elestio 1.2.0 → 1.2.3

package/README.md

@@ -355,16 +355,30 @@ domain.
 | Repo files the compose mounts | Unavailable | Available |
 | Works for | Templates that need no files from the repo | Every template |
 
-The compose route has no checkout, so a template whose `docker-compose.yml`
-bind-mounts a file from its repo cannot work: Docker creates the missing source
-as an empty directory and the container fails to start. The CLI detects this
-from the compose file and refuses upfront, naming the files, rather than
-letting the build fail a minute later with a `runc` error. `--force` overrides.
+The compose route has no checkout and runs no install script, so a template
+whose `docker-compose.yml` bind-mounts a file cannot work: Docker creates the
+missing source as an empty directory and the container fails to start. The file
+may ship in the template repo (n8n's `./n8n-task-runners.json`) or be generated
+by an install script (Kafka writes its `./jaas/*.conf` in `preInstall`) - either
+way it is absent here. The CLI detects this from the compose file and refuses
+upfront, naming the files, rather than letting the build fail a minute later
+with a `runc` error. `--force` overrides, and will most likely still fail.
+
+Quoted mounts (`- "./.env:/app/.env"`) and the long `type: bind` syntax count
+too; missing them is how Chromadb once deployed into a broken container.
 
 This affects more templates than you would expect - n8n
-(`./n8n-task-runners.json`), Rybbit (four files under `./configs/`) and
-WordPress (`./php.ini`) are all in this category. Vaultwarden, Redis and
-Metabase deploy cleanly on the compose route.
+(`./n8n-task-runners.json`), Chromadb (`./.env`, `./overrides/system.js`),
+Rybbit (four files under `./configs/`) and WordPress (`./php.ini`) are all in
+this category. Vaultwarden, Redis and Metabase deploy cleanly on the compose
+route.
+
+**Every template also declares install scripts** (`preInstallCommand`,
+`postInstallCommand`) that the compose route cannot run, and what they do
+cannot be read from outside Elestio. Most software does not need them -
+vaultwarden, redis and metabase were verified to deploy and run - so the CLI
+warns and continues rather than refusing. If the software comes up without its
+admin account or initial data, deploy it as a managed service instead.
 
 > **The git route is currently unavailable.** It needs
 > `POST /api/cicd/createRepoByTemplate`, which the Elestio API returns 404 for:
@@ -383,7 +397,8 @@ Metabase deploy cleanly on the compose route.
 | `elestio cicd pipeline-delete <vmID> <pipelineID> --force` | Delete pipeline |
 | `elestio cicd pipeline-resync <vmID> <pipelineID>` | Re-sync pipeline |
 | `elestio cicd pipeline-logs <vmID> <pipelineID>` | View pipeline logs |
-| `elestio cicd pipeline-history <vmID> <pipelineID>` | Build history |
+| `elestio cicd pipeline-history <vmID> <pipelineID>` | Build history, with each build's log file |
+| `elestio cicd pipeline-log <vmID> --pipeline <id> [--file <logID>]` | Open a build log (latest, or one from the history) |
 | `elestio cicd create --auto --target <vmID> --name X --repo owner/repo` | Pipeline from your own repo |
 | `elestio cicd create <config.json>` | Create from config file |
 | `elestio cicd template [mode]` | Generate config template |
@@ -407,7 +422,7 @@ Metabase deploy cleanly on the compose route.
 | `--build-cmd`, `--run-cmd`, `--install-cmd`, `--build-dir` | Override the values from `elestio.yml` (git route only) |
 | `--variables <KEY=VALUE...>` | Override the environment variables, newline-separated (git route only) |
 | `--force` | Deploy on the compose route even when the compose mounts a repo file |
-| `--dry-run` | Print the plan, create nothing |
+| `--dry-run` | Print the plan, create nothing - including on the git route, which never creates the repository |
 
 #### Pipelines from your own repository
 
@@ -488,7 +503,8 @@ you to supply all of that yourself.
 
 **The software starts, then exits, or the build fails.**
 Check the build log: `elestio cicd pipeline-history <vmID> <pipelineID>`, then
-`elestio cicd pipeline-log <vmID> --pipeline <id> --file <log>`. On the compose
+`elestio cicd pipeline-log <vmID> --pipeline <id> --file <logID>` (or without
+`--file` for the latest build). It answers a temporary URL tailing the log. On the compose
 route the usual causes are a repo file the compose mounts (the CLI refuses
 these upfront unless you passed `--force`) or a template that genuinely needs
 its lifecycle scripts. Both need the git route, which is currently

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "elestio",
-  "version": "1.2.0",
+  "version": "1.2.3",
   "description": "Elestio CLI - Deploy and manage services on the Elestio DevOps platform",
   "type": "module",
   "main": "src/cli.js",

package/src/api.js

@@ -50,6 +50,28 @@ async function parseJson(response, endpoint) {
   }
 }
 
+/**
+ * The API throttles bursts and then answers "Access temporarily restricted"
+ * for a while, on authentication as well as on any endpoint. Saying so plainly
+ * matters: it reads like a credentials or permissions problem otherwise, and a
+ * script that treats it as "no data" silently produces wrong results.
+ */
+export function rateLimitMessage(message) {
+  if (!/temporarily restricted|too many requests|rate limit/i.test(String(message ?? ''))) return null;
+  return 'The Elestio API has temporarily restricted this account for sending too many requests. ' +
+    'Wait a few minutes before retrying, and space out bulk loops (one request at a time). ' +
+    `API said: "${String(message).trim()}"`;
+}
+
+function raiseIfRateLimited(data) {
+  const message = rateLimitMessage(data?.message);
+  if (message) {
+    const error = new Error(message);
+    error.rateLimited = true;
+    throw error;
+  }
+}
+
 async function authenticate(email, token) {
   const response = await httpRequest(`${BASE_URL}/api/auth/checkAPIToken`, {
     method: 'POST',
@@ -59,6 +81,8 @@ async function authenticate(email, token) {
 
   const data = await parseJson(response, '/api/auth/checkAPIToken');
 
+  raiseIfRateLimited(data);
+
   if (data.status !== 'OK' || !data.jwt) {
     throw new Error(data.message || 'Authentication failed');
   }
@@ -118,6 +142,10 @@ export async function apiRequest(endpoint, method = 'POST', body = {}, retried =
 
   const data = await parseJson(response, endpoint);
 
+  // Before the auth check: a throttled account answers like a bad token, and
+  // clearing the JWT then re-authenticating only adds requests.
+  raiseIfRateLimited(data);
+
   const isAuthError = !retried && (
     (data.status === 'error' && data.message?.toLowerCase().includes('auth')) ||
     (data.code === 'InvalidToken') ||

package/src/commands/cicd-template.js

@@ -4,6 +4,7 @@ import { log, colors, outputJson, formatTable } from '../utils.js';
 import { getTemplates } from './templates.js';
 import { createSubstitutions, normalizeElestioConfig, repoFileMounts } from '../templates/elestio-config.js';
 import { buildGitPipelinePayload, buildComposePipelinePayload } from '../payloads/pipeline.js';
+import { parseGitAuthId } from './cicd.js';
 import { TEMPLATE_REPO_OWNER, TEMPLATE_REPO_HOST } from '../constants.js';
 
 /**
@@ -99,12 +100,9 @@ async function resolveCicdTarget(vmID, projectId) {
   };
 }
 
-async function findGitAuth(gitType, projectId) {
+async function findGitAuth(gitType) {
   const response = await apiRequest('/api/cicd/getCICDUserAuthAccount', 'POST', {});
-  const accounts = response.data?.accounts || response.data || response.accounts || [];
-  if (!Array.isArray(accounts)) return null;
-  const match = accounts.find(a => (a.externalProviderName || a.gitType) === gitType);
-  return match ? String(match.id || match.authID) : null;
+  return parseGitAuthId(response, gitType);
 }
 
 /**
@@ -211,7 +209,7 @@ export async function deployTemplate(nameOrId, options = {}) {
   log('success', `Config loaded: runtime "${elestioConfig.config.runTime}", ${elestioConfig.variables ? elestioConfig.variables.split('\n').length : 0} env vars, ${elestioConfig.ports.length} port(s)`);
 
   const payload = useGit
-    ? await buildGitRoute({ options, projectId, target, template, repoName, pipelineName, branch, elestioConfig })
+    ? await buildGitRoute({ options, projectId, target, template, repoName, pipelineName, branch, elestioConfig, dryRun: !!options.dryRun })
     : await buildComposeRoute({ projectId, target, repoName, pipelineName, branch, sourceRepoUrl, elestioConfig, force: options.force });
 
   if (options.dryRun) {
@@ -239,10 +237,10 @@ export async function deployTemplate(nameOrId, options = {}) {
   return response;
 }
 
-async function buildGitRoute({ options, projectId, target, template, repoName, pipelineName, branch, elestioConfig }) {
+async function buildGitRoute({ options, projectId, target, template, repoName, pipelineName, branch, elestioConfig, dryRun = false }) {
   const gitType = (options.gitType || 'GITHUB').toUpperCase();
 
-  let authID = options.authId ? String(options.authId) : await findGitAuth(gitType, projectId);
+  let authID = options.authId ? String(options.authId) : await findGitAuth(gitType);
   if (!authID) {
     throw new Error(
       `No ${gitType} account connected. Connect one in the dashboard (CI/CD > Git accounts), pass --auth-id, ` +
@@ -255,14 +253,21 @@ async function buildGitRoute({ options, projectId, target, template, repoName, p
     throw new Error('The Git account or organisation to create the repo in is required (--owner <user-or-org>)');
   }
 
-  log('info', `Creating ${owner}/${repoName} from ${TEMPLATE_REPO_OWNER}/${repoName}...`);
-  const repo = await generateRepoFromTemplate({
-    gitType, authID, owner, repoName,
-    templateName: repoName,
-    isPrivate: !!options.private,
-    isNonOrg: !!options.nonOrg
-  });
-  log('success', `Repo created: ${owner}/${repoName}`);
+  // A dry run must create nothing, and this step creates a repository in the
+  // user's Git account.
+  let repo = null;
+  if (dryRun) {
+    log('info', `Would create ${owner}/${repoName} from ${TEMPLATE_REPO_OWNER}/${repoName}`);
+  } else {
+    log('info', `Creating ${owner}/${repoName} from ${TEMPLATE_REPO_OWNER}/${repoName}...`);
+    repo = await generateRepoFromTemplate({
+      gitType, authID, owner, repoName,
+      templateName: repoName,
+      isPrivate: !!options.private,
+      isNonOrg: !!options.nonOrg
+    });
+    log('success', `Repo created: ${owner}/${repoName}`);
+  }
 
   return buildGitPipelinePayload({
     target,
@@ -291,16 +296,17 @@ async function buildComposeRoute({ projectId, target, repoName, pipelineName, br
   const fileMounts = repoFileMounts(compose);
   if (fileMounts.length > 0 && !force) {
     throw new Error(
-      `"${repoName}" bind-mounts ${fileMounts.length} file(s) that live in the template repo ` +
-      `(${fileMounts.join(', ')}). The compose route has no checkout, so Docker creates each one as an ` +
-      'empty directory and the container fails to start. Use the Git route (--owner <git-user>) for this ' +
-      'software, or --force to deploy anyway.'
+      `"${repoName}" bind-mounts ${fileMounts.length} file(s) that will not exist on the compose route ` +
+      `(${fileMounts.join(', ')}): either they ship in the template repo, or its install scripts create them ` +
+      '(Kafka generates its jaas/ files in preInstall). This route has no checkout and runs no install ' +
+      'script, so Docker creates each path as an empty directory and the container fails to start. The Git ' +
+      'route would handle both, but the Elestio API does not expose it today: deploy this software from the ' +
+      'dashboard, or as a managed service. --force deploys anyway, and will most likely fail.'
     );
   }
 
-  if (hasLifecycleHooks(elestioConfig)) {
-    log('warn', `"${repoName}" defines lifecycle scripts that need a repo checkout; they are skipped on the compose route.`);
-  }
+  const hooks = installHooks(elestioConfig);
+  if (hooks.length > 0) log('warn', lifecycleWarning(repoName, hooks));
 
   return buildComposePipelinePayload({
     target, projectId, pipelineName, compose, elestioConfig
@@ -311,6 +317,25 @@ function hasLifecycleHooks(elestioConfig) {
   return Object.values(elestioConfig.lifeCycleCommand).some(v => v && v !== '');
 }
 
+/**
+ * Install hooks live in the template repo, which the compose route never
+ * checks out, so they are skipped. Every catalog template declares them, and
+ * plenty deploy perfectly without them (vaultwarden, redis and metabase were
+ * verified live), so this reports rather than refuses: what the scripts
+ * actually do cannot be read, the repos are private to Elestio.
+ */
+export function installHooks(elestioConfig) {
+  return Object.entries(elestioConfig.lifeCycleCommand || {})
+    .filter(([name, value]) => value && value !== '' && /^(pre|post)Install/.test(name))
+    .map(([name, value]) => `${name}=${value}`);
+}
+
+export function lifecycleWarning(repoName, hooks) {
+  return `"${repoName}" declares install scripts the compose route cannot run (${hooks.join(', ')}). ` +
+    'Whatever they set up is skipped: an admin account, initial data or a sign-up lockdown may be missing. ' +
+    'Check the software once deployed; if it needs them, deploy it as a managed service instead.';
+}
+
 function collectOverrides(options) {
   const overrides = {};
   if (options.buildCmd !== undefined) overrides.buildCmd = options.buildCmd;

package/src/commands/cicd.js

@@ -169,16 +169,70 @@ export async function getPipelineHistory(vmID, pipelineID, projectId, json = fal
   return history;
 }
 
-export async function viewPipelineLog(vmID, pipelineID, filepath, projectId) {
+/**
+ * getCICDUserAuthAccount answers an object keyed by provider:
+ *   {data: {GITHUB: [{name, value, type}], GITLAB: [], GITLAB_SELF_HOSTED: []}}
+ * The auth ID is the account's `value`. Reading it as an array found nothing,
+ * so the git route reported no connected account even when there was one.
+ */
+export function parseGitAuthId(response, gitType) {
+  const data = response?.data ?? response ?? {};
+
+  const byProvider = data[gitType];
+  if (Array.isArray(byProvider) && byProvider.length > 0) {
+    const account = byProvider[0];
+    const id = account.value ?? account.id ?? account.authID;
+    return id === undefined || id === null ? null : String(id);
+  }
+
+  // Older shape: a flat list of accounts carrying their provider.
+  const flat = Array.isArray(data) ? data : (Array.isArray(data.accounts) ? data.accounts : null);
+  if (flat) {
+    const match = flat.find(a => (a.externalProviderName || a.gitType || a.type) === gitType);
+    if (match) {
+      const id = match.value ?? match.id ?? match.authID;
+      return id === undefined || id === null ? null : String(id);
+    }
+  }
+
+  return null;
+}
+
+/**
+ * viewPipelineLog requires isLatest, and spells the file `filePath`. Sending
+ * `filepath` without isLatest was rejected as a missing parameter, so no build
+ * log could be read. The file name is the logID from pipeline-history; it is
+ * resolved inside the pipeline's own log directory, so a full path is trimmed.
+ */
+export function buildViewLogPayload(vmID, pipelineID, projectId, file = null) {
+  const payload = {
+    vmID: String(vmID),
+    projectID: String(projectId),
+    pipelineID: parseInt(pipelineID),
+    isLatest: !file
+  };
+  if (file) payload.filePath = String(file).slice(String(file).lastIndexOf('/') + 1);
+  return payload;
+}
+
+/**
+ * Opens a temporary web view tailing one build log, like the dashboard does.
+ * The endpoint answers a URL, not the log's content.
+ */
+export async function viewPipelineLog(vmID, pipelineID, filepath, projectId, json = false) {
   const config = loadConfig();
   const pid = projectId || config.defaultProject;
   if (!pid) throw new Error('Project ID required');
+  if (!pipelineID) throw new Error('Pipeline ID required (--pipeline <id>)');
 
-  const response = await apiRequest('/api/cicd/viewPipelineLog', 'POST', {
-    vmID: String(vmID), projectID: String(pid), pipelineID: parseInt(pipelineID), filepath
-  });
-  if (response.status !== 'OK') throw new Error(response.message || 'Failed');
-  console.log(response.data?.content || response.content || '');
+  const response = await apiRequest('/api/cicd/viewPipelineLog', 'POST', buildViewLogPayload(vmID, pipelineID, pid, filepath));
+  if (!response.url) throw new Error(response.message || response.details || 'Failed to open the build log');
+
+  if (json) { outputJson({ url: response.url }); return response; }
+
+  console.log(`\n${colors.bold}Build log${filepath ? ` (${filepath})` : ' (latest)'}${colors.reset}\n`);
+  console.log(`  URL: ${colors.cyan}${response.url}${colors.reset}`);
+  console.log(`\n  ${colors.dim}Temporary page tailing the log on the target.${colors.reset}\n`);
   return response;
 }
 
@@ -238,6 +292,14 @@ async function findGitAuthID(gitType, projectId) {
   const config = loadConfig();
   const pid = projectId || config.defaultProject;
 
+  // The connected accounts are the authoritative source; the scan below only
+  // covers accounts that are not listed but are in use by a pipeline.
+  try {
+    const accounts = await apiRequest('/api/cicd/getCICDUserAuthAccount', 'POST', {});
+    const authID = parseGitAuthId(accounts, gitType);
+    if (authID) return authID;
+  } catch { /* fall through to the scan */ }
+
   try {
     const cicdResp = await apiRequest('/api/cicd/getCICDServices', 'POST', { projectID: String(pid) });
     const cicdServices = Array.isArray(cicdResp) ? cicdResp : (cicdResp.data?.services || []);

package/src/registry.js

@@ -654,7 +654,7 @@ export const registry = {
       'pipeline-resync': { summary: 'Re-sync a pipeline', usage: 'pipeline-resync <vmID> <pipelineID>', async run({ args }) { await (await load.cicd()).resyncPipeline(requireArg(args._[2], 'cicd pipeline-resync <vmID> <pipelineID>'), positional(args, 3, 'pipeline'), args.project); } },
       'pipeline-logs': { summary: 'Tail the running pipeline logs', usage: 'pipeline-logs <vmID> <pipelineID>', async run({ args }) { await (await load.cicd()).getPipelineLogs(requireArg(args._[2], 'cicd pipeline-logs <vmID> <pipelineID>'), positional(args, 3, 'pipeline'), args.project); } },
       'pipeline-history': { summary: 'Show the build history', usage: 'pipeline-history <vmID> <pipelineID>', async run({ args, json }) { await (await load.cicd()).getPipelineHistory(requireArg(args._[2], 'cicd pipeline-history <vmID> <pipelineID>'), positional(args, 3, 'pipeline'), args.project, json); } },
-      'pipeline-log': { summary: 'Print one build log file', usage: 'pipeline-log <vmID> --pipeline <id> --file <path>', async run({ args }) { await (await load.cicd()).viewPipelineLog(requireArg(args._[2], 'cicd pipeline-log <vmID> --pipeline <id> --file <path>'), args.pipeline, args.file, args.project); } },
+      'pipeline-log': { summary: 'Open a build log (latest, or --file <logID> from pipeline-history)', usage: 'pipeline-log <vmID> --pipeline <id> [--file <logID>]', async run({ args, json }) { await (await load.cicd()).viewPipelineLog(requireArg(args._[2], 'cicd pipeline-log <vmID> --pipeline <id> [--file <logID>]'), args.pipeline, args.file, args.project, json); } },
       domains: { summary: 'List pipeline domains', usage: 'domains <vmID> <pipelineID>', async run({ args, json }) { await (await load.cicd()).listPipelineDomains(requireArg(args._[2], 'cicd domains <vmID> <pipelineID>'), positional(args, 3, 'pipeline'), args.project, json); } },
       'domain-add': { summary: 'Add a pipeline domain', usage: 'domain-add <vmID> --pipeline <id> --domain <d>', async run({ args }) { await (await load.cicd()).addPipelineDomain(requireArg(args._[2], 'cicd domain-add <vmID> --pipeline <id> --domain <d>'), args.pipeline, args.domain || args._[3], args.project); } },
       'domain-remove': { summary: 'Remove a pipeline domain', usage: 'domain-remove <vmID> --pipeline <id> --domain <d>', async run({ args }) { await (await load.cicd()).removePipelineDomain(requireArg(args._[2], 'cicd domain-remove <vmID> --pipeline <id> --domain <d>'), args.pipeline, args.domain || args._[3], args.project); } },

package/src/templates/elestio-config.js

@@ -179,10 +179,22 @@ export function repoFileMounts(compose) {
   if (typeof compose !== 'string') return [];
 
   const mounts = new Set();
-  for (const match of compose.matchAll(/^\s*-\s+(\.{1,2}\/[^\s:]+):[^\s]+/gm)) {
-    const source = match[1];
+  const add = (source) => {
     const lastSegment = source.slice(source.lastIndexOf('/') + 1);
     if (/\.[A-Za-z0-9]{1,10}$/.test(lastSegment)) mounts.add(source);
+  };
+
+  // Short syntax, quoted or not: - ./file:/in/container[:ro]
+  // Many templates quote their mounts (Chromadb among them), and the
+  // unquoted-only pattern let those through silently.
+  for (const match of compose.matchAll(/^\s*-\s+["']?(\.{1,2}\/[^\s:"']+)["']?\s*:/gm)) {
+    add(match[1]);
   }
+
+  // Long syntax: - type: bind / source: ./file / target: /in/container
+  for (const match of compose.matchAll(/^\s*source:\s*["']?(\.{1,2}\/[^\s"']+)["']?\s*$/gm)) {
+    add(match[1]);
+  }
+
   return [...mounts];
 }