@wpelevator/tug 0.8.0 → 0.10.0

package/dist/compose.js

@@ -289,6 +289,15 @@ export function ingressHostsOf(compose) {
     }
     return hosts;
 }
+/** True when two lowercase ingress hosts could route the same request: equal, or one is a `*.` wildcard covering the other. */
+export function ingressHostsOverlap(a, b) {
+    if (a === b)
+        return true;
+    const suffix = (host) => (host.startsWith('*.') ? host.slice(1) : undefined);
+    const wa = suffix(a);
+    const wb = suffix(b);
+    return (wa !== undefined && b.endsWith(wa)) || (wb !== undefined && a.endsWith(wb));
+}
 export function validateCompose(compose, nodes = []) {
     if (!compose?.services || typeof compose.services !== 'object')
         throw new Error('compose file must define services');

package/dist/container-spec.d.ts

@@ -1,4 +1,5 @@
 import type { CreateContainerBody } from './docker-api.ts';
+import type { VolumeInspect } from './docker-api.ts';
 import type { DesiredState, ServiceEndpoint } from './protocol.ts';
 import type { PortBind } from './compose.ts';
 export declare const LABEL_PROJECT = "tug.project";
@@ -7,10 +8,14 @@ export declare const LABEL_JOB = "tug.job";
 export declare const LABEL_SERVICE = "tug.service";
 export declare const LABEL_REVISION = "tug.revision";
 export declare const LABEL_HASH = "tug.config-hash";
+/** Never treat a Docker name alone as proof of ownership; validate its labels before reuse. */
+export declare function assertVolumeOwnership(volume: VolumeInspect, project: string, name: string): void;
 /** The project network every container of the project joins; service names are its aliases. */
 export declare const networkName: (project: string) => string;
 /** Docker volume name for a Compose volume; `external` volumes keep their own name. */
 export declare const volumeName: (project: string, volume: string) => string;
+/** Scratch volumes occupy a separate namespace from project-managed volumes. */
+export declare const scratchVolumeName: (project: string, restore: string) => string;
 export declare const containerName: (project: string, service: string, hash: string) => string;
 export interface VolumeSpec {
     /** Docker volume name. */

package/dist/container-spec.js

@@ -9,10 +9,17 @@ export const LABEL_JOB = 'tug.job';
 export const LABEL_SERVICE = 'tug.service';
 export const LABEL_REVISION = 'tug.revision';
 export const LABEL_HASH = 'tug.config-hash';
+/** Never treat a Docker name alone as proof of ownership; validate its labels before reuse. */
+export function assertVolumeOwnership(volume, project, name) {
+    if (volume.Labels?.[LABEL_PROJECT] !== project || volume.Labels?.['tug.volume'] !== name)
+        throw new Error(`volume ${volume.Name} is not owned by project ${project} as volume ${name}`);
+}
 /** The project network every container of the project joins; service names are its aliases. */
 export const networkName = (project) => `tug_${project}`;
 /** Docker volume name for a Compose volume; `external` volumes keep their own name. */
-export const volumeName = (project, volume) => `tug_${project}_${volume}`;
+export const volumeName = (project, volume) => `tug_v${project.length}_${project}_${volume}`;
+/** Scratch volumes occupy a separate namespace from project-managed volumes. */
+export const scratchVolumeName = (project, restore) => `tug_r${project.length}_${project}_${restore}`;
 export const containerName = (project, service, hash) => `tug-${project}-${service}-${hash.slice(0, 8)}`;
 const SECOND_NS = 1_000_000_000;
 const UNITS = {
@@ -113,10 +120,12 @@ function volumeSpecs(desired, node, used) {
     for (const key of [...used].sort()) {
         const def = desired.compose.volumes?.[key] || {};
         const xe = def['x-tug'] || {};
+        const customLabels = { ...(def.labels || {}) };
+        delete customLabels['tug.restore'];
         const labels = {
+            ...customLabels,
             [LABEL_PROJECT]: desired.project,
             'tug.volume': key,
-            ...(def.labels || {}),
         };
         if (def.external) {
             out.push({

package/dist/control-credential.d.ts

@@ -2,6 +2,8 @@ export interface IssueArgs {
     name: string;
     role: string;
     replace: boolean;
+    /** The control URL to write into the credential; defaults to `TUG_CONTROL_URL`. */
+    controlUrl?: string;
 }
 export declare function parseIssueArgs(argv: string[]): IssueArgs;
 /**

package/dist/control-credential.js

@@ -25,15 +25,15 @@ export function parseIssueArgs(argv) {
  */
 export async function issueHostCredential(args) {
     const dataDir = process.env.TUG_DATA_DIR || './data';
-    const publicUrl = process.env.TUG_PUBLIC_URL;
-    if (!publicUrl)
-        throw new Error('TUG_PUBLIC_URL is required');
+    const controlUrl = args.controlUrl ?? process.env.TUG_CONTROL_URL;
+    if (!controlUrl)
+        throw new Error('TUG_CONTROL_URL is required');
     const db = await openDb(path.join(dataDir, 'tug.db'));
     try {
         const fresh = !db.get('SELECT 1 FROM operator_credentials') && !db.get('SELECT 1 FROM nodes');
         const pki = await Pki.load(path.join(dataDir, 'pki'), fresh);
         const request = parseCredentialRequest({ name: args.name, role: args.role });
-        const created = await createCredential(db, pki, new URL(publicUrl).origin, request, 'host', {
+        const created = await createCredential(db, pki, new URL(controlUrl).origin, request, 'host', {
             replace: args.replace,
         });
         if (args.replace)

package/dist/control.d.ts

@@ -27,7 +27,7 @@ export declare function createApp(options?: {
     openDatabase?: typeof openDb;
     /** Minimum time between event prunes triggered by agent reports; default one hour. */ eventPruneIntervalMs?: number;
     /** Override the live open/agent startup timeout in milliseconds. */ liveStartTimeoutMs?: number;
-    /** Credential-free HTTPS origin clients use to reach control; defaults to `TUG_PUBLIC_URL`. */ publicUrl?: string;
+    /** Credential-free HTTPS origin clients connect to by default; defaults to `TUG_CONTROL_URL`. */ controlUrl?: string;
     /**
      * Replaces certificate-based identity resolution. Only for in-process tests that skip TLS; production never sets it.
      * It returns the principal URI and key hash a connection would have presented.

package/dist/control.js

@@ -16,15 +16,15 @@ import * as tar from 'tar';
 import { openDb, openSnapshotDb } from "./db.js";
 import { isUniqueViolation } from "./db-driver.js";
 import { encrypt, decrypt, loadOrCreateMasterKey } from "./secrets.js";
-import { buildDesiredState, ingressHostsOf, loopbackIngressServices, serviceSecretNames, validateCompose, } from "./compose.js";
+import { buildDesiredState, ingressHostsOf, ingressHostsOverlap, loopbackIngressServices, serviceSecretNames, validateCompose, } from "./compose.js";
 import { buildImage, unpackContext, run as runCommand } from "./build.js";
 import { sentinelNames } from "./normalize.js";
 import { ensureDir, errMessage, id, now } from "./util.js";
 import { ENROLL_DEFAULT_TTL_MS, NODE_LIFETIME_MS, Pki, SERVER_LIFETIME_MS, encodeCredential, identityUri, namesKey, parseIdentityUri, peerIdentity, serverNames, writeFileDurable, } from "./pki.js";
 import { EXPIRY_WARN_DAYS, certificateExpiry, diagnoseNode } from "./diagnostics.js";
 import { serverTlsOptions } from "./tls-server.js";
-import { DEFAULT_MESH_CIDR, DEFAULT_WG_PORT, WG_INTERFACE, WG_KEEPALIVE, allocateOverlayIp, isWgKey, parseCidr, wgEndpoint, } from "./mesh.js";
-import { buildIngressWork, resolveServiceEndpoints } from "./ingress.js";
+import { isNodeHost } from "./node-address.js";
+import { buildIngressWork, ingressConfigHash, resolveServiceEndpoints } from "./ingress.js";
 import { parseStatusReport } from "./status-report.js";
 import { ACTIVE_DEPLOYMENT_STATES, LIVE_MAX_FRAME_BYTES, LIVE_MAX_BUFFERED_BYTES, LIVE_MAX_SESSIONS, LIVE_START_TIMEOUT_MS, BACKUP_COMMAND_TYPES, } from "./protocol.js";
 import { BACKUP_SECRET_PROJECT, isReservedProject, parseBackupDestination, projectRepository, repositoryPassword, redactSecrets, } from "./backup-destination.js";
@@ -431,14 +431,8 @@ export async function createApp(options = {}) {
     });
     const dbFile = path.join(DATA_DIR, 'tug.db');
     const masterKeyFile = path.join(DATA_DIR, 'master.key');
-    // Networking layers are opt-in; with all of them off the work response is unchanged.
-    const MESH = process.env.TUG_MESH === 'true';
-    const MESH_CIDR = process.env.TUG_MESH_CIDR || DEFAULT_MESH_CIDR;
-    const WG_PORT = Number(process.env.TUG_WG_PORT || DEFAULT_WG_PORT);
-    const SERVICE_DNS = (process.env.TUG_SERVICE_NAMES ?? String(MESH)) === 'true';
+    const SERVICE_DNS = process.env.TUG_SERVICE_NAMES !== 'false';
     const ACME_EMAIL = process.env.TUG_ACME_EMAIL || undefined;
-    if (MESH)
-        parseCidr(MESH_CIDR);
     const db = await (options.openDatabase || openDb)(dbFile);
     const wakeHub = new WakeHub();
     // Events are an operator-facing log, not a record of truth, so keep them bounded. `0` turns a limit off; anything that is
@@ -479,14 +473,16 @@ export async function createApp(options = {}) {
     const masterKey = await loadOrCreateMasterKey(masterKeyFile);
     // A CA is created only for a fresh installation; existing state with missing or mismatched CA material is a startup error.
     const pki = await Pki.load(path.join(DATA_DIR, 'pki'), !db.get('SELECT 1 FROM operator_credentials') && !db.get('SELECT 1 FROM nodes'));
-    const publicUrl = () => {
-        const url = options.publicUrl ?? process.env.TUG_PUBLIC_URL;
+    const configuredControlUrl = options.controlUrl ?? process.env.TUG_CONTROL_URL;
+    const controlUrl = () => {
+        const url = configuredControlUrl;
         if (!url)
-            throw httpError(500, 'TUG_PUBLIC_URL is not set');
+            throw httpError(500, 'TUG_CONTROL_URL is not set');
         return new URL(url).origin;
     };
     const app = express();
     app.locals.pki = pki;
+    app.locals.controlUrl = configuredControlUrl;
     app.locals.dataDir = DATA_DIR;
     /** Resolves a presented certificate (principal URI and key hash) to a principal from current database state. */
     function resolvePrincipal(uri, keyHash) {
@@ -685,7 +681,40 @@ export async function createApp(options = {}) {
             ? JSON.parse(byNode.get(node)?.status_json || '{}').observedRevision === state.revision
             : byNode.get(node)?.observed_version === state.version) &&
             ['serving', 'skipped'].includes(byNode.get(node)?.health ?? ''));
-        if (ok)
+        // For projects using managed ingress, wait until each enabled ingress node has applied
+        // the current routing configuration. Container health alone does not prove a switch.
+        const ingressServices = Object.entries(state.compose.services || {})
+            .filter(([, service]) => service['x-tug']?.ingress)
+            .map(([name]) => name);
+        // A revision that removes its last route must wait for that removal too.
+        const previous = db.get(`SELECT ds.state_json FROM desired_states ds JOIN deployments d ON d.id=ds.deployment_id
+       WHERE d.project_id=? AND d.id<>? AND d.state='succeeded' ORDER BY d.created_at DESC LIMIT 1`, projectId, project.current_deployment_id);
+        const previouslyRouted = previous
+            ? Object.values(JSON.parse(previous.state_json).compose.services || {}).some((service) => service['x-tug']?.ingress)
+            : false;
+        const ingressNodes = ingressServices.length || previouslyRouted
+            ? db.all('SELECT * FROM nodes WHERE ingress=1 AND disabled_at IS NULL')
+            : [];
+        const staleBefore = new Date(Date.now() - Number(process.env.TUG_STALE_SECONDS || 60) * 1000).toISOString();
+        const ingressReady = !ingressNodes.length ||
+            ingressNodes.every((node) => {
+                const work = ingressFor(node, currentDesiredStates());
+                if (!ingressServices.every((service) => work.routes.some((route) => route.project === projectId && route.service === service && route.upstreams.length)))
+                    return false;
+                if (!node.ingress_status_json)
+                    return false;
+                try {
+                    const status = JSON.parse(node.ingress_status_json);
+                    return (status.state === 'serving' &&
+                        status.configHash === ingressConfigHash(work) &&
+                        typeof status.reportedAt === 'string' &&
+                        status.reportedAt >= staleBefore);
+                }
+                catch {
+                    return false;
+                }
+            });
+        if (ok && ingressReady)
             db.run('UPDATE deployments SET state=?,updated_at=? WHERE id=? AND state=?', 'succeeded', now(), project.current_deployment_id, 'rolling_out');
     }
     /** Events control writes when it rolls back on its own; they are attributed to a reserved system actor. */
@@ -708,11 +737,10 @@ export async function createApp(options = {}) {
         for (const other of currentDesiredStates()) {
             if (other.project === project)
                 continue;
-            for (const [host, service] of ingressHostsOf(other.compose)) {
-                const mine = wanted.get(host);
-                if (mine)
-                    throw httpError(409, `${mine}: ingress.host ${host} is already routed by project ${other.project} (${service})`);
-            }
+            for (const [host, service] of ingressHostsOf(other.compose))
+                for (const [wantedHost, mine] of wanted)
+                    if (ingressHostsOverlap(wantedHost, host))
+                        throw httpError(409, `${mine}: ingress.host ${wantedHost} ${wantedHost === host ? 'is' : `overlaps ${host},`} already routed by project ${other.project} (${service})`);
         }
     }
     function createRollback(project, opts) {
@@ -938,41 +966,7 @@ export async function createApp(options = {}) {
     /** A node whose agent has been seen before but not within TUG_STALE_SECONDS; never-seen (just registered) nodes stay schedulable. */
     const isStale = (row) => !!row.last_seen_at &&
         Date.parse(row.last_seen_at) < Date.now() - Number(process.env.TUG_STALE_SECONDS || 60) * 1000;
-    const NODE_INFO_SQL = 'SELECT id,name,address,public_address,overlay_ip,labels_json,status,created_at,updated_at FROM nodes WHERE id=?';
-    /** Allocates the node's stable overlay IP on first registration (retrying if a concurrent register took it). */
-    function ensureOverlayIp(nodeId) {
-        if (!MESH)
-            return;
-        for (let attempt = 0; attempt < 5; attempt++) {
-            const row = db.get('SELECT overlay_ip FROM nodes WHERE id=?', nodeId);
-            if (row?.overlay_ip)
-                return;
-            const used = db
-                .all('SELECT overlay_ip FROM nodes WHERE overlay_ip IS NOT NULL')
-                .map((r) => r.overlay_ip);
-            try {
-                db.run('UPDATE nodes SET overlay_ip=? WHERE id=? AND overlay_ip IS NULL', allocateOverlayIp(MESH_CIDR, used), nodeId);
-                return;
-            }
-            catch (e) {
-                if (!isUniqueViolation(e))
-                    throw e;
-            }
-        }
-        throw new Error('could not allocate an overlay address');
-    }
-    /** Stores (or refreshes) the node's WireGuard peer entry; the private key never reaches control. */
-    function syncWgPeer(nodeId, publicKey) {
-        if (!MESH)
-            return;
-        const node = db.get('SELECT * FROM nodes WHERE id=?', nodeId);
-        const existing = db.get('SELECT * FROM wg_peers WHERE node_id=?', nodeId);
-        const key = publicKey ?? existing?.public_key;
-        if (!node?.overlay_ip || !key)
-            return;
-        db.run(`INSERT INTO wg_peers(node_id,public_key,overlay_ip,endpoint,allowed_ips,updated_at) VALUES(?,?,?,?,?,?)
-      ON CONFLICT(node_id) DO UPDATE SET public_key=excluded.public_key,overlay_ip=excluded.overlay_ip,endpoint=excluded.endpoint,allowed_ips=excluded.allowed_ips,updated_at=excluded.updated_at`, nodeId, key, node.overlay_ip, wgEndpoint(node.public_address, WG_PORT) ?? null, `${node.overlay_ip}/32`, now());
-    }
+    const NODE_INFO_SQL = 'SELECT id,name,address,labels_json,status,created_at,updated_at FROM nodes WHERE id=?';
     const NODE_RENEW_MIN_INTERVAL_MS = () => Number(process.env.TUG_RENEW_MIN_INTERVAL_MS ?? 60 * 60 * 1000);
     const nodeInfo = (nodeId) => {
         const row = db.get(NODE_INFO_SQL, nodeId);
@@ -982,8 +976,6 @@ export async function createApp(options = {}) {
             id: row.id,
             name: row.name,
             address: row.address,
-            public_address: row.public_address,
-            overlay_ip: row.overlay_ip,
             labels: row.labels_json ? JSON.parse(row.labels_json) : [],
             status: row.status,
             created_at: row.created_at,
@@ -995,20 +987,18 @@ export async function createApp(options = {}) {
     function insertNode(input) {
         if (!NODE_NAME.test(input.name))
             throw httpError(400, 'node name must be 1-63 letters, numbers, dots, underscores or hyphens');
-        if (input.wgPublicKey !== undefined && !isWgKey(input.wgPublicKey))
-            throw httpError(400, 'wgPublicKey must be a base64 WireGuard public key');
+        if (input.address && !isNodeHost(input.address))
+            throw httpError(400, 'address must be an IP address or hostname without a port');
         const ts = now();
-        db.run(`INSERT INTO nodes(id,name,address,public_address,status,labels_json,key_hash,cert_not_after,created_at,updated_at)
-      VALUES(?,?,?,?,?,?,?,?,?,?)`, input.id, input.name, input.address || null, input.publicAddress || null, 'registered', JSON.stringify(Array.isArray(input.labels) ? input.labels : []), input.keyHash, input.notAfter.toISOString(), ts, ts);
-        ensureOverlayIp(input.id);
-        syncWgPeer(input.id, input.wgPublicKey);
+        db.run(`INSERT INTO nodes(id,name,address,status,labels_json,key_hash,cert_not_after,created_at,updated_at)
+      VALUES(?,?,?,?,?,?,?,?,?)`, input.id, input.name, input.address || null, 'registered', JSON.stringify(Array.isArray(input.labels) ? input.labels : []), input.keyHash, input.notAfter.toISOString(), ts, ts);
         wakeAll();
     }
     const identityResponse = (nodeId, cert) => ({
         node: nodeInfo(nodeId),
         certificate: cert,
         ca: pki.caPem,
-        url: publicUrl(),
+        url: controlUrl(),
     });
     // The node generates its key and CSR; an admin posts the CSR here. The private key is never transmitted.
     api('post', '/api/v1/nodes/:name/identity', null, async (req, res) => {
@@ -1044,7 +1034,6 @@ export async function createApp(options = {}) {
                         keyHash: signed.keyHash,
                         notAfter: signed.notAfter,
                         address: body.address,
-                        publicAddress: body.publicAddress,
                         labels: body.labels,
                     });
                 }
@@ -1052,13 +1041,18 @@ export async function createApp(options = {}) {
             else {
                 if (!existing)
                     return res.status(404).json({ error: 'node not found' });
-                db.run("UPDATE nodes SET key_hash=?,disabled_at=NULL,status='registered',cert_not_after=?,updated_at=? WHERE id=?", signed.keyHash, signed.notAfter.toISOString(), now(), existing.id);
+                if (body.address !== undefined && !isNodeHost(body.address))
+                    throw httpError(400, 'address must be an IP address or hostname without a port');
+                const address = body.address === undefined ? existing.address : body.address;
+                db.run("UPDATE nodes SET key_hash=?,disabled_at=NULL,status='registered',cert_not_after=?,address=?,updated_at=? WHERE id=?", signed.keyHash, signed.notAfter.toISOString(), address || null, now(), existing.id);
                 audit(req.actor, {
                     type: 'node.replaced',
                     message: `node ${name} key replaced by ${req.actor.name}`,
                     metadata: { node: name },
                 });
                 reconcileSockets();
+                endpointSnapshot = JSON.stringify(endpointsFor(currentDesiredStates()));
+                wakeAll();
             }
             res.json(identityResponse(nodeId, signed.cert));
         }
@@ -1079,7 +1073,7 @@ export async function createApp(options = {}) {
             return res.status(400).json({ error: 'labels must be a list of strings' });
         const ttlSeconds = Math.max(1, Number(req.body.ttlSeconds ?? ENROLL_DEFAULT_TTL_MS / 1000));
         const rowId = id('enr');
-        const issued = await pki.issueClient(identityUri('enroll', rowId), ttlSeconds * 1000, publicUrl());
+        const issued = await pki.issueClient(identityUri('enroll', rowId), ttlSeconds * 1000, controlUrl());
         const expiresAt = issued.notAfter.toISOString();
         db.run('DELETE FROM enrollment_credentials WHERE expires_at < ?', new Date(Date.now() - 86_400_000).toISOString());
         // Minting again for a name revokes its previous unconsumed key.
@@ -1120,8 +1114,6 @@ export async function createApp(options = {}) {
                     keyHash: signed.keyHash,
                     notAfter: signed.notAfter,
                     address: body.address,
-                    publicAddress: body.publicAddress,
-                    wgPublicKey: body.wgPublicKey,
                     labels: fresh.labels_json ? JSON.parse(fresh.labels_json) : [],
                 });
                 db.run('UPDATE enrollment_credentials SET node_id=?,node_key_hash=? WHERE id=?', fresh.reserved_node_id, signed.keyHash, fresh.id);
@@ -1170,13 +1162,13 @@ export async function createApp(options = {}) {
             metadata: { node: node.name },
         });
         reconcileSockets();
-        // Healthy peers drop the node from their mesh and ingress configuration on their next work fetch.
+        // Other nodes drop the node from service endpoints and ingress configuration on their next work fetch.
         endpointSnapshot = JSON.stringify(endpointsFor(currentDesiredStates()));
         wakeAll();
         res.json({ ok: true, node: node.name });
     });
     api('get', '/api/v1/nodes', null, async (req, res) => {
-        const rows = db.all('SELECT id,name,address,public_address,overlay_ip,ingress,ingress_status_json,status,labels_json,last_seen_at,disabled_at,cert_not_after,created_at,updated_at FROM nodes ORDER BY name');
+        const rows = db.all('SELECT id,name,address,ingress,ingress_status_json,status,labels_json,last_seen_at,disabled_at,cert_not_after,created_at,updated_at FROM nodes ORDER BY name');
         res.json({
             nodes: rows.map((row) => {
                 const { labels_json, ...rest } = row;
@@ -1194,17 +1186,7 @@ export async function createApp(options = {}) {
         wakeHub.wake(nodeId, projectId ?? undefined);
         return commandId;
     }
-    // The private key lives only on the node, so rotation is a command the agent executes: it
-    // generates a new keypair, reports the public key and peers pick it up from their next work response.
-    api('post', '/api/v1/nodes/:name/rotate-wg-key', null, async (req, res) => {
-        if (!MESH)
-            return res.status(409).json({ error: 'the WireGuard mesh is not enabled (TUG_MESH=true)' });
-        const node = findNode(String(req.params.name));
-        if (!node)
-            return res.status(404).json({ error: 'node not found' });
-        res.json({ commandId: queueCommand(node.id, null, 'wg.rotate-key'), nodeId: node.id });
-    });
-    // Removes a retired node: its identity, WireGuard peer, statuses and queued commands. Refused while a current deployment still places
+    // Removes a retired node: its identity, statuses and queued commands. Refused while a current deployment still places
     // something on it (redeploy without it first) or while its agent is still reporting, unless force=true.
     api('delete', '/api/v1/nodes/:name', null, async (req, res) => {
         const node = db.get('SELECT id,name,last_seen_at FROM nodes WHERE name=? OR id=?', String(req.params.name), String(req.params.name));
@@ -1229,7 +1211,6 @@ export async function createApp(options = {}) {
             });
         db.run('DELETE FROM commands WHERE node_id=?', node.id);
         db.run('DELETE FROM node_statuses WHERE node_id=?', node.id);
-        db.run('DELETE FROM wg_peers WHERE node_id=?', node.id);
         db.run('DELETE FROM nodes WHERE id=?', node.id);
         db.run('UPDATE enrollment_credentials SET revoked_at=COALESCE(revoked_at,?) WHERE name=? AND node_id IS NULL', now(), node.name);
         reconcileSockets();
@@ -1241,33 +1222,37 @@ export async function createApp(options = {}) {
         wakeAll();
         res.json({ ok: true, node: node.name });
     });
+    api('post', '/api/v1/nodes/:name/address', null, async (req, res) => {
+        const node = findNode(String(req.params.name));
+        if (!node)
+            return res.status(404).json({ error: 'node not found' });
+        const { address } = req.body;
+        if (!isNodeHost(address))
+            return res
+                .status(400)
+                .json({ error: 'address must be an IP address or hostname without a port' });
+        db.run('UPDATE nodes SET address=?,updated_at=? WHERE id=?', address, now(), node.id);
+        audit(req.actor, {
+            type: 'node.address',
+            message: `node ${node.name} address changed`,
+            metadata: { node: node.name, address },
+        });
+        endpointSnapshot = JSON.stringify(endpointsFor(currentDesiredStates()));
+        wakeAll();
+        res.json({ ok: true, node: node.name, address });
+    });
     api('post', '/api/v1/nodes/:name/ingress', null, async (req, res) => {
         const node = findNode(String(req.params.name));
         if (!node)
             return res.status(404).json({ error: 'node not found' });
         const enabled = req.body.enabled !== false;
-        db.run('UPDATE nodes SET ingress=?,updated_at=? WHERE id=?', enabled ? 1 : 0, now(), node.id);
+        db.run('UPDATE nodes SET ingress_status_json=CASE WHEN ingress<>? THEN NULL ELSE ingress_status_json END,ingress=?,updated_at=? WHERE id=?', enabled ? 1 : 0, enabled ? 1 : 0, now(), node.id);
         wakeHub.wake(node.id);
         res.json({ ok: true, node: node.name, ingress: enabled });
     });
-    post('/agent/v1/wireguard/key', authAgent, async (req, res) => {
-        if (!MESH)
-            return res.status(409).json({ error: 'the WireGuard mesh is not enabled' });
-        const { publicKey } = req.body;
-        if (!isWgKey(publicKey))
-            return res.status(400).json({ error: 'publicKey must be a base64 WireGuard public key' });
-        try {
-            syncWgPeer(req.node.id, publicKey);
-            wakeAll();
-            res.json({ ok: true });
-        }
-        catch (e) {
-            sendError(res, isUniqueViolation(e) ? httpError(409, 'public key already registered to another node') : e);
-        }
-    });
     api('post', '/api/v1/credentials', null, async (req, res) => {
         const request = parseCredentialRequest(req.body);
-        const created = await createCredential(db, pki, publicUrl(), request, req.actor.name);
+        const created = await createCredential(db, pki, controlUrl(), request, req.actor.name);
         audit(req.actor, {
             type: 'credential.create',
             message: `credential ${created.name} (${created.role}${created.projects ? `, projects: ${created.projects.join(', ')}` : ''}) created by ${req.actor.name}`,
@@ -1624,6 +1609,10 @@ export async function createApp(options = {}) {
                 }
             }
             const nodes = nodeRows.map((row) => ({ name: row.name }));
+            for (const [name, svc] of Object.entries(compose.services || {}))
+                for (const node of svc['x-tug']?.placement?.nodes || [])
+                    if (!nodes.some((n) => n.name === node))
+                        throw httpError(400, `${name}: placement node ${node} is not an enabled node`);
             try {
                 validateCompose(compose, nodes.map((n) => n.name));
             }
@@ -2212,15 +2201,6 @@ export async function createApp(options = {}) {
         await check('docker', async () => ({
             output: (await runCommand('docker', ['version', '--format', '{{.Server.Version}}'])).out.trim(),
         }));
-        if (MESH) {
-            await check('mesh', async () => {
-                const nodes = db.all('SELECT n.name, n.overlay_ip, EXISTS(SELECT 1 FROM wg_peers w WHERE w.node_id=n.id) AS has_key FROM nodes n');
-                const missing = nodes.filter((n) => !n.has_key).map((n) => n.name);
-                if (missing.length)
-                    throw new Error(`nodes without a reported WireGuard key (is TUG_MESH=true on their agents?): ${missing.join(', ')}`);
-                return { cidr: MESH_CIDR, port: WG_PORT, nodes: nodes.length };
-            });
-        }
         const ingressNodes = db.all('SELECT name,ingress_status_json FROM nodes WHERE ingress=1');
         if (ingressNodes.length) {
             await check('ingress', async () => {
@@ -2254,10 +2234,9 @@ export async function createApp(options = {}) {
     }
     function endpointsFor(states) {
         const staleBefore = new Date(Date.now() - Number(process.env.TUG_STALE_SECONDS || 60) * 1000).toISOString();
-        const nodes = db.all('SELECT n.*, EXISTS(SELECT 1 FROM wg_peers w WHERE w.node_id=n.id) AS has_key FROM nodes n WHERE n.disabled_at IS NULL');
+        const nodes = db.all('SELECT * FROM nodes WHERE disabled_at IS NULL');
         const views = nodes.map((n) => ({
             name: n.name,
-            overlayIp: MESH && n.has_key ? n.overlay_ip : null,
             address: n.address,
             lastSeenAt: n.last_seen_at,
         }));
@@ -2270,24 +2249,6 @@ export async function createApp(options = {}) {
         }));
         return resolveServiceEndpoints(states, views, statuses, staleBefore);
     }
-    function networkFor(node) {
-        if (!MESH || !node.overlay_ip)
-            return undefined;
-        const peers = db.all('SELECT w.*, n.name FROM wg_peers w JOIN nodes n ON n.id=w.node_id WHERE w.node_id != ? AND n.disabled_at IS NULL ORDER BY n.name', node.id);
-        return {
-            interface: WG_INTERFACE,
-            overlayIp: node.overlay_ip,
-            cidr: MESH_CIDR,
-            listenPort: WG_PORT,
-            peers: peers.map((p) => ({
-                node: p.name,
-                publicKey: p.public_key,
-                endpoint: p.endpoint ?? undefined,
-                allowedIps: p.allowed_ips.split(','),
-                persistentKeepalive: WG_KEEPALIVE,
-            })),
-        };
-    }
     /** Names of all nodes and of the ingress nodes, for port binding and upstream decisions. */
     function nodeTopology() {
         const rows = db.all('SELECT name,ingress FROM nodes WHERE disabled_at IS NULL ORDER BY name');
@@ -2298,7 +2259,6 @@ export async function createApp(options = {}) {
     }
     /** Where this node's published ports listen: the address other nodes and the ingress reach it on, or loopback. */
     function portBindingFor(node, states) {
-        const hasKey = MESH && node.overlay_ip && db.get('SELECT 1 FROM wg_peers WHERE node_id=?', node.id);
         const { nodes, ingressNodes } = nodeTopology();
         const loopback = {};
         for (const state of states) {
@@ -2306,7 +2266,7 @@ export async function createApp(options = {}) {
             if (services.length)
                 loopback[state.project] = services;
         }
-        return { address: (hasKey ? node.overlay_ip : node.address) || null, loopback };
+        return { address: node.address || null, loopback };
     }
     function ingressFor(node, states) {
         const secrets = new Map();
@@ -2360,9 +2320,6 @@ export async function createApp(options = {}) {
             commands,
             retainedImages,
         };
-        const network = networkFor(node);
-        if (network)
-            work.network = network;
         work.ports = portBindingFor(node, desiredStates);
         const holds = restores.holds();
         if (Object.keys(holds).length)
@@ -2401,7 +2358,6 @@ export async function createApp(options = {}) {
                 }),
             };
             db.run(`INSERT INTO node_statuses(id,node_id,project_id,observed_version,status_json,health,updated_at) VALUES(?,?,?,?,?,?,?) ON CONFLICT(node_id,project_id) DO UPDATE SET observed_version=excluded.observed_version,status_json=excluded.status_json,health=excluded.health,updated_at=excluded.updated_at`, id('ns'), req.node.id, st.project, st.observedVersion, JSON.stringify(sanitized), st.health, ts);
-            updateDeploymentConvergence(st.project);
         }
         // Commands are resolved under the calling node first: only a running command of this node can be
         // heartbeated or completed, so foreign and already-finished command ids change nothing.
@@ -2416,10 +2372,14 @@ export async function createApp(options = {}) {
             db.run("UPDATE commands SET state=?,result_json=?,updated_at=? WHERE id=? AND node_id=? AND state='running'", cr.state, JSON.stringify(cr.result), ts, cr.commandId, req.node.id);
         }
         if (report.ingress)
-            db.run('UPDATE nodes SET ingress_status_json=? WHERE id=?', JSON.stringify({ ...report.ingress, reportedAt: ts }), req.node.id);
+            db.run('UPDATE nodes SET ingress_status_json=? WHERE id=? AND ingress=1 AND disabled_at IS NULL', JSON.stringify({ ...report.ingress, reportedAt: ts }), req.node.id);
         db.run('UPDATE nodes SET last_seen_at=?,status=? WHERE id=?', ts, 'online', req.node.id);
         if (report.sentAt)
             db.run('UPDATE nodes SET clock_skew_ms=?,clock_observed_at=? WHERE id=?', Date.parse(report.sentAt) - Date.parse(ts), ts, req.node.id);
+        // Ingress-only nodes can acknowledge routing without reporting any project; recheck
+        // every active rollout after all project and ingress observations have been stored.
+        for (const deployment of db.all("SELECT DISTINCT project_id FROM deployments WHERE state='rolling_out'"))
+            updateDeploymentConvergence(deployment.project_id);
         try {
             restores.advance();
         }
@@ -2460,6 +2420,14 @@ export async function createApp(options = {}) {
             return res.status(409).json({ error: `command is ${command.state}, not running` });
         if (!command.project_id || !backupDestination())
             return res.status(409).json({ error: 'no backup destination is configured' });
+        // A command that outlived the project's placement on this node (a newer version moved it) gets nothing.
+        const desiredRow = currentDesired(command.project_id);
+        const desiredNow = desiredRow
+            ? JSON.parse(desiredRow.state_json)
+            : undefined;
+        const placedHere = Object.values(desiredNow?.services || {}).some((svc) => svc.placement?.nodes?.includes(req.node.name));
+        if (!placedHere)
+            return res.status(403).json({ error: 'project is no longer placed on this node' });
         const response = {
             env: {
                 ...backupEnv(),
@@ -2583,18 +2551,18 @@ async function ensureServerCredential(pki, dir, names, force = false) {
 export async function listen(app, port = PORT) {
     const pki = app.locals.pki;
     const dataDir = app.locals.dataDir;
-    const publicUrl = process.env.TUG_PUBLIC_URL;
-    if (!publicUrl)
-        throw new Error('TUG_PUBLIC_URL is required: the credential-free https origin clients connect to');
-    const url = new URL(publicUrl);
+    const advertised = app.locals.controlUrl;
+    if (!advertised)
+        throw new Error('TUG_CONTROL_URL is required: the credential-free https origin clients connect to');
+    const url = new URL(advertised);
     if (url.protocol !== 'https:' ||
         url.username ||
         url.password ||
         url.search ||
         url.hash ||
         url.pathname !== '/')
-        throw new Error('TUG_PUBLIC_URL must be a credential-free https origin such as https://control.example.com:8443');
-    const names = serverNames(publicUrl, (process.env.TUG_EXTRA_SANS || '').split(','));
+        throw new Error('TUG_CONTROL_URL must be a credential-free https origin such as https://control.example.com:8443');
+    const names = serverNames(advertised, (process.env.TUG_EXTRA_SANS || '').split(','));
     const credential = await ensureServerCredential(pki, dataDir, names);
     const server = https.createServer(serverTlsOptions({ cert: credential.cert, key: credential.key, ca: pki.caPem }), app);
     server.requestTimeout = 5 * 60_000;

package/dist/credentials.js

@@ -39,7 +39,7 @@ export const ROUTE_ROLES = {
     'POST /api/v1/nodes/enrollment-credential': 'admin',
     'POST /api/v1/nodes/:name/identity': 'admin',
     'POST /api/v1/nodes/:name/disable': 'admin',
-    'POST /api/v1/nodes/:name/rotate-wg-key': 'admin',
+    'POST /api/v1/nodes/:name/address': 'admin',
     'POST /api/v1/nodes/:name/ingress': 'admin',
     'DELETE /api/v1/nodes/:name': 'admin',
     'POST /api/v1/backups/run': 'deploy',

package/dist/db.d.ts

@@ -13,8 +13,6 @@ export interface NodeRow {
     id: string;
     name: string;
     address: string | null;
-    public_address: string | null;
-    overlay_ip: string | null;
     ingress: number;
     ingress_status_json: string | null;
     status: string;
@@ -31,14 +29,6 @@ export interface NodeRow {
     created_at: string;
     updated_at: string;
 }
-export interface WgPeerRow {
-    node_id: string;
-    public_key: string;
-    overlay_ip: string;
-    endpoint: string | null;
-    allowed_ips: string;
-    updated_at: string;
-}
 export interface EnrollmentCredentialRow {
     id: string;
     key_hash: string;

package/dist/db.js

@@ -54,8 +54,7 @@ function initializeControl(db) {
     db.exec(`
 CREATE TABLE IF NOT EXISTS meta(key TEXT PRIMARY KEY, value TEXT NOT NULL);
 CREATE TABLE IF NOT EXISTS projects(id TEXT PRIMARY KEY, name TEXT UNIQUE NOT NULL, current_deployment_id TEXT, created_at TEXT, updated_at TEXT);
-CREATE TABLE IF NOT EXISTS nodes(id TEXT PRIMARY KEY, name TEXT UNIQUE NOT NULL, address TEXT, public_address TEXT, overlay_ip TEXT UNIQUE, ingress INTEGER NOT NULL DEFAULT 0, ingress_status_json TEXT, status TEXT, labels_json TEXT, key_hash TEXT, disabled_at TEXT, cert_not_after TEXT, last_renewed_at TEXT, last_seen_at TEXT, clock_skew_ms INTEGER, clock_observed_at TEXT, created_at TEXT, updated_at TEXT);
-CREATE TABLE IF NOT EXISTS wg_peers(node_id TEXT PRIMARY KEY, public_key TEXT NOT NULL UNIQUE, overlay_ip TEXT NOT NULL, endpoint TEXT, allowed_ips TEXT NOT NULL, updated_at TEXT);
+CREATE TABLE IF NOT EXISTS nodes(id TEXT PRIMARY KEY, name TEXT UNIQUE NOT NULL, address TEXT, ingress INTEGER NOT NULL DEFAULT 0, ingress_status_json TEXT, status TEXT, labels_json TEXT, key_hash TEXT, disabled_at TEXT, cert_not_after TEXT, last_renewed_at TEXT, last_seen_at TEXT, clock_skew_ms INTEGER, clock_observed_at TEXT, created_at TEXT, updated_at TEXT);
 CREATE TABLE IF NOT EXISTS enrollment_credentials(id TEXT PRIMARY KEY, key_hash TEXT UNIQUE NOT NULL, name TEXT NOT NULL, labels_json TEXT, expires_at TEXT NOT NULL, revoked_at TEXT, node_id TEXT, reserved_node_id TEXT NOT NULL, node_key_hash TEXT, created_at TEXT);
 CREATE TABLE IF NOT EXISTS deployments(id TEXT PRIMARY KEY, project_id TEXT, version TEXT, state TEXT, created_at TEXT, updated_at TEXT, error_message TEXT, actor TEXT);
 CREATE TABLE IF NOT EXISTS desired_states(id TEXT PRIMARY KEY, project_id TEXT, deployment_id TEXT, version TEXT, state_json TEXT, created_at TEXT);