okengine 0.8.0 → 0.9.0

package/src/docker/docker.test.ts

@@ -7,21 +7,50 @@ import { mkdtemp } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import {
+  COMPOSE_ALL,
   COMPOSE_OVERRIDE,
   assertNoCredentialsInYaml,
+  buildCaddyfile,
+  buildPgDogToml,
+  buildPgDogUsersToml,
   builtinRecipes,
+  caddy,
   deriveInfrastructure,
+  dragonfly,
   emitDockerfile,
   formatStackEnv,
+  pgdog,
   postgres,
   recipeFor,
   redis,
   resolveStack,
+  SOCKET_PROXY_IMAGE,
+  SOCKET_PROXY_SERVICE,
+  traefik,
+  traefikAppLabels,
+  valkey,
   writeDerivedFiles,
   type ImageRecipe,
   type ServiceSpec,
 } from "./index.ts";
 
+/** Service keys under a top-level `services:` mapping (2-space indent). */
+function serviceNamesFromComposeYaml(yml: string): Set<string> {
+  const names = new Set<string>();
+  let inServices = false;
+  for (const line of yml.split("\n")) {
+    if (line === "services:") {
+      inServices = true;
+      continue;
+    }
+    if (!inServices) continue;
+    if (/^[A-Za-z]/.test(line)) break;
+    const m = /^  ([A-Za-z0-9_-]+):\s*$/.exec(line);
+    if (m?.[1]) names.add(m[1]);
+  }
+  return names;
+}
+
 const fixedCreds = {
   "store.sql": {
     user: "oke",
@@ -38,9 +67,129 @@ const fixedCreds = {
 describe("image recipes", () => {
   test("postgres and redis match vendor images by protocol", () => {
     expect(recipeFor("pgvector/pgvector:pg17").id).toBe("postgres");
-    expect(recipeFor("valkey/valkey:8-alpine").id).toBe("redis");
     expect(postgres.match("postgres:16")).toBe(true);
     expect(redis.match("redis:7")).toBe(true);
+    expect(redis.match("redis:8-alpine")).toBe(true);
+    expect(redis.match("valkey/valkey:8-alpine")).toBe(false);
+  });
+
+  test("valkey matches the official image, keeps redis:// URL, uses valkey-server", () => {
+    const image = "valkey/valkey:8-alpine";
+    expect(recipeFor(image).id).toBe("valkey");
+    expect(valkey.match(image)).toBe(true);
+    expect(redis.match(image)).toBe(false);
+    const spec: ServiceSpec = {
+      role: "store.kv",
+      serviceName: "store-kv",
+      image,
+      port: 6379,
+      hostPort: 6379,
+      credentials: fixedCreds["store.kv"],
+    };
+    const applied = recipeFor(spec.image).apply(spec);
+    expect(String(applied.command)).toContain("exec valkey-server");
+    expect(String(applied.command)).toContain("$$OKE_STORE_KV_PASSWORD");
+    expect(applied.healthcheck?.test[1]).toBe("valkey-cli");
+    const url = recipeFor(spec.image).url(spec, {
+      host: "127.0.0.1",
+      port: 6379,
+      user: "oke",
+      password: fixedCreds["store.kv"].password,
+      database: "oke",
+    });
+    expect(url).toBe(
+      `redis://:${encodeURIComponent(fixedCreds["store.kv"].password)}@127.0.0.1:6379`,
+    );
+
+    const derived = deriveInfrastructure({
+      images: { "store.kv": image },
+      credentials: { "store.kv": fixedCreds["store.kv"] },
+    });
+    const kvYml = derived.files.find((f) => f.path === "compose.store.kv.yml")?.content ?? "";
+    expect(kvYml).toContain(image);
+    expect(kvYml).toContain("valkey-server");
+    expect(derived.stackEnv.REDIS_URL).toContain("redis://");
+  });
+
+  test("dragonfly matches the official image, keeps redis:// URL, distinct from redis recipe", () => {
+    const image = "docker.dragonflydb.io/dragonflydb/dragonfly";
+    expect(recipeFor(image).id).toBe("dragonfly");
+    expect(dragonfly.match(image)).toBe(true);
+    expect(redis.match(image)).toBe(false);
+    const spec: ServiceSpec = {
+      role: "store.kv",
+      serviceName: "store-kv",
+      image,
+      port: 6379,
+      hostPort: 6379,
+      credentials: fixedCreds["store.kv"],
+    };
+    const applied = recipeFor(spec.image).apply(spec);
+    expect(String(applied.command)).toContain("exec dragonfly");
+    expect(String(applied.command)).toContain("$$OKE_STORE_KV_PASSWORD");
+    expect(applied.ulimits?.memlock).toBe(-1);
+    expect(applied.environment?.HEALTHCHECK_PORT).toBe("6379");
+    expect(applied.healthcheck?.test).toEqual(["CMD", "/usr/local/bin/healthcheck.sh"]);
+    const url = recipeFor(spec.image).url(spec, {
+      host: "127.0.0.1",
+      port: 6379,
+      user: "oke",
+      password: fixedCreds["store.kv"].password,
+      database: "oke",
+    });
+    expect(url).toBe(
+      `redis://:${encodeURIComponent(fixedCreds["store.kv"].password)}@127.0.0.1:6379`,
+    );
+
+    const derived = deriveInfrastructure({
+      images: { "store.kv": image },
+      credentials: { "store.kv": fixedCreds["store.kv"] },
+    });
+    const kvYml = derived.files.find((f) => f.path === "compose.store.kv.yml")?.content ?? "";
+    expect(kvYml).toContain(image);
+    expect(kvYml).toContain("memlock");
+    expect(kvYml).toContain("HEALTHCHECK_PORT");
+    expect(derived.stackEnv.REDIS_URL).toContain("redis://");
+  });
+
+  test("pgdog matches the official image and waits on store-sql", () => {
+    expect(recipeFor("ghcr.io/pgdogdev/pgdog:v0.1.51").id).toBe("pgdog");
+    expect(pgdog.match("ghcr.io/pgdogdev/pgdog:main")).toBe(true);
+    const applied = pgdog.apply({
+      role: "pgdog",
+      serviceName: "pgdog",
+      image: "ghcr.io/pgdogdev/pgdog:v0.1.51",
+      port: 6432,
+      hostPort: 6432,
+      credentials: fixedCreds["store.sql"],
+    });
+    expect(applied.dependsOn?.["store-sql"]?.condition).toBe("service_healthy");
+    expect(applied.volumes).toContain("./pgdog.toml:/pgdog/pgdog.toml:ro");
+    expect(applied.volumes).toContain("./users.toml:/pgdog/users.toml:ro");
+    expect(applied.healthcheck?.test.join(" ")).toContain("pg_isready");
+  });
+
+  test("pgdog.toml + users.toml match upstream config shape", () => {
+    const pgdogToml = buildPgDogToml({ database: "oke", postgresHost: "store-sql" });
+    expect(pgdogToml).toContain("[general]");
+    expect(pgdogToml).toContain('host = "0.0.0.0"');
+    expect(pgdogToml).toContain("port = 6432");
+    expect(pgdogToml).toContain('pooler_mode = "transaction"');
+    expect(pgdogToml).toContain("[[databases]]");
+    expect(pgdogToml).toContain('name = "oke"');
+    expect(pgdogToml).toContain('host = "store-sql"');
+    expect(pgdogToml).toContain("port = 5432");
+    expect(pgdogToml).toContain('database_name = "oke"');
+
+    const usersToml = buildPgDogUsersToml({
+      user: "oke",
+      password: "s3cret-sql-password-xyz",
+      database: "oke",
+    });
+    expect(usersToml).toContain("[[users]]");
+    expect(usersToml).toContain('name = "oke"');
+    expect(usersToml).toContain('password = "s3cret-sql-password-xyz"');
+    expect(usersToml).toContain('database = "oke"');
   });
 
   test("meilisearch matches the official image and emits a http URL", () => {
@@ -104,6 +253,56 @@ describe("image recipes", () => {
     expect(exportLines.length).toBeLessThanOrEqual(15);
   });
 
+  test("caddy matches official images and emits a Caddyfile reverse_proxy", () => {
+    expect(recipeFor("caddy:2-alpine").id).toBe("caddy");
+    expect(caddy.match("library/caddy:2")).toBe(true);
+    const spec: ServiceSpec = {
+      role: "proxy",
+      serviceName: "proxy",
+      image: "caddy:2-alpine",
+      port: 80,
+      hostPort: 80,
+      credentials: { user: "oke", password: "unused-proxy", database: "oke" },
+    };
+    const applied = caddy.apply(spec);
+    expect(applied.extraPorts).toEqual([{ host: 443, container: 443 }]);
+    expect(applied.volumes).toContain("./Caddyfile:/etc/caddy/Caddyfile:ro");
+    expect(applied.volumes).toContain("proxy-data:/data");
+    const file = buildCaddyfile();
+    expect(file).toContain("{$OKE_PROXY_HOST:localhost}");
+    expect(file).toContain("reverse_proxy app:6530");
+    expect(caddy.url(spec, { host: "app.example.com", port: 443, ...spec.credentials })).toBe(
+      "https://app.example.com",
+    );
+  });
+
+  test("traefik matches official images, labels app, and uses socket-proxy", () => {
+    expect(recipeFor("traefik:v3.3").id).toBe("traefik");
+    expect(traefik.match("traefik:v3.1")).toBe(true);
+    const applied = traefik.apply({
+      role: "proxy",
+      serviceName: "proxy",
+      image: "traefik:v3.3",
+      port: 80,
+      hostPort: 80,
+      credentials: { user: "oke", password: "unused-proxy", database: "oke" },
+    });
+    expect(applied.extraPorts).toEqual([{ host: 443, container: 443 }]);
+    expect(String(applied.command)).toContain("--providers.docker=true");
+    expect(String(applied.command)).toContain(`tcp://${SOCKET_PROXY_SERVICE}:2375`);
+    expect(String(applied.command)).not.toContain("docker.sock");
+    expect(applied.volumes?.some((v) => v.includes("docker.sock"))).toBeFalsy();
+    expect(applied.dependsOn?.[SOCKET_PROXY_SERVICE]?.condition).toBe("service_started");
+    const socket = applied.services?.[SOCKET_PROXY_SERVICE] as Record<string, unknown>;
+    expect(socket.image).toBe(SOCKET_PROXY_IMAGE);
+    expect(socket.volumes).toContain("/var/run/docker.sock:/var/run/docker.sock:ro");
+    const labels = (applied.services?.app as { labels: Record<string, string> }).labels;
+    expect(labels).toEqual(traefikAppLabels());
+    expect(labels["traefik.enable"]).toBe("true");
+    expect(labels["traefik.http.services.app.loadbalancer.server.port"]).toBe("6530");
+    expect(labels["traefik.http.routers.app.rule"]).toContain("OKE_PROXY_HOST");
+  });
+
   test("recipe.url builds a connection string without env-var names in the kernel", () => {
     const spec: ServiceSpec = {
       role: "store.sql",
@@ -168,6 +367,7 @@ describe("deriveInfrastructure", () => {
     expect(paths).toContain("compose.yml");
     expect(paths).toContain("compose.store.sql.yml");
     expect(paths).toContain("compose.store.kv.yml");
+    expect(paths).toContain(COMPOSE_ALL);
     expect(paths).not.toContain(COMPOSE_OVERRIDE);
 
     expect(result.composeFiles).toEqual([
@@ -176,6 +376,7 @@ describe("deriveInfrastructure", () => {
       "compose.store.sql.yml",
       COMPOSE_OVERRIDE,
     ]);
+    expect(result.composeFiles).not.toContain(COMPOSE_ALL);
 
     const sqlYml = result.files.find((f) => f.path === "compose.store.sql.yml")!.content;
     expect(sqlYml).toContain("pgvector/pgvector:pg17");
@@ -187,6 +388,7 @@ describe("deriveInfrastructure", () => {
     const baseYml = result.files.find((f) => f.path === "compose.yml")!.content;
     expect(baseYml).toContain('context: ".."');
     expect(baseYml).toContain("app:");
+    expect(baseYml).toContain("oke-skyport:latest");
 
     for (const f of result.files) {
       assertNoCredentialsInYaml(f.content, Object.values(fixedCreds));
@@ -221,6 +423,56 @@ describe("deriveInfrastructure", () => {
     expect(result.composeFiles.at(-1)).toBe(COMPOSE_OVERRIDE);
     const prod = result.files.find((f) => f.path === "compose.prod.yml")!.content;
     expect(prod).toContain("replicas");
+    expect(prod).toContain("/_/ready");
+    expect(prod).toContain("update_config");
+    expect(prod).toContain("restart_policy");
+    expect(prod).toContain("stop_grace_period");
+    expect(prod).toContain("start-first");
+    expect(prod).toContain("on-failure");
+  });
+
+  test("when postgres + pgdog are both pinned, DATABASE_URL points at PgDog", () => {
+    const result = deriveInfrastructure({
+      images: {
+        "store.sql": "postgres:18-alpine",
+        pgdog: "ghcr.io/pgdogdev/pgdog:v0.1.51",
+      },
+      credentials: { "store.sql": fixedCreds["store.sql"] },
+      prod: true,
+      app: "skyport",
+    });
+
+    expect(result.stackEnv.DATABASE_URL).toContain(":6432/");
+    expect(result.stackEnv.DATABASE_URL).toContain("postgres://oke:");
+    expect(result.stackEnv.DATABASE_URL).toContain("/oke");
+    expect(result.stackEnv.OKE_PGDOG_URL).toBe(result.stackEnv.DATABASE_URL);
+    // Direct Postgres URL stays on the role key for ops / escape hatch.
+    expect(result.stackEnv.OKE_STORE_SQL_URL).toContain(":5432/");
+
+    const pgdogYml = result.files.find((f) => f.path === "compose.pgdog.yml")!.content;
+    expect(pgdogYml).toContain("ghcr.io/pgdogdev/pgdog:v0.1.51");
+    expect(pgdogYml).toContain("store-sql");
+    expect(pgdogYml).toContain("service_healthy");
+    expect(pgdogYml).not.toContain(fixedCreds["store.sql"].password);
+
+    const pgdogToml = result.files.find((f) => f.path === "pgdog.toml")!.content;
+    expect(pgdogToml).toContain('pooler_mode = "transaction"');
+    expect(pgdogToml).toContain('host = "store-sql"');
+    expect(pgdogToml).not.toContain(fixedCreds["store.sql"].password);
+
+    const usersToml = result.files.find((f) => f.path === "users.toml")!.content;
+    expect(usersToml).toContain('password = "s3cret-sql-password-xyz"');
+    expect(usersToml).toContain('database = "oke"');
+  });
+
+  test("postgres alone keeps DATABASE_URL on 5432 (no pooler)", () => {
+    const result = deriveInfrastructure({
+      images: { "store.sql": "postgres:18-alpine" },
+      credentials: { "store.sql": fixedCreds["store.sql"] },
+    });
+    expect(result.stackEnv.DATABASE_URL).toContain(":5432/");
+    expect(result.stackEnv.OKE_PGDOG_URL).toBeUndefined();
+    expect(result.files.some((f) => f.path === "pgdog.toml")).toBe(false);
   });
 
   test("Dockerfile CMD is oke start", () => {
@@ -393,4 +645,125 @@ describe("deriveInfrastructure", () => {
     expect(files.hostPort).toBe(18_000 + n);
     expect(files.extraPorts).toEqual([{ hostPort: 19_000 + n, containerPort: 9001 }]);
   });
+
+  test("opt-in caddy proxy emits Caddyfile and unpublishes app ports", () => {
+    const result = deriveInfrastructure({
+      images: {
+        "store.sql": "postgres:16",
+        proxy: "caddy:2-alpine",
+      },
+      credentials: { "store.sql": fixedCreds["store.sql"] },
+      app: "skyport",
+    });
+    const base = result.files.find((f) => f.path === "compose.yml")!.content;
+    expect(base).toContain("app:");
+    expect(base).not.toContain("6530:6530");
+    expect(base).not.toContain("proxy:");
+    expect(base).toContain("store-sql");
+    expect(base).not.toMatch(/depends_on:[\s\S]*proxy/);
+
+    const proxyYml = result.files.find((f) => f.path === "compose.proxy.yml")!.content;
+    expect(proxyYml).toContain("caddy:2-alpine");
+    expect(proxyYml).toContain("80:80");
+    expect(proxyYml).toContain("443:443");
+    expect(proxyYml).toContain("./Caddyfile:/etc/caddy/Caddyfile:ro");
+
+    const caddyfile = result.files.find((f) => f.path === "Caddyfile")!.content;
+    expect(caddyfile).toContain("reverse_proxy app:6530");
+    expect(result.stackEnv.OKE_PROXY_URL).toBe("https://127.0.0.1");
+    expect(formatStackEnv(result.stackEnv)).toContain("# ── proxy — TLS terminator");
+    expect(formatStackEnv(result.stackEnv)).toContain("# OKE_PROXY_HOST=localhost");
+  });
+
+  test("opt-in traefik proxy labels app and mounts socket only on socket-proxy", () => {
+    const result = deriveInfrastructure({
+      images: {
+        "store.sql": "postgres:16",
+        proxy: "traefik:v3.3",
+      },
+      credentials: { "store.sql": fixedCreds["store.sql"] },
+      app: "skyport",
+      prod: true,
+    });
+    const base = result.files.find((f) => f.path === "compose.yml")!.content;
+    expect(base).not.toContain("6530:6530");
+
+    const proxyYml = result.files.find((f) => f.path === "compose.proxy.yml")!.content;
+    expect(proxyYml).toContain("traefik:v3.3");
+    expect(proxyYml).toContain(SOCKET_PROXY_IMAGE);
+    expect(proxyYml).toContain(SOCKET_PROXY_SERVICE);
+    expect(proxyYml).toContain("/var/run/docker.sock:/var/run/docker.sock:ro");
+    expect(proxyYml).toContain("tcp://socket-proxy:2375");
+    expect(proxyYml).toContain("traefik.enable");
+    expect(proxyYml).toContain("traefik.http.routers.app.rule");
+    expect(proxyYml).toContain("loadbalancer.server.port");
+    // Raw socket must not be on the Traefik service itself.
+    const traefikBlock = proxyYml.split("socket-proxy:")[0]!;
+    expect(traefikBlock).toContain("traefik:v3.3");
+    expect(traefikBlock).not.toContain("docker.sock");
+
+    expect(result.files.some((f) => f.path === "Caddyfile")).toBe(false);
+    expect(result.stackEnv.OKE_PROXY_URL).toBe("https://127.0.0.1");
+    expect(result.composeFiles).toContain("compose.proxy.yml");
+    expect(result.composeFiles).toContain("compose.prod.yml");
+  });
+
+  test("without proxy role, app still publishes 6530 (default unchanged)", () => {
+    const result = deriveInfrastructure({
+      images: { "store.sql": "postgres:16" },
+      credentials: { "store.sql": fixedCreds["store.sql"] },
+      app: "skyport",
+    });
+    const base = result.files.find((f) => f.path === "compose.yml")!.content;
+    expect(base).toContain("6530:6530");
+    expect(result.files.some((f) => f.path === "compose.proxy.yml")).toBe(false);
+    expect(result.stackEnv.OKE_PROXY_URL).toBeUndefined();
+  });
+
+  test("compose.all.yml merges every service from separate layer files", () => {
+    const result = deriveInfrastructure({
+      images: {
+        "store.sql": "postgres:16",
+        "store.kv": "redis:8-alpine",
+        proxy: "traefik:v3.3",
+      },
+      credentials: {
+        "store.sql": fixedCreds["store.sql"],
+        "store.kv": fixedCreds["store.kv"],
+      },
+      app: "skyport",
+      prod: true,
+    });
+
+    const allFile = result.files.find((f) => f.path === COMPOSE_ALL);
+    expect(allFile).toBeDefined();
+    const allYml = allFile!.content;
+    const allServices = serviceNamesFromComposeYaml(allYml);
+
+    const expected = new Set<string>();
+    for (const f of result.files) {
+      if (f.path === COMPOSE_ALL) continue;
+      if (f.path !== "compose.yml" && !/^compose\..+\.yml$/.test(f.path)) continue;
+      for (const name of serviceNamesFromComposeYaml(f.content)) {
+        expected.add(name);
+      }
+    }
+
+    expect(expected.size).toBeGreaterThan(0);
+    for (const name of expected) {
+      expect(allServices.has(name)).toBe(true);
+    }
+    // Companion + role services survive the merge (not dropped).
+    expect(allServices.has("app")).toBe(true);
+    expect(allServices.has("store-sql")).toBe(true);
+    expect(allServices.has("store-kv")).toBe(true);
+    expect(allServices.has("proxy")).toBe(true);
+    expect(allServices.has(SOCKET_PROXY_SERVICE)).toBe(true);
+    // Prod overlay fields land on app in the merged document.
+    expect(allYml).toContain("/_/ready");
+    expect(allYml).toContain("stop_grace_period");
+    expect(allYml).toContain("update_config");
+    // Still not in the layered `-f` list.
+    expect(result.composeFiles).not.toContain(COMPOSE_ALL);
+  });
 });

package/src/docker/helpers.ts

@@ -43,6 +43,8 @@ export function defaultHostPort(role: string, containerPort: number): number {
   if (role === "store.sql") return 5432;
   if (role === "store.kv") return 6379;
   if (role === "signal") return 4222;
+  if (role === "pgdog") return 6432;
+  if (role === "proxy") return 80;
   return containerPort;
 }
 

package/src/docker/index.ts

@@ -15,6 +15,7 @@ export type {
   ImageRecipe,
   RecipeApplyResult,
   RecipeExtraPort,
+  RecipeUlimit,
   ServiceCredentials,
   ServiceEndpoint,
   ServiceSpec,
@@ -23,11 +24,13 @@ export type {
 export { DEFAULT_DOCKER_DIR } from "./types.ts";
 
 export {
+  COMPOSE_ALL,
   COMPOSE_OVERRIDE,
   assertNoCredentialsInYaml,
   buildSpecs,
   buildStackEnv,
   composePathRefs,
+  deepMergeCompose,
   emitComposeLayers,
   formatStackEnv,
 } from "./compose.ts";
@@ -38,15 +41,23 @@ export { credEnv, envPrefix, serviceNameFor } from "./helpers.ts";
 export { generateCredentials } from "./credentials.ts";
 export {
   builtinRecipes,
+  caddy,
+  dragonfly,
   mailpit,
   meilisearch,
   ollama,
   openbao,
+  pgdog,
   postgres,
   recipeFor,
   redis,
   rustfs,
+  traefik,
+  valkey,
 } from "./recipes/index.ts";
+export { CADDY_APP_SERVICE, buildCaddyfile } from "./recipes/caddy.ts";
+export { PGDOG_BACKEND_SERVICE, buildPgDogToml, buildPgDogUsersToml } from "./recipes/pgdog.ts";
+export { SOCKET_PROXY_IMAGE, SOCKET_PROXY_SERVICE, traefikAppLabels } from "./recipes/traefik.ts";
 export {
   formatStackPreview,
   resolveExtraPorts,

package/src/docker/recipes/caddy.ts

@@ -0,0 +1,51 @@
+/**
+ * Caddy image recipe — automatic HTTPS reverse proxy (simplest TLS path).
+ *
+ * Opt-in via `images.proxy`. Emits a `Caddyfile` that terminates TLS and
+ * reverse-proxies to the compose `app` service on {@link APP_PORT}.
+ */
+
+import { APP_PORT } from "../../runtime/types.ts";
+import type { ImageRecipe } from "../types.ts";
+
+/** Compose service name for the application container. */
+export const CADDY_APP_SERVICE = "app";
+
+/**
+ * Build a minimal Caddyfile — automatic HTTPS for `OKE_PROXY_HOST`.
+ *
+ * @param opts - Upstream app port on the compose network
+ */
+export function buildCaddyfile(opts: { readonly appPort?: number } = {}): string {
+  const port = opts.appPort ?? APP_PORT;
+  return [
+    "# Generated by `oke docker` — edit via compose.override.yml / replace this file.",
+    "# Set OKE_PROXY_HOST to your public hostname (Let's Encrypt). localhost → local TLS.",
+    "{$OKE_PROXY_HOST:localhost} {",
+    `	reverse_proxy ${CADDY_APP_SERVICE}:${port}`,
+    "}",
+    "",
+  ].join("\n");
+}
+
+/** Caddy reverse proxy. HTTP 80 + HTTPS 443. */
+export const caddy: ImageRecipe = {
+  id: "caddy",
+  port: 80,
+  match: (i) => /caddy/i.test(i),
+  apply: (s) => ({
+    extraPorts: [{ host: 443, container: 443 }],
+    volumes: [
+      "./Caddyfile:/etc/caddy/Caddyfile:ro",
+      `${s.serviceName}-data:/data`,
+      `${s.serviceName}-config:/config`,
+    ],
+    healthcheck: {
+      test: ["CMD", "caddy", "version"],
+      interval: "10s",
+      timeout: "3s",
+      retries: 5,
+    },
+  }),
+  url: (_s, c) => `https://${c.host}`,
+};

package/src/docker/recipes/dragonfly.ts

@@ -0,0 +1,31 @@
+/**
+ * Dragonfly image recipe — Redis-wire-compatible, multi-threaded alternative.
+ *
+ * Peer of Redis / Valkey via `images["store.kv"]` (driver id stays `redis`).
+ * Official image: `docker.dragonflydb.io/dragonflydb/dragonfly`.
+ */
+
+import type { ImageRecipe } from "../types.ts";
+
+/** Dragonfly — Redis protocol on 6379. */
+export const dragonfly: ImageRecipe = {
+  id: "dragonfly",
+  port: 6379,
+  match: (i) => /dragonfly/i.test(i),
+  apply: () => ({
+    environment: { HEALTHCHECK_PORT: "6379" },
+    command: [
+      "sh",
+      "-c",
+      'exec dragonfly --requirepass "$$OKE_STORE_KV_PASSWORD" --maxmemory "$${OKE_STORE_KV_MAXMEMORY:-0}"',
+    ],
+    ulimits: { memlock: -1 },
+    healthcheck: {
+      test: ["CMD", "/usr/local/bin/healthcheck.sh"],
+      interval: "5s",
+      timeout: "3s",
+      retries: 10,
+    },
+  }),
+  url: (_s, c) => `redis://:${encodeURIComponent(c.password)}@${c.host}:${c.port}`,
+};

package/src/docker/recipes/index.ts

@@ -3,26 +3,49 @@
  */
 
 import type { ImageRecipe } from "../types.ts";
+import { caddy } from "./caddy.ts";
+import { dragonfly } from "./dragonfly.ts";
 import { mailpit } from "./mailpit.ts";
 import { meilisearch } from "./meilisearch.ts";
 import { ollama } from "./ollama.ts";
 import { openbao } from "./openbao.ts";
+import { pgdog } from "./pgdog.ts";
 import { postgres } from "./postgres.ts";
 import { redis } from "./redis.ts";
 import { rustfs } from "./rustfs.ts";
+import { traefik } from "./traefik.ts";
+import { valkey } from "./valkey.ts";
 
-/** Default recipe catalogue. */
+/** Default recipe catalogue — more specific image matches before protocol peers. */
 export const builtinRecipes: readonly ImageRecipe[] = [
   postgres,
+  pgdog,
+  dragonfly,
+  valkey,
   redis,
   mailpit,
   rustfs,
   openbao,
   meilisearch,
   ollama,
+  caddy,
+  traefik,
 ];
 
-export { mailpit, meilisearch, ollama, openbao, postgres, redis, rustfs };
+export {
+  caddy,
+  dragonfly,
+  mailpit,
+  meilisearch,
+  ollama,
+  openbao,
+  pgdog,
+  postgres,
+  redis,
+  rustfs,
+  traefik,
+  valkey,
+};
 
 /**
  * Resolve the recipe for an image reference.