@wtfalch/foundry 0.36.1 → 0.38.0

package/dist/index.d.ts

@@ -54,7 +54,7 @@ export { checkMailIdentityAudience } from './plan/index.js';
 export type { MailAllowlistApp } from './plan/index.js';
 export { checkMailAppsAllowlist } from './plan/index.js';
 export { FoundryPlatformStepExecutor, ProvidersPlatformCloudflareReader, ProvidersPlatformCoolifyReader, createZitadelAdminMinter, createZitadelLoginPolicy, createZitadelProjectRoles, PLATFORM_AUTH_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_RELAY_KEY, PLATFORM_MAIL_RELAY_ROUTES_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_DESCRIPTION, } from './plan/index.js';
-export type { PlatformAuthDeps, PlatformAuthSmtp, PlatformAuthRuntime, PlatformFilesDeps, PlatformFilesRuntime, PlatformEdgeDeps, PlatformDnsFactory, PlatformAccessFactory, PlatformUptimeAccessFactory, PlatformUptimeAccessPort, PlatformUptimeDeps, PlatformWorkersFactory, PlatformWorkersPort, PlatformAccessPort, PlatformTunnelsFactory, PlatformEdgeRuntime, } from './plan/index.js';
+export type { PlatformAuthDeps, PlatformAuthSmtp, PlatformAuthRuntime, PlatformFilesDeps, PlatformFilesRuntime, PlatformEdgeDeps, PlatformDnsFactory, PlatformAccessFactory, PlatformUptimeAccessFactory, PlatformUptimeAccessPort, PlatformUptimeChatDeps, PlatformUptimeDeps, PlatformWorkersFactory, PlatformWorkersPort, PlatformAccessPort, PlatformTunnelsFactory, PlatformEdgeRuntime, } from './plan/index.js';
 export type { PlatformMailDeps, PlatformMailAdminPort, PlatformMailRuntime, } from './plan/index.js';
 export { FILES_INTROSPECTION_SECRET_REF, FILES_MANAGEMENT_ISSUER, FILES_MANAGEMENT_KEY_ID, FILES_MANAGEMENT_KEY_REF, PLATFORM_AUTH_INSTANCE_BEARER_REF, } from './plan/index.js';
 export { AI_MANAGEMENT_ISSUER, AI_MANAGEMENT_KEY_ID, AI_SIGNING_KEY_REF, AiManagementKeyExistsError, createAiManagementKeyMinter, PLATFORM_AI_MANAGEMENT_KEY_REF, PLATFORM_AI_MANAGEMENT_PERMISSIONS, } from './plan/index.js';

package/dist/plan/backup-gate.d.ts

@@ -52,8 +52,8 @@ export interface BackupGatePorts {
  * `unconfirmedUpgrades` and before any step. A service whose database the
  * company does not have passes (there is nothing to migrate); a database that
  * exists with no recorded schedule, a disabled or non-S3 schedule, a failed or
- * old dump, or an unreadable list all refuse. `mail` has no Postgres and is
- * not covered here (plan note `backup-not-covered:mail`).
+ * old dump, or an unreadable list all refuse. `mail` is covered like the rest:
+ * Stalwart's data store is a Postgres database.
  *
  * Where this Coolify has no executions route, the fallback is that the
  * schedule exists, is enabled and saves to S3; that proves a dump is
@@ -88,6 +88,6 @@ export declare function requireFreshBackupsForMove(ports: MoveGatePorts): Promis
 /**
  * The platform databases an upgrade of `service` can migrate. Postgres is all three. archon, ai and
  * integrations each migrate their own database when the new container starts. The owner company runs its own
- * sign-in, files and jobs, so the platform has no database for them; mail, edge and hc have no Postgres.
+ * sign-in, files and jobs, so the platform has no database for them; edge and hc have no Postgres.
  */
 export declare function platformDatabasesForService(service: string): readonly string[] | 'all';

package/dist/plan/backup-gate.js

@@ -123,8 +123,8 @@ function freshSuccess(executions, now, maxAgeMs = BACKUP_MAX_AGE_HOURS * 3_600_0
  * `unconfirmedUpgrades` and before any step. A service whose database the
  * company does not have passes (there is nothing to migrate); a database that
  * exists with no recorded schedule, a disabled or non-S3 schedule, a failed or
- * old dump, or an unreadable list all refuse. `mail` has no Postgres and is
- * not covered here (plan note `backup-not-covered:mail`).
+ * old dump, or an unreadable list all refuse. `mail` is covered like the rest:
+ * Stalwart's data store is a Postgres database.
  *
  * Where this Coolify has no executions route, the fallback is that the
  * schedule exists, is enabled and saves to S3; that proves a dump is
@@ -252,10 +252,15 @@ export async function requireFreshBackupsForMove(ports) {
 /**
  * The platform databases an upgrade of `service` can migrate. Postgres is all three. archon, ai and
  * integrations each migrate their own database when the new container starts. The owner company runs its own
- * sign-in, files and jobs, so the platform has no database for them; mail, edge and hc have no Postgres.
+ * sign-in, files and jobs, so the platform has no database for them; edge and hc have no Postgres.
  */
 export function platformDatabasesForService(service) {
     if (service === 'postgres')
         return 'all';
-    return service === 'archon' || service === 'ai' || service === 'integrations' ? [service] : [];
+    return service === 'archon' ||
+        service === 'ai' ||
+        service === 'integrations' ||
+        service === 'mail'
+        ? [service]
+        : [];
 }

package/dist/plan/company-backups.d.ts

@@ -11,6 +11,11 @@ import type { DraftStep } from './diff.js';
  * `app` is the hosting entry's database, recorded as a resource id.
  */
 export declare function companyDatabaseKeys(org: Pick<DeclaredOrg, 'id'>): Readonly<Record<string, string>>;
+/**
+ * The database a company backup schedule must name when the Coolify resource
+ * is not left to pick its first database. Absent: the resource's first database.
+ */
+export declare const COMPANY_BACKUP_DATABASE_NAMES: Readonly<Record<string, string>>;
 /** What every recorded-id key of a company database's backup schedule starts with. */
 export declare const BACKUP_SCOPE_PREFIX = "backup_";
 /** The recorded-id key a company database's backup schedule uuid is stored under. */
@@ -22,8 +27,8 @@ export declare function databasesForService(service: string): readonly string[]
  * recorded uuid and no recorded backup yet. `storageUuid` undefined means the
  * host did not wire backups, so nothing is planned and nothing is said; null
  * means the platform's backup storage is not registered, so each database is
- * reported as blocked instead (rule 2). A company that runs its own mail
- * server carries a note that the Stalwart volume has no Postgres to dump.
+ * reported as blocked instead (rule 2). A company's mail server is one of
+ * these databases (Stalwart's data store), dumped like the rest.
  */
 export declare function planCompanyBackups(org: DeclaredOrg, recordedIds: Readonly<Record<string, string>>, storageUuid: string | null | undefined): {
     steps: DraftStep[];

package/dist/plan/company-backups.js

@@ -1,6 +1,6 @@
-import { ownsServices } from '../org.js';
 import { BOULE_DATABASE_SCOPE_KEY } from './boule.js';
 import { CHAT_REKEY_MAS_DB_SCOPE_KEY, CHAT_REKEY_SYNAPSE_DB_SCOPE_KEY } from './executor.js';
+import { MAIL_DATABASE_NAME, MAIL_DATABASE_SCOPE_KEY } from './mail-store.js';
 /**
  * F6: the Postgres databases of a company that get a nightly backup, and the
  * recorded id each one's uuid sits under. The keys are second, documented
@@ -14,6 +14,7 @@ export function companyDatabaseKeys(org) {
     return {
         app: `coolify:database:${org.id}`,
         cms: 'coolify_cms_database',
+        mail: MAIL_DATABASE_SCOPE_KEY,
         auth: 'coolify_platform_auth_database',
         files: 'coolify_platform_files_database',
         jobs: 'coolify_jobs_database',
@@ -28,6 +29,13 @@ export function companyDatabaseKeys(org) {
         chat_rekey_mas: CHAT_REKEY_MAS_DB_SCOPE_KEY,
     };
 }
+/**
+ * The database a company backup schedule must name when the Coolify resource
+ * is not left to pick its first database. Absent: the resource's first database.
+ */
+export const COMPANY_BACKUP_DATABASE_NAMES = {
+    mail: MAIL_DATABASE_NAME,
+};
 /** What every recorded-id key of a company database's backup schedule starts with. */
 export const BACKUP_SCOPE_PREFIX = 'backup_';
 /** The recorded-id key a company database's backup schedule uuid is stored under. */
@@ -43,6 +51,8 @@ export function databasesForService(service) {
             return ['files'];
         case 'jobs':
             return ['jobs'];
+        case 'mail':
+            return ['mail'];
         case 'synapse':
             return ['synapse', 'chat_synapse'];
         case 'mas':
@@ -58,8 +68,8 @@ export function databasesForService(service) {
  * recorded uuid and no recorded backup yet. `storageUuid` undefined means the
  * host did not wire backups, so nothing is planned and nothing is said; null
  * means the platform's backup storage is not registered, so each database is
- * reported as blocked instead (rule 2). A company that runs its own mail
- * server carries a note that the Stalwart volume has no Postgres to dump.
+ * reported as blocked instead (rule 2). A company's mail server is one of
+ * these databases (Stalwart's data store), dumped like the rest.
  */
 export function planCompanyBackups(org, recordedIds, storageUuid) {
     const steps = [];
@@ -91,11 +101,5 @@ export function planCompanyBackups(org, recordedIds, storageUuid) {
             },
         });
     }
-    if (ownsServices(org)) {
-        blocked.push({
-            description: `${org.slug}'s mail server keeps its data on a volume, not in Postgres: no backup covers it yet`,
-            key: 'backup-not-covered:mail',
-        });
-    }
     return { steps, blocked };
 }

package/dist/plan/diff.js

@@ -14,6 +14,7 @@ import { appHostname, tunnelDnsHostnames } from './hostnames.js';
 import { lockedHostnames } from './locked-hostnames.js';
 import { LOGIN_BINDING_SCOPE_KEY, agoraIssuerHostFor, companyLoginTunnelHost, loginBindingState, loginHostClientIds, loginHostServesAgora, loginHostnameFor, ownAuthApplied, pendingRemovalHosts, } from './login-host.js';
 import { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, parseMailCopyCompleted, } from './mail-copy.js';
+import { mailStoreSwitchChange } from './mail-store.js';
 import { hasAdoptedResources, networkMoveNeeded, planNetworkMove } from './network-move.js';
 import { OWN_AUTH_BLOCKED_KEY, OWN_FILES_BLOCKED_KEY, OWN_FILES_R2_BLOCKED_KEY, OWN_JOBS_BLOCKED_KEY, OWN_MAIL_BLOCKED_KEY, OWN_SFU_BLOCKED_KEY, OWN_SFU_FIREWALL_KEY, planOwnAuth, planOwnFiles, planOwnFilesR2, planOwnJobs, planOwnMail, planOwnSfu, } from './own-diff.js';
 import { ownDnsHostnames } from './own-dns.js';
@@ -319,6 +320,9 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     // uses, never `versionChangeLine`'s "X -> Y (redeploy)" -- nothing here
     // ever performs that redeploy.
     const versionChanges = [];
+    if (ownMail.step?.action.desired.switchMailStore) {
+        versionChanges.push(mailStoreSwitchChange(org.slug));
+    }
     if (org.calls.enabled && !calls.blocked) {
         const callsAppLive = Boolean(byKey.get(resourceKey('coolify', 'calls', org.id)));
         const synapseChange = versionNotAppliedLine('synapse', callsAppLive, recordedIds[CALLS_SYNAPSE_APPLIED_IMAGE_TAG_SCOPE_KEY], versionPin?.calls ?? VERSIONS.synapse);

package/dist/plan/executor.d.ts

@@ -15,6 +15,7 @@ import { type MailCopyPort } from './mail-copy.js';
 import { type OwnServicesPort } from './own-services.js';
 import type { DestroyTarget, StepDestroyer, StepExecutionContext, StepExecutor } from './plan-apply.js';
 import type { EdgePortName } from './platform-org.js';
+import type { RequestHeaderPort } from './platform-providers.js';
 export declare function coolifyProjectMark(org: Pick<DeclaredOrg, 'id'>): string;
 /**
  * The Coolify calls this executor makes, shaped to match
@@ -1595,6 +1596,13 @@ export interface FoundryStepExecutorPorts {
      * `edge.tunnels` (see {@link EdgePort.tunnels}). Kept for a host or a test that supplies its own.
      */
     tunnels?: TunnelPort;
+    /**
+     * #745: the Cloudflare request header rule call, edge's `platform.requestHeaders`
+     * (`@wtfalch/edge` 0.14.0). A company's sign-in hostname gets its header strip rule
+     * through it before its DNS record; without it the step logs one fixed line and
+     * writes no rule. Mail and SFU hostnames never use it.
+     */
+    requestHeaders?: RequestHeaderPort;
     /**
      * F4.access: overrides the Access calls, which otherwise go through
      * `edge.access` (see {@link EdgePort.access}). Kept for a host or a test that supplies its own.

package/dist/plan/executor.js

@@ -13,7 +13,7 @@ import { recordBuiltCommit } from './build-record.js';
 import { MAS_TAG, SYNAPSE_IMAGE, SYNAPSE_TAG, callsMasConfigYaml, callsServerName, callsSynapseHomeserverYaml, masDockerfile, mintCallsMatrixSecrets, parseCallsDbUrl, } from './calls-matrix.js';
 import { CHAT_MAS_PORT, CHAT_REPO, CHAT_SERVICE_DOCKERFILE, CHAT_SERVICE_PORT, CHAT_SYNAPSE_DOCKERFILE, CHAT_SYNAPSE_PORT, assertChatServerName, chatInternalNames, chatMasConfigYaml, chatRekeyedInternalNames, chatServerName, chatServiceEnvs, chatSynapseHomeserverYaml, chatUpstreams, } from './chat-matrix.js';
 import { ensureCloudflaredConnector } from './cloudflared-connector.js';
-import { BACKUP_SCOPE_PREFIX, backupScopeKey } from './company-backups.js';
+import { BACKUP_SCOPE_PREFIX, COMPANY_BACKUP_DATABASE_NAMES, backupScopeKey, } from './company-backups.js';
 import { CORE_FILES_COLLECTION_NAME, FILES_CORE_COLLECTION_SCOPE_KEY, ZITADEL_FILES_PROJECT_SCOPE_KEY, } from './core-files.js';
 import { waitForNewDeployment, } from './deploy-health.js';
 import { PLATFORM_NETWORK, companyNetworkName, ensureDestination, findDestination, onPlatformNetwork, placed, placedByScope, } from './destinations.js';
@@ -2633,6 +2633,7 @@ export class FoundryStepExecutor {
             databaseUuid: databaseId,
             label: `${org.slug} ${database}`,
             storageUuid,
+            databaseName: COMPANY_BACKUP_DATABASE_NAMES[database],
         });
         context.recordScopeId(backupScopeKey(database), uuid);
         return undefined;
@@ -5749,7 +5750,12 @@ export class FoundryStepExecutor {
             apex: hn.zone,
             gitRef,
             project: { ensure: () => this.ensureCoolifyProject(org, context) },
-            network: orgNetwork({ dns: this.dnsPort(), tunnels: this.tunnelPort(), zones: this.zonePort() }, scope, `${org.slug}:auth`),
+            network: orgNetwork({
+                dns: this.dnsPort(),
+                tunnels: this.tunnelPort(),
+                requestHeaders: this.ports.requestHeaders,
+                zones: this.zonePort(),
+            }, scope, `${org.slug}:auth`),
             smtpSender: `noreply@${hn.mailDomain}`,
             defaultRedirectUri: `https://${agoraHostnameFor(org)}`,
             ownerCompany: null,
@@ -5808,12 +5814,17 @@ export class FoundryStepExecutor {
             },
             zitadel: own.zitadelFor({ issuerUrl, bearerRef: target.refs.instanceBearer }),
             zitadelForInstance: undefined,
+            runtime: {
+                ...own.provision.mail.runtime,
+                onSecret: (value) => this.handledSecrets.add(value),
+            },
         }, target, {
             hostname: action.desired.hostname,
             apex: hn.mailDomain,
             zone: hn.zone,
             mailHost: action.desired.mailHost,
             imageTag: action.desired.gitRef,
+            switchStore: action.desired.switchMailStore === true,
             hostPorts: bind ? `${bind}:${smtpPort}:25` : `${smtpPort}:25`,
             issuerUrl,
             mxRecord: null,

package/dist/plan/index.d.ts

@@ -23,6 +23,7 @@ export { AdoptRefusedError } from './adopt.js';
 export type { AuditActor, AuditLog, AuthzGate, StepExecutor, StepDestroyer, DestroyTarget, StepExecutionContext, PlatformStepExecutor, PlatformStepExecutionContext, FoundryPlanApplyOptions, FoundryApplyOptions, } from './plan-apply.js';
 export { FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, ConfirmationRequiredError, NotAuthorizedError, NotATestOrgError, DeclaredPlatformNotFoundError, PlatformStalePlanError, PlatformConfirmationRequiredError, UpgradeConfirmationRequiredError, planNeedsConfirmation, } from './plan-apply.js';
 export type { UnconfirmedUpgrade } from './confirm-upgrade.js';
+export { MAIL_STORE_SWITCH_SERVICE } from './mail-store.js';
 export { NetworkMoveBackupMissingError, UpgradeBackupMissingError } from './backup-gate.js';
 export type { BackupGatePorts, MoveGatePorts } from './backup-gate.js';
 export { FoundryPlatformStepExecutor, ProvidersPlatformCloudflareReader, ProvidersPlatformCoolifyReader, PLATFORM_MAIL_ADMIN_KEY_DESCRIPTION, filesPublicHostsValue, filesShareDomains, provisionFilesHost, provisionJobsHost, provisionMailServer, } from './platform-providers.js';
@@ -63,7 +64,7 @@ export { createEdgeAccess } from './edge-access.js';
 export type { AccessAppSummary, AccessDecision, AccessPolicyRule, AccessPort, EdgePlatformAccess, } from './edge-access.js';
 export { createEdgeWorkers } from './edge-workers.js';
 export type { EdgePlatformWorkers, EdgeWorkersOptions, PlatformWorkersPort, } from './edge-workers.js';
-export type { PlatformUptimeAccessFactory, PlatformUptimeAccessPort, PlatformUptimeDeps, PlatformWorkersFactory, } from './uptime-worker.js';
+export type { PlatformUptimeAccessFactory, PlatformUptimeAccessPort, PlatformUptimeChatDeps, PlatformUptimeDeps, PlatformWorkersFactory, } from './uptime-worker.js';
 export { createEdgeRateLimits } from './edge-ratelimits.js';
 export type { EdgePlatformRateLimits, EdgeRateLimitsOptions, RateLimitPort, RateLimitRuleInput, } from './edge-ratelimits.js';
 export { createEdgeZones } from './edge-zones.js';

package/dist/plan/index.js

@@ -10,6 +10,7 @@ export { OWN_FILES_R2_SCOPE_KEY, OWN_FILES_R2_UNDELIVERED_SCOPE_KEY, OWN_SERVICE
 export { PlatformOrgBlockedError, PlatformOrgPorts } from './platform-org-ports.js';
 export { AdoptRefusedError } from './adopt.js';
 export { FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, ConfirmationRequiredError, NotAuthorizedError, NotATestOrgError, DeclaredPlatformNotFoundError, PlatformStalePlanError, PlatformConfirmationRequiredError, UpgradeConfirmationRequiredError, planNeedsConfirmation, } from './plan-apply.js';
+export { MAIL_STORE_SWITCH_SERVICE } from './mail-store.js';
 export { NetworkMoveBackupMissingError, UpgradeBackupMissingError } from './backup-gate.js';
 export { FoundryPlatformStepExecutor, ProvidersPlatformCloudflareReader, ProvidersPlatformCoolifyReader, PLATFORM_MAIL_ADMIN_KEY_DESCRIPTION, filesPublicHostsValue, filesShareDomains, provisionFilesHost, provisionJobsHost, provisionMailServer, } from './platform-providers.js';
 // #171: how a host signs files management requests with the delivered key.

package/dist/plan/mail-store.d.ts

@@ -0,0 +1,34 @@
+import { type VersionChangeItem } from '../plan.js';
+/**
+ * Stalwart keeps its data (mail, accounts, settings, DKIM keys) in a Coolify
+ * Postgres, so the nightly dump of that database is the off-server backup.
+ * These keys are shared by the planners (which must not import
+ * `platform-providers.ts`) and by `provisionMailServer`.
+ */
+/** The recorded uuid of the mail Postgres, under the same name for the platform and every company. */
+export declare const MAIL_DATABASE_SCOPE_KEY = "coolify_mail_database";
+/** Recorded as {@link MAIL_STORE_POSTGRES} once the `Bootstrap` write has pointed Stalwart at the database. */
+export declare const MAIL_STORE_SCOPE_KEY = "mail_store";
+export declare const MAIL_STORE_POSTGRES = "postgres";
+/** The recorded uuid of the Stalwart app (`platform-providers.ts` re-exports it under its old name). */
+export declare const MAIL_APP_SCOPE_KEY = "coolify_platform_mail_app";
+/** The database and its owner, and the env var Stalwart reads the password from. */
+export declare const MAIL_DATABASE_NAME = "stalwart";
+export declare const MAIL_DATABASE_USER = "stalwart";
+export declare const MAIL_DATABASE_PASSWORD_ENV = "STALWART_DB_PASSWORD";
+/** The `confirmUpgrade` name that confirms the switch (`VersionChangeItem.service`). */
+export declare const MAIL_STORE_SWITCH_SERVICE = "mail-store";
+/**
+ * A Stalwart app is recorded and its data store was never moved to Postgres
+ * (no mail database recorded either: a fresh instance records that before it
+ * creates the app, so a crash halfway never reads as a volume-backed server).
+ */
+export declare function mailStoreIsLegacy(recorded: Readonly<Record<string, string>>): boolean;
+/** The one step description for the switch. `owner` is `the platform` or the company's slug. */
+export declare function mailStoreSwitchDescription(owner: string): string;
+/**
+ * The version-change line that makes `apply` refuse the plan until
+ * `confirmUpgrade` names `mail-store`. Fixed text: it is part of the
+ * stale-plan comparison.
+ */
+export declare function mailStoreSwitchChange(owner: string): VersionChangeItem;

package/dist/plan/mail-store.js

@@ -0,0 +1,49 @@
+import { VERSION_CHANGE_KIND } from '../plan.js';
+/**
+ * Stalwart keeps its data (mail, accounts, settings, DKIM keys) in a Coolify
+ * Postgres, so the nightly dump of that database is the off-server backup.
+ * These keys are shared by the planners (which must not import
+ * `platform-providers.ts`) and by `provisionMailServer`.
+ */
+/** The recorded uuid of the mail Postgres, under the same name for the platform and every company. */
+export const MAIL_DATABASE_SCOPE_KEY = 'coolify_mail_database';
+/** Recorded as {@link MAIL_STORE_POSTGRES} once the `Bootstrap` write has pointed Stalwart at the database. */
+export const MAIL_STORE_SCOPE_KEY = 'mail_store';
+export const MAIL_STORE_POSTGRES = 'postgres';
+/** The recorded uuid of the Stalwart app (`platform-providers.ts` re-exports it under its old name). */
+export const MAIL_APP_SCOPE_KEY = 'coolify_platform_mail_app';
+/** The database and its owner, and the env var Stalwart reads the password from. */
+export const MAIL_DATABASE_NAME = 'stalwart';
+export const MAIL_DATABASE_USER = 'stalwart';
+export const MAIL_DATABASE_PASSWORD_ENV = 'STALWART_DB_PASSWORD';
+/** The `confirmUpgrade` name that confirms the switch (`VersionChangeItem.service`). */
+export const MAIL_STORE_SWITCH_SERVICE = 'mail-store';
+/**
+ * A Stalwart app is recorded and its data store was never moved to Postgres
+ * (no mail database recorded either: a fresh instance records that before it
+ * creates the app, so a crash halfway never reads as a volume-backed server).
+ */
+export function mailStoreIsLegacy(recorded) {
+    return (Boolean(recorded[MAIL_APP_SCOPE_KEY]) &&
+        !recorded[MAIL_DATABASE_SCOPE_KEY] &&
+        recorded[MAIL_STORE_SCOPE_KEY] !== MAIL_STORE_POSTGRES);
+}
+/** The one step description for the switch. `owner` is `the platform` or the company's slug. */
+export function mailStoreSwitchDescription(owner) {
+    return `switch ${owner}'s mail store to Postgres (recreates the mail server; mail stored there is deleted)`;
+}
+/**
+ * The version-change line that makes `apply` refuse the plan until
+ * `confirmUpgrade` names `mail-store`. Fixed text: it is part of the
+ * stale-plan comparison.
+ */
+export function mailStoreSwitchChange(owner) {
+    return {
+        kind: VERSION_CHANGE_KIND,
+        service: MAIL_STORE_SWITCH_SERVICE,
+        description: `${owner}'s mail server still stores its data on a volume: moving it to Postgres recreates the server and deletes the mail stored there; confirm with confirmUpgrade "${MAIL_STORE_SWITCH_SERVICE}"`,
+        from: 'volume',
+        to: 'postgres',
+        needsConfirmation: true,
+    };
+}

package/dist/plan/own-diff.js

@@ -6,6 +6,7 @@ import { brokerEntryAppliedScopeKey } from './broker-entries.js';
 import { ZITADEL_FILES_PROJECT_SCOPE_KEY } from './core-files.js';
 import { OWN_AUTH_APPLIED_HOSTNAME_SCOPE_KEY, ownAuthApplied } from './login-host.js';
 import { OWN_MAIL_SMTP_INTERNAL_SCOPE_KEY, OWN_MAIL_SMTP_PORT_BASE, OWN_MAIL_SMTP_PORT_SCOPE_KEY, isOwnMailSmtpPort, } from './mail-relay.js';
+import { mailStoreIsLegacy, mailStoreSwitchDescription } from './mail-store.js';
 import { ownHostnames } from './own-hostnames.js';
 import { OWN_FILES_R2_SCOPE_KEY, OWN_SERVICES_APPLIED_SCOPE_KEY, orgTarget, } from './own-services.js';
 import { OWN_SFU_APPLIED_HOSTNAME_SCOPE_KEY, OWN_SFU_APPLIED_SLOT_SCOPE_KEY, OWN_SFU_APPLIED_VERSION_SCOPE_KEY, OWN_SFU_DEPLOY_PENDING_SCOPE_KEY, OWN_SFU_KEYS_UNDELIVERED_SCOPE_KEY, SFU_INTERNAL_URL_SCOPE_KEY, SFU_PUBLIC_URL_SCOPE_KEY, } from './own-sfu.js';
@@ -212,7 +213,9 @@ export function planOwnMail(options) {
     const smtpPort = options.smtpPort ?? OWN_MAIL_SMTP_PORT_BASE;
     if (!isOwnMailSmtpPort(smtpPort))
         return blocked('its mail port is outside the range foundry uses');
-    if (recordedIds[`coolify:own-mail:${org.id}`] &&
+    const storeSwitch = mailStoreIsLegacy(recordedIds);
+    if (!storeSwitch &&
+        recordedIds[`coolify:own-mail:${org.id}`] &&
         recordedIds[OWN_MAIL_SMTP_PORT_SCOPE_KEY] === String(smtpPort) &&
         recordedIds[PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY] === hostname &&
         recordedIds[PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY] === gitRef &&
@@ -227,11 +230,19 @@ export function planOwnMail(options) {
                 system: 'coolify',
                 kind: 'own-mail',
                 key: org.id,
-                desired: { hostname, gitRef, mailHost: platformMailMxHost(platformApex), smtpPort },
+                desired: {
+                    hostname,
+                    gitRef,
+                    mailHost: platformMailMxHost(platformApex),
+                    smtpPort,
+                    ...(storeSwitch ? { switchMailStore: true } : {}),
+                },
             },
             step: {
-                description: `provision ${org.slug}'s own mail server`,
-                destroys: false,
+                description: storeSwitch
+                    ? mailStoreSwitchDescription(org.slug)
+                    : `provision ${org.slug}'s own mail server`,
+                destroys: storeSwitch,
                 migrates: false,
             },
         },

package/dist/plan/own-services.d.ts

@@ -6,7 +6,7 @@ import type { DnsPort } from './edge-dns.js';
 import type { ZonePort } from './edge-zones.js';
 import type { CallsSfuPort, CloudflarePort, CoolifyPort, FilesOrganisationPort, FoundryStepExecutorPorts, JobsSchedulerPort, MailPort, ZitadelPort } from './executor.js';
 import type { PlatformStepExecutionContext, StepExecutionContext } from './plan-apply.js';
-import type { FoundryPlatformStepExecutorOptions, PlatformAuthDeps, PlatformDnsFactory, PlatformFilesDeps, PlatformMailDeps, PlatformTunnelPort, PlatformTunnelsFactory } from './platform-providers.js';
+import type { FoundryPlatformStepExecutorOptions, PlatformAuthDeps, PlatformDnsFactory, PlatformFilesDeps, PlatformMailDeps, PlatformRequestHeadersFactory, PlatformTunnelPort, PlatformTunnelsFactory, RequestHeaderPort } from './platform-providers.js';
 /** Applied-state key under which an own org's provisioned-services marker is recorded. */
 export declare const OWN_SERVICES_APPLIED_SCOPE_KEY = "own_services_applied";
 /**
@@ -26,6 +26,7 @@ export interface ServiceTarget {
         authTunnel: string;
         authCloudflared: string;
         mailApp: string;
+        mailDb: string;
         mailTunnel: string;
         mailCloudflared: string;
         filesDb: string;
@@ -82,10 +83,13 @@ export interface ServiceNetwork {
     dns(): Promise<DnsPort>;
     tunnels(): Promise<PlatformTunnelPort>;
     zoneId(apex: string): Promise<string | undefined>;
+    /** Undefined when the host supplies no way to write Cloudflare request header rules. */
+    requestHeaders(): Promise<RequestHeaderPort | undefined>;
 }
 export declare function platformNetwork(deps: {
     dns: PlatformDnsFactory;
     tunnels: PlatformTunnelsFactory;
+    requestHeaders?: PlatformRequestHeadersFactory;
     cloudflare: Pick<CloudflarePort, 'findZoneByApex'>;
 }, scope: StepScope, step: string): ServiceNetwork;
 /**
@@ -96,6 +100,7 @@ export declare function platformNetwork(deps: {
 export declare function orgNetwork(ports: {
     dns?: DnsPort;
     tunnels?: PlatformTunnelPort;
+    requestHeaders?: RequestHeaderPort;
     zones?: Pick<ZonePort, 'findZoneByApex'>;
 }, scope: StepScope, step: string): ServiceNetwork;
 /** Where the project comes from: the platform's 'platform' project, or the org's own. */

package/dist/plan/own-services.js

@@ -1,5 +1,5 @@
 import { NO_DOMAIN_ZONE } from './own-hostnames.js';
-import { apexZoneKey, exactZone, platformDns, platformTunnels } from './platform-providers.js';
+import { apexZoneKey, exactZone, platformDns, platformRequestHeaders, platformTunnels, } from './platform-providers.js';
 /** The key the org's zone step records its Cloudflare zone id under. */
 const ORG_ZONE_SCOPE_KEY = 'cloudflare_zone';
 /** Applied-state key under which an own org's provisioned-services marker is recorded. */
@@ -17,6 +17,7 @@ export function platformTarget() {
             authTunnel: 'platform-auth-tunnel',
             authCloudflared: 'platform-auth-cloudflared',
             mailApp: 'platform-mail-stalwart',
+            mailDb: 'platform-mail-postgres',
             mailTunnel: 'platform-mail-tunnel',
             mailCloudflared: 'platform-mail-cloudflared',
             filesDb: 'platform-files-db',
@@ -66,6 +67,7 @@ export function orgTarget(org) {
             authTunnel: `${s}-auth-tunnel`,
             authCloudflared: `${s}-auth-cloudflared`,
             mailApp: `${s}-mail-stalwart`,
+            mailDb: `${s}-mail-postgres`,
             mailTunnel: `${s}-mail-tunnel`,
             mailCloudflared: `${s}-mail-cloudflared`,
             filesDb: `${s}-files-db`,
@@ -123,6 +125,7 @@ export function platformNetwork(deps, scope, step) {
     return {
         dns: () => platformDns(deps, scope.recordedIds(), step),
         tunnels: () => platformTunnels(deps, scope.recordedIds(), step),
+        requestHeaders: () => platformRequestHeaders(deps, scope.recordedIds()),
         zoneId: async (apex) => scope.recordedIds()[apexZoneKey(apex)] ?? (await exactZone(deps.cloudflare, apex))?.id,
     };
 }
@@ -143,6 +146,7 @@ export function orgNetwork(ports, scope, step) {
                 throw new Error(`${step}: the host supplies no tunnel port for this org`);
             return ports.tunnels;
         },
+        requestHeaders: async () => ports.requestHeaders,
         zoneId: async (apex) => {
             // The recorded zone is the company's own; `oikos.host` is never it.
             const recorded = apex === NO_DOMAIN_ZONE ? undefined : scope.recordedIds()[ORG_ZONE_SCOPE_KEY];

package/dist/plan/plan-apply.js

@@ -22,7 +22,7 @@ import { findNameClashes, nameClashMessage } from './org-names.js';
 import { ownHostnames } from './own-hostnames.js';
 import { OWN_FILES_R2_UNDELIVERED_SCOPE_KEY, orgTarget } from './own-services.js';
 import { PLATFORM_ARCHON_KEY, PLATFORM_BACKUP_DATABASE_SCOPE_KEYS, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_KEY, appStepKey, planPlatform as computePlatformPlanDetail, toPlatformPlan, } from './platform-diff.js';
-import { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesForOwn, agoraHostValuesFromPlatform, dnsBlockedReason, heldOwnKeyRefs, heldPlatformKeyRefs, orgPlatformReadinessFor, orgPlatformReadinessFrom, ownerFilesFrom, ownerSignInFrom, platformOwnerUserIdFrom, serviceGitRefsOf, } from './platform-org.js';
+import { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesForOwn, agoraHostValuesFromPlatform, dnsBlockedReason, heldOwnKeyRefs, heldPlatformKeyRefs, orgPlatformReadinessFor, orgPlatformReadinessFrom, ownerChatFrom, ownerFilesFrom, ownerSignInFrom, platformOwnerUserIdFrom, serviceGitRefsOf, } from './platform-org.js';
 import { PLATFORM_AUTH_BROKER_MAIL_KEY_REF, PLATFORM_BACKUP_S3_STORAGE_SCOPE_KEY, } from './platform-providers.js';
 import { CLOUDFLARE_TUNNEL_ENTRY_ROUTES_SCOPE_KEY, CLOUDFLARE_TUNNEL_OIKOS_HOSTNAMES_SCOPE_KEY, } from './proxy-labels.js';
 import { liveWorkers, workerTraceScopeKeys } from './worker.js';
@@ -1330,9 +1330,13 @@ export class FoundryPlanApply {
     async platformOwnerInput(platform) {
         const owner = await this.store.get(platform.ownerOrgId);
         if (!owner)
-            return { signIn: null, files: null };
+            return { signIn: null, files: null, chat: null };
         const recorded = (await this.store.getAppliedState(owner.id))?.serviceIds ?? {};
-        return { signIn: ownerSignInFrom(owner, recorded), files: ownerFilesFrom(owner, recorded) };
+        return {
+            signIn: ownerSignInFrom(owner, recorded),
+            files: ownerFilesFrom(owner, recorded),
+            chat: ownerChatFrom(owner, recorded),
+        };
     }
     /**
      * What the shared mail relay needs from the orgs. A route exists for an org

package/dist/plan/platform-diff.d.ts

@@ -1030,6 +1030,25 @@ export declare const PLATFORM_UPTIME_APPLIED_SECRETS_SCOPE_KEY = "uptime_applied
 export declare const PLATFORM_UPTIME_APPLIED_VARS_SCOPE_KEY = "uptime_applied_vars";
 /** `'1'` once the step removed the Worker because the platform no longer enables it; cleared when it deploys again. */
 export declare const PLATFORM_UPTIME_REMOVED_SCOPE_KEY = "uptime_removed";
+/**
+ * The chat bot's room (`!id:server`), recorded as soon as chat-service names it.
+ * Recorded before the bot's token is held, so a crash between the two leaves the room known.
+ */
+export declare const PLATFORM_UPTIME_CHAT_ROOM_ID_SCOPE_KEY = "platform_uptime_chat_room_id";
+/**
+ * A random id, recorded and persisted before the chat route is called (it mints the bot's token) and
+ * cleared once that token is held. Set while the token is not held, it means a token was minted that may
+ * be lost, so the next call asks the route to rotate it.
+ */
+export declare const PLATFORM_UPTIME_CHAT_UNDELIVERED_SCOPE_KEY = "platform_uptime_chat_token_undelivered";
+/**
+ * The Worker's plain text variables: the chat homeserver and room foundry made, under whatever the
+ * host configured (a host value that is set wins). Unset values are left out.
+ */
+export declare function uptimeEffectiveVars(hostVars: Readonly<Record<string, string | undefined>> | undefined, chat: {
+    homeserverUrl: string;
+    roomId: string;
+} | null): Record<string, string | undefined>;
 /** The digest of the Worker's plain text variables that are set; empty when none is. */
 export declare function uptimeVarsDigest(vars?: Readonly<Record<string, string | undefined>>): string;
 /** The Worker secret names the step sets: the three it mints, and each held one. */
@@ -1164,6 +1183,16 @@ export interface PlanPlatformOptions {
             access: boolean;
             vars: string;
         };
+        /**
+         * The uptime Worker's chat bot, when the host wired one. `pending`: the bot's token is not held and
+         * Company Included's chat is applied, so the step makes it. `blocked`: why it cannot yet (a fixed
+         * line, reported without stopping the rest of the Worker). Absent: no bot path, so the plan keeps
+         * asking for a hand-held credential.
+         */
+        uptimeChat?: {
+            pending: boolean;
+            blocked?: string;
+        };
         /** Why Archon's step must wait: the deployment it triggered is still running. Blocks even an applied step. */
         archonDeployRunning?: string;
         /**
@@ -1279,6 +1308,7 @@ export declare const PLATFORM_BACKUP_DATABASE_SCOPE_KEYS: {
     readonly archon: "coolify_platform_archon_database";
     readonly ai: "coolify_platform_ai_database";
     readonly integrations: "coolify_integrations_database";
+    readonly mail: "coolify_mail_database";
 };
 export type PlatformBackupServiceKey = keyof typeof PLATFORM_BACKUP_DATABASE_SCOPE_KEYS;
 export declare const PLATFORM_BACKUP_SERVICE_KEYS: readonly PlatformBackupServiceKey[];