create-svc 0.1.10 → 0.1.12

package/templates/shared/service.config.ts

@@ -0,0 +1,59 @@
+export default {
+  service_id: "{{SERVICE_ID}}",
+  target: "{{TARGET}}",
+  runtime: "{{RUNTIME}}",
+  framework: "{{FRAMEWORK}}",
+  stage_default: "prod",
+  dns: {
+    hostname: "{{API_HOSTNAME}}",
+    base_domain: "{{API_BASE_DOMAIN}}",
+  },
+  ownership: {
+    managed_by: "create-service",
+    service_id: "{{SERVICE_ID}}",
+  },
+  auth: {
+    issuer: "{{AUTH_ISSUER}}",
+    token_endpoint: "https://auth.anmho.com/api/auth/oauth2/token",
+    jwks_url: "https://auth.anmho.com/api/auth/jwks",
+    resource_server: {
+      id: "{{SERVICE_ID}}",
+      audience: "api://{{SERVICE_ID}}",
+      default_scopes: ["{{SERVICE_ID}}:read", "{{SERVICE_ID}}:write"],
+    },
+    client: {
+      app_id: "{{SERVICE_ID}}",
+      identity: "server",
+      vault_path_prefix: "prod/apps/{{SERVICE_ID}}/server/oauth-clients",
+    },
+  },
+  temporal: {
+    enabled: false,
+    address: "localhost:7233",
+    namespace: "default",
+    task_queue: "{{SERVICE_ID}}",
+    api_key_secret_name: "{{SERVICE_ID}}-temporal-api-key",
+  },
+  providers: {
+    vault: {
+      mount: "secret",
+      neon_path: "prod/providers/neon",
+      grafana_path: "prod/providers/grafana",
+      clerk_m2m_path: "prod/providers/clerk-m2m",
+      temporal_path: "prod/providers/temporal",
+    },
+  },
+  buf: {
+    module: "buf.build/anmho/{{SERVICE_ID}}",
+  },
+  cloudrun: {
+    project_id: "{{PROJECT_ID}}",
+    region: "{{REGION}}",
+    service_account: "{{RUNTIME_SERVICE_ACCOUNT}}",
+  },
+  workers: {
+    script_name: "{{SERVICE_ID}}",
+    hyperdrive_binding: "HYPERDRIVE",
+    cron: "*/15 * * * *",
+  },
+} as const;

package/templates/shared/service.yaml

@@ -2,10 +2,17 @@ apiVersion: serving.knative.dev/v1
 kind: Service
 metadata:
   name: ${SERVICE_NAME}
+  labels:
+    managed_by: create-service
+    service_id: ${SERVICE_ID}
   annotations:
     run.googleapis.com/ingress: all
 spec:
   template:
+    metadata:
+      labels:
+        managed_by: create-service
+        service_id: ${SERVICE_ID}
     spec:
       serviceAccountName: ${RUNTIME_SERVICE_ACCOUNT}
       containers:
@@ -17,55 +24,28 @@ spec:
               value: ${SERVICE_RUNTIME}
             - name: APP_FRAMEWORK
               value: ${SERVICE_FRAMEWORK}
+            - name: TEMPORAL_ENABLED
+              value: "${TEMPORAL_ENABLED}"
+            - name: TEMPORAL_ADDRESS
+              value: "${TEMPORAL_ADDRESS}"
+            - name: TEMPORAL_NAMESPACE
+              value: "${TEMPORAL_NAMESPACE}"
+            - name: TEMPORAL_TASK_QUEUE
+              value: "${TEMPORAL_TASK_QUEUE}"
+${TEMPORAL_API_KEY_ENV}
             - name: DATABASE_URL
               valueFrom:
                 secretKeyRef:
                   name: ${DATABASE_URL_SECRET}
                   key: latest
-            - name: CLERK_SECRET_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: ${CLERK_SECRET_KEY}
-                  key: latest
-            - name: CLERK_WEBHOOK_SECRET
-              valueFrom:
-                secretKeyRef:
-                  name: ${CLERK_WEBHOOK_SECRET}
-                  key: latest
-            - name: STRIPE_SECRET_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: ${STRIPE_SECRET_KEY}
-                  key: latest
-            - name: STRIPE_WEBHOOK_SECRET
-              valueFrom:
-                secretKeyRef:
-                  name: ${STRIPE_WEBHOOK_SECRET}
-                  key: latest
-            - name: REVENUECAT_API_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: ${REVENUECAT_API_KEY}
-                  key: latest
-            - name: REVENUECAT_WEBHOOK_SECRET
-              valueFrom:
-                secretKeyRef:
-                  name: ${REVENUECAT_WEBHOOK_SECRET}
-                  key: latest
-            - name: RESEND_API_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: ${RESEND_API_KEY}
-                  key: latest
-            - name: POSTHOG_API_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: ${POSTHOG_API_KEY}
-                  key: latest
-            - name: ATTACHMENT_BUCKET
-              value: ${ATTACHMENT_BUCKET}
-            - name: ATTACHMENT_PUBLIC_BASE_URL
-              value: ${ATTACHMENT_PUBLIC_BASE_URL}
+            - name: AUTH_ENABLED
+              value: "true"
+            - name: AUTH_ISSUER
+              value: ${AUTH_ISSUER}
+            - name: AUTH_AUDIENCE
+              value: ${AUTH_AUDIENCE}
+            - name: AUTH_JWKS_URL
+              value: ${AUTH_JWKS_URL}
   traffic:
     - latestRevision: true
       percent: 100

package/templates/targets/workers/.github/workflows/ci.yml

@@ -0,0 +1,19 @@
+name: CI
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: oven-sh/setup-bun@v2
+      - run: bun install
+      - run: bun lint
+      - run: bun test
+      - if: ${{ vars.GCX_ENABLED == 'true' && github.ref == 'refs/heads/main' }}
+        run: bun run dashboards

package/templates/targets/workers/.github/workflows/deploy.yml

@@ -0,0 +1,19 @@
+name: Deploy
+
+on:
+  push:
+    branches:
+      - main
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: oven-sh/setup-bun@v2
+      - run: bun install
+      - run: bun run deploy
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+      - if: ${{ vars.GCX_ENABLED == 'true' }}
+        run: bun run dashboards

package/templates/targets/workers/Makefile

@@ -0,0 +1,33 @@
+.PHONY: dev migrate gen lint test create deploy dashboards auth destroy
+
+SERVICE := npx --no-install service
+
+dev:
+	bun run dev
+
+migrate:
+	$(SERVICE) migrate
+
+gen:
+	@echo "no generated code for workers"
+
+lint:
+	bunx tsc --noEmit
+
+test:
+	bun test
+
+create:
+	$(SERVICE) create
+
+deploy:
+	$(SERVICE) deploy $(ARGS)
+
+dashboards:
+	$(SERVICE) dashboards
+
+auth:
+	$(SERVICE) auth $(ARGS)
+
+destroy:
+	$(SERVICE) destroy $(ARGS)

package/templates/targets/workers/README.md

@@ -0,0 +1,75 @@
+# {{SERVICE_NAME}}
+
+Generated by `service create`.
+
+This `{{PROFILE}}` profile targets `{{RUNTIME}} + {{FRAMEWORK}}` on Cloudflare Workers with:
+
+- one `wrangler.toml`
+- a lightweight waitlist/launch API
+- the `service` CLI for create, deploy, doctor, dashboards, DNS, and destroy
+- Cron Trigger wiring for scheduled follow-up work
+- a Hyperdrive binding for Neon-backed Postgres persistence
+- a production API origin at `https://{{API_HOSTNAME}}`
+
+## Commands
+
+```bash
+wrangler dev
+bun run test
+bun run lint
+bun run migrate
+service create
+service deploy
+bun run dashboards
+bun run doctor
+bun run destroy
+```
+
+## Local Development
+
+```bash
+bun install
+bun run dev
+```
+
+The Workers target starts with an HTTP waitlist API. Local unit tests use an
+in-memory store. Deployed Workers use the `HYPERDRIVE` binding and create the
+small waitlist/trigger schema on first use.
+
+## API
+
+- `GET /healthz`
+- `GET /readyz`
+- `POST /v1/waitlist`
+- `GET /v1/waitlist?email=<email>`
+- `GET /v1/waitlist/:entryId`
+- `POST /v1/triggers/waitlist`
+- `POST /webhooks/:provider`
+- `GET /webhooks/:provider/health`
+
+## Production
+
+```bash
+service create
+```
+
+`service create` deploys the Worker through Wrangler. The custom domain is
+configured in `wrangler.toml`:
+
+```bash
+https://{{API_HOSTNAME}}
+```
+
+Use `service doctor` after create to verify Wrangler auth, route config, Cron,
+Hyperdrive, dashboard tooling, auth tooling, and deployed health.
+
+If the Hyperdrive binding id is empty, `service create` uses `DATABASE_URL`, or
+`NEON_API_KEY` to create/resolve the generated Neon database and connection URI,
+applies the waitlist schema, then runs `wrangler hyperdrive create` and writes
+the returned id back into `wrangler.toml` before deploy.
+
+You can also apply the schema manually:
+
+```bash
+DATABASE_URL=postgres://... bun run migrate
+```

package/templates/targets/workers/package.json

@@ -0,0 +1,35 @@
+{
+  "name": "{{SERVICE_NAME}}",
+  "private": true,
+  "type": "module",
+  "bin": {
+    "service": "./scripts/workers/cli.ts"
+  },
+  "scripts": {
+    "dev": "wrangler dev",
+    "service": "bun run ./scripts/workers/cli.ts",
+    "migrate": "bun run ./scripts/workers/cli.ts migrate",
+    "seed": "bun run ./scripts/workers/cli.ts seed",
+    "lint": "bunx tsc --noEmit",
+    "test": "bun test",
+    "create": "bun run ./scripts/workers/cli.ts create",
+    "deploy": "bun run ./scripts/workers/cli.ts deploy",
+    "dashboards": "bun run ./scripts/workers/cli.ts dashboards",
+    "auth": "bun run ./scripts/workers/cli.ts auth",
+    "destroy": "bun run ./scripts/workers/cli.ts destroy"
+  },
+  "dependencies": {
+    "@anmho/authctl": "0.1.1",
+    "@clack/prompts": "^1.2.0",
+    "@neondatabase/api-client": "^2.7.1",
+    "hono": "^4.10.1",
+    "pg": "^8.16.3"
+  },
+  "devDependencies": {
+    "@cloudflare/workers-types": "latest",
+    "@types/pg": "^8.16.0",
+    "@types/bun": "latest",
+    "typescript": "^5.9.3",
+    "wrangler": "^4.49.0"
+  }
+}