vibed-infra 0.6.0 → 0.7.0

package/README.md

@@ -8,30 +8,33 @@ Published on npm as **`vibed-infra`**.
 
 | File | Purpose |
 |------|---------|
-| `vibed-infra-config.yml` | Name, templates, `network.edge` (default `vps-edge`), `gateway.sites[]`, auto-update |
+| `vibed-infra-config.yml` | Name, templates, `network.edge`, `gateway.publicIp` / `tlsEmail` / `sites[]`, auto-update |
 | `api-config.yaml` / `ui-config.yaml` / `nodes-config.yaml` | Images + opaque config |
 
 ```bash
 ./package.sh
 git add dist && git commit && git push
-# Copy dist/DNS-SKILL.md into AU agent browser extension; give it the VPS IP
+# Copy dist/DNS-SKILL.md into AU agent (domains + publicIp already filled when configured)
 ```
 
 ## Operator flow (VPS)
 
 ```bash
+# 1) DNS — paste dist/DNS-SKILL.md into AU browser agent
+# 2) App roles
 wget -qO- .../dist/install-api.sh | bash
 wget -qO- .../dist/install-ui.sh | bash
 wget -qO- .../dist/install-nodes.sh | bash
-wget -qO- .../dist/install-gateway.sh | bash   # bootstraps ~/services/gateway once + apps/{name}/
+# 3) Host gateway + TLS (setup-tls.sh; re-run with --force if host/IP changes)
+wget -qO- .../dist/install-gateway.sh | bash
 ```
 
 | Profile | Role |
 |---------|------|
 | `api` / `ui` / `nodes` | Join shared `vps-edge` |
-| `gateway` | Host nginx + this app’s `sites.conf` under `apps/` |
+| `gateway` | Host nginx + `apps/{name}/sites.conf` + HTTPS via `~/services/gateway/setup-tls.sh` |
 
-Multi-app: further products’ `install-gateway.sh` only add `apps/{other}/sites.conf` and reload — no second 80/443 bind.
+Multi-app: further products’ `install-gateway.sh` only add `apps/{other}/sites.conf`, refresh TLS SANs, and reload — no second 80/443 bind.
 
 ## Machine services (installed once)
 
@@ -41,7 +44,7 @@ Multi-app: further products’ `install-gateway.sh` only add `apps/{other}/sites
 | `~/services/vibed-infra/update-agent` | Serial pull queue + optional GHCR webhook |
 | `~/services/vibed-infra/persist-logs` | Per-app WALs + optional R2/S3 ship |
 
-Auto-update cron **enqueues** work; the agent processes one job at a time. Updates prune dangling images (`DOCKER_AUTO_PRUNE=1`).
+Auto-update cron **enqueues** work; the agent processes one job at a time. After a GHCR push, the reusable image workflow mints a GitHub Actions OIDC JWT and notifies `https://{domain}/_vibed/hooks/ghcr` (fallback `http://{publicIp}/…`) so the pull does not wait for cron. Updates prune dangling images (`DOCKER_AUTO_PRUNE=1`).
 
 ## Layout
 
@@ -60,6 +63,8 @@ Auto-update cron **enqueues** work; the agent processes one job at a time. Updat
 |----------|---------|
 | `GATEWAY_HOME` | Host gateway dir (default `~/services/gateway`) |
 | `VIBED_HOME` | Machine vibed root (default `~/services/vibed-infra`) |
+| `GATEWAY_PUBLIC_IP` | VPS IPv4 (from `gateway.publicIp`) |
+| `TLS_EMAIL` / `TLS_MODE` | Let’s Encrypt email; `lab` or `letsencrypt` |
 | `PERSIST_LOG_DIR` | Per-service event log dir |
 | `DOCKER_AUTO_PRUNE` | Prune dangling images after update (default on) |
 
@@ -68,6 +73,7 @@ Auto-update cron **enqueues** work; the agent processes one job at a time. Updat
 ```bash
 npm test
 npm run test:dist
+npm run test:e2e-multi   # two apps, localhost wget|bash, shared host gateway
 ```
 
 ## Publishing

package/github/notify-vps-pull.py

@@ -0,0 +1,194 @@
+#!/usr/bin/env python3
+"""Notify a vibed-infra VPS to pull a GHCR image.
+
+Prefers GitHub Actions OIDC (no shared secret). Falls back to compiled
+config token / VIBED_WEBHOOK_SECRET for local curl.
+"""
+from __future__ import annotations
+
+import argparse
+import json
+import os
+import sys
+import urllib.error
+import urllib.parse
+import urllib.request
+from pathlib import Path
+
+# Keep in sync with lib/webhook.py
+HOOK_PATH = "/_vibed/hooks/ghcr"
+TOKEN_VERSION = "vibed-webhook|v1|"
+
+
+def _derive_token(name: str, public_ip: str, host: str) -> str:
+    import hashlib
+
+    raw = f"{TOKEN_VERSION}{name}|{public_ip}|{host}"
+    return hashlib.sha256(raw.encode()).hexdigest()[:32]
+
+
+def _strip(s: str) -> str:
+    s = s.strip()
+    if (s.startswith('"') and s.endswith('"')) or (s.startswith("'") and s.endswith("'")):
+        return s[1:-1]
+    return s
+
+
+def _load_webhook(path: Path) -> dict[str, str]:
+    text = path.read_text(encoding="utf-8")
+    url = fallback = token = name = public_ip = host = ""
+    in_webhook = False
+    in_sites = False
+    for raw in text.splitlines():
+        line = raw.rstrip()
+        stripped = line.lstrip()
+        if stripped.startswith("webhook:"):
+            in_webhook = True
+            in_sites = False
+            continue
+        if in_webhook:
+            if stripped and not line.startswith(" ") and not line.startswith("\t"):
+                in_webhook = False
+            elif stripped.startswith("url:"):
+                url = _strip(stripped.split(":", 1)[1])
+            elif stripped.startswith("fallbackUrl:"):
+                fallback = _strip(stripped.split(":", 1)[1])
+            elif stripped.startswith("token:"):
+                token = _strip(stripped.split(":", 1)[1])
+        if stripped.startswith("name:") and not name:
+            name = _strip(stripped.split(":", 1)[1])
+        if stripped.startswith("publicIp:"):
+            public_ip = _strip(stripped.split(":", 1)[1])
+        if stripped.startswith("sites:"):
+            in_sites = True
+            continue
+        if in_sites and stripped.startswith("- host:"):
+            host = _strip(stripped.split(":", 1)[1])
+            in_sites = False
+        elif in_sites and stripped.startswith("host:"):
+            host = _strip(stripped.split(":", 1)[1])
+            in_sites = False
+    if not token and name and (public_ip or host):
+        token = _derive_token(name, public_ip, host)
+    if not url and host:
+        url = f"https://{host}{HOOK_PATH}"
+    if not fallback and public_ip:
+        fallback = f"http://{public_ip}{HOOK_PATH}"
+    if not url:
+        url = fallback
+    return {"url": url, "fallbackUrl": fallback, "token": token}
+
+
+def _package_from_image(image: str) -> str:
+    img = image.split("@", 1)[0]
+    if "/" in img:
+        return img.rsplit("/", 1)[-1].split(":")[0]
+    return img.split(":")[0]
+
+
+def fetch_oidc_token(audience: str) -> str:
+    url = os.environ.get("ACTIONS_ID_TOKEN_REQUEST_URL") or ""
+    tok = os.environ.get("ACTIONS_ID_TOKEN_REQUEST_TOKEN") or ""
+    if not url or not tok:
+        return ""
+    sep = "&" if "?" in url else "?"
+    req = urllib.request.Request(
+        f"{url}{sep}audience={urllib.parse.quote(audience, safe='')}",
+        headers={"Authorization": f"Bearer {tok}", "Accept": "application/json"},
+    )
+    try:
+        with urllib.request.urlopen(req, timeout=20) as resp:
+            data = json.loads(resp.read().decode())
+        return str(data.get("value") or "")
+    except Exception as e:
+        print(f"notify-vps: OIDC mint failed: {e}", file=sys.stderr)
+        return ""
+
+
+def _post(url: str, body: dict, *, bearer: str = "", secret: str = "") -> tuple[int, str]:
+    headers = {"Content-Type": "application/json"}
+    if bearer:
+        headers["Authorization"] = f"Bearer {bearer}"
+    if secret:
+        headers["X-Vibed-Secret"] = secret
+    req = urllib.request.Request(
+        url,
+        data=json.dumps(body).encode(),
+        method="POST",
+        headers=headers,
+    )
+    try:
+        with urllib.request.urlopen(req, timeout=15) as resp:
+            return resp.status, resp.read().decode()
+    except urllib.error.HTTPError as e:
+        return e.code, e.read().decode(errors="replace")
+    except Exception as e:
+        return 0, str(e)
+
+
+def main() -> int:
+    ap = argparse.ArgumentParser()
+    ap.add_argument("--image", required=True)
+    ap.add_argument("--tag", default="main")
+    ap.add_argument("--config", default="")
+    ap.add_argument("--url", action="append", default=[], help="Override webhook URL (repeatable)")
+    ap.add_argument("--strict", action="store_true", help="Exit 1 if notify fails")
+    args = ap.parse_args()
+
+    spec = {"url": "", "fallbackUrl": "", "token": ""}
+    if not args.url:
+        roots = []
+        if args.config:
+            roots.append(Path(args.config))
+        cwd = Path.cwd()
+        roots.extend(
+            [
+                cwd / "dist" / "packageconfig.yaml",
+                cwd / "packageconfig.yaml",
+                cwd / "templates" / "vibed-infra-config.yml",
+            ]
+        )
+        conf_path = next((p for p in roots if p.is_file()), None)
+        if conf_path:
+            spec = _load_webhook(conf_path)
+        elif not args.url:
+            print("notify-vps: no packageconfig (set gateway.publicIp + sites[].host)", file=sys.stderr)
+            return 1 if args.strict else 0
+
+    token = os.environ.get("VIBED_WEBHOOK_SECRET") or spec.get("token") or ""
+    urls = list(args.url) if args.url else [u for u in (spec.get("url"), spec.get("fallbackUrl")) if u]
+    seen: set[str] = set()
+    urls = [u for u in urls if not (u in seen or seen.add(u))]
+    has_oidc = bool(os.environ.get("ACTIONS_ID_TOKEN_REQUEST_URL"))
+    if not urls:
+        print("notify-vps: skipped (no webhook url)", file=sys.stderr)
+        return 1 if args.strict else 0
+    if not has_oidc and not token:
+        print("notify-vps: skipped (no OIDC env and no token)", file=sys.stderr)
+        return 1 if args.strict else 0
+
+    pkg = _package_from_image(args.image)
+    payload = {"package": pkg, "tag": args.tag, "image": args.image}
+    last_err = ""
+    for url in urls:
+        bearer = fetch_oidc_token(url) if has_oidc else ""
+        secret = "" if bearer else token
+        if not bearer and not secret:
+            last_err = f"{url}: no OIDC token"
+            print(f"notify-vps: {last_err}", file=sys.stderr)
+            continue
+        try:
+            code, text = _post(url, payload, bearer=bearer, secret=secret)
+        except Exception as e:
+            code, text = 0, str(e)
+        if code == 200:
+            print(f"notify-vps: {url} → {text.strip()}")
+            return 0
+        last_err = f"{url} HTTP {code}: {text[:200]}"
+        print(f"notify-vps: {last_err}", file=sys.stderr)
+    print(f"notify-vps: failed ({last_err})", file=sys.stderr)
+    return 1 if args.strict else 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/github/workflows/docker-build-reusable.yml

@@ -4,12 +4,19 @@
 #
 #   jobs:
 #     build-api:
-#       uses: ./infra/github/workflows/docker-build-reusable.yml
+#       uses: naiemk/vibed-infra/.github/workflows/docker-build-reusable.yml@main
 #       with:
 #         dockerfile: deploy/Dockerfile.api
 #         image: ghcr.io/${{ github.repository_owner }}/my-api
 #         context: .
+#       permissions:
+#         contents: read
+#         packages: write
+#         id-token: write
 #       secrets: inherit
+#
+# After push to the default branch, notifies the VPS using GitHub Actions OIDC
+# (audience = webhook URL). No GitHub Packages webhook and no extra secrets.
 
 name: Reusable docker build (single image)
 
@@ -26,14 +33,26 @@ on:
         required: false
         type: string
         default: .
+      notify:
+        required: false
+        type: boolean
+        default: true
+    secrets:
+      VIBED_WEBHOOK_SECRET:
+        required: false
 
 permissions:
   contents: read
   packages: write
+  id-token: write
 
 jobs:
   build-push:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
     steps:
       - uses: actions/checkout@v4
       - uses: docker/setup-buildx-action@v3
@@ -59,3 +78,15 @@ jobs:
           labels: |
             org.opencontainers.image.revision=${{ github.sha }}
             org.opencontainers.image.source=https://github.com/${{ github.repository }}
+      - name: Notify VPS to pull
+        if: inputs.notify && github.event.repository.default_branch == github.ref_name
+        continue-on-error: true
+        env:
+          VIBED_WEBHOOK_SECRET: ${{ secrets.VIBED_WEBHOOK_SECRET }}
+        run: |
+          script=dist/notify-vps-pull.py
+          if [[ ! -f "$script" ]]; then
+            echo "notify-vps: dist/notify-vps-pull.py missing — re-package and commit dist/"
+            exit 0
+          fi
+          python3 "$script" --image "${{ inputs.image }}" --tag main

package/install.sh

@@ -57,7 +57,7 @@ LOCAL_PACKAGER=0
 if [[ "$PACKAGER_RAW" =~ ^/ ]] && [[ -d "$PACKAGER_RAW/lib" ]]; then
   LOCAL_PACKAGER=1
 fi
-for lib in fetch.sh env.sh prompt.sh tls.sh load_config.py generate.py host_gateway.sh; do
+for lib in fetch.sh env.sh prompt.sh tls.sh load_config.py generate.py host_gateway.sh update_queue.sh webhook.py github_oidc.py; do
   if [[ "$LOCAL_PACKAGER" == "1" ]]; then
     cp -f "${PACKAGER_RAW}/lib/${lib}" "${INFRA_LIB}/${lib}"
   else
@@ -319,8 +319,83 @@ EOF
 chmod +x "$DEST/${START_SCRIPT}" 2>/dev/null || true
 
 # Ensure update-agent + persist-logs on first install (idempotent)
-if [[ -f "${PACKAGER_RAW}/templates/update-agent/install-agent.sh" ]]; then
-  PACKAGER_RAW="$PACKAGER_RAW" VIBED_HOME="${VIBED_HOME:-}" bash "${PACKAGER_RAW}/templates/update-agent/install-agent.sh" || true
+_install_update_agent() {
+  local agent_packager="$PACKAGER_RAW"
+  if [[ "$LOCAL_PACKAGER" != "1" ]]; then
+    agent_packager="${DEST}/.infra-packager"
+    mkdir -p "$agent_packager/lib" "$agent_packager/templates/update-agent"
+    cp -f "${INFRA_LIB}/update_queue.sh" "$agent_packager/lib/update_queue.sh" 2>/dev/null || true
+    cp -f "${INFRA_LIB}/webhook.py" "$agent_packager/lib/webhook.py" 2>/dev/null || true
+    cp -f "${INFRA_LIB}/github_oidc.py" "$agent_packager/lib/github_oidc.py" 2>/dev/null || true
+    for f in install-agent.sh agent.sh enqueue.sh webhook_server.py; do
+      _fetch "${PACKAGER_RAW}/templates/update-agent/${f}" "$agent_packager/templates/update-agent/${f}" || true
+    done
+  fi
+  if [[ -f "${agent_packager}/templates/update-agent/install-agent.sh" ]]; then
+    chmod +x "$agent_packager/templates/update-agent/"*.sh 2>/dev/null || true
+    PACKAGER_RAW="$agent_packager" VIBED_HOME="${VIBED_HOME:-}" bash "${agent_packager}/templates/update-agent/install-agent.sh" || true
+  fi
+}
+_install_update_agent
+
+# Register this install so GHCR notify can enqueue without waiting for cron
+PRODUCT_NAME="${PRODUCT_NAME:-$(
+  python3 -c "
+import sys
+sys.path.insert(0, '${INFRA_LIB}')
+from load_config import load_packageconfig
+from pathlib import Path
+print(load_packageconfig(Path('${PC_LOCAL}')).get('name') or 'app')
+"
+)}"
+_REG_ROLE="$ROLE"
+case "$ROLE" in
+  backend) _REG_ROLE=api ;;
+  workers) _REG_ROLE=nodes ;;
+esac
+# shellcheck source=/dev/null
+if [[ -f "${INFRA_LIB}/update_queue.sh" ]]; then
+  source "${INFRA_LIB}/update_queue.sh"
+elif [[ -f "${PACKAGER_RAW}/lib/update_queue.sh" ]]; then
+  source "${PACKAGER_RAW}/lib/update_queue.sh"
+fi
+if declare -F vibed_register_app >/dev/null 2>&1; then
+  _env_val() {
+    local key="$1"
+    [[ -f "$DEST/.env" ]] || return 0
+    grep -E "^${key}=" "$DEST/.env" 2>/dev/null | head -1 | cut -d= -f2-
+  }
+  _REG_IMAGE=""
+  case "$_REG_ROLE" in
+    api) _REG_IMAGE="$(_env_val BACKEND_IMAGE)" ;;
+    ui) _REG_IMAGE="$(_env_val UI_IMAGE)" ;;
+    nodes) _REG_IMAGE="$(_env_val WORKER_IMAGE)" ;;
+    gateway) _REG_IMAGE="$(_env_val NGINX_IMAGE)" ;;
+  esac
+  vibed_register_app "$PRODUCT_NAME" "$_REG_ROLE" "$DEST" "$_REG_IMAGE" || true
+  _HOOK_TOKEN="$(
+    python3 -c "
+import sys
+sys.path.insert(0, '${INFRA_LIB}')
+from pathlib import Path
+from load_config import load_packageconfig
+try:
+    from webhook import webhook_from_packageconfig
+except ImportError:
+    webhook_from_packageconfig = None
+c = load_packageconfig(Path('${PC_LOCAL}'))
+if webhook_from_packageconfig:
+    print(webhook_from_packageconfig(c).get('token') or '')
+else:
+    print((c.get('webhook') or {}).get('token') or '')
+"
+  )"
+  if [[ -n "${_HOOK_TOKEN}" ]]; then
+    AGENT_HOME="$(vibed_agent_home 2>/dev/null || echo "${VIBED_HOME:-$HOME/services/vibed-infra}/update-agent")"
+    mkdir -p "${AGENT_HOME}/tokens"
+    printf '%s\n' "$_HOOK_TOKEN" >"${AGENT_HOME}/tokens/${PRODUCT_NAME}"
+    echo "webhook token registered for ${PRODUCT_NAME}"
+  fi
 fi
 if [[ -f "${PACKAGER_RAW}/templates/persist-logs/install-persist-logs.sh" ]]; then
   PACKAGER_RAW="$PACKAGER_RAW" VIBED_HOME="${VIBED_HOME:-}" bash "${PACKAGER_RAW}/templates/persist-logs/install-persist-logs.sh" || true
@@ -333,67 +408,90 @@ if [[ "$ROLE" == "gateway" ]]; then
   source "$DEST/lib-env.sh"
   load_dotenv "$DEST/.env"
   HG="$(vibed_gateway_home)"
-  # Prefer host certs
-  if [[ -f "$HG/.env" ]]; then
-    load_dotenv "$HG/.env"
-  fi
-  CERT_DIR="$(python3 -c "
+  mkdir -p "$HG/certs" "$HG/certbot-www"
+
+  # Propagate public IP / TLS email from packageconfig into host + product .env
+  GW_PUBLIC_IP="$(
+    python3 -c "
 import sys
 sys.path.insert(0, '${INFRA_LIB}')
 from load_config import load_packageconfig, get_profile
 from pathlib import Path
-p = get_profile(load_packageconfig(Path('${PC_LOCAL}')), '${PROFILE}')
-sites = p.get('sites') or []
-if not sites:
-    print('${HG}/certs')
-else:
-    s = sites[0]
-    print(s.get('tlsCertDir') or ('${HG}/certs'))
-")"
-  TLS_FULLCHAIN="${TLS_FULLCHAIN:-${CERT_DIR}/fullchain.pem}"
-  TLS_PRIVKEY="${TLS_PRIVKEY:-${CERT_DIR}/privkey.pem}"
-  # Prefer writable host certs when packaged tlsCertDir is not writable (e.g. /etc/letsencrypt)
-  if [[ ! -f "$TLS_FULLCHAIN" ]]; then
-    HOST_CERT_DIR="${HG}/certs"
-    mkdir -p "$HOST_CERT_DIR" 2>/dev/null || true
-    if [[ -x "${PRODUCT_RAW}/gen-dev-certs.sh" ]]; then
-      APP_HOST="$(python3 -c "
+c = load_packageconfig(Path('${PC_LOCAL}'))
+p = get_profile(c, '${PROFILE}')
+print(p.get('publicIp') or '')
+"
+  )"
+  GW_TLS_EMAIL="$(
+    python3 -c "
 import sys
 sys.path.insert(0, '${INFRA_LIB}')
 from load_config import load_packageconfig, get_profile
 from pathlib import Path
-p = get_profile(load_packageconfig(Path('${PC_LOCAL}')), '${PROFILE}')
-sites = p.get('sites') or []
-print(sites[0]['host'] if sites else 'localhost')
-")"
-      if APP_HOST="$APP_HOST" bash "${PRODUCT_RAW}/gen-dev-certs.sh" "$HOST_CERT_DIR" 2>/dev/null; then
-        TLS_FULLCHAIN="${HOST_CERT_DIR}/fullchain.pem"
-        TLS_PRIVKEY="${HOST_CERT_DIR}/privkey.pem"
-      fi
+c = load_packageconfig(Path('${PC_LOCAL}'))
+p = get_profile(c, '${PROFILE}')
+print(p.get('tlsEmail') or '')
+"
+  )"
+  _patch_env() {
+    local file="$1" key="$2" val="$3"
+    [[ -n "$val" ]] || return 0
+    [[ -f "$file" ]] || return 0
+    if grep -q "^${key}=" "$file" 2>/dev/null; then
+      sed -i "s|^${key}=.*|${key}=${val}|" "$file"
+    else
+      echo "${key}=${val}" >>"$file"
     fi
-  fi
+  }
   if [[ -f "$HG/.env" ]]; then
-    sed -i "s|^TLS_FULLCHAIN=.*|TLS_FULLCHAIN=${TLS_FULLCHAIN}|" "$HG/.env" 2>/dev/null || true
-    sed -i "s|^TLS_PRIVKEY=.*|TLS_PRIVKEY=${TLS_PRIVKEY}|" "$HG/.env" 2>/dev/null || true
+    _patch_env "$HG/.env" GATEWAY_PUBLIC_IP "${GATEWAY_PUBLIC_IP:-$GW_PUBLIC_IP}"
+    _patch_env "$HG/.env" TLS_EMAIL "${TLS_EMAIL:-$GW_TLS_EMAIL}"
+    # Product/install env can force lab (CI) without wiping host LE later
+    if [[ -n "${TLS_MODE:-}" ]]; then
+      _patch_env "$HG/.env" TLS_MODE "$TLS_MODE"
+    fi
   fi
-  mapfile -t DOMAIN_ARR < <(python3 -c "
+  _patch_env "$DEST/.env" GATEWAY_PUBLIC_IP "${GATEWAY_PUBLIC_IP:-$GW_PUBLIC_IP}"
+  _patch_env "$DEST/.env" TLS_EMAIL "${TLS_EMAIL:-$GW_TLS_EMAIL}"
+
+  # Collect domains for TLS_DOMAINS fallback if apps conf not parseable yet
+  TLS_DOMAINS="$(
+    python3 -c "
 import sys
 sys.path.insert(0, '${INFRA_LIB}')
 from load_config import load_packageconfig, get_profile
 from pathlib import Path
 p = get_profile(load_packageconfig(Path('${PC_LOCAL}')), '${PROFILE}')
+names=[]
 for s in p.get('sites') or []:
-    print(s['host'])
-    for a in s.get('aliases') or []:
-        print(a)
-")
-  infra_tls_offer_interactive "$TLS_FULLCHAIN" "$TLS_PRIVKEY" "${DOMAIN_ARR[@]}" || true
+    names.append(s['host'])
+    names.extend(s.get('aliases') or [])
+print(' '.join(names))
+"
+  )"
+  export TLS_DOMAINS
+  export GATEWAY_PUBLIC_IP="${GATEWAY_PUBLIC_IP:-$GW_PUBLIC_IP}"
+  export TLS_EMAIL="${TLS_EMAIL:-$GW_TLS_EMAIL}"
+
+  if [[ -x "$HG/setup-tls.sh" ]]; then
+    echo "Running host gateway TLS setup ..."
+    (cd "$HG" && GATEWAY_HOME="$HG" TLS_DOMAINS="$TLS_DOMAINS" \
+      GATEWAY_PUBLIC_IP="${GATEWAY_PUBLIC_IP:-}" \
+      TLS_EMAIL="${TLS_EMAIL:-}" \
+      TLS_MODE="${TLS_MODE:-}" \
+      ./setup-tls.sh) || {
+      echo "TLS setup did not complete — fix DNS then: cd $HG && ./setup-tls.sh --force" >&2
+    }
+  else
+    echo "warning: $HG/setup-tls.sh missing — re-run gateway install to bootstrap" >&2
+  fi
 fi
 
 echo ""
 if [[ "$ROLE" == "gateway" ]]; then
   echo "Install complete. Host gateway: $(vibed_gateway_home)"
   echo "App sites: $(vibed_gateway_home)/apps/${PRODUCT_NAME:-app}/sites.conf"
+  echo "TLS: cd $(vibed_gateway_home) && ./setup-tls.sh   # re-run if host/IP/domains change (--force)"
   echo "Start: cd $DEST && ./start-gateway.sh"
 else
   echo "Install complete. Start: cd $DEST && ./${START_SCRIPT}"

package/lib/generate.py

@@ -59,6 +59,14 @@ server {{
   set ${be_var}_upstream {backend}:{backend_port};
   set ${ui_var}_upstream {ui}:{ui_port};
 
+  location /_vibed/hooks/ {{
+    proxy_pass http://host.docker.internal:19200;
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+  }}
+
   location = {health} {{
 {proxy_headers}
   }}