@wpelevator/tug 0.3.0 → 0.5.0

package/README.md

@@ -6,15 +6,15 @@ Deploy Docker Compose projects to one or more ordinary Linux VPSes through a sma
 
 ## Features
 
-- Control API with bearer-token auth, scoped `read`/`deploy`/`admin` API tokens for CI and teammates, an audit trail naming who acted, and SQLite metadata.
-- Nodes join over SSH (`node-install`) or enroll themselves with a single `docker run` (`node-enroll`), with per-node agent and registry tokens. Agents only dial out, so nodes behind NAT work.
-- Agents pull desired state from control, apply a generated per-node Compose file, run TCP/HTTP/Docker health checks and report status. An outbound WebSocket wakes them as soon as control queues work and carries live `exec`, followed logs, `ps` and `inspect` sessions, with long-poll and periodic-poll fallbacks for ordinary work.
+- Control API with bearer-token auth, scoped `read`/`deploy`/`admin` API tokens for CI and teammates, an audit trail naming who acted, and SQLite metadata through Node's built-in driver.
+- Nodes join over SSH (`node-install`) or enroll themselves with a single `docker run` (`node-enroll`), with one agent token per node. Agents only dial out, so nodes behind NAT work.
+- Agents pull desired state from control, reconcile containers through the Docker Engine API, run TCP/HTTP/Docker health checks and report status. An outbound WebSocket wakes them as soon as control queues work and carries live `exec`, followed logs, `ps` and `inspect` sessions, with long-poll and periodic-poll fallbacks for ordinary work.
 - `x-tug` placement of services and volumes on nodes, with immutable desired-state records per deployment.
-- Build application images on control from uploaded source, or locally with `deploy --build-local`. Agents download saved images directly from control by default; a bring-your-own registry is optional.
+- Build application images on control from uploaded source, or locally with `deploy --build-local`. Agents download saved images directly from control. Published images are pinned to registry digests at deployment creation.
 - Secrets encrypted at rest, released only to the nodes whose services reference them, with targeted service recreation when only a secret changes.
 - Deployment convergence, per-project operation locks, cancellation, rollback, per-service rollout events and log fetching through the agents.
 - Opt-in zero-downtime rolling rollouts for ingress-fronted services (`x-tug.rollout`) and automatic rollback of failed deployments (`x-tug.rollback: auto`). See [Compose extensions](docs/compose.md#rolling-rollouts).
-- Per-node registry pull tokens enforced by an htpasswd-backed registry you provide, with rotation and revocation.
+- Private published images use encrypted project credentials for digest resolution and Engine API pulls.
 - Optional WireGuard mesh between nodes, health-aware cross-node service names and a managed Caddy ingress with automatic HTTPS, each opt-in. See [Networking](docs/networking.md).
 - Private-by-default published ports: generated Compose binds them to the overlay IP, loopback or the node address, never every interface unless you write `0.0.0.0`. See [Networking](docs/networking.md#published-ports-private-by-default).
 - Control-plane backup and restore, and `tug doctor` diagnostics.
@@ -31,7 +31,6 @@ Deploy Docker Compose projects to one or more ordinary Linux VPSes through a sma
 |   Control API (role-checked)        |
 |   SQLite: desired states, secrets   |
 |   image builds, saved images        |
-|   registry (optional)               |
 +-------------------------------------+
        ^                       ^
        |  agents dial out: work, status,
@@ -72,7 +71,7 @@ The CLI installs the matching `ghcr.io/wpelevator/tug:<version>` image on your h
 
 - [Architecture](docs/architecture.md): components, reconciliation, workflow diagrams, secrets and runtime paths.
 - [Compose extensions](docs/compose.md): `x-tug` placement, health checks, volumes and limitations.
-- [Control plane](docs/control-plane.md): install, TLS, registry credentials, backup and restore.
+- [Control plane](docs/control-plane.md): install, TLS, image delivery, backup and restore.
 - [Backups](docs/backups.md): interim WordPress backup sidecar with restic, per-node and NFS variants, and a restore drill until `x-tug.backup` (M11).
 - [Access control](docs/access-control.md): scoped API tokens, roles, audit trail and a GitHub Actions deploy example.
 - [Networking](docs/networking.md): WireGuard mesh, service DNS, ingress and TLS, firewall notes.
@@ -80,7 +79,7 @@ The CLI installs the matching `ghcr.io/wpelevator/tug:<version>` image on your h
 - [CLI reference](docs/cli.md): every `tug` command and option.
 - [Configuration](docs/configuration.md): CLI, control and agent environment variables.
 - [Development](docs/development.md): local setup, CI, Compose stack, host mode and the integration test.
-- [Testing](docs/testing.md): test layers, the numbers rollouts are held to, and the backlog of mocked tests.
+- [Testing](docs/testing.md): test layers, rollout metrics, mocked test backlog, and the [Caddy/PHP and static-file benchmark](docs/testing.md#caddy-proxy-overhead-benchmark).
 - [Observability](docs/observability.md): what can be observed today, and the proposed logs, metrics and alerting.
 - [Releases](docs/releases.md): changesets, npm and Docker image publishing.
 - [Standalone binary](docs/standalone-binary.md): proposed Bun-compiled CLI binaries and Homebrew distribution.

package/dist/agent.d.ts

@@ -1,12 +1,13 @@
 #!/usr/bin/env node
 import { WebSocket } from 'ws';
+import type { ContainerSummary, DockerApi } from './docker-api.ts';
 import type { AgentLiveCommand, AgentLiveFrame } from './protocol.ts';
 import type { LiveEngineOptions } from './live.ts';
 import { parseDuration } from './util.ts';
-import type { DockerRunner, HostRunner, HttpClient } from './runners.ts';
+import type { HostRunner, HttpClient } from './runners.ts';
 import type { Command, CommandResult, DesiredState, HealthCheck, ProjectStatus, ImageArtifact, PortBinding, ServiceEndpoint } from './protocol.ts';
 export interface AgentContext {
-    docker: DockerRunner;
+    docker: DockerApi;
     http: HttpClient;
     nodeName: string;
     stateDir: string;
@@ -57,25 +58,23 @@ export declare class AgentLiveOperations {
     private readonly emit;
     private readonly engine;
     private readonly sessions;
-    constructor(ctx: AgentContext, emit: (frame: AgentLiveOutputFrame) => void, options?: Omit<LiveEngineOptions, 'emit'>);
+    constructor(ctx: AgentContext, emit: (frame: AgentLiveOutputFrame) => void, options?: Omit<LiveEngineOptions, 'emit' | 'docker'>);
     handle(frame: AgentLiveControlFrame): Promise<void>;
     dispose(): void;
     private fail;
     private open;
 }
-export declare function containerIp(ctx: AgentContext, project: string, service: string, cwd: string, composeFile?: string): Promise<string>;
-export declare function waitForHealth(ctx: AgentContext, project: string, service: string, health: HealthCheck | null | undefined, cwd: string, composeFile?: string): Promise<void>;
+/** The container's address on the project network, which health checks dial. */
+export declare function containerIp(ctx: AgentContext, project: string, container: string): Promise<string>;
+export declare function waitForHealth(ctx: AgentContext, project: string, container: string, service: string, health: HealthCheck | null | undefined): Promise<void>;
 export { parseDuration };
 export interface PublicListener {
     project: string;
     container: string;
     listen: string;
 }
-/**
- * Containers of Tug projects (`projects`, plus their rolling revision projects `<project>-…`) that
- * listen on all interfaces or on a public IP, from `docker ps --format '{{.Label "com.docker.compose.project"}}\t{{.Names}}\t{{.Ports}}'`.
- */
-export declare function publicListeners(psOutput: string, projects: readonly string[]): PublicListener[];
+/** Containers of Tug projects (`projects`) that publish a port on all interfaces or on a public IP. */
+export declare function publicListeners(containers: ContainerSummary[], projects: readonly string[]): PublicListener[];
 export declare function executeCommand(command: Command, ctx?: AgentContext): Promise<CommandResult>;
 export declare function ensureArtifact(ctx: AgentContext, artifact: ImageArtifact): Promise<void>;
 export declare function pruneManagedImages(ctx: AgentContext, retained: string[]): Promise<void>;
@@ -94,8 +93,6 @@ interface Creds {
     agentToken: string;
     nodeName?: string;
     controlUrl?: string;
-    registry?: string | null;
-    registryToken?: string | null;
 }
 export declare function loadOrEnroll(): Promise<Creds>;
 export declare function main(): Promise<void>;