create-flowdular 0.5.1 → 0.6.1

package/template/default/infra/docker/pitr.sh

@@ -0,0 +1,177 @@
+#!/usr/bin/env bash
+# Point-in-time recovery for the compose stack. Base backups land in the WAL
+# archive volume next to the segments; a restore replaces the cluster with one
+# base backup and replays the archive up to a target time. Nothing here runs
+# while the app container serves the database unless --stop-app says to stop
+# it first.
+set -euo pipefail
+
+here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+compose=(docker compose --env-file "$here/.env" -f "$here/compose.yaml")
+archive=/var/lib/postgresql/wal-archive
+recovery_wait_seconds=600
+
+usage() {
+	cat <<'USAGE'
+Usage:
+  pitr.sh base-backup
+      Take a base backup of the running postgres service into the WAL archive
+      volume (base/<stamp>/base.tar.gz).
+  pitr.sh list
+      List the base backups the archive volume holds.
+  pitr.sh restore --base <stamp> [--target-time '<YYYY-MM-DD HH:MM:SS+00>'] \
+      --confirm replace-cluster [--stop-app]
+      Delete the current cluster, unpack <stamp> and replay the archive up to
+      the target time (to the end of the archive without one). Refuses while
+      the app container is running unless --stop-app is passed.
+USAGE
+}
+
+running() {
+	"${compose[@]}" ps --services --status running | grep -qx "$1"
+}
+
+base_backup() {
+	if ! running postgres; then
+		echo "The postgres service is not running; start it before taking a base backup." >&2
+		exit 1
+	fi
+	local stamp
+	stamp="$(date -u +%Y%m%dT%H%M%SZ)"
+	"${compose[@]}" exec -T -u postgres postgres \
+		pg_basebackup -U postgres -D "$archive/base/$stamp" -Ft -z -X fetch -c fast -P
+	echo "Base backup $stamp is in the flowdular-postgres-wal volume under base/$stamp."
+	echo "Copy it off the host: docker compose --env-file $here/.env -f $here/compose.yaml cp postgres:$archive/base/$stamp <dir>"
+}
+
+list() {
+	"${compose[@]}" run --rm --no-deps -T --entrypoint bash postgres \
+		-c "ls -1 $archive/base 2>/dev/null || true"
+}
+
+# Runs inside a one-off postgres container as root, with the data and archive
+# volumes mounted. PITR_BASE and PITR_TARGET_TIME come from the environment.
+read -r -d '' replace_cluster <<'SCRIPT' || true
+set -euo pipefail
+archive=/var/lib/postgresql/wal-archive
+pgdata=/var/lib/postgresql/data
+tarball="$archive/base/$PITR_BASE/base.tar.gz"
+if [ ! -f "$tarball" ]; then
+	echo "No base backup at $tarball." >&2
+	exit 1
+fi
+find "$pgdata" -mindepth 1 -delete
+tar -xzf "$tarball" -C "$pgdata"
+{
+	echo ""
+	echo "# pitr.sh"
+	echo "restore_command = 'cp $archive/%f %p'"
+	if [ -n "$PITR_TARGET_TIME" ]; then
+		echo "recovery_target_time = '${PITR_TARGET_TIME//\'/\'\'}'"
+	fi
+	echo "recovery_target_action = 'promote'"
+} >>"$pgdata/postgresql.conf"
+touch "$pgdata/recovery.signal"
+chown -R postgres:postgres "$pgdata"
+chmod 700 "$pgdata"
+SCRIPT
+
+restore() {
+	local base="" target_time="" confirm="" stop_app=false
+	while [ $# -gt 0 ]; do
+		case "$1" in
+		--base)
+			base="${2:?--base needs a value}"
+			shift 2
+			;;
+		--target-time)
+			target_time="${2:?--target-time needs a value}"
+			shift 2
+			;;
+		--confirm)
+			confirm="${2:?--confirm needs a value}"
+			shift 2
+			;;
+		--stop-app)
+			stop_app=true
+			shift
+			;;
+		*)
+			echo "Unknown option: $1" >&2
+			usage >&2
+			exit 2
+			;;
+		esac
+	done
+	if [ -z "$base" ]; then
+		echo "--base <stamp> is required; pitr.sh list shows the candidates." >&2
+		exit 2
+	fi
+	case "$base" in
+	*/* | .*)
+		echo "--base must be a plain backup name." >&2
+		exit 2
+		;;
+	esac
+	if [ -n "$target_time" ] &&
+		! [[ "$target_time" =~ ^[0-9]{4}-[0-9]{2}-[0-9]{2}[\ T][0-9]{2}:[0-9]{2}:[0-9]{2}(\.[0-9]+)?(Z|[+-][0-9]{2}(:?[0-9]{2})?)?$ ]]; then
+		echo "--target-time must look like '2026-09-14 09:30:00+00' (date, time, optional fraction and offset)." >&2
+		exit 2
+	fi
+	if [ "$confirm" != replace-cluster ]; then
+		echo "The current cluster is deleted before the base backup is unpacked. Pass --confirm replace-cluster." >&2
+		exit 2
+	fi
+	if running app; then
+		if [ "$stop_app" = true ]; then
+			"${compose[@]}" stop app
+		else
+			echo "The app container is running and serves the database about to be replaced. Stop it (docker compose stop app) or pass --stop-app." >&2
+			exit 1
+		fi
+	fi
+	"${compose[@]}" stop postgres
+	"${compose[@]}" run --rm --no-deps -T \
+		-e PITR_BASE="$base" -e PITR_TARGET_TIME="$target_time" \
+		--entrypoint bash postgres -c "$replace_cluster"
+	"${compose[@]}" up -d postgres
+	echo "Replaying the archive; waiting up to $recovery_wait_seconds seconds for promotion."
+	local waited=0 state
+	while [ "$waited" -lt "$recovery_wait_seconds" ]; do
+		state="$("${compose[@]}" exec -T -u postgres postgres \
+			psql -U postgres -d postgres -tAc 'select pg_is_in_recovery()' 2>/dev/null || true)"
+		if [ "$state" = f ]; then
+			echo "Recovery finished and the server promoted."
+			echo "Check the log for the recovery stop point: docker compose --env-file $here/.env -f $here/compose.yaml logs postgres | grep -i 'recovery stopping'"
+			echo "Then start the app (docker compose --env-file $here/.env -f $here/compose.yaml up -d app), run pnpm flowdular migration verify and check GET /api/ready."
+			return 0
+		fi
+		sleep 5
+		waited=$((waited + 5))
+	done
+	echo "The server is still in recovery after $recovery_wait_seconds seconds. Read docker compose --env-file $here/.env -f $here/compose.yaml logs postgres before doing anything else." >&2
+	exit 1
+}
+
+case "${1:-}" in
+base-backup)
+	shift
+	base_backup "$@"
+	;;
+list)
+	shift
+	list "$@"
+	;;
+restore)
+	shift
+	restore "$@"
+	;;
+-h | --help | help | "")
+	usage
+	;;
+*)
+	echo "Unknown command: $1" >&2
+	usage >&2
+	exit 2
+	;;
+esac

package/template/default/infra/docker/postgres/10-roles.sh

@@ -7,25 +7,29 @@
 # poll reads, under a policy of that table's own.
 set -euo pipefail
 
-psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" <<SQL
-CREATE ROLE coreloom_migrator LOGIN PASSWORD '${FD_DATABASE_MIGRATOR_PASSWORD}'
+psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" <<'SQL'
+\getenv database_name POSTGRES_DB
+\getenv migrator_password FD_DATABASE_MIGRATOR_PASSWORD
+\getenv runtime_password FD_DATABASE_RUNTIME_PASSWORD
+\getenv background_password FD_DATABASE_BACKGROUND_PASSWORD
+CREATE ROLE flowdular_migrator LOGIN PASSWORD :'migrator_password'
 	NOSUPERUSER NOBYPASSRLS NOCREATEDB NOCREATEROLE;
-CREATE ROLE coreloom_runtime LOGIN PASSWORD '${FD_DATABASE_RUNTIME_PASSWORD}'
+CREATE ROLE flowdular_runtime LOGIN PASSWORD :'runtime_password'
 	NOSUPERUSER NOBYPASSRLS NOCREATEDB NOCREATEROLE;
-CREATE ROLE coreloom_background LOGIN PASSWORD '${FD_DATABASE_BACKGROUND_PASSWORD}'
+CREATE ROLE flowdular_background LOGIN PASSWORD :'background_password'
 	NOSUPERUSER NOBYPASSRLS NOCREATEDB NOCREATEROLE;
 
-REVOKE CONNECT ON DATABASE "$POSTGRES_DB" FROM PUBLIC;
-GRANT CONNECT ON DATABASE "$POSTGRES_DB" TO coreloom_migrator, coreloom_runtime, coreloom_background;
+REVOKE CONNECT ON DATABASE :"database_name" FROM PUBLIC;
+GRANT CONNECT ON DATABASE :"database_name" TO flowdular_migrator, flowdular_runtime, flowdular_background;
 
-ALTER SCHEMA public OWNER TO coreloom_migrator;
+ALTER SCHEMA public OWNER TO flowdular_migrator;
 REVOKE ALL ON SCHEMA public FROM PUBLIC;
-GRANT USAGE ON SCHEMA public TO coreloom_runtime, coreloom_background;
+GRANT USAGE ON SCHEMA public TO flowdular_runtime, flowdular_background;
 
 -- Every table the migrator creates later is reachable by the runtime role
 -- without a second grant step after each migration.
-ALTER DEFAULT PRIVILEGES FOR ROLE coreloom_migrator IN SCHEMA public
-	GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO coreloom_runtime;
-ALTER DEFAULT PRIVILEGES FOR ROLE coreloom_migrator IN SCHEMA public
-	GRANT USAGE, SELECT ON SEQUENCES TO coreloom_runtime;
+ALTER DEFAULT PRIVILEGES FOR ROLE flowdular_migrator IN SCHEMA public
+	GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO flowdular_runtime;
+ALTER DEFAULT PRIVILEGES FOR ROLE flowdular_migrator IN SCHEMA public
+	GRANT USAGE, SELECT ON SEQUENCES TO flowdular_runtime;
 SQL

package/template/default/infra/docker/start.mjs

@@ -0,0 +1,402 @@
+#!/usr/bin/env node
+import { randomBytes } from 'node:crypto';
+import {
+	chmodSync,
+	closeSync,
+	existsSync,
+	fsyncSync,
+	lstatSync,
+	openSync,
+	readFileSync,
+	renameSync,
+	rmSync,
+	writeFileSync,
+} from 'node:fs';
+import { spawnSync } from 'node:child_process';
+import { isIP } from 'node:net';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { parseEnv } from 'node:util';
+
+const directory = dirname(fileURLToPath(import.meta.url));
+const envPath = resolve(directory, '.env');
+const examplePath = resolve(directory, '.env.example');
+const composePath = resolve(directory, 'compose.yaml');
+const projectRoot = resolve(directory, '../..');
+
+const databasePasswords = [
+	'FD_POSTGRES_SUPERUSER_PASSWORD',
+	'FD_DATABASE_MIGRATOR_PASSWORD',
+	'FD_DATABASE_RUNTIME_PASSWORD',
+	'FD_DATABASE_BACKGROUND_PASSWORD',
+];
+const encryptionKeys = [
+	'FD_AGENT_CREDENTIAL_KEY',
+	'FD_AGENT_RUN_GRANT_KEY',
+	'FD_AUTH_MFA_KEY',
+	'FD_APPROVAL_GRANT_KEY',
+	'FD_AUTOMATIONS_CREDENTIAL_KEY',
+	'FD_NOTIFICATIONS_SECRET_KEY',
+	'FD_WORKFLOWS_PAYLOAD_KEY',
+	'FD_WORKFLOWS_CURSOR_KEY',
+	'FD_STORAGE_ENCRYPTION_KEY',
+	'FD_CONNECTORS_SECRET_KEY',
+	'FD_AUDIT_ANCHOR_KEY',
+];
+const secretKeys = [
+	...databasePasswords,
+	...encryptionKeys,
+	'FD_MINIO_ROOT_PASSWORD',
+];
+const plainEnvValue = /^[A-Za-z0-9_./+=:@%~-]+$/;
+
+function setEntry(contents, key, value) {
+	const line = new RegExp(`^(\\s*(?:export\\s+)?${key}\\s*=)[^\\r\\n]*$`, 'm');
+	if (line.test(contents)) {
+		return contents.replace(line, (_match, prefix) => `${prefix}${value}`);
+	}
+	return `${contents.replace(/\s*$/, '\n')}${key}=${value}\n`;
+}
+
+function writePrivateFile(path, contents) {
+	const temporary = `${path}.${randomBytes(6).toString('hex')}.tmp`;
+	let handle;
+	try {
+		handle = openSync(temporary, 'wx', 0o600);
+		writeFileSync(handle, contents);
+		fsyncSync(handle);
+		closeSync(handle);
+		handle = undefined;
+		renameSync(temporary, path);
+		chmodSync(path, 0o600);
+	} catch (error) {
+		if (handle !== undefined) closeSync(handle);
+		rmSync(temporary, { force: true });
+		throw error;
+	}
+}
+
+function valueOf(parsed, environment, key) {
+	const fromFile = parsed[key] ?? '';
+	const fromEnvironment = environment[key] ?? '';
+	if (fromFile && fromEnvironment && fromFile !== fromEnvironment) {
+		throw new Error(
+			`${key} differs between the shell and infra/docker/.env. Use one value before starting.`,
+		);
+	}
+	return fromEnvironment || fromFile;
+}
+
+function settingOf(parsed, environment, key) {
+	return environment[key]?.trim() || parsed[key]?.trim() || '';
+}
+
+/** Fill only absent credentials. A restart must reuse exactly the same values. */
+function ensureEnvironmentFileUnlocked(
+	path = envPath,
+	template = examplePath,
+	environment = process.env,
+) {
+	const existed = existsSync(path);
+	if (existed) {
+		const stat = lstatSync(path);
+		if (!stat.isFile() || stat.isSymbolicLink()) {
+			throw new Error('infra/docker/.env must be a regular file, not a link.');
+		}
+	}
+	let contents = existed
+		? readFileSync(path, 'utf8')
+		: readFileSync(template, 'utf8');
+	let parsed = parseEnv(contents);
+	let generated = 0;
+	const fileProjectName = parsed.COMPOSE_PROJECT_NAME?.trim() ?? '';
+	const shellProjectName = environment.COMPOSE_PROJECT_NAME?.trim() ?? '';
+	if (
+		fileProjectName &&
+		shellProjectName &&
+		fileProjectName !== shellProjectName
+	) {
+		throw new Error(
+			'COMPOSE_PROJECT_NAME differs between the shell and infra/docker/.env. Use the existing project name to keep its volumes.',
+		);
+	}
+	/* Earlier stacks used Compose's implicit name, docker. Persist it for old
+	   .env files so upgrading cannot silently switch to empty volumes. */
+	const projectName =
+		fileProjectName ||
+		shellProjectName ||
+		(existed ? 'docker' : `flowdular-${randomBytes(6).toString('hex')}`);
+	if (!/^[a-z0-9][a-z0-9_-]*$/.test(projectName)) {
+		throw new Error(
+			'COMPOSE_PROJECT_NAME must start with a lowercase letter or digit and contain only lowercase letters, digits, underscores or hyphens.',
+		);
+	}
+	if (!fileProjectName) {
+		contents = setEntry(contents, 'COMPOSE_PROJECT_NAME', projectName);
+		parsed = { ...parsed, COMPOSE_PROJECT_NAME: projectName };
+		generated++;
+	}
+	const port = settingOf(parsed, environment, 'FD_PORT') || '3000';
+	if (!/^\d+$/.test(port) || Number(port) < 1 || Number(port) > 65535) {
+		throw new Error('FD_PORT must be an integer from 1 to 65535.');
+	}
+	const appPath =
+		settingOf(parsed, environment, 'FD_APPLICATION_PATH') || '/app';
+	if (
+		appPath.length > 64 ||
+		!/^\/[a-z][a-z0-9-]*$/.test(appPath) ||
+		[
+			'setup',
+			'health',
+			'ready',
+			'assets',
+			'auth',
+			'api',
+			'sites',
+			'sign-in',
+			'sign-up',
+			'forgot-password',
+			'reset-password',
+			'accept-invitation',
+		].includes(appPath.slice(1))
+	) {
+		throw new Error(
+			'FD_APPLICATION_PATH must be one available path such as /app or /backoffice.',
+		);
+	}
+	const bindAddress =
+		settingOf(parsed, environment, 'FD_BIND_ADDRESS') || '127.0.0.1';
+	if (isIP(bindAddress) !== 4) {
+		throw new Error('FD_BIND_ADDRESS must be an IPv4 address.');
+	}
+	const origin =
+		settingOf(parsed, environment, 'FD_AUTH_PUBLIC_ORIGIN') ||
+		`http://localhost:${port}`;
+	const localhostHttp =
+		/^http:\/\/(?:localhost|127\.0\.0\.1|\[::1\])(?::\d+)?$/i.test(origin);
+	const cookieSetting = settingOf(parsed, environment, 'FD_AUTH_SECURE_COOKIE');
+	if (localhostHttp && cookieSetting === 'true') {
+		throw new Error(
+			'FD_AUTH_SECURE_COOKIE=true blocks setup on local HTTP. Set it to false in infra/docker/.env or use an HTTPS origin.',
+		);
+	}
+	const endpoint = settingOf(parsed, environment, 'FD_STORAGE_S3_ENDPOINT');
+	const accessKey = settingOf(
+		parsed,
+		environment,
+		'FD_STORAGE_S3_ACCESS_KEY_ID',
+	);
+	const secretKey = settingOf(
+		parsed,
+		environment,
+		'FD_STORAGE_S3_SECRET_ACCESS_KEY',
+	);
+	/* An empty endpoint with AWS credentials is the existing AWS configuration.
+	   New local installs receive an explicit MinIO endpoint in their .env. */
+	const localMinio =
+		endpoint === 'http://minio:9000' || (!endpoint && !accessKey && !secretKey);
+	if (
+		localMinio &&
+		settingOf(parsed, environment, 'FD_STORAGE_S3_FORCE_PATH_STYLE') === 'false'
+	) {
+		throw new Error(
+			'FD_STORAGE_S3_FORCE_PATH_STYLE must be true when using the bundled MinIO service.',
+		);
+	}
+	if (!localMinio && (!accessKey || !secretKey)) {
+		throw new Error(
+			'An external S3 service needs FD_STORAGE_S3_ACCESS_KEY_ID and FD_STORAGE_S3_SECRET_ACCESS_KEY.',
+		);
+	}
+	if (localMinio && !endpoint) {
+		contents = setEntry(
+			contents,
+			'FD_STORAGE_S3_ENDPOINT',
+			'http://minio:9000',
+		);
+		parsed = { ...parsed, FD_STORAGE_S3_ENDPOINT: 'http://minio:9000' };
+		generated++;
+	}
+	for (const key of secretKeys) {
+		const present = Boolean(parsed[key]);
+		const value =
+			valueOf(parsed, environment, key) ||
+			(databasePasswords.includes(key) || key === 'FD_MINIO_ROOT_PASSWORD'
+				? randomBytes(32).toString('hex')
+				: randomBytes(32).toString('base64'));
+		if (!present && !plainEnvValue.test(value)) {
+			throw new Error(
+				`${key} contains characters that this launcher cannot safely persist. Put it in infra/docker/.env directly.`,
+			);
+		}
+		if (!present) {
+			contents = setEntry(contents, key, value);
+			parsed = { ...parsed, [key]: value };
+			generated++;
+		}
+	}
+	if (!cookieSetting) {
+		contents = setEntry(
+			contents,
+			'FD_AUTH_SECURE_COOKIE',
+			localhostHttp ? 'false' : 'true',
+		);
+		generated++;
+	}
+	if (!existsSync(path) || contents !== readFileSync(path, 'utf8'))
+		writePrivateFile(path, contents);
+	else chmodSync(path, 0o600);
+	return {
+		path,
+		projectName,
+		port: Number(port),
+		appPath,
+		bindAddress,
+		publicOrigin: origin.replace(/\/+$/, ''),
+		generated,
+	};
+}
+
+export function ensureEnvironmentFile(
+	path = envPath,
+	template = examplePath,
+	environment = process.env,
+) {
+	/* The lock covers reads, generated values and the atomic rename. Without it,
+	   concurrent launchers can initialize PostgreSQL with a password that loses
+	   the last rename and can no longer be recovered from .env. */
+	const lockPath = `${path}.lock`;
+	let lock;
+	try {
+		lock = openSync(lockPath, 'wx', 0o600);
+	} catch (error) {
+		if (error?.code === 'EEXIST') {
+			throw new Error(
+				'Another launcher is preparing infra/docker/.env. Wait for it to finish. If it crashed, verify no launcher is running before removing infra/docker/.env.lock.',
+			);
+		}
+		throw error;
+	}
+	try {
+		return ensureEnvironmentFileUnlocked(path, template, environment);
+	} finally {
+		closeSync(lock);
+		rmSync(lockPath, { force: true });
+	}
+}
+
+function compose(args, options = {}) {
+	const result = spawnSync(
+		'docker',
+		['compose', '--env-file', envPath, '-f', composePath, ...args],
+		{
+			cwd: projectRoot,
+			encoding: 'utf8',
+			stdio: options.capture ? ['ignore', 'pipe', 'pipe'] : 'inherit',
+		},
+	);
+	if (result.error) throw result.error;
+	if (result.status !== 0) {
+		throw new Error(
+			`docker compose ${args[0]} failed${result.stderr ? `: ${result.stderr.trim()}` : ''}.`,
+		);
+	}
+	return result.stdout ?? '';
+}
+
+async function waitForHealth(origin) {
+	for (let attempt = 0; attempt < 60; attempt++) {
+		try {
+			const response = await fetch(`${origin}/api/health`, {
+				signal: AbortSignal.timeout(3000),
+			});
+			if (response.ok) return;
+		} catch {
+			// Compose may have started the container before the port is listening.
+		}
+		await new Promise((done) => setTimeout(done, 2000));
+	}
+	throw new Error(
+		`The application did not become healthy at ${origin}/api/health.`,
+	);
+}
+
+function openBrowser(url) {
+	if (
+		process.platform === 'linux' &&
+		!process.env.DISPLAY &&
+		!process.env.WAYLAND_DISPLAY
+	)
+		return false;
+	const command =
+		process.platform === 'darwin'
+			? 'open'
+			: process.platform === 'win32'
+				? 'rundll32.exe'
+				: 'xdg-open';
+	const args =
+		process.platform === 'win32' ? ['url.dll,FileProtocolHandler', url] : [url];
+	const result = spawnSync(command, args, { stdio: 'ignore', timeout: 10000 });
+	return !result.error && result.status === 0;
+}
+
+async function main() {
+	const flags = new Set(process.argv.slice(2));
+	if (flags.has('--help')) {
+		console.log('Usage: node infra/docker/start.mjs [--no-open] [--no-build]');
+		return;
+	}
+	for (const flag of flags) {
+		if (!['--no-open', '--no-build'].includes(flag))
+			throw new Error(`Unknown option: ${flag}`);
+	}
+	const version = spawnSync('docker', ['compose', 'version'], {
+		stdio: 'ignore',
+	});
+	if (version.error || version.status !== 0)
+		throw new Error('Docker Compose is required.');
+	const { port, appPath, bindAddress, publicOrigin, generated } =
+		ensureEnvironmentFile();
+	console.log(
+		generated
+			? 'Saved first-run credentials in infra/docker/.env (owner-only).'
+			: 'Using existing infra/docker/.env.',
+	);
+	compose(['up', '-d', ...(flags.has('--no-build') ? [] : ['--build'])]);
+	const healthHost = bindAddress === '0.0.0.0' ? 'localhost' : bindAddress;
+	const localOrigin = `http://${healthHost}:${port}`;
+	await waitForHealth(localOrigin);
+	const setupResponse = await fetch(`${localOrigin}/setup`, {
+		redirect: 'manual',
+		signal: AbortSignal.timeout(5000),
+	});
+	const setupPage =
+		setupResponse.ok &&
+		setupResponse.headers.get('x-flowdular-setup') === 'first-run';
+	const url = `${publicOrigin}${setupPage ? '/setup' : appPath}`;
+	console.log(`Flowdular is ready: ${url}`);
+	if (setupPage) {
+		console.log('Setup token from the application log:');
+		const logs = compose(['logs', '--no-log-prefix', '--tail', '120', 'app'], {
+			capture: true,
+		});
+		const token = /(?:^|\n)\s*Token\s+([^\s]+)/.exec(logs)?.[1];
+		if (token) console.log(`  ${token}`);
+		else
+			console.log(
+				'  Run: docker compose -f infra/docker/compose.yaml logs app',
+			);
+	}
+	if (!flags.has('--no-open') && !openBrowser(url))
+		console.log('Open the URL in a browser on this workstation.');
+}
+
+if (
+	process.argv[1] &&
+	resolve(process.argv[1]) === fileURLToPath(import.meta.url)
+) {
+	main().catch((error) => {
+		console.error(error.message);
+		process.exitCode = 1;
+	});
+}

package/template/default/infra/kubernetes/database-secret.example.yaml

@@ -10,6 +10,6 @@ metadata:
   name: flowdular-database
 type: Opaque
 stringData:
-  migratorUrl: postgresql://coreloom_migrator:CHANGE_ME@postgres:5432/flowdular
-  runtimeUrl: postgresql://coreloom_runtime:CHANGE_ME@postgres:5432/flowdular
-  backgroundUrl: postgresql://coreloom_background:CHANGE_ME@postgres:5432/flowdular
+  migratorUrl: postgresql://flowdular_migrator:CHANGE_ME@postgres:5432/flowdular
+  runtimeUrl: postgresql://flowdular_runtime:CHANGE_ME@postgres:5432/flowdular
+  backgroundUrl: postgresql://flowdular_background:CHANGE_ME@postgres:5432/flowdular

package/template/default/infra/kubernetes/deployment.yaml

@@ -61,6 +61,11 @@ spec:
                   key: backgroundUrl
             - name: FD_AUTH_ALLOW_SIGN_UP
               value: 'false'
+            # Tenant id that overrides the operator workspace, the one that
+            # changes platform settings such as the branding and the mail relay.
+            # Empty, the workspace auth.core recorded at first-run setup decides.
+            - name: FD_OPERATOR_TENANT
+              value: ''
             - name: FD_AUTH_SECURE_COOKIE
               value: 'true'
             # With none, invitations and password resets are refused. The smtp