percher 0.5.24 → 1.0.0

package/dist/templates/eleventy/Dockerfile

@@ -1,35 +1,51 @@
-# Multi-stage build: a Bun stage compiles the static bundle, then a
-# minimal Caddy image serves it. This project uses runtime = "docker"
-# (not "static") because Percher's static runtime serves pre-built
-# files only — it does not run a build command. Generated by Percher;
-# safe to edit and own.
-
-# --- Build stage: install deps and build the static bundle -----------
-FROM oven/bun:1-alpine AS build
-WORKDIR /app
-COPY . .
-RUN bun install && bun run build
-
-# --- Serve stage: minimal Caddy image --------------------------------
-# caddy:2-alpine ships /usr/bin/caddy with cap_net_bind_service file
-# caps. Percher runs every container with --security-opt
-# no-new-privileges, which makes execve refuse a cap-bearing binary
-# (an "operation not permitted" crash-loop). Copy Caddy onto a plain
-# alpine base and strip the caps with setcap -r — Caddy never needs
-# the cap here, it listens on :8080 (>= 1024).
-FROM caddy:2-alpine AS caddy-source
-FROM alpine:3.21
-COPY --from=caddy-source /usr/bin/caddy /usr/bin/caddy
-RUN apk add --no-cache libcap \
- && (setcap -r /usr/bin/caddy 2>/dev/null || true) \
- && test -z "$(getcap /usr/bin/caddy)" \
- && apk del libcap \
- && rm -rf /var/cache/apk/*
-COPY Caddyfile /etc/caddy/Caddyfile
-COPY --from=build /app/_site /srv
-# HOME points at the writable tmpfs so non-root Caddy can persist its
-# XDG state (storage-clean lock, config autosave) under Percher's
-# read-only root filesystem.
-ENV HOME=/tmp
-EXPOSE 8080
-CMD ["caddy", "run", "--config", "/etc/caddy/Caddyfile", "--adapter", "caddyfile"]
+# Multi-stage build: a Bun stage compiles the static bundle, then a
+# minimal Caddy image serves it. This project uses runtime = "docker"
+# (not "static") because Percher's static runtime serves pre-built
+# files only — it does not run a build command. Generated by Percher;
+# safe to edit and own.
+
+# --- Build stage: install deps and build the static bundle -----------
+FROM oven/bun:1-alpine AS build
+WORKDIR /app
+COPY . .
+RUN bun install && bun run build
+
+# --- Serve stage: minimal Caddy image --------------------------------
+# Build pinned Caddy source with refreshed security modules. The scratch
+# runtime carries no shell, package manager, or file capabilities and listens
+# on the unprivileged port :8080.
+FROM golang:1.26.7-alpine3.23@sha256:b17af760035fc2f338eed92d448a6c67f2d45438844fc6c60678fa5f99e44b57 AS caddy-source
+ADD --checksum=sha256:78e660d838e45c0b8c89338b325946238f153641aa9925df9ef2ad5e8eced31b \
+  https://github.com/caddyserver/caddy/commit/b2693fb63a30e6d7be0972c3645e9a2c0a500e93.patch /tmp/caddy-cel-go.patch
+RUN go mod download github.com/caddyserver/caddy/v2@v2.11.4 \
+ && cp -R /go/pkg/mod/github.com/caddyserver/caddy/v2@v2.11.4 /src \
+ && chmod -R u+w /src
+WORKDIR /src
+RUN apk add --no-cache patch \
+ && patch -p1 < /tmp/caddy-cel-go.patch \
+ && go get github.com/go-chi/chi/v5@v5.3.0 github.com/google/cel-go@v0.29.2 \
+      github.com/klauspost/compress@v1.18.7 go.opentelemetry.io/otel@v1.44.0 \
+      golang.org/x/crypto@v0.55.0 golang.org/x/net@v0.58.0 \
+      golang.org/x/text@v0.41.0 google.golang.org/grpc@v1.83.2 \
+ && go mod tidy \
+ && CGO_ENABLED=0 go build -trimpath -ldflags "-s -w" -o /out/caddy ./cmd/caddy \
+ && printf '%s\n' \
+      'package main' \
+      'import ("net/http"; "os"; "time")' \
+      'func main(){ if len(os.Args)!=2 { os.Exit(2) }; c:=http.Client{Timeout:2500*time.Millisecond,Transport:&http.Transport{Proxy:nil},CheckRedirect:func(_ *http.Request,_ []*http.Request) error{return http.ErrUseLastResponse}}; r,e:=c.Get(os.Args[1]); if e!=nil { os.Exit(1) }; defer r.Body.Close(); if r.StatusCode!=http.StatusOK { os.Exit(1) } }' \
+      > /tmp/percher-healthcheck.go \
+ && CGO_ENABLED=0 go build -trimpath -ldflags "-s -w" -o /out/percher-healthcheck /tmp/percher-healthcheck.go
+FROM scratch
+COPY --from=caddy-source /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
+COPY --from=caddy-source /out/caddy /usr/bin/caddy
+COPY --from=caddy-source /out/percher-healthcheck /usr/bin/percher-healthcheck
+COPY Caddyfile /etc/caddy/Caddyfile
+COPY --from=build /app/_site /srv
+LABEL dev.percher.health-client="static-http-v1"
+# HOME points at the writable tmpfs so non-root Caddy can persist its
+# XDG state (storage-clean lock, config autosave) under Percher's
+# read-only root filesystem.
+ENV HOME=/tmp
+USER 10001:10001
+EXPOSE 8080
+CMD ["caddy", "run", "--config", "/etc/caddy/Caddyfile", "--adapter", "caddyfile"]

package/dist/templates/eleventy/PERCHER-TEMPLATE-LICENSE.txt

@@ -0,0 +1,14 @@
+BSD Zero Clause License (0BSD)
+
+Copyright (c) 2026 Mattias Malmborg
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+PERFORMANCE OF THIS SOFTWARE.

package/dist/templates/elysia/PERCHER-TEMPLATE-LICENSE.txt

@@ -0,0 +1,14 @@
+BSD Zero Clause License (0BSD)
+
+Copyright (c) 2026 Mattias Malmborg
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+PERFORMANCE OF THIS SOFTWARE.

package/dist/templates/express/PERCHER-TEMPLATE-LICENSE.txt

@@ -0,0 +1,14 @@
+BSD Zero Clause License (0BSD)
+
+Copyright (c) 2026 Mattias Malmborg
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+PERFORMANCE OF THIS SOFTWARE.

package/dist/templates/express/package.json

@@ -2,8 +2,9 @@
   "name": "__APP_NAME__",
   "version": "0.1.0",
   "private": true,
+  "type": "module",
   "scripts": {
-    "start": "bun run index.ts"
+    "start": "node index.ts"
   },
   "dependencies": {
     "express": "^5.0.0"

package/dist/templates/fastify/PERCHER-TEMPLATE-LICENSE.txt

@@ -0,0 +1,14 @@
+BSD Zero Clause License (0BSD)
+
+Copyright (c) 2026 Mattias Malmborg
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+PERFORMANCE OF THIS SOFTWARE.

package/dist/templates/fastify/package.json

@@ -2,8 +2,9 @@
   "name": "__APP_NAME__",
   "version": "0.1.0",
   "private": true,
+  "type": "module",
   "scripts": {
-    "start": "bun run index.ts"
+    "start": "node index.ts"
   },
   "dependencies": {
     "fastify": "^5.0.0"

package/dist/templates/flask/PERCHER-TEMPLATE-LICENSE.txt

@@ -0,0 +1,14 @@
+BSD Zero Clause License (0BSD)
+
+Copyright (c) 2026 Mattias Malmborg
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+PERFORMANCE OF THIS SOFTWARE.

package/dist/templates/flask/percher.toml

@@ -4,6 +4,7 @@ runtime = "python"
 framework = "flask"
 
 [web]
+command = "gunicorn main:app --bind 0.0.0.0:5000"
 port = 5000
 health = "/health"
 

package/dist/templates/flask/requirements.txt

@@ -1 +1,2 @@
 flask>=3.0.0
+gunicorn>=22.0

package/dist/templates/go/PERCHER-TEMPLATE-LICENSE.txt

@@ -0,0 +1,14 @@
+BSD Zero Clause License (0BSD)
+
+Copyright (c) 2026 Mattias Malmborg
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+PERFORMANCE OF THIS SOFTWARE.

package/dist/templates/hono/PERCHER-TEMPLATE-LICENSE.txt

@@ -0,0 +1,14 @@
+BSD Zero Clause License (0BSD)
+
+Copyright (c) 2026 Mattias Malmborg
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+PERFORMANCE OF THIS SOFTWARE.

package/dist/templates/hono/index.ts

@@ -1,3 +1,4 @@
+import { serve } from "@hono/node-server";
 import { Hono } from "hono";
 
 const app = new Hono();
@@ -6,7 +7,8 @@ app.get("/health", (c) => c.json({ status: "ok" }));
 
 app.get("/", (c) => c.text("Hello from __APP_NAME__!"));
 
-export default {
+serve({
+  hostname: "0.0.0.0",
   port: Number(process.env.PORT ?? 3000),
   fetch: app.fetch,
-};
+});

package/dist/templates/hono/package.json

@@ -2,10 +2,12 @@
   "name": "__APP_NAME__",
   "version": "0.1.0",
   "private": true,
+  "type": "module",
   "scripts": {
-    "start": "bun run index.ts"
+    "start": "node index.ts"
   },
   "dependencies": {
+    "@hono/node-server": "^1.19.17",
     "hono": "^4.0.0"
   }
 }

package/dist/templates/htmx/PERCHER-TEMPLATE-LICENSE.txt

@@ -0,0 +1,14 @@
+BSD Zero Clause License (0BSD)
+
+Copyright (c) 2026 Mattias Malmborg
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+PERFORMANCE OF THIS SOFTWARE.

package/dist/templates/htmx/package.json

@@ -4,7 +4,7 @@
   "private": true,
   "type": "module",
   "scripts": {
-    "start": "bun run index.ts"
+    "start": "node index.ts"
   },
   "dependencies": {
     "express": "^4.19.0"

package/dist/templates/hugo/Dockerfile

@@ -1,33 +1,49 @@
-# Multi-stage build: Hugo compiles the site, then a minimal Caddy
-# image serves it. runtime = "docker" because Percher's static runtime
-# serves pre-built files only — it does not run Hugo. Edit and own freely.
-
-# --- Build stage: compile the Hugo site ------------------------------
-FROM hugomods/hugo:exts-0.139.4 AS build
-WORKDIR /site
-COPY . .
-RUN hugo --minify
-
-# --- Serve stage: minimal Caddy image --------------------------------
-# caddy:2-alpine ships /usr/bin/caddy with cap_net_bind_service file
-# caps. Percher runs every container with --security-opt
-# no-new-privileges, which makes execve refuse a cap-bearing binary
-# (an "operation not permitted" crash-loop). Copy Caddy onto a plain
-# alpine base and strip the caps with setcap -r — Caddy never needs
-# the cap here, it listens on :8080 (>= 1024).
-FROM caddy:2-alpine AS caddy-source
-FROM alpine:3.21
-COPY --from=caddy-source /usr/bin/caddy /usr/bin/caddy
-RUN apk add --no-cache libcap \
- && (setcap -r /usr/bin/caddy 2>/dev/null || true) \
- && test -z "$(getcap /usr/bin/caddy)" \
- && apk del libcap \
- && rm -rf /var/cache/apk/*
-COPY Caddyfile /etc/caddy/Caddyfile
-COPY --from=build /site/public /srv
-# HOME points at the writable tmpfs so non-root Caddy can persist its
-# XDG state (storage-clean lock, config autosave) under Percher's
-# read-only root filesystem.
-ENV HOME=/tmp
-EXPOSE 8080
-CMD ["caddy", "run", "--config", "/etc/caddy/Caddyfile", "--adapter", "caddyfile"]
+# Multi-stage build: Hugo compiles the site, then a minimal Caddy
+# image serves it. runtime = "docker" because Percher's static runtime
+# serves pre-built files only — it does not run Hugo. Edit and own freely.
+
+# --- Build stage: compile the Hugo site ------------------------------
+FROM hugomods/hugo:exts-0.139.4 AS build
+WORKDIR /site
+COPY . .
+RUN hugo --minify
+
+# --- Serve stage: minimal Caddy image --------------------------------
+# Build pinned Caddy source with refreshed security modules. The scratch
+# runtime carries no shell, package manager, or file capabilities and listens
+# on the unprivileged port :8080.
+FROM golang:1.26.7-alpine3.23@sha256:b17af760035fc2f338eed92d448a6c67f2d45438844fc6c60678fa5f99e44b57 AS caddy-source
+ADD --checksum=sha256:78e660d838e45c0b8c89338b325946238f153641aa9925df9ef2ad5e8eced31b \
+  https://github.com/caddyserver/caddy/commit/b2693fb63a30e6d7be0972c3645e9a2c0a500e93.patch /tmp/caddy-cel-go.patch
+RUN go mod download github.com/caddyserver/caddy/v2@v2.11.4 \
+ && cp -R /go/pkg/mod/github.com/caddyserver/caddy/v2@v2.11.4 /src \
+ && chmod -R u+w /src
+WORKDIR /src
+RUN apk add --no-cache patch \
+ && patch -p1 < /tmp/caddy-cel-go.patch \
+ && go get github.com/go-chi/chi/v5@v5.3.0 github.com/google/cel-go@v0.29.2 \
+      github.com/klauspost/compress@v1.18.7 go.opentelemetry.io/otel@v1.44.0 \
+      golang.org/x/crypto@v0.55.0 golang.org/x/net@v0.58.0 \
+      golang.org/x/text@v0.41.0 google.golang.org/grpc@v1.83.2 \
+ && go mod tidy \
+ && CGO_ENABLED=0 go build -trimpath -ldflags "-s -w" -o /out/caddy ./cmd/caddy \
+ && printf '%s\n' \
+      'package main' \
+      'import ("net/http"; "os"; "time")' \
+      'func main(){ if len(os.Args)!=2 { os.Exit(2) }; c:=http.Client{Timeout:2500*time.Millisecond,Transport:&http.Transport{Proxy:nil},CheckRedirect:func(_ *http.Request,_ []*http.Request) error{return http.ErrUseLastResponse}}; r,e:=c.Get(os.Args[1]); if e!=nil { os.Exit(1) }; defer r.Body.Close(); if r.StatusCode!=http.StatusOK { os.Exit(1) } }' \
+      > /tmp/percher-healthcheck.go \
+ && CGO_ENABLED=0 go build -trimpath -ldflags "-s -w" -o /out/percher-healthcheck /tmp/percher-healthcheck.go
+FROM scratch
+COPY --from=caddy-source /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
+COPY --from=caddy-source /out/caddy /usr/bin/caddy
+COPY --from=caddy-source /out/percher-healthcheck /usr/bin/percher-healthcheck
+COPY Caddyfile /etc/caddy/Caddyfile
+COPY --from=build /site/public /srv
+LABEL dev.percher.health-client="static-http-v1"
+# HOME points at the writable tmpfs so non-root Caddy can persist its
+# XDG state (storage-clean lock, config autosave) under Percher's
+# read-only root filesystem.
+ENV HOME=/tmp
+USER 10001:10001
+EXPOSE 8080
+CMD ["caddy", "run", "--config", "/etc/caddy/Caddyfile", "--adapter", "caddyfile"]

package/dist/templates/hugo/PERCHER-TEMPLATE-LICENSE.txt

@@ -0,0 +1,14 @@
+BSD Zero Clause License (0BSD)
+
+Copyright (c) 2026 Mattias Malmborg
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+PERFORMANCE OF THIS SOFTWARE.

package/dist/templates/java/PERCHER-TEMPLATE-LICENSE.txt

@@ -0,0 +1,14 @@
+BSD Zero Clause License (0BSD)
+
+Copyright (c) 2026 Mattias Malmborg
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+PERFORMANCE OF THIS SOFTWARE.

package/dist/templates/laravel/PERCHER-TEMPLATE-LICENSE.txt

@@ -0,0 +1,14 @@
+BSD Zero Clause License (0BSD)
+
+Copyright (c) 2026 Mattias Malmborg
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+PERFORMANCE OF THIS SOFTWARE.

package/dist/templates/nextjs/PERCHER-TEMPLATE-LICENSE.txt

@@ -0,0 +1,14 @@
+BSD Zero Clause License (0BSD)
+
+Copyright (c) 2026 Mattias Malmborg
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+PERFORMANCE OF THIS SOFTWARE.

package/dist/templates/node/PERCHER-TEMPLATE-LICENSE.txt

@@ -0,0 +1,14 @@
+BSD Zero Clause License (0BSD)
+
+Copyright (c) 2026 Mattias Malmborg
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+PERFORMANCE OF THIS SOFTWARE.

package/dist/templates/nuxt/PERCHER-TEMPLATE-LICENSE.txt

@@ -0,0 +1,14 @@
+BSD Zero Clause License (0BSD)
+
+Copyright (c) 2026 Mattias Malmborg
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+PERFORMANCE OF THIS SOFTWARE.

package/dist/templates/phoenix/PERCHER-TEMPLATE-LICENSE.txt

@@ -0,0 +1,14 @@
+BSD Zero Clause License (0BSD)
+
+Copyright (c) 2026 Mattias Malmborg
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+PERFORMANCE OF THIS SOFTWARE.

package/dist/templates/preact/Dockerfile

@@ -1,35 +1,51 @@
-# Multi-stage build: a Bun stage compiles the static bundle, then a
-# minimal Caddy image serves it. This project uses runtime = "docker"
-# (not "static") because Percher's static runtime serves pre-built
-# files only — it does not run a build command. Generated by Percher;
-# safe to edit and own.
-
-# --- Build stage: install deps and build the static bundle -----------
-FROM oven/bun:1-alpine AS build
-WORKDIR /app
-COPY . .
-RUN bun install && bun run build
-
-# --- Serve stage: minimal Caddy image --------------------------------
-# caddy:2-alpine ships /usr/bin/caddy with cap_net_bind_service file
-# caps. Percher runs every container with --security-opt
-# no-new-privileges, which makes execve refuse a cap-bearing binary
-# (an "operation not permitted" crash-loop). Copy Caddy onto a plain
-# alpine base and strip the caps with setcap -r — Caddy never needs
-# the cap here, it listens on :8080 (>= 1024).
-FROM caddy:2-alpine AS caddy-source
-FROM alpine:3.21
-COPY --from=caddy-source /usr/bin/caddy /usr/bin/caddy
-RUN apk add --no-cache libcap \
- && (setcap -r /usr/bin/caddy 2>/dev/null || true) \
- && test -z "$(getcap /usr/bin/caddy)" \
- && apk del libcap \
- && rm -rf /var/cache/apk/*
-COPY Caddyfile /etc/caddy/Caddyfile
-COPY --from=build /app/dist /srv
-# HOME points at the writable tmpfs so non-root Caddy can persist its
-# XDG state (storage-clean lock, config autosave) under Percher's
-# read-only root filesystem.
-ENV HOME=/tmp
-EXPOSE 8080
-CMD ["caddy", "run", "--config", "/etc/caddy/Caddyfile", "--adapter", "caddyfile"]
+# Multi-stage build: a Bun stage compiles the static bundle, then a
+# minimal Caddy image serves it. This project uses runtime = "docker"
+# (not "static") because Percher's static runtime serves pre-built
+# files only — it does not run a build command. Generated by Percher;
+# safe to edit and own.
+
+# --- Build stage: install deps and build the static bundle -----------
+FROM oven/bun:1-alpine AS build
+WORKDIR /app
+COPY . .
+RUN bun install && bun run build
+
+# --- Serve stage: minimal Caddy image --------------------------------
+# Build pinned Caddy source with refreshed security modules. The scratch
+# runtime carries no shell, package manager, or file capabilities and listens
+# on the unprivileged port :8080.
+FROM golang:1.26.7-alpine3.23@sha256:b17af760035fc2f338eed92d448a6c67f2d45438844fc6c60678fa5f99e44b57 AS caddy-source
+ADD --checksum=sha256:78e660d838e45c0b8c89338b325946238f153641aa9925df9ef2ad5e8eced31b \
+  https://github.com/caddyserver/caddy/commit/b2693fb63a30e6d7be0972c3645e9a2c0a500e93.patch /tmp/caddy-cel-go.patch
+RUN go mod download github.com/caddyserver/caddy/v2@v2.11.4 \
+ && cp -R /go/pkg/mod/github.com/caddyserver/caddy/v2@v2.11.4 /src \
+ && chmod -R u+w /src
+WORKDIR /src
+RUN apk add --no-cache patch \
+ && patch -p1 < /tmp/caddy-cel-go.patch \
+ && go get github.com/go-chi/chi/v5@v5.3.0 github.com/google/cel-go@v0.29.2 \
+      github.com/klauspost/compress@v1.18.7 go.opentelemetry.io/otel@v1.44.0 \
+      golang.org/x/crypto@v0.55.0 golang.org/x/net@v0.58.0 \
+      golang.org/x/text@v0.41.0 google.golang.org/grpc@v1.83.2 \
+ && go mod tidy \
+ && CGO_ENABLED=0 go build -trimpath -ldflags "-s -w" -o /out/caddy ./cmd/caddy \
+ && printf '%s\n' \
+      'package main' \
+      'import ("net/http"; "os"; "time")' \
+      'func main(){ if len(os.Args)!=2 { os.Exit(2) }; c:=http.Client{Timeout:2500*time.Millisecond,Transport:&http.Transport{Proxy:nil},CheckRedirect:func(_ *http.Request,_ []*http.Request) error{return http.ErrUseLastResponse}}; r,e:=c.Get(os.Args[1]); if e!=nil { os.Exit(1) }; defer r.Body.Close(); if r.StatusCode!=http.StatusOK { os.Exit(1) } }' \
+      > /tmp/percher-healthcheck.go \
+ && CGO_ENABLED=0 go build -trimpath -ldflags "-s -w" -o /out/percher-healthcheck /tmp/percher-healthcheck.go
+FROM scratch
+COPY --from=caddy-source /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
+COPY --from=caddy-source /out/caddy /usr/bin/caddy
+COPY --from=caddy-source /out/percher-healthcheck /usr/bin/percher-healthcheck
+COPY Caddyfile /etc/caddy/Caddyfile
+COPY --from=build /app/dist /srv
+LABEL dev.percher.health-client="static-http-v1"
+# HOME points at the writable tmpfs so non-root Caddy can persist its
+# XDG state (storage-clean lock, config autosave) under Percher's
+# read-only root filesystem.
+ENV HOME=/tmp
+USER 10001:10001
+EXPOSE 8080
+CMD ["caddy", "run", "--config", "/etc/caddy/Caddyfile", "--adapter", "caddyfile"]

package/dist/templates/preact/PERCHER-TEMPLATE-LICENSE.txt

@@ -0,0 +1,14 @@
+BSD Zero Clause License (0BSD)
+
+Copyright (c) 2026 Mattias Malmborg
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+PERFORMANCE OF THIS SOFTWARE.

package/dist/templates/python/PERCHER-TEMPLATE-LICENSE.txt

@@ -0,0 +1,14 @@
+BSD Zero Clause License (0BSD)
+
+Copyright (c) 2026 Mattias Malmborg
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+PERFORMANCE OF THIS SOFTWARE.

package/dist/templates/rails/PERCHER-TEMPLATE-LICENSE.txt

@@ -0,0 +1,14 @@
+BSD Zero Clause License (0BSD)
+
+Copyright (c) 2026 Mattias Malmborg
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+PERFORMANCE OF THIS SOFTWARE.