unoverse 0.1.86 → 0.1.87

package/lib/urls.mjs

@@ -39,6 +39,7 @@ function section(title, rows, subtitle) {
 import { existsSync } from "node:fs";
 import { join, resolve, dirname } from "node:path";
 import { spawnSync } from "node:child_process";
+import { lookup } from "node:dns/promises";
 
 import { bold, dim, cyan, green, red } from "./ui.mjs";
 
@@ -75,11 +76,35 @@ function terraformOutputs(root) {
   return {};
 }
 
-async function probe(url) {
+/**
+ * "no answer" AND "answering from the wrong machine" ARE DIFFERENT PROBLEMS.
+ *
+ * A URL that does not respond used to report identically whether the service was down or
+ * the hostname resolved somewhere else entirely. That sent an operator to look at
+ * infrastructure that was already working: two load balancers up, a verified certificate,
+ * and every deployed URL reading "no answer" because a resolver was still holding a
+ * deleted A record. The address had a cached answer pointing at a destroyed server, which
+ * is not a fact any amount of staring at containers reveals.
+ *
+ * So when a probe fails, ask what the name actually resolves to and compare it with the
+ * address the ground says it should be. Stale DNS then says so in the one place the
+ * operator is already looking.
+ */
+async function probe(url, expectedIp) {
   try {
     const res = await fetch(url, { redirect: "manual", signal: AbortSignal.timeout(5000) });
     return { up: true, status: res.status };
   } catch {
+    if (!expectedIp) return { up: false };
+    try {
+      const { hostname } = new URL(url);
+      const { address } = await lookup(hostname);
+      if (address !== expectedIp) {
+        return { up: false, note: `DNS says ${address}, should be ${expectedIp} — a resolver is holding an old record` };
+      }
+    } catch {
+      return { up: false, note: "that hostname does not resolve yet" };
+    }
     return { up: false };
   }
 }
@@ -103,14 +128,14 @@ export async function urls() {
     domain = /^https:\/\/api\.(.+)$/.exec(apiBase)?.[1] || "";
     const candidates = [];
     if (apiBase) {
-      candidates.push({ label: "API", url: apiBase, note: "MCP at /mcp" });
-      candidates.push({ label: "Health", url: `${apiBase}/health` });
+      candidates.push({ label: "API", url: apiBase, note: "MCP at /mcp", expect: tf.lb_ip });
+      candidates.push({ label: "Health", url: `${apiBase}/health`, expect: tf.lb_ip });
     }
     const canvas = tf.canvas_url && tf.canvas_url.startsWith("http") ? tf.canvas_url : null;
-    if (canvas) candidates.push({ label: "Canvas", url: canvas, note: "add to IdP origins" });
+    if (canvas) candidates.push({ label: "Canvas", url: canvas, note: "add to IdP origins", expect: tf.canvas_lb_ip });
     if (tf.deploy_host) candidates.push({ label: "Logs", url: `http://${tf.deploy_host}:8080`, note: "admin IP only" });
     if (tf.cognito_hosted_ui) candidates.push({ label: "Login", url: tf.cognito_hosted_ui });
-    deployed = await Promise.all(candidates.map(async (c) => ({ ...c, ...(await probe(c.url)) })));
+    deployed = await Promise.all(candidates.map(async (c) => ({ ...c, ...(await probe(c.url, c.expect)) })));
   }
 
   const anyUp = [...local, ...deployed].some((r) => r.up);

package/operator/ansible/playbooks/deploy-images.yml

@@ -42,6 +42,25 @@
         src: "{{ universe_root | default(playbook_dir + '/../..') }}/docker-compose.yml"
         dest: "{{ gravity_dir }}/docker-compose.yml"
 
+    # THE ENVIRONMENT TRAVELS WITH THE DEPLOY TOO. This step used to be skipped on the
+    # grounds that `.env` held per-server values a deploy must not clobber. That stopped
+    # being true when the ground started rendering it in full: it is `terraform output -raw
+    # env_production`, derived from the same state that built the infrastructure, and
+    # nothing on the server edits it.
+    #
+    # Skipping it meant a change to the ground reached docker-compose.yml and stopped there.
+    # Setting a domain updated the compose file, while the environment still said
+    # DOMAIN= and API_URL=http://<lb-ip> — so Canvas loaded over HTTPS and called the API
+    # over plain HTTP at a raw IP, and the browser blocked it as mixed content. The compose
+    # file and the environment describe one deployment; shipping one without the other
+    # leaves them disagreeing.
+    - name: "[1b/4] Sync .env (the ground renders it, so it travels with the deploy)"
+      copy:
+        src: "{{ env_file }}"
+        dest: /opt/gravity/.env
+        owner: "{{ ansible_user }}"
+        mode: "0600"
+
     - name: "[2/4] Pull latest platform images"
       shell: |
         cd {{ gravity_dir }}

package/operator/infra/digitalocean/outputs.tf

@@ -42,6 +42,13 @@ output "lb_ip" {
   value       = digitalocean_loadbalancer.public.ip
 }
 
+# Canvas's own load balancer address. Read by `unoverse where` so a hostname resolving to
+# something else can be reported as stale DNS rather than as a dead service.
+output "canvas_lb_ip" {
+  description = "The Canvas load balancer's IP — canvas.<domain>'s A record target. Empty when Canvas is not public or there is no domain."
+  value       = length(digitalocean_loadbalancer.canvas) > 0 ? digitalocean_loadbalancer.canvas[0].ip : ""
+}
+
 output "canvas_url" {
   description = "Public Canvas URL (canvas_public = true only) — add it to the IdP's allowed origins."
   value       = var.canvas_public ? (local.has_domain ? "https://canvas.${var.domain}" : "http://${digitalocean_loadbalancer.public.ip}:3001") : "canvas is admin-only (direct http://<droplet-ip>:3001 from admin_cidr)"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unoverse",
-  "version": "0.1.86",
+  "version": "0.1.87",
   "description": "The Unoverse front door — create a Studio project, a universe, or a client app, and launch Studio.",
   "license": "SEE LICENSE IN README.md",
   "type": "module",