@wtfalch/foundry 0.41.0 → 0.41.2

package/dist/plan/executor.js

@@ -5975,6 +5975,7 @@ export class FoundryStepExecutor {
             apex: ownHostnames(org).zone,
             version: action.desired.version,
             project: { ensure: () => this.ensureCoolifyProject(org, context) },
+            ...(context.serverIpv4 ? { serverIpv4: context.serverIpv4 } : {}),
         });
     }
     async jobsRegistration(action, org, context) {

package/dist/plan/own-diff.d.ts

@@ -135,7 +135,7 @@ export interface PlanOwnSfuOptions {
 /**
  * An own org (`services.own`) with calls on runs its own LiveKit media server
  * as a Coolify app. Applied once, and again when the pinned LiveKit version,
- * the slot or the hostname changed, or an earlier run died before the deploy
+ * the slot or the hostname changed, no `node_ip` is recorded (applied before 0.41.2), or an earlier run died before the deploy
  * finished. `firewall` is the one line that says which ports the server must
  * have open: foundry opens none, so it stays until the host confirms them.
  * Every line is fixed text: it is part of the stale-plan comparison.

package/dist/plan/own-diff.js

@@ -9,7 +9,7 @@ import { OWN_MAIL_SMTP_INTERNAL_SCOPE_KEY, OWN_MAIL_SMTP_PORT_BASE, OWN_MAIL_SMT
 import { mailStoreIsLegacy, mailStoreSwitchDescription } from './mail-store.js';
 import { ownHostnames } from './own-hostnames.js';
 import { OWN_FILES_R2_SCOPE_KEY, OWN_SERVICES_APPLIED_SCOPE_KEY, orgTarget, } from './own-services.js';
-import { OWN_SFU_APPLIED_HOSTNAME_SCOPE_KEY, OWN_SFU_APPLIED_SLOT_SCOPE_KEY, OWN_SFU_APPLIED_VERSION_SCOPE_KEY, OWN_SFU_DEPLOY_PENDING_SCOPE_KEY, OWN_SFU_KEYS_UNDELIVERED_SCOPE_KEY, SFU_INTERNAL_URL_SCOPE_KEY, SFU_PUBLIC_URL_SCOPE_KEY, } from './own-sfu.js';
+import { OWN_SFU_APPLIED_HOSTNAME_SCOPE_KEY, OWN_SFU_APPLIED_NODE_IP_SCOPE_KEY, OWN_SFU_APPLIED_SLOT_SCOPE_KEY, OWN_SFU_APPLIED_VERSION_SCOPE_KEY, OWN_SFU_DEPLOY_PENDING_SCOPE_KEY, OWN_SFU_KEYS_UNDELIVERED_SCOPE_KEY, SFU_INTERNAL_URL_SCOPE_KEY, SFU_PUBLIC_URL_SCOPE_KEY, } from './own-sfu.js';
 import { AUTH_ZITADEL_RUN_OPTIONS, JOBS_DEPLOY_PENDING_SCOPE_KEY, JOBS_INTERNAL_URL_SCOPE_KEY, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_SMTP_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, platformMailMxHost, } from './platform-diff.js';
 import { OWN_FILES_RUNNER_SCOPE_KEY } from './platform-org.js';
 import { JOBS_ADMIN_TOKEN_UNDELIVERED_SCOPE_KEY, JOBS_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_AUTH_DB_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_SCOPE_KEY, PLATFORM_FILES_SHARE_DOMAINS_SCOPE_KEY, filesShareDomains, } from './platform-providers.js';
@@ -312,7 +312,7 @@ export const OWN_SFU_FIREWALL_KEY = 'own-sfu:firewall';
 /**
  * An own org (`services.own`) with calls on runs its own LiveKit media server
  * as a Coolify app. Applied once, and again when the pinned LiveKit version,
- * the slot or the hostname changed, or an earlier run died before the deploy
+ * the slot or the hostname changed, no `node_ip` is recorded (applied before 0.41.2), or an earlier run died before the deploy
  * finished. `firewall` is the one line that says which ports the server must
  * have open: foundry opens none, so it stays until the host confirms them.
  * Every line is fixed text: it is part of the stale-plan comparison.
@@ -361,6 +361,7 @@ export function planOwnSfu(options) {
         recordedIds[OWN_SFU_APPLIED_VERSION_SCOPE_KEY] === version &&
         recordedIds[OWN_SFU_APPLIED_SLOT_SCOPE_KEY] === String(slot) &&
         recordedIds[OWN_SFU_APPLIED_HOSTNAME_SCOPE_KEY] === hostname &&
+        Boolean(recordedIds[OWN_SFU_APPLIED_NODE_IP_SCOPE_KEY]) &&
         !recordedIds[OWN_SFU_DEPLOY_PENDING_SCOPE_KEY] &&
         Boolean(recordedIds[SFU_INTERNAL_URL_SCOPE_KEY]) &&
         Boolean(recordedIds[SFU_PUBLIC_URL_SCOPE_KEY]);

package/dist/plan/own-sfu.d.ts

@@ -21,6 +21,8 @@ export declare const OWN_SFU_DEPLOY_PENDING_SCOPE_KEY = "own_sfu_deploy_pending"
 export declare const OWN_SFU_APPLIED_VERSION_SCOPE_KEY = "own_sfu_applied_version";
 export declare const OWN_SFU_APPLIED_SLOT_SCOPE_KEY = "own_sfu_applied_slot";
 export declare const OWN_SFU_APPLIED_HOSTNAME_SCOPE_KEY = "own_sfu_applied_hostname";
+/** LiveKit's `node_ip` as last applied. Absent: applied before 0.41.2, when it could be `host.docker.internal`. */
+export declare const OWN_SFU_APPLIED_NODE_IP_SCOPE_KEY = "own_sfu_applied_node_ip";
 export declare const SFU_INTERNAL_URL_SCOPE_KEY = "sfu_internal_url";
 export declare const SFU_PUBLIC_URL_SCOPE_KEY = "sfu_public_url";
 export interface SfuAppDeps {
@@ -45,6 +47,8 @@ export interface SfuAppInput {
     /** The pinned LiveKit release tag. */
     version: string;
     project: ProjectSource;
+    /** The platform's declared public IPv4: LiveKit's `node_ip`. Absent: the Coolify server's ip, when it is an IPv4. */
+    serverIpv4?: string;
 }
 /** The compose `ports` lines for a slot: the UDP range and the TCP fallback port, one to one. */
 export declare function sfuComposePorts(slot: number): string[];

package/dist/plan/own-sfu.js

@@ -1,3 +1,4 @@
+import { isIPv4 } from 'node:net';
 import { DIGESTS, VERSIONS } from '../bootstrap/versions.js';
 import { mintLivekitCredentials } from '../calls-sfu-keys.js';
 import { LIVEKIT_SIGNALLING_PORT, sfuSlotPorts } from '../calls-sfu.js';
@@ -22,6 +23,8 @@ export const OWN_SFU_DEPLOY_PENDING_SCOPE_KEY = 'own_sfu_deploy_pending';
 export const OWN_SFU_APPLIED_VERSION_SCOPE_KEY = 'own_sfu_applied_version';
 export const OWN_SFU_APPLIED_SLOT_SCOPE_KEY = 'own_sfu_applied_slot';
 export const OWN_SFU_APPLIED_HOSTNAME_SCOPE_KEY = 'own_sfu_applied_hostname';
+/** LiveKit's `node_ip` as last applied. Absent: applied before 0.41.2, when it could be `host.docker.internal`. */
+export const OWN_SFU_APPLIED_NODE_IP_SCOPE_KEY = 'own_sfu_applied_node_ip';
 export const SFU_INTERNAL_URL_SCOPE_KEY = 'sfu_internal_url';
 export const SFU_PUBLIC_URL_SCOPE_KEY = 'sfu_public_url';
 const KEYS_DELIVERY_ATTEMPTS = 3;
@@ -132,8 +135,12 @@ export async function provisionSfuApp(scope, deps, target, input) {
     const server = servers.find((s) => s.is_usable && s.is_reachable) ?? servers[0];
     if (!server)
         throw new Error(`${label}: no usable Coolify server is registered`);
-    if (!server.ip)
-        throw new Error(`${label}: the Coolify server has no address to give LiveKit`);
+    // Coolify reports its localhost server as `host.docker.internal`, which LiveKit refuses as `node_ip`
+    // and then restarts forever; the declared address wins, the same rule as the platform's mail server.
+    const nodeIp = input.serverIpv4 ?? (server.ip && isIPv4(server.ip) ? server.ip : undefined);
+    if (!nodeIp) {
+        throw new Error(`${label}: no public IPv4 to give LiveKit; declare the server's public IPv4 as serverIpv4 in the platform config`);
+    }
     const compose = sfuCompose({
         serviceName: target.internal.sfu,
         slot: input.slot,
@@ -213,7 +220,7 @@ export async function provisionSfuApp(scope, deps, target, input) {
             keysJustSet = true;
         }
     }
-    const config = sfuConfig({ slot: input.slot, nodeIp: server.ip, keys });
+    const config = sfuConfig({ slot: input.slot, nodeIp, keys });
     deps.onSecret?.(config);
     const envChanged = liveConfig !== config;
     const pending = Boolean(scope.recordedIds()[OWN_SFU_DEPLOY_PENDING_SCOPE_KEY]) || changed || envChanged;
@@ -278,6 +285,7 @@ export async function provisionSfuApp(scope, deps, target, input) {
     scope.recordScopeId(OWN_SFU_APPLIED_VERSION_SCOPE_KEY, input.version);
     scope.recordScopeId(OWN_SFU_APPLIED_SLOT_SCOPE_KEY, String(input.slot));
     scope.recordScopeId(OWN_SFU_APPLIED_HOSTNAME_SCOPE_KEY, input.hostname);
+    scope.recordScopeId(OWN_SFU_APPLIED_NODE_IP_SCOPE_KEY, nodeIp);
     scope.recordScopeId(SFU_INTERNAL_URL_SCOPE_KEY, signalling);
     scope.recordScopeId(SFU_PUBLIC_URL_SCOPE_KEY, `https://${input.hostname}`);
     return { resourceId: serviceId };

package/dist/plan/plan-apply.d.ts

@@ -130,6 +130,12 @@ export interface StepExecutionContext {
      * platform's Docker network, not on `co-<slug>`, so Archon reaches its database. Absent: false.
      */
     readonly ownerCompany?: boolean;
+    /**
+     * The platform's declared public IPv4 (`DeclaredPlatform.serverIpv4`). A company's media server
+     * gives it to LiveKit as `node_ip`: Coolify reports its localhost server as `host.docker.internal`,
+     * which LiveKit refuses. Absent: none declared.
+     */
+    readonly serverIpv4?: string;
     /**
      * Every id foundry has recorded for this org so far — both `system:kind:key`
      * resource ids (`runSteps` records these itself from `execute`'s own return

package/dist/plan/plan-apply.js

@@ -908,10 +908,13 @@ export class FoundryPlanApply {
         const checkpoints = [];
         // Backed by the very `serviceIds` map this method persists once, at the
         // end — see `StepExecutionContext`'s doc comment for why.
-        const ownerCompany = (await this.platformDeps?.store.get())?.ownerOrgId === orgId;
+        const declaredPlatform = await this.platformDeps?.store.get();
+        const ownerCompany = declaredPlatform?.ownerOrgId === orgId;
+        const serverIpv4 = declaredPlatform?.serverIpv4 ?? undefined;
         const context = {
             org,
             ownerCompany,
+            ...(serverIpv4 ? { serverIpv4 } : {}),
             recordedIds: () => ({ ...serviceIds }),
             now: () => this.now().getTime(),
             recordScopeId: (key, id) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/foundry",
-  "version": "0.41.0",
+  "version": "0.41.2",
   "description": "Foundry's SDK: the declared org's types, the plan and apply contracts, and the state store's interface.",
   "repository": {
     "type": "git",