unoverse 0.1.85 → 0.1.87

package/lib/urls.mjs

@@ -39,6 +39,7 @@ function section(title, rows, subtitle) {
 import { existsSync } from "node:fs";
 import { join, resolve, dirname } from "node:path";
 import { spawnSync } from "node:child_process";
+import { lookup } from "node:dns/promises";
 
 import { bold, dim, cyan, green, red } from "./ui.mjs";
 
@@ -75,11 +76,35 @@ function terraformOutputs(root) {
   return {};
 }
 
-async function probe(url) {
+/**
+ * "no answer" AND "answering from the wrong machine" ARE DIFFERENT PROBLEMS.
+ *
+ * A URL that does not respond used to report identically whether the service was down or
+ * the hostname resolved somewhere else entirely. That sent an operator to look at
+ * infrastructure that was already working: two load balancers up, a verified certificate,
+ * and every deployed URL reading "no answer" because a resolver was still holding a
+ * deleted A record. The address had a cached answer pointing at a destroyed server, which
+ * is not a fact any amount of staring at containers reveals.
+ *
+ * So when a probe fails, ask what the name actually resolves to and compare it with the
+ * address the ground says it should be. Stale DNS then says so in the one place the
+ * operator is already looking.
+ */
+async function probe(url, expectedIp) {
   try {
     const res = await fetch(url, { redirect: "manual", signal: AbortSignal.timeout(5000) });
     return { up: true, status: res.status };
   } catch {
+    if (!expectedIp) return { up: false };
+    try {
+      const { hostname } = new URL(url);
+      const { address } = await lookup(hostname);
+      if (address !== expectedIp) {
+        return { up: false, note: `DNS says ${address}, should be ${expectedIp} — a resolver is holding an old record` };
+      }
+    } catch {
+      return { up: false, note: "that hostname does not resolve yet" };
+    }
     return { up: false };
   }
 }
@@ -103,14 +128,14 @@ export async function urls() {
     domain = /^https:\/\/api\.(.+)$/.exec(apiBase)?.[1] || "";
     const candidates = [];
     if (apiBase) {
-      candidates.push({ label: "API", url: apiBase, note: "MCP at /mcp" });
-      candidates.push({ label: "Health", url: `${apiBase}/health` });
+      candidates.push({ label: "API", url: apiBase, note: "MCP at /mcp", expect: tf.lb_ip });
+      candidates.push({ label: "Health", url: `${apiBase}/health`, expect: tf.lb_ip });
     }
     const canvas = tf.canvas_url && tf.canvas_url.startsWith("http") ? tf.canvas_url : null;
-    if (canvas) candidates.push({ label: "Canvas", url: canvas, note: "add to IdP origins" });
+    if (canvas) candidates.push({ label: "Canvas", url: canvas, note: "add to IdP origins", expect: tf.canvas_lb_ip });
     if (tf.deploy_host) candidates.push({ label: "Logs", url: `http://${tf.deploy_host}:8080`, note: "admin IP only" });
     if (tf.cognito_hosted_ui) candidates.push({ label: "Login", url: tf.cognito_hosted_ui });
-    deployed = await Promise.all(candidates.map(async (c) => ({ ...c, ...(await probe(c.url)) })));
+    deployed = await Promise.all(candidates.map(async (c) => ({ ...c, ...(await probe(c.url, c.expect)) })));
   }
 
   const anyUp = [...local, ...deployed].some((r) => r.up);

package/operator/ansible/playbooks/deploy-images.yml

@@ -42,6 +42,25 @@
         src: "{{ universe_root | default(playbook_dir + '/../..') }}/docker-compose.yml"
         dest: "{{ gravity_dir }}/docker-compose.yml"
 
+    # THE ENVIRONMENT TRAVELS WITH THE DEPLOY TOO. This step used to be skipped on the
+    # grounds that `.env` held per-server values a deploy must not clobber. That stopped
+    # being true when the ground started rendering it in full: it is `terraform output -raw
+    # env_production`, derived from the same state that built the infrastructure, and
+    # nothing on the server edits it.
+    #
+    # Skipping it meant a change to the ground reached docker-compose.yml and stopped there.
+    # Setting a domain updated the compose file, while the environment still said
+    # DOMAIN= and API_URL=http://<lb-ip> — so Canvas loaded over HTTPS and called the API
+    # over plain HTTP at a raw IP, and the browser blocked it as mixed content. The compose
+    # file and the environment describe one deployment; shipping one without the other
+    # leaves them disagreeing.
+    - name: "[1b/4] Sync .env (the ground renders it, so it travels with the deploy)"
+      copy:
+        src: "{{ env_file }}"
+        dest: /opt/gravity/.env
+        owner: "{{ ansible_user }}"
+        mode: "0600"
+
     - name: "[2/4] Pull latest platform images"
       shell: |
         cd {{ gravity_dir }}

package/operator/infra/aws/main.tf

@@ -493,7 +493,7 @@ resource "aws_iam_access_key" "bedrock" {
 resource "aws_acm_certificate" "public" {
   count                     = local.has_domain ? 1 : 0
   domain_name               = local.api_host
-  subject_alternative_names = var.canvas_public ? ["unoverse.${var.domain}"] : []
+  subject_alternative_names = var.canvas_public ? ["canvas.${var.domain}"] : []
   validation_method         = "DNS"
 
   lifecycle {
@@ -625,7 +625,7 @@ resource "aws_lb_listener_rule" "canvas" {
   }
   condition {
     host_header {
-      values = ["unoverse.${var.domain}"]
+      values = ["canvas.${var.domain}"]
     }
   }
 }
@@ -661,7 +661,7 @@ resource "aws_route53_record" "api" {
 resource "aws_route53_record" "unoverse" {
   count   = local.dns_auto && var.canvas_public ? 1 : 0
   zone_id = var.route53_zone_id
-  name    = "unoverse.${var.domain}"
+  name    = "canvas.${var.domain}"
   type    = "A"
 
   alias {

package/operator/infra/aws/outputs.tf

@@ -9,7 +9,7 @@ output "deploy_host" {
 }
 
 output "alb_dns_name" {
-  description = "Point api.<domain> (and unoverse.<domain> when canvas_public) at this — CNAME/ALIAS. Created automatically when route53_zone_id is set."
+  description = "Point api.<domain> (and canvas.<domain> when canvas_public) at this — CNAME/ALIAS. Created automatically when route53_zone_id is set."
   value       = aws_lb.public.dns_name
 }
 
@@ -24,7 +24,7 @@ output "acm_validation_records" {
 
 output "canvas_url" {
   description = "Public Canvas URL (canvas_public = true only) — add it to the client origins."
-  value       = var.canvas_public ? (local.has_domain ? "https://unoverse.${var.domain}" : "http://${aws_lb.public.dns_name}:3001") : "canvas is admin-only (direct http://<instance-ip>:3001 from admin_cidr)"
+  value       = var.canvas_public ? (local.has_domain ? "https://canvas.${var.domain}" : "http://${aws_lb.public.dns_name}:3001") : "canvas is admin-only (direct http://<instance-ip>:3001 from admin_cidr)"
 }
 
 output "api_url" {

package/operator/infra/digitalocean/main.tf

@@ -116,17 +116,18 @@ resource "digitalocean_firewall" "app" {
     port_range                = "4105"
     source_load_balancer_uids = [digitalocean_loadbalancer.public.id]
   }
-  # Canvas (operator UI): the DO LB has NO host-based routing (Caddy did), so the
-  # public LB carries ONLY the api host → :4105. Canvas is an OPERATOR tool —
-  # admin-only direct access, same trust ring as SSH and Dozzle. It still calls
-  # the platform at https://api.<domain> like any client.
-  # POC (canvas_public = true): :3001 ALSO accepts the public LB, which serves
-  # Canvas at https://api.<domain>:3001. Direct-IP access stays admin-only either way.
+  # Canvas (operator UI). Direct access to :3001 on the droplet stays admin-only, same
+  # trust ring as SSH and Dozzle, whatever else is true.
+  # With canvas_public: whichever load balancer fronts it may reach :3001 too — the canvas
+  # LB when there is a domain, the main one when there is not. Naming both here would open
+  # 3001 to an LB that is not serving Canvas in that mode.
   inbound_rule {
-    protocol                  = "tcp"
-    port_range                = "3001"
-    source_addresses          = [var.admin_cidr]
-    source_load_balancer_uids = var.canvas_public ? [digitalocean_loadbalancer.public.id] : []
+    protocol         = "tcp"
+    port_range       = "3001"
+    source_addresses = [var.admin_cidr]
+    source_load_balancer_uids = var.canvas_public ? (
+      local.has_domain ? [digitalocean_loadbalancer.canvas[0].id] : [digitalocean_loadbalancer.public.id]
+    ) : []
   }
 
   outbound_rule {
@@ -183,18 +184,16 @@ resource "digitalocean_loadbalancer" "public" {
     }
   }
 
-  # POC (canvas_public = true, DECIDED 2026-07-29): Canvas rides the SAME LB on a
-  # second port — https://canvas.<domain>:3001 (a SAN on the api certificate, an A record to this same LB). ONE load balancer total: DO LBs can't
-  # host-route, and a clean second hostname would cost a second LB; the POC takes
-  # the port in the URL instead. Domainless: same second port, plain HTTP.
+  # DOMAINLESS ONLY. Without a hostname there is nothing to route by, so Canvas takes a
+  # second port on this LB's IP. With a domain it gets its own load balancer below and a
+  # clean https://canvas.<domain> — see the note there.
   dynamic "forwarding_rule" {
-    for_each = var.canvas_public ? [1] : []
+    for_each = var.canvas_public && !local.has_domain ? [1] : []
     content {
-      entry_port       = 3001
-      entry_protocol   = local.has_domain ? "https" : "http"
-      target_port      = 3001
-      target_protocol  = "http"
-      certificate_name = one(digitalocean_certificate.api[*].name)
+      entry_port      = 3001
+      entry_protocol  = "http"
+      target_port     = 3001
+      target_protocol = "http"
     }
   }
 
@@ -206,12 +205,49 @@ resource "digitalocean_loadbalancer" "public" {
   }
 }
 
+# CANVAS GETS ITS OWN LOAD BALANCER, so its URL carries no port.
+#
+# Supersedes the 2026-07-29 decision to run one LB and put :3001 in the URL. A port in a
+# hostname is not a URL anyone ships: it breaks the expectation that https means 443, it
+# has to be explained to every operator, and it leaks an implementation detail of the
+# ingress into the address bar. The reason for it was real — DigitalOcean load balancers
+# route on PORT only, never on the Host header, so one LB genuinely cannot serve two
+# hostnames — but the conclusion was wrong. The right answer to "the product cannot do
+# this" is a second load balancer, not a worse address.
+#
+# ~$12/month, and only when a domain is set AND Canvas is public. Domainless universes
+# keep the second port on the main LB above: with no hostname there is nothing to route by,
+# so a second LB would buy nothing.
+resource "digitalocean_loadbalancer" "canvas" {
+  count                     = local.has_domain && var.canvas_public ? 1 : 0
+  name                      = "${var.name}-canvas-lb"
+  region                    = var.region
+  droplet_ids               = [digitalocean_droplet.app.id]
+  redirect_http_to_https    = true
+  http_idle_timeout_seconds = 600
+
+  forwarding_rule {
+    entry_port       = 443
+    entry_protocol   = "https"
+    target_port      = 3001
+    target_protocol  = "http"
+    certificate_name = one(digitalocean_certificate.api[*].name)
+  }
+
+  # Canvas has no /health of its own; the root answering is the liveness signal.
+  healthcheck {
+    port     = 3001
+    protocol = "http"
+    path     = "/"
+  }
+}
+
 resource "digitalocean_record" "canvas" {
   count  = local.has_domain && var.canvas_public && var.manage_dns ? 1 : 0
   domain = var.domain
   type   = "A"
   name   = "canvas"
-  value  = digitalocean_loadbalancer.public.ip
+  value  = digitalocean_loadbalancer.canvas[0].ip
   ttl    = 300
 }
 

package/operator/infra/digitalocean/outputs.tf

@@ -42,9 +42,16 @@ output "lb_ip" {
   value       = digitalocean_loadbalancer.public.ip
 }
 
+# Canvas's own load balancer address. Read by `unoverse where` so a hostname resolving to
+# something else can be reported as stale DNS rather than as a dead service.
+output "canvas_lb_ip" {
+  description = "The Canvas load balancer's IP — canvas.<domain>'s A record target. Empty when Canvas is not public or there is no domain."
+  value       = length(digitalocean_loadbalancer.canvas) > 0 ? digitalocean_loadbalancer.canvas[0].ip : ""
+}
+
 output "canvas_url" {
   description = "Public Canvas URL (canvas_public = true only) — add it to the IdP's allowed origins."
-  value       = var.canvas_public ? (local.has_domain ? "https://canvas.${var.domain}:3001" : "http://${digitalocean_loadbalancer.public.ip}:3001") : "canvas is admin-only (direct http://<droplet-ip>:3001 from admin_cidr)"
+  value       = var.canvas_public ? (local.has_domain ? "https://canvas.${var.domain}" : "http://${digitalocean_loadbalancer.public.ip}:3001") : "canvas is admin-only (direct http://<droplet-ip>:3001 from admin_cidr)"
 }
 
 output "api_url" {

package/operator/infra/digitalocean/prices.tf

@@ -35,6 +35,9 @@ locals {
     local.provision_pg ? lookup(local.prices, local.s.pg, 0) : 0,
     lookup(local.prices, local.s.redis, 0),
     local.prices["lb"],
+    # Canvas's own load balancer, so its URL needs no port. Only with a domain: without
+    # one it shares the main LB's IP on a second port and costs nothing extra.
+    local.has_domain && var.canvas_public ? local.prices["lb"] : 0,
   ])
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unoverse",
-  "version": "0.1.85",
+  "version": "0.1.87",
   "description": "The Unoverse front door — create a Studio project, a universe, or a client app, and launch Studio.",
   "license": "SEE LICENSE IN README.md",
   "type": "module",