@vibesdotdev/infra-doks 0.0.1

package/src/implementations/verdaccio.impl.ts

@@ -0,0 +1,300 @@
+/**
+ * Implementation: infra/package-registry -> verdaccio-doks
+ *
+ * Generates K8s manifests for a Verdaccio npm registry on DOKS.
+ */
+import { createHash } from 'node:crypto';
+import * as z from 'zod/v4';
+import { createRuntimeImplementation } from '@vibesdotdev/runtime';
+import { VerdaccioDoksPackageRegistryConfigSchema, PackageRegistryTypeSchema } from '@vibesdotdev/infra-core/kinds';
+import { loadVerdaccioThemeAssets, VIBES_PRIMARY_HEX } from '@vibesdotdev/registry-theme';
+import type { K8sDeployment, K8sService } from '../types.ts';
+
+export const VerdaccioDoksDescriptorSchema = z.object({
+	kind: z.literal('infra/package-registry'),
+	id: z.string().min(1),
+	name: z.string().optional(),
+	description: z.string().optional(),
+	url: z.string().url(),
+	registryType: PackageRegistryTypeSchema.default('npm'),
+	scope: z.string().optional(),
+	upstreamUrl: z.string().url().optional(),
+	authRequired: z.boolean().default(true),
+	ssl: z.boolean().default(true),
+	env: z.array(z.object({
+		name: z.string().regex(/^[_A-Z0-9]+$/),
+		public: z.boolean().default(false),
+		required: z.boolean().default(true),
+		value: z.string().optional(),
+		secret: z.boolean().default(false),
+		description: z.string().optional(),
+		storeKey: z.string().min(1).optional()
+	})).optional(),
+	config: VerdaccioDoksPackageRegistryConfigSchema.extend({
+		adapter: z.literal('verdaccio-doks')
+	})
+});
+
+export type VerdaccioDoksDescriptorInput = z.input<typeof VerdaccioDoksDescriptorSchema>;
+export type VerdaccioDoksDescriptor = z.infer<typeof VerdaccioDoksDescriptorSchema>;
+
+export interface VerdaccioManifest {
+	deployment: K8sDeployment;
+	service: K8sService;
+	pvc: { apiVersion: string; kind: string; metadata: Record<string, unknown>; spec: Record<string, unknown> };
+	configMap: { apiVersion: string; kind: string; metadata: Record<string, unknown>; data: Record<string, string> };
+	ingress: { apiVersion: string; kind: string; metadata: Record<string, unknown>; spec: Record<string, unknown> };
+}
+
+function buildVerdaccioConfig(d: VerdaccioDoksDescriptor): string {
+	const cfg = d.config!;
+	const theme = loadVerdaccioThemeAssets();
+
+	// Verdaccio v5's metaScripts/scriptsBodyAfter render the array items via
+	// string interpolation in the HTML template — items must be RAW HTML
+	// strings, not { tag, attribs } objects. The latter render as
+	// "[object Object]".
+	const cssDataUri = `data:text/css;base64,${Buffer.from(theme.combinedCss).toString('base64')}`;
+	const cssTag = `<link rel="stylesheet" href="${cssDataUri}">`;
+
+	const lines: string[] = [
+		'storage: /verdaccio/storage',
+		// url_prefix must be the PATH prefix (e.g. "/"), not the full origin.
+		// Setting the full origin causes Verdaccio to concat it with the request
+		// origin → base href becomes https://X/https://X/ and the SPA breaks.
+		'url_prefix: /',
+		'web:',
+		'  title: vibes packages',
+		`  logo: ${theme.logoDataUri}`,
+		`  primary_color: "${VIBES_PRIMARY_HEX}"`,
+		'  darkMode: enabled',
+		'  gravatar: true',
+		'  metaScripts:',
+		// Single-quoted YAML keeps the inner double-quotes and the long data URL intact.
+		`    - '${cssTag}'`
+	];
+	if (theme.elementsBundle) {
+		const jsDataUri = `data:text/javascript;base64,${Buffer.from(theme.elementsBundle).toString('base64')}`;
+		const scriptTag = `<script type="module" src="${jsDataUri}"></script>`;
+		const brandBarMarkup = '<vibes-brand-bar app="packages"><vibes-account-menu slot="end"></vibes-account-menu></vibes-brand-bar>';
+		// Verdaccio v5.33's bundled middleware looks up `web.scriptsbodyBefore`
+		// (lowercase 'b' before Before). The capital-B `scriptsBodyBefore` was
+		// introduced later but the deprecated lowercase key is what's wired in
+		// the installed @verdaccio/middleware@8.0.0-next-8.1. Confirmed by
+		// grepping the actual /usr/local/lib/.../template.js in the pod.
+		lines.push(
+			'  scriptsbodyBefore:',
+			`    - '${brandBarMarkup}'`,
+			`    - '${scriptTag}'`
+		);
+	}
+	lines.push(
+		'security:',
+		'  api:',
+		'    jwt:',
+		'      sign:',
+		'        expiresIn: 7d',
+		'  web:',
+		'    sign:',
+		'      expiresIn: 1d',
+		// Auth plugin disabled while the better-auth-jwt distribution is
+		// reworked — the previous setup-plugin init container tried to
+		// `git clone` the private monorepo, which fails unauthenticated.
+		// Falls back to Verdaccio's built-in htpasswd auth; if the htpasswd
+		// file is empty, no one can publish but reads are still permitted
+		// per the `access: $all` policy below.
+		'auth:',
+		'  htpasswd:',
+		'    file: /verdaccio/storage/htpasswd',
+		'    max_users: -1',
+		'plugins: /verdaccio/plugins',
+		'packages:'
+	);
+	if (d.scope) {
+		const scopeName = d.scope.replace('@', '');
+		lines.push(`  '@${scopeName}/*':`);
+		lines.push('    access: $all');
+		lines.push('    publish: $authenticated');
+		lines.push('    unpublish: $authenticated');
+		lines.push('  "**":');
+		lines.push('    access: $all');
+		lines.push('    publish: $authenticated');
+		lines.push(`    proxy: ${new URL(cfg.upstreamNpmUrl).origin}`);
+	} else {
+		lines.push('  "**":');
+		lines.push('    access: $all');
+		lines.push('    publish: $authenticated');
+		lines.push(`    proxy: ${new URL(cfg.upstreamNpmUrl).origin}`);
+	}
+	lines.push('logs:');
+	lines.push('  - type: stdout');
+	lines.push('    format: pretty');
+	lines.push('    level: http');
+	return lines.join('\n');
+}
+
+export function generateVerdaccioManifest(input: VerdaccioDoksDescriptorInput): VerdaccioManifest {
+	const d = VerdaccioDoksDescriptorSchema.parse(input);
+	const ns = 'vibes';
+	const name = `vibes-${d.id}`;
+	const pvcName = `${name}-data`;
+	const port = 4873;
+	const configKey = 'config.yaml';
+	const cfg = d.config!;
+	const secretName = 'verdaccio-secrets';
+	const pluginMountPath = '/verdaccio/plugins';
+
+	const configYaml = buildVerdaccioConfig(d);
+	const configChecksum = createHash('sha256').update(configYaml).digest('hex').slice(0, 16);
+
+	const deployment: K8sDeployment = {
+		apiVersion: 'apps/v1',
+		kind: 'Deployment',
+		metadata: {
+			name,
+			namespace: ns,
+			labels: { app: d.id, 'app.kubernetes.io/part-of': 'vibes' },
+			annotations: {
+				'vibes.dev/verdaccio-plugin': 'better-auth-jwt',
+				'secrets.hashicorp.com/rollout-restart': 'true'
+			}
+		},
+		spec: {
+			replicas: 1,
+			strategy: { type: 'Recreate' },
+			selector: { matchLabels: { app: d.id } },
+			template: {
+				metadata: {
+					labels: { app: d.id },
+					annotations: { 'vibes.dev/config-checksum': configChecksum }
+				},
+				spec: {
+					initContainers: [{
+						name: 'setup-plugin',
+						image: 'node:22-alpine',
+						command: ['sh', '-c', [
+							'apk add --no-cache git',
+							`mkdir -p ${pluginMountPath}/better-auth-jwt`,
+							'cd /tmp',
+							`git clone --depth 1 https://github.com/vibesdotdev/monorepo.git || git clone https://github.com/vibesdotdev/monorepo.git`,
+							'cd monorepo/packages/verdaccio-better-auth-jwt',
+							'npm install',
+							'npm run build || true',
+							`cp -r ./dist/* ${pluginMountPath}/better-auth-jwt/ || true`,
+							'echo "Plugin installed"'
+						].join(' && ')],
+						volumeMounts: [
+							{ name: 'plugins', mountPath: pluginMountPath }
+						],
+						resources: {
+							requests: { cpu: '100m', memory: '64Mi' },
+							limits: { cpu: '500m', memory: '256Mi' }
+						}
+					}],
+					containers: [{
+						name: d.id,
+						image: cfg.dockerImage,
+						ports: [{ name: 'http', containerPort: port }],
+						envFrom: [{ secretRef: { name: secretName } }],
+						env: [
+							{ name: 'VERDACCIO_PORT', value: String(port) },
+							{ name: 'VERDACCIO_JWT_SECRET', valueFrom: { secretKeyRef: { name: secretName, key: 'jwt-secret' } } }
+						],
+						volumeMounts: [
+							{ name: 'storage', mountPath: '/verdaccio/storage' },
+							{ name: 'config', mountPath: '/verdaccio/conf', readOnly: true },
+							{ name: 'plugins', mountPath: pluginMountPath }
+						],
+						livenessProbe: {
+							httpGet: { path: '/', port },
+							initialDelaySeconds: 30,
+							periodSeconds: 30
+						},
+						readinessProbe: {
+							httpGet: { path: '/-/ping', port },
+							periodSeconds: 10
+						},
+						resources: {
+							requests: { cpu: '100m', memory: '128Mi' },
+							limits: { cpu: '500m', memory: '512Mi' }
+						}
+					}],
+					volumes: [
+						{ name: 'storage', persistentVolumeClaim: { claimName: pvcName } },
+						{ name: 'config', configMap: { name: `${name}-config` } },
+						{ name: 'plugins', emptyDir: {} }
+					]
+				}
+			}
+		}
+	};
+
+	const service: K8sService = {
+		apiVersion: 'v1',
+		kind: 'Service',
+		metadata: { name, namespace: ns },
+		spec: {
+			type: 'ClusterIP',
+			selector: { app: d.id },
+			ports: [{ name: 'http', port, targetPort: port }]
+		}
+	};
+
+	const pvc = {
+		apiVersion: 'v1',
+		kind: 'PersistentVolumeClaim',
+		metadata: { name: pvcName, namespace: ns, labels: { app: d.id } },
+		spec: {
+			accessModes: ['ReadWriteOnce'],
+			resources: { requests: { storage: cfg.storageSize } }
+		}
+	};
+
+	const configMap = {
+		apiVersion: 'v1',
+		kind: 'ConfigMap',
+		metadata: { name: `${name}-config`, namespace: ns, labels: { app: d.id } },
+		data: { [configKey]: configYaml }
+	};
+
+	const ingress = {
+		apiVersion: 'networking.k8s.io/v1',
+		kind: 'Ingress',
+		metadata: {
+			name,
+			namespace: ns,
+			labels: { app: d.id },
+			annotations: {
+				'cert-manager.io/cluster-issuer': 'letsencrypt-prod',
+				'nginx.ingress.kubernetes.io/proxy-body-size': '100m'
+			}
+		},
+		spec: {
+			tls: [{ hosts: [cfg.domain], secretName: `${name}-tls` }],
+			rules: [{
+				host: cfg.domain,
+				http: {
+					paths: [{
+						path: '/',
+						pathType: 'Prefix' as const,
+						backend: { service: { name, port: { number: port } } }
+					}]
+				}
+			}]
+		}
+	};
+
+	return { deployment, service, pvc, configMap, ingress };
+}
+
+export function createVerdaccioImpl(input: VerdaccioDoksDescriptorInput) {
+	const descriptor = VerdaccioDoksDescriptorSchema.parse(input);
+	return createRuntimeImplementation({
+		id: 'verdaccio-doks',
+		kind: 'infra/package-registry',
+		priority: 20,
+		implementation: {
+			generateConfig: () => generateVerdaccioManifest(descriptor)
+		}
+	});
+}

package/src/index.ts

@@ -0,0 +1,136 @@
+// Implementations
+export {
+	generateK8sDeployment,
+	DoksDeploymentDescriptorSchema,
+	type DoksDeploymentDescriptorInput,
+	type DoksDeploymentDescriptor
+} from './implementations/deployment.impl';
+export {
+	generateK8sStatefulSet,
+	DoksQueueDescriptorSchema,
+	DoksDatabaseDescriptorSchema,
+	type DoksQueueDescriptorInput,
+	type DoksQueueDescriptor,
+	type DoksDatabaseDescriptorInput,
+	type DoksDatabaseDescriptor
+} from './implementations/statefulset.impl';
+export {
+	generateDOManagedDB,
+	DOManagedPostgresDescriptorSchema,
+	type DOManagedPostgresDescriptorInput,
+	type DOManagedPostgresDescriptor
+} from './implementations/managed-db.impl';
+export {
+	generateDOSpaces,
+	DOSpacesDescriptorSchema,
+	type DOSpacesDescriptorInput,
+	type DOSpacesDescriptor
+} from './implementations/spaces.impl';
+export {
+	generateDOManagedRedis,
+	DOManagedRedisDescriptorSchema,
+	type DOManagedRedisDescriptorInput,
+	type DOManagedRedisDescriptor
+} from './implementations/managed-redis.impl';
+export {
+	generateGiteaManifest,
+	type GiteaManifest
+} from './implementations/gitea.impl';
+export {
+	generateVerdaccioManifest,
+	type VerdaccioManifest
+} from './implementations/verdaccio.impl';
+
+// Types
+export type {
+	K8sDeployment,
+	K8sStatefulSet,
+	K8sService,
+	K8sConfigMap,
+	K8sSecret,
+	K8sContainer,
+	K8sPodSpec,
+	K8sPodTemplateSpec,
+	K8sMetadata,
+	K8sLabelSelector,
+	K8sResourceRequirements,
+	K8sProbe,
+	K8sVolumeClaimTemplate,
+	DOManagedDBSpec,
+	DOManagedRedisSpec,
+	DOSpacesSpec,
+	// Cloud provider types
+	CloudProvider,
+	CloudInstance,
+	InstanceConfig,
+	InstanceFilters,
+	CloudVolume,
+	VolumeConfig,
+	VolumeFilters,
+	SSHKey,
+	CloudProviderConfig,
+	InstanceStatus,
+	VolumeStatus,
+	CloudProviderError,
+	// Kubernetes types
+	K8sConfig,
+	K8sEnvironment,
+	PodSelector,
+	PodStatus,
+	LogOptions,
+	LogEntry,
+	LogStream,
+	DeploymentStatus,
+	ServiceInfo,
+	PodMetrics,
+	ResourceMetrics,
+	K8sEvent,
+	ExecOptions,
+	ExecResult,
+	PortForwardOptions,
+	PortForward,
+	ContainerState,
+	PodPhase,
+	ConditionStatus,
+	DeploymentConditionType,
+	ServiceType,
+	ServiceProtocol,
+	EventType,
+	K8sError,
+	K8sAuthError,
+	K8sNotFoundError
+} from './types.ts';
+
+// Secrets
+export {
+	vaultDescriptor,
+	createVaultStore,
+	readKVSecret,
+	writeKVSecret,
+	deleteKVKey,
+	listKVPaths,
+} from './secrets/index.ts';
+export type { VaultClientConfig } from './secrets/index.ts';
+
+// Cloud Provider (implementation classes only; types already exported above)
+export {
+	BaseCloudProvider,
+	DigitalOceanProvider,
+	createCloudProvider,
+	getCloudProviderFromEnv,
+	validateCloudProviderConfig,
+} from './cloud/index.ts';
+
+// Kubernetes Client
+export { KubernetesClient } from './kubernetes/index.ts';
+
+// Plugin
+export { default as doksPlugin } from './doks.plugin';
+
+// Runtime clients
+export {
+	DigitalOceanAppDeployClient,
+	getDigitalOceanAppDeployClient,
+	type DeployAppOptions,
+	type DeployAppResult
+} from './client/index.ts';