redkite 0.1.12 → 0.1.14

package/src/services/proxy.ts

@@ -1,5 +1,5 @@
 import type { AppTopology, Topology } from "../topology.js";
-import type { Deployment, ProxySpec, ServiceSpec } from "../types.js";
+import type { Deployment, ProxyLogs, ProxySpec, ServiceSpec } from "../types.js";
 
 // The proxy every route is resolved by: what it is, and the configuration it
 // runs. Both halves here, because a deployment does not list this service and
@@ -30,6 +30,9 @@ export const LISTEN_PORT = 3000;
 // container claiming the first one's, so the config surface refuses it
 export const PROXY = "nginx";
 
+// Where nginx writes inside its container. A log directory is mounted here
+export const LOG_DIRECTORY = "/var/log/nginx";
+
 // Not something a deployment lists. Apps carry routes, routes need something
 // to resolve them, and this says what that something is
 export function proxyService(config: Deployment): ServiceSpec {
@@ -41,16 +44,22 @@ export function proxyService(config: Deployment): ServiceSpec {
 }
 
 export function renderProxy(topology: Topology, proxy: ProxySpec = {}) {
+  assertNotDerived(proxy.server ?? []);
+  assertLocations(topology, proxy);
+
   const upstreams = topology.apps.map((app) => upstream(app)).join("\n\n");
   // Longest route first, so "/api/" is not shadowed by the "/" catch-all
   const ordered = [...topology.apps].sort((a, b) => b.route.length - a.route.length);
-  const locations = ordered.map((app) => location(app, proxy.location ?? [])).join("\n\n");
 
-  assertNotDerived(proxy.server ?? []);
+  const locations = ordered
+    .map((app) => location(app, [...(proxy.location ?? []), ...(proxy.locations?.[app.name] ?? [])]))
+    .join("\n\n");
 
+  // Logging leads the lines written by hand, so an access_log there replaces it
   const server = settled([
     `merge_slashes off;`,
     `client_max_body_size ${proxy.maxBodySize ?? "1M"};`,
+    ...logging(proxy.logs, topology.environment),
     ...(proxy.server ?? []),
   ]);
 
@@ -101,6 +110,65 @@ function assertNotDerived(lines: string[]) {
   );
 }
 
+// Nothing for a deployment that says nothing, so a proxy it already runs is not
+// recreated for a config that means the same. error_log has no off: the
+// quietest it gets is emerg, written nowhere
+function logging(logs: false | ProxyLogs | undefined, environment: string) {
+  if (logs === undefined) return [];
+  if (logs === false) return ["access_log off;", "error_log /dev/null emerg;"];
+
+  // Named for the environment, since two environments on one host may be given
+  // the same directory
+  const access = logs.directory ? `${LOG_DIRECTORY}/${environment}.access.log` : "/dev/stdout";
+  const error = logs.directory ? `${LOG_DIRECTORY}/${environment}.error.log` : "/dev/stderr";
+
+  return [
+    logs.access === false ? "access_log off;" : `access_log ${access};`,
+    `error_log ${error} ${logs.errors ?? "error"};`,
+  ];
+}
+
+// The host directory a deployment's logs land in, mounted where nginx writes.
+// Absolute, because docker reads anything else as the name of a volume and the
+// logs would go somewhere nobody asked for
+export function logMount(proxy: ProxySpec | undefined) {
+  const directory = proxy?.logs ? proxy.logs.directory : undefined;
+  if (directory === undefined) return undefined;
+
+  if (!directory.startsWith("/") || /[:,]/.test(directory)) {
+    throw new Error(
+      `The proxy logs to ${directory}, which has to be an absolute path on the deploy ` +
+        "host with no colon or comma in it: docker reads anything else as a volume name",
+    );
+  }
+
+  return { volume: directory, mountPath: LOG_DIRECTORY };
+}
+
+// An app name nobody has is a typo, and a location it named would otherwise be
+// settings nothing reads. proxy_pass is what routes the location to its app, so
+// replacing it is not a setting but a broken route
+function assertLocations(topology: Topology, proxy: ProxySpec) {
+  const apps = new Set(topology.apps.map((app) => app.name));
+  const unknown = Object.keys(proxy.locations ?? {}).filter((name) => !apps.has(name));
+
+  if (unknown.length > 0) {
+    throw new Error(
+      `The proxy sets locations for ${unknown.join(", ")}, which this deployment has ` +
+        `no app by that name for. Its apps are ${[...apps].join(", ")}`,
+    );
+  }
+
+  const lines = [...(proxy.location ?? []), ...Object.values(proxy.locations ?? {}).flat()];
+  const routing = lines.find((line) => directive(line) === "proxy_pass");
+  if (!routing) return;
+
+  throw new Error(
+    `A proxy location says ${routing.trim()}, and where a location sends a request ` +
+      "is its app's route, which redkite derives",
+  );
+}
+
 function indented(lines: string[], by: number) {
   return lines.map((line) => " ".repeat(by) + line).join("\n");
 }

package/src/source.ts

@@ -1,4 +1,5 @@
 import type { Host } from "./host.js";
+import { tag } from "./log.js";
 
 // Getting the source onto the machine that builds it. A repository the host
 // clones for itself over the forwarded agent, so no tree crosses the wire: a
@@ -45,6 +46,29 @@ const REVISION: Record<RefKind, (name: string) => string> = {
   commit: (name) => `${name}^{commit}`,
 };
 
+// Hosts common enough to be worth a tag in place of their name
+const HOSTS: Record<string, string> = { "github.com": "GH" };
+
+// user@host:path, or scheme://user@host/path, with the .git every clone URL ends
+// in. Anything that is not one of those, a directory for instance, has no host
+const REMOTE = /^(?:[a-z][a-z0-9+.-]*:\/\/)?(?:[^@/]+@)?([^:/]+)[:/](.+?)(?:\.git)?\/?$/;
+
+// How a repository is named on screen: the host as a tag where it is a known
+// one, and the path without the .git that says nothing a person needs
+export function describeRepo(repo: string) {
+  const match = REMOTE.exec(repo);
+  if (!match?.[1] || !match[2]) return repo.replace(/\.git$/, "");
+
+  const known = HOSTS[match[1]];
+  return known ? `${tag(known)} ${match[2]}` : `${match[1]}:${match[2]}`;
+}
+
+// A branch is what is tracked nearly always, so it goes by its name alone. A tag
+// or a commit is a pin, and says which kind it is
+export function describeRef(ref: Ref) {
+  return ref.kind === "branch" ? ref.name : `${ref.kind} ${ref.name}`;
+}
+
 // accept-new rather than no: a host key that changes is still worth refusing
 const GIT_SSH = "ssh -o StrictHostKeyChecking=accept-new";
 

package/src/topology.ts

@@ -2,6 +2,7 @@ import type { AppSpec, Deployment, ServiceSpec } from "./types.js";
 
 import { environmentOf } from "./config.js";
 import { mountFor } from "./layout.js";
+import { logMount } from "./services/proxy.js";
 
 // Every name and address the deployment uses, derived from the app list. This
 // is the file that replaces the constants block: nothing is chosen by hand, so
@@ -92,7 +93,9 @@ export function topologyFor(config: Deployment, environment: string): Topology {
       name: "nginx",
       container: `${prefix}-nginx`,
       address: address(NGINX_OCTET),
-      volumes: [],
+      // Only a directory the deployment named. Nothing mounted otherwise, so a
+      // proxy that says nothing about its logs is the container it always was
+      volumes: routerVolumes(config),
     },
     apps,
     services,
@@ -165,6 +168,11 @@ function serviceTopology(
   };
 }
 
+function routerVolumes(config: Deployment) {
+  const logs = logMount(config.proxy);
+  return logs ? [logs] : [];
+}
+
 // Nginx resolves upstreams by container name, apps reach services by alias
 function extraHosts(
   apps: AppTopology[],

package/src/types.ts

@@ -92,6 +92,24 @@ export type ProxySpec = {
   // Lines put inside every location, below what redkite sets, so one of these
   // replaces a header rather than being replaced by it
   location?: string[];
+  // Lines for one app's location alone, keyed by the app's name. Below the lines
+  // every location gets, so one of these replaces those for that app only
+  locations?: Record<string, string[]>;
+  // Where the proxy writes what it logs, and whether it logs at all. Absent
+  // leaves it to the image, which writes to the container's own output
+  logs?: false | ProxyLogs;
+};
+
+export type ProxyLogs = {
+  // A directory on the deploy host, mounted where nginx writes its logs. Each
+  // environment writes files of its own into it. Absent keeps them on the
+  // container's output, where docker logs reads them
+  directory?: string;
+  // One line per request. On unless this says false
+  access?: boolean;
+  // How severe something has to be to reach the error log. nginx's own default
+  // is error
+  errors?: "debug" | "info" | "notice" | "warn" | "error" | "crit" | "alert" | "emerg";
 };
 
 export type ServiceSpec = {