vela 0.10.14 → 0.11.1

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "vela",
-	"version": "0.10.14",
+	"version": "0.11.1",
 	"type": "module",
 	"description": "A CLI for creating and updating SvelteKit projects",
 	"license": "MIT",

package/templates/server/apply.sh

@@ -24,6 +24,7 @@ APP_NAME=$INSTANCE
 APP_ID=$INSTANCE
 ENV_TAG=prod
 DOMAIN=""
+MANAGED=""
 HEALTH_PATH=/
 KEEP=5
 PB_VERSION=""
@@ -37,6 +38,7 @@ while [ $# -gt 0 ]; do
 		--app-id) APP_ID=$2; shift 2 ;;
 		--env) ENV_TAG=$2; shift 2 ;;
 		--domain) DOMAIN=$2; shift 2 ;;
+		--managed) MANAGED=$2; shift 2 ;;
 		--health-path) HEALTH_PATH=$2; shift 2 ;;
 		--keep) KEEP=$2; shift 2 ;;
 		--pb-version) PB_VERSION=$2; shift 2 ;;
@@ -88,7 +90,10 @@ PORTS=$(allocate_ports "$INSTANCE")
 WEB_PORT=$(printf '%s' "$PORTS" | jq -r .web)
 PB_PORT=$(printf '%s' "$PORTS" | jq -r .pb)
 
+# The canonical host: a domain the user's own DNS points here outranks a
+# managed velastack.app name, which then redirects to it at the edge.
 PRIMARY_DOMAIN=$(printf '%s' "$DOMAIN" | cut -d, -f1 | tr -d ' ')
+[ -n "$PRIMARY_DOMAIN" ] || PRIMARY_DOMAIN=$(printf '%s' "$MANAGED" | cut -d, -f1 | tr -d ' ')
 if [ -n "$PRIMARY_DOMAIN" ]; then
 	ORIGIN="https://$PRIMARY_DOMAIN"
 else
@@ -325,17 +330,28 @@ ACTIVATED=1
 state_merge "$INSTANCE" "$(jq -c -n \
 	--arg app "$APP_ID" --arg name "$APP_NAME" --arg env "$ENV_TAG" \
 	--arg instance "$INSTANCE" --arg release "$RELEASE" --arg previous "$PREVIOUS" \
-	--arg domain "$DOMAIN" --arg health "$HEALTH_PATH" --arg pb "$PB_VERSION" \
+	--arg domain "$DOMAIN" --arg managed "$MANAGED" --arg url "$ORIGIN" \
+	--arg health "$HEALTH_PATH" --arg pb "$PB_VERSION" \
 	--arg sha "$GIT_SHA" --arg at "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
 	--argjson web "$WEB_PORT" --argjson pbport "$PB_PORT" --argjson backend "$BACKEND" \
 	'{appId: $app, name: $name, env: $env, instance: $instance,
 	  activeRelease: $release, previousRelease: $previous, domain: $domain,
+	  managed: $managed, url: $url,
 	  healthCheckPath: $health, pocketbaseVersion: $pb, gitSha: $sha,
 	  webPort: $web, pbPort: $pbport, backend: ($backend == 1), deployedAt: $at}')"
 
 # ------------------------------------------------------------------ routing
+#
+# Two files, written independently and each only if the whole Caddy config
+# still validates with it in place (`caddy_install` keeps the previous one
+# otherwise). Hosts the user's DNS points here get a site block of their own
+# and a certificate each; managed velastack.app hosts arrive through the
+# Worker at this server's origin site and are picked out by header.
 
 CADDY_SNIPPET="$VELA_ETC/caddy/$INSTANCE.caddy"
+ROUTE_SNIPPET="$VELA_ETC/caddy/routes/$INSTANCE.route"
+ROUTING_CHANGED=0
+
 if [ -n "$DOMAIN" ]; then
 	hosts=$(printf '%s' "$DOMAIN" | tr ',' '\n' | sed 's/^ *//; s/ *$//' | grep -v '^$' | paste -sd, - | sed 's/,/, /g')
 	tmp=$(mktemp "$VELA_ETC/caddy/.snippet.XXXXXX")
@@ -343,18 +359,42 @@ if [ -n "$DOMAIN" ]; then
 		printf '# Managed by vela - app %s (%s)\n' "$APP_NAME" "$INSTANCE"
 		printf '%s {\n\treverse_proxy 127.0.0.1:%s\n}\n' "$hosts" "$WEB_PORT"
 	} > "$tmp"
-	chmod 0644 "$tmp"
-	mv -f "$tmp" "$CADDY_SNIPPET"
-	if ! caddy validate --config /etc/caddy/Caddyfile --adapter caddyfile >/dev/null 2>&1; then
-		rm -f "$CADDY_SNIPPET"
-		die "generated Caddy config for $DOMAIN is invalid"
-	fi
-	systemctl reload caddy
+	caddy_install "$tmp" "$CADDY_SNIPPET" || die "generated Caddy config for $DOMAIN is invalid"
+	ROUTING_CHANGED=1
 elif [ -f "$CADDY_SNIPPET" ]; then
 	rm -f "$CADDY_SNIPPET"
-	systemctl reload caddy || true
+	ROUTING_CHANGED=1
 fi
 
+if [ -n "$MANAGED" ]; then
+	[ -f "$VELA_ETC/caddy/00-origin.caddy" ] \
+		|| die "managed hostnames need this server's origin site - the CLI runs origin.sh first"
+	# A matcher name is an identifier; instance ids carry dashes.
+	matcher=vela_$(printf '%s' "$INSTANCE" | tr -c 'a-zA-Z0-9_' '_')
+	tmp=$(mktemp "$VELA_ETC/caddy/routes/.route.XXXXXX")
+	{
+		printf '# Managed by vela - app %s (%s)\n' "$APP_NAME" "$INSTANCE"
+		printf '@%s {\n' "$matcher"
+		printf '%s' "$MANAGED" | tr ',' '\n' | sed 's/^ *//; s/ *$//' | grep -v '^$' \
+			| while IFS= read -r host; do printf '\theader X-Velastack-Host %s\n' "$host"; done
+		printf '}\n'
+		# The app should see the public host and the visitor, not the origin
+		# name and the Cloudflare edge that carried the request here.
+		printf 'handle @%s {\n' "$matcher"
+		printf '\treverse_proxy 127.0.0.1:%s {\n' "$WEB_PORT"
+		printf '\t\theader_up Host {http.request.header.X-Velastack-Host}\n'
+		printf '\t\theader_up X-Forwarded-For {http.request.header.X-Velastack-Client-IP}\n'
+		printf '\t}\n}\n'
+	} > "$tmp"
+	caddy_install "$tmp" "$ROUTE_SNIPPET" || die "generated Caddy route for $MANAGED is invalid"
+	ROUTING_CHANGED=1
+elif [ -f "$ROUTE_SNIPPET" ]; then
+	rm -f "$ROUTE_SNIPPET"
+	ROUTING_CHANGED=1
+fi
+
+[ "$ROUTING_CHANGED" = 0 ] || caddy_reload
+
 
 # ------------------------------------------------------------------- pruning
 
@@ -379,7 +419,7 @@ if [ "$KEEP" -gt 0 ] 2>/dev/null; then
 fi
 
 emit_result \
-	--arg instance "$INSTANCE" --arg release "$RELEASE" --arg domain "$DOMAIN" \
+	--arg instance "$INSTANCE" --arg release "$RELEASE" --arg domain "$DOMAIN" --arg managed "$MANAGED" \
 	--arg url "$ORIGIN" --argjson web "$WEB_PORT" --argjson pb "$PB_PORT" --argjson su "$SU_CREATED" \
-	'{instance: $instance, release: $release, domain: $domain, url: $url,
+	'{instance: $instance, release: $release, domain: $domain, managed: $managed, url: $url,
 	  webPort: $web, pbPort: $pb, superuserCreated: ($su == 1)}'

package/templates/server/destroy.sh

@@ -34,8 +34,8 @@ for unit in "$(unit_web "$INSTANCE")" "$(unit_pb "$INSTANCE")"; do
 done
 
 log "removing routing"
-rm -f "$VELA_ETC/caddy/$INSTANCE.caddy"
-systemctl reload caddy >/dev/null 2>&1 || true
+rm -f "$VELA_ETC/caddy/$INSTANCE.caddy" "$VELA_ETC/caddy/routes/$INSTANCE.route"
+caddy_reload || true
 
 log "removing releases"
 rm -rf "$APP/releases" "$APP/deps" "$APP/current" "$APP/bin"

package/templates/server/lib.sh

@@ -228,3 +228,41 @@ assert_superuser_auth() {
 			-X POST -H 'content-type: application/json' --data-binary @- \
 			"http://127.0.0.1:$port/api/collections/_superusers/auth-with-password"
 }
+
+# ------------------------------------------------------------------- caddy
+
+CADDYFILE=${CADDYFILE:-/etc/caddy/Caddyfile}
+
+caddy_valid() {
+	caddy validate --config "$CADDYFILE" --adapter caddyfile >/dev/null 2>&1
+}
+
+# Put a generated snippet in place only if the whole Caddy config still
+# validates with it there. The file it replaces is kept and restored on
+# failure, so a bad generation cannot take a working route down.
+#
+# usage: caddy_install <tmp> <dest> [mode] [owner]
+caddy_install() {
+	local tmp=$1 dest=$2 mode=${3:-0644} owner=${4:-root:root} backup=""
+	chmod "$mode" "$tmp"
+	chown "$owner" "$tmp"
+	if [ -f "$dest" ]; then
+		backup=$(mktemp "$(dirname "$dest")/.previous.XXXXXX")
+		cp -p "$dest" "$backup"
+	fi
+	mv -f "$tmp" "$dest"
+	if caddy_valid; then
+		[ -z "$backup" ] || rm -f "$backup"
+		return 0
+	fi
+	if [ -n "$backup" ]; then
+		mv -f "$backup" "$dest"
+	else
+		rm -f "$dest"
+	fi
+	return 1
+}
+
+caddy_reload() {
+	systemctl reload caddy >/dev/null 2>&1 || systemctl restart caddy
+}

package/templates/server/origin.sh

@@ -0,0 +1,62 @@
+#!/usr/bin/env bash
+#
+# Publish this server's origin site: the one hostname the velastack.app Worker
+# proxies managed hostnames to.
+#
+# Reads /etc/vela/origin.json, which the CLI writes after registering the
+# server with velastack.dev. The site block refuses anything without the
+# server's token, then hands matching requests to per-instance route files
+# that apply.sh writes under routes/. Idempotent, and quiet when nothing has
+# changed, so a deploy does not reload Caddy for no reason.
+#
+# usage: origin.sh
+set -Eeuo pipefail
+
+SCRIPT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
+# shellcheck source=lib.sh
+. "$SCRIPT_DIR/lib.sh"
+
+require_provisioned
+[ "$(id -u)" -eq 0 ] || die "origin must run as root"
+
+ORIGIN_FILE="$VELA_ETC/origin.json"
+[ -f "$ORIGIN_FILE" ] || die "$ORIGIN_FILE is missing - the CLI registers the server before running this"
+
+HOST=$(jq -er .originHost "$ORIGIN_FILE") || die "$ORIGIN_FILE has no originHost"
+TOKEN=$(jq -er .token "$ORIGIN_FILE") || die "$ORIGIN_FILE has no token"
+
+ROUTES="$VELA_ETC/caddy/routes"
+mkdir -p "$ROUTES"
+chmod 0755 "$ROUTES"
+# An import glob that matches nothing is a hard error in Caddy, so keep a
+# comment-only file in place before the first managed instance is deployed.
+if [ ! -f "$ROUTES/00-vela.route" ]; then
+	printf '# Managed by vela. Instance routes are written alongside this file.\n' \
+		> "$ROUTES/00-vela.route"
+fi
+
+SNIPPET="$VELA_ETC/caddy/00-origin.caddy"
+desired=$(
+	printf '# Managed by vela - origin for velastack.app managed hostnames\n'
+	printf '%s {\n' "$HOST"
+	printf '\t@untrusted not header X-Velastack-Origin-Token "%s"\n' "$TOKEN"
+	printf '\thandle @untrusted {\n\t\trespond 403\n\t}\n'
+	printf '\timport %s/*.route\n' "$ROUTES"
+	printf '\thandle {\n\t\trespond 404\n\t}\n'
+	printf '}\n'
+)
+
+if [ -f "$SNIPPET" ] && [ "$(cat "$SNIPPET")" = "$desired" ]; then
+	emit_result --arg host "$HOST" '{originHost: $host, changed: false}'
+	exit 0
+fi
+
+tmp=$(mktemp "$VELA_ETC/caddy/.origin.XXXXXX")
+printf '%s\n' "$desired" > "$tmp"
+# Readable by the caddy user (which is what `caddy reload` runs as) and no one
+# else: the token must not leak to the apps, which run as $VELA_USER.
+caddy_install "$tmp" "$SNIPPET" 0640 root:caddy \
+	|| die "generated origin config for $HOST is invalid"
+caddy_reload
+
+emit_result --arg host "$HOST" '{originHost: $host, changed: true}'

package/templates/server/provision.sh

@@ -34,10 +34,47 @@ case "${ID:-}" in
 esac
 
 export DEBIAN_FRONTEND=noninteractive
+# Ubuntu's needrestart hook prints several paragraphs of "Restarting services"
+# chatter to stderr after every install. Nothing vela installs needs a service
+# restart mid-provision, so skip it.
+export NEEDRESTART_SUSPEND=1
+
+# A freshly created cloud box is usually still busy on first boot: cloud-init
+# runs its package step and unattended-upgrades kicks off, both holding the
+# dpkg lock. Provisioning that races them fails with "Could not get lock", so
+# wait for first boot to settle before touching apt.
+if command -v cloud-init >/dev/null 2>&1; then
+	log "waiting for cloud-init to finish"
+	cloud-init status --wait >/dev/null 2>&1 || true
+fi
+
+APT_LOCK_TIMEOUT=${APT_LOCK_TIMEOUT:-600}
+# Block until no other process holds an apt/dpkg lock, up to APT_LOCK_TIMEOUT
+# seconds. Covers callers that invoke apt-get themselves (the nodesource setup
+# script) and older apt without DPkg::Lock::Timeout support.
+wait_for_apt() {
+	local waited=0 announced=0
+	command -v fuser >/dev/null 2>&1 || return 0
+	while fuser /var/lib/dpkg/lock-frontend /var/lib/dpkg/lock /var/lib/apt/lists/lock >/dev/null 2>&1; do
+		[ "$announced" -eq 1 ] || { log "waiting for another apt process to finish"; announced=1; }
+		[ "$waited" -lt "$APT_LOCK_TIMEOUT" ] \
+			|| die "gave up waiting for the apt lock after ${APT_LOCK_TIMEOUT}s - is unattended-upgrades still running?"
+		sleep 2
+		waited=$((waited + 2))
+	done
+}
+
+# Every apt-get call goes through here so a lock held by unattended-upgrades
+# waits instead of failing the whole provision.
+apt_get() {
+	wait_for_apt
+	apt-get -o DPkg::Lock::Timeout="$APT_LOCK_TIMEOUT" "$@"
+}
+
 APT_UPDATED=0
 apt_update_once() {
 	[ "$APT_UPDATED" -eq 1 ] && return 0
-	apt-get update -qq
+	apt_get update -qq
 	APT_UPDATED=1
 }
 
@@ -49,7 +86,7 @@ ensure_packages() {
 	[ ${#missing[@]} -eq 0 ] && return 0
 	log "installing ${missing[*]}"
 	apt_update_once
-	apt-get install -y -qq --no-install-recommends "${missing[@]}" >/dev/null
+	apt_get install -y -qq --no-install-recommends "${missing[@]}" >/dev/null
 }
 
 log "checking base packages"
@@ -70,9 +107,10 @@ install_node() {
 	fi
 	log "installing Node.js $NODE_MAJOR"
 	curl -fsSL "https://deb.nodesource.com/setup_${NODE_MAJOR}.x" -o /tmp/nodesource_setup.sh
+	wait_for_apt
 	bash /tmp/nodesource_setup.sh >/dev/null
 	rm -f /tmp/nodesource_setup.sh
-	apt-get install -y -qq nodejs >/dev/null
+	apt_get install -y -qq nodejs >/dev/null
 }
 install_node
 
@@ -86,8 +124,8 @@ install_caddy() {
 		| gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg
 	curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' \
 		> /etc/apt/sources.list.d/caddy-stable.list
-	apt-get update -qq
-	apt-get install -y -qq caddy >/dev/null
+	apt_get update -qq
+	apt_get install -y -qq caddy >/dev/null
 	APT_UPDATED=1
 }
 install_caddy