vibed-infra 0.4.0 → 0.6.0

package/README.md

@@ -1,98 +1,75 @@
 # vibed-infra
 
-Product-agnostic VPS deployment packager: **`package.sh`** turns four YAML configs into a committed **`dist/`** tree operators wget on the box — install scripts, generic start/update helpers, env examples, and gateway nginx.
+Product-agnostic VPS packager: **`package.sh`** builds committed **`dist/`** for wget install. One **host gateway** serves many apps; a **serial update agent** pulls images without overload; **persist-logs** enable event-sourced recovery; **`dist/DNS-SKILL.md`** configures DNS via an AU browser agent.
 
 Published on npm as **`vibed-infra`**.
 
 ## Product maintainer flow
 
-Author **`templates/`** in your product repo:
-
 | File | Purpose |
 |------|---------|
-| `vibed-infra-config.yml` | Product name, template refs, edge network, gateway `sites[]`, auto-update |
-| `api-config.yaml` | API image, port, opaque `config:` |
-| `ui-config.yaml` | UI image, port |
-| `nodes-config.yaml` | Worker image, opaque `config:` |
-
-Then package and commit **`dist/`**:
+| `vibed-infra-config.yml` | Name, templates, `network.edge` (default `vps-edge`), `gateway.sites[]`, auto-update |
+| `api-config.yaml` / `ui-config.yaml` / `nodes-config.yaml` | Images + opaque config |
 
 ```bash
-./package.sh                  # exec vibed-infra packager → writes dist/
+./package.sh
 git add dist && git commit && git push
+# Copy dist/DNS-SKILL.md into AU agent browser extension; give it the VPS IP
 ```
 
-Resolve the packager from npm:
+## Operator flow (VPS)
 
 ```bash
-node -e "console.log(require('path').dirname(require.resolve('vibed-infra/package.json')))"
-```
-
-Example product: [`examples/vps-hello`](examples/vps-hello) (`app/`, `build-images.sh`, four YAMLs, committed `dist/`).
-
-## Operator flow (wget on VPS)
-
-```bash
-wget -qO- https://raw.githubusercontent.com/ORG/REPO/main/dist/install-api.sh | bash
-wget -qO- .../dist/install-nodes.sh | bash
+wget -qO- .../dist/install-api.sh | bash
 wget -qO- .../dist/install-ui.sh | bash
-wget -qO- .../dist/install-gateway.sh | bash
-# edit each install dir .env, then ./start-*.sh
+wget -qO- .../dist/install-nodes.sh | bash
+wget -qO- .../dist/install-gateway.sh | bash   # bootstraps ~/services/gateway once + apps/{name}/
 ```
 
 | Profile | Role |
 |---------|------|
-| `api` | Backend on shared edge network |
-| `ui` | UI container (separate install) |
-| `nodes` | Worker compose on edge network |
-| `gateway` | HTTPS nginx only (API + UI must already run) |
+| `api` / `ui` / `nodes` | Join shared `vps-edge` |
+| `gateway` | Host nginx + this app’s `sites.conf` under `apps/` |
+
+Multi-app: further products’ `install-gateway.sh` only add `apps/{other}/sites.conf` and reload — no second 80/443 bind.
+
+## Machine services (installed once)
+
+| Path | Purpose |
+|------|---------|
+| `~/services/gateway` | Host nginx (`GATEWAY_HOME`) |
+| `~/services/vibed-infra/update-agent` | Serial pull queue + optional GHCR webhook |
+| `~/services/vibed-infra/persist-logs` | Per-app WALs + optional R2/S3 ship |
+
+Auto-update cron **enqueues** work; the agent processes one job at a time. Updates prune dangling images (`DOCKER_AUTO_PRUNE=1`).
 
 ## Layout
 
 | Path | Purpose |
 |------|---------|
-| `package.sh` / `lib/package.py` | Build product `dist/` from four YAMLs + generic templates |
-| `install.sh` | Single entrypoint (`INFRA_PROFILE` or `--profile`) |
-| `install-auto-update.sh` | Cron from profile flags |
-| `lib/` | fetch, env, tls, prompt, generate, product_config |
-| `templates/generic/` | Generic start/update/env/certs/gateway |
-| `schema/packageconfig.md` | Four-file product schema + compiled packageconfig |
-| `examples/vps-hello/` | Full example with dist e2e tests |
-| `skills/` | Cursor skills |
-| `github/workflows/` | Reusable GHCR build workflow |
+| `package.sh` / `lib/package.py` | Build `dist/` |
+| `templates/host-gateway/` | Shared gateway skeleton |
+| `templates/update-agent/` | Queue agent + webhook |
+| `templates/persist-logs/` | Shipper install |
+| `lib/persistlog/` | Python append / seal / replay |
+| `skills/` | system-gateway, infra-update-agent, persist-logs, dns-configure |
 
 ## Environment
 
 | Variable | Meaning |
 |----------|---------|
-| `PACKAGER_RAW` | Base URL or local path to this package root |
-| `PACKAGECONFIG_URL` | Product `packageconfig.yaml` or `dist/` URL (URL or path) |
-| `PRODUCT_RAW` | Product `dist/` base (templates + install scripts) |
-| `INFRA_PROFILE` | `api`, `ui`, `nodes`, or `gateway` |
-| `INSTALL_DIR` | Target directory (default `.`) |
+| `GATEWAY_HOME` | Host gateway dir (default `~/services/gateway`) |
+| `VIBED_HOME` | Machine vibed root (default `~/services/vibed-infra`) |
+| `PERSIST_LOG_DIR` | Per-service event log dir |
+| `DOCKER_AUTO_PRUNE` | Prune dangling images after update (default on) |
 
 ## Tests
 
 ```bash
-npm test                        # package + dry-run all dist/install-*.sh
-npm run test:dist               # build images + e2e api, ui, nodes (sequential)
-./examples/vps-hello/test-dist.sh --profile api   # single profile
+npm test
+npm run test:dist
 ```
 
-CI: `validate` job then parallel `dist-e2e` matrix (`api`, `ui`, `nodes`).
-
-## Publishing (npm)
-
-Every **merge to `main`** runs [Publish npm](.github/workflows/publish.yml):
-
-1. Bumps **minor** (`0.1.0` → `0.2.0`)
-2. Commits `chore: release vibed-infra v…`, tags `v…`, pushes
-3. Runs `npm publish` (needs repo secret `NPM_TOKEN`)
-
-**Major versions** — set `version` in `package.json` yourself (e.g. `1.0.0`) and include **`[major]`** in the commit message. That publishes the pinned version with **no** automatic minor bump.
-
-Set repository secret **`NPM_TOKEN`** before the first merge to `main`.
-
-Ordinary PRs only run CI (`npm test` + dist e2e); they do **not** publish.
+## Publishing
 
-Runbook: [`examples/vps-hello/README.md`](examples/vps-hello/README.md).
+Merge to `main` runs Publish npm (minor bump). Set `NPM_TOKEN`. Ordinary PRs run CI only.

package/install-auto-update.sh

@@ -88,7 +88,23 @@ build_cron_minutes() {
 }
 CRON_MINUTES="$(build_cron_minutes "${CRON_OFFSET:-0}" "${INTERVAL_MIN:-30}")"
 CRON_SCHED="${CRON_MINUTES} * * * *"
-CRON_CMD="cd ${SCRIPT_DIR} && /bin/bash ${SCRIPT_DIR}/${UPDATE_SCRIPT} >/dev/null 2>&1"
+# Prefer shared update-agent queue when available; else direct update script.
+AGENT_ENQUEUE=""
+for cand in \
+  "${VIBED_HOME:-}/update-agent/enqueue.sh" \
+  "${HOME:-}/services/vibed-infra/update-agent/enqueue.sh" \
+  "/var/lib/vibed/update-agent/enqueue.sh"
+do
+  if [[ -n "$cand" && -x "$cand" ]]; then
+    AGENT_ENQUEUE="$cand"
+    break
+  fi
+done
+if [[ -n "$AGENT_ENQUEUE" ]]; then
+  CRON_CMD="cd ${SCRIPT_DIR} && UPDATE_REASON=cron /bin/bash ${AGENT_ENQUEUE} ${SCRIPT_DIR} >/dev/null 2>&1"
+else
+  CRON_CMD="cd ${SCRIPT_DIR} && /bin/bash ${SCRIPT_DIR}/${UPDATE_SCRIPT} >/dev/null 2>&1"
+fi
 dir_slug="$(basename "$SCRIPT_DIR" | tr -c 'A-Za-z0-9._-' '_')"
 CRON_D_FILE="/etc/cron.d/infra-${ROLE}-${dir_slug}"
 

package/install.sh

@@ -57,7 +57,7 @@ LOCAL_PACKAGER=0
 if [[ "$PACKAGER_RAW" =~ ^/ ]] && [[ -d "$PACKAGER_RAW/lib" ]]; then
   LOCAL_PACKAGER=1
 fi
-for lib in fetch.sh env.sh prompt.sh tls.sh load_config.py generate.py; do
+for lib in fetch.sh env.sh prompt.sh tls.sh load_config.py generate.py host_gateway.sh; do
   if [[ "$LOCAL_PACKAGER" == "1" ]]; then
     cp -f "${PACKAGER_RAW}/lib/${lib}" "${INFRA_LIB}/${lib}"
   else
@@ -79,6 +79,8 @@ source "${INFRA_LIB}/fetch.sh"
 source "${INFRA_LIB}/prompt.sh"
 # shellcheck source=/dev/null
 source "${INFRA_LIB}/tls.sh"
+# shellcheck source=/dev/null
+source "${INFRA_LIB}/host_gateway.sh"
 
 cd "$DEST"
 
@@ -203,15 +205,85 @@ for e in extras:
 done
 
 if [[ "$ROLE" == "gateway" ]]; then
-  mkdir -p "$DEST/gateway/conf.d"
-  infra_write_if_missing "${PRODUCT_RAW}/gateway/nginx.conf" "$DEST/gateway/nginx.conf" 0
-  infra_write_template "${PRODUCT_RAW}/gateway/nginx.conf" "$DEST/gateway/nginx.conf" 0
-  if python3 "${INFRA_LIB}/generate.py" "$PC_LOCAL" --profile "$PROFILE" -o "$DEST/gateway/conf.d/domains.conf" 2>/dev/null; then
-    echo "generated: gateway/conf.d/domains.conf"
-  else
-    infra_write_if_missing "${PRODUCT_RAW}/gateway/conf.d/domains.conf" "$DEST/gateway/conf.d/domains.conf" 0
-    infra_write_template "${PRODUCT_RAW}/gateway/conf.d/domains.conf" "$DEST/gateway/conf.d/domains.conf" 0
+  PRODUCT_NAME="$(
+    python3 -c "
+import sys
+sys.path.insert(0, '${INFRA_LIB}')
+from load_config import load_packageconfig
+from pathlib import Path
+c = load_packageconfig(Path('${PC_LOCAL}'))
+print(c.get('name') or 'app')
+"
+  )"
+  GATEWAY_HOME="${GATEWAY_HOME:-$(vibed_gateway_home)}"
+  export GATEWAY_HOME
+  mkdir -p "$DEST/gateway/conf.d" "$DEST/lib"
+
+  # Phase 1: bootstrap shared host gateway once
+  vibed_bootstrap_host_gateway "$PACKAGER_RAW"
+  if [[ "$LOCAL_PACKAGER" == "1" ]]; then
+    cp -f "${PACKAGER_RAW}/lib/env.sh" "${GATEWAY_HOME}/lib-env.sh"
+    cp -f "${PACKAGER_RAW}/lib/host_gateway.sh" "${GATEWAY_HOME}/lib/host_gateway.sh" 2>/dev/null || \
+      mkdir -p "${GATEWAY_HOME}/lib" && cp -f "${PACKAGER_RAW}/lib/host_gateway.sh" "${GATEWAY_HOME}/lib/host_gateway.sh"
   fi
+
+  # Phase 2: app extension — sites.conf under host apps/{name}/
+  SITES_TMP="$DEST/gateway/sites.conf"
+  python3 "${INFRA_LIB}/generate.py" "$PC_LOCAL" --profile "$PROFILE" --mode app -o "$SITES_TMP"
+  META_TMP="$DEST/gateway/meta.json"
+  python3 -c "
+import json, sys
+from pathlib import Path
+sys.path.insert(0, '${INFRA_LIB}')
+from load_config import load_packageconfig, get_profile
+c = load_packageconfig(Path('${PC_LOCAL}'))
+p = get_profile(c, '${PROFILE}')
+meta = {
+  'name': c.get('name'),
+  'installDir': '${DEST}',
+  'sites': p.get('sites') or [],
+  'images': c.get('images') or {},
+}
+Path('${META_TMP}').write_text(json.dumps(meta, indent=2) + '\n')
+"
+  vibed_install_app_sites "$PRODUCT_NAME" "$SITES_TMP" "$META_TMP"
+
+  # Product install dir keeps thin wrappers that point at host gateway
+  infra_write_if_missing "${PRODUCT_RAW}/gateway/nginx.conf" "$DEST/gateway/nginx.conf" 0
+  cat >"$DEST/start-gateway.sh" <<EOF
+#!/usr/bin/env bash
+set -euo pipefail
+export GATEWAY_HOME="${GATEWAY_HOME}"
+# shellcheck source=/dev/null
+source "\$(cd "\$(dirname "\${BASH_SOURCE[0]}")" && pwd)/.infra-lib/host_gateway.sh" 2>/dev/null \\
+  || source "${GATEWAY_HOME}/lib/host_gateway.sh"
+vibed_reload_or_start_gateway
+EOF
+  cat >"$DEST/update-gateway.sh" <<EOF
+#!/usr/bin/env bash
+set -euo pipefail
+SCRIPT_DIR="\$(cd "\$(dirname "\${BASH_SOURCE[0]}")" && pwd)"
+cd "\$SCRIPT_DIR"
+# shellcheck source=lib-env.sh
+[[ -f lib-env.sh ]] && source lib-env.sh && load_dotenv .env
+export GATEWAY_HOME="${GATEWAY_HOME}"
+# Regenerate this app's sites and reload host (image update is host's update-gateway.sh)
+if [[ -f .packageconfig.yaml ]]; then
+  python3 "\${SCRIPT_DIR}/.infra-lib/generate.py" .packageconfig.yaml --profile gateway --mode app \\
+    -o "\${GATEWAY_HOME}/apps/${PRODUCT_NAME}/sites.conf" 2>/dev/null \\
+    || python3 "\${GATEWAY_HOME}/../vibed-infra/lib/generate.py" .packageconfig.yaml --profile gateway --mode app \\
+    -o "\${GATEWAY_HOME}/apps/${PRODUCT_NAME}/sites.conf"
+fi
+# shellcheck source=/dev/null
+source "\${SCRIPT_DIR}/.infra-lib/host_gateway.sh" 2>/dev/null || source "${GATEWAY_HOME}/lib/host_gateway.sh"
+vibed_reload_or_start_gateway
+EOF
+  chmod +x "$DEST/start-gateway.sh" "$DEST/update-gateway.sh"
+  # generate.py / host_gateway.sh already live in .infra-lib from bootstrap
+  cp -f "${INFRA_LIB}/host_gateway.sh" "$DEST/.infra-lib/host_gateway.sh" 2>/dev/null || true
+
+  # Ensure host network name is in product .env example path after copy
+  echo "GATEWAY_HOME=${GATEWAY_HOME}" >>"$DEST/.env.example" 2>/dev/null || true
 fi
 
 if [[ ! -f "$DEST/.env" ]]; then
@@ -221,6 +293,22 @@ else
   echo "exists: $DEST/.env"
 fi
 
+# Align product DOCKER_NETWORK with host edge when gateway/host exists
+if vibed_host_gateway_ready 2>/dev/null; then
+  HG="$(vibed_gateway_home)"
+  if [[ -f "$HG/.env" ]]; then
+    HOST_NET="$(grep -E '^DOCKER_NETWORK=' "$HG/.env" | head -1 | cut -d= -f2- || true)"
+    if [[ -n "$HOST_NET" && -f "$DEST/.env" ]]; then
+      if grep -q '^DOCKER_NETWORK=' "$DEST/.env"; then
+        sed -i "s|^DOCKER_NETWORK=.*|DOCKER_NETWORK=${HOST_NET}|" "$DEST/.env"
+      else
+        echo "DOCKER_NETWORK=${HOST_NET}" >>"$DEST/.env"
+      fi
+      echo "joined host edge network: $HOST_NET"
+    fi
+  fi
+fi
+
 cat >"$DEST/.infra-profile" <<EOF
 PROFILE=${PROFILE}
 ROLE=${ROLE}
@@ -229,12 +317,26 @@ UPDATE_SCRIPT=${UPDATE_SCRIPT}
 EOF
 
 chmod +x "$DEST/${START_SCRIPT}" 2>/dev/null || true
+
+# Ensure update-agent + persist-logs on first install (idempotent)
+if [[ -f "${PACKAGER_RAW}/templates/update-agent/install-agent.sh" ]]; then
+  PACKAGER_RAW="$PACKAGER_RAW" VIBED_HOME="${VIBED_HOME:-}" bash "${PACKAGER_RAW}/templates/update-agent/install-agent.sh" || true
+fi
+if [[ -f "${PACKAGER_RAW}/templates/persist-logs/install-persist-logs.sh" ]]; then
+  PACKAGER_RAW="$PACKAGER_RAW" VIBED_HOME="${VIBED_HOME:-}" bash "${PACKAGER_RAW}/templates/persist-logs/install-persist-logs.sh" || true
+fi
+
 INFRA_PROFILE="$PROFILE" ./install-auto-update.sh || true
 
 if [[ "$ROLE" == "gateway" ]]; then
   # shellcheck source=/dev/null
   source "$DEST/lib-env.sh"
   load_dotenv "$DEST/.env"
+  HG="$(vibed_gateway_home)"
+  # Prefer host certs
+  if [[ -f "$HG/.env" ]]; then
+    load_dotenv "$HG/.env"
+  fi
   CERT_DIR="$(python3 -c "
 import sys
 sys.path.insert(0, '${INFRA_LIB}')
@@ -243,13 +345,37 @@ from pathlib import Path
 p = get_profile(load_packageconfig(Path('${PC_LOCAL}')), '${PROFILE}')
 sites = p.get('sites') or []
 if not sites:
-    print('/etc/letsencrypt/live/example.com')
+    print('${HG}/certs')
 else:
     s = sites[0]
-    print(s.get('tlsCertDir') or ('/etc/letsencrypt/live/' + s['host']))
+    print(s.get('tlsCertDir') or ('${HG}/certs'))
 ")"
   TLS_FULLCHAIN="${TLS_FULLCHAIN:-${CERT_DIR}/fullchain.pem}"
   TLS_PRIVKEY="${TLS_PRIVKEY:-${CERT_DIR}/privkey.pem}"
+  # Prefer writable host certs when packaged tlsCertDir is not writable (e.g. /etc/letsencrypt)
+  if [[ ! -f "$TLS_FULLCHAIN" ]]; then
+    HOST_CERT_DIR="${HG}/certs"
+    mkdir -p "$HOST_CERT_DIR" 2>/dev/null || true
+    if [[ -x "${PRODUCT_RAW}/gen-dev-certs.sh" ]]; then
+      APP_HOST="$(python3 -c "
+import sys
+sys.path.insert(0, '${INFRA_LIB}')
+from load_config import load_packageconfig, get_profile
+from pathlib import Path
+p = get_profile(load_packageconfig(Path('${PC_LOCAL}')), '${PROFILE}')
+sites = p.get('sites') or []
+print(sites[0]['host'] if sites else 'localhost')
+")"
+      if APP_HOST="$APP_HOST" bash "${PRODUCT_RAW}/gen-dev-certs.sh" "$HOST_CERT_DIR" 2>/dev/null; then
+        TLS_FULLCHAIN="${HOST_CERT_DIR}/fullchain.pem"
+        TLS_PRIVKEY="${HOST_CERT_DIR}/privkey.pem"
+      fi
+    fi
+  fi
+  if [[ -f "$HG/.env" ]]; then
+    sed -i "s|^TLS_FULLCHAIN=.*|TLS_FULLCHAIN=${TLS_FULLCHAIN}|" "$HG/.env" 2>/dev/null || true
+    sed -i "s|^TLS_PRIVKEY=.*|TLS_PRIVKEY=${TLS_PRIVKEY}|" "$HG/.env" 2>/dev/null || true
+  fi
   mapfile -t DOMAIN_ARR < <(python3 -c "
 import sys
 sys.path.insert(0, '${INFRA_LIB}')
@@ -261,8 +387,14 @@ for s in p.get('sites') or []:
     for a in s.get('aliases') or []:
         print(a)
 ")
-  infra_tls_offer_interactive "$TLS_FULLCHAIN" "$TLS_PRIVKEY" "${DOMAIN_ARR[@]}"
+  infra_tls_offer_interactive "$TLS_FULLCHAIN" "$TLS_PRIVKEY" "${DOMAIN_ARR[@]}" || true
 fi
 
 echo ""
-echo "Install complete. Start: cd $DEST && ./${START_SCRIPT}"
+if [[ "$ROLE" == "gateway" ]]; then
+  echo "Install complete. Host gateway: $(vibed_gateway_home)"
+  echo "App sites: $(vibed_gateway_home)/apps/${PRODUCT_NAME:-app}/sites.conf"
+  echo "Start: cd $DEST && ./start-gateway.sh"
+else
+  echo "Install complete. Start: cd $DEST && ./${START_SCRIPT}"
+fi

package/lib/env.sh

@@ -222,3 +222,32 @@ chown_data_dir() {
   fi
   chmod 755 "$dir" 2>/dev/null || true
 }
+
+# Default on during auto-update. Set DOCKER_AUTO_PRUNE=0 to disable.
+docker_auto_prune_on() {
+  if [[ -n "${DOCKER_AUTO_PRUNE+x}" ]]; then
+    env_flag_on DOCKER_AUTO_PRUNE
+    return
+  fi
+  return 0
+}
+
+# Drop dangling images left after retagged pulls (e.g. :main). Optionally also
+# remove unused tagged images older than DOCKER_PRUNE_UNTIL when DOCKER_PRUNE_UNUSED=1.
+prune_docker_images() {
+  local log_dir="${1:-.}"
+  local role_label="${2:-infra}"
+  docker_auto_prune_on || return 0
+  if ! command -v docker >/dev/null 2>&1; then
+    return 0
+  fi
+  local summary
+  summary="$(docker image prune -f 2>/dev/null | awk '/Total reclaimed space/{print; found=1} END{if(!found) print "done"}' || echo done)"
+  log_update "$log_dir" "${role_label}: prune dangling images — ${summary}"
+  if env_flag_on DOCKER_PRUNE_UNUSED; then
+    local until="${DOCKER_PRUNE_UNTIL:-72h}"
+    summary="$(docker image prune -af --filter "until=${until}" 2>/dev/null \
+      | awk '/Total reclaimed space/{print; found=1} END{if(!found) print "done"}' || echo done)"
+    log_update "$log_dir" "${role_label}: prune unused images (until=${until}) — ${summary}"
+  fi
+}

package/lib/generate.py

@@ -22,6 +22,8 @@ def render_site(site: dict) -> str:
     create = site.get("createPath") or ""
     be_var = backend.replace("-", "_")
     ui_var = ui.replace("-", "_")
+    cert = site.get("sslCertificate") or "/etc/nginx/certs/fullchain.pem"
+    key = site.get("sslCertificateKey") or "/etc/nginx/certs/privkey.pem"
     proxy_headers = f"""    proxy_pass http://${be_var}_upstream;
     proxy_set_header Host $host;
     proxy_set_header X-Real-IP $remote_addr;
@@ -42,8 +44,8 @@ server {{
   http2 on;
   server_name {server_names};
 
-  ssl_certificate     /etc/nginx/certs/fullchain.pem;
-  ssl_certificate_key /etc/nginx/certs/privkey.pem;
+  ssl_certificate     {cert};
+  ssl_certificate_key {key};
   ssl_protocols       TLSv1.2 TLSv1.3;
   ssl_prefer_server_ciphers on;
 
@@ -78,7 +80,23 @@ server {{
 """
 
 
+def render_app_sites(prof: dict) -> str:
+    """Per-app sites.conf (no ACME block — host 00-default.conf owns that)."""
+    sites = prof.get("sites") or []
+    parts = [
+        "# Generated by lib/generate.py — app sites for host gateway apps/{name}/sites.conf",
+        "",
+    ]
+    for site in sites:
+        parts.append(render_site(site))
+        parts.append("")
+    return "\n".join(parts)
+
+
 def render_gateway(conf: dict, profile: str, prof: dict, output_name: str = "domains.conf") -> str:
+    """Full standalone conf (legacy) or app-only when output is sites.conf."""
+    if Path(output_name).name == "sites.conf":
+        return render_app_sites(prof)
     sites = prof.get("sites") or []
     parts = [
         "# Generated by lib/generate.py — edit packageconfig sites[] and re-install",
@@ -106,10 +124,23 @@ def main() -> int:
     ap.add_argument("packageconfig")
     ap.add_argument("--profile", default="gateway")
     ap.add_argument("-o", "--output", required=True)
+    ap.add_argument(
+        "--mode",
+        choices=("full", "app"),
+        default=None,
+        help="full=standalone domains.conf; app=sites.conf for host gateway",
+    )
     args = ap.parse_args()
     conf = load_packageconfig(Path(args.packageconfig))
     prof = get_profile(conf, args.profile)
-    out = render_gateway(conf, args.profile, prof, Path(args.output).name)
+    out_name = Path(args.output).name
+    mode = args.mode
+    if mode is None:
+        mode = "app" if out_name == "sites.conf" else "full"
+    if mode == "app":
+        out = render_app_sites(prof)
+    else:
+        out = render_gateway(conf, args.profile, prof, out_name)
     Path(args.output).write_text(out, encoding="utf-8")
     print(f"wrote {args.output}")
     return 0

package/lib/host_gateway.sh

@@ -0,0 +1,115 @@
+#!/usr/bin/env bash
+# Host / shared gateway helpers. Sourced by install.sh and start scripts.
+# shellcheck shell=bash
+
+vibed_gateway_home() {
+  if [[ -n "${GATEWAY_HOME:-}" ]]; then
+    echo "$GATEWAY_HOME"
+    return 0
+  fi
+  if [[ -n "${HOME:-}" ]]; then
+    echo "${HOME}/services/gateway"
+    return 0
+  fi
+  echo "/var/lib/vibed/gateway"
+}
+
+vibed_home() {
+  if [[ -n "${VIBED_HOME:-}" ]]; then
+    echo "$VIBED_HOME"
+    return 0
+  fi
+  if [[ -n "${HOME:-}" ]]; then
+    echo "${HOME}/services/vibed-infra"
+    return 0
+  fi
+  echo "/var/lib/vibed"
+}
+
+vibed_host_gateway_ready() {
+  local home
+  home="$(vibed_gateway_home)"
+  [[ -f "${home}/.vibed-host-gateway" ]]
+}
+
+vibed_bootstrap_host_gateway() {
+  local packager="${1:?packager root or URL}"
+  local home
+  home="$(vibed_gateway_home)"
+  mkdir -p "$home/gateway/conf.d" "$home/apps" "$home/certs" "$home/certbot-www"
+
+  if [[ -f "${home}/.vibed-host-gateway" ]]; then
+    echo "host gateway already present: $home"
+    return 0
+  fi
+
+  echo "bootstrapping host gateway at $home"
+
+  _hg_fetch() {
+    local rel="$1" dest="$2"
+    mkdir -p "$(dirname "$dest")"
+    if [[ "$packager" =~ ^/ ]]; then
+      cp -f "${packager}/${rel}" "$dest"
+    else
+      if command -v curl >/dev/null 2>&1; then
+        curl -fsSL "${packager}/${rel}" -o "$dest"
+      else
+        wget -qO "$dest" "${packager}/${rel}"
+      fi
+    fi
+  }
+
+  _hg_fetch "templates/host-gateway/gateway/nginx.conf" "$home/gateway/nginx.conf"
+  _hg_fetch "templates/host-gateway/gateway/conf.d/00-default.conf" "$home/gateway/conf.d/00-default.conf"
+  _hg_fetch "templates/host-gateway/.env.example" "$home/.env.example"
+  _hg_fetch "templates/host-gateway/start-gateway.sh" "$home/start-gateway.sh"
+  _hg_fetch "templates/host-gateway/reload-gateway.sh" "$home/reload-gateway.sh"
+  _hg_fetch "templates/host-gateway/update-gateway.sh" "$home/update-gateway.sh"
+  chmod +x "$home/start-gateway.sh" "$home/reload-gateway.sh" "$home/update-gateway.sh"
+
+  if [[ ! -f "$home/.env" ]]; then
+    cp "$home/.env.example" "$home/.env"
+  fi
+  if [[ -f "${packager}/lib/env.sh" ]] || [[ "$packager" =~ ^/ ]]; then
+    if [[ "$packager" =~ ^/ ]]; then
+      cp -f "${packager}/lib/env.sh" "$home/lib-env.sh"
+    fi
+  fi
+
+  echo "1" >"${home}/.vibed-host-gateway"
+  echo "bootstrapped host gateway: $home"
+}
+
+vibed_install_app_sites() {
+  local app_name="$1"
+  local sites_conf_src="$2"
+  local meta_json="${3:-}"
+  local home
+  home="$(vibed_gateway_home)"
+  local app_dir="${home}/apps/${app_name}"
+  mkdir -p "$app_dir"
+  cp -f "$sites_conf_src" "${app_dir}/sites.conf"
+  if [[ -n "$meta_json" && -f "$meta_json" ]]; then
+    cp -f "$meta_json" "${app_dir}/meta.json"
+  fi
+  echo "installed app sites: ${app_dir}/sites.conf"
+}
+
+vibed_reload_or_start_gateway() {
+  local home
+  home="$(vibed_gateway_home)"
+  # shellcheck source=/dev/null
+  [[ -f "$home/lib-env.sh" ]] && source "$home/lib-env.sh"
+  # shellcheck disable=SC1091
+  [[ -f "$home/.env" ]] && load_dotenv "$home/.env" 2>/dev/null || true
+  local name="${GATEWAY_NAME:-vps-gateway}"
+  if docker inspect "$name" >/dev/null 2>&1; then
+    if [[ -x "$home/reload-gateway.sh" ]]; then
+      (cd "$home" && ./reload-gateway.sh)
+    else
+      (cd "$home" && ./start-gateway.sh)
+    fi
+  else
+    (cd "$home" && ./start-gateway.sh)
+  fi
+}