unoverse 0.1.84 → 0.1.86

package/operator/ansible/playbooks/db-setup.yml

@@ -127,9 +127,33 @@
       register: migrate_result
       ignore_errors: yes
 
+    # THE WHOLE FILE IS NOT THE ANSWER TO "DID IT WORK". This printed every line of the
+    # baseline — several hundred lines of CREATE TABLE nobody asked to read, burying the one
+    # line that says whether anything ran. Keep the names and the verdict.
     - name: "[4/5] Migration output"
       debug:
-        msg: "{{ migrate_result.stdout_lines | default(['No output']) }}"
+        msg: >-
+          {{ (migrate_result.stdout_lines | default([]) | select('match', '^> - ') | list)
+             + (migrate_result.stdout_lines | default([]) | select('search', 'Migrations complete|No migrations') | list)
+             | default(['No output'], true) }}
+
+    # SERVICES BOOTED BEFORE THIS SCHEMA EXISTED. install.yml has to start the containers
+    # first — migrations run THROUGH the unoverse container, so there is nothing to run them
+    # in until it is up. The cost is that every service that touches the database at boot
+    # does so against an empty one: memory logged "permission denied for schema public" and
+    # then 'relation "memories" does not exist', and stayed in that state until something
+    # restarted it. Restarting here is the missing half of that ordering, and it only ever
+    # happens on a first setup.
+    - name: "[4b/5] Restart services against the migrated schema"
+      command: docker compose restart
+      args:
+        chdir: /opt/gravity
+      when: migrate_result.rc | default(1) == 0
+
+    - name: "[4b/5] Settle"
+      pause:
+        seconds: 15
+      when: migrate_result.rc | default(1) == 0
 
     - name: "[5/5] Verify database connectivity"
       uri:

package/operator/ansible/playbooks/test-connectivity.yml

@@ -134,36 +134,38 @@
       register: api_write_check
       ignore_errors: yes
 
-    - name: "[10/14] Check unoverse node catalog loaded"
+    # AN EMPTY CATALOGUE IS NOT A BROKEN ONE. Nodes arrive as rows — installed from the
+    # marketplace or published from Studio — so a universe on its first day has none, and
+    # that is the correct state, not a fault. This used to fail outright on zero and advise
+    # "run deploy.sh rebuild", a command that does not exist, which turned every first
+    # deploy into a red line pointing at nothing.
+    #
+    # What IS worth failing on is the runtime not answering at all: that means the catalogue
+    # could not be read, which is a different fact from it being empty.
+    - name: "[10/13] Check the node catalogue is readable"
       shell: |
         cd /opt/gravity
         # The internal :4106 runtime is Docker-network-only (never published), and the
         # public :4105 routes are JWT-gated — so read the catalog from INSIDE the
         # container. node:20-slim has no curl; use node fetch.
         NODE_COUNT=$(docker compose exec -T unoverse node -e \
-          "fetch('http://127.0.0.1:4106/nodes').then(r=>r.json()).then(d=>console.log((d.nodes||[]).length)).catch(()=>console.log(0))" 2>/dev/null | tr -d ' \r')
+          "fetch('http://127.0.0.1:4106/nodes').then(r=>r.json()).then(d=>console.log((d.nodes||[]).length)).catch(()=>console.log('unreachable'))" 2>/dev/null | tr -d ' \r')
+        if [ "$NODE_COUNT" = "unreachable" ]; then
+          echo "nodes=unreachable"
+          echo "The runtime did not answer on :4106 — the catalogue could not be read"
+          exit 1
+        fi
         echo "nodes=${NODE_COUNT}"
         if [ "${NODE_COUNT:-0}" -eq 0 ] 2>/dev/null; then
-          echo "WARNING: No nodes loaded — run deploy.sh rebuild or unoverse update"
-          exit 1
+          echo "(none installed yet — install from the marketplace or publish from Studio)"
         fi
       register: plugin_check
       ignore_errors: yes
 
-    - name: "[11/14] Check packages directory mounted"
-      shell: |
-        cd /opt/gravity
-        if docker compose exec -T unoverse ls /app/host_packages 2>/dev/null | head -5; then
-          PKG_COUNT=$(docker compose exec -T unoverse ls /app/host_packages 2>/dev/null | wc -l | tr -d ' ')
-          echo "packages_mounted=${PKG_COUNT}"
-          [ "$PKG_COUNT" -gt 0 ]
-        else
-          echo "packages_mounted=0"
-          echo "WARNING: No packages directory — run deploy.sh or unoverse update"
-          exit 1
-        fi
-      register: packages_check
-      ignore_errors: yes
+    # NO PACKAGES CHECK. It looked for /app/host_packages, a bind mount that was retired
+    # when nodes moved to npm at runtime plus the marketplace. Nothing declares
+    # PACKAGES_PATH any more and docker-compose.yml has no such volume, so the check could
+    # only ever report 0 and tell the operator to run a command that would not fix it.
 
     - name: "[12/14] Check for errors in service logs"
       shell: |
@@ -245,11 +247,9 @@
           ── Prompt Blocks (internal :4106) ──
             {{ prompt_blocks_check.stdout_lines[0] | default('(skipped)') }}
 
-          ── Plugins & Packages ──
-          Unoverse: {{ plugin_check.stdout_lines[0] | default('(skipped)') }}
+          ── Node catalogue ──
+          {{ plugin_check.stdout_lines[0] | default('(skipped)') }}
           {{ plugin_check.stdout_lines[1] | default('') }}
-          Packages: {{ packages_check.stdout_lines[0] | default('(skipped)') }}
-          {{ packages_check.stdout_lines[1] | default('') }}
 
           ── Recent Errors in Logs ──
           {{ log_errors.stdout | default('(skipped)') }}

package/operator/infra/aws/main.tf

@@ -493,7 +493,7 @@ resource "aws_iam_access_key" "bedrock" {
 resource "aws_acm_certificate" "public" {
   count                     = local.has_domain ? 1 : 0
   domain_name               = local.api_host
-  subject_alternative_names = var.canvas_public ? ["unoverse.${var.domain}"] : []
+  subject_alternative_names = var.canvas_public ? ["canvas.${var.domain}"] : []
   validation_method         = "DNS"
 
   lifecycle {
@@ -625,7 +625,7 @@ resource "aws_lb_listener_rule" "canvas" {
   }
   condition {
     host_header {
-      values = ["unoverse.${var.domain}"]
+      values = ["canvas.${var.domain}"]
     }
   }
 }
@@ -661,7 +661,7 @@ resource "aws_route53_record" "api" {
 resource "aws_route53_record" "unoverse" {
   count   = local.dns_auto && var.canvas_public ? 1 : 0
   zone_id = var.route53_zone_id
-  name    = "unoverse.${var.domain}"
+  name    = "canvas.${var.domain}"
   type    = "A"
 
   alias {

package/operator/infra/aws/outputs.tf

@@ -9,7 +9,7 @@ output "deploy_host" {
 }
 
 output "alb_dns_name" {
-  description = "Point api.<domain> (and unoverse.<domain> when canvas_public) at this — CNAME/ALIAS. Created automatically when route53_zone_id is set."
+  description = "Point api.<domain> (and canvas.<domain> when canvas_public) at this — CNAME/ALIAS. Created automatically when route53_zone_id is set."
   value       = aws_lb.public.dns_name
 }
 
@@ -24,7 +24,7 @@ output "acm_validation_records" {
 
 output "canvas_url" {
   description = "Public Canvas URL (canvas_public = true only) — add it to the client origins."
-  value       = var.canvas_public ? (local.has_domain ? "https://unoverse.${var.domain}" : "http://${aws_lb.public.dns_name}:3001") : "canvas is admin-only (direct http://<instance-ip>:3001 from admin_cidr)"
+  value       = var.canvas_public ? (local.has_domain ? "https://canvas.${var.domain}" : "http://${aws_lb.public.dns_name}:3001") : "canvas is admin-only (direct http://<instance-ip>:3001 from admin_cidr)"
 }
 
 output "api_url" {

package/operator/infra/digitalocean/main.tf

@@ -116,17 +116,18 @@ resource "digitalocean_firewall" "app" {
     port_range                = "4105"
     source_load_balancer_uids = [digitalocean_loadbalancer.public.id]
   }
-  # Canvas (operator UI): the DO LB has NO host-based routing (Caddy did), so the
-  # public LB carries ONLY the api host → :4105. Canvas is an OPERATOR tool —
-  # admin-only direct access, same trust ring as SSH and Dozzle. It still calls
-  # the platform at https://api.<domain> like any client.
-  # POC (canvas_public = true): :3001 ALSO accepts the public LB, which serves
-  # Canvas at https://api.<domain>:3001. Direct-IP access stays admin-only either way.
+  # Canvas (operator UI). Direct access to :3001 on the droplet stays admin-only, same
+  # trust ring as SSH and Dozzle, whatever else is true.
+  # With canvas_public: whichever load balancer fronts it may reach :3001 too — the canvas
+  # LB when there is a domain, the main one when there is not. Naming both here would open
+  # 3001 to an LB that is not serving Canvas in that mode.
   inbound_rule {
-    protocol                  = "tcp"
-    port_range                = "3001"
-    source_addresses          = [var.admin_cidr]
-    source_load_balancer_uids = var.canvas_public ? [digitalocean_loadbalancer.public.id] : []
+    protocol         = "tcp"
+    port_range       = "3001"
+    source_addresses = [var.admin_cidr]
+    source_load_balancer_uids = var.canvas_public ? (
+      local.has_domain ? [digitalocean_loadbalancer.canvas[0].id] : [digitalocean_loadbalancer.public.id]
+    ) : []
   }
 
   outbound_rule {
@@ -183,18 +184,16 @@ resource "digitalocean_loadbalancer" "public" {
     }
   }
 
-  # POC (canvas_public = true, DECIDED 2026-07-29): Canvas rides the SAME LB on a
-  # second port — https://canvas.<domain>:3001 (a SAN on the api certificate, an A record to this same LB). ONE load balancer total: DO LBs can't
-  # host-route, and a clean second hostname would cost a second LB; the POC takes
-  # the port in the URL instead. Domainless: same second port, plain HTTP.
+  # DOMAINLESS ONLY. Without a hostname there is nothing to route by, so Canvas takes a
+  # second port on this LB's IP. With a domain it gets its own load balancer below and a
+  # clean https://canvas.<domain> — see the note there.
   dynamic "forwarding_rule" {
-    for_each = var.canvas_public ? [1] : []
+    for_each = var.canvas_public && !local.has_domain ? [1] : []
     content {
-      entry_port       = 3001
-      entry_protocol   = local.has_domain ? "https" : "http"
-      target_port      = 3001
-      target_protocol  = "http"
-      certificate_name = one(digitalocean_certificate.api[*].name)
+      entry_port      = 3001
+      entry_protocol  = "http"
+      target_port     = 3001
+      target_protocol = "http"
     }
   }
 
@@ -206,12 +205,49 @@ resource "digitalocean_loadbalancer" "public" {
   }
 }
 
+# CANVAS GETS ITS OWN LOAD BALANCER, so its URL carries no port.
+#
+# Supersedes the 2026-07-29 decision to run one LB and put :3001 in the URL. A port in a
+# hostname is not a URL anyone ships: it breaks the expectation that https means 443, it
+# has to be explained to every operator, and it leaks an implementation detail of the
+# ingress into the address bar. The reason for it was real — DigitalOcean load balancers
+# route on PORT only, never on the Host header, so one LB genuinely cannot serve two
+# hostnames — but the conclusion was wrong. The right answer to "the product cannot do
+# this" is a second load balancer, not a worse address.
+#
+# ~$12/month, and only when a domain is set AND Canvas is public. Domainless universes
+# keep the second port on the main LB above: with no hostname there is nothing to route by,
+# so a second LB would buy nothing.
+resource "digitalocean_loadbalancer" "canvas" {
+  count                     = local.has_domain && var.canvas_public ? 1 : 0
+  name                      = "${var.name}-canvas-lb"
+  region                    = var.region
+  droplet_ids               = [digitalocean_droplet.app.id]
+  redirect_http_to_https    = true
+  http_idle_timeout_seconds = 600
+
+  forwarding_rule {
+    entry_port       = 443
+    entry_protocol   = "https"
+    target_port      = 3001
+    target_protocol  = "http"
+    certificate_name = one(digitalocean_certificate.api[*].name)
+  }
+
+  # Canvas has no /health of its own; the root answering is the liveness signal.
+  healthcheck {
+    port     = 3001
+    protocol = "http"
+    path     = "/"
+  }
+}
+
 resource "digitalocean_record" "canvas" {
   count  = local.has_domain && var.canvas_public && var.manage_dns ? 1 : 0
   domain = var.domain
   type   = "A"
   name   = "canvas"
-  value  = digitalocean_loadbalancer.public.ip
+  value  = digitalocean_loadbalancer.canvas[0].ip
   ttl    = 300
 }
 

package/operator/infra/digitalocean/outputs.tf

@@ -44,7 +44,7 @@ output "lb_ip" {
 
 output "canvas_url" {
   description = "Public Canvas URL (canvas_public = true only) — add it to the IdP's allowed origins."
-  value       = var.canvas_public ? (local.has_domain ? "https://canvas.${var.domain}:3001" : "http://${digitalocean_loadbalancer.public.ip}:3001") : "canvas is admin-only (direct http://<droplet-ip>:3001 from admin_cidr)"
+  value       = var.canvas_public ? (local.has_domain ? "https://canvas.${var.domain}" : "http://${digitalocean_loadbalancer.public.ip}:3001") : "canvas is admin-only (direct http://<droplet-ip>:3001 from admin_cidr)"
 }
 
 output "api_url" {

package/operator/infra/digitalocean/prices.tf

@@ -35,6 +35,9 @@ locals {
     local.provision_pg ? lookup(local.prices, local.s.pg, 0) : 0,
     lookup(local.prices, local.s.redis, 0),
     local.prices["lb"],
+    # Canvas's own load balancer, so its URL needs no port. Only with a domain: without
+    # one it shares the main LB's IP on a second port and costs nothing extra.
+    local.has_domain && var.canvas_public ? local.prices["lb"] : 0,
   ])
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unoverse",
-  "version": "0.1.84",
+  "version": "0.1.86",
   "description": "The Unoverse front door — create a Studio project, a universe, or a client app, and launch Studio.",
   "license": "SEE LICENSE IN README.md",
   "type": "module",