vela 0.14.2 → 0.14.3

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "vela",
-	"version": "0.14.2",
+	"version": "0.14.3",
 	"type": "module",
 	"description": "A CLI for creating and updating SvelteKit projects",
 	"license": "MIT",

package/templates/server/apply.sh

@@ -157,9 +157,9 @@ PB_PORT=$(printf '%s' "$PORTS" | jq -r .pb)
 PRIMARY_DOMAIN=$(printf '%s' "$DOMAIN" | cut -d, -f1 | tr -d ' ')
 [ -n "$PRIMARY_DOMAIN" ] || PRIMARY_DOMAIN=$(printf '%s' "$MANAGED" | cut -d, -f1 | tr -d ' ')
 if [ -n "$PRIMARY_DOMAIN" ]; then
-	ORIGIN="https://$PRIMARY_DOMAIN"
+	PRIMARY_URL="https://$PRIMARY_DOMAIN"
 else
-	ORIGIN="http://127.0.0.1:$WEB_PORT"
+	PRIMARY_URL="http://127.0.0.1:$WEB_PORT"
 fi
 
 # Production secrets live in $ETC/env and are managed only by `vela env`.
@@ -172,7 +172,7 @@ runtime_tmp=$(mktemp "$ETC/.runtime.XXXXXX")
 	printf 'NODE_ENV=production\n'
 	printf 'HOST=127.0.0.1\n'
 	printf 'PORT=%s\n' "$WEB_PORT"
-	printf 'ORIGIN=%s\n' "$ORIGIN"
+	runtime_origin_lines "$DOMAIN" "$PRIMARY_URL"
 	# Only an instance with a PocketBase gets pointed at one: a URL to a port
 	# nothing listens on is not a setting, it is a trap. Kept for one more
 	# deploy when the backend is being removed, so that a failed deploy can put
@@ -412,7 +412,7 @@ fi
 log "starting app on 127.0.0.1:$WEB_PORT"
 systemctl enable "$WEB_UNIT" >/dev/null 2>&1 || true
 systemctl restart "$WEB_UNIT"
-wait_for_http "http://127.0.0.1:$WEB_PORT$HEALTH_PATH" 60 0.5 \
+wait_for_http "http://127.0.0.1:$WEB_PORT$HEALTH_PATH" 60 0.5 "$PRIMARY_DOMAIN" \
 	|| die "app did not become healthy at $HEALTH_PATH - journalctl -u $WEB_UNIT"
 
 ACTIVATED=1
@@ -431,7 +431,7 @@ fi
 state_merge "$INSTANCE" "$(jq -c -n \
 	--arg app "$APP_ID" --arg name "$APP_NAME" --arg env "$ENV_TAG" \
 	--arg instance "$INSTANCE" --arg release "$RELEASE" --arg previous "$PREVIOUS" \
-	--arg domain "$DOMAIN" --arg managed "$MANAGED" --arg url "$ORIGIN" \
+	--arg domain "$DOMAIN" --arg managed "$MANAGED" --arg url "$PRIMARY_URL" \
 	--arg health "$HEALTH_PATH" --arg pb "$PB_VERSION" \
 	--arg sha "$GIT_SHA" --arg at "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
 	--argjson web "$WEB_PORT" --argjson pbport "$PB_PORT" --argjson backend "$BACKEND" \
@@ -530,6 +530,6 @@ fi
 
 emit_result \
 	--arg instance "$INSTANCE" --arg release "$RELEASE" --arg domain "$DOMAIN" --arg managed "$MANAGED" \
-	--arg url "$ORIGIN" --argjson web "$WEB_PORT" --argjson pb "$PB_PORT" --argjson su "$SU_CREATED" \
+	--arg url "$PRIMARY_URL" --argjson web "$WEB_PORT" --argjson pb "$PB_PORT" --argjson su "$SU_CREATED" \
 	'{instance: $instance, release: $release, domain: $domain, managed: $managed, url: $url,
 	  webPort: $web, pbPort: $pb, superuserCreated: ($su == 1)}'

package/templates/server/lib.sh

@@ -171,11 +171,17 @@ unit_active() { systemctl is-active --quiet "$1"; }
 # a health path behind auth). A 404 is not that: it is what a wrong
 # --health-path or a route that never mounted looks like, and it used to pass.
 # No `-f`: curl has to report the status of an error response, not fail on it.
+#
+# A fourth argument is the public host to ask as, the way Caddy would. An app
+# serving several hosts has no pinned ORIGIN and tells its sites apart by
+# `Host`; asked as 127.0.0.1 it may rightly answer that it serves no such site.
 wait_for_http() {
-	local url=$1 attempts=${2:-60} delay=${3:-0.5} code
+	local url=$1 attempts=${2:-60} delay=${3:-0.5} host=${4:-} code
 	local i=0
+	local -a as=()
+	[ -z "$host" ] || as=(-H "Host: $host" -H 'X-Forwarded-Proto: https')
 	while [ "$i" -lt "$attempts" ]; do
-		code=$(curl -sS -o /dev/null -w '%{http_code}' --max-time 5 "$url" 2>/dev/null || echo 000)
+		code=$(curl -sS -o /dev/null -w '%{http_code}' --max-time 5 ${as[@]+"${as[@]}"} "$url" 2>/dev/null || echo 000)
 		case "$code" in
 			2*|3*|401|403) return 0 ;;
 		esac
@@ -185,6 +191,43 @@ wait_for_http() {
 	return 1
 }
 
+# The public host an instance's health check should ask as: the host of the
+# `url` its last deploy recorded, or nothing for an instance no domain points
+# at (whose url is its own loopback address).
+#
+# usage: state_primary_host <instance>
+state_primary_host() {
+	local url
+	url=$(state_get "$1" url 2>/dev/null) || return 0
+	case "$url" in
+		https://*) url=${url#https://}; printf '%s' "${url%%/*}" ;;
+	esac
+}
+
+# The lines of runtime.env that tell adapter-node what origin a request has.
+#
+# One served host: pin it with ORIGIN, so nothing a client sends can change
+# what the app believes its own address is. Several hosts served directly
+# (velastack.dev and velabase.dev from one app) cannot share an ORIGIN - the
+# second host would render as the first and have its form posts refused as
+# cross-site - so the origin comes from the request instead: `Host`, which
+# Caddy passes through and only ever for the names in this instance's site
+# block, and the scheme from the X-Forwarded-Proto Caddy sets itself.
+#
+# Managed velastack.app names do not count: beside a direct host they redirect
+# at the edge rather than being served.
+#
+# usage: runtime_origin_lines <direct_hosts_csv> <primary_url>
+runtime_origin_lines() {
+	local direct=$1 primary_url=$2 count
+	count=$(printf '%s' "$direct" | tr ',' '\n' | sed 's/^ *//; s/ *$//' | grep -c -v '^$' || true)
+	if [ "$count" -gt 1 ]; then
+		printf 'PROTOCOL_HEADER=x-forwarded-proto\n'
+	else
+		printf 'ORIGIN=%s\n' "$primary_url"
+	fi
+}
+
 # How many migrations the current release has that the target release does not.
 # PocketBase reverts by count, so this is what `migrate down` needs.
 migrations_ahead() {

package/templates/server/restore.sh

@@ -220,7 +220,7 @@ assert_superuser_auth "$PB_PORT" "$SU_EMAIL" "$SU_PASSWORD" \
 
 log "starting app on 127.0.0.1:$WEB_PORT"
 systemctl start "$WEB_UNIT"
-wait_for_http "http://127.0.0.1:$WEB_PORT$HEALTH_PATH" 60 0.5 \
+wait_for_http "http://127.0.0.1:$WEB_PORT$HEALTH_PATH" 60 0.5 "$(state_primary_host "$INSTANCE")" \
 	|| die "app did not become healthy at $HEALTH_PATH - journalctl -u $WEB_UNIT"
 
 RESTORED=1

package/templates/server/rollback.sh

@@ -74,7 +74,7 @@ if [ "$BACKEND" = "true" ]; then
 		|| die "PocketBase did not become healthy after rollback"
 fi
 systemctl restart "$WEB_UNIT"
-wait_for_http "http://127.0.0.1:$WEB_PORT$HEALTH_PATH" 60 0.5 \
+wait_for_http "http://127.0.0.1:$WEB_PORT$HEALTH_PATH" 60 0.5 "$(state_primary_host "$INSTANCE")" \
 	|| die "app did not become healthy after rollback"
 
 state_merge "$INSTANCE" "$(jq -c -n --arg t "$TARGET" --arg c "$CURRENT" \