py-serverless-kit 0.2.0__tar.gz → 0.3.0__tar.gz

{py_serverless_kit-0.2.0 → py_serverless_kit-0.3.0}/CHANGELOG.md

@@ -6,6 +6,17 @@ All notable changes to this project are documented here. The format follows [Kee
 
 ## [Unreleased]
 
+## [0.3.0] - 2026-10-17
+
+### Added
+- On-premises deploy targets. `provider.options.deploy.method` is `local` (default, previous behaviour), `ssh` (copy the host over OpenSSH and start a process or systemd unit), or `docker` (build an image that already contains Python). When the server has no Python, set `python: bundle` to ship a portable CPython, or use `method: docker`. `python_home` / `python_url` cover air-gapped mirrors. Wheels are vendored for the target OS/arch (manylinux when the server is Linux).
+- Example [17-on-premises-remote](examples/17-on-premises-remote): SSH + bundled interpreter + systemd.
+
+### Fixed
+- On-prem host: Windows process helpers (`ctypes.windll`, `subprocess.DETACHED_PROCESS`) are gated on `sys.platform == "win32"` so mypy on Linux/macOS CI no longer reports missing attributes.
+
+Redeploy on-premises hosts to pick up the new `onprem_deploy.py` provisioner. Handler code is unchanged.
+
 ## [0.2.0] - 2026-10-17
 
 ### Added

{py_serverless_kit-0.2.0 → py_serverless_kit-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: py-serverless-kit
-Version: 0.2.0
+Version: 0.3.0
 Summary: Write a Python serverless function once and deploy it to AWS, Azure, GCP, 7 more clouds, or an on-premises host with one YAML file, powered by Terraform.
 Project-URL: Homepage, https://github.com/ak9347128658/serverless_kit
 Project-URL: Documentation, https://github.com/ak9347128658/serverless_kit/tree/main/docs
@@ -97,7 +97,7 @@ Teams that build on AWS Lambda and Step Functions end up with code full of API G
 
 ## Features
 
-- **10 clouds and an on-premises host:** AWS Lambda, Azure Functions, Google Cloud Functions (gen2), Alibaba Function Compute, Oracle Functions, IBM Code Engine, DigitalOcean Functions, Tencent SCF, Huawei FunctionGraph, Cloudflare Workers, plus a process on your own machine (`onprem`).
+- **10 clouds and an on-premises host:** AWS Lambda, Azure Functions, Google Cloud Functions (gen2), Alibaba Function Compute, Oracle Functions, IBM Code Engine, DigitalOcean Functions, Tencent SCF, Huawei FunctionGraph, Cloudflare Workers, plus a process on your own machine or a remote server (`onprem`: local, SSH, Docker, or a bundled CPython when the server has no Python).
 - **Triggers:** HTTP (path params, CORS, auth), schedules (rate/cron, translated into each cloud's cron dialect), queues, object storage, pub/sub topics, and direct function-to-function `invoke()`.
 - **Workflows:** task / choice / wait / pass / parallel / map / succeed / fail with retry and catch. Native on AWS and GCP; an embedded engine on the other clouds; runnable locally with `pskit workflow run`.
 - **Terraform underneath:** real, reviewable `main.tf.json`, any backend (S3, GCS, azurerm, ...), works with OpenTofu. Escape hatches: `terraform.extra`, `${tf:...}` references, per-function `options`.
@@ -120,7 +120,7 @@ Teams that build on AWS Lambda and Step Functions end up with code full of API G
 | IBM Code Engine | beta | ✅ | – | – | – | – | embedded |
 | Oracle Cloud Functions | experimental | ✅ | – | – | ✅ | – | embedded |
 | Cloudflare Workers (Python) | experimental | ✅ | ✅ | – | – | – | embedded |
-| On-premises | experimental | ✅ | ✅ | ✅ files | ✅ directory | ✅ files | embedded (in the host) |
+| On-premises | experimental | ✅ | ✅ | ✅ files | ✅ directory | ✅ files | embedded (local, SSH, or Docker) |
 
 Run `pskit providers` for the live matrix. If a config uses a trigger the target cloud can't support, **`pskit validate` fails with a clear message instead of deploying something half-working.**
 

{py_serverless_kit-0.2.0 → py_serverless_kit-0.3.0}/README.md

@@ -53,7 +53,7 @@ Teams that build on AWS Lambda and Step Functions end up with code full of API G
 
 ## Features
 
-- **10 clouds and an on-premises host:** AWS Lambda, Azure Functions, Google Cloud Functions (gen2), Alibaba Function Compute, Oracle Functions, IBM Code Engine, DigitalOcean Functions, Tencent SCF, Huawei FunctionGraph, Cloudflare Workers, plus a process on your own machine (`onprem`).
+- **10 clouds and an on-premises host:** AWS Lambda, Azure Functions, Google Cloud Functions (gen2), Alibaba Function Compute, Oracle Functions, IBM Code Engine, DigitalOcean Functions, Tencent SCF, Huawei FunctionGraph, Cloudflare Workers, plus a process on your own machine or a remote server (`onprem`: local, SSH, Docker, or a bundled CPython when the server has no Python).
 - **Triggers:** HTTP (path params, CORS, auth), schedules (rate/cron, translated into each cloud's cron dialect), queues, object storage, pub/sub topics, and direct function-to-function `invoke()`.
 - **Workflows:** task / choice / wait / pass / parallel / map / succeed / fail with retry and catch. Native on AWS and GCP; an embedded engine on the other clouds; runnable locally with `pskit workflow run`.
 - **Terraform underneath:** real, reviewable `main.tf.json`, any backend (S3, GCS, azurerm, ...), works with OpenTofu. Escape hatches: `terraform.extra`, `${tf:...}` references, per-function `options`.
@@ -76,7 +76,7 @@ Teams that build on AWS Lambda and Step Functions end up with code full of API G
 | IBM Code Engine | beta | ✅ | – | – | – | – | embedded |
 | Oracle Cloud Functions | experimental | ✅ | – | – | ✅ | – | embedded |
 | Cloudflare Workers (Python) | experimental | ✅ | ✅ | – | – | – | embedded |
-| On-premises | experimental | ✅ | ✅ | ✅ files | ✅ directory | ✅ files | embedded (in the host) |
+| On-premises | experimental | ✅ | ✅ | ✅ files | ✅ directory | ✅ files | embedded (local, SSH, or Docker) |
 
 Run `pskit providers` for the live matrix. If a config uses a trigger the target cloud can't support, **`pskit validate` fails with a clear message instead of deploying something half-working.**
 

{py_serverless_kit-0.2.0 → py_serverless_kit-0.3.0}/docs/architecture.md

@@ -45,10 +45,12 @@ artifact.zip
 ├── <shim>                        pskit_entry.py (aws) · main.py (gcp) · function_app.py + host.json (azure)
 │                                 index.py (alibaba/tencent/huawei) · __main__.py (ibm/do)
 │                                 func.py + func.yaml + Dockerfile (oracle) · generated worker module (cloudflare)
-│                                 onprem_handler.py (onprem; the host process is started beside the zip)
+│                                 onprem_handler.py (onprem; the host is started beside the zip)
 └── dependencies or requirements.txt
 ```
 
+On-premises also writes `.pskit/onprem-<stage>/onprem_app/` (`pskit_host.json`, `onprem_ctl.py`, `onprem_deploy.py`, the staged bundle, and a Dockerfile or systemd unit when those methods are selected). Terraform `local-exec` runs `onprem_deploy.py apply`, which starts the host on this machine, copies it over SSH (detached process or systemd, optional portable CPython), or builds a Docker image.
+
 ## Runtime flow
 
 ```

{py_serverless_kit-0.2.0 → py_serverless_kit-0.3.0}/docs/configuration.md

@@ -45,7 +45,7 @@ extends: base.yml               # inherit another file (see below)
 | `iam.statements` | list of `{effect, actions, resources}` | `[]` | AWS-style; `effect` defaults to `Allow`, `resources` to `["*"]`. Ignored (with a warning) on clouds that don't map it |
 | `iam.role` | string | — | use an existing role / agency instead of creating one |
 | `log_retention_days` | int or null | `14` | AWS CloudWatch log group retention |
-| `options` | mapping | `{}` | provider-specific settings, see [providers.md](providers.md) |
+| `options` | mapping | `{}` | provider-specific settings, see [providers.md](providers.md). On-premises: `deploy.method` is `local`, `ssh`, or `docker`; `python: bundle` ships an interpreter when the server has none |
 | `state` | mapping | local state | see [state](#state-remote-terraform-backend) |
 | `terraform` | mapping | | see [terraform](#terraform) |
 

{py_serverless_kit-0.2.0 → py_serverless_kit-0.3.0}/docs/getting-started.md

@@ -109,7 +109,7 @@ pskit runs Terraform, so credentials come from each Terraform provider's standar
 | `tencent` | `TENCENTCLOUD_SECRET_ID` / `TENCENTCLOUD_SECRET_KEY`, or `options.profile` |
 | `huawei` | `HW_ACCESS_KEY` / `HW_SECRET_KEY` (+ `HW_REGION_NAME`), or `options.profile` |
 | `cloudflare` | `CLOUDFLARE_API_TOKEN`. `options.account_id` is required |
-| `onprem` | nothing to configure. Terraform's built-in provider starts a process with the Python that runs `pskit` |
+| `onprem` | local: nothing to configure (the Python that runs `pskit` starts the host). Remote: OpenSSH and `options.deploy.method: ssh`, or Docker and `method: docker`. Servers without Python: `python: bundle` or Docker |
 
 Provider-specific required options are listed in [providers.md](providers.md).
 

{py_serverless_kit-0.2.0 → py_serverless_kit-0.3.0}/docs/local-development.md

@@ -95,7 +95,7 @@ def test_workflow():
 
 ## On-premises is a deploy, not `pskit dev`
 
-`pskit dev` reloads HTTP handlers and drops the process when you stop it. `provider.name: onprem` is the durable run: `pskit deploy` starts a process that keeps schedules, file queues, directory storage, topics and embedded workflows after the command returns. See [providers.md](providers.md#onprem-on-premises) and [`examples/16-on-premises`](../examples/16-on-premises).
+`pskit dev` reloads HTTP handlers and drops the process when you stop it. `provider.name: onprem` is the durable run: `pskit deploy` starts a process that keeps schedules, file queues, directory storage, topics and embedded workflows after the command returns. `options.deploy.method` is `local` (this machine), `ssh`, or `docker`. See [providers.md](providers.md#onprem-on-premises), [`examples/16-on-premises`](../examples/16-on-premises) and [`examples/17-on-premises-remote`](../examples/17-on-premises-remote).
 | `http_event(method, path, body=None, headers=None, query=None)` | dict/list bodies are JSON-encoded; `?query` in `path` is parsed |
 | `build_event(type, data, **http)` | `queue`/`topic` (list → records), `storage` (`{"bucket", "key", "size", "action"}`), `schedule`, `invoke`, `workflow`, `http` |
 

{py_serverless_kit-0.2.0 → py_serverless_kit-0.3.0}/docs/providers.md

@@ -356,19 +356,19 @@ One Worker script per function. pskit generates a single Python module per Worke
 
 ## onprem (On-premises)
 
-- **Terraform:** built-in `terraform_data` (no plugin download)
-- **Credentials:** none. The host is the same Python that runs `pskit deploy`
-- **Dependencies:** pip wheels for this machine and interpreter, not a Linux cloud image. `tzdata` is vendored so cron timezones work on Windows
+- **Terraform:** built-in `terraform_data` (no plugin download). Create/destroy run `onprem_deploy.py` via `local-exec`
+- **Credentials:** none for `method: local`. SSH keys / an SSH agent for `method: ssh`. Docker CLI (and optional `DOCKER_HOST`) for `method: docker`
+- **Dependencies:** native pip wheels for a local host; manylinux / Windows / macOS wheels matching `deploy.target_os` and `architecture` for a remote host. `tzdata` is vendored so cron timezones work on Windows
 
 ```yaml
 provider:
   name: onprem
   region: local
   options:
-    host: 127.0.0.1          # bind address. 0.0.0.0 is advertised as 127.0.0.1 unless advertise is set
+    host: 127.0.0.1          # bind address on the *target*. 0.0.0.0 is advertised as 127.0.0.1 unless advertise is set
     port: 8080               # 1-65535. Give each service its own port
     advertise: https://fn.internal.example   # optional URL written into outputs
-    data_dir: .pskit/onprem-data             # default .pskit/onprem-data/<service>-<stage>
+    data_dir: .pskit/onprem-data             # default .pskit/onprem-data/<service>-<stage> (local); <path>/data on SSH
     poll_seconds: 0.5
     admin_token: "${env:PSKIT_ADMIN_TOKEN, }"  # header x-pskit-token on /__pskit/* except health
     services:
@@ -377,9 +377,11 @@ provider:
       storage: {use: directory, path: .onprem/buckets}
       topic: builtin
       workflow: embedded                       # builtin is an alias of embedded
+    deploy:
+      method: local          # local | ssh | docker   (default local)
 ```
 
-`pskit deploy` writes the bundle under `.pskit/onprem-<stage>/onprem_app/` and starts `onprem_ctl.py`. The process serves your HTTP routes and polls the service directories. `pskit remove` stops the process and does not delete `data_dir`.
+`pskit deploy` writes the bundle under `.pskit/onprem-<stage>/onprem_app/` and runs `onprem_deploy.py apply`. `pskit remove` stops the process (or container / systemd unit) and does not delete `data_dir`.
 
 Omitted services default to `builtin` and are created at start. `existing: true` on one queue, bucket or topic skips that create and waits until the directory appears. Names are a single path segment (`..`, slashes and NUL are rejected).
 
@@ -406,11 +408,47 @@ Publish from outside the process:
 
 From a handler in that process (`PSKIT_ONPREM_ROOT` is set), call `submit_queue`, `submit_topic`, `put_object` or `delete_object` in `py_serverless_kit.runtime.onprem_host`.
 
-**Resources:** `terraform_data.host` with create and destroy `local-exec` provisioners.
+**Deploy targets** (`options.deploy`)
 
-**Limits:** no cloud authorizer and no IAM mapping. A `terraform.extra` resource from another cloud (`aws_*`, `google_*`, `azurerm_*`, and the other cloud prefixes) is omitted with a warning. A state backend of `s3`, `gcs` or `azurerm` warns; set `provider.state.backend` empty (see `providers.onprem` in examples 11 and 15) to keep state on this machine. Delivery is at-least-once. A missed schedule fires once on the next poll, not as a burst. The host does not kill a handler at `timeout`; `ctx.remaining_time_ms()` still counts down. If `provider.runtime` is not the interpreter running `pskit`, validation warns and the host still uses that interpreter.
+| `method` | What runs | Target needs | Laptop needs |
+|---|---|---|---|
+| `local` (default) | detached process on this machine | Python (the interpreter that runs `pskit`) | — |
+| `ssh` | process or systemd unit on a remote host | SSH. Python only if `python: system` | OpenSSH (`ssh`, `scp`) |
+| `docker` | `docker build` + `docker run` | Docker engine, not Python | Docker CLI; set `docker_host: ssh://user@host` to use a remote daemon |
 
-Example: [`examples/16-on-premises`](../examples/16-on-premises).
+When the server has **no Python**, use `python: bundle` (a portable CPython from [python-build-standalone](https://github.com/astral-sh/python-build-standalone) is fetched at apply and copied with the app) or `method: docker` (the image is `FROM python:<minor>-slim`). Air-gapped: `python_home` (copy a tree you already have) or `python_url` + `python_sha256` (internal mirror of an `install_only` tarball).
+
+```yaml
+# SSH + portable CPython + systemd (server does not need Python)
+deploy:
+  method: ssh
+  host: 10.0.1.12                 # or deploy: ssh://pskit@10.0.1.12/opt/pskit/orders
+  user: pskit
+  port: 22
+  identity_file: ${env:PSKIT_SSH_KEY}   # optional; otherwise the SSH agent
+  known_hosts: accept-new         # accept-new | ignore | path to a known_hosts file
+  path: /opt/pskit/orders
+  python: bundle                  # auto | system | bundle
+  target_os: linux                # auto | linux | windows | darwin
+  target_arch: x86_64             # auto | x86_64 | arm64  (drives pip wheels)
+  install: systemd                # process | systemd (linux only)
+  sudo: true                      # needed to write /etc/systemd/system
+
+# Docker (server needs Docker, not Python)
+deploy:
+  method: docker
+  image: pskit/orders:dev
+  docker_host: ssh://pskit@10.0.1.12   # empty = Docker on this laptop
+  restart: unless-stopped
+```
+
+`options.host` is the bind address **on the target**. Use `0.0.0.0` so other machines can call a remote host. `advertise` is the URL stored in `pskit info`. SSH deploy defaults `advertise` to `http://<ssh host>:<port>` when it is unset.
+
+**Resources:** `terraform_data.host` with create (`onprem_deploy.py apply`) and destroy (`onprem_deploy.py destroy`) `local-exec` provisioners.
+
+**Limits:** no cloud authorizer and no IAM mapping. A `terraform.extra` resource from another cloud (`aws_*`, `google_*`, `azurerm_*`, and the other cloud prefixes) is omitted with a warning. A state backend of `s3`, `gcs` or `azurerm` warns; set `provider.state.backend` empty (see `providers.onprem` in examples 11 and 15) to keep state on this machine. Delivery is at-least-once. A missed schedule fires once on the next poll, not as a burst. The host does not kill a handler at `timeout`; `ctx.remaining_time_ms()` still counts down. If `method` is `local` and `provider.runtime` is not the interpreter running `pskit`, validation warns and the host still uses that interpreter. `python: bundle` needs network on first apply unless `python_home` or a cached archive under `~/.cache/pskit/python-standalone` is present. systemd units are written to `/etc/systemd/system` (set `sudo: true` unless the SSH user is root).
+
+Examples: [`examples/16-on-premises`](../examples/16-on-premises) (local process), [`examples/17-on-premises-remote`](../examples/17-on-premises-remote) (SSH / Docker / bundled Python).
 
 ---
 

{py_serverless_kit-0.2.0 → py_serverless_kit-0.3.0}/docs/troubleshooting.md

@@ -82,7 +82,7 @@ Add `-v` to any command to see the full traceback. Start with `pskit validate`,
 | digitalocean | `doctl` must be installed and authenticated (`doctl auth init`); `options.namespace` required; set `options.api_host` to get URLs |
 | ibm | HTTP only, python3.11 only, 120 s / 4 GB max; large bundles → `options.code_reference` |
 | cloudflare | Pyodide: only stdlib and Pyodide packages; `options.account_id` and `CLOUDFLARE_API_TOKEN` required; non-`.py` files aren't uploaded |
-| onprem | one process per service, so give each service its own `options.port`. `pskit remove` stops it and leaves `data_dir`. `auth` must be `none`. A cloud `terraform.extra` resource is omitted. Set `state.backend` empty when the file points at S3, GCS or Azure Storage |
+| onprem | one process per service, so give each service its own `options.port`. `pskit remove` stops it and leaves `data_dir`. `auth` must be `none`. A cloud `terraform.extra` resource is omitted. Set `state.backend` empty when the file points at S3, GCS or Azure Storage. Remote SSH needs `ssh`/`scp` on the laptop; a server without Python needs `deploy.python: bundle` or `method: docker`. systemd writes `/etc/systemd/system` (`sudo: true`). Bind `options.host: 0.0.0.0` on a remote host so other machines can call it |
 | alibaba / tencent / huawei | `iam.statements` aren't translated; set `iam.role` |
 
 ## FAQ

{py_serverless_kit-0.2.0 → py_serverless_kit-0.3.0}/examples/16-on-premises/README.md

@@ -58,3 +58,6 @@ Set `options.admin_token` and send `x-pskit-token` on `/__pskit/*` except
 
 `pskit dev` is still the hot-reloading HTTP server. This example is the durable
 deploy: it keeps running after `pskit deploy` returns.
+
+To copy the same host onto another machine (SSH, Docker, or a bundled CPython
+when that machine has no Python), see [17-on-premises-remote](../17-on-premises-remote).

py_serverless_kit-0.3.0/examples/17-on-premises-remote/README.md

@@ -0,0 +1,97 @@
+# 17 · On-premises, remote server
+
+Example 16 runs the host on the laptop that runs `pskit deploy`. This example
+copies the same kind of host onto a machine you SSH into — a factory box, a
+VM, or a rack server. The handler code does not change.
+
+Three ways to get code from this laptop onto that server:
+
+| `options.deploy.method` | What the server needs | What the laptop needs | When to use it |
+| --- | --- | --- | --- |
+| `local` | this machine (example 16) | Python + pskit | laptop / the server *is* the deploy machine |
+| `ssh` | SSH. Python only if `python: system` | OpenSSH (`ssh`, `scp`) | most on-prem Linux boxes |
+| `docker` | Docker engine | Docker CLI (and SSH if `docker_host` is `ssh://…`) | the server has Docker and you do not want to manage Python |
+
+When the server has **no Python**, pick one of:
+
+- `method: ssh` and `python: bundle` — pskit downloads a portable CPython
+  ([python-build-standalone](https://github.com/astral-sh/python-build-standalone))
+  at apply time, copies it with the app, and starts systemd (this file)
+- `method: docker` — the image is `FROM python:3.12-slim`; the server never
+  installs Python
+- `python_home: /path/to/portable-python` — air-gapped: you already have a
+  CPython tree, pskit copies it instead of downloading
+
+## This file (SSH + bundled Python + systemd)
+
+```bash
+export PSKIT_ONPREM_HOST=10.0.1.12          # SSH target
+export PSKIT_ONPREM_USER=pskit
+export PSKIT_SSH_KEY=$HOME/.ssh/id_ed25519  # optional
+export PSKIT_ONPREM_URL=http://10.0.1.12:8090
+pskit deploy
+curl http://10.0.1.12:8090/hello?name=Ada
+pskit remove                                 # systemctl stop; data dir stays
+```
+
+The SSH user needs `sudo` to write `/etc/systemd/system` (`deploy.sudo: true`).
+Wheels are vendored as manylinux x86_64 because `target_os: linux`.
+
+Shorthand for the same method:
+
+```yaml
+deploy: ssh://pskit@10.0.1.12/opt/pskit/factory-api
+```
+
+## Docker instead
+
+The server needs a Docker engine. It does not need Python.
+
+```yaml
+provider:
+  options:
+    host: 0.0.0.0
+    port: 8090
+    deploy:
+      method: docker
+      image: pskit/factory-api:dev
+      docker_host: ssh://pskit@10.0.1.12   # empty = Docker on this laptop
+      restart: unless-stopped
+```
+
+`pskit deploy` runs `docker build` and `docker run` (with `DOCKER_HOST` when
+`docker_host` is set). Data lives in a volume named after the container.
+
+## Server already has Python
+
+```yaml
+deploy:
+  method: ssh
+  host: 10.0.1.12
+  user: pskit
+  path: /opt/pskit/factory-api
+  python: system          # uses python3.12 on the server
+  install: process        # start a detached process instead of systemd
+```
+
+## Air-gapped bundle
+
+Download the install_only archive once on a machine with network, copy it in,
+and point at the unpacked tree:
+
+```yaml
+deploy:
+  method: ssh
+  host: 10.0.1.12
+  python: bundle
+  python_home: ./vendor/python     # portable CPython directory, copied as-is
+```
+
+Or set `python_url` + `python_sha256` to an internal mirror of the
+python-build-standalone `install_only` tarball.
+
+## Bind address
+
+`options.host` is the address the process binds on the **target**. Use
+`0.0.0.0` so other machines can call it. `advertise` is the URL written into
+`pskit info` and the dashboard.

py_serverless_kit-0.3.0/examples/17-on-premises-remote/app/__init__.py

@@ -0,0 +1 @@
+# Package marker.

py_serverless_kit-0.3.0/examples/17-on-premises-remote/app/handlers.py

@@ -0,0 +1,16 @@
+"""Handlers for a remote on-premises deploy. Identical to a cloud function."""
+
+from __future__ import annotations
+
+from py_serverless_kit import Context, Event
+
+
+def hello(event: Event, ctx: Context):
+    name = event.http.query.get("name", "world")
+    ctx.logger.info("greeting", extra={"name": name})
+    return {"message": f"Hello, {name}!", "provider": event.provider, "stage": ctx.stage, "host": "remote"}
+
+
+def tick(event: Event, ctx: Context):
+    ctx.logger.info("tick", extra={"data": event.data})
+    return {"ok": True, "data": event.data}

py_serverless_kit-0.3.0/examples/17-on-premises-remote/pskit.yml

@@ -0,0 +1,60 @@
+# Remote on-premises deploy.
+#
+# This file ships the function bundle to a Linux server that may not have Python.
+# `python: bundle` downloads a portable CPython at apply time and copies it with
+# the app. `install: systemd` keeps the host up across reboots.
+#
+# Required on the laptop: OpenSSH (`ssh`, `scp`). Required on the server: SSH
+# access. Python on the server is optional.
+#
+#   set PSKIT_ONPREM_HOST=10.0.1.12
+#   pskit deploy
+#
+# Switch to Docker (server needs Docker, not Python) with the `providers.onprem`
+# block left as-is and:
+#   pskit deploy  after changing deploy.method to docker (see README).
+service: factory-api
+
+provider:
+  name: onprem
+  region: local
+  runtime: python3.12
+  architecture: x86_64
+  options:
+    host: 0.0.0.0
+    port: 8090
+    advertise: "${env:PSKIT_ONPREM_URL, http://127.0.0.1:8090}"
+    data_dir: /opt/pskit/factory-api/data
+    deploy:
+      method: ssh
+      host: "${env:PSKIT_ONPREM_HOST, 127.0.0.1}"
+      user: "${env:PSKIT_ONPREM_USER, pskit}"
+      port: 22
+      identity_file: "${env:PSKIT_SSH_KEY, }"
+      known_hosts: accept-new
+      path: /opt/pskit/factory-api
+      python: bundle
+      target_os: linux
+      target_arch: x86_64
+      install: systemd
+      sudo: true
+
+functions:
+  hello:
+    handler: app.handlers.hello
+    events:
+      - http: GET /hello
+  tick:
+    handler: app.handlers.tick
+    events:
+      - schedule: {rate: 1 hour, input: {source: factory}}
+
+providers:
+  aws:
+    region: us-east-1
+  gcp:
+    region: us-central1
+    options: {project: "${env:GOOGLE_CLOUD_PROJECT, my-gcp-project}"}
+  azure:
+    region: eastus
+    options: {subscription_id: "${env:ARM_SUBSCRIPTION_ID, 00000000-0000-0000-0000-000000000000}"}

py_serverless_kit-0.3.0/examples/17-on-premises-remote/requirements.txt

@@ -0,0 +1 @@
+# No third-party dependencies. The pskit runtime is vendored into the bundle automatically.

{py_serverless_kit-0.2.0 → py_serverless_kit-0.3.0}/examples/README.md

@@ -23,6 +23,7 @@ by changing only the provider (`pskit deploy --provider gcp`).
 | 14 | [testing](14-testing) | pytest with `LocalRunner`, synthetic events, workflow tests, CI validation | AWS, GCP, Azure |
 | 15 | [ci-cd-deploy](15-ci-cd-deploy) | GitHub Actions per-stage deploys with OIDC, remote state, dashboard artifact | AWS, GCP, Azure |
 | 16 | [on-premises](16-on-premises) | one process on this machine: HTTP, schedule, queue, directory storage, topic, embedded workflow | on-premises |
+| 17 | [on-premises-remote](17-on-premises-remote) | SSH / Docker / bundled CPython onto a server that may not have Python | on-premises |
 
 \* Azure blob triggers can't fire on deletions; the example's `providers.azure` block
 handles that explicitly.

{py_serverless_kit-0.2.0 → py_serverless_kit-0.3.0}/src/py_serverless_kit/_version.py

@@ -1,2 +1,2 @@
-__version__ = "0.2.0"
+__version__ = "0.3.0"
 __author__ = "Asif Khan @ Kavion.ai"

{py_serverless_kit-0.2.0 → py_serverless_kit-0.3.0}/src/py_serverless_kit/cli/templates.py

@@ -31,6 +31,9 @@ PROVIDER_OPTIONS = {
         "  options:\n"
         "    host: 127.0.0.1\n"
         "    port: 8080\n"
+        "    # deploy.method: local (this machine) | ssh | docker\n"
+        "    # ssh: {host: 10.0.1.12, user: pskit, python: bundle, install: systemd}\n"
+        "    # python: bundle ships a portable CPython when the server has none\n"
         "    # builtin services are created on deploy. To use a directory you already\n"
         "    # have: storage: {use: directory, path: /var/pskit/buckets}\n"
     ),

{py_serverless_kit-0.2.0 → py_serverless_kit-0.3.0}/src/py_serverless_kit/packaging/builder.py

@@ -238,7 +238,7 @@ def build_artifact(project: Project, *, skip_deps: bool = False, log=print) -> A
         if final_reqs and not skip_deps:
             req_file = work / "requirements.vendor.txt"
             req_file.write_text("\n".join(final_reqs) + "\n", "utf-8")
-            flags = provider.pip_platform(cfg.provider.runtime, cfg.provider.architecture)
+            flags = provider.pip_platform_for(cfg)
             log(f"  vendoring {len(final_reqs)} requirement(s) for {cfg.provider.runtime}/{cfg.provider.architecture}")
             _pip_install(req_file, build_dir, flags, cfg.package.pip_args)
     else:

{py_serverless_kit-0.2.0 → py_serverless_kit-0.3.0}/src/py_serverless_kit/providers/base.py

@@ -191,6 +191,9 @@ class Provider(ABC):
             "--only-binary=:all:",
         ]
 
+    def pip_platform_for(self, config: ServiceConfig) -> List[str]:
+        return self.pip_platform(config.provider.runtime, config.provider.architecture)
+
     # ------------------------------------------------------------ validation
     def workflow_engine(self, wf: WorkflowConfig) -> str:
         if wf.engine == "native":