percher 0.5.23 → 1.0.0

package/dist/templates/hugo/PERCHER-TEMPLATE-LICENSE.txt

@@ -0,0 +1,14 @@
+BSD Zero Clause License (0BSD)
+
+Copyright (c) 2026 Mattias Malmborg
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+PERFORMANCE OF THIS SOFTWARE.

package/dist/templates/java/PERCHER-TEMPLATE-LICENSE.txt

@@ -0,0 +1,14 @@
+BSD Zero Clause License (0BSD)
+
+Copyright (c) 2026 Mattias Malmborg
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+PERFORMANCE OF THIS SOFTWARE.

package/dist/templates/laravel/PERCHER-TEMPLATE-LICENSE.txt

@@ -0,0 +1,14 @@
+BSD Zero Clause License (0BSD)
+
+Copyright (c) 2026 Mattias Malmborg
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+PERFORMANCE OF THIS SOFTWARE.

package/dist/templates/nextjs/PERCHER-TEMPLATE-LICENSE.txt

@@ -0,0 +1,14 @@
+BSD Zero Clause License (0BSD)
+
+Copyright (c) 2026 Mattias Malmborg
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+PERFORMANCE OF THIS SOFTWARE.

package/dist/templates/node/PERCHER-TEMPLATE-LICENSE.txt

@@ -0,0 +1,14 @@
+BSD Zero Clause License (0BSD)
+
+Copyright (c) 2026 Mattias Malmborg
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+PERFORMANCE OF THIS SOFTWARE.

package/dist/templates/nuxt/PERCHER-TEMPLATE-LICENSE.txt

@@ -0,0 +1,14 @@
+BSD Zero Clause License (0BSD)
+
+Copyright (c) 2026 Mattias Malmborg
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+PERFORMANCE OF THIS SOFTWARE.

package/dist/templates/phoenix/PERCHER-TEMPLATE-LICENSE.txt

@@ -0,0 +1,14 @@
+BSD Zero Clause License (0BSD)
+
+Copyright (c) 2026 Mattias Malmborg
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+PERFORMANCE OF THIS SOFTWARE.

package/dist/templates/preact/Dockerfile

@@ -1,35 +1,51 @@
-# Multi-stage build: a Bun stage compiles the static bundle, then a
-# minimal Caddy image serves it. This project uses runtime = "docker"
-# (not "static") because Percher's static runtime serves pre-built
-# files only — it does not run a build command. Generated by Percher;
-# safe to edit and own.
-
-# --- Build stage: install deps and build the static bundle -----------
-FROM oven/bun:1-alpine AS build
-WORKDIR /app
-COPY . .
-RUN bun install && bun run build
-
-# --- Serve stage: minimal Caddy image --------------------------------
-# caddy:2-alpine ships /usr/bin/caddy with cap_net_bind_service file
-# caps. Percher runs every container with --security-opt
-# no-new-privileges, which makes execve refuse a cap-bearing binary
-# (an "operation not permitted" crash-loop). Copy Caddy onto a plain
-# alpine base and strip the caps with setcap -r — Caddy never needs
-# the cap here, it listens on :8080 (>= 1024).
-FROM caddy:2-alpine AS caddy-source
-FROM alpine:3.21
-COPY --from=caddy-source /usr/bin/caddy /usr/bin/caddy
-RUN apk add --no-cache libcap \
- && (setcap -r /usr/bin/caddy 2>/dev/null || true) \
- && test -z "$(getcap /usr/bin/caddy)" \
- && apk del libcap \
- && rm -rf /var/cache/apk/*
-COPY Caddyfile /etc/caddy/Caddyfile
-COPY --from=build /app/dist /srv
-# HOME points at the writable tmpfs so non-root Caddy can persist its
-# XDG state (storage-clean lock, config autosave) under Percher's
-# read-only root filesystem.
-ENV HOME=/tmp
-EXPOSE 8080
-CMD ["caddy", "run", "--config", "/etc/caddy/Caddyfile", "--adapter", "caddyfile"]
+# Multi-stage build: a Bun stage compiles the static bundle, then a
+# minimal Caddy image serves it. This project uses runtime = "docker"
+# (not "static") because Percher's static runtime serves pre-built
+# files only — it does not run a build command. Generated by Percher;
+# safe to edit and own.
+
+# --- Build stage: install deps and build the static bundle -----------
+FROM oven/bun:1-alpine AS build
+WORKDIR /app
+COPY . .
+RUN bun install && bun run build
+
+# --- Serve stage: minimal Caddy image --------------------------------
+# Build pinned Caddy source with refreshed security modules. The scratch
+# runtime carries no shell, package manager, or file capabilities and listens
+# on the unprivileged port :8080.
+FROM golang:1.26.7-alpine3.23@sha256:b17af760035fc2f338eed92d448a6c67f2d45438844fc6c60678fa5f99e44b57 AS caddy-source
+ADD --checksum=sha256:78e660d838e45c0b8c89338b325946238f153641aa9925df9ef2ad5e8eced31b \
+  https://github.com/caddyserver/caddy/commit/b2693fb63a30e6d7be0972c3645e9a2c0a500e93.patch /tmp/caddy-cel-go.patch
+RUN go mod download github.com/caddyserver/caddy/v2@v2.11.4 \
+ && cp -R /go/pkg/mod/github.com/caddyserver/caddy/v2@v2.11.4 /src \
+ && chmod -R u+w /src
+WORKDIR /src
+RUN apk add --no-cache patch \
+ && patch -p1 < /tmp/caddy-cel-go.patch \
+ && go get github.com/go-chi/chi/v5@v5.3.0 github.com/google/cel-go@v0.29.2 \
+      github.com/klauspost/compress@v1.18.7 go.opentelemetry.io/otel@v1.44.0 \
+      golang.org/x/crypto@v0.55.0 golang.org/x/net@v0.58.0 \
+      golang.org/x/text@v0.41.0 google.golang.org/grpc@v1.83.2 \
+ && go mod tidy \
+ && CGO_ENABLED=0 go build -trimpath -ldflags "-s -w" -o /out/caddy ./cmd/caddy \
+ && printf '%s\n' \
+      'package main' \
+      'import ("net/http"; "os"; "time")' \
+      'func main(){ if len(os.Args)!=2 { os.Exit(2) }; c:=http.Client{Timeout:2500*time.Millisecond,Transport:&http.Transport{Proxy:nil},CheckRedirect:func(_ *http.Request,_ []*http.Request) error{return http.ErrUseLastResponse}}; r,e:=c.Get(os.Args[1]); if e!=nil { os.Exit(1) }; defer r.Body.Close(); if r.StatusCode!=http.StatusOK { os.Exit(1) } }' \
+      > /tmp/percher-healthcheck.go \
+ && CGO_ENABLED=0 go build -trimpath -ldflags "-s -w" -o /out/percher-healthcheck /tmp/percher-healthcheck.go
+FROM scratch
+COPY --from=caddy-source /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
+COPY --from=caddy-source /out/caddy /usr/bin/caddy
+COPY --from=caddy-source /out/percher-healthcheck /usr/bin/percher-healthcheck
+COPY Caddyfile /etc/caddy/Caddyfile
+COPY --from=build /app/dist /srv
+LABEL dev.percher.health-client="static-http-v1"
+# HOME points at the writable tmpfs so non-root Caddy can persist its
+# XDG state (storage-clean lock, config autosave) under Percher's
+# read-only root filesystem.
+ENV HOME=/tmp
+USER 10001:10001
+EXPOSE 8080
+CMD ["caddy", "run", "--config", "/etc/caddy/Caddyfile", "--adapter", "caddyfile"]

package/dist/templates/preact/PERCHER-TEMPLATE-LICENSE.txt

@@ -0,0 +1,14 @@
+BSD Zero Clause License (0BSD)
+
+Copyright (c) 2026 Mattias Malmborg
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+PERFORMANCE OF THIS SOFTWARE.

package/dist/templates/python/PERCHER-TEMPLATE-LICENSE.txt

@@ -0,0 +1,14 @@
+BSD Zero Clause License (0BSD)
+
+Copyright (c) 2026 Mattias Malmborg
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+PERFORMANCE OF THIS SOFTWARE.

package/dist/templates/rails/PERCHER-TEMPLATE-LICENSE.txt

@@ -0,0 +1,14 @@
+BSD Zero Clause License (0BSD)
+
+Copyright (c) 2026 Mattias Malmborg
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+PERFORMANCE OF THIS SOFTWARE.

package/dist/templates/remix/PERCHER-TEMPLATE-LICENSE.txt

@@ -0,0 +1,14 @@
+BSD Zero Clause License (0BSD)
+
+Copyright (c) 2026 Mattias Malmborg
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+PERFORMANCE OF THIS SOFTWARE.

package/dist/templates/remix/app/routes/health.tsx

@@ -1,3 +1,5 @@
+import { json } from "@remix-run/node";
+
 export function loader() {
-  return Response.json({ status: "ok" });
+  return json({ status: "ok" });
 }

package/dist/templates/rust/PERCHER-TEMPLATE-LICENSE.txt

@@ -0,0 +1,14 @@
+BSD Zero Clause License (0BSD)
+
+Copyright (c) 2026 Mattias Malmborg
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+PERFORMANCE OF THIS SOFTWARE.

package/dist/templates/solid/Dockerfile

@@ -1,35 +1,51 @@
-# Multi-stage build: a Bun stage compiles the static bundle, then a
-# minimal Caddy image serves it. This project uses runtime = "docker"
-# (not "static") because Percher's static runtime serves pre-built
-# files only — it does not run a build command. Generated by Percher;
-# safe to edit and own.
-
-# --- Build stage: install deps and build the static bundle -----------
-FROM oven/bun:1-alpine AS build
-WORKDIR /app
-COPY . .
-RUN bun install && bun run build
-
-# --- Serve stage: minimal Caddy image --------------------------------
-# caddy:2-alpine ships /usr/bin/caddy with cap_net_bind_service file
-# caps. Percher runs every container with --security-opt
-# no-new-privileges, which makes execve refuse a cap-bearing binary
-# (an "operation not permitted" crash-loop). Copy Caddy onto a plain
-# alpine base and strip the caps with setcap -r — Caddy never needs
-# the cap here, it listens on :8080 (>= 1024).
-FROM caddy:2-alpine AS caddy-source
-FROM alpine:3.21
-COPY --from=caddy-source /usr/bin/caddy /usr/bin/caddy
-RUN apk add --no-cache libcap \
- && (setcap -r /usr/bin/caddy 2>/dev/null || true) \
- && test -z "$(getcap /usr/bin/caddy)" \
- && apk del libcap \
- && rm -rf /var/cache/apk/*
-COPY Caddyfile /etc/caddy/Caddyfile
-COPY --from=build /app/dist /srv
-# HOME points at the writable tmpfs so non-root Caddy can persist its
-# XDG state (storage-clean lock, config autosave) under Percher's
-# read-only root filesystem.
-ENV HOME=/tmp
-EXPOSE 8080
-CMD ["caddy", "run", "--config", "/etc/caddy/Caddyfile", "--adapter", "caddyfile"]
+# Multi-stage build: a Bun stage compiles the static bundle, then a
+# minimal Caddy image serves it. This project uses runtime = "docker"
+# (not "static") because Percher's static runtime serves pre-built
+# files only — it does not run a build command. Generated by Percher;
+# safe to edit and own.
+
+# --- Build stage: install deps and build the static bundle -----------
+FROM oven/bun:1-alpine AS build
+WORKDIR /app
+COPY . .
+RUN bun install && bun run build
+
+# --- Serve stage: minimal Caddy image --------------------------------
+# Build pinned Caddy source with refreshed security modules. The scratch
+# runtime carries no shell, package manager, or file capabilities and listens
+# on the unprivileged port :8080.
+FROM golang:1.26.7-alpine3.23@sha256:b17af760035fc2f338eed92d448a6c67f2d45438844fc6c60678fa5f99e44b57 AS caddy-source
+ADD --checksum=sha256:78e660d838e45c0b8c89338b325946238f153641aa9925df9ef2ad5e8eced31b \
+  https://github.com/caddyserver/caddy/commit/b2693fb63a30e6d7be0972c3645e9a2c0a500e93.patch /tmp/caddy-cel-go.patch
+RUN go mod download github.com/caddyserver/caddy/v2@v2.11.4 \
+ && cp -R /go/pkg/mod/github.com/caddyserver/caddy/v2@v2.11.4 /src \
+ && chmod -R u+w /src
+WORKDIR /src
+RUN apk add --no-cache patch \
+ && patch -p1 < /tmp/caddy-cel-go.patch \
+ && go get github.com/go-chi/chi/v5@v5.3.0 github.com/google/cel-go@v0.29.2 \
+      github.com/klauspost/compress@v1.18.7 go.opentelemetry.io/otel@v1.44.0 \
+      golang.org/x/crypto@v0.55.0 golang.org/x/net@v0.58.0 \
+      golang.org/x/text@v0.41.0 google.golang.org/grpc@v1.83.2 \
+ && go mod tidy \
+ && CGO_ENABLED=0 go build -trimpath -ldflags "-s -w" -o /out/caddy ./cmd/caddy \
+ && printf '%s\n' \
+      'package main' \
+      'import ("net/http"; "os"; "time")' \
+      'func main(){ if len(os.Args)!=2 { os.Exit(2) }; c:=http.Client{Timeout:2500*time.Millisecond,Transport:&http.Transport{Proxy:nil},CheckRedirect:func(_ *http.Request,_ []*http.Request) error{return http.ErrUseLastResponse}}; r,e:=c.Get(os.Args[1]); if e!=nil { os.Exit(1) }; defer r.Body.Close(); if r.StatusCode!=http.StatusOK { os.Exit(1) } }' \
+      > /tmp/percher-healthcheck.go \
+ && CGO_ENABLED=0 go build -trimpath -ldflags "-s -w" -o /out/percher-healthcheck /tmp/percher-healthcheck.go
+FROM scratch
+COPY --from=caddy-source /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
+COPY --from=caddy-source /out/caddy /usr/bin/caddy
+COPY --from=caddy-source /out/percher-healthcheck /usr/bin/percher-healthcheck
+COPY Caddyfile /etc/caddy/Caddyfile
+COPY --from=build /app/dist /srv
+LABEL dev.percher.health-client="static-http-v1"
+# HOME points at the writable tmpfs so non-root Caddy can persist its
+# XDG state (storage-clean lock, config autosave) under Percher's
+# read-only root filesystem.
+ENV HOME=/tmp
+USER 10001:10001
+EXPOSE 8080
+CMD ["caddy", "run", "--config", "/etc/caddy/Caddyfile", "--adapter", "caddyfile"]

package/dist/templates/solid/PERCHER-TEMPLATE-LICENSE.txt

@@ -0,0 +1,14 @@
+BSD Zero Clause License (0BSD)
+
+Copyright (c) 2026 Mattias Malmborg
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+PERFORMANCE OF THIS SOFTWARE.

package/dist/templates/static/PERCHER-TEMPLATE-LICENSE.txt

@@ -0,0 +1,14 @@
+BSD Zero Clause License (0BSD)
+
+Copyright (c) 2026 Mattias Malmborg
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+PERFORMANCE OF THIS SOFTWARE.

package/dist/templates/sveltekit/PERCHER-TEMPLATE-LICENSE.txt

@@ -0,0 +1,14 @@
+BSD Zero Clause License (0BSD)
+
+Copyright (c) 2026 Mattias Malmborg
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+PERFORMANCE OF THIS SOFTWARE.

package/dist/templates/sveltekit/package.json

@@ -14,6 +14,6 @@
     "@sveltejs/kit": "^2.5.0",
     "@sveltejs/vite-plugin-svelte": "^5.0.0",
     "svelte": "^5.0.0",
-    "vite": "^5.4.0"
+    "vite": "^6.0.0"
   }
 }

package/dist/templates/vite-react/Dockerfile

@@ -1,35 +1,51 @@
-# Multi-stage build: a Bun stage compiles the static bundle, then a
-# minimal Caddy image serves it. This project uses runtime = "docker"
-# (not "static") because Percher's static runtime serves pre-built
-# files only — it does not run a build command. Generated by Percher;
-# safe to edit and own.
-
-# --- Build stage: install deps and build the static bundle -----------
-FROM oven/bun:1-alpine AS build
-WORKDIR /app
-COPY . .
-RUN bun install && bun run build
-
-# --- Serve stage: minimal Caddy image --------------------------------
-# caddy:2-alpine ships /usr/bin/caddy with cap_net_bind_service file
-# caps. Percher runs every container with --security-opt
-# no-new-privileges, which makes execve refuse a cap-bearing binary
-# (an "operation not permitted" crash-loop). Copy Caddy onto a plain
-# alpine base and strip the caps with setcap -r — Caddy never needs
-# the cap here, it listens on :8080 (>= 1024).
-FROM caddy:2-alpine AS caddy-source
-FROM alpine:3.21
-COPY --from=caddy-source /usr/bin/caddy /usr/bin/caddy
-RUN apk add --no-cache libcap \
- && (setcap -r /usr/bin/caddy 2>/dev/null || true) \
- && test -z "$(getcap /usr/bin/caddy)" \
- && apk del libcap \
- && rm -rf /var/cache/apk/*
-COPY Caddyfile /etc/caddy/Caddyfile
-COPY --from=build /app/dist /srv
-# HOME points at the writable tmpfs so non-root Caddy can persist its
-# XDG state (storage-clean lock, config autosave) under Percher's
-# read-only root filesystem.
-ENV HOME=/tmp
-EXPOSE 8080
-CMD ["caddy", "run", "--config", "/etc/caddy/Caddyfile", "--adapter", "caddyfile"]
+# Multi-stage build: a Bun stage compiles the static bundle, then a
+# minimal Caddy image serves it. This project uses runtime = "docker"
+# (not "static") because Percher's static runtime serves pre-built
+# files only — it does not run a build command. Generated by Percher;
+# safe to edit and own.
+
+# --- Build stage: install deps and build the static bundle -----------
+FROM oven/bun:1-alpine AS build
+WORKDIR /app
+COPY . .
+RUN bun install && bun run build
+
+# --- Serve stage: minimal Caddy image --------------------------------
+# Build pinned Caddy source with refreshed security modules. The scratch
+# runtime carries no shell, package manager, or file capabilities and listens
+# on the unprivileged port :8080.
+FROM golang:1.26.7-alpine3.23@sha256:b17af760035fc2f338eed92d448a6c67f2d45438844fc6c60678fa5f99e44b57 AS caddy-source
+ADD --checksum=sha256:78e660d838e45c0b8c89338b325946238f153641aa9925df9ef2ad5e8eced31b \
+  https://github.com/caddyserver/caddy/commit/b2693fb63a30e6d7be0972c3645e9a2c0a500e93.patch /tmp/caddy-cel-go.patch
+RUN go mod download github.com/caddyserver/caddy/v2@v2.11.4 \
+ && cp -R /go/pkg/mod/github.com/caddyserver/caddy/v2@v2.11.4 /src \
+ && chmod -R u+w /src
+WORKDIR /src
+RUN apk add --no-cache patch \
+ && patch -p1 < /tmp/caddy-cel-go.patch \
+ && go get github.com/go-chi/chi/v5@v5.3.0 github.com/google/cel-go@v0.29.2 \
+      github.com/klauspost/compress@v1.18.7 go.opentelemetry.io/otel@v1.44.0 \
+      golang.org/x/crypto@v0.55.0 golang.org/x/net@v0.58.0 \
+      golang.org/x/text@v0.41.0 google.golang.org/grpc@v1.83.2 \
+ && go mod tidy \
+ && CGO_ENABLED=0 go build -trimpath -ldflags "-s -w" -o /out/caddy ./cmd/caddy \
+ && printf '%s\n' \
+      'package main' \
+      'import ("net/http"; "os"; "time")' \
+      'func main(){ if len(os.Args)!=2 { os.Exit(2) }; c:=http.Client{Timeout:2500*time.Millisecond,Transport:&http.Transport{Proxy:nil},CheckRedirect:func(_ *http.Request,_ []*http.Request) error{return http.ErrUseLastResponse}}; r,e:=c.Get(os.Args[1]); if e!=nil { os.Exit(1) }; defer r.Body.Close(); if r.StatusCode!=http.StatusOK { os.Exit(1) } }' \
+      > /tmp/percher-healthcheck.go \
+ && CGO_ENABLED=0 go build -trimpath -ldflags "-s -w" -o /out/percher-healthcheck /tmp/percher-healthcheck.go
+FROM scratch
+COPY --from=caddy-source /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
+COPY --from=caddy-source /out/caddy /usr/bin/caddy
+COPY --from=caddy-source /out/percher-healthcheck /usr/bin/percher-healthcheck
+COPY Caddyfile /etc/caddy/Caddyfile
+COPY --from=build /app/dist /srv
+LABEL dev.percher.health-client="static-http-v1"
+# HOME points at the writable tmpfs so non-root Caddy can persist its
+# XDG state (storage-clean lock, config autosave) under Percher's
+# read-only root filesystem.
+ENV HOME=/tmp
+USER 10001:10001
+EXPOSE 8080
+CMD ["caddy", "run", "--config", "/etc/caddy/Caddyfile", "--adapter", "caddyfile"]

package/dist/templates/vite-react/PERCHER-TEMPLATE-LICENSE.txt

@@ -0,0 +1,14 @@
+BSD Zero Clause License (0BSD)
+
+Copyright (c) 2026 Mattias Malmborg
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+PERFORMANCE OF THIS SOFTWARE.