unoverse 0.1.85 → 0.1.86

package/operator/infra/aws/main.tf

@@ -493,7 +493,7 @@ resource "aws_iam_access_key" "bedrock" {
 resource "aws_acm_certificate" "public" {
   count                     = local.has_domain ? 1 : 0
   domain_name               = local.api_host
-  subject_alternative_names = var.canvas_public ? ["unoverse.${var.domain}"] : []
+  subject_alternative_names = var.canvas_public ? ["canvas.${var.domain}"] : []
   validation_method         = "DNS"
 
   lifecycle {
@@ -625,7 +625,7 @@ resource "aws_lb_listener_rule" "canvas" {
   }
   condition {
     host_header {
-      values = ["unoverse.${var.domain}"]
+      values = ["canvas.${var.domain}"]
     }
   }
 }
@@ -661,7 +661,7 @@ resource "aws_route53_record" "api" {
 resource "aws_route53_record" "unoverse" {
   count   = local.dns_auto && var.canvas_public ? 1 : 0
   zone_id = var.route53_zone_id
-  name    = "unoverse.${var.domain}"
+  name    = "canvas.${var.domain}"
   type    = "A"
 
   alias {

package/operator/infra/aws/outputs.tf

@@ -9,7 +9,7 @@ output "deploy_host" {
 }
 
 output "alb_dns_name" {
-  description = "Point api.<domain> (and unoverse.<domain> when canvas_public) at this — CNAME/ALIAS. Created automatically when route53_zone_id is set."
+  description = "Point api.<domain> (and canvas.<domain> when canvas_public) at this — CNAME/ALIAS. Created automatically when route53_zone_id is set."
   value       = aws_lb.public.dns_name
 }
 
@@ -24,7 +24,7 @@ output "acm_validation_records" {
 
 output "canvas_url" {
   description = "Public Canvas URL (canvas_public = true only) — add it to the client origins."
-  value       = var.canvas_public ? (local.has_domain ? "https://unoverse.${var.domain}" : "http://${aws_lb.public.dns_name}:3001") : "canvas is admin-only (direct http://<instance-ip>:3001 from admin_cidr)"
+  value       = var.canvas_public ? (local.has_domain ? "https://canvas.${var.domain}" : "http://${aws_lb.public.dns_name}:3001") : "canvas is admin-only (direct http://<instance-ip>:3001 from admin_cidr)"
 }
 
 output "api_url" {

package/operator/infra/digitalocean/main.tf

@@ -116,17 +116,18 @@ resource "digitalocean_firewall" "app" {
     port_range                = "4105"
     source_load_balancer_uids = [digitalocean_loadbalancer.public.id]
   }
-  # Canvas (operator UI): the DO LB has NO host-based routing (Caddy did), so the
-  # public LB carries ONLY the api host → :4105. Canvas is an OPERATOR tool —
-  # admin-only direct access, same trust ring as SSH and Dozzle. It still calls
-  # the platform at https://api.<domain> like any client.
-  # POC (canvas_public = true): :3001 ALSO accepts the public LB, which serves
-  # Canvas at https://api.<domain>:3001. Direct-IP access stays admin-only either way.
+  # Canvas (operator UI). Direct access to :3001 on the droplet stays admin-only, same
+  # trust ring as SSH and Dozzle, whatever else is true.
+  # With canvas_public: whichever load balancer fronts it may reach :3001 too — the canvas
+  # LB when there is a domain, the main one when there is not. Naming both here would open
+  # 3001 to an LB that is not serving Canvas in that mode.
   inbound_rule {
-    protocol                  = "tcp"
-    port_range                = "3001"
-    source_addresses          = [var.admin_cidr]
-    source_load_balancer_uids = var.canvas_public ? [digitalocean_loadbalancer.public.id] : []
+    protocol         = "tcp"
+    port_range       = "3001"
+    source_addresses = [var.admin_cidr]
+    source_load_balancer_uids = var.canvas_public ? (
+      local.has_domain ? [digitalocean_loadbalancer.canvas[0].id] : [digitalocean_loadbalancer.public.id]
+    ) : []
   }
 
   outbound_rule {
@@ -183,18 +184,16 @@ resource "digitalocean_loadbalancer" "public" {
     }
   }
 
-  # POC (canvas_public = true, DECIDED 2026-07-29): Canvas rides the SAME LB on a
-  # second port — https://canvas.<domain>:3001 (a SAN on the api certificate, an A record to this same LB). ONE load balancer total: DO LBs can't
-  # host-route, and a clean second hostname would cost a second LB; the POC takes
-  # the port in the URL instead. Domainless: same second port, plain HTTP.
+  # DOMAINLESS ONLY. Without a hostname there is nothing to route by, so Canvas takes a
+  # second port on this LB's IP. With a domain it gets its own load balancer below and a
+  # clean https://canvas.<domain> — see the note there.
   dynamic "forwarding_rule" {
-    for_each = var.canvas_public ? [1] : []
+    for_each = var.canvas_public && !local.has_domain ? [1] : []
     content {
-      entry_port       = 3001
-      entry_protocol   = local.has_domain ? "https" : "http"
-      target_port      = 3001
-      target_protocol  = "http"
-      certificate_name = one(digitalocean_certificate.api[*].name)
+      entry_port      = 3001
+      entry_protocol  = "http"
+      target_port     = 3001
+      target_protocol = "http"
     }
   }
 
@@ -206,12 +205,49 @@ resource "digitalocean_loadbalancer" "public" {
   }
 }
 
+# CANVAS GETS ITS OWN LOAD BALANCER, so its URL carries no port.
+#
+# Supersedes the 2026-07-29 decision to run one LB and put :3001 in the URL. A port in a
+# hostname is not a URL anyone ships: it breaks the expectation that https means 443, it
+# has to be explained to every operator, and it leaks an implementation detail of the
+# ingress into the address bar. The reason for it was real — DigitalOcean load balancers
+# route on PORT only, never on the Host header, so one LB genuinely cannot serve two
+# hostnames — but the conclusion was wrong. The right answer to "the product cannot do
+# this" is a second load balancer, not a worse address.
+#
+# ~$12/month, and only when a domain is set AND Canvas is public. Domainless universes
+# keep the second port on the main LB above: with no hostname there is nothing to route by,
+# so a second LB would buy nothing.
+resource "digitalocean_loadbalancer" "canvas" {
+  count                     = local.has_domain && var.canvas_public ? 1 : 0
+  name                      = "${var.name}-canvas-lb"
+  region                    = var.region
+  droplet_ids               = [digitalocean_droplet.app.id]
+  redirect_http_to_https    = true
+  http_idle_timeout_seconds = 600
+
+  forwarding_rule {
+    entry_port       = 443
+    entry_protocol   = "https"
+    target_port      = 3001
+    target_protocol  = "http"
+    certificate_name = one(digitalocean_certificate.api[*].name)
+  }
+
+  # Canvas has no /health of its own; the root answering is the liveness signal.
+  healthcheck {
+    port     = 3001
+    protocol = "http"
+    path     = "/"
+  }
+}
+
 resource "digitalocean_record" "canvas" {
   count  = local.has_domain && var.canvas_public && var.manage_dns ? 1 : 0
   domain = var.domain
   type   = "A"
   name   = "canvas"
-  value  = digitalocean_loadbalancer.public.ip
+  value  = digitalocean_loadbalancer.canvas[0].ip
   ttl    = 300
 }
 

package/operator/infra/digitalocean/outputs.tf

@@ -44,7 +44,7 @@ output "lb_ip" {
 
 output "canvas_url" {
   description = "Public Canvas URL (canvas_public = true only) — add it to the IdP's allowed origins."
-  value       = var.canvas_public ? (local.has_domain ? "https://canvas.${var.domain}:3001" : "http://${digitalocean_loadbalancer.public.ip}:3001") : "canvas is admin-only (direct http://<droplet-ip>:3001 from admin_cidr)"
+  value       = var.canvas_public ? (local.has_domain ? "https://canvas.${var.domain}" : "http://${digitalocean_loadbalancer.public.ip}:3001") : "canvas is admin-only (direct http://<droplet-ip>:3001 from admin_cidr)"
 }
 
 output "api_url" {

package/operator/infra/digitalocean/prices.tf

@@ -35,6 +35,9 @@ locals {
     local.provision_pg ? lookup(local.prices, local.s.pg, 0) : 0,
     lookup(local.prices, local.s.redis, 0),
     local.prices["lb"],
+    # Canvas's own load balancer, so its URL needs no port. Only with a domain: without
+    # one it shares the main LB's IP on a second port and costs nothing extra.
+    local.has_domain && var.canvas_public ? local.prices["lb"] : 0,
   ])
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unoverse",
-  "version": "0.1.85",
+  "version": "0.1.86",
   "description": "The Unoverse front door — create a Studio project, a universe, or a client app, and launch Studio.",
   "license": "SEE LICENSE IN README.md",
   "type": "module",