okengine 0.11.2 → 0.13.0

package/src/docker/docker.test.ts

@@ -14,6 +14,7 @@ import {
   DOCKER_STACK,
   assertNoCredentialsInYaml,
   buildCaddyfile,
+  buildNginxConf,
   buildPgDogToml,
   buildPgDogUsersToml,
   builtinRecipes,
@@ -23,8 +24,12 @@ import {
   dragonfly,
   emitDockerfile,
   formatStackEnv,
+  nginx,
   pgdog,
   postgres,
+  postgresAdvisor,
+  POSTGRES_ADVISOR_DOCKERFILE,
+  POSTGRES_ADVISOR_IMAGE,
   recipeFor,
   redis,
   resolveStack,
@@ -259,13 +264,118 @@ describe("image recipes", () => {
     expect(derived.stackEnv.DATABASE_URL).toContain("postgres://");
   });
 
+  test("postgres preloads pg_stat_statements at postmaster start", () => {
+    const spec: ServiceSpec = {
+      role: "store.sql",
+      serviceName: "store-sql",
+      image: "postgres:18-alpine",
+      port: 5432,
+      hostPort: 5432,
+      credentials: fixedCreds["store.sql"],
+    };
+    const applied = postgres.apply(spec);
+    expect(applied.command).toEqual([
+      "postgres",
+      "-c",
+      "shared_preload_libraries=pg_stat_statements",
+    ]);
+    const derived = deriveInfrastructure({
+      images: { "store.sql": spec.image },
+      credentials: { "store.sql": fixedCreds["store.sql"] },
+    });
+    const yml = derived.files.find((f) => f.path === DOCKER_COMPOSE)?.content ?? "";
+    expect(yml).toContain("shared_preload_libraries=pg_stat_statements");
+  });
+
+  test("timescale preload keeps timescaledb first so hypertables still load", () => {
+    const spec: ServiceSpec = {
+      role: "store.sql",
+      serviceName: "store-sql",
+      image: "timescale/timescaledb:latest-pg17",
+      port: 5432,
+      hostPort: 5432,
+      credentials: fixedCreds["store.sql"],
+    };
+    const applied = timescale.apply(spec);
+    expect(applied.command).toEqual([
+      "postgres",
+      "-c",
+      "shared_preload_libraries=timescaledb,pg_stat_statements",
+    ]);
+    const joined = Array.isArray(applied.command)
+      ? applied.command.join(" ")
+      : String(applied.command);
+    expect(joined.indexOf("timescaledb")).toBeGreaterThanOrEqual(0);
+    expect(joined.indexOf("timescaledb")).toBeLessThan(joined.indexOf("pg_stat_statements"));
+    const derived = deriveInfrastructure({
+      images: { "store.sql": spec.image },
+      credentials: { "store.sql": fixedCreds["store.sql"] },
+    });
+    const yml = derived.files.find((f) => f.path === DOCKER_COMPOSE)?.content ?? "";
+    expect(yml).toContain("timescaledb,pg_stat_statements");
+    expect(yml).not.toMatch(/shared_preload_libraries=pg_stat_statements[^-]/);
+  });
+
+  test("supabase and yugabyte recipes do not overwrite vendor preload commands", () => {
+    const supabaseSpec: ServiceSpec = {
+      role: "store.sql",
+      serviceName: "store-sql",
+      image: "supabase/postgres:15.8.1.049",
+      port: 5432,
+      hostPort: 5432,
+      credentials: fixedCreds["store.sql"],
+    };
+    expect(recipeFor(supabaseSpec.image).apply(supabaseSpec).command).toBeUndefined();
+    const ybSpec: ServiceSpec = {
+      role: "store.sql",
+      serviceName: "store-sql",
+      image: "yugabytedb/yugabyte:2024.2.2.1-b6",
+      port: 5433,
+      hostPort: 5433,
+      credentials: fixedCreds["store.sql"],
+    };
+    expect(recipeFor(ybSpec.image).apply(ybSpec).command).toEqual([
+      "bin/yugabyted",
+      "start",
+      "--base_dir=/home/yugabyte/yb_data",
+      "--background=false",
+    ]);
+  });
+
+  test("oke-postgres-advisor matches ahead of generic postgres and emits a local build", () => {
+    expect(postgres.match(POSTGRES_ADVISOR_IMAGE)).toBe(true);
+    expect(recipeFor(POSTGRES_ADVISOR_IMAGE).id).toBe("postgres-advisor");
+    expect(postgresAdvisor.match("postgres:18-alpine")).toBe(false);
+    const derived = deriveInfrastructure({
+      images: { "store.sql": POSTGRES_ADVISOR_IMAGE },
+      credentials: { "store.sql": fixedCreds["store.sql"] },
+    });
+    const yml = derived.files.find((f) => f.path === DOCKER_COMPOSE)?.content ?? "";
+    expect(yml).toContain('dockerfile: "Dockerfile.postgres-advisor"');
+    expect(yml).toContain("shared_preload_libraries=pg_stat_statements");
+    const dockerfile = derived.files.find((f) => f.path === POSTGRES_ADVISOR_DOCKERFILE);
+    expect(dockerfile?.content).toContain("FROM postgres:18-alpine");
+    expect(dockerfile?.content).toContain("HypoPG/hypopg");
+    expect(dockerfile?.content).toContain("supabase/index_advisor");
+    expect(dockerfile?.content).toContain("$DOCKER_PG_LLVM_DEPS");
+    expect(dockerfile?.content).not.toContain("postgresql-dev");
+    const alpine = deriveInfrastructure({
+      images: { "store.sql": "postgres:18-alpine" },
+      credentials: { "store.sql": fixedCreds["store.sql"] },
+    });
+    expect(alpine.files.some((f) => f.path === POSTGRES_ADVISOR_DOCKERFILE)).toBe(false);
+    expect(alpine.files.find((f) => f.path === DOCKER_COMPOSE)?.content ?? "").not.toContain(
+      "Dockerfile.postgres-advisor",
+    );
+  });
+
   test("pgdog matches the official image and waits on store-sql", () => {
-    expect(recipeFor("ghcr.io/pgdogdev/pgdog:v0.1.51").id).toBe("pgdog");
+    expect(recipeFor("ghcr.io/pgdogdev/pgdog:v0.1.53").id).toBe("pgdog");
     expect(pgdog.match("ghcr.io/pgdogdev/pgdog:main")).toBe(true);
     const applied = pgdog.apply({
       role: "pgdog",
       serviceName: "pgdog",
-      image: "ghcr.io/pgdogdev/pgdog:v0.1.51",
+      image: "ghcr.io/pgdogdev/pgdog:v0.1.53",
       port: 6432,
       hostPort: 6432,
       credentials: fixedCreds["store.sql"],
@@ -300,11 +410,11 @@ describe("image recipes", () => {
   });
 
   test("meilisearch matches the official image and emits a http URL", () => {
-    expect(recipeFor("getmeili/meilisearch:v1.37").id).toBe("meilisearch");
+    expect(recipeFor("getmeili/meilisearch:v1.53").id).toBe("meilisearch");
     const spec: ServiceSpec = {
       role: "store.index",
       serviceName: "store-index",
-      image: "getmeili/meilisearch:v1.37",
+      image: "getmeili/meilisearch:v1.53",
       port: 7700,
       hostPort: 7700,
       credentials: { user: "oke", password: "meili-master-key", database: "oke" },
@@ -532,13 +642,35 @@ describe("image recipes", () => {
     );
   });
 
+  test("nginx matches official images and emits nginx.conf reverse_proxy", () => {
+    expect(recipeFor("nginx:1.31-alpine").id).toBe("nginx");
+    expect(nginx.match("library/nginx:1.27")).toBe(true);
+    const spec: ServiceSpec = {
+      role: "proxy",
+      serviceName: "proxy",
+      image: "nginx:1.31-alpine",
+      port: 80,
+      hostPort: 80,
+      credentials: { user: "oke", password: "unused-proxy", database: "oke" },
+    };
+    const applied = nginx.apply(spec);
+    expect(applied.extraPorts).toBeUndefined();
+    expect(applied.volumes).toContain("./nginx.conf:/etc/nginx/nginx.conf:ro");
+    const file = buildNginxConf();
+    expect(file).toContain("server app:6530");
+    expect(file).toContain("proxy_pass http://oke_app");
+    expect(nginx.url(spec, { host: "app.example.com", port: 80, ...spec.credentials })).toBe(
+      "http://app.example.com",
+    );
+  });
+
   test("traefik matches official images, labels app, and uses socket-proxy", () => {
-    expect(recipeFor("traefik:v3.3").id).toBe("traefik");
+    expect(recipeFor("traefik:v3.7").id).toBe("traefik");
     expect(traefik.match("traefik:v3.1")).toBe(true);
     const applied = traefik.apply({
       role: "proxy",
       serviceName: "proxy",
-      image: "traefik:v3.3",
+      image: "traefik:v3.7",
       port: 80,
       hostPort: 80,
       credentials: { user: "oke", password: "unused-proxy", database: "oke" },
@@ -559,6 +691,14 @@ describe("image recipes", () => {
     expect(labels["traefik.http.routers.app.rule"]).toContain("OKE_PROXY_HOST");
   });
 
+  test("proxy recipes do not filter HTTP methods", () => {
+    expect(buildCaddyfile()).toContain("reverse_proxy app:6530");
+    expect(buildCaddyfile()).not.toMatch(/method\s|allowed_methods|@method/i);
+    expect(buildNginxConf()).not.toMatch(/limit_except/i);
+    const labels = traefikAppLabels();
+    expect(JSON.stringify(labels)).not.toMatch(/Method\(|methods/i);
+  });
+
   test("recipe.url builds a connection string without env-var names in the kernel", () => {
     const spec: ServiceSpec = {
       role: "store.sql",
@@ -633,7 +773,7 @@ describe("deriveInfrastructure", () => {
     expect(yml).toContain("valkey/valkey:8-alpine");
     expect(yml).toContain("POSTGRES_PASSWORD");
     expect(yml).toContain("${OKE_STORE_SQL_PASSWORD}");
-    expect(yml).toContain(".env.docker");
+    expect(yml).toContain(".env.local");
     expect(yml).not.toContain(fixedCreds["store.sql"].password);
     expect(yml).toContain('context: ".."');
     expect(yml).toContain("app:");
@@ -651,8 +791,8 @@ describe("deriveInfrastructure", () => {
     const result = deriveInfrastructure({
       images: {
         ai: "ghcr.io/ggml-org/llama.cpp:server",
-        "channel.email": "axllent/mailpit:v1.22.3",
-        pgdog: "ghcr.io/pgdogdev/pgdog:v0.1.51",
+        "channel.email": "axllent/mailpit:v1.30.7",
+        pgdog: "ghcr.io/pgdogdev/pgdog:v0.1.53",
         "store.sql": "postgres:16",
       },
       credentials: { "store.sql": fixedCreds["store.sql"] },
@@ -687,6 +827,25 @@ describe("deriveInfrastructure", () => {
     expect(base).not.toContain("build:");
   });
 
+  test("includeApp false + Traefik omits the label-only app overlay", () => {
+    const result = deriveInfrastructure({
+      images: {
+        "store.sql": "postgres:16",
+        proxy: "traefik:v3.7",
+      },
+      credentials: { "store.sql": fixedCreds["store.sql"] },
+      includeApp: false,
+      app: "dev",
+    });
+    const yml = result.files.find((f) => f.path === DOCKER_COMPOSE)!.content;
+    const services = serviceNamesFromComposeYaml(yml);
+    expect(services.has("app")).toBe(false);
+    expect(services.has("proxy")).toBe(true);
+    expect(services.has(SOCKET_PROXY_SERVICE)).toBe(true);
+    expect(yml).toContain("traefik:v3.7");
+    expect(yml).not.toContain("build:");
+  });
+
   test("prod folds readiness + budgeted deploy into docker-compose.yml", () => {
     const result = deriveInfrastructure({
       images: { "store.sql": "postgres:16" },
@@ -755,7 +914,7 @@ describe("deriveInfrastructure", () => {
     const result = deriveInfrastructure({
       images: {
         "store.sql": "postgres:18-alpine",
-        pgdog: "ghcr.io/pgdogdev/pgdog:v0.1.51",
+        pgdog: "ghcr.io/pgdogdev/pgdog:v0.1.53",
       },
       credentials: { "store.sql": fixedCreds["store.sql"] },
       prod: true,
@@ -770,7 +929,7 @@ describe("deriveInfrastructure", () => {
     expect(result.stackEnv.OKE_STORE_SQL_URL).toContain(":5432/");
 
     const pgdogYml = result.files.find((f) => f.path === DOCKER_COMPOSE)!.content;
-    expect(pgdogYml).toContain("ghcr.io/pgdogdev/pgdog:v0.1.51");
+    expect(pgdogYml).toContain("ghcr.io/pgdogdev/pgdog:v0.1.53");
     expect(pgdogYml).toContain("store-sql");
     expect(pgdogYml).toContain("service_healthy");
     expect(pgdogYml).not.toContain(fixedCreds["store.sql"].password);
@@ -812,25 +971,39 @@ describe("deriveInfrastructure", () => {
       writeStackEnv: true,
     });
     expect(written.some((p) => p.endsWith(COMPOSE_OVERRIDE))).toBe(false);
-    expect(await Bun.file(join(dockerDir, ".env.docker")).exists()).toBe(true);
+    expect(await Bun.file(join(root, ".env.local")).exists()).toBe(true);
     expect(await Bun.file(join(dockerDir, DOCKER_COMPOSE)).exists()).toBe(true);
-    const envText = await Bun.file(join(dockerDir, ".env.docker")).text();
+    const envText = await Bun.file(join(root, ".env.local")).text();
     expect(envText).toContain("DATABASE_URL=");
-    expect(envText).toContain("# docker/.env.docker — generated by");
+    expect(envText).toContain("# .env.local — stack keys written by");
     expect(envText).toContain("# ── store.sql — Postgres");
     expect(formatStackEnv(result.stackEnv)).toContain("OKE_STORE_SQL_PASSWORD=");
   });
 
+  test("writeDerivedFiles merges stack keys into existing .env.local", async () => {
+    const root = await mkdtemp(join(tmpdir(), "oke-docker-"));
+    const dockerDir = join(root, "docker");
+    await Bun.write(join(root, ".env.local"), "GITHUB_TOKEN=keep-me\n");
+    const result = deriveInfrastructure({
+      images: { "store.sql": "postgres:16" },
+      credentials: { "store.sql": fixedCreds["store.sql"] },
+    });
+    await writeDerivedFiles(result, dockerDir, { writeStackEnv: true });
+    const envText = await Bun.file(join(root, ".env.local")).text();
+    expect(envText).toContain("GITHUB_TOKEN=keep-me");
+    expect(envText).toContain("DATABASE_URL=");
+  });
+
   test("store.index meilisearch emits its own URL + master key env", () => {
     const result = deriveInfrastructure({
-      images: { "store.index": "getmeili/meilisearch:v1.37" },
+      images: { "store.index": "getmeili/meilisearch:v1.53" },
       credentials: {
         "store.index": { user: "oke", password: "meili-master-key", database: "oke" },
       },
       app: "skyport",
     });
     const yml = result.files.find((f) => f.path === DOCKER_COMPOSE)!.content;
-    expect(yml).toContain("getmeili/meilisearch:v1.37");
+    expect(yml).toContain("getmeili/meilisearch:v1.53");
     expect(yml).toContain("${OKE_STORE_INDEX_KEY}");
     expect(yml).toContain("meili_data");
     expect(yml).not.toContain("meili-master-key");
@@ -899,8 +1072,8 @@ describe("deriveInfrastructure", () => {
       images: {
         "store.sql": "postgres:18-alpine",
         "store.kv": "redis:8-alpine",
-        "store.files": "rustfs/rustfs:1.0.0-beta.11",
-        "channel.email": "axllent/mailpit:v1.22.3",
+        "store.files": "rustfs/rustfs:1.0.0-rc.2",
+        "channel.email": "axllent/mailpit:v1.30.7",
       },
       credentials: {
         ...fixedCreds,
@@ -943,8 +1116,8 @@ describe("deriveInfrastructure", () => {
     const n = Number.parseInt(id.slice(0, 4), 16) % 1000;
     const result = deriveInfrastructure({
       images: {
-        "channel.email": "axllent/mailpit:v1.22.3",
-        "store.files": "rustfs/rustfs:1.0.0-beta.11",
+        "channel.email": "axllent/mailpit:v1.30.7",
+        "store.files": "rustfs/rustfs:1.0.0-rc.2",
       },
       instanceId: id,
       credentials: {
@@ -982,8 +1155,8 @@ describe("deriveInfrastructure", () => {
     const n = Number.parseInt(id.slice(0, 4), 16) % 1000;
     const rows = resolveStack({
       images: {
-        "channel.email": "axllent/mailpit:v1.22.3",
-        "store.files": "rustfs/rustfs:1.0.0-beta.11",
+        "channel.email": "axllent/mailpit:v1.30.7",
+        "store.files": "rustfs/rustfs:1.0.0-rc.2",
       },
       instanceId: id,
       credentials: {
@@ -1032,7 +1205,7 @@ describe("deriveInfrastructure", () => {
     const caddyfile = result.files.find((f) => f.path === "Caddyfile")!.content;
     expect(caddyfile).toContain("reverse_proxy app:6530");
     expect(result.stackEnv.OKE_PROXY_URL).toBe("https://127.0.0.1");
-    expect(formatStackEnv(result.stackEnv)).toContain("# ── proxy — TLS terminator");
+    expect(formatStackEnv(result.stackEnv)).toContain("# ── proxy — edge reverse proxy");
     expect(formatStackEnv(result.stackEnv)).toContain("# OKE_PROXY_HOST=localhost");
   });
 
@@ -1040,7 +1213,7 @@ describe("deriveInfrastructure", () => {
     const result = deriveInfrastructure({
       images: {
         "store.sql": "postgres:16",
-        proxy: "traefik:v3.3",
+        proxy: "traefik:v3.7",
       },
       credentials: { "store.sql": fixedCreds["store.sql"] },
       app: "skyport",
@@ -1048,7 +1221,7 @@ describe("deriveInfrastructure", () => {
     });
     const yml = result.files.find((f) => f.path === DOCKER_COMPOSE)!.content;
     expect(yml).not.toContain("6530:6530");
-    expect(yml).toContain("traefik:v3.3");
+    expect(yml).toContain("traefik:v3.7");
     expect(yml).toContain(SOCKET_PROXY_IMAGE);
     expect(yml).toContain(SOCKET_PROXY_SERVICE);
     expect(yml).toContain("/var/run/docker.sock:/var/run/docker.sock:ro");
@@ -1058,7 +1231,7 @@ describe("deriveInfrastructure", () => {
     expect(yml).toContain("loadbalancer.server.port");
     // Raw socket must not be on the Traefik service itself.
     const traefikBlock = yml.split("socket-proxy:")[0]!;
-    expect(traefikBlock).toContain("traefik:v3.3");
+    expect(traefikBlock).toContain("traefik:v3.7");
     expect(traefikBlock).not.toContain("docker.sock");
 
     expect(result.files.some((f) => f.path === "Caddyfile")).toBe(false);
@@ -1066,6 +1239,25 @@ describe("deriveInfrastructure", () => {
     expect(result.composeFiles).toEqual([DOCKER_COMPOSE, DOCKER_COMPOSE_OVERRIDE]);
   });
 
+  test("opt-in nginx proxy emits nginx.conf and unpublishes app ports", () => {
+    const result = deriveInfrastructure({
+      images: {
+        "store.sql": "postgres:16",
+        proxy: "nginx:1.31-alpine",
+      },
+      credentials: { "store.sql": fixedCreds["store.sql"] },
+      app: "skyport",
+    });
+    const yml = result.files.find((f) => f.path === DOCKER_COMPOSE)!.content;
+    expect(yml).not.toContain("6530:6530");
+    expect(yml).toContain("nginx:1.31-alpine");
+    expect(yml).toContain("./nginx.conf:/etc/nginx/nginx.conf:ro");
+    const conf = result.files.find((f) => f.path === "nginx.conf")!.content;
+    expect(conf).toContain("proxy_pass http://oke_app");
+    expect(conf).toContain("server app:6530");
+    expect(result.stackEnv.OKE_PROXY_URL).toBe("http://127.0.0.1");
+  });
+
   test("without proxy role, app still publishes 6530 (default unchanged)", () => {
     const result = deriveInfrastructure({
       images: { "store.sql": "postgres:16" },
@@ -1083,7 +1275,7 @@ describe("deriveInfrastructure", () => {
       images: {
         "store.sql": "postgres:16",
         "store.kv": "redis:8-alpine",
-        proxy: "traefik:v3.3",
+        proxy: "traefik:v3.7",
       },
       credentials: {
         "store.sql": fixedCreds["store.sql"],

package/src/docker/helpers.ts

@@ -32,6 +32,26 @@ export const postgresHealth = {
   retries: 10,
 } as const;
 
+/**
+ * Postmaster flags so `pg_stat_statements` can load (shared memory).
+ * Official `postgres` / `pgvector` images — do not use on Supabase/Yugabyte.
+ */
+export const POSTGRES_STAT_STATEMENTS_COMMAND = [
+  "postgres",
+  "-c",
+  "shared_preload_libraries=pg_stat_statements",
+] as const;
+
+/**
+ * Timescale images already require `timescaledb` in preload.
+ * Keep it first — dropping it breaks `CREATE EXTENSION timescaledb` / hypertables.
+ */
+export const TIMESCALE_STAT_STATEMENTS_COMMAND = [
+  "postgres",
+  "-c",
+  "shared_preload_libraries=timescaledb,pg_stat_statements",
+] as const;
+
 /** CockroachDB single-node env (`COCKROACH_*`) — used only when the data dir is empty. */
 export function cockroachEnv(s: ServiceSpec): Record<string, string> {
   return {
@@ -89,6 +109,34 @@ export function envPrefix(role: string): string {
   return `OKE_${role.replaceAll(".", "_").toUpperCase()}`;
 }
 
+/**
+ * `redis-server` / `valkey-server` command — role-prefixed password.
+ *
+ * @param spec - Service
+ * @param binary - Server binary
+ */
+export function kvServerCommand(
+  spec: ServiceSpec,
+  binary: "redis-server" | "valkey-server",
+): string {
+  const p = envPrefix(spec.role);
+  const pass = `$$${p}_PASSWORD`;
+  const memory = `--maxmemory "$$\{${p}_MAXMEMORY:-0}" --maxmemory-policy "$$\{${p}_MAXMEMORY_POLICY:-noeviction}"`;
+  return `exec ${binary} --requirepass "${pass}" ${memory}`;
+}
+
+/**
+ * Dragonfly command — Redis-wire, role-prefixed password.
+ *
+ * @param spec - Service
+ */
+export function dragonflyServerCommand(spec: ServiceSpec): string {
+  const p = envPrefix(spec.role);
+  const pass = `$$${p}_PASSWORD`;
+  const memory = `--maxmemory "$$\{${p}_MAXMEMORY:-0}"`;
+  return `exec dragonfly --requirepass "${pass}" ${memory}`;
+}
+
 /**
  * Default host port for well-known roles.
  *

package/src/docker/images-config.test.ts

@@ -15,6 +15,7 @@ import { describe, expect, test } from "bun:test";
 import { flattenImagesConfig, type ImagesConfig } from "../config/index.ts";
 import { deriveInfrastructure } from "./derive.ts";
 import { builtinRecipes, recipeFor } from "./recipes/index.ts";
+import { POSTGRES_ADVISOR_IMAGE } from "./recipes/postgres-advisor.ts";
 import type { ServiceCredentials } from "./types.ts";
 
 describe("ImagesConfig nesting — recipe coverage", () => {
@@ -46,6 +47,11 @@ describe("ImagesConfig nesting — recipe coverage", () => {
         role: "store.sql",
         image: "supabase/postgres:15.1.0.117",
       },
+      {
+        images: { store: { sql: POSTGRES_ADVISOR_IMAGE } },
+        role: "store.sql",
+        image: POSTGRES_ADVISOR_IMAGE,
+      },
       // store.kv — redis-family
       { images: { store: { kv: "redis:8-alpine" } }, role: "store.kv", image: "redis:8-alpine" },
       {
@@ -60,41 +66,42 @@ describe("ImagesConfig nesting — recipe coverage", () => {
       },
       // store.files / store.index
       {
-        images: { store: { files: "rustfs/rustfs:1.0.0-beta.11" } },
+        images: { store: { files: "rustfs/rustfs:1.0.0-rc.2" } },
         role: "store.files",
-        image: "rustfs/rustfs:1.0.0-beta.11",
+        image: "rustfs/rustfs:1.0.0-rc.2",
       },
       {
-        images: { store: { index: "getmeili/meilisearch:v1.37" } },
+        images: { store: { index: "getmeili/meilisearch:v1.53" } },
         role: "store.index",
-        image: "getmeili/meilisearch:v1.37",
+        image: "getmeili/meilisearch:v1.53",
       },
       // channel.email
       {
-        images: { channel: { email: "axllent/mailpit:v1.22.3" } },
+        images: { channel: { email: "axllent/mailpit:v1.30.7" } },
         role: "channel.email",
-        image: "axllent/mailpit:v1.22.3",
+        image: "axllent/mailpit:v1.30.7",
       },
       // flat roles — no driver counterpart in DriversConfig
       {
-        images: { ai: "ghcr.io/ggml-org/llama.cpp:server-b10290" },
+        images: { ai: "ghcr.io/ggml-org/llama.cpp:server-b10450" },
         role: "ai",
-        image: "ghcr.io/ggml-org/llama.cpp:server-b10290",
+        image: "ghcr.io/ggml-org/llama.cpp:server-b10450",
       },
-      { images: { ai: "vllm/vllm-openai:v0.26.0" }, role: "ai", image: "vllm/vllm-openai:v0.26.0" },
+      { images: { ai: "vllm/vllm-openai:v0.27.1" }, role: "ai", image: "vllm/vllm-openai:v0.27.1" },
       {
-        images: { ai: "lmsysorg/sglang:v0.5.16-runtime" },
+        images: { ai: "lmsysorg/sglang:v0.5.17-runtime" },
         role: "ai",
-        image: "lmsysorg/sglang:v0.5.16-runtime",
+        image: "lmsysorg/sglang:v0.5.17-runtime",
       },
-      { images: { ai: "ollama/ollama:0.32.6" }, role: "ai", image: "ollama/ollama:0.32.6" },
+      { images: { ai: "ollama/ollama:0.32.13" }, role: "ai", image: "ollama/ollama:0.32.13" },
       {
-        images: { pgdog: "ghcr.io/pgdogdev/pgdog:v0.1.51" },
+        images: { pgdog: "ghcr.io/pgdogdev/pgdog:v0.1.53" },
         role: "pgdog",
-        image: "ghcr.io/pgdogdev/pgdog:v0.1.51",
+        image: "ghcr.io/pgdogdev/pgdog:v0.1.53",
       },
       { images: { proxy: "caddy:2-alpine" }, role: "proxy", image: "caddy:2-alpine" },
       { images: { proxy: "traefik:v3.1" }, role: "proxy", image: "traefik:v3.1" },
+      { images: { proxy: "nginx:1.31-alpine" }, role: "proxy", image: "nginx:1.31-alpine" },
     ];
 
     const matchedIds = new Set<string>();
@@ -113,22 +120,22 @@ describe("ImagesConfig nesting — compose output parity", () => {
   test("nested config derives byte-identical output to its flat-shape equivalent", () => {
     const flatImages: Readonly<Record<string, string>> = {
       "store.sql": "postgres:18-alpine",
-      pgdog: "ghcr.io/pgdogdev/pgdog:v0.1.51",
+      pgdog: "ghcr.io/pgdogdev/pgdog:v0.1.53",
       "store.kv": "redis:8-alpine",
-      "store.files": "rustfs/rustfs:1.0.0-beta.11",
-      "store.index": "getmeili/meilisearch:v1.37",
-      "channel.email": "axllent/mailpit:v1.22.3",
+      "store.files": "rustfs/rustfs:1.0.0-rc.2",
+      "store.index": "getmeili/meilisearch:v1.53",
+      "channel.email": "axllent/mailpit:v1.30.7",
     };
 
     const nestedImages: ImagesConfig = {
       store: {
         sql: "postgres:18-alpine",
         kv: "redis:8-alpine",
-        files: "rustfs/rustfs:1.0.0-beta.11",
-        index: "getmeili/meilisearch:v1.37",
+        files: "rustfs/rustfs:1.0.0-rc.2",
+        index: "getmeili/meilisearch:v1.53",
       },
-      channel: { email: "axllent/mailpit:v1.22.3" },
-      pgdog: "ghcr.io/pgdogdev/pgdog:v0.1.51",
+      channel: { email: "axllent/mailpit:v1.30.7" },
+      pgdog: "ghcr.io/pgdogdev/pgdog:v0.1.53",
     };
 
     // Same nested→flat set, written in a different field order — proves the

package/src/docker/index.ts

@@ -111,11 +111,18 @@ export {
   LLAMA_CPP_MIN_SAFE_BUILD,
   mailpit,
   meilisearch,
+  nginx,
   ollama,
   OLLAMA_IMAGE,
   OLLAMA_MIN_SAFE_VERSION,
   pgdog,
   postgres,
+  postgresAdvisor,
+  emitPostgresAdvisorDockerfile,
+  HYPOPG_GIT_TAG,
+  INDEX_ADVISOR_GIT_TAG,
+  POSTGRES_ADVISOR_DOCKERFILE,
+  POSTGRES_ADVISOR_IMAGE,
   recipeFor,
   redis,
   rustfs,
@@ -129,6 +136,7 @@ export {
   yugabyte,
 } from "./recipes/index.ts";
 export { CADDY_APP_SERVICE, buildCaddyfile } from "./recipes/caddy.ts";
+export { NGINX_APP_SERVICE, buildNginxConf } from "./recipes/nginx.ts";
 export {
   PGDOG_BACKEND_SERVICE,
   PGDOG_CONFIG_DIR,