@wtfalch/foundry 0.36.1 → 0.38.0

package/dist/plan/platform-diff.js

@@ -7,6 +7,7 @@ import { versionChangeNeedsConfirmation } from './confirm-upgrade.js';
 import { ACCESS_PROVIDER_RECORD_KEY } from './gates.js';
 import { legacyAppHostname } from './hostnames.js';
 import { PLATFORM_MAIL_RELAY_KEY, planMailRelay } from './mail-relay.js';
+import { MAIL_DATABASE_SCOPE_KEY, mailStoreIsLegacy, mailStoreSwitchChange, mailStoreSwitchDescription, } from './mail-store.js';
 import { planOikosIngress } from './oikos-ingress.js';
 import { callsSfuAppliedFingerprint } from './platform-sfu.js';
 import { signInDomainBlockedText } from './sign-in-org.js';
@@ -1155,6 +1156,28 @@ export const PLATFORM_UPTIME_APPLIED_SECRETS_SCOPE_KEY = 'uptime_applied_secrets
 export const PLATFORM_UPTIME_APPLIED_VARS_SCOPE_KEY = 'uptime_applied_vars';
 /** `'1'` once the step removed the Worker because the platform no longer enables it; cleared when it deploys again. */
 export const PLATFORM_UPTIME_REMOVED_SCOPE_KEY = 'uptime_removed';
+/**
+ * The chat bot's room (`!id:server`), recorded as soon as chat-service names it.
+ * Recorded before the bot's token is held, so a crash between the two leaves the room known.
+ */
+export const PLATFORM_UPTIME_CHAT_ROOM_ID_SCOPE_KEY = 'platform_uptime_chat_room_id';
+/**
+ * A random id, recorded and persisted before the chat route is called (it mints the bot's token) and
+ * cleared once that token is held. Set while the token is not held, it means a token was minted that may
+ * be lost, so the next call asks the route to rotate it.
+ */
+export const PLATFORM_UPTIME_CHAT_UNDELIVERED_SCOPE_KEY = 'platform_uptime_chat_token_undelivered';
+/**
+ * The Worker's plain text variables: the chat homeserver and room foundry made, under whatever the
+ * host configured (a host value that is set wins). Unset values are left out.
+ */
+export function uptimeEffectiveVars(hostVars, chat) {
+    const host = Object.fromEntries(Object.entries(hostVars ?? {}).filter(([, v]) => Boolean(v)));
+    return {
+        ...(chat ? { CHAT_HOMESERVER_URL: chat.homeserverUrl, CHAT_ROOM_ID: chat.roomId } : {}),
+        ...host,
+    };
+}
 /** The digest of the Worker's plain text variables that are set; empty when none is. */
 export function uptimeVarsDigest(vars = {}) {
     const set = Object.entries(vars)
@@ -1332,7 +1355,7 @@ export function planPlatform(platform, live, options = {}) {
         plannedSteps.push(heartbeats.step);
     // foundry#542: after Archon is applied (never merely planned): the Worker
     // probes Archon, and Archon's env takes the token this step mints.
-    const uptime = planUptime(platform, recordedIds, blocked.uptime, blocked.uptimeSecretsHeld ?? [], Boolean(recordedIds[resourceKey('coolify', 'app', PLATFORM_ARCHON_KEY)]), blocked.uptimeHeld);
+    const uptime = planUptime(platform, recordedIds, blocked.uptime, blocked.uptimeSecretsHeld ?? [], Boolean(recordedIds[resourceKey('coolify', 'app', PLATFORM_ARCHON_KEY)]), blocked.uptimeHeld, blocked.uptimeChat);
     if (uptime.step)
         plannedSteps.push(uptime.step);
     if (archon.step && blocked.archonRunsInsideApp)
@@ -1353,6 +1376,9 @@ export function planPlatform(platform, live, options = {}) {
     // read for, is premature, not informational.
     const versionChanges = [];
     for (const change of [
+        mail.blocked || !mail.step?.action.desired.switchMailStore
+            ? null
+            : mailStoreSwitchChange('the platform'),
         mail.blocked
             ? null
             : versionChangeLine('mail', recordedIds[PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY], platform.mail.gitRef, 'image, redeploy'),
@@ -1593,11 +1619,13 @@ export const PLATFORM_BACKUP_DATABASE_SCOPE_KEYS = {
     archon: 'coolify_platform_archon_database',
     ai: 'coolify_platform_ai_database',
     integrations: 'coolify_integrations_database',
+    mail: MAIL_DATABASE_SCOPE_KEY,
 };
 export const PLATFORM_BACKUP_SERVICE_KEYS = [
     'archon',
     'ai',
     'integrations',
+    'mail',
 ];
 /**
  * #257: a nightly backup for each platform database foundry itself creates,
@@ -2047,7 +2075,9 @@ function planMail(platform, recordedIds, executorBlocked, authReady) {
     if (!platform.mail.enabled)
         return { step: null, blocked: null };
     const key = resourceKey('coolify', 'app', PLATFORM_MAIL_KEY);
-    if (recordedIds[key] &&
+    const storeSwitch = mailStoreIsLegacy(recordedIds);
+    if (!storeSwitch &&
+        recordedIds[key] &&
         recordedIds[PLATFORM_MAIL_CONNECTOR_APP_SCOPE_KEY] &&
         recordedIds[PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY] === platform.mail.hostname &&
         recordedIds[PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY] === platform.mail.gitRef &&
@@ -2083,6 +2113,28 @@ function planMail(platform, recordedIds, executorBlocked, authReady) {
             blocked: "the platform's mail server is blocked, not planned: its OIDC directory uses the platform's own sign-in, which is neither applied nor planned",
         };
     }
+    if (storeSwitch) {
+        return {
+            step: {
+                action: {
+                    system: 'coolify',
+                    kind: 'app',
+                    key: PLATFORM_MAIL_KEY,
+                    desired: {
+                        hostname: platform.mail.hostname,
+                        gitRef: platform.mail.gitRef,
+                        switchMailStore: true,
+                    },
+                },
+                step: {
+                    description: mailStoreSwitchDescription('the platform'),
+                    destroys: true,
+                    migrates: false,
+                },
+            },
+            blocked: null,
+        };
+    }
     return {
         step: {
             action: {
@@ -2684,7 +2736,7 @@ function planUptime(platform, recordedIds, executorBlocked, heldOptional, archon
     token: true,
     access: true,
     vars: '',
-}) {
+}, chat) {
     const { uptime } = platform;
     const deployed = Boolean(recordedIds[resourceKey('cloudflare', 'worker', PLATFORM_UPTIME_KEY)]) &&
         !recordedIds[PLATFORM_UPTIME_REMOVED_SCOPE_KEY];
@@ -2733,7 +2785,7 @@ function planUptime(platform, recordedIds, executorBlocked, heldOptional, archon
     if (executorBlocked)
         return { step: null, blocked: [executorBlocked], notes: [] };
     const notes = [];
-    if (!heldOptional.includes('CHAT_ACCESS_TOKEN')) {
+    if (!chat && !heldOptional.includes('CHAT_ACCESS_TOKEN')) {
         notes.push({
             key: 'uptime:CHAT_ACCESS_TOKEN',
             service: 'uptime',
@@ -2759,9 +2811,12 @@ function planUptime(platform, recordedIds, executorBlocked, heldOptional, archon
         recordedIds[PLATFORM_UPTIME_APPLIED_SHA256_SCOPE_KEY] === uptime.sha256 &&
         recordedIds[PLATFORM_UPTIME_APPLIED_HOSTNAME_SCOPE_KEY] === hostname &&
         (recordedIds[PLATFORM_UPTIME_APPLIED_VARS_SCOPE_KEY] ?? '') === uptimeHeld.vars &&
-        recordedIds[PLATFORM_UPTIME_APPLIED_SECRETS_SCOPE_KEY] === uptimeSecretNames(heldOptional);
+        recordedIds[PLATFORM_UPTIME_APPLIED_SECRETS_SCOPE_KEY] === uptimeSecretNames(heldOptional) &&
+        !chat?.pending;
+    // Reported beside the step, not instead of it: the Worker deploys without chat alerts meanwhile.
+    const blockedLines = chat?.blocked ? [chat.blocked] : [];
     if (applied)
-        return { step: null, blocked: [], notes };
+        return { step: null, blocked: blockedLines, notes };
     return {
         step: {
             action: action({ hostname, gitRef: uptime.tag, sha256: uptime.sha256 }),
@@ -2771,7 +2826,7 @@ function planUptime(platform, recordedIds, executorBlocked, heldOptional, archon
                 migrates: false,
             },
         },
-        blocked: [],
+        blocked: blockedLines,
         notes,
     };
 }

package/dist/plan/platform-org.d.ts

@@ -304,10 +304,23 @@ export interface OwnerFiles {
     organisationId: string;
     managementKeyRef: string;
 }
+/**
+ * The owner company's chat once `coolify:chat` has applied: where the uptime
+ * Worker's bot is made and which people join its room.
+ */
+export interface OwnerChat {
+    /** The chat-service app (Coolify uuid), whose env holds `CHAT_INTERNAL_TOKEN`. */
+    appId: string;
+    /** The company's Agora host: the public origin of the bot route and the Matrix homeserver. */
+    agoraHost: string;
+    /** ZITADEL subjects of the owner company's owners whose invite is recorded. */
+    subjects: readonly string[];
+}
 /** What the platform plan reads about the owner company. */
 export interface PlatformOwnerInput {
     signIn?: OwnerSignIn | null;
     files?: OwnerFiles | null;
+    chat?: OwnerChat | null;
 }
 /**
  * The owner's sign-in from its declared org and the ids its own steps recorded.
@@ -326,3 +339,5 @@ export declare function ownerSignInFrom(owner: DeclaredOrg | null, recorded: Rea
 export declare function platformOwnerUserIdFrom(owner: DeclaredOrg | null, recorded: Readonly<Record<string, string>>): string | null;
 /** The owner's files host once its own files step has applied; `null` before. */
 export declare function ownerFilesFrom(owner: DeclaredOrg | null, recorded: Readonly<Record<string, string>>): OwnerFiles | null;
+/** The owner's chat once its `coolify:chat` step has applied; `null` before, and when chat is off. */
+export declare function ownerChatFrom(owner: DeclaredOrg | null, recorded: Readonly<Record<string, string>>): OwnerChat | null;

package/dist/plan/platform-org.js

@@ -1,5 +1,5 @@
 import { ownsServices } from '../org.js';
-import { ZITADEL_ORG_SCOPE_KEY } from './agora.js';
+import { ZITADEL_ORG_SCOPE_KEY, agoraHostnameFor } from './agora.js';
 import { ACCESS_PROVIDER_RECORD_KEY } from './gates.js';
 import { FILES_MANAGEMENT_KEY_REF, JOBS_ADMIN_TOKEN_REF, PLATFORM_AI_MANAGEMENT_KEY_REF, } from './held-key-refs.js';
 import { OWN_AUTH_APPLIED_HOSTNAME_SCOPE_KEY, ownAuthApplied } from './login-host.js';
@@ -352,3 +352,19 @@ export function ownerFilesFrom(owner, recorded) {
         managementKeyRef: orgTarget(owner).refs.filesManagement,
     };
 }
+/** The recorded id of the chat-service app (`coolify_chat_service`, set by the `coolify:chat` step). */
+const CHAT_SERVICE_APP_SCOPE_KEY = 'coolify_chat_service';
+/** The owner's chat once its `coolify:chat` step has applied; `null` before, and when chat is off. */
+export function ownerChatFrom(owner, recorded) {
+    const appId = recorded[CHAT_SERVICE_APP_SCOPE_KEY];
+    if (!owner || !owner.chat.enabled || !appId || !recorded[`coolify:chat:${owner.id}`])
+        return null;
+    return {
+        appId,
+        agoraHost: agoraHostnameFor(owner),
+        subjects: owner.owners.flatMap((o) => {
+            const id = recorded[`zitadel:owner:${owner.id}:${o.email.toLowerCase()}`];
+            return id ? [id] : [];
+        }),
+    };
+}

package/dist/plan/platform-providers.d.ts

@@ -59,6 +59,33 @@ export type PlatformTunnelPort = Pick<TunnelPort, 'findTunnelByName' | 'createTu
 export declare function platformTunnels(deps: {
     tunnels: PlatformTunnelsFactory;
 }, recorded: Readonly<Record<string, string>>, step: string): Promise<PlatformTunnelPort>;
+/**
+ * Request headers a client can set that ZITADEL reads to pick or name an
+ * instance (auth#241, auth#252). Cloudflare removes them from every inbound
+ * request on a sign-in hostname, because the tunnel routes ZITADEL's paths
+ * straight to ZITADEL and no app code sees them first.
+ */
+export declare const SIGNIN_STRIPPED_REQUEST_HEADERS: readonly ["X-Zitadel-Instance-Host", "X-Zitadel-Public-Host", "X-Zitadel-Forward-Host", "X-Forwarded-Host"];
+/** One Cloudflare request-header Transform Rule (phase `http_request_late_transform`) that removes headers. */
+export interface RequestHeaderStripRule {
+    /** Names the rule in the zone: the key that makes a repeat safe. */
+    description: string;
+    expression: string;
+    headers: readonly string[];
+}
+/** The Cloudflare request header rule calls a sign-in step makes. */
+export interface RequestHeaderPort {
+    /** Makes the rule, or returns the one already made for that zone and description. */
+    ensureRequestHeaderStrip(zoneId: string, rule: RequestHeaderStripRule): Promise<{
+        id: string;
+    }>;
+}
+/** Like {@link PlatformTunnelsFactory}: builds the {@link RequestHeaderPort} at edge's recorded address. */
+export type PlatformRequestHeadersFactory = (edgeUrl: string) => RequestHeaderPort | Promise<RequestHeaderPort>;
+/** The request header port for a platform step; undefined when edge is not recorded or the host supplied no factory. */
+export declare function platformRequestHeaders(deps: {
+    requestHeaders?: PlatformRequestHeadersFactory;
+}, recorded: Readonly<Record<string, string>>): Promise<RequestHeaderPort | undefined>;
 /**
  * F4.access: builds the {@link AccessPort} a platform step finds, creates and
  * deletes its Access app through, given the same address as
@@ -110,6 +137,11 @@ export interface PlatformAuthDeps {
     dns: PlatformDnsFactory;
     /** F4.tunnels: every tunnel call, through edge at its recorded address (see {@link PlatformTunnelsFactory}). */
     tunnels: PlatformTunnelsFactory;
+    /**
+     * Request header rules through edge. Edge has no such call yet (@wtfalch/edge 0.13.0 offers
+     * rate limit rules only), so a host that leaves this out gets no rule and a logged line per run.
+     */
+    requestHeaders?: PlatformRequestHeadersFactory;
     cloudflare: Pick<CloudflarePort, 'findZoneByApex'>;
     /** Must target the platform's own new instance (its issuer), or `zitadelForInstance` must be set. */
     zitadel: Pick<ZitadelPort, 'findOrCreateOrg' | 'mintAdminMachineUser' | 'mintLoginClientMachineUser' | 'listLoginClientPats' | 'reserveUserName' | 'closeSelfRegistration' | 'enforceSecondFactor' | 'inviteOrgOwner' | 'ensureDomainPolicy' | 'addOrgDomain' | 'removeOrgDomain' | 'setPrimaryOrgDomain' | 'setUserMetadata' | 'getUserMetadata'> & PlatformZitadelSmtp;
@@ -322,6 +354,10 @@ export declare class FoundryPlatformStepExecutor implements PlatformStepExecutor
             access: boolean;
             vars: string;
         };
+        uptimeChat?: {
+            pending: boolean;
+            blocked?: string;
+        };
         archonRunsInsideApp?: boolean;
         archonDeployRunning?: string;
         archonIdTokenUserinfo?: boolean;
@@ -574,6 +610,16 @@ export interface PlatformMailAdminPort {
             issuerUrl: string;
             audience: string;
         };
+        /**
+         * Where Stalwart keeps its data: a Postgres reached at `host:port`. The password is not here:
+         * Stalwart reads it from the env var {@link MAIL_DATABASE_PASSWORD_ENV}.
+         */
+        dataStore: {
+            host: string;
+            port: number;
+            database: string;
+            user: string;
+        };
     }): Promise<'restart' | undefined>;
     /**
      * `StalwartClient.createApiKey`'s own signature. The key belongs to a real
@@ -610,7 +656,7 @@ export declare function defaultStalwartForInstance(input: {
  * own shape.
  */
 export interface PlatformMailDeps {
-    coolify: Pick<CoolifyPort, 'findProjectByName' | 'createProject' | 'findOrCreateEnvironment' | 'listServers' | 'findApplicationByName' | 'getApplication' | 'createDockerImageApplication' | 'createDockerfileApplication' | 'raw' | 'listStorages' | 'createPersistentStorage' | 'bulkUpsertEnvs' | 'listEnvs' | 'updateApplication' | 'deploy' | 'deployAndWait' | 'restart' | 'getDeployment'>;
+    coolify: Pick<CoolifyPort, 'findProjectByName' | 'createProject' | 'findOrCreateEnvironment' | 'listServers' | 'findApplicationByName' | 'getApplication' | 'createDockerImageApplication' | 'createDockerfileApplication' | 'createPostgresDatabase' | 'getDatabase' | 'listDatabases' | 'deleteApplication' | 'raw' | 'listStorages' | 'createPersistentStorage' | 'bulkUpsertEnvs' | 'listEnvs' | 'updateApplication' | 'deploy' | 'deployAndWait' | 'restart' | 'getDeployment'>;
     /** F4.dns: every DNS record call, through edge at its recorded address (see {@link PlatformDnsFactory}). */
     dns: PlatformDnsFactory;
     /** F4.tunnels: every tunnel call, through edge at its recorded address (see {@link PlatformTunnelsFactory}). */
@@ -652,6 +698,8 @@ export interface PlatformMailRuntime {
     readyIntervalMs?: number;
     /** Tries at handing the admin key to the host (default 3). */
     deliverAttempts?: number;
+    /** Called with the mail database's password, so the host can keep it out of every message it writes. */
+    onSecret?: (value: string) => void;
 }
 /**
  * What {@link provisionMailServer} reads besides the target's names: the
@@ -669,6 +717,12 @@ export interface MailServerInput {
     mailHost: string;
     /** The Stalwart image tag. */
     imageTag: string;
+    /**
+     * The plan's confirmed switch of a volume-backed server to Postgres: delete the Stalwart app and its
+     * volume, clear the ids that describe it, then provision as usual. Without it a server still on its
+     * volume is refused before any write.
+     */
+    switchStore?: boolean;
     /** `host:container` list; empty publishes no host port. */
     hostPorts: string;
     /** The sign-in the server's directory trusts; its `mail` project's id is the audience. */