@zaaxch/tailframe 4.0.6 → 4.0.7

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@zaaxch/tailframe",
-	"version": "4.0.6",
+	"version": "4.0.7",
 	"description": "Tailframe architecture toolkit: validates the Tailframe structure, import-boundary, and file-convention contracts. The package version is the contract version.",
 	"type": "module",
 	"bin": {

package/src/new.mjs

@@ -269,6 +269,10 @@ add(`${svc}/.env.example`, `NODE_ENV=development\nPORT=3000\nCORS_ORIGIN=https:/
 add(`${svc}/.env.infrastructure.example`, `ECR_IMAGE=<account>.dkr.ecr.<region>.amazonaws.com/${options.name}
 IMAGE_TAG=<product-sha>
 APP_ENV_FILE=/opt/${options.name}/shared/.env.production
+CADDY_ORIGIN_CERTIFICATE=/opt/${options.name}/shared/caddy/origin.pem
+CADDY_ORIGIN_KEY=/opt/${options.name}/shared/caddy/origin-key.pem
+CADDY_DATA_DIR=/opt/${options.name}/shared/caddy/data
+CADDY_CONFIG_DIR=/opt/${options.name}/shared/caddy/config
 ${postgres ? `POSTGRES_DATA_DIR=/opt/${options.name}/shared/postgres/data
 POSTGRES_ROOT_PASSWORD=<uri-safe-random-value>
 POSTGRES_APP_PASSWORD=<different-uri-safe-random-value>
@@ -1190,6 +1194,9 @@ configured. No push or merge deploys production automatically.
 Configure the ECR repository with immutable image tags. The release-only role may publish; the distinct deployment
 role is pull-only. Record the full commit SHA and ECR digest; deployment and product migrations use that release image.
 
+Production ingress is a required Caddy reverse proxy in every generated service deployment. The application container remains
+internal; Caddy is the only edge surface and must own 80/443 exposure.
+
 The host separates replaceable artifacts from persistent state:
 
 \`\`\`text
@@ -1201,6 +1208,12 @@ The host separates replaceable artifacts from persistent state:
 └── shared/
     ├── .env.production
     ├── .env.infrastructure
+    ├── caddy/
+    │   ├── certs/
+    │   │   ├── origin.pem
+    │   │   └── origin-key.pem
+    │   ├── config/
+    │   └── data/
 ${options.auth === "firebase" ? `    ├── secrets/firebase-service-account.json
 ` : ""}${postgres ? `    ├── postgres/data/
 ` : `    ├── mongo/config/keyfile
@@ -1215,6 +1228,8 @@ Actions may replace \`current/\` and must never replace \`shared/\`. The server
 - \`.env.production\` contains Node application behavior and provider credentials.
 - \`.env.infrastructure\` contains Compose paths, image identity, and infrastructure passwords. Start from
   \`.env.infrastructure.example\` and replace every placeholder.
+- \`.env.infrastructure\` is also the host-owned control plane for Caddy certificate paths and runtime directories; keep TLS
+  key material under shared storage and rotate it independently from application images.
 - Compose \`environment:\` owns fixed production wiring: \`NODE_ENV\`, internal database/cache URLs, and mounted
   credential paths.
 ${options.ui && options.auth === "firebase" ? `- The UI application's build-time \`.env.production\` comes from the GitHub \`UI_ENV_PRODUCTION\` secret and is unrelated to the service runtime file above.
@@ -1225,9 +1240,11 @@ Do not inject \`.env.infrastructure\` into Node. Make both host environment file
 
 1. Install Docker Engine and Docker Compose.
 ${postgres
-	? `2. Create \`/opt/${options.name}/current/deploy/postgres\` and \`/opt/${options.name}/shared/postgres/data\`${options.redis ? `, plus \`/opt/${options.name}/shared/redis/data\`` : ""}.`
+	? `2. Create \`/opt/${options.name}/current/deploy/postgres\`, \`/opt/${options.name}/shared/postgres/data\`,
+   \`/opt/${options.name}/shared/caddy/certs\`, \`/opt/${options.name}/shared/caddy/data\`, \`/opt/${options.name}/shared/caddy/config\`${options.redis ? `, plus \`/opt/${options.name}/shared/redis/data\`` : ""}.`
 	: `2. Create \`/opt/${options.name}/current/deploy/mongo\`, \`/opt/${options.name}/shared/mongo/config\`, and
-   \`/opt/${options.name}/shared/mongo/data\`${options.redis ? `, plus \`/opt/${options.name}/shared/redis/data\`` : ""}.`}
+   \`/opt/${options.name}/shared/mongo/data\`, \`/opt/${options.name}/shared/caddy/certs\`,
+   \`/opt/${options.name}/shared/caddy/data\`, \`/opt/${options.name}/shared/caddy/config\`${options.redis ? `, plus \`/opt/${options.name}/shared/redis/data\`` : ""}.`}
 3. Install \`.env.production\` and a completed \`.env.infrastructure\` under \`shared/\`.
 ${postgres ? "" : `4. Generate the MongoDB replica key with \`openssl rand -base64 756\`, make it owned by UID/GID \`999:999\`, and
    mode \`0400\`.
@@ -1331,6 +1348,34 @@ const developmentEnvironment = [
 ];
 const developmentEnvironmentBlock = `\n    environment:\n${developmentEnvironment.join("\n")}`;
 const volumeBlock = serviceVolumes.length ? `\n    volumes:\n${serviceVolumes.join("\n")}` : "";
+const caddyService = `
+  caddy:
+    image: caddy:2-alpine
+    ports:
+      - "80:80"
+      - "443:443"
+    volumes:
+      - ./Caddyfile:/etc/caddy/Caddyfile:ro
+      - \${CADDY_ORIGIN_CERTIFICATE:?Set CADDY_ORIGIN_CERTIFICATE}:/etc/caddy/certs/origin.pem:ro
+      - \${CADDY_ORIGIN_KEY:?Set CADDY_ORIGIN_KEY}:/etc/caddy/certs/origin-key.pem:ro
+      - \${CADDY_DATA_DIR:?Set CADDY_DATA_DIR}:/data
+      - \${CADDY_CONFIG_DIR:?Set CADDY_CONFIG_DIR}:/config
+    depends_on:
+      ${options.name}:
+        condition: service_healthy
+    networks:
+      - backend
+    restart: unless-stopped`;
+add(`${svc}/Caddyfile`, `{
+    auto_https off
+}
+:80 {
+    redir https://{host}{uri} 308
+}
+:443 {
+    tls /etc/caddy/certs/origin.pem /etc/caddy/certs/origin-key.pem
+    reverse_proxy ${options.name}:3000
+}`);
 const workerService = options.worker ? `\n  worker:
     image: \${ECR_IMAGE:?Set ECR_IMAGE}:\${IMAGE_TAG:?Set IMAGE_TAG}
     env_file:
@@ -1473,8 +1518,7 @@ services:
     image: \${ECR_IMAGE:?Set ECR_IMAGE}:\${IMAGE_TAG:?Set IMAGE_TAG}
     env_file:
       - \${APP_ENV_FILE:-.env.production}
-    ports:
-      - "3000:3000"${productionEnvironmentBlock}${volumeBlock}${dependsBlock}
+${productionEnvironmentBlock}${volumeBlock}${dependsBlock}
     healthcheck:
       test:
         - CMD-SHELL
@@ -1490,7 +1534,7 @@ services:
     stop_grace_period: 2m
     networks:
       - backend
-    restart: unless-stopped${workerService}${schemaInitService}${databaseService}${redisService}
+    restart: unless-stopped${workerService}${schemaInitService}${databaseService}${redisService}${caddyService}
 networks:
   backend:
     driver: bridge