@wtfalch/foundry 0.39.2 → 0.39.4

package/dist/plan/signin-db-backup.d.ts

@@ -74,22 +74,34 @@ export declare const SIGNIN_DB_BACKUP_ENV: {
     readonly keyId: "BACKUP_S3_KEY_ID";
     readonly secret: "BACKUP_S3_SECRET";
     readonly prefix: "BACKUP_S3_PREFIX";
+    readonly script: "BACKUP_S3_SCRIPT";
 };
 /** Where in the bucket a company's dumps go: `signin-db/<slug>/signin-db-<UTC time>.dump`. */
 export declare function signinDbBackupPrefix(slug: string): string;
-/** The env entries the backup command needs, for the database app. */
-export declare function signinDbBackupEnvs(target: SigninDbBackupTarget, slug: string): Array<{
+/** The env entries the backup command needs, for the database app, the script included. */
+export declare function signinDbBackupEnvs(target: SigninDbBackupTarget, slug: string, db: {
+    user: string;
+    database: string;
+}): Array<{
     key: string;
     value: string;
 }>;
 /**
- * The command Coolify runs in the container. A custom-format dump goes to a temporary file (an upload
+ * The script the backup command runs. A custom-format dump goes to a temporary file (an upload
  * needs a length), is signed with SigV4 and put with curl, and the file is removed on every exit. The
  * credentials reach curl on its standard input as a config, never in an argument. Every failure ends the
- * run non-zero, and curl's error text names the HTTP status only. No single quote: Coolify wraps the
- * command in single quotes.
+ * run non-zero, and curl's error text names the HTTP status only. It lives in the app's env, base64,
+ * because Coolify stores a task's command in 255 characters and this script is longer.
+ */
+export declare function signinDbBackupScript(user: string, database: string): string;
+/** The most Coolify stores in a scheduled task's command (`varchar(255)`); a longer one answers 500. */
+export declare const COOLIFY_TASK_COMMAND_MAX = 255;
+/**
+ * The command Coolify runs in the container: it decodes the script from the env and runs it. An
+ * empty env fails the run instead of passing it. No single quote: Coolify wraps the command in single
+ * quotes.
  */
-export declare function signinDbBackupCommand(user: string, database: string): string;
+export declare function signinDbBackupCommand(): string;
 /**
  * Makes sure the database app has its backup task, and returns its uuid. The task is found by name
  * before it is created, and updated to the full wanted body every time (Coolify hides the stored
@@ -97,9 +109,6 @@ export declare function signinDbBackupCommand(user: string, database: string): s
  * read back and must be listed enabled with the wanted frequency and timeout, or this throws: a
  * schedule that cannot be seen is not a backup. The caller records the uuid. Errors name the label only.
  */
-export declare function ensureSigninDbBackupTask(coolify: Pick<CoolifyPort, 'raw'>, appId: string, label: string, db: {
-    user: string;
-    database: string;
-}): Promise<string>;
+export declare function ensureSigninDbBackupTask(coolify: Pick<CoolifyPort, 'raw'>, appId: string, label: string): Promise<string>;
 /** A company on the TLS database whose nightly dump is not scheduled yet: the sign-in step plans again to schedule it. */
 export declare function signinDbBackupMissing(recordedIds: Readonly<Record<string, string>>): boolean;

package/dist/plan/signin-db-backup.js

@@ -113,13 +113,14 @@ export const SIGNIN_DB_BACKUP_ENV = {
     keyId: 'BACKUP_S3_KEY_ID',
     secret: 'BACKUP_S3_SECRET',
     prefix: 'BACKUP_S3_PREFIX',
+    script: 'BACKUP_S3_SCRIPT',
 };
 /** Where in the bucket a company's dumps go: `signin-db/<slug>/signin-db-<UTC time>.dump`. */
 export function signinDbBackupPrefix(slug) {
     return `signin-db/${slug}`;
 }
-/** The env entries the backup command needs, for the database app. */
-export function signinDbBackupEnvs(target, slug) {
+/** The env entries the backup command needs, for the database app, the script included. */
+export function signinDbBackupEnvs(target, slug, db) {
     return [
         { key: SIGNIN_DB_BACKUP_ENV.endpoint, value: target.endpoint.replace(/\/+$/, '') },
         { key: SIGNIN_DB_BACKUP_ENV.bucket, value: target.bucket },
@@ -127,16 +128,20 @@ export function signinDbBackupEnvs(target, slug) {
         { key: SIGNIN_DB_BACKUP_ENV.keyId, value: target.accessKeyId },
         { key: SIGNIN_DB_BACKUP_ENV.secret, value: target.secretAccessKey },
         { key: SIGNIN_DB_BACKUP_ENV.prefix, value: signinDbBackupPrefix(slug) },
+        {
+            key: SIGNIN_DB_BACKUP_ENV.script,
+            value: Buffer.from(signinDbBackupScript(db.user, db.database), 'utf8').toString('base64'),
+        },
     ];
 }
 /**
- * The command Coolify runs in the container. A custom-format dump goes to a temporary file (an upload
+ * The script the backup command runs. A custom-format dump goes to a temporary file (an upload
  * needs a length), is signed with SigV4 and put with curl, and the file is removed on every exit. The
  * credentials reach curl on its standard input as a config, never in an argument. Every failure ends the
- * run non-zero, and curl's error text names the HTTP status only. No single quote: Coolify wraps the
- * command in single quotes.
+ * run non-zero, and curl's error text names the HTTP status only. It lives in the app's env, base64,
+ * because Coolify stores a task's command in 255 characters and this script is longer.
  */
-export function signinDbBackupCommand(user, database) {
+export function signinDbBackupScript(user, database) {
     const e = SIGNIN_DB_BACKUP_ENV;
     return [
         'set -eu',
@@ -146,6 +151,17 @@ export function signinDbBackupCommand(user, database) {
         `printf "user = \\"%s:%s\\"\\n" "$${e.keyId}" "$${e.secret}" | curl -sS --fail --max-time ${UPLOAD_MAX_SECONDS} --aws-sigv4 "aws:amz:$${e.region}:s3" -K - -T "$f" "$${e.endpoint}/$${e.bucket}/$${e.prefix}/\${f##*/}"`,
     ].join('; ');
 }
+/** The most Coolify stores in a scheduled task's command (`varchar(255)`); a longer one answers 500. */
+export const COOLIFY_TASK_COMMAND_MAX = 255;
+/**
+ * The command Coolify runs in the container: it decodes the script from the env and runs it. An
+ * empty env fails the run instead of passing it. No single quote: Coolify wraps the command in single
+ * quotes.
+ */
+export function signinDbBackupCommand() {
+    const v = `$${SIGNIN_DB_BACKUP_ENV.script}`;
+    return `[ -n "${v}" ] && printf %s "${v}" | base64 -d > /tmp/signin-db-backup.sh && sh /tmp/signin-db-backup.sh`;
+}
 function rows(body) {
     if (!Array.isArray(body))
         throw new Error('scheduled tasks list has an unexpected shape');
@@ -158,11 +174,11 @@ function rows(body) {
  * read back and must be listed enabled with the wanted frequency and timeout, or this throws: a
  * schedule that cannot be seen is not a backup. The caller records the uuid. Errors name the label only.
  */
-export async function ensureSigninDbBackupTask(coolify, appId, label, db) {
+export async function ensureSigninDbBackupTask(coolify, appId, label) {
     const base = `/applications/${appId}/scheduled-tasks`;
     const body = {
         name: SIGNIN_DB_BACKUP_TASK_NAME,
-        command: signinDbBackupCommand(db.user, db.database),
+        command: signinDbBackupCommand(),
         frequency: SIGNIN_DB_BACKUP_FREQUENCY,
         timeout: SIGNIN_DB_BACKUP_TIMEOUT_SECONDS,
         enabled: true,

package/dist/plan/signin-db.js

@@ -223,7 +223,10 @@ export async function provisionSigninDb(input) {
         { key: SIGNIN_DB_ENV.database, value: SIGNIN_DB_NAME },
         { key: SIGNIN_DB_ENV.cert, value: b64(server.certPem) },
         { key: SIGNIN_DB_ENV.key, value: b64(server.keyPem) },
-        ...signinDbBackupEnvs(backup.target, input.slug),
+        ...signinDbBackupEnvs(backup.target, input.slug, {
+            user: SIGNIN_DB_USER,
+            database: SIGNIN_DB_NAME,
+        }),
     ];
     const changed = await envsDiffer(coolify, app.appId, envs);
     await coolify.bulkUpsertEnvs(app.appId, envs);
@@ -237,10 +240,7 @@ export async function provisionSigninDb(input) {
     }
     await input.record(SIGNIN_DB_CERT_NOT_AFTER_SCOPE_KEY, String(server.notAfter));
     // The database is not used, and ZITADEL is not stopped for a move, until its nightly dump is scheduled.
-    await input.record(SIGNIN_DB_BACKUP_TASK_SCOPE_KEY, await ensureSigninDbBackupTask(coolify, app.appId, label, {
-        user: SIGNIN_DB_USER,
-        database: SIGNIN_DB_NAME,
-    }));
+    await input.record(SIGNIN_DB_BACKUP_TASK_SCOPE_KEY, await ensureSigninDbBackupTask(coolify, app.appId, label));
     const dsn = signinDbDsn(input.internalHost, password);
     runtime.onSecret?.(dsn);
     return { appId: app.appId, dsn, ca: ca.certPem, password };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/foundry",
-  "version": "0.39.2",
+  "version": "0.39.4",
   "description": "Foundry's SDK: the declared org's types, the plan and apply contracts, and the state store's interface.",
   "repository": {
     "type": "git",