@wtfalch/foundry 0.36.0 → 0.37.0

package/dist/bootstrap/versions.d.ts

@@ -34,10 +34,16 @@ export declare const DIGESTS: PinnedVersions;
  */
 export declare function pinnedRef(key: keyof PinnedVersions): string;
 /**
- * A declared tag that equals the pinned one gets its digest; any other
- * declared tag (an override) is passed through unchanged.
+ * The two image fields Coolify accepts. Its tag rule has no `@` or `:`, so a
+ * digest goes in the name as `<image>@sha256` and the tag holds the bare
+ * 64-hex digest (Coolify pulls `<name>:<tag>`). A declared tag that equals the
+ * pinned one gets its digest; any other declared tag (an override) is passed
+ * through unchanged.
  */
-export declare function pinnedTagFor(key: keyof PinnedVersions, tag: string): string;
+export declare function coolifyImageFor(key: keyof PinnedVersions, image: string, tag: string): {
+    docker_registry_image_name: string;
+    docker_registry_image_tag: string;
+};
 /**
  * Why an image tag cannot be used, or `null`. #248: generalised out of what
  * was `platform-providers.ts`'s `mailImageTagBlocked`, the one guard

package/dist/bootstrap/versions.js

@@ -41,11 +41,20 @@ export function pinnedRef(key) {
     return `${VERSIONS[key]}@${DIGESTS[key]}`;
 }
 /**
- * A declared tag that equals the pinned one gets its digest; any other
- * declared tag (an override) is passed through unchanged.
+ * The two image fields Coolify accepts. Its tag rule has no `@` or `:`, so a
+ * digest goes in the name as `<image>@sha256` and the tag holds the bare
+ * 64-hex digest (Coolify pulls `<name>:<tag>`). A declared tag that equals the
+ * pinned one gets its digest; any other declared tag (an override) is passed
+ * through unchanged.
  */
-export function pinnedTagFor(key, tag) {
-    return tag === VERSIONS[key] ? pinnedRef(key) : tag;
+export function coolifyImageFor(key, image, tag) {
+    if (tag !== VERSIONS[key]) {
+        return { docker_registry_image_name: image, docker_registry_image_tag: tag };
+    }
+    return {
+        docker_registry_image_name: `${image}@sha256`,
+        docker_registry_image_tag: DIGESTS[key].replace(/^sha256:/, ''),
+    };
 }
 /**
  * Tag spellings that resolve to whatever the registry currently has, not a

package/dist/plan/executor.d.ts

@@ -15,6 +15,7 @@ import { type MailCopyPort } from './mail-copy.js';
 import { type OwnServicesPort } from './own-services.js';
 import type { DestroyTarget, StepDestroyer, StepExecutionContext, StepExecutor } from './plan-apply.js';
 import type { EdgePortName } from './platform-org.js';
+import type { RequestHeaderPort } from './platform-providers.js';
 export declare function coolifyProjectMark(org: Pick<DeclaredOrg, 'id'>): string;
 /**
  * The Coolify calls this executor makes, shaped to match
@@ -1595,6 +1596,13 @@ export interface FoundryStepExecutorPorts {
      * `edge.tunnels` (see {@link EdgePort.tunnels}). Kept for a host or a test that supplies its own.
      */
     tunnels?: TunnelPort;
+    /**
+     * #745: the Cloudflare request header rule call, edge's `platform.requestHeaders`
+     * (`@wtfalch/edge` 0.14.0). A company's sign-in hostname gets its header strip rule
+     * through it before its DNS record; without it the step logs one fixed line and
+     * writes no rule. Mail and SFU hostnames never use it.
+     */
+    requestHeaders?: RequestHeaderPort;
     /**
      * F4.access: overrides the Access calls, which otherwise go through
      * `edge.access` (see {@link EdgePort.access}). Kept for a host or a test that supplies its own.

package/dist/plan/executor.js

@@ -1,7 +1,7 @@
 import { AsyncLocalStorage } from 'node:async_hooks';
 import { randomBytes, randomUUID } from 'node:crypto';
 import { URL } from 'node:url';
-import { pinnedTagFor } from '../bootstrap/versions.js';
+import { coolifyImageFor } from '../bootstrap/versions.js';
 import { redactSecrets } from '../calls-sfu-deploy-support.js';
 import { resolveCallsSfuUrls } from '../calls-sfu.js';
 import { APP_ENTRY_KEY, appEntry, filesCollectionEnvName, ownerMailboxRecorded, ownerMailboxes, ownsServices, sharedSecretRef, } from '../org.js';
@@ -3870,8 +3870,7 @@ export class FoundryStepExecutor {
             server_uuid: server.uuid,
             environment_name: environment.name,
             environment_uuid: environment.uuid,
-            docker_registry_image_name: SYNAPSE_IMAGE,
-            docker_registry_image_tag: pinnedTagFor('synapse', synapseTag),
+            ...coolifyImageFor('synapse', SYNAPSE_IMAGE, synapseTag),
             ports_exposes: '8008',
             name: names.synapse,
             description: `Synapse for ${org.slug}'s calls stack (${SYNAPSE_IMAGE}:${synapseTag})`,
@@ -5750,7 +5749,12 @@ export class FoundryStepExecutor {
             apex: hn.zone,
             gitRef,
             project: { ensure: () => this.ensureCoolifyProject(org, context) },
-            network: orgNetwork({ dns: this.dnsPort(), tunnels: this.tunnelPort(), zones: this.zonePort() }, scope, `${org.slug}:auth`),
+            network: orgNetwork({
+                dns: this.dnsPort(),
+                tunnels: this.tunnelPort(),
+                requestHeaders: this.ports.requestHeaders,
+                zones: this.zonePort(),
+            }, scope, `${org.slug}:auth`),
             smtpSender: `noreply@${hn.mailDomain}`,
             defaultRedirectUri: `https://${agoraHostnameFor(org)}`,
             ownerCompany: null,

package/dist/plan/own-services.d.ts

@@ -6,7 +6,7 @@ import type { DnsPort } from './edge-dns.js';
 import type { ZonePort } from './edge-zones.js';
 import type { CallsSfuPort, CloudflarePort, CoolifyPort, FilesOrganisationPort, FoundryStepExecutorPorts, JobsSchedulerPort, MailPort, ZitadelPort } from './executor.js';
 import type { PlatformStepExecutionContext, StepExecutionContext } from './plan-apply.js';
-import type { FoundryPlatformStepExecutorOptions, PlatformAuthDeps, PlatformDnsFactory, PlatformFilesDeps, PlatformMailDeps, PlatformTunnelPort, PlatformTunnelsFactory } from './platform-providers.js';
+import type { FoundryPlatformStepExecutorOptions, PlatformAuthDeps, PlatformDnsFactory, PlatformFilesDeps, PlatformMailDeps, PlatformRequestHeadersFactory, PlatformTunnelPort, PlatformTunnelsFactory, RequestHeaderPort } from './platform-providers.js';
 /** Applied-state key under which an own org's provisioned-services marker is recorded. */
 export declare const OWN_SERVICES_APPLIED_SCOPE_KEY = "own_services_applied";
 /**
@@ -82,10 +82,13 @@ export interface ServiceNetwork {
     dns(): Promise<DnsPort>;
     tunnels(): Promise<PlatformTunnelPort>;
     zoneId(apex: string): Promise<string | undefined>;
+    /** Undefined when the host supplies no way to write Cloudflare request header rules. */
+    requestHeaders(): Promise<RequestHeaderPort | undefined>;
 }
 export declare function platformNetwork(deps: {
     dns: PlatformDnsFactory;
     tunnels: PlatformTunnelsFactory;
+    requestHeaders?: PlatformRequestHeadersFactory;
     cloudflare: Pick<CloudflarePort, 'findZoneByApex'>;
 }, scope: StepScope, step: string): ServiceNetwork;
 /**
@@ -96,6 +99,7 @@ export declare function platformNetwork(deps: {
 export declare function orgNetwork(ports: {
     dns?: DnsPort;
     tunnels?: PlatformTunnelPort;
+    requestHeaders?: RequestHeaderPort;
     zones?: Pick<ZonePort, 'findZoneByApex'>;
 }, scope: StepScope, step: string): ServiceNetwork;
 /** Where the project comes from: the platform's 'platform' project, or the org's own. */

package/dist/plan/own-services.js

@@ -1,5 +1,5 @@
 import { NO_DOMAIN_ZONE } from './own-hostnames.js';
-import { apexZoneKey, exactZone, platformDns, platformTunnels } from './platform-providers.js';
+import { apexZoneKey, exactZone, platformDns, platformRequestHeaders, platformTunnels, } from './platform-providers.js';
 /** The key the org's zone step records its Cloudflare zone id under. */
 const ORG_ZONE_SCOPE_KEY = 'cloudflare_zone';
 /** Applied-state key under which an own org's provisioned-services marker is recorded. */
@@ -123,6 +123,7 @@ export function platformNetwork(deps, scope, step) {
     return {
         dns: () => platformDns(deps, scope.recordedIds(), step),
         tunnels: () => platformTunnels(deps, scope.recordedIds(), step),
+        requestHeaders: () => platformRequestHeaders(deps, scope.recordedIds()),
         zoneId: async (apex) => scope.recordedIds()[apexZoneKey(apex)] ?? (await exactZone(deps.cloudflare, apex))?.id,
     };
 }
@@ -143,6 +144,7 @@ export function orgNetwork(ports, scope, step) {
                 throw new Error(`${step}: the host supplies no tunnel port for this org`);
             return ports.tunnels;
         },
+        requestHeaders: async () => ports.requestHeaders,
         zoneId: async (apex) => {
             // The recorded zone is the company's own; `oikos.host` is never it.
             const recorded = apex === NO_DOMAIN_ZONE ? undefined : scope.recordedIds()[ORG_ZONE_SCOPE_KEY];

package/dist/plan/own-sfu.js

@@ -1,4 +1,4 @@
-import { pinnedTagFor } from '../bootstrap/versions.js';
+import { coolifyImageFor } from '../bootstrap/versions.js';
 import { mintLivekitCredentials } from '../calls-sfu-keys.js';
 import { LIVEKIT_SIGNALLING_PORT, sfuSlotPorts } from '../calls-sfu.js';
 import { ensureCloudflaredConnector } from './cloudflared-connector.js';
@@ -105,8 +105,7 @@ export async function provisionSfuApp(scope, deps, target, input) {
             server_uuid: server.uuid,
             environment_name: environment.name,
             environment_uuid: environment.uuid,
-            docker_registry_image_name: OWN_SFU_IMAGE,
-            docker_registry_image_tag: pinnedTagFor('livekit', input.version),
+            ...coolifyImageFor('livekit', OWN_SFU_IMAGE, input.version),
             ports_exposes: String(LIVEKIT_SIGNALLING_PORT),
             ports_mappings: sfuPortsMappings(input.slot),
             name: target.names.sfuApp,
@@ -122,7 +121,7 @@ export async function provisionSfuApp(scope, deps, target, input) {
     // Set on every run: a declared version or slot reaches an existing app here.
     await coolify.updateApplication(appId, {
         custom_internal_name: target.internal.sfu,
-        docker_registry_image_tag: pinnedTagFor('livekit', input.version),
+        ...coolifyImageFor('livekit', OWN_SFU_IMAGE, input.version),
         ports_exposes: String(LIVEKIT_SIGNALLING_PORT),
         ports_mappings: sfuPortsMappings(input.slot),
         ...healthCheckSettings('/', LIVEKIT_SIGNALLING_PORT),

package/dist/plan/platform-providers.d.ts

@@ -59,6 +59,33 @@ export type PlatformTunnelPort = Pick<TunnelPort, 'findTunnelByName' | 'createTu
 export declare function platformTunnels(deps: {
     tunnels: PlatformTunnelsFactory;
 }, recorded: Readonly<Record<string, string>>, step: string): Promise<PlatformTunnelPort>;
+/**
+ * Request headers a client can set that ZITADEL reads to pick or name an
+ * instance (auth#241, auth#252). Cloudflare removes them from every inbound
+ * request on a sign-in hostname, because the tunnel routes ZITADEL's paths
+ * straight to ZITADEL and no app code sees them first.
+ */
+export declare const SIGNIN_STRIPPED_REQUEST_HEADERS: readonly ["X-Zitadel-Instance-Host", "X-Zitadel-Public-Host", "X-Zitadel-Forward-Host", "X-Forwarded-Host"];
+/** One Cloudflare request-header Transform Rule (phase `http_request_late_transform`) that removes headers. */
+export interface RequestHeaderStripRule {
+    /** Names the rule in the zone: the key that makes a repeat safe. */
+    description: string;
+    expression: string;
+    headers: readonly string[];
+}
+/** The Cloudflare request header rule calls a sign-in step makes. */
+export interface RequestHeaderPort {
+    /** Makes the rule, or returns the one already made for that zone and description. */
+    ensureRequestHeaderStrip(zoneId: string, rule: RequestHeaderStripRule): Promise<{
+        id: string;
+    }>;
+}
+/** Like {@link PlatformTunnelsFactory}: builds the {@link RequestHeaderPort} at edge's recorded address. */
+export type PlatformRequestHeadersFactory = (edgeUrl: string) => RequestHeaderPort | Promise<RequestHeaderPort>;
+/** The request header port for a platform step; undefined when edge is not recorded or the host supplied no factory. */
+export declare function platformRequestHeaders(deps: {
+    requestHeaders?: PlatformRequestHeadersFactory;
+}, recorded: Readonly<Record<string, string>>): Promise<RequestHeaderPort | undefined>;
 /**
  * F4.access: builds the {@link AccessPort} a platform step finds, creates and
  * deletes its Access app through, given the same address as
@@ -110,6 +137,11 @@ export interface PlatformAuthDeps {
     dns: PlatformDnsFactory;
     /** F4.tunnels: every tunnel call, through edge at its recorded address (see {@link PlatformTunnelsFactory}). */
     tunnels: PlatformTunnelsFactory;
+    /**
+     * Request header rules through edge. Edge has no such call yet (@wtfalch/edge 0.13.0 offers
+     * rate limit rules only), so a host that leaves this out gets no rule and a logged line per run.
+     */
+    requestHeaders?: PlatformRequestHeadersFactory;
     cloudflare: Pick<CloudflarePort, 'findZoneByApex'>;
     /** Must target the platform's own new instance (its issuer), or `zitadelForInstance` must be set. */
     zitadel: Pick<ZitadelPort, 'findOrCreateOrg' | 'mintAdminMachineUser' | 'mintLoginClientMachineUser' | 'listLoginClientPats' | 'reserveUserName' | 'closeSelfRegistration' | 'enforceSecondFactor' | 'inviteOrgOwner' | 'ensureDomainPolicy' | 'addOrgDomain' | 'removeOrgDomain' | 'setPrimaryOrgDomain' | 'setUserMetadata' | 'getUserMetadata'> & PlatformZitadelSmtp;

package/dist/plan/platform-providers.js

@@ -1,7 +1,7 @@
 import { createHash, createPrivateKey, generateKeyPairSync, randomBytes, randomUUID, sign, } from 'node:crypto';
 import { isIPv4 } from 'node:net';
 import { applyObjects, openInstance, platformMailSettingsObjects } from '@wtfalch/email/postmaster';
-import { VERSIONS, floatingTagBlocked, pinnedRef, pinnedTagFor } from '../bootstrap/versions.js';
+import { VERSIONS, coolifyImageFor, floatingTagBlocked, pinnedRef } from '../bootstrap/versions.js';
 import { redactSecrets } from '../calls-sfu-deploy-support.js';
 import { ownerMailboxes } from '../org.js';
 import { BOULE_BRIDGE_SECRET_ENV, BOULE_PEER_PASSWORD_ENV, BOULE_PEER_ROLE, bouleHostnameFor, } from './boule.js';
@@ -53,6 +53,23 @@ export async function platformTunnels(deps, recorded, step) {
     }
     return deps.tunnels(edgeUrl);
 }
+/**
+ * Request headers a client can set that ZITADEL reads to pick or name an
+ * instance (auth#241, auth#252). Cloudflare removes them from every inbound
+ * request on a sign-in hostname, because the tunnel routes ZITADEL's paths
+ * straight to ZITADEL and no app code sees them first.
+ */
+export const SIGNIN_STRIPPED_REQUEST_HEADERS = [
+    'X-Zitadel-Instance-Host',
+    'X-Zitadel-Public-Host',
+    'X-Zitadel-Forward-Host',
+    'X-Forwarded-Host',
+];
+/** The request header port for a platform step; undefined when edge is not recorded or the host supplied no factory. */
+export async function platformRequestHeaders(deps, recorded) {
+    const edgeUrl = recorded[PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY];
+    return edgeUrl && deps.requestHeaders ? deps.requestHeaders(edgeUrl) : undefined;
+}
 /** The Access port for a platform step; same address and same reason as {@link platformDns}. */
 async function platformAccess(deps, recorded, step) {
     const edgeUrl = recorded[PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY];
@@ -1701,6 +1718,18 @@ export async function provisionAuthStack(scope, deps, target, input) {
     if (!zoneId) {
         throw new Error(`${label}: no Cloudflare zone for ${apex} to put ${hostname} in`);
     }
+    // Before the DNS record, so the hostname is never published without the rule.
+    const requestHeaders = await network.requestHeaders();
+    if (requestHeaders) {
+        await requestHeaders.ensureRequestHeaderStrip(zoneId, {
+            description: `strip spoofable sign-in headers: ${hostname}`,
+            expression: `(http.host eq "${hostname}")`,
+            headers: SIGNIN_STRIPPED_REQUEST_HEADERS,
+        });
+    }
+    else {
+        console.error(`${label}: no request header port, so the sign-in hostname keeps X-Zitadel-* and X-Forwarded-Host from clients`);
+    }
     const dnsTarget = `${tunnel.id}.cfargotunnel.com`;
     const dns = await network.dns();
     const [dnsRecord] = await dns.findDnsRecord(apex, hostname, 'CNAME');
@@ -2539,8 +2568,7 @@ export async function provisionMailServer(scope, deps, target, input) {
             server_uuid: server.uuid,
             environment_name: environment.name,
             environment_uuid: environment.uuid,
-            docker_registry_image_name: STALWART_IMAGE,
-            docker_registry_image_tag: pinnedTagFor('stalwart', imageTag),
+            ...coolifyImageFor('stalwart', STALWART_IMAGE, imageTag),
             ports_exposes: STALWART_PORTS_EXPOSES,
             ...(hostPorts ? { ports_mappings: hostPorts } : {}),
             name: target.names.mailApp,
@@ -2560,7 +2588,7 @@ export async function provisionMailServer(scope, deps, target, input) {
     // `'ready'` probe below. Stalwart's own readiness route and HTTP port.
     await deps.coolify.updateApplication(appId, {
         custom_internal_name: target.internal.mail,
-        docker_registry_image_tag: pinnedTagFor('stalwart', imageTag),
+        ...coolifyImageFor('stalwart', STALWART_IMAGE, imageTag),
         ...healthCheckSettings(STALWART_READY_PATH, Number(STALWART_HTTP_PORT)),
         // Only a platform that uses the shared relay, or one that did, changes a published port.
         ...(portsChanged ? { ports_mappings: hostPorts } : {}),
@@ -7263,8 +7291,7 @@ async function provisionPlatformHc(context, deps) {
             server_uuid: server.uuid,
             environment_name: environment.name,
             environment_uuid: environment.uuid,
-            docker_registry_image_name: HC_IMAGE,
-            docker_registry_image_tag: pinnedTagFor('hc', gitRef),
+            ...coolifyImageFor('hc', HC_IMAGE, gitRef),
             ports_exposes: HC_PORT,
             name: PLATFORM_HC_APP_NAME,
             description: `Healthchecks for the platform's own heartbeats (#540, ${HC_IMAGE}:${gitRef})`,
@@ -7277,7 +7304,7 @@ async function provisionPlatformHc(context, deps) {
     // own rule. The image tag too, so a declared release change reaches the app.
     await deps.coolify.updateApplication(appId, {
         custom_internal_name: HC_INTERNAL_NAME,
-        docker_registry_image_tag: pinnedTagFor('hc', gitRef),
+        ...coolifyImageFor('hc', HC_IMAGE, gitRef),
         ...healthCheckSettings(HC_HEALTH_CHECK_PATH, Number(HC_PORT)),
     });
     // ---- env, parsed off the database's own owner credentials -----------------

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/foundry",
-  "version": "0.36.0",
+  "version": "0.37.0",
   "description": "Foundry's SDK: the declared org's types, the plan and apply contracts, and the state store's interface.",
   "repository": {
     "type": "git",