@wtfalch/foundry 0.16.3 → 0.16.4

package/dist/plan/executor.d.ts

@@ -237,6 +237,8 @@ export interface CoolifyPort {
         name?: string;
         description?: string;
         instant_deploy?: boolean;
+        /** Extra `docker run` options (`--entrypoint "..."` becomes the compose entrypoint). */
+        custom_docker_run_options?: string;
         /**
          * `host:container`, comma separated -- publishes host ports directly
          * (`@wtfalch/providers`' `CoolifyClient.createDockerImageApplication`

package/dist/plan/platform-diff.d.ts

@@ -46,6 +46,15 @@ export declare const PLATFORM_AUTH_KEY = "platform:auth";
  * that was never actually applied.
  */
 export declare const PLATFORM_AUTH_ZITADEL_APPLIED_IMAGE_TAG_SCOPE_KEY = "auth_zitadel_applied_image_tag";
+/**
+ * The image has `Entrypoint /app/zitadel` and no `Cmd`, so without this it
+ * runs zitadel with no subcommand, exits, and restarts forever. Coolify turns
+ * `--entrypoint` in `custom_docker_run_options` into the compose `entrypoint`
+ * (its PATCH takes this field; it refuses `dockerfile`).
+ */
+export declare const AUTH_ZITADEL_RUN_OPTIONS = "--entrypoint \"/app/zitadel start-from-init --masterkeyFromEnv --tlsMode external\"";
+/** The run options last applied to the ZITADEL app (value: the options string), so a changed value forces one redeploy. */
+export declare const PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY = "zitadel_platform_auth_run_options_applied";
 /**
  * #251: the Synapse/MAS image tags an org's calls Matrix stack last
  * successful apply actually set live. `coolifyCalls` (`executor.ts`)

package/dist/plan/platform-diff.js

@@ -41,6 +41,15 @@ export const PLATFORM_AUTH_KEY = 'platform:auth';
  * that was never actually applied.
  */
 export const PLATFORM_AUTH_ZITADEL_APPLIED_IMAGE_TAG_SCOPE_KEY = 'auth_zitadel_applied_image_tag';
+/**
+ * The image has `Entrypoint /app/zitadel` and no `Cmd`, so without this it
+ * runs zitadel with no subcommand, exits, and restarts forever. Coolify turns
+ * `--entrypoint` in `custom_docker_run_options` into the compose `entrypoint`
+ * (its PATCH takes this field; it refuses `dockerfile`).
+ */
+export const AUTH_ZITADEL_RUN_OPTIONS = '--entrypoint "/app/zitadel start-from-init --masterkeyFromEnv --tlsMode external"';
+/** The run options last applied to the ZITADEL app (value: the options string), so a changed value forces one redeploy. */
+export const PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY = 'zitadel_platform_auth_run_options_applied';
 /**
  * #251: the Synapse/MAS image tags an org's calls Matrix stack last
  * successful apply actually set live. `coolifyCalls` (`executor.ts`)
@@ -753,8 +762,15 @@ function planJobs(platform, byKey, claimed, observable) {
         claimed.add(key);
     if (!platform.jobs.enabled)
         return { step: null, blocked: null };
-    if (live)
-        return { step: null, blocked: null };
+    if (live) {
+        // The step also starts the scheduler's database (0.16.3), so a live app
+        // whose database the reader saw stopped plans it again. A status the
+        // reader could not read is absent, and plans nothing.
+        const databaseStatus = live.config.databaseStatus;
+        if (typeof databaseStatus !== 'string' || databaseStatus.startsWith('running')) {
+            return { step: null, blocked: null };
+        }
+    }
     // No Coolify reader means the host wired no Coolify at all for the
     // platform: the step's executor would throw every apply, and the scheduler
     // could never be seen live, so it would re-plan forever. A fixed text: it
@@ -1103,7 +1119,10 @@ function planAuth(platform, recordedIds, executorBlocked, executorMissing, authD
         connectorApplied &&
         brokerApplied &&
         brokerDeployed &&
-        loginClientApplied) {
+        loginClientApplied &&
+        // The ZITADEL run options reach the container only through the auth
+        // step's redeploy, so a platform recorded before them still plans it.
+        recordedIds[PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY] === AUTH_ZITADEL_RUN_OPTIONS) {
         return { step: null, blocked: null };
     }
     // The admin key was minted but never reached the host. ZITADEL shows a

package/dist/plan/platform-providers.d.ts

@@ -770,7 +770,7 @@ export declare class ProvidersPlatformCloudflareReader implements PlatformCloudf
 export declare class ProvidersPlatformCoolifyReader implements PlatformCoolifyReader {
     private readonly client;
     private readonly platformStore;
-    constructor(client: Pick<CoolifyPort, 'getApplication' | 'listDatabaseBackups'>, platformStore: Pick<PlatformStore, 'getServiceIds'>);
+    constructor(client: Pick<CoolifyPort, 'getApplication' | 'getDatabase' | 'listDatabaseBackups'>, platformStore: Pick<PlatformStore, 'getServiceIds'>);
     listResources(): Promise<LiveResource[]>;
 }
 export {};

package/dist/plan/platform-providers.js

@@ -6,7 +6,7 @@ import { redactSecrets } from '../calls-sfu-deploy-support.js';
 import { ensureCloudflaredConnector } from './cloudflared-connector.js';
 import { ACCESS_POLICY_NAME, getDatabaseStarted, isNotFoundError, isRunningOrStarting, } from './executor.js';
 import { coolifyDomains } from './hostnames.js';
-import { JOBS_SCHEDULER_KEY, PLATFORM_AI_APPLIED_GITREF_SCOPE_KEY, PLATFORM_AI_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_AI_DEPLOY_PENDING_SCOPE_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_KEY, PLATFORM_AI_MANAGEMENT_KEY_CONFLICT_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_MIGRATE_BLOCKED_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_SET_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_CONNECTOR_APP_SCOPE_KEY, PLATFORM_ARCHON_GATE_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_KEY, PLATFORM_ARCHON_MASTER_CLOUDFLARE_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_URL_REF, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_APPLIED_IMAGE_TAG_SCOPE_KEY, PLATFORM_BACKUP_DATABASE_SCOPE_KEYS, PLATFORM_BACKUP_SERVICE_KEYS, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_GITREF_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY, PLATFORM_INTEGRATIONS_KEY_SET_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_CONNECTOR_APP_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, parseBrokerDeployRecord, parseLoginClientRecord, platformMailMxHost, } from './platform-diff.js';
+import { AUTH_ZITADEL_RUN_OPTIONS, JOBS_SCHEDULER_KEY, PLATFORM_AI_APPLIED_GITREF_SCOPE_KEY, PLATFORM_AI_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_AI_DEPLOY_PENDING_SCOPE_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_KEY, PLATFORM_AI_MANAGEMENT_KEY_CONFLICT_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_MIGRATE_BLOCKED_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_SET_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_CONNECTOR_APP_SCOPE_KEY, PLATFORM_ARCHON_GATE_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_KEY, PLATFORM_ARCHON_MASTER_CLOUDFLARE_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_URL_REF, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_APPLIED_IMAGE_TAG_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, PLATFORM_BACKUP_DATABASE_SCOPE_KEYS, PLATFORM_BACKUP_SERVICE_KEYS, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_GITREF_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY, PLATFORM_INTEGRATIONS_KEY_SET_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_CONNECTOR_APP_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, parseBrokerDeployRecord, parseLoginClientRecord, platformMailMxHost, } from './platform-diff.js';
 import { applyCallsSfuPlatformStep } from './platform-sfu.js';
 import { CreateInstanceError, createZitadelInstance, generateSystemApiKeypair, instanceWithoutBearerMessage, systemApiUsersEnv, } from './zitadel-system-api.js';
 /** The key `runPlatformSteps` records the apex zone's id under (`system:kind:key`). */
@@ -871,6 +871,7 @@ async function provisionPlatformAuth(context, deps) {
             docker_registry_image_name: AUTH_ZITADEL_IMAGE,
             docker_registry_image_tag: AUTH_ZITADEL_IMAGE_TAG,
             ports_exposes: AUTH_ZITADEL_PORT,
+            custom_docker_run_options: AUTH_ZITADEL_RUN_OPTIONS,
             name: PLATFORM_AUTH_ZITADEL_APP_NAME,
             description: `ZITADEL for the platform's own sign-in (#168, ${AUTH_ZITADEL_IMAGE}:${AUTH_ZITADEL_IMAGE_TAG})`,
             instant_deploy: false,
@@ -882,9 +883,14 @@ async function provisionPlatformAuth(context, deps) {
     // create must not leave the app unnamed for good, and the tunnel addresses
     // the app by this name. (The port cannot read the current name back, and
     // setting the same value again is harmless.)
+    // The run options go in the same patch, so an app made before they existed
+    // gets them too.
     await deps.coolify.updateApplication(zitadelAppId, {
         custom_internal_name: PLATFORM_AUTH_ZITADEL_INTERNAL_NAME,
+        custom_docker_run_options: AUTH_ZITADEL_RUN_OPTIONS,
     });
+    // The container only takes new run options at its next deploy.
+    const zitadelRunOptionsNew = recorded[PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY] !== AUTH_ZITADEL_RUN_OPTIONS;
     // #251: only on create, never unconditionally -- nothing here patches
     // `docker_registry_image_tag` on an app `findOrCreatePlatformApp` found
     // already running, so that is the only moment this tag is actually live.
@@ -1012,9 +1018,12 @@ async function provisionPlatformAuth(context, deps) {
     await deps.coolify.bulkUpsertEnvs(brokerAppId, brokerEnvs);
     // Deploy an app that was just created, is not running (a throw after the
     // create left it never deployed, or it stopped), or whose envs changed.
-    if (zitadelApp.justCreated || !zitadelApp.running || zitadelEnvsChanged) {
+    if (zitadelApp.justCreated || !zitadelApp.running || zitadelEnvsChanged || zitadelRunOptionsNew) {
         await deps.coolify.deploy(zitadelAppId);
         await record(PLATFORM_AUTH_ZITADEL_DEPLOYED_SCOPE_KEY, zitadelAppId);
+        // Only now: the options are live once the deploy went out. A throw between
+        // the PATCH and here leaves the marker unset, so the next run deploys.
+        await record(PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, AUTH_ZITADEL_RUN_OPTIONS);
     }
     if (loginApp.justCreated || !loginApp.running || loginEnvsChanged) {
         await deps.coolify.deploy(loginAppId);
@@ -5029,11 +5038,27 @@ export class ProvidersPlatformCoolifyReader {
         if (recordedAppId) {
             try {
                 const app = await this.client.getApplication(recordedAppId);
+                // The scheduler's database status, so `planJobs` can see a stopped
+                // one. Left out when it cannot be read: unknown is not "stopped".
+                let databaseStatus;
+                const databaseId = recorded[JOBS_DATABASE_SCOPE_KEY];
+                if (databaseId) {
+                    try {
+                        databaseStatus = (await this.client.getDatabase(databaseId)).status;
+                    }
+                    catch {
+                        databaseStatus = undefined;
+                    }
+                }
                 resources.push({
                     system: 'coolify',
                     kind: 'jobs',
                     key: JOBS_SCHEDULER_KEY,
-                    config: { uuid: app.uuid, status: app.status },
+                    config: {
+                        uuid: app.uuid,
+                        status: app.status,
+                        ...(databaseStatus !== undefined && { databaseStatus }),
+                    },
                 });
             }
             catch {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/foundry",
-  "version": "0.16.3",
+  "version": "0.16.4",
   "description": "Foundry's SDK: the declared org's types, the plan and apply contracts, and the state store's interface.",
   "repository": {
     "type": "git",