@yourrealm/sdk 0.0.0-alpha.1378.ce03c8dc

package/dist/ingress.js

@@ -0,0 +1,436 @@
+import {
+  HOME_COOKIE_PREFIX
+} from "./chunk-CMAEHQ4F.js";
+import {
+  structuredHost
+} from "./chunk-3R6KEFOI.js";
+import "./chunk-MLKGABMK.js";
+
+// src/worker-protocol/uplink/constants.ts
+var MAX_PAYLOAD_BYTES = 16 * 1024;
+var DEFAULT_LIMITS = {
+  fragmentSize: 16 * 1024,
+  initialWindow: 256 * 1024,
+  maxStreams: 64,
+  maxInFlight: 8 * 1024 * 1024
+};
+var UPLINK_PROLOGUE = Uint8Array.from(
+  "realm-uplink/1",
+  (c) => c.charCodeAt(0)
+);
+var SOCKET_HIGH_WATER = 256 * 1024;
+var SOCKET_INBOUND_CAP = 16 * 1024 * 1024;
+var REKEY_INTERVAL_MS = 24 * 60 * 60 * 1e3;
+var REKEY_JITTER_MS = 2 * 60 * 60 * 1e3;
+
+// src/runtime/docker/ingress/build-config.ts
+var VERIFY_UPSTREAM = "realm-worker:6021";
+var VERIFY_PATH = "/api/access/verify";
+var REALM_HEADER_WILDCARD = "X-Realm-*";
+var HOME_COOKIE_REGEX = `(__Secure-)?${HOME_COOKIE_PREFIX}\\.[^=]+=[^;]*;?\\s*`;
+var HOME_SET_COOKIE_REGEX = `^(__Secure-)?${HOME_COOKIE_PREFIX}\\.[^=]*=.*$`;
+function holdingPage(title, headline, detail) {
+  return [
+    `<!doctype html>`,
+    `<html lang="en" style="color-scheme: light dark">`,
+    `<meta charset="utf-8">`,
+    `<meta name="viewport" content="width=device-width,initial-scale=1">`,
+    `<meta http-equiv="refresh" content="5">`,
+    `<title>${title}</title>`,
+    `<body style="background: Canvas; color: CanvasText; font-family: system-ui, sans-serif; display: grid; place-items: center; min-height: 100vh; margin: 0; padding: 2rem; box-sizing: border-box; text-align: center">`,
+    `<main style="max-width: 32rem">`,
+    `<h1 style="font-size: 1.25rem; font-weight: 600; margin: 0 0 0.75rem">${headline}</h1>`,
+    `<p style="margin: 0; opacity: 0.7; line-height: 1.5">${detail}</p>`,
+    `</main>`
+  ].join("");
+}
+var DEPLOYING_PAGE = holdingPage(
+  "Starting up",
+  "This app is starting up",
+  "Its container is not answering yet. This page reloads on its own."
+);
+var AUTH_OK_VAR = "realm_auth_ok";
+var HOME_UNREACHABLE_PAGE = holdingPage(
+  "Realm is unreachable",
+  "Realm's control plane is not responding",
+  "Apps cannot be reached until it is back, even the ones still running."
+);
+var NOT_ROUTED_PAGE = holdingPage(
+  "Nothing here",
+  "Nothing is serving this address",
+  "No app on this worker answers to this name."
+);
+var ASSET_LINKS_PATH = "/.well-known/assetlinks.json";
+var COMPANION_PACKAGE = "eu.yourrealm.companion";
+function assetLinksBody(fingerprints) {
+  return JSON.stringify([
+    {
+      relation: ["delegate_permission/common.handle_all_urls"],
+      target: {
+        namespace: "android_app",
+        package_name: COMPANION_PACKAGE,
+        sha256_cert_fingerprints: fingerprints
+      }
+    }
+  ]);
+}
+var DEFAULT_SECURITY_HEADERS = {
+  "Strict-Transport-Security": "max-age=31536000; includeSubDomains",
+  "X-Frame-Options": "SAMEORIGIN",
+  "X-Content-Type-Options": "nosniff",
+  "Referrer-Policy": "strict-origin-when-cross-origin",
+  "Permissions-Policy": "camera=(), microphone=(), geolocation=()"
+};
+function securityHeaderLists() {
+  return Object.fromEntries(Object.entries(DEFAULT_SECURITY_HEADERS).map(([k, v]) => [k, [v]]));
+}
+var ACME_CA_ROOT_PATH = "/etc/caddy/acme-ca-root.pem";
+var STREAM_CLOSE_DELAY = `${Math.ceil((REKEY_INTERVAL_MS + REKEY_JITTER_MS) / 36e5)}h`;
+function buildCaddyConfig(input) {
+  const { routedApps, dashboardHost, workerId, baseDomain, acmeDns, publicProviders } = input;
+  const { cdnProviders, companionFingerprints } = input;
+  const routes = [];
+  const clientIp = cdnProviders.length > 0 ? "{http.vars.client_ip}" : "{http.request.remote.host}";
+  routes.push({
+    match: [{ path: [ASSET_LINKS_PATH] }],
+    handle: [
+      {
+        handler: "static_response",
+        status_code: 200,
+        headers: {
+          "Content-Type": ["application/json"],
+          ...securityHeaderLists()
+        },
+        body: assetLinksBody(companionFingerprints)
+      }
+    ],
+    terminal: true
+  });
+  if (dashboardHost !== null) {
+    routes.push({
+      match: [{ host: [dashboardHost] }],
+      handle: [homeProxy("realm-home:3100", clientIp)],
+      terminal: true
+    });
+  }
+  for (const app of routedApps) {
+    for (const svc of app.services) {
+      const router = svc.router;
+      const upstream = `${app.appId}_${svc.serviceId}:${router.containerPort}`;
+      const host = structuredHost(app.appId, svc.serviceId, workerId, baseDomain);
+      routes.push(buildAuthRoute(host, router, upstream, app.trustedHeaderKeys ?? [], clientIp));
+      if (router.publicDomain) {
+        const domains = Array.isArray(router.publicDomain) ? router.publicDomain.map(String) : [String(router.publicDomain)];
+        pushRoutes(routes, domains, router, upstream, app.trustedHeaderKeys ?? [], clientIp);
+      }
+    }
+  }
+  if (workerId && baseDomain) {
+    routes.push({
+      match: [{ host: [`*.${workerId}.${baseDomain}`] }],
+      handle: [holdingResponse(NOT_ROUTED_PAGE)],
+      terminal: true
+    });
+  }
+  const policies = [];
+  const automate = [];
+  if (acmeDns != null && workerId) {
+    const wildcard = `*.${workerId}.${acmeDns.baseDomain}`;
+    automate.push(wildcard);
+    policies.push({ subjects: [wildcard], issuers: [buildAcmeDnsIssuer(workerId, acmeDns)] });
+  }
+  if (publicProviders.length > 0) {
+    policies.push({ issuers: publicProviders.map(buildPublicIssuer) });
+  } else {
+    policies.push({ issuers: [{ module: "internal" }] });
+  }
+  const dynamicDns = acmeDns != null && workerId ? {
+    domains: { [acmeDns.baseDomain]: [workerId] },
+    dns_provider: {
+      name: "realm",
+      server_url: acmeDns.serverUrl,
+      username: acmeDns.username,
+      api_key: acmeDns.apiKey
+    },
+    ip_sources: [{ source: "simple_http", endpoints: [`${acmeDns.serverUrl}/ip`] }],
+    check_interval: "5m",
+    versions: { ipv4: true, ipv6: false }
+  } : void 0;
+  return {
+    admin: { listen: "127.0.0.1:2019" },
+    apps: {
+      http: {
+        servers: {
+          main: {
+            listen: [":443", ":80"],
+            routes,
+            // With a CDN declared in front, resolve `{client_ip}`
+            // right-to-left (strict) past its edge addresses from
+            // X-Forwarded-For. Omitted entirely otherwise: Caddy then ignores
+            // inbound XFF and uses the direct peer, so a client can't spoof
+            // its address when nothing is in front. The module fails soft - an
+            // unreachable provider yields no ranges, degrading to that same
+            // direct-peer behaviour rather than trusting anything.
+            ...cdnProviders.length > 0 && {
+              trusted_proxies: { source: "cdn", providers: [...cdnProviders] },
+              trusted_proxies_strict: 1,
+              client_ip_headers: ["X-Forwarded-For"]
+            },
+            ...workerId && baseDomain && {
+              errors: {
+                // Ordered pair, splitting on which dial failed. The marker is
+                // set only once Home has answered and approved, so its absence
+                // means Home itself was unreachable. Every app route under
+                // this wildcard carries a forward_auth hop (checkPublicDomains
+                // refuses a granted publicDomain under baseDomain at eval
+                // time), while the dashboard route has none and proxies
+                // straight to Home, so it falls to the second page.
+                //
+                // The first page is true on every box: the marker proves Home
+                // answered, so the dial that failed was the app's. The second
+                // names Home as the thing that is down, a claim only the box
+                // running it can make - the same gate as the dashboard route.
+                // A worker-only box leaves an unmarked 502 to Caddy's default.
+                routes: [
+                  buildFallbackRoute(
+                    workerId,
+                    baseDomain,
+                    ` && {http.vars.${AUTH_OK_VAR}} == "1"`,
+                    DEPLOYING_PAGE
+                  ),
+                  ...dashboardHost !== null ? [buildFallbackRoute(workerId, baseDomain, "", HOME_UNREACHABLE_PAGE)] : []
+                ]
+              }
+            }
+          }
+        }
+      },
+      tls: {
+        ...automate.length > 0 && { certificates: { automate } },
+        automation: { policies }
+      },
+      ...dynamicDns && { dynamic_dns: dynamicDns }
+    }
+  };
+}
+function buildAcmeDnsIssuer(subdomain, acme) {
+  return {
+    module: "acme",
+    // Default ACME endpoint (Let's Encrypt prod) unless overridden to a
+    // staging endpoint or a test CA (Pebble) in the e2e.
+    ...acme.ca && { ca: acme.ca },
+    ...acme.caRootPem && { trusted_roots_pem_files: [ACME_CA_ROOT_PATH] },
+    challenges: {
+      dns: {
+        provider: {
+          name: "acmedns",
+          server_url: acme.serverUrl,
+          username: acme.username,
+          password: acme.apiKey,
+          // Static at config-gen time: the worker's own label under acme-dns.
+          subdomain
+        },
+        // Wait for the Hetzner write to propagate before asking LE to
+        // validate. Too short and LE's multi-perspective validation races
+        // propagation: it queries an anycast PoP still serving the previous
+        // challenge value and fails with "Incorrect TXT record". Convergence
+        // measures ~30s from one vantage point and LE checks worldwide, so the
+        // delay sits above that with margin. Polling can't substitute — Caddy
+        // sees only its own resolver, never the stale PoP LE hits.
+        propagation_delay: "60s"
+      }
+    }
+  };
+}
+function buildPublicIssuer(provider) {
+  const dnsProvider = provider.name === "cloudflare" ? { name: "cloudflare", api_token: provider.apiToken } : { name: "hetzner", api_token: provider.apiToken };
+  return { module: "acme", challenges: { dns: { provider: dnsProvider } } };
+}
+function proxy(upstream, clientIp, response) {
+  return {
+    handler: "reverse_proxy",
+    upstreams: [{ dial: upstream }],
+    headers: {
+      request: {
+        set: {
+          "X-Forwarded-For": [clientIp],
+          "X-Real-IP": [clientIp]
+        }
+      },
+      ...response ? { response } : {}
+    }
+  };
+}
+function appProxy(upstream, clientIp) {
+  return proxy(upstream, clientIp, {
+    replace: { "Set-Cookie": [{ search_regexp: HOME_SET_COOKIE_REGEX, replace: "" }] }
+  });
+}
+function homeProxy(upstream, clientIp) {
+  return { ...proxy(upstream, clientIp), stream_close_delay: STREAM_CLOSE_DELAY };
+}
+function pushRoutes(routes, domains, router, upstream, trustedHeaderKeys, clientIp) {
+  if (domains.length === 0) return;
+  if (domains.length === 1 || router.domainMode === "all") {
+    routes.push(buildPrimaryRoute(domains, router, upstream, trustedHeaderKeys, clientIp));
+    return;
+  }
+  const [primary, ...rest] = domains;
+  if (!primary) return;
+  routes.push(buildPrimaryRoute([primary], router, upstream, trustedHeaderKeys, clientIp));
+  routes.push(buildRedirectRoute(rest, primary, router.pathPrefix));
+}
+function buildPrimaryRoute(domains, router, upstream, trustedHeaderKeys, clientIp) {
+  const handle = [];
+  const rateLimitHandler = buildRateLimitHandler(router.rateLimit, clientIp);
+  if (rateLimitHandler) handle.push(rateLimitHandler);
+  handle.push({
+    handler: "headers",
+    request: { delete: [REALM_HEADER_WILDCARD, ...trustedHeaderKeys] }
+  });
+  handle.push(...buildContentHandlers(router));
+  handle.push(appProxy(upstream, clientIp));
+  return { match: [buildMatcher(domains, router.pathPrefix)], handle, terminal: true };
+}
+function buildAuthRoute(host, router, upstream, trustedHeaderKeys, clientIp) {
+  const handle = [];
+  const rateLimitHandler = buildRateLimitHandler(router.rateLimit, clientIp);
+  if (rateLimitHandler) handle.push(rateLimitHandler);
+  handle.push({
+    handler: "headers",
+    request: { delete: [REALM_HEADER_WILDCARD, ...trustedHeaderKeys] }
+  });
+  handle.push(...buildForwardAuthHandlers(VERIFY_UPSTREAM, VERIFY_PATH, trustedHeaderKeys));
+  handle.push(...buildContentHandlers(router));
+  handle.push({
+    handler: "headers",
+    request: { replace: { Cookie: [{ search_regexp: HOME_COOKIE_REGEX, replace: "" }] } }
+  });
+  handle.push(appProxy(upstream, clientIp));
+  return { match: [buildMatcher([host], router.pathPrefix)], handle, terminal: true };
+}
+function buildContentHandlers(router) {
+  const handle = [];
+  if (router.compress) {
+    handle.push({ handler: "encode", encodings: { gzip: {} }, prefer: ["gzip"] });
+  }
+  const headerHandler = buildHeaderHandler(router.headers);
+  if (headerHandler) handle.push(headerHandler);
+  if (router.maxRequestSizeMb != null) {
+    handle.push({
+      handler: "request_body",
+      max_size: router.maxRequestSizeMb * 1024 * 1024
+    });
+  }
+  return handle;
+}
+function buildForwardAuthHandlers(verifyUpstream, verifyPath, trustedHeaderKeys) {
+  const onAuthed = [{ handle: [{ handler: "vars", [AUTH_OK_VAR]: "1" }] }];
+  for (const k of trustedHeaderKeys) {
+    const placeholder = `{http.reverse_proxy.header.${k}}`;
+    onAuthed.push({
+      match: [{ not: [{ vars: { [placeholder]: [""] } }] }],
+      handle: [{ handler: "headers", request: { set: { [k]: [placeholder] } } }]
+    });
+  }
+  return [
+    {
+      handler: "reverse_proxy",
+      rewrite: { method: "GET", uri: verifyPath },
+      headers: {
+        request: {
+          // Host is pinned, not forwarded. Home picks the anonymous gate and
+          // the brokered-header mapping from this header alone, and Caddy
+          // keeps a client-supplied value once server-level `trusted_proxies`
+          // is configured (a declared `cdn`) — which would let a caller borrow
+          // another app's gate. `set` is overwrite, so the route's host wins.
+          set: {
+            "X-Forwarded-Host": ["{http.request.host}"],
+            "X-Forwarded-Method": ["{http.request.method}"],
+            "X-Forwarded-Uri": ["{http.request.uri}"]
+          }
+        }
+      },
+      // `[2]` is Caddy's shorthand for the whole 2xx class.
+      handle_response: [{ match: { status_code: [2] }, routes: onAuthed }],
+      upstreams: [{ dial: verifyUpstream }]
+    }
+  ];
+}
+function buildRateLimitHandler(rateLimit, clientIp) {
+  if (rateLimit == null) return void 0;
+  const { max_events, window } = typeof rateLimit === "number" ? { max_events: rateLimit, window: "1s" } : { max_events: rateLimit.requests, window: rateLimit.window };
+  return {
+    handler: "rate_limit",
+    rate_limits: {
+      // `clientIp` must be a placeholder Caddy actually expands — an
+      // unresolved literal would collapse every client into one bucket.
+      per_ip: { key: clientIp, window, max_events }
+    }
+  };
+}
+function holdingResponse(body) {
+  return {
+    handler: "static_response",
+    status_code: 503,
+    headers: {
+      "Content-Type": ["text/html; charset=utf-8"],
+      "Retry-After": ["5"],
+      ...securityHeaderLists()
+    },
+    body
+  };
+}
+function buildFallbackRoute(workerId, baseDomain, extraExpr, body) {
+  return {
+    match: [
+      {
+        host: [`*.${workerId}.${baseDomain}`],
+        expression: `{http.error.status_code} in [502, 504]${extraExpr}`
+      }
+    ],
+    handle: [holdingResponse(body)],
+    terminal: true
+  };
+}
+function buildRedirectRoute(domains, primary, pathPrefix) {
+  return {
+    match: [buildMatcher(domains, pathPrefix)],
+    handle: [
+      {
+        handler: "static_response",
+        headers: { Location: [`https://${primary}{http.request.orig_uri}`] },
+        status_code: 301
+      }
+    ],
+    terminal: true
+  };
+}
+function buildMatcher(domains, pathPrefix) {
+  return { host: domains, ...pathPrefix ? { path: [`${pathPrefix}*`] } : {} };
+}
+function buildHeaderHandler(overrides) {
+  const set = { ...DEFAULT_SECURITY_HEADERS };
+  const del = [];
+  if (overrides) {
+    for (const [k, v] of Object.entries(overrides).sort(([a], [b]) => a < b ? -1 : 1)) {
+      if (v === null) {
+        delete set[k];
+        del.push(k);
+      } else {
+        set[k] = v;
+      }
+    }
+  }
+  if (Object.keys(set).length === 0 && del.length === 0) return void 0;
+  const setArr = {};
+  for (const [k, v] of Object.entries(set)) setArr[k] = [v];
+  const response = {};
+  if (Object.keys(setArr).length > 0) response.set = setArr;
+  if (del.length > 0) response.delete = del;
+  return { handler: "headers", response };
+}
+export {
+  ACME_CA_ROOT_PATH,
+  buildCaddyConfig
+};

package/dist/jsx-runtime.js

@@ -0,0 +1,2 @@
+// src/jsx-runtime/index.ts
+export * from "preact/jsx-runtime";

package/dist/preact.js

@@ -0,0 +1,22 @@
+import "./chunk-MLKGABMK.js";
+
+// src/preact/index.ts
+var stub = (() => {
+  throw new Error(
+    "@yourrealm/sdk/preact has no runtime in this environment. Hook calls are bundled by realm-sdk and execute inside the Home iframe."
+  );
+});
+var useCallback = stub;
+var useEffect = stub;
+var useMemo = stub;
+var useReducer = stub;
+var useRef = stub;
+var useState = stub;
+export {
+  useCallback,
+  useEffect,
+  useMemo,
+  useReducer,
+  useRef,
+  useState
+};

package/dist/service-url.js

@@ -0,0 +1,11 @@
+import {
+  firstPublicDomain,
+  serviceUrl,
+  structuredHost
+} from "./chunk-3R6KEFOI.js";
+import "./chunk-MLKGABMK.js";
+export {
+  firstPublicDomain,
+  serviceUrl,
+  structuredHost
+};

package/dist/services.js

@@ -0,0 +1,213 @@
+import {
+  Service,
+  interpolate
+} from "./chunk-AITGS27R.js";
+import "./chunk-MLKGABMK.js";
+
+// src/postgres.ts
+var Postgres = class extends Service {
+  image;
+  port = 5432;
+  user = "realm";
+  database = "realm";
+  // Underscore-prefixed to keep it off the public surface - the backup
+  // strategy is the only consumer, and output doesn't carry it.
+  _majorVersion;
+  _shmSizeMb;
+  constructor(options) {
+    super();
+    const majorVersion = options?.majorVersion ?? 18;
+    this.image = options?.image ?? `postgres:${majorVersion}`;
+    this._majorVersion = majorVersion;
+    this._shmSizeMb = options?.shmSizeMb ?? 128;
+  }
+  get password() {
+    return this.derived("postgres-password");
+  }
+  get url() {
+    return interpolate`postgres://${this.user}:${this.password}@${this.host}:${this.port}/${this.database}`;
+  }
+  getServiceDefinition() {
+    return {
+      image: this.image,
+      volumes: [
+        {
+          hostPath: interpolate`./data/${this.host}`,
+          containerPath: "/var/lib/postgresql",
+          backup: { kind: "pg-dump", url: this.url, version: this._majorVersion }
+        }
+      ],
+      env: {
+        POSTGRES_USER: this.user,
+        POSTGRES_PASSWORD: this.password,
+        POSTGRES_DB: this.database
+      },
+      healthcheck: {
+        test: ["CMD", "pg_isready", "-U", "realm", "-d", "realm"]
+      },
+      shmSizeMb: this._shmSizeMb
+    };
+  }
+};
+
+// src/mysql.ts
+var MySQL = class extends Service {
+  image;
+  port = 3306;
+  user = "realm";
+  database = "realm";
+  _majorVersion;
+  constructor(options) {
+    super();
+    const majorVersion = options?.majorVersion ?? 9;
+    this.image = `mysql:${majorVersion}`;
+    this._majorVersion = majorVersion;
+  }
+  get password() {
+    return this.derived("mysql-password");
+  }
+  get rootPassword() {
+    return this.derived("root-password");
+  }
+  get url() {
+    return interpolate`mysql://${this.user}:${this.password}@${this.host}:${this.port}/${this.database}`;
+  }
+  getServiceDefinition() {
+    return {
+      image: this.image,
+      volumes: [
+        {
+          hostPath: interpolate`./data/${this.host}`,
+          containerPath: "/var/lib/mysql",
+          backup: { kind: "mysql-dump", url: this.url, version: this._majorVersion }
+        }
+      ],
+      env: {
+        MYSQL_USER: this.user,
+        MYSQL_PASSWORD: this.password,
+        MYSQL_DATABASE: this.database,
+        MYSQL_ROOT_PASSWORD: this.rootPassword
+      },
+      healthcheck: {
+        test: ["CMD", "mysqladmin", "ping", "-h", "localhost"]
+      }
+    };
+  }
+};
+
+// src/valkey.ts
+var Valkey = class extends Service {
+  image;
+  port = 6379;
+  constructor(_options) {
+    super();
+    this.image = "valkey/valkey:8";
+  }
+  get password() {
+    return this.derived("valkey-password");
+  }
+  get url() {
+    return interpolate`redis://default:${this.password}@${this.host}:${this.port}/0`;
+  }
+  getServiceDefinition() {
+    return {
+      image: this.image,
+      volumes: [
+        {
+          hostPath: interpolate`./data/${this.host}`,
+          containerPath: "/var/lib/valkey/data",
+          backup: { kind: "valkey-save", url: this.url }
+        }
+      ],
+      command: ["--requirepass", this.password],
+      env: { REDISCLI_AUTH: this.password },
+      healthcheck: {
+        test: ["CMD", "valkey-cli", "PING"]
+      }
+    };
+  }
+};
+
+// src/redis.ts
+var Redis = class extends Service {
+  image;
+  port = 6379;
+  constructor(options) {
+    super();
+    this.image = `redis:${options?.version ?? "8"}`;
+  }
+  get password() {
+    return this.derived("redis-password");
+  }
+  get url() {
+    return interpolate`redis://default:${this.password}@${this.host}:${this.port}/0`;
+  }
+  getServiceDefinition() {
+    return {
+      image: this.image,
+      volumes: [
+        {
+          hostPath: interpolate`./data/${this.host}`,
+          containerPath: "/data",
+          backup: { kind: "valkey-save", url: this.url }
+        }
+      ],
+      command: ["--requirepass", this.password],
+      env: { REDISCLI_AUTH: this.password },
+      healthcheck: {
+        test: ["CMD", "redis-cli", "PING"]
+      }
+    };
+  }
+};
+
+// src/garage.ts
+var Garage = class extends Service {
+  image;
+  port = 3900;
+  adminPort = 3903;
+  bucket = "data";
+  constructor(options) {
+    super();
+    this.image = `dxflrs/garage:${options?.version ?? "v1"}`;
+  }
+  get accessKey() {
+    return this.derived("access-key");
+  }
+  get secretKey() {
+    return this.derived("secret-key");
+  }
+  get url() {
+    return interpolate`http://${this.host}:${this.port}`;
+  }
+  get adminUrl() {
+    return interpolate`http://${this.host}:${this.adminPort}`;
+  }
+  getServiceDefinition() {
+    return {
+      image: this.image,
+      volumes: [
+        {
+          hostPath: interpolate`./data/${this.host}`,
+          containerPath: "/var/lib/garage/data",
+          backup: { kind: "file-copy" }
+        }
+      ],
+      env: {
+        GARAGE_ACCESS_KEY: this.accessKey,
+        GARAGE_SECRET_KEY: this.secretKey,
+        GARAGE_DEFAULT_BUCKET: this.bucket
+      },
+      healthcheck: {
+        test: ["CMD", "/garage", "status"]
+      }
+    };
+  }
+};
+export {
+  Garage,
+  MySQL,
+  Postgres,
+  Redis,
+  Valkey
+};