openship 0.1.1 → 0.1.7

package/README.md

@@ -1,360 +0,0 @@
-<h1 align="center">Openship</h1>
-
-<p align="center">
-  Deploy anything. Own everything.<br>
-  Push your code — build, configure, and deploy from one place.<br>
-  Use our cloud or connect your own servers.
-</p>
-
-<p align="center">
-  Desktop-first. Open-source. Zero lock-in.
-</p>
-
-<p align="center">
-  <img src="docs/screenshots/screen.png" alt="Openship" width="800" />
-</p>
-
----
-
-## What Openship Is
-
-Openship is a **desktop-first deployment platform with built-in CI/CD and full infrastructure control**.
-
-It removes the gap between writing code and running it in production.
-
-No pipelines to maintain.  
-No YAML to manage.  
-No platform lock-in.
-
----
-
-## The Core Idea
-
-Most platforms run everything on your server:
-
-- CI/CD pipelines
-- Build systems
-- Dashboards
-- Databases
-- Your apps
-
-→ Your production resources are shared with tooling.
-
----
-
-### Openship
-
-**Your machine**
-- Desktop app (UI)
-- Build system (local by default)
-- Deployment control
-
-**Your server**
-- Production containers only
-
-→ No resource contention  
-→ Predictable performance  
-→ Clean architecture  
-
----
-
-## Desktop-First Architecture
-
-Openship is not a hosted dashboard.
-
-It’s a **local control plane for your infrastructure**.
-
-- Builds run locally by default
-- Deployments are triggered instantly
-- Works with any VPS or private network
-- No dependency on a remote control layer
-
-Your server stays minimal:
-- No CI runners
-- No dashboards
-- No management services
-
-Only your apps.
-
----
-
-## Built-in CI/CD (Without the Overhead)
-
-CI/CD is fully integrated — without pipelines to configure.
-
-- Deploy on every push
-- Preview environments per branch
-- Staging and production flows
-- Rollbacks built-in
-
-You can still use:
-- CLI workflows
-- External CI if needed
-- Server-side builds (optional)
-
-Default: simple, fast, local.
-
----
-
-## Deploy Anywhere
-
-- Openship Cloud (managed)
-- Any VPS or bare metal
-- Any provider, any region
-- Multi-server deployments
-
-Same app, same flow — everywhere.
-
----
-
-## Full Backend Support
-
-Run complete applications out of the box:
-
-- Databases (Postgres, MySQL, MongoDB)
-- Redis / caching
-- Background workers
-- WebSockets
-- APIs
-- Storage
-
-Provision and manage everything from the app.
-
----
-
-## Any Stack
-
-If it builds, it ships.
-
-- Node.js, Bun, Deno
-- Python, Go, Rust
-- PHP, Ruby, Java, .NET
-- Docker (full control)
-- Monorepos supported
-
-No lock-in to a runtime.
-
----
-
-## Domains & SSL
-
-- Automatic SSL (Let's Encrypt)
-- Wildcard domains
-- Unlimited domains
-- Auto-renewal
-
-No manual setup.
-
----
-
-## The Desktop App
-
-Everything in one place:
-
-- One-click deploys
-- Live build logs
-- Real-time metrics
-- Domain & DNS management
-- Database control
-- Backups & restore
-- Scaling controls
-
-Replaces:
-- CI dashboards
-- SSH workflows
-- Manual Docker setup
-
----
-
-## Developer Interfaces
-
-### CLI
-
-```bash
-openship deploy
-openship logs --follow
-openship rollback
-openship domains
-```
-
----
-
-### REST API
-
-Automate everything:
-
-- Deployments
-- Projects
-- Domains
-- Logs
-
----
-
-### MCP (AI / Agent Control)
-
-Expose deployment actions to external agents when needed.
-
----
-
-## Backups
-
-- Scheduled backups
-- Databases + volumes
-- One-click restore
-- Export anytime
-
----
-
-## Portability
-
-Move anywhere:
-
-- Cloud ↔ self-host
-- VPS → VPS
-- Full export/import
-
-No proprietary formats:
-- Standard Docker containers
-- Encrypted transfer via SSH
-
----
-
-## Built-in Mail Server
-
-- Unlimited domains
-- Standard email auth (DKIM, SPF, DMARC)
-- No external providers required
-
----
-
-## Global CDN
-
-- Edge caching
-- Compression (HTTP/3, Brotli)
-- Instant cache purge
-
-Works with any deployment.
-
----
-
-## Scaling
-
-### Cloud
-- Auto-scaling
-- Load balancing
-- Zero config
-
-### Self-hosted
-- Upgrade servers anytime
-- Move workloads without redeploy
-- Multi-node ready
-
----
-
-## Architecture Comparison
-
-### Traditional Tools
-
-Server runs:
-- CI/CD
-- Build system
-- Dashboard
-- Reverse proxy
-- Apps
-
-→ Resource contention  
-→ Complex setup  
-
----
-
-### Openship
-
-**Local machine**
-- Builds
-- Control plane
-
-**Server**
-- Production containers only
-
-→ Maximum efficiency  
-→ Minimal overhead  
-
----
-
-## Why Openship
-
-- Desktop-first deployment loop
-- Built-in CI/CD without pipeline overhead
-- No YAML or infra complexity
-- No server-side tooling overhead
-- Works on any Linux server
-- Fully open-source (AGPL-3)
-- No vendor lock-in
-
----
-
-## Example Flow
-
-1. Connect your repo
-2. Connect a server (or use cloud)
-3. Click deploy
-
-Under the hood:
-- Build runs locally
-- Production container is shipped
-- App goes live
-
----
-
-## Philosophy
-
-Infrastructure should be:
-
-- Local-first
-- Transparent
-- Portable
-- Fully owned
-
-Not hidden behind platforms.  
-Not tied to pricing models.  
-Not dependent on proprietary runtimes.
-
----
-
-## Open Source
-
-- AGPL-3 licensed
-- Fully self-hostable
-- No usage limits
-- Community-driven
-
----
-
-## Status
-
-Production-ready core.
-
-Planned:
-- Multi-node clusters
-- Load balancing UI
-- Private networking
-- Advanced monitoring
-- Visual CI/CD pipelines
-
----
-
-## Get Started
-
-- Download the app
-- Connect your repo
-- Deploy in minutes
-
-No lock-in.  
-No complexity.  
-Full control.
-
----
-
-## License
-
-AGPL-3

package/apps/api/.env.example

@@ -1,30 +0,0 @@
-# Openship API — Environment Variables
-# Copy this file to .env and fill in the values.
-
-NODE_ENV=development
-PORT=4000
-
-# ---------- Mode ----------
-# Set to "true" to enable cloud billing, metering, multi-tenant features.
-# Default: false (self-hosted single-tenant mode).
-CLOUD_MODE=false
-
-# ---------- Database ----------
-DATABASE_URL=file:./dev.db
-
-# ---------- Auth ----------
-JWT_SECRET=change-me-in-production
-JWT_EXPIRES_IN=15m
-JWT_REFRESH_EXPIRES_IN=7d
-
-# ---------- Redis ----------
-REDIS_URL=redis://localhost:6379
-
-# ---------- Stripe (Cloud mode only) ----------
-# STRIPE_SECRET_KEY=sk_test_...
-# STRIPE_WEBHOOK_SECRET=whsec_...
-
-# ---------- GitHub App (for Git push webhooks) ----------
-# GITHUB_APP_ID=
-# GITHUB_PRIVATE_KEY=
-# GITHUB_WEBHOOK_SECRET=

package/apps/api/Dockerfile

@@ -1,22 +0,0 @@
-# ─── Build stage ────────────────────────────────────────
-FROM oven/bun:1 AS builder
-WORKDIR /app
-
-COPY package.json bun.lock pnpm-workspace.yaml ./
-COPY packages/ ./packages/
-COPY apps/api/ ./apps/api/
-
-RUN bun install --frozen-lockfile
-RUN cd apps/api && bun run build
-
-# ─── Production stage ──────────────────────────────────
-FROM oven/bun:1-slim AS runner
-WORKDIR /app
-
-COPY --from=builder /app/apps/api/dist ./dist
-COPY --from=builder /app/apps/api/package.json ./
-COPY --from=builder /app/node_modules ./node_modules
-
-ENV NODE_ENV=production
-EXPOSE 4000
-CMD ["bun", "run", "dist/index.js"]

package/apps/api/package.json

@@ -1,41 +0,0 @@
-{
-  "name": "@repo/api",
-  "version": "0.1.0",
-  "private": true,
-  "type": "module",
-  "scripts": {
-    "dev": "node --env-file=.env --import tsx --watch src/index.ts",
-    "dev:saas": "PGLITE_DATA_DIR=$HOME/.openship/data-saas node --env-file=.env.saas --import tsx --watch src/index.ts",
-    "build": "tsup src/index.ts --format esm --dts",
-    "start": "node dist/index.js",
-    "lint": "tsc --noEmit",
-    "test": "vitest run",
-    "clean": "rm -rf dist .turbo node_modules"
-  },
-  "dependencies": {
-    "@better-auth/drizzle-adapter": "^1.5.4",
-    "@hono/node-server": "^1.19.11",
-    "@hono/typebox-validator": "^0.3.0",
-    "@repo/adapters": "workspace:*",
-    "@repo/core": "workspace:*",
-    "@repo/db": "workspace:*",
-    "@sinclair/typebox": "^0.34.48",
-    "better-auth": "^1.5.4",
-    "bullmq": "^5.70.4",
-    "hono": "^4.12.5",
-    "ioredis": "^5.10.0",
-    "nodemailer": "^8.0.1",
-    "pino": "^10.3.1",
-    "stripe": "^20.4.0",
-    "yaml": "^2.8.2",
-    "zod": "^4.3.6"
-  },
-  "devDependencies": {
-    "@types/node": "^22.13.0",
-    "@types/nodemailer": "^7.0.11",
-    "tsup": "^8.5.1",
-    "tsx": "^4.21.0",
-    "typescript": "^5.9.3",
-    "vitest": "^4.0.18"
-  }
-}

package/apps/api/src/app.ts

@@ -1,69 +0,0 @@
-import { Hono } from "hono";
-import { cors } from "hono/cors";
-import { logger } from "hono/logger";
-import { env, trustedOrigins } from "./config/env";
-import { errorHandler } from "./middleware/error-handler";
-import { rateLimiter } from "./middleware/rate-limiter";
-import { bootstrapPlatform } from "./lib/controller-helpers";
-
-import { authRoutes } from "./modules/auth/auth.routes";
-import { projectRoutes } from "./modules/projects/project.routes";
-import { deploymentRoutes } from "./modules/deployments/deployment.routes";
-import { domainRoutes } from "./modules/domains/domain.routes";
-import { analyticsRoutes } from "./modules/analytics/analytics.routes";
-import { billingRoutes } from "./modules/billing/billing.routes";
-import { webhookRoutes } from "./modules/webhooks/webhook.routes";
-import { healthRoutes } from "./modules/health/health.routes";
-import { githubRoutes } from "./modules/github";
-import { settingsRoutes } from "./modules/settings/settings.routes";
-
-/* ---------- Initialize platform (runtime + infra + system) ---------- */
-await bootstrapPlatform();
-
-export const app = new Hono();
-
-/* ---------- Global middleware ---------- */
-app.use(
-  "*",
-  cors({
-    origin: trustedOrigins,
-    credentials: true,
-  }),
-);
-app.use("*", errorHandler);
-app.use("*", logger());
-
-app.use("/api/auth/*", rateLimiter);
-
-/* ---------- Shared routes (self-hosted + cloud + desktop) ---------- */
-app.route("/api/health", healthRoutes);
-app.route("/api/auth", authRoutes);
-app.route("/api/projects", projectRoutes);
-app.route("/api/deployments", deploymentRoutes);
-app.route("/api/domains", domainRoutes);
-app.route("/api/webhooks", webhookRoutes);
-app.route("/api/github", githubRoutes);
-app.route("/api/analytics", analyticsRoutes);
-app.route("/api/settings", settingsRoutes);
-
-/* ---------- Cloud-only routes (gated by CLOUD_MODE) ---------- */
-if (env.CLOUD_MODE) {
-  const { cloudSaasRoutes } = await import("./modules/cloud/cloud.routes");
-  app.route("/api/cloud", cloudSaasRoutes);
-  app.route("/api/billing", billingRoutes);
-} else {
-  /**
-   * System routes — filesystem browse, instance setup, user provisioning.
-   *
-   * Dynamic import: in cloud mode these modules are NEVER loaded into the
-   * process. The filesystem controller (node:fs), setup controller
-   * (admin user creation), and all their dependencies don't exist in
-   * the cloud runtime — not just "protected", but fully absent.
-   */
-  const { systemRoutes } = await import("./modules/system");
-  app.route("/api/system", systemRoutes);
-
-  /** Cloud account management — connect/disconnect to Openship Cloud */
-  const { cloudLocalRoutes } = await import("./modules/cloud/cloud.routes");
-  app.route("/api/cloud", cloudLocalRoutes);
-}

package/apps/api/src/config/env.ts

@@ -1,113 +0,0 @@
-import { z } from "zod";
-
-/**
- * API configuration — loaded from environment variables.
- *
- * CLOUD_MODE=true enables billing, metering, and multi-tenant features.
- * CLOUD_MODE=false (default) runs as a self-hosted single-tenant instance.
- */
-const envSchema = z.object({
-  NODE_ENV: z.enum(["development", "production", "test"]).default("development"),
-  PORT: z.coerce.number().default(4000),
-
-  /* ---------- Mode ---------- */
-  CLOUD_MODE: z
-    .enum(["true", "false", "1", "0", ""])
-    .default("false")
-    .transform((v) => v === "true" || v === "1"),
-  /**
-   * Deployment mode — determines the runtime + infrastructure combination:
-   *   - "docker"  (default) → Docker runtime + Traefik routing/SSL (self-hosted)
-   *   - "bare"              → Process runtime + Traefik routing/SSL (self-hosted)
-   *   - "cloud"             → Oblien cloud API for everything (auto-set when CLOUD_MODE=true)
-   *   - "desktop"           → Bare runtime, no routing/SSL (desktop app)
-   */
-  DEPLOY_MODE: z.enum(["docker", "bare", "cloud", "desktop"]).default("docker"),
-
-  /* ---------- Database ---------- */
-  DATABASE_URL: z.string().default(""),
-
-  /* ---------- Auth (Better Auth) ---------- */
-  BETTER_AUTH_SECRET: z.string().default("change-me-in-production"),
-  BETTER_AUTH_URL: z.string().default("http://localhost:4000"),
-  TRUSTED_ORIGINS: z.string().optional(),
-
-  /* ---------- OAuth Providers ---------- */
-  GITHUB_CLIENT_ID: z.string().optional(),
-  GITHUB_CLIENT_SECRET: z.string().optional(),
-  GOOGLE_CLIENT_ID: z.string().optional(),
-  GOOGLE_CLIENT_SECRET: z.string().optional(),
-
-  /* ---------- GitHub Auth Strategy ---------- */
-  /**
-   * Controls how the API authenticates with GitHub:
-   *   - "auto"  (default) → inferred from DEPLOY_MODE / CLOUD_MODE
-   *   - "app"             → GitHub App installation tokens (cloud)
-   *   - "oauth"           → Better Auth OAuth flow only (self-hosted with OAuth)
-   *   - "cli"             → `gh auth login` token from the machine (local/desktop)
-   *   - "token"           → static GITHUB_TOKEN env var (CI, scripts)
-   */
-  GITHUB_AUTH_MODE: z.enum(["auto", "app", "oauth", "cli", "token"]).default("auto"),
-  /** Static GitHub personal access token — used when GITHUB_AUTH_MODE="token" */
-  GITHUB_TOKEN: z.string().optional(),
-
-  /* ---------- Redis ---------- */
-  REDIS_URL: z.string().default("redis://localhost:6379"),
-
-  /* ---------- Stripe (Cloud only) ---------- */
-  STRIPE_SECRET_KEY: z.string().optional(),
-  STRIPE_WEBHOOK_SECRET: z.string().optional(),
-
-  /* ---------- Git Webhooks ---------- */
-  GITHUB_APP_ID: z.string().optional(),
-  GITHUB_APP_SLUG: z.string().optional(),
-  GITHUB_PRIVATE_KEY: z.string().optional(),
-  GITHUB_WEBHOOK_SECRET: z.string().optional(),
-
-  /* ---------- Email (SMTP) ---------- */
-  SMTP_HOST: z.string().optional(),
-  SMTP_PORT: z.coerce.number().optional(),
-  SMTP_USER: z.string().optional(),
-  SMTP_PASS: z.string().optional(),
-  SMTP_FROM: z.string().default("Openship <noreply@openship.dev>"),
-
-  /* ---------- Dashboard ---------- */
-  DASHBOARD_URL: z.string().default("http://localhost:3001"),
-
-  /* ---------- Network (self-hosted) ---------- */
-  /** Public IP of the server — used for A record instructions in self-hosted mode. */
-  SERVER_IP: z.string().optional(),
-
-  /* ---------- Oblien Cloud ---------- */
-  OBLIEN_CLIENT_ID: z.string().optional(),
-  OBLIEN_CLIENT_SECRET: z.string().optional(),
-
-  /** Openship Cloud API URL — used by local instances to fetch namespace tokens */
-  OPENSHIP_CLOUD_URL: z.string().default("https://api.openship.io"),
-
-  /** Openship Cloud dashboard URL — used for external auth redirect (desktop + cloud connect) */
-  OPENSHIP_CLOUD_DASHBOARD_URL: z.string().default("https://app.openship.io"),
-
-  /* ---------- Screenshots (optional) ---------- */
-  SCREENSHOT_SERVICE_URL: z.string().optional(),
-  CDN_UPLOAD_URL: z.string().optional(),
-
-  /* ---------- Internal (Electron ↔ API) ---------- */
-  /** Shared secret for Electron → API calls (set by desktop app on startup) */
-  INTERNAL_TOKEN: z.string().optional(),
-
-  /** Enables verbose timing logs for SSH/system checks and environment detection */
-  SYSTEM_DEBUG_LOGS: z
-    .enum(["true", "false", "1", "0", ""])
-    .default("")
-    .transform((v) => v === "true" || v === "1"),
-});
-
-export type Env = z.infer<typeof envSchema>;
-
-export const env = envSchema.parse(process.env);
-
-/** Parsed trusted origins — single source of truth for CORS + Better Auth */
-export const trustedOrigins = env.TRUSTED_ORIGINS
-  ? env.TRUSTED_ORIGINS.split(",")
-  : ["http://localhost:3000", "http://localhost:3001"];

package/apps/api/src/config/index.ts

@@ -1 +0,0 @@
-export { env } from "./env";

package/apps/api/src/index.ts

@@ -1,8 +0,0 @@
-import { serve } from "@hono/node-server";
-import { app } from "./app";
-
-const port = Number(process.env.PORT) || 4000;
-
-serve({ fetch: app.fetch, port }, (info) => {
-  console.log(`🚀 Openship API running on http://localhost:${info.port}`);
-});

package/apps/api/src/lib/auth-mode.ts

@@ -1,42 +0,0 @@
-/**
- * Cached auth-mode reader for desktop mode.
- *
- * Auth mode is written once during onboarding and rarely changes.
- * Caching avoids a DB hit on every request through authMiddleware.
- *
- * The cache is cleared by setup.controller after any write so that
- * re-onboarding (dev reset) picks up the new value immediately.
- */
-
-import { env } from "../config/env";
-
-let cached: string | null = null;
-
-/**
- * Returns the current auth mode for this instance.
- *
- *   "none"  → zero-auth desktop (auto-provisioned local user)
- *   "cloud" → cloud-authenticated desktop (Openship Cloud session)
- *   "local" → standard Better Auth (self-hosted VPS / SaaS)
- */
-export async function getAuthMode(): Promise<"none" | "cloud" | "local"> {
-  // Non-desktop always uses local Better Auth
-  if (env.DEPLOY_MODE !== "desktop") return "local";
-
-  if (cached !== null) return cached as "none" | "cloud" | "local";
-
-  try {
-    const { repos } = await import("@repo/db");
-    const settings = await repos.instanceSettings.get();
-    cached = settings?.authMode ?? "none";
-  } catch {
-    cached = "none";
-  }
-
-  return cached as "none" | "cloud" | "local";
-}
-
-/** Clear the cached value — called after setup.controller writes. */
-export function clearAuthModeCache() {
-  cached = null;
-}