * otherwise a bucket static site) — so existing bun/node sites are unaffected.
+     */
+    type?: 'laravel' | 'php' | 'statamic' | 'wordpress' | 'static' | 'spa';
+    /**
+     * PHP version for this site (e.g. `'8.3'`). Selects the php-fpm pool/socket
+     * the nginx vhost points at. Must be one of `compute.php.versions`. Defaults
+     * to `compute.php.default`.
+     */
+    phpVersion?: string;
+    /**
+     * Web root relative to the release directory. Defaults to `'public'` for
+     * `laravel`/`statamic`/`wordpress`, and `''` (the release root) for `php`,
+     * `static`, and `spa`.
+     */
+    webDirectory?: string;
+    /**
+     * Git repository the server clones/pulls on deploy (Forge-style). When set,
+     * the deploy clones `branch` into `releases/<sha>` rather than shipping a
+     * tarball over SCP.
+     */
+    repository?: SiteRepositoryConfig;
+    /**
+     * Override the deploy script run inside the new release directory. When
+     * omitted, a sensible default for `type` is used (e.g. the Laravel script).
+     * The special tokens `$CREATE_RELEASE`, `$ACTIVATE_RELEASE`, and
+     * `$RESTART_QUEUES` expand to the zero-downtime release macros.
+     */
+    deployScript?: string[];
+    /**
+     * Paths symlinked from the site's `shared/` directory into every release so
+     * they persist across deploys (e.g. `storage`, uploaded files, a SQLite db).
+     * `.env` is always shared and need not be listed.
+     * @default ['storage', '.env']
+     */
+    sharedPaths?: string[];
+    /**
+     * Number of past releases to retain on the box for rollback.
+     * @default 4
+     */
+    keepReleases?: number;
+    /**
+     * Use zero-downtime atomic releases (Envoyer-style: clone → build → flip the
+     * `current` symlink only after every step succeeds, with the previous release
+     * kept for instant rollback). On by default for git-deployed PHP sites — set
+     * `false` only to deploy in place.
+     * @default true
+     */
+    zeroDowntime?: boolean;
+    /** Laravel queue workers to run for this site (systemd-managed). */
+    queues?: QueueWorkerConfig[];
+    /**
+     * Run the Laravel scheduler for this site
+     * (`* * * * * php artisan schedule:run`).
+     */
+    scheduler?: boolean;
+    /** Arbitrary long-running processes to keep alive (systemd-managed). */
+    daemons?: DaemonConfig[];
+    /** TLS configuration for this site's nginx vhost. */
+    ssl?: SiteSslConfig;
+    /** Additional hostnames served by the same vhost (nginx `server_name`). */
+    aliases?: string[];
+    /** `from` path/host → `to` URL redirects emitted into the nginx vhost. */
+    redirects?: Record<string, string>;
+    /**
+     * Give this site a dedicated php-fpm pool (isolated user/process) rather than
+     * sharing the default pool.
+     */
+    isolation?: boolean;
+    /** Post-deploy health check (Forge-style) pinged after `current` is flipped. */
+    healthCheck?: {
+        path?: string;
+    };
+    /**
+     * Per-site notification channels, overriding the project-wide
+     * {@link CloudConfig.notifications} for this site's events.
+     */
+    notifications?: NotificationsConfig;
+    /**
+     * HTTP Basic auth (htpasswd) protecting the whole site at the nginx layer.
+     * Typically driven from an env value, e.g. `{ username: 'admin', password:
+     * process.env.UI_PASSWORD }`. The htpasswd file is generated on the box.
+     */
+    auth?: SiteAuthConfig;
+}
+/** HTTP Basic auth for a site's nginx vhost. See {@link SiteConfig.auth}. */
+export interface SiteAuthConfig {
+    /** Enable basic auth. @default true when this object is present */
+    enabled?: boolean;
+    /** Username. @default 'admin' */
+    username?: string;
+    /** Plaintext password (hashed on the box). Usually `process.env.X`. */
+    password?: string;
+    /** Realm shown in the browser auth prompt. @default 'Restricted' */
+    realm?: string;
+}
+/**
+ * Git source for a Forge-style git-clone deploy. See {@link SiteConfig.repository}.
+ */
+export interface SiteRepositoryConfig {
+    /** Clone URL (https or git@). */
+    url: string;
+    /** Branch to deploy. @default 'main' */
+    branch?: string;
+    /** Hosting provider — drives push-to-deploy hook wiring. @default 'github' */
+    provider?: 'github' | 'gitlab' | 'bitbucket' | 'custom';
+    /**
+     * Deploy strategy:
+     *  - `'push'` (default) — deploy the tip of `branch` (push-to-deploy).
+     *  - `'tag'` — deploy a git version tag: a specific {@link tag}, or the latest
+     *    tag matching {@link tagPattern} (e.g. release `v*` tags). Useful for
+     *    promoting tagged releases rather than every push.
+     */
+    strategy?: 'push' | 'tag';
+    /** Exact tag to deploy when `strategy: 'tag'`. Overrides {@link tagPattern}. */
+    tag?: string;
+    /**
+     * Glob matching the tags to consider when `strategy: 'tag'` and no explicit
+     * {@link tag} is set; the highest version (`-sort=-v:refname`) is deployed.
+     * @default 'v*'
+     */
+    tagPattern?: string;
+}
+/**
+ * TLS for a PHP/static site's nginx vhost. See {@link SiteConfig.ssl}.
+ */
+export interface SiteSslConfig {
+    /**
+     * Certificate source:
+     *  - `'letsencrypt'` — issue + auto-renew via certbot (default for sites with
+     *    a `domain`).
+     *  - `'custom'` — install operator-provided `certPath`/`keyPath`.
+     *  - `'none'` — serve plain HTTP only.
+     */
+    provider?: 'letsencrypt' | 'custom' | 'none';
+    /** Contact email for Let's Encrypt registration/expiry notices. */
+    email?: string;
+    /** Path to the certificate (PEM) when `provider: 'custom'`. */
+    certPath?: string;
+    /** Path to the private key (PEM) when `provider: 'custom'`. */
+    keyPath?: string;
+}
+/**
+ * A Laravel queue worker (or Horizon supervisor) run as a systemd service.
+ * Mirrors Forge's queue configuration. See {@link SiteConfig.queues}.
+ */
+export interface QueueWorkerConfig {
+    /**
+     * Use `php artisan horizon` instead of `queue:work`. When true, connection /
+     * queue / worker tuning is taken from the app's `config/horizon.php`.
+     * @default false
+     */
+    horizon?: boolean;
+    /** Queue connection (`php artisan queue:work <connection>`). @default 'default' */
+    connection?: string;
+    /** Comma-separated queues to consume, highest priority first. @default 'default' */
+    queue?: string;
+    /** Number of worker processes to run in parallel. @default 1 */
+    processes?: number;
+    /** `--timeout`: seconds a child job may run before being killed. @default 60 */
+    timeout?: number;
+    /** `--sleep`: seconds to wait when no job is available. @default 3 */
+    sleep?: number;
+    /** `--tries`: attempts before a job is marked failed. @default 3 */
+    tries?: number;
+    /** `--max-jobs`: restart the worker after N jobs (0 = unlimited). */
+    maxJobs?: number;
+    /** `--max-time`: restart the worker after N seconds (0 = unlimited). */
+    maxTime?: number;
+    /** `--memory`: restart the worker when it exceeds N MB. @default 128 */
+    memory?: number;
+    /** Seconds to wait for in-flight jobs to finish on stop/restart. @default 90 */
+    stopWaitSecs?: number;
+}
+/**
+ * A generic long-running process kept alive by systemd. Mirrors Forge daemons.
+ * See {@link SiteConfig.daemons}.
+ */
+export interface DaemonConfig {
+    /** Command to run (becomes systemd `ExecStart`). */
+    command: string;
+    /** Working directory. Defaults to the site's `current` release directory. */
+    directory?: string;
+    /** User to run as. Defaults to the deploy user. */
+    user?: string;
+    /** Number of identical processes to run. @default 1 */
+    processes?: number;
+    /** Restart policy. @default 'always' */
+    restart?: 'always' | 'on-failure' | 'no';
+    /** Optional explicit unit name; defaults to a slug of the command. */
+    name?: string;
+}
+/** A lifecycle event that can trigger a notification. */
+export type NotifyEvent = 'deploy' | 'deploy-failed' | 'ssl' | 'health' | 'backup';
+/**
+ * Notification channels (Forge-style). Configure any subset; each configured
+ * channel receives the events listed in {@link events} (all events by default).
+ */
+export interface NotificationsConfig {
+    /** Slack incoming-webhook URL. */
+    slack?: {
+        webhookUrl: string;
+    };
+    /** Discord webhook URL. */
+    discord?: {
+        webhookUrl: string;
+    };
+    /** Telegram bot token + chat id. */
+    telegram?: {
+        botToken: string;
+        chatId: string;
+    };
+    /** Email recipients (sent via ts-cloud's email/SES client). */
+    email?: {
+        to: string | string[];
+        from?: string;
+    };
+    /** Generic webhook — receives `{ event, message }` as JSON. */
+    webhook?: {
+        url: string;
+        method?: 'POST' | 'GET';
+    };
+    /**
+     * Which events to notify on. @default all events
+     */
+    events?: NotifyEvent[];
 }
 export interface VpcConfig {
     cidr?: string;
@@ -844,8 +1104,18 @@ export interface BucketConfig {
 }
 export interface DatabaseConfig {
     type?: 'rds' | 'dynamodb';
-    engine?: 'postgres' | 'mysql';
+    engine?: 'postgres' | 'mysql' | 'mariadb';
     instanceType?: string;
+    /** Database/schema name to create (e.g. `forge`). */
+    name?: string;
+    /** Application database user to create. */
+    username?: string;
+    /** Password for {@link username}. */
+    password?: string;
+    /** Hostname for a managed/external database (default `127.0.0.1` on-box). */
+    host?: string;
+    /** Port (defaults: mysql/mariadb 3306, postgres 5432). */
+    port?: number;
 }
 export interface CacheConfig {
     type?: 'redis' | 'memcached';
@@ -1316,6 +1586,23 @@ export interface ComputeConfig {
      * @default 'micro'
      */
     size?: InstanceSize;
+    /**
+     * Number of application servers (Forge load-balanced fleet). When > 1, a load
+     * balancer is provisioned in front and a private network connects the fleet;
+     * the app is deployed to every app server. Pair with {@link servicesServer}
+     * so the database/cache/search live on one shared box. @default 1
+     */
+    appServers?: number;
+    /**
+     * Provision a **dedicated services server** (its own box) running the
+     * configured {@link managedServices} (MySQL/Redis/Meilisearch), instead of
+     * co-locating them on the app server(s). App servers then point their `.env`
+     * at this box over the private network. Required for a multi-app fleet so all
+     * app servers share one database/cache. `true` uses the default size.
+     */
+    servicesServer?: boolean | {
+        size?: InstanceSize;
+    };
     /**
      * Mixed instance fleet for cost optimization
      * Allows combining different sizes and spot instances
@@ -1329,10 +1616,20 @@ export interface ComputeConfig {
      */
     fleet?: InstanceConfig[];
     /**
-     * Custom machine image (optional)
-     * If not specified, uses the provider's default Linux image
+     * Custom machine image (optional). For the Forge path this is a ts-cloud
+     * **golden image** (a Hetzner snapshot / AWS AMI baked with the full stack —
+     * nginx, php-fpm, Composer, services). If not specified, the provider's
+     * default Ubuntu image is used and the stack is installed at first boot.
+     * @see bakedImage
      */
     image?: string;
+    /**
+     * The configured {@link image} is a pre-provisioned golden image that already
+     * has the runtime + PHP + services + base packages installed. Boot skips the
+     * install-heavy provisioning for a near-instant start. Build + publish the
+     * image with the bake recipe (see scripts/build-image.ts). @default false
+     */
+    bakedImage?: boolean;
     /**
      * CloudFront custom origin for the registry/app server (when the site stack
      * fronts EC2 instead of S3-only). Use the EC2 public DNS name, not a raw IP.
@@ -1349,6 +1646,12 @@ export interface ComputeConfig {
         instanceType?: string;
         ami?: string;
         keyPair?: string;
+        /**
+         * IAM instance profile name attached at launch. For the lightweight EC2
+         * boot path, this should grant `AmazonSSMManagedInstanceCore` so deploys
+         * (SSM Run Command) reach the box.
+         */
+        iamInstanceProfile?: string;
         autoScaling?: {
             min?: number;
             max?: number;
@@ -1515,9 +1818,10 @@ export interface ComputeConfig {
     };
     /**
      * Application runtime to install on the instance.
-     * Shared by every site that gets deployed to this compute.
+     * Shared by every site that gets deployed to this compute. `'php'` provisions
+     * nginx + php-fpm + Composer (see {@link php}) for Laravel/PHP sites.
      */
-    runtime?: 'bun' | 'node' | 'deno';
+    runtime?: 'bun' | 'node' | 'deno' | 'php';
     /**
      * Pinned runtime version (e.g. '1.3.13'). Defaults to 'latest'.
      */
@@ -1552,6 +1856,126 @@ export interface ComputeConfig {
      * static dirs — so an app, docs, and a public site can share one domain.
      */
     proxy?: ComputeProxyConfig;
+    /**
+     * PHP-FPM provisioning. When set (or `runtime: 'php'`), the box installs the
+     * requested PHP versions (via `ppa:ondrej/php`), Composer, and the common
+     * Laravel extension set. Each site picks its version with `SiteConfig.phpVersion`.
+     */
+    php?: ComputePhpConfig;
+    /**
+     * Web server that fronts the box.
+     *  - `'nginx'` (default) — per-site nginx vhost + php-fpm, Let's Encrypt via certbot.
+     *  - `'rpx'` — the existing `@stacksjs/rpx` gateway with on-demand TLS.
+     * Independent of {@link proxy}, which only configures the rpx engine details.
+     * @default 'nginx'
+     */
+    webServer?: 'nginx' | 'rpx';
+    /**
+     * On-box managed services to install (Forge's single-server model): the
+     * database engine, cache, and search. Each may be `true` for defaults or an
+     * object for pinning a version. Omit to install nothing (e.g. when pointing
+     * the app at a managed/RDS database instead).
+     *
+     * Named `managedServices` to avoid colliding with the ECS microservices
+     * `services` array above.
+     */
+    managedServices?: ComputeServicesConfig;
+    /**
+     * Host firewall (UFW). When enabled, only SSH + the listed ports are open.
+     * On Hetzner this complements the cloud firewall; on a bare box it's the
+     * primary firewall. @default { enabled: true } for PHP boxes
+     */
+    firewall?: ComputeFirewallConfig;
+    /**
+     * Automatic unattended security/system updates (Forge's "maintenance"). When
+     * enabled, installs `unattended-upgrades` and enables daily auto-updates.
+     * @default true for PHP boxes
+     */
+    autoUpdates?: boolean;
+    /**
+     * Scheduled database backups (powered by `ts-backups`), synced to object
+     * storage. Off unless configured.
+     */
+    backups?: ComputeBackupConfig;
+    /**
+     * Operator SSH keys authorized on the box, in addition to the deploy key.
+     * Managed declaratively: keys are written to `authorized_keys` inside a
+     * ts-cloud-managed block on every provision/deploy, so adding one is as
+     * simple as adding an entry here and redeploying.
+     */
+    sshKeys?: SshKeyConfig[];
+}
+/** An operator SSH key authorized on the box. See {@link ComputeConfig.sshKeys}. */
+export interface SshKeyConfig {
+    /** Human label for the key (comment). */
+    name: string;
+    /** The public key line (e.g. `ssh-ed25519 AAAA… user@host`). */
+    publicKey: string;
+}
+/** Host firewall (UFW) configuration. See {@link ComputeConfig.firewall}. */
+export interface ComputeFirewallConfig {
+    /** Enable UFW. @default true */
+    enabled?: boolean;
+    /** TCP ports to allow in addition to SSH/80/443 (always allowed). */
+    allowedPorts?: number[];
+}
+/** Scheduled database backup configuration. See {@link ComputeConfig.backups}. */
+export interface ComputeBackupConfig {
+    /** Enable scheduled backups. @default false */
+    enabled?: boolean;
+    /** Cron schedule for the backup run. @default '0 2 * * *' (daily 02:00) */
+    schedule?: string;
+    /** Keep the newest N backups locally. @default 5 */
+    retentionCount?: number;
+    /** Delete local backups older than N days. @default 30 */
+    retentionDays?: number;
+    /** Object-storage bucket (S3 or Hetzner) the backups are synced to. */
+    bucket?: string;
+    /** S3-compatible endpoint (e.g. Hetzner object storage). Omit for AWS S3. */
+    endpoint?: string;
+}
+/**
+ * PHP-FPM provisioning for a compute box. See {@link ComputeConfig.php}.
+ */
+export interface ComputePhpConfig {
+    /**
+     * PHP versions to install (e.g. `['8.3', '8.2']`). Each gets its own php-fpm
+     * pool/socket so sites can pin different versions. @default ['8.3']
+     */
+    versions?: string[];
+    /** Default PHP version for sites that don't set `phpVersion`. @default first of `versions` */
+    default?: string;
+    /**
+     * Extra PHP extensions to install beyond the Laravel baseline (mbstring, xml,
+     * curl, mysql, pgsql, redis, gd, bcmath, zip, intl). apt package suffixes,
+     * e.g. `['imagick', 'swoole']`.
+     */
+    extensions?: string[];
+}
+/**
+ * On-box managed services (database / cache / search) for a compute box.
+ * Each entry is `true` (install with defaults) or an object pinning a version.
+ * See {@link ComputeConfig.services}.
+ */
+export interface ComputeServicesConfig {
+    mysql?: boolean | {
+        version?: string;
+    };
+    mariadb?: boolean | {
+        version?: string;
+    };
+    postgres?: boolean | {
+        version?: string;
+    };
+    redis?: boolean | {
+        version?: string;
+    };
+    memcached?: boolean | {
+        version?: string;
+    };
+    meilisearch?: boolean | {
+        version?: string;
+    };
 }
 /**
  * Reverse-proxy gateway provisioning for a compute box. The gateway is
@@ -1583,6 +2007,34 @@ export interface ComputeProxyConfig {
     onDemandTls?: boolean;
     /** Contact email for the ACME account when {@link onDemandTls} is enabled. */
     onDemandTlsEmail?: string;
+    /**
+     * Put a CDN (CloudFront) in front of this self-hosted gateway. A CDN custom
+     * origin can't be a bare IP and can't be one of the public aliases (it would
+     * resolve back to the CDN — an infinite loop), so it needs a dedicated origin
+     * hostname pointing at this box. Requests then flow
+     * `viewer → CDN → originDomain (this box)`.
+     *
+     * When {@link CdnFrontConfig.secret} is set, the CDN injects it as a header
+     * on the origin hop and the gateway rejects any request to the fronted hosts
+     * that lacks it — so the publicly-resolvable origin can't be used to bypass
+     * the CDN (origin lockdown via rpx `createOriginGuard`). Pair with
+     * `buildCloudFrontOriginConfig` for the matching AWS distribution config.
+     */
+    cdn?: CdnFrontConfig;
+}
+/** CDN-in-front-of-gateway configuration (see {@link ComputeProxyConfig.cdn}). */
+export interface CdnFrontConfig {
+    /**
+     * Hostname the CDN connects to (e.g. `origin.example.com`). MUST resolve to
+     * this box and MUST NOT be one of {@link frontedHosts} (else the CDN loops).
+     */
+    originDomain: string;
+    /** Public hosts served through the CDN (its aliases) — locked down when {@link secret} is set. */
+    frontedHosts: string[];
+    /** Shared secret the CDN injects on the origin hop; the gateway enforces it on {@link frontedHosts}. */
+    secret?: string;
+    /** Header name carrying {@link secret}. @default 'X-Origin-Verify' */
+    secretHeader?: string;
 }
 export interface DatabaseItemConfig {
     engine?: 'dynamodb' | 'postgres' | 'mysql';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ts-cloud/core",
-  "version": "0.2.25",
+  "version": "0.2.27",
   "type": "module",
   "description": "Core CloudFormation generation library for ts-cloud",
   "author": "Chris Breuer <chris@stacksjs.com>",
@@ -31,7 +31,7 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@ts-cloud/aws-types": "0.2.25"
+    "@ts-cloud/aws-types": "0.2.27"
   },
   "devDependencies": {
     "typescript": "^5.9.3"