small-software 0.8.0__tar.gz → 0.9.0__tar.gz

{small_software-0.8.0/small_software.egg-info → small_software-0.9.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: small-software
-Version: 0.8.0
+Version: 0.9.0
 Summary: A cloud for small software: deploy team apps to Railway in one command, private by default, shared by work email
 Author: RuslanKazyradzi13
 License-Expression: MIT
@@ -319,7 +319,7 @@ share apps itself: *"Deploy this folder and give ivan@company.com access."*
 ## `small deploy`
 
 ```
-small deploy [folder] [--name NAME] [--workspace ID] [--port N] [-m MESSAGE] [--new] [--no-wait] [--timeout SEC]
+small deploy [folder] [--name NAME] [--workspace ID] [--port N] [-m MESSAGE] [--public] [--new] [--no-wait] [--timeout SEC]
 ```
 
 | Flag | What it does |
@@ -328,6 +328,7 @@ small deploy [folder] [--name NAME] [--workspace ID] [--port N] [-m MESSAGE] [--
 | `--workspace` | workspace ID if the account has several (or `RAILWAY_WORKSPACE_ID`) |
 | `--port` | port for the public domain if the app does not listen on `$PORT` |
 | `-m`, `--message` | deploy message shown in Railway |
+| `--public` | an app without sign-in of its own: deploy it open to anyone, without the gateway (see `small gateway`) |
 | `--new` | create a new project even if the folder has been deployed before |
 | `--no-wait` | print the URL right away without waiting for the build |
 | `--timeout` | how many seconds to wait for the build (default 900) |
@@ -335,6 +336,42 @@ small deploy [folder] [--name NAME] [--workspace ID] [--port N] [-m MESSAGE] [--
 Progress goes to stderr and the final URL to stdout: `URL=$(small deploy)`.
 Exit codes: `0` success, `1` error or failed build (the last log lines are printed), `130` interrupted.
 
+## `small gateway`: sign-in in front of any app
+
+```
+small gateway [on [--port N] | off [--yes]]          # no subcommand: the status
+```
+
+The gateway protects an app that has no sign-in of its own — any language, any framework, a Dockerfile — without
+changing its code. It is a second service in the app's Railway project, `<app>-gateway`: [Caddy](https://caddyserver.com)
+takes every request, and magic-link next to it decides who gets in (Google and Microsoft sign-on, email links, invite
+links, all `small access` / `small sso` / `small mail` settings). Requests it lets in go on to the app over Railway's
+private network; the app itself has no public address.
+
+- **Private by default.** The first `small deploy` of a folder without `magic_link.py` / `magic-link.js` sets the
+  gateway up before the app ever gets an address, and puts your own invite link in `small.json` (`small open`).
+  `small deploy --public` deploys such an app open to anyone instead; redeploying an app that is open prints a warning.
+- **`on`** for an app already deployed: creates the gateway, moves the sign-in variables to it, moves the address
+  (keeping its name), and restarts the app without a public address. The app must listen on `$PORT` (small sets it to
+  `8080` if it isn't set) or pass `--port`. A custom domain has to be removed first and added back after; it then
+  points to the gateway.
+- **Who is signed in.** The gateway adds `X-Small-User` (the address, or the invite-link name), `X-Small-Method`
+  (`email`, `google`, `microsoft`, `link`) and `X-Small-Auth`, an HMAC signature of both with `SMALL_GATEWAY_KEY`, which
+  the app gets as a Railway reference. Any `X-Small-*` header a visitor sends is dropped. magic-link in the app (0.9+)
+  trusts that signature and nothing else, so an app that keeps its own sign-in code works behind the gateway too.
+- **Websockets** go through the same check. For Streamlit this means an `HttpOnly` session cookie set by the gateway.
+- **Where things live.** Sign-in variables (`ACCESS_*`, `SESSION_SECRET`, `GOOGLE_*`, `MICROSOFT_*`,
+  `SESSIONS_REVOKED`…) belong to the gateway; mail and Telegram variables go to both; everything else stays the
+  app's. `small env`, `small access`, `small sso`, `small mail` and `small deploy` route them for you, and restart only
+  the service that changed.
+- **The rest follows:** `small access log` reads the gateway's log, `small logs --gateway` shows it, `small sleep`
+  puts both to sleep (the first request wakes both, a few seconds), `small domain` attaches to the gateway,
+  `small volume add --gateway` keeps sign-in state across the gateway's restarts, `small destroy` removes both.
+- **`small deploy`** also rebuilds the gateway when it was built by an older small.
+- **`off`** gives the address and the variables back to the app and deletes the gateway. If the app has no sign-in of
+  its own, small asks first (or `--yes`): without the gateway anyone with the address gets in.
+- **Cost:** one more small service. Caddy and the sign-in server idle at a few tens of MB; with sleep on, both sleep.
+
 ## After deploy
 
 These commands work in the folder of a deployed app, that is, where `.small.json` is. `link`, `open`, `logs` and
@@ -351,10 +388,11 @@ small mail [resend | smtp [--from FROM] [--to TO] | log | off]  # emails for sig
 small notify [telegram [--chat-id ID] | off]        # access requests to Telegram
 small env [list [--values] | set K=V ... | unset K ...] [--no-deploy]
 small db [list | add postgres | remove postgres [--yes]]
-small volume [add [--mount /data]]                  # persistent disk; no argument shows the status
+small volume [add [--mount /data]] [--gateway]      # persistent disk; no argument shows the status
+small gateway [on [--port N] | off [--yes]]          # sign-in in front of any app (see above)
 small domain [list | add DOMAIN [--port N] | remove DOMAIN]
 small sleep [on | off]                              # sleep mode; no argument shows the status
-small logs [folder] [--build] [-n N] [-f]            # log of the latest deploy
+small logs [folder] [--build | --gateway] [-n N] [-f]  # log of the latest deploy
 small destroy [folder] [--yes]                       # remove from Railway
 ```
 
@@ -501,7 +539,7 @@ then takes effect on the next deploy.
   that it disappears from Railway too.
 
 **`small logs`** shows the log of the latest deploy.
-- **Which log.** The app log by default, the build log with `--build`. `-n` sets the number of lines (default 100).
+- **Which log.** The app log by default, the build log with `--build`, the gateway's with `--gateway`. `-n` sets the number of lines (default 100).
 - **Follow mode.** `-f` appends new lines every 2 seconds; `Ctrl+C` exits.
 - **Format.** Every line is printed with its local time. Requests from the **Request access** button show up as
   `[access-request] ...`, and they are easy to filter: `small logs | findstr access-request`.
@@ -667,4 +705,5 @@ network, timeout, wrong token, garbage status, no token in the response):
 ## Limitations
 
 - Only the root `.gitignore`/`.railwayignore` are read; nested ones are ignored.
-- One service is created, in the `production` environment. Databases: Postgres only (`small db`).
+- One service is created (two with the gateway), in the `production` environment. Databases: Postgres only
+  (`small db`).

{small_software-0.8.0 → small_software-0.9.0}/README.md

@@ -291,7 +291,7 @@ share apps itself: *"Deploy this folder and give ivan@company.com access."*
 ## `small deploy`
 
 ```
-small deploy [folder] [--name NAME] [--workspace ID] [--port N] [-m MESSAGE] [--new] [--no-wait] [--timeout SEC]
+small deploy [folder] [--name NAME] [--workspace ID] [--port N] [-m MESSAGE] [--public] [--new] [--no-wait] [--timeout SEC]
 ```
 
 | Flag | What it does |
@@ -300,6 +300,7 @@ small deploy [folder] [--name NAME] [--workspace ID] [--port N] [-m MESSAGE] [--
 | `--workspace` | workspace ID if the account has several (or `RAILWAY_WORKSPACE_ID`) |
 | `--port` | port for the public domain if the app does not listen on `$PORT` |
 | `-m`, `--message` | deploy message shown in Railway |
+| `--public` | an app without sign-in of its own: deploy it open to anyone, without the gateway (see `small gateway`) |
 | `--new` | create a new project even if the folder has been deployed before |
 | `--no-wait` | print the URL right away without waiting for the build |
 | `--timeout` | how many seconds to wait for the build (default 900) |
@@ -307,6 +308,42 @@ small deploy [folder] [--name NAME] [--workspace ID] [--port N] [-m MESSAGE] [--
 Progress goes to stderr and the final URL to stdout: `URL=$(small deploy)`.
 Exit codes: `0` success, `1` error or failed build (the last log lines are printed), `130` interrupted.
 
+## `small gateway`: sign-in in front of any app
+
+```
+small gateway [on [--port N] | off [--yes]]          # no subcommand: the status
+```
+
+The gateway protects an app that has no sign-in of its own — any language, any framework, a Dockerfile — without
+changing its code. It is a second service in the app's Railway project, `<app>-gateway`: [Caddy](https://caddyserver.com)
+takes every request, and magic-link next to it decides who gets in (Google and Microsoft sign-on, email links, invite
+links, all `small access` / `small sso` / `small mail` settings). Requests it lets in go on to the app over Railway's
+private network; the app itself has no public address.
+
+- **Private by default.** The first `small deploy` of a folder without `magic_link.py` / `magic-link.js` sets the
+  gateway up before the app ever gets an address, and puts your own invite link in `small.json` (`small open`).
+  `small deploy --public` deploys such an app open to anyone instead; redeploying an app that is open prints a warning.
+- **`on`** for an app already deployed: creates the gateway, moves the sign-in variables to it, moves the address
+  (keeping its name), and restarts the app without a public address. The app must listen on `$PORT` (small sets it to
+  `8080` if it isn't set) or pass `--port`. A custom domain has to be removed first and added back after; it then
+  points to the gateway.
+- **Who is signed in.** The gateway adds `X-Small-User` (the address, or the invite-link name), `X-Small-Method`
+  (`email`, `google`, `microsoft`, `link`) and `X-Small-Auth`, an HMAC signature of both with `SMALL_GATEWAY_KEY`, which
+  the app gets as a Railway reference. Any `X-Small-*` header a visitor sends is dropped. magic-link in the app (0.9+)
+  trusts that signature and nothing else, so an app that keeps its own sign-in code works behind the gateway too.
+- **Websockets** go through the same check. For Streamlit this means an `HttpOnly` session cookie set by the gateway.
+- **Where things live.** Sign-in variables (`ACCESS_*`, `SESSION_SECRET`, `GOOGLE_*`, `MICROSOFT_*`,
+  `SESSIONS_REVOKED`…) belong to the gateway; mail and Telegram variables go to both; everything else stays the
+  app's. `small env`, `small access`, `small sso`, `small mail` and `small deploy` route them for you, and restart only
+  the service that changed.
+- **The rest follows:** `small access log` reads the gateway's log, `small logs --gateway` shows it, `small sleep`
+  puts both to sleep (the first request wakes both, a few seconds), `small domain` attaches to the gateway,
+  `small volume add --gateway` keeps sign-in state across the gateway's restarts, `small destroy` removes both.
+- **`small deploy`** also rebuilds the gateway when it was built by an older small.
+- **`off`** gives the address and the variables back to the app and deletes the gateway. If the app has no sign-in of
+  its own, small asks first (or `--yes`): without the gateway anyone with the address gets in.
+- **Cost:** one more small service. Caddy and the sign-in server idle at a few tens of MB; with sleep on, both sleep.
+
 ## After deploy
 
 These commands work in the folder of a deployed app, that is, where `.small.json` is. `link`, `open`, `logs` and
@@ -323,10 +360,11 @@ small mail [resend | smtp [--from FROM] [--to TO] | log | off]  # emails for sig
 small notify [telegram [--chat-id ID] | off]        # access requests to Telegram
 small env [list [--values] | set K=V ... | unset K ...] [--no-deploy]
 small db [list | add postgres | remove postgres [--yes]]
-small volume [add [--mount /data]]                  # persistent disk; no argument shows the status
+small volume [add [--mount /data]] [--gateway]      # persistent disk; no argument shows the status
+small gateway [on [--port N] | off [--yes]]          # sign-in in front of any app (see above)
 small domain [list | add DOMAIN [--port N] | remove DOMAIN]
 small sleep [on | off]                              # sleep mode; no argument shows the status
-small logs [folder] [--build] [-n N] [-f]            # log of the latest deploy
+small logs [folder] [--build | --gateway] [-n N] [-f]  # log of the latest deploy
 small destroy [folder] [--yes]                       # remove from Railway
 ```
 
@@ -473,7 +511,7 @@ then takes effect on the next deploy.
   that it disappears from Railway too.
 
 **`small logs`** shows the log of the latest deploy.
-- **Which log.** The app log by default, the build log with `--build`. `-n` sets the number of lines (default 100).
+- **Which log.** The app log by default, the build log with `--build`, the gateway's with `--gateway`. `-n` sets the number of lines (default 100).
 - **Follow mode.** `-f` appends new lines every 2 seconds; `Ctrl+C` exits.
 - **Format.** Every line is printed with its local time. Requests from the **Request access** button show up as
   `[access-request] ...`, and they are easy to filter: `small logs | findstr access-request`.
@@ -639,4 +677,5 @@ network, timeout, wrong token, garbage status, no token in the response):
 ## Limitations
 
 - Only the root `.gitignore`/`.railwayignore` are read; nested ones are ignored.
-- One service is created, in the `production` environment. Databases: Postgres only (`small db`).
+- One service is created (two with the gateway), in the `production` environment. Databases: Postgres only
+  (`small db`).

{small_software-0.8.0 → small_software-0.9.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "small-software"
-version = "0.8.0"
+version = "0.9.0"
 description = "A cloud for small software: deploy team apps to Railway in one command, private by default, shared by work email"
 license = "MIT"
 license-files = ["LICENSE"]

small_software-0.9.0/small_cli/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.9.0"

{small_software-0.8.0 → small_software-0.9.0}/small_cli/access.py

@@ -9,6 +9,7 @@ import re
 import secrets
 from urllib.parse import quote
 
+from . import gateway
 from .config import CONFIG_FILE, load_config
 from .i18n import tr
 from .railway import Railway, RailwayError, token_from_env
@@ -60,13 +61,19 @@ def parse_emails(value):
 
 
 def app_env(root, state, warn=None):
-    """(app variables, where each one comes from): Railway, overlaid with non-empty values from small.json."""
+    """(app variables, where each one comes from): Railway, overlaid with non-empty values from small.json. Behind the
+    gateway, the sign-in variables come from the gateway's service."""
     env, sources = {}, {}
     linked = all(state.get(k) for k in ("projectId", "environmentId", "serviceId"))
     if linked and token_from_env():
         try:
-            env = dict(Railway(token_from_env()).service_variables(
-                state["projectId"], state["environmentId"], state["serviceId"]))
+            api = Railway(token_from_env())
+            env = dict(api.service_variables(state["projectId"], state["environmentId"], state["serviceId"]))
+            if gateway.is_on(state):
+                for name in gateway.GATEWAY_ONLY:
+                    env.pop(name, None)
+                ours = api.service_variables(state["projectId"], state["environmentId"], state["gateway"]["serviceId"])
+                env.update({k: v for k, v in ours.items() if k in gateway.GATEWAY_ONLY + gateway.SHARED})
             sources = dict.fromkeys(env, "Railway")
         except RailwayError as e:
             if warn:
@@ -121,11 +128,11 @@ def app_url(root, state):
 
 def redirect_uri(root, state):
     """Where Google and Microsoft send people back after sign-in: /_access/sso/callback, or the page itself for
-    Streamlit (it can't serve other paths). None until the app has an address."""
+    Streamlit without the gateway (it can't serve other paths). None until the app has an address."""
     base = app_url(root, state)
     if base is None:
         return None
-    return base + "/" if is_streamlit(root) else base + SSO_CALLBACK
+    return base + "/" if is_streamlit(root) and not gateway.is_on(state) else base + SSO_CALLBACK
 
 
 def parse_revoked(value):
@@ -148,9 +155,11 @@ def add_revoked(value, who, now):
     return ", ".join("%s=%d" % pair for pair in keep)
 
 
-def feature_problem(root):
-    """None if the app's code knows sign-in with Google and Microsoft and signing out (small 0.8); otherwise what is
-    in the way and how to fix it."""
+def feature_problem(root, state=None):
+    """None if the app's code knows sign-in with Google and Microsoft and signing out (small 0.8), or the gateway
+    does it for the app; otherwise what is in the way and how to fix it."""
+    if gateway.is_on(state or {}):
+        return None
     streamlit = is_streamlit(root)
     if streamlit and "sso_finish" not in (root / "app.py").read_text(encoding="utf-8", errors="replace"):
         return (tr("app.py is from a streamlit template older than small 0.8, without sign-in with Google and "
@@ -170,11 +179,14 @@ def feature_problem(root):
     return None  # no magic_link next to the code: the app may keep it elsewhere, as for email sign-in
 
 
-def email_login_problem(root):
+def email_login_problem(root, state=None):
     """None if the app code supports sign-in by email; otherwise, what is in the way and how to fix it.
 
     Streamlit cannot be wrapped in middleware: there sign-in by email is done by require_access() in app.py via
-    MagicLinkGate from magic_link.py, so new versions of both files are needed."""
+    MagicLinkGate from magic_link.py, so new versions of both files are needed. Behind the gateway the app's code
+    doesn't matter: the gateway signs people in."""
+    if gateway.is_on(state or {}):
+        return None
     app = root / "app.py"
     source = app.read_text(encoding="utf-8", errors="replace") if app.is_file() else ""
     streamlit = "streamlit" in source

{small_software-0.8.0 → small_software-0.9.0}/small_cli/commands/__init__.py

@@ -3,7 +3,8 @@
 The order here is the order in `small --help`: from creating an app to deleting it.
 """
 
-from . import (access, dashboard, db, deploy, destroy, domain, env, init, link, logs, mail, mcp, notify, sleep,
-               sso, volume)
+from . import (access, dashboard, db, deploy, destroy, domain, env, gateway, init, link, logs, mail, mcp, notify,
+               sleep, sso, volume)
 
-ALL = (init, deploy, link, access, sso, mail, notify, env, db, volume, domain, sleep, logs, dashboard, mcp, destroy)
+ALL = (init, deploy, link, access, sso, gateway, mail, notify, env, db, volume, domain, sleep, logs, dashboard, mcp,
+       destroy)

{small_software-0.8.0 → small_software-0.9.0}/small_cli/commands/access.py

@@ -11,6 +11,7 @@ import time
 from datetime import datetime, timezone
 
 from .. import access as tokens
+from .. import gateway
 from ..common import CliError, app_dir, linked_state, require_token, say
 from ..config import CONFIG_FILE, STATE_FILE, load_config, load_state
 from ..i18n import tr
@@ -143,10 +144,10 @@ def grant_access(root, who, deploy=True, warn=None):
 
 
 def _grant_email(root, email, deploy, warn):
-    problem = tokens.email_login_problem(root)
+    state = load_state(root / STATE_FILE)
+    problem = tokens.email_login_problem(root, state)
     if problem:
         raise CliError(problem)
-    state = load_state(root / STATE_FILE)
     env, _ = tokens.app_env(root, state, warn=warn)
     emails = tokens.parse_emails(env.get("ACCESS_EMAILS"))
     if email in emails:
@@ -269,10 +270,11 @@ def signout_access(root, who, deploy=True, warn=None):
     if who != "*" and not tokens.is_email(who):
         raise CliError(tr("specify an email address (ivan@company.com), a domain (@company.com) or --all",
                           "укажите адрес почты (ivan@company.com), домен (@company.com) или --all"))
-    problem = tokens.feature_problem(root)
+    state = load_state(root / STATE_FILE)
+    problem = tokens.feature_problem(root, state)
     if problem:
         raise CliError(problem)
-    env, _ = tokens.app_env(root, load_state(root / STATE_FILE), warn=warn)
+    env, _ = tokens.app_env(root, state, warn=warn)
     value = tokens.add_revoked(env.get("SESSIONS_REVOKED"), who, time.time())
     return {"who": who, "linked": change_env(root, {"SESSIONS_REVOKED": value}, deploy=deploy)}
 
@@ -309,7 +311,7 @@ def access_log(root, limit=50):
     plan keeps logs."""
     state = linked_state(root)
     entries = Railway(require_token()).environment_logs(
-        state["environmentId"], "@service:%s @magic_link:*" % state["serviceId"], limit=limit)
+        state["environmentId"], "@service:%s @magic_link:*" % gateway.public_service(state), limit=limit)
     rows = []
     for entry in entries:
         fields = entry["attributes"]

{small_software-0.8.0 → small_software-0.9.0}/small_cli/commands/deploy.py

@@ -2,16 +2,23 @@
 -> serviceDomainCreate -> write the variables from small.json (variableCollectionUpsert) -> upload the archive
 (POST .../up) -> poll deployment(id).status -> print https://<domain>.
 
+Private by default: the first deploy of an app without sign-in of its own (no magic_link next to its code) puts the
+small gateway in front of it before it ever gets an address (see small gateway); --public opts out.
+
 Progress goes to stderr and the final URL to stdout, so `URL=$(small deploy)` works.
 """
 
 import argparse
+import json
 import os
 import time
 
+from .. import access as tokens
+from .. import gateway
 from ..archive import collect_files, make_tarball
 from ..common import CliError, app_dir, format_elapsed, human_size, require_token, say, slugify
 from ..config import CONFIG_FILE, STATE_FILE, load_config, load_state, save_state
+from .. import __version__
 from ..i18n import lang, tr
 from ..railway import Railway, RailwayError
 
@@ -37,6 +44,9 @@ def register(sub):
     d.add_argument("--port", type=int, help=tr("port the app listens on (by default Railway uses $PORT)",
                                                "порт, который слушает приложение (по умолчанию Railway берёт $PORT)"))
     d.add_argument("-m", "--message", help=tr("deploy message", "подпись деплоя"))
+    d.add_argument("--public", action="store_true",
+                   help=tr("an app without sign-in of its own: deploy it open to anyone, without the gateway",
+                           "приложение без своего входа: задеплоить открытым для всех, без шлюза"))
     d.add_argument("--new", action="store_true",
                    help=tr("create a new project even if %s exists", "создать новый проект, даже если есть %s")
                    % STATE_FILE)
@@ -86,16 +96,34 @@ def cmd_deploy(args):
         else:
             project_id, environment_id = api.create_project(name, workspace_id)
             say(tr("Created project %s", "Создан проект %s") % name)
-            service_id = api.create_service(project_id, environment_id, name)
+            try:
+                service_id = api.create_service(project_id, environment_id, name)
+            except RailwayError:
+                api.delete_project(project_id)  # an empty project of our own, e.g. after Railway's daily limit
+                raise
             say(tr("Created service %s", "Создан сервис %s") % name)
             state = {"name": name, "projectId": project_id,
                      "environmentId": environment_id, "serviceId": service_id}
         # Save right away: if the build fails, a rerun won't spawn new projects.
         save_state(state_path, state)
 
+    private = not reused and not gateway.is_on(state) and not args.public and not gateway.has_own_sign_in(root)
+    if private:
+        # No sign-in of its own: the gateway comes first, so the app never has an open address.
+        from .gateway import create
+
+        config = ensure_owner_link(root, config)
+        create(api, root, state, config["env"], args.port)
+        save_state(state_path, state)
+    elif not gateway.is_on(state) and not gateway.has_own_sign_in(root) and not args.public:
+        say(tr("Warning: the app has no sign-in of its own, so anyone with its address gets in. Protect it: "
+               "small gateway on",
+               "Внимание: своего входа у приложения нет, в него попадёт любой, у кого есть адрес. Защитить: "
+               "small gateway on"))
+
     if not state.get("domain"):
         # Domain before the code upload: the very first build already needs its address (links in sign-in emails).
-        state["domain"] = ensure_domain(api, state, args.port)
+        state["domain"] = ensure_domain(api, state, gateway.GATEWAY_PORT if gateway.is_on(state) else args.port)
         save_state(state_path, state)
         say(tr("Public domain: %s", "Публичный домен: %s") % state["domain"])
 
@@ -109,8 +137,10 @@ def cmd_deploy(args):
     if variables and "OWNER_LANG" not in variables:
         variables["OWNER_LANG"] = lang()  # log lines and Telegram notifications in the owner's language
     if variables:
-        # Before the code upload, so the new build gets the variables right away. Values are not printed.
-        api.upsert_variables(state["projectId"], state["environmentId"], state["serviceId"], variables)
+        # Before the code upload, so the new build gets the variables right away. Values are not printed. Behind the
+        # gateway, the sign-in variables go to the gateway (gateway.services_for).
+        for service_id, values in gateway.split(variables, state).items():
+            api.upsert_variables(state["projectId"], state["environmentId"], service_id, values)
         say(tr("Variables from %s: %s%s", "Переменные из %s: %s%s")
             % (CONFIG_FILE, ", ".join(sorted(config["env"])),
                tr(" (+ PUBLIC_URL for sign-in emails)", " (+ PUBLIC_URL для писем входа)")
@@ -125,6 +155,16 @@ def cmd_deploy(args):
         raise
     deployment_id = up["deploymentId"]
     say(tr("Code uploaded, deploy %s", "Код загружен, деплой %s") % deployment_id)
+    gateway_deployment = None
+    if gateway.outdated(state):  # a new gateway, or one built by another version of small: this version's code
+        if not gateway.wait_for_private_address(api, state, interval=args.interval or 0.1):
+            say(tr("Railway hasn't given the app its private address yet: if the app answers 508, run small deploy "
+                   "again",
+                   "Railway ещё не выдал приложению внутренний адрес: если приложение ответит 508, запустите "
+                   "small deploy ещё раз"))
+        say(tr("Building the gateway (small %s)…", "Собираю шлюз (small %s)…") % __version__)
+        gateway_deployment = gateway.upload(api, state)
+        save_state(state_path, state)
     if up.get("logsUrl"):
         say(tr("Logs: %s", "Логи: %s") % up["logsUrl"].rstrip("&"))
 
@@ -138,11 +178,40 @@ def cmd_deploy(args):
     if status not in OK_STATUSES:
         show_logs(api, deployment_id, build=(status == "FAILED"))
         raise CliError(tr("deploy finished with status %s", "деплой завершился со статусом %s") % status)
+    if gateway_deployment:
+        status = wait_for_deployment(api, gateway_deployment, args.timeout, args.interval)
+        if status not in OK_STATUSES:
+            show_logs(api, gateway_deployment, build=(status == "FAILED"))
+            raise CliError(tr("the gateway's deploy finished with status %s; the app is not reachable until it works "
+                              "(small logs --gateway)",
+                              "деплой шлюза завершился со статусом %s; пока он не заработает, приложение недоступно "
+                              "(small logs --gateway)") % status)
     say(tr("Done!", "Готово!"))
+    if private:
+        say(tr("The app is private: it has no sign-in of its own, so small put its gateway in front. Open it yourself: "
+               "small open; let people in: small access add ivan@company.com (or small deploy --public next time to "
+               "deploy an app open to anyone).",
+               "Приложение закрыто: своего входа у него нет, поэтому small поставил перед ним шлюз. Открыть самому: "
+               "small open; пустить людей: small access add ivan@company.com (а чтобы задеплоить открытое для всех "
+               "приложение, в следующий раз: small deploy --public)."))
     print(url)
     return 0
 
 
+def ensure_owner_link(root, config):
+    """The owner's invite link (ACCESS_TOKEN in small.json, as small init makes it), so that small open lets the owner
+    into a private app right away. Returns small.json as read again."""
+    if config["env"].get("ACCESS_TOKEN") or config["env"].get("ACCESS_EMAILS"):
+        return config
+    path = root / CONFIG_FILE
+    raw = json.loads(path.read_text(encoding="utf-8-sig")) if path.is_file() else {}
+    raw.setdefault("env", {})["ACCESS_TOKEN"] = tokens.new_token()
+    path.write_text(json.dumps(raw, indent=2, ensure_ascii=False) + "\n", encoding="utf-8")
+    say(tr("ACCESS_TOKEN for your own invite link is in %s (small open uses it; the file is for you only).",
+           "ACCESS_TOKEN для вашей личной ссылки — в %s (её использует small open; файл только для вас).") % CONFIG_FILE)
+    return load_config(path)
+
+
 def pick_workspace(api):
     try:
         workspaces = api.workspaces()
@@ -185,15 +254,19 @@ def bind_existing(api, name, workspace_id):
         say(tr("Created service %s", "Создан сервис %s") % name)
         return state
     state["serviceId"] = service["id"]
-    domains = api.service_domains(project["id"], env["id"], service["id"])
+    gateway_service = next((s for s in services if s["name"] == service["name"] + "-gateway"), None)
+    if gateway_service:  # deployed with the gateway from another computer: rebuilt by this version on deploy
+        state["gateway"] = {"serviceId": gateway_service["id"], "name": gateway_service["name"]}
+    domains = api.service_domains(project["id"], env["id"], gateway.public_service(state))
     if domains:
         state["domain"] = domains[0]["domain"]
     return state
 
 
 def ensure_domain(api, state, port):
-    """Creates a *.up.railway.app domain and tries to rename it to <name>.up.railway.app."""
-    sid, eid = state["serviceId"], state["environmentId"]
+    """Creates a *.up.railway.app domain for the public service (the gateway, if there is one) and tries to rename it
+    to <name>.up.railway.app."""
+    sid, eid = gateway.public_service(state), state["environmentId"]
     domain_id, domain = api.create_domain(sid, eid, port)
     wanted = state["name"] + ".up.railway.app"
     if domain == wanted:

{small_software-0.8.0 → small_software-0.9.0}/small_cli/commands/destroy.py

@@ -32,7 +32,8 @@ def cmd_destroy(args):
         raise CliError(tr("project %s not found in Railway (%s). If it is already deleted, delete %s manually",
                           "проект %s не найден в Railway (%s). Если он уже удалён, удалите %s вручную")
                        % (state["projectId"], e, root / STATE_FILE)) from None
-    own_ids = {state["serviceId"]} | {db["serviceId"] for db in state.get("databases", [])}
+    own_ids = ({state["serviceId"]} | {db["serviceId"] for db in state.get("databases", [])}
+               | ({state["gateway"]["serviceId"]} if (state.get("gateway") or {}).get("serviceId") else set()))
     own = [s for s in services if s["id"] in own_ids]
     others = [s["name"] for s in services if s["id"] not in own_ids]
     if others:

{small_software-0.8.0 → small_software-0.9.0}/small_cli/commands/domain.py

@@ -3,6 +3,7 @@
 import argparse
 import re
 
+from .. import gateway
 from ..common import CliError, app_dir, linked_state, require_token, say
 from ..i18n import tr
 from ..railway import Railway
@@ -51,7 +52,8 @@ def normalize(domain):
 
 
 def ids(state):
-    return state["projectId"], state["environmentId"], state["serviceId"]
+    """The service that has the public address: behind the gateway, the gateway."""
+    return state["projectId"], state["environmentId"], gateway.public_service(state)
 
 
 def cmd_domain_list(args):

{small_software-0.8.0 → small_software-0.9.0}/small_cli/commands/env.py

@@ -4,6 +4,7 @@ next small deploy would bring back the old values from small.json."""
 import argparse
 import json
 
+from .. import gateway
 from ..common import CliError, app_dir, is_linked, require_token, say
 from ..config import CONFIG_FILE, ENV_NAME_RE, STATE_FILE, load_config, load_state
 from ..i18n import tr
@@ -50,7 +51,9 @@ def change_env(root, set_vars=None, unset=(), deploy=True, railway_only=None):
     """Changes variables in Railway (if the app is deployed) and in small.json, so that they don't diverge.
 
     Railway first: if it refuses, small.json stays as it was. railway_only are variables that small manages
-    itself and doesn't write to small.json (e.g. PUBLIC_URL). Returns True if Railway was touched.
+    itself and doesn't write to small.json (e.g. PUBLIC_URL). Behind the gateway, each variable goes to its service
+    (sign-in variables to the gateway, see gateway.services_for), and only the services that changed restart.
+    Returns True if Railway was touched.
     """
     set_vars, unset = dict(set_vars or {}), list(unset)
     config_path, state = root / CONFIG_FILE, load_state(root / STATE_FILE)
@@ -59,16 +62,26 @@ def change_env(root, set_vars=None, unset=(), deploy=True, railway_only=None):
 
     if is_linked(state):
         api = Railway(require_token())
-        ids = (state["projectId"], state["environmentId"], state["serviceId"])
-        existing = api.service_variables(*ids)
-        upsert = dict(set_vars, **(railway_only or {}))
-        if upsert:
-            api.upsert_variables(*ids, upsert)
-        for name in unset:
-            if name in existing:
-                api.delete_variable(*ids, name)
+        services = [state["serviceId"]] + ([state["gateway"]["serviceId"]] if gateway.is_on(state) else [])
+        changed = []
+        for service_id in services:
+            mine = {k: v for k, v in set_vars.items() if service_id in gateway.services_for(k, state)}
+            if service_id == gateway.public_service(state):
+                mine.update(railway_only or {})  # small's own (the public address): for the service that has it
+            gone = [name for name in unset if service_id in gateway.services_for(name, state)]
+            if len(services) > 1 and not (mine or gone):
+                continue
+            ids = (state["projectId"], state["environmentId"], service_id)
+            existing = api.service_variables(*ids)
+            if mine:
+                api.upsert_variables(*ids, mine)
+            for name in gone:
+                if name in existing:
+                    api.delete_variable(*ids, name)
+            changed.append(service_id)
         if deploy:
-            api.redeploy(state["serviceId"], state["environmentId"])
+            for service_id in changed or [state["serviceId"]]:
+                api.redeploy(service_id, state["environmentId"])
 
     env = raw.setdefault("env", {})
     env.update(set_vars)