@wtfalch/foundry 0.34.0 → 0.35.1

package/dist/plan/edge-access.js

@@ -31,6 +31,7 @@ export function createEdgeAccess(client, options = {}) {
         adopt: (input) => retrying(() => client.adopt(input)),
         readiness: () => retrying(() => client.readiness()),
         ensureProvider: (input) => retrying(() => client.ensureProvider(input)),
+        oneTimePinProvider: () => retrying(() => client.oneTimePinProvider()),
         createGate: (input) => retrying(() => client.createGate(input)),
         replaceGateHostnames: (id, input) => retrying(() => client.replaceGateHostnames(id, input)),
         deleteGate: (id) => retrying(() => client.deleteGate(id)),
@@ -80,13 +81,27 @@ export function createEdgeAccess(client, options = {}) {
     const listAccessApps = async () => {
         const { apps } = await access.list();
         remember(apps);
-        return apps.map((a) => ({ id: a.id, name: a.name, domain: a.domain }));
+        return apps.map((a) => ({
+            id: a.id,
+            name: a.name,
+            domain: a.domain,
+            allowedIdps: a.allowedIdps,
+            autoRedirectToIdentity: a.autoRedirectToIdentity,
+        }));
     };
     return {
         listAccessApps,
         async createAccessApp(app) {
             try {
-                const created = await writeSlot(() => access.create({ name: app.name, domain: app.domain, type: app.type }));
+                const created = await writeSlot(() => access.create({
+                    name: app.name,
+                    domain: app.domain,
+                    type: app.type,
+                    ...(app.allowedIdps === undefined ? {} : { allowedIdps: app.allowedIdps }),
+                    ...(app.autoRedirectToIdentity === undefined
+                        ? {}
+                        : { autoRedirectToIdentity: app.autoRedirectToIdentity }),
+                }));
                 return { id: created.id };
             }
             catch (error) {
@@ -155,6 +170,10 @@ export function createEdgeAccess(client, options = {}) {
             const { authDomain } = await access.readiness();
             return { authDomain };
         },
+        async ensureOneTimePinProvider() {
+            const { id } = await access.oneTimePinProvider();
+            return { id };
+        },
         async ensureProvider(input) {
             const { id } = await writeSlot(() => access.ensureProvider(input));
             return { id };

package/dist/plan/executor.d.ts

@@ -54,6 +54,8 @@ export interface CoolifyPort {
      */
     listResources?(projectUuid: string): Promise<Array<{
         kind: string;
+        key?: string;
+        config?: Record<string, unknown>;
     }>>;
     findOrCreateEnvironment(projectUuid: string, name: string): Promise<{
         environment: {
@@ -111,10 +113,16 @@ export interface CoolifyPort {
         /** Coolify's own record of the resource limits (`plan/own-limits.ts`). */
         limits_memory?: string;
         limits_cpus?: string;
+        git_repository?: string;
+        is_auto_deploy_enabled?: boolean;
+        /** Coolify's record of the run options, where the capability options live (`plan/run-options.ts`). */
+        custom_docker_run_options?: string | null;
     }>;
     createGithubAppApplication(input: {
         project_uuid: string;
         server_uuid: string;
+        /** The Docker network the app joins (`plan/destinations.ts`); absent: the server's default. */
+        destination_uuid?: string;
         environment_name: string;
         environment_uuid: string;
         github_app_uuid: string;
@@ -125,6 +133,8 @@ export interface CoolifyPort {
         domains?: string;
         /** Selects which of two Dockerfiles in one repo to build (`cmsSite`'s own site/cms apps). */
         dockerfile_location?: string;
+        /** Extra `docker run` options; the capability options are added by `plan/own-limits.ts`. */
+        custom_docker_run_options?: string;
         /** The port the app listens on (`HostingEntry.port`). */
         ports_exposes?: string;
         /** `false` for an internal entry: Coolify makes no domain for it. */
@@ -142,6 +152,7 @@ export interface CoolifyPort {
     createPostgresDatabase(input: {
         project_uuid: string;
         server_uuid: string;
+        destination_uuid?: string;
         environment_name: string;
         environment_uuid: string;
         name: string;
@@ -223,6 +234,16 @@ export interface CoolifyPort {
     deleteEnv(applicationUuid: string, envUuid: string): Promise<unknown>;
     /** Escape hatch (`CoolifyClient.raw`) — used for stop/start, which have no typed method yet. */
     raw(method: string, path: string, body?: unknown): Promise<unknown>;
+    /**
+     * F6: the dumps one scheduled backup has run, newest first. A host may wrap
+     * `raw('GET', '/databases/{uuid}/backups/{backup}/executions')`; absent, the
+     * backup gate (`backup-gate.ts`) makes that call through `raw` itself.
+     */
+    listDatabaseBackupExecutions?(databaseUuid: string, backupUuid: string): Promise<Array<{
+        uuid: string;
+        status: string;
+        created_at: string;
+    }>>;
     /**
      * Persistent (named volume) and file storages already attached to an
      * application (#75) — `ensureLogVolume` reads this before creating one, so
@@ -263,6 +284,7 @@ export interface CoolifyPort {
     createDockerImageApplication(input: {
         project_uuid: string;
         server_uuid: string;
+        destination_uuid?: string;
         environment_name: string;
         environment_uuid: string;
         docker_registry_image_name: string;
@@ -294,12 +316,14 @@ export interface CoolifyPort {
     createDockerfileApplication(input: {
         project_uuid: string;
         server_uuid: string;
+        destination_uuid?: string;
         environment_name: string;
         environment_uuid: string;
         dockerfile: string;
         name?: string;
         description?: string;
         instant_deploy?: boolean;
+        custom_docker_run_options?: string;
     }): Promise<{
         uuid: string;
     }>;
@@ -431,6 +455,17 @@ export interface CoolifyPort {
     getDeployment(deploymentUuid: string): Promise<{
         status: string;
     }>;
+    /**
+     * An application's deployment history, newest first -- matches
+     * `CoolifyClient.listApplicationDeployments`. `build-record.ts` finds the
+     * deployment a deploy started by its uuid and records its commit. Optional:
+     * a port without it records no built commit.
+     */
+    listApplicationDeployments?(uuid: string, take?: number): Promise<Array<{
+        deployment_uuid: string;
+        commit?: string;
+        status: string;
+    }>>;
 }
 /**
  * The Cloudflare zone calls the platform steps make directly, shaped to match
@@ -939,6 +974,21 @@ export interface ZitadelPort {
     closeSelfRegistration(orgId: string): Promise<{
         changed: boolean;
     }>;
+    /**
+     * Makes the org require a second factor at sign-in: `forceMfa` on, no
+     * registration, no external identity provider, username and password kept
+     * (the invite and a password reset need them), passkeys allowed, and
+     * `mfaInitSkipLifetime` zero so enrolment cannot be skipped. The second
+     * factors are an authenticator app and a security key, the multi factor a
+     * user-verified passkey; every other factor (email or SMS code) is removed.
+     * An org on the instance default gets its own policy. Idempotent: a policy
+     * already so set is no write. A failure halfway is repaired by a repeat,
+     * which reads the policy again. `zitadel-login-policy.ts` is the real
+     * implementation.
+     */
+    enforceSecondFactor(orgId: string): Promise<{
+        changed: boolean;
+    }>;
     /** Grants another ZITADEL org access to a project (plan gap A9). Idempotent. */
     findOrCreateProjectGrant(orgId: string, projectId: string, grantedOrgId: string): Promise<{
         created: boolean;
@@ -1596,7 +1646,7 @@ export interface FoundryStepExecutorPorts {
     deliverSecret(ref: string, secret: string): Promise<void>;
     /**
      * Archon's held keys, for an entry env from `sharedSecret` (read, else
-     * generate and `put`) and `platformMailKey` (read only). Optional: without
+     * generate and `put`). Optional: without
      * it, or without `put`, such an env is omitted and the plan reports it
      * blocked. A value goes to the entry's env and nowhere else.
      */
@@ -1612,6 +1662,27 @@ export interface FoundryStepExecutorPorts {
      * passes the same store instance it constructs `FoundryPlanApply` with.
      */
     declaredOrgStore: Pick<DeclaredOrgStore, 'findOrgIdForZone'>;
+    /**
+     * The `<host>:<port>` the shared mail relay dials for a company's mail server, given the Coolify
+     * server's address and the host port the server publishes. Absent: `<server address>:<port>`. A
+     * host whose containers cannot reach the server by its address (the local stack, where it is a
+     * loopback address) supplies its own. The answer is checked like any relay target
+     * (`normalizeMailTarget`): a host name or an IPv4 address and a port, nothing else.
+     */
+    mailRelayTarget?(input: {
+        serverAddress: string | undefined;
+        port: number;
+    }): string;
+    /**
+     * The address of the server's Docker bridge gateway (an IPv4 address, `172.17.0.1` unless the
+     * daemon's `bip` says otherwise). With it a company's Stalwart publishes SMTP as
+     * `<address>:<port>:25`, which Coolify 4.3.23 passes to Docker unchanged, so the port is reachable
+     * from containers on the server but not on the server's public address; the relay is given
+     * `<address>:<port>` unless `mailRelayTarget` says otherwise. Absent: `<port>:25` on every interface,
+     * and the host firewall must close the range (`docs/runbooks/network-move.md`). The local stack
+     * leaves it unset.
+     */
+    mailBindAddress?: string;
     /**
      * #543: clock, sleep and `fetch` for the health-check wait every company
      * app's own redeploy now goes through (`deploy-health.ts`'s
@@ -1638,9 +1709,8 @@ export declare class NotBuiltError extends Error {
  * `cms.<domain>` -- the cms studio's own hostname (`cmsSite` below), apart
  * from the public site itself at `org.domain` (used directly there). Called
  * from `cmsSite` and from `zitadelApp` for the fixed `cms` client (#139),
- * both of which only run once `org.site.enabled` is true, so `org.domain`
- * is non-null by the same `validateSite` guarantee
- * {@link tunnelIngressHostnames}'s own doc comment cites.
+ * both of which only run once `org.site.enabled` is true. A company without
+ * a domain has its studio at `<slug>-cms.oikos.host` (`cmsStudioHostnameFor`).
  */
 export declare function cmsHostnameFor(org: DeclaredOrg): string;
 /**
@@ -1663,8 +1733,24 @@ export declare function callsHostnameFor(org: DeclaredOrg): string;
  * this file's hostname rules.
  */
 export declare function healthUrls(org: DeclaredOrg): string[];
+/**
+ * Every app on the Coolify box shares one Traefik reverse proxy, and Coolify
+ * itself points that proxy's routing at whatever `domains` an application
+ * declares (`coolifyApp`'s `appHostname(org)`) -- so a tunnel's ingress only
+ * has to reach the proxy, never a specific app container.
+ * `wtfalch/app-template`'s bootstrap (`bootstrap/steps/cf-tunnel.ts`, prior
+ * art for the exact org this file's `cloudflareTunnel` implements, cited by
+ * https://github.com/wtfalch/foundry/issues/71) names this same constant and
+ * value.
+ */
+export declare const COOLIFY_PROXY_ORIGIN = "http://coolify-proxy:80";
 /** The one Access policy foundry puts on a platform Access app (#84). */
 export declare const ACCESS_POLICY_NAME = "foundry: allowed emails";
+export declare const LOG_DIR = "/app/logs";
+/** The company's Coolify destination (its Docker network `co-<slug>`), recorded when its first resource is created. */
+export declare const COOLIFY_DESTINATION_SCOPE_KEY = "coolify_destination";
+export declare const CHAT_REKEY_SYNAPSE_DB_SCOPE_KEY = "coolify_chat_rekey_synapse_database";
+export declare const CHAT_REKEY_MAS_DB_SCOPE_KEY = "coolify_chat_rekey_mas_database";
 /**
  * Whether an application's own Coolify `status` (`` `running:healthy`,
  * `exited:unhealthy` `` -- `@wtfalch/providers`' own doc comment) means it is
@@ -1705,7 +1791,6 @@ export declare const databaseStartWait: {
     graceMs: number;
 };
 export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer {
-    private readonly ports;
     private edgeDns;
     private edgeTunnels;
     private edgeAccess;
@@ -1714,6 +1799,8 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
     private edgeWriteSlot;
     /** Secrets this executor minted or was handed; see `StepExecutor.secretsHandled`. */
     private readonly handledSecrets;
+    private readonly ports;
+    private get rawCoolify();
     constructor(ports: FoundryStepExecutorPorts);
     secretsHandled(): readonly string[];
     /**
@@ -1736,12 +1823,26 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
     }>;
     /** Whether the host's scoped ports for this own org include a files-organisation port. A held key still missing counts as no port. */
     ownFilesOrganisationPort(org: DeclaredOrg, recordedIds: Readonly<Record<string, string>>): Promise<boolean>;
+    /** Whether the host's scoped ports for this own org include a broker port: the company's own broker, which its broker entries are written to. */
+    ownBrokerPort(org: DeclaredOrg, recordedIds: Readonly<Record<string, string>>): Promise<boolean>;
     /** #555: the edge-routed ports this executor was built with itself (they win over edge). */
     ownEdgePorts(): Partial<Record<EdgePortName, boolean>>;
     execute(action: StepAction, context: StepExecutionContext): Promise<{
         resourceId?: string;
     } | undefined>;
     private run;
+    /**
+     * The company's destination on `serverUuid`: its Docker network `co-<slug>`, made when absent and
+     * recorded as {@link COOLIFY_DESTINATION_SCOPE_KEY}. Called before the first create of a step;
+     * a server that already holds too many networks fails here (`DestinationCapacityError`), before
+     * the destination or the resource exists. A crash after the destination is made and before it is
+     * recorded leaves a destination the next run finds by its network name, so a re-run converges.
+     * Each Coolify call has a 60 second timeout (`destinations.ts`).
+     */
+    private companyDestination;
+    /** `coolify` for an own-services step: its creates go to the company's destination. */
+    private placedForCompany;
+    private dispatch;
     /**
      * `plan/diff.ts`'s `planAccess` (#246): puts a `hosting.access` rule's
      * hostname behind a Cloudflare Access app named
@@ -1965,6 +2066,17 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
     private findRecreatedApp;
     private ensureZitadelProject;
     private ensureCoolifyProject;
+    /**
+     * `plan/network-move.ts`'s `planNetworkMove`: a company built on the shared network is moved to its
+     * own. Coolify cannot move a resource in production, so every application and database in the
+     * company's project that foundry did not adopt is deleted, applications first, and the ids recorded
+     * for them are forgotten; the next apply builds them again on `co-<slug>`. Apply has already asked
+     * for the typed company name and checked a fresh backup of every database. A failure part way
+     * leaves what is left recorded and the marker unset, so the same step is planned again and goes on
+     * from there (a 404 counts as deleted). The marker is recorded last. No new timeout: each delete
+     * has the Coolify port's own.
+     */
+    private coolifyNetwork;
     /**
      * #445: one company lands on one Coolify server. The first call for an
      * org picks a usable, reachable server and records it
@@ -2003,6 +2115,15 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
      * one).
      */
     private ensureLogVolume;
+    /**
+     * F6: a nightly dump of one of the company's databases to the platform's
+     * backup bucket. The schedule is found before it is created
+     * (`provisionDatabaseBackup`), so a run that died after the create and
+     * before `backup_<db>` was recorded reuses the schedule on the next apply
+     * instead of adding a second. The error carries the database's name, never
+     * the connection URL or a response body.
+     */
+    private coolifyBackup;
     private coolifyDatabase;
     /**
      * Pushes the database's connection string into the app's environment,
@@ -2055,6 +2176,19 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
      * provisioned, where this one is unconditional (#239).
      */
     private pushAppEnv;
+    /**
+     * The install's edge label token: read from the held keys, else minted and held first, so a crash
+     * after the `put` hands the same value out on the next apply. Read once more after the `put`, so two
+     * runs that mint at the same moment end on the value that was held last. An error names the ref,
+     * never a value.
+     */
+    private edgeLabelToken;
+    /**
+     * The `custom_labels` patch of an app foundry routes through Traefik at `hostname`: the same http
+     * router a `domains` entry gets, plus the edge token. Coolify uses these instead of the labels it
+     * generates from `domains`. The router names use the app's own name, which is unique per company.
+     */
+    private routedLabels;
     /**
      * The org's shared secret `name`: read from the held keys, else generated
      * and held first, so a crash after the `put` and before the env write
@@ -2779,8 +2913,9 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
     private ownAuth;
     /**
      * `plan/own-diff.ts`'s `planOwnMail`: the org's own Stalwart in the org's own
-     * project, with no host port (the shared relay reaches it by internal name)
-     * and a directory that trusts the org's own sign-in. The admin key goes to
+     * project, publishing its port 25 on one host port of the server (the shared
+     * relay is on another network and dials the server's address) and a directory
+     * that trusts the org's own sign-in. The admin key goes to
      * `orgTarget(org).refs.mailAdminKey` and nowhere else. The address the relay
      * routes to is recorded last, and the step's marker after it.
      */
@@ -2795,6 +2930,17 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
     /** `deliverSecret`, tried up to {@link JOBS_DELIVERY_ATTEMPTS} times; true once one attempt succeeds. */
     private deliverWithRetry;
     private cloudflareTunnel;
+    /**
+     * The entry names a company has in the platform's `oikos.host` zone (a company with no domain of its own):
+     * one proxied CNAME each, to this company's tunnel, which routes them straight to the entry container. A
+     * specific record beats the shared `*.oikos.host` wildcard, so the shared ingress stops carrying the name
+     * without being edited. The company writes only its own `<slug>.oikos.host` ({@link ownsOikosName}); an
+     * A or AAAA record, or a CNAME that points anywhere but this tunnel, an earlier id of it or the shared
+     * wildcard's target, blocks the step. A name the company no longer declares has its record deleted when
+     * it still points at this tunnel. The names are recorded only after every record is in place, so a failure
+     * halfway is planned again.
+     */
+    private publishOikosEntryRecords;
     /**
      * #236: when this tunnel's DNS was last published under a domain that
      * differs from the one `org` now declares, deletes every CNAME in the
@@ -3007,6 +3153,19 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
      * publishes it.
      */
     private publishMailDnsRecords;
+    /**
+     * A company without a domain keeps its web address at `<slug>.oikos.host`,
+     * which only the shared `*.oikos.host` wildcard answers. A wildcard applies
+     * only to a name that holds no record of its own, so the MX and TXT records
+     * of the company's mail domain on that same name would take the web address
+     * away. This writes the name's own proxied CNAME, to wherever the wildcard
+     * points, before any mail record. Found by name and type, so a rerun after a
+     * half-finished apply never doubles it. Cloudflare lists only A, AAAA and
+     * CNAME as clashing with a CNAME, so MX and TXT sit beside it.
+     * https://developers.cloudflare.com/dns/manage-dns-records/reference/wildcard-dns-records/
+     * https://developers.cloudflare.com/dns/manage-dns-records/troubleshooting/records-with-same-name/
+     */
+    private ensureOwnWebAddressRecord;
     /**
      * Creates or updates one mail record (Stalwart's or Lettermint's).
      *