1390 lines
61 KiB
JavaScript
Executable File
1390 lines
61 KiB
JavaScript
Executable File
#!/usr/bin/env node
|
|
const [, , command, ...args] = process.argv;
|
|
|
|
const apiUrl = (process.env.SELECTED_COOLIFY_API_URL || process.env.COOLIFY_STAGING_API_URL || process.env.COOLIFY_API_URL || "").replace(/\/+$/, "");
|
|
const token = process.env.SELECTED_COOLIFY_TOKEN || process.env.COOLIFY_STAGING_TOKEN || process.env.COOLIFY_TOKEN || "";
|
|
// Poll faster without reducing the existing 450-second deployment failure budget.
|
|
const delayMs = Number(process.env.COOLIFY_DEPLOYMENT_POLL_MS || "2000");
|
|
const attempts = Number(process.env.COOLIFY_DEPLOYMENT_WAIT_ATTEMPTS || "225");
|
|
const apiTimeoutMs = Number(process.env.COOLIFY_API_TIMEOUT_MS || "20000");
|
|
const FULL_GIT_SHA_PATTERN = /^[0-9a-f]{40}$/;
|
|
const OCI_DIGEST_PATTERN = /^sha256:[0-9a-f]{64}$/;
|
|
const WORKER_GROUP_NAMES = Object.freeze(["general", "mail", "import", "webhook", "plugin"]);
|
|
const WORKER_GROUPS = new Set(WORKER_GROUP_NAMES);
|
|
const RUNTIME_DATABASE_ROLES = new Set(["hivegrid_app", "hivegrid_worker", "hivegrid_portal"]);
|
|
const RUNTIME_DATABASE_SURFACES = new Set(["web", "admin", "portal", "service"]);
|
|
const WEB_SURFACE_IDENTITIES = Object.freeze({
|
|
core: "hivegrid-web",
|
|
admin: "hivegrid-admin",
|
|
portal: "hivegrid-portal",
|
|
});
|
|
const PORTAL_DOMAIN_CONTROLLER_IDENTITY = "hivegrid-portal-domain-controller";
|
|
const AUTHENTIK_ADMIN_ENV_KEYS = Object.freeze([
|
|
"AUTHENTIK_ISSUER_URL",
|
|
"AUTHENTIK_ADMIN_CLIENT_ID",
|
|
"AUTHENTIK_ADMIN_CLIENT_SECRET",
|
|
"AUTHENTIK_ADMIN_REDIRECT_URI",
|
|
"AUTHENTIK_ADMIN_JIT_DATABASE_URL",
|
|
]);
|
|
const CORE_PUBLIC_HOST_ENV_KEYS = Object.freeze(["APP_BASE_DOMAIN", "WEB_APP_HOST", "ADMIN_APP_HOST", "API_HOST"]);
|
|
const WEB_PUSH_VAPID_WORKER_ENV_KEYS = Object.freeze(["WEB_PUSH_VAPID_SUBJECT", "WEB_PUSH_VAPID_PUBLIC_KEY", "WEB_PUSH_VAPID_PRIVATE_KEY"]);
|
|
const GDPR_EXPORT_STORAGE_ENV_KEYS = Object.freeze([
|
|
"STORAGE_ENDPOINT",
|
|
"STORAGE_REGION",
|
|
"STORAGE_BUCKET",
|
|
"STORAGE_ACCESS_KEY_ID",
|
|
"STORAGE_SECRET_ACCESS_KEY",
|
|
"GDPR_EXPORT_SSE_C_KEY_BASE64",
|
|
]);
|
|
const GDPR_EXPORT_RETENTION_STORAGE_ENV_KEYS = Object.freeze(GDPR_EXPORT_STORAGE_ENV_KEYS.filter((key) => key !== "GDPR_EXPORT_SSE_C_KEY_BASE64"));
|
|
const SAFE_BASE64URL_PATTERN = /^[A-Za-z0-9_-]+$/;
|
|
const CANONICAL_BASE64_32_BYTES_PATTERN = /^[A-Za-z0-9+/]{43}=$/;
|
|
const COOLIFY_CUID_PATTERN = /^[a-z][a-z0-9]{23}$/;
|
|
|
|
function fail(message) {
|
|
throw new Error(message);
|
|
}
|
|
|
|
async function coolify(path, options = {}) {
|
|
if (!apiUrl || !token) {
|
|
fail("Coolify API URL and token are required");
|
|
}
|
|
if (!Number.isInteger(apiTimeoutMs) || apiTimeoutMs < 10 || apiTimeoutMs > 120_000) {
|
|
fail("COOLIFY_API_TIMEOUT_MS must be an integer between 10 and 120000");
|
|
}
|
|
let response;
|
|
try {
|
|
response = await fetch(`${apiUrl}${path}`, {
|
|
...options,
|
|
signal: options.signal ?? AbortSignal.timeout(apiTimeoutMs),
|
|
headers: {
|
|
Authorization: `Bearer ${token}`,
|
|
Accept: "application/json",
|
|
...(options.body ? { "Content-Type": "application/json" } : {}),
|
|
...options.headers,
|
|
},
|
|
});
|
|
} catch {
|
|
fail("Coolify API request failed or timed out");
|
|
}
|
|
|
|
const text = await response.text();
|
|
let payload = {};
|
|
if (text.trim()) {
|
|
try {
|
|
payload = JSON.parse(text);
|
|
} catch {
|
|
payload = { message: text.trim() };
|
|
}
|
|
}
|
|
|
|
if (!response.ok) {
|
|
fail(`Coolify API request failed with HTTP ${response.status}`);
|
|
}
|
|
|
|
return payload;
|
|
}
|
|
|
|
function deploymentStatus(payload) {
|
|
return String(payload.status || payload.deployment?.status || payload.data?.status || "unknown").toLowerCase();
|
|
}
|
|
|
|
function deploymentUuid(payload, resourceUuid = "") {
|
|
if (!Array.isArray(payload.deployments)) return "";
|
|
const queuedDeployment = resourceUuid ? payload.deployments.find((deployment) => deployment?.resource_uuid === resourceUuid) : payload.deployments[0];
|
|
const value = queuedDeployment?.deployment_uuid || "";
|
|
return typeof value === "string" && COOLIFY_CUID_PATTERN.test(value) ? value : "";
|
|
}
|
|
|
|
function requireCoolifyCuid(value, label) {
|
|
if (!COOLIFY_CUID_PATTERN.test(value)) {
|
|
fail(`${label} must be a valid Coolify CUID`);
|
|
}
|
|
}
|
|
|
|
function applicationEnvsPath(resourceUuid) {
|
|
return `/applications/${encodeURIComponent(resourceUuid)}/envs`;
|
|
}
|
|
|
|
async function readApplicationEnvs(resourceUuid) {
|
|
const path = applicationEnvsPath(resourceUuid);
|
|
try {
|
|
return await coolify(path);
|
|
} catch (error) {
|
|
if (!(error instanceof Error) || error.message !== "Coolify API request failed with HTTP 404") {
|
|
throw error;
|
|
}
|
|
// Coolify 4.0 exposes this read route only when the decrypt query is explicit.
|
|
return coolify(`${path}?decrypt=true`);
|
|
}
|
|
}
|
|
|
|
function envEntries(payload) {
|
|
if (Array.isArray(payload)) return payload;
|
|
if (Array.isArray(payload?.data)) return payload.data;
|
|
fail("Coolify environment response was malformed");
|
|
}
|
|
|
|
function runtimeEnvEntries(payload) {
|
|
const runtime = [];
|
|
const keys = new Set();
|
|
for (const entry of envEntries(payload)) {
|
|
if (normalizeCoolifyBoolean(entry?.is_preview) === "true") continue;
|
|
const key = envKey(entry);
|
|
if (!key) continue;
|
|
if (keys.has(key)) {
|
|
fail("Coolify runtime environment response contained duplicate non-preview keys");
|
|
}
|
|
keys.add(key);
|
|
runtime.push(entry);
|
|
}
|
|
return runtime;
|
|
}
|
|
|
|
function applicationEntries(payload) {
|
|
if (Array.isArray(payload)) return payload;
|
|
if (Array.isArray(payload?.data)) return payload.data;
|
|
fail("Coolify applications response was malformed");
|
|
}
|
|
|
|
function allowedResourceSet(allowedCsv) {
|
|
const allowedValues = allowedCsv
|
|
.split(",")
|
|
.map((value) => value.trim())
|
|
.filter(Boolean);
|
|
if (allowedValues.length === 0) {
|
|
fail("Coolify inventory validation requires allowed resources");
|
|
}
|
|
const allowed = new Set(allowedValues);
|
|
if (allowed.size !== allowedValues.length) {
|
|
fail("Coolify inventory allowlist must not contain duplicate resources");
|
|
}
|
|
for (const uuid of allowed) {
|
|
requireCoolifyCuid(uuid, "Coolify inventory allowlist entry");
|
|
}
|
|
return allowed;
|
|
}
|
|
|
|
function normalizedImage(value) {
|
|
return normalizeCoolifyValue(value).replace(/\/+$/, "");
|
|
}
|
|
|
|
function isPositiveNumericLimit(value) {
|
|
const normalized = normalizeCoolifyValue(value);
|
|
if (!/^(?:\d+(?:\.\d*)?|\.\d+)$/.test(normalized)) return false;
|
|
const numeric = Number(normalized);
|
|
return Number.isFinite(numeric) && numeric > 0;
|
|
}
|
|
|
|
function hasPositiveMemoryLimit(value) {
|
|
const normalized = normalizeCoolifyValue(value);
|
|
const match = /^(\d+)[bkmg]$/i.exec(normalized);
|
|
if (!match) return false;
|
|
return BigInt(match[1]) > 0n;
|
|
}
|
|
|
|
function isPositiveInteger(value) {
|
|
const normalized = normalizeCoolifyValue(value);
|
|
return /^[1-9]\d*$/.test(normalized) && BigInt(normalized) > 0n;
|
|
}
|
|
|
|
function normalizeHttpsConfiguredOrigin(value) {
|
|
const normalized = normalizeCoolifyValue(value);
|
|
if (!normalized) return "";
|
|
try {
|
|
const withProtocol = /^[a-z][a-z\d+\-.]*:\/\//i.test(normalized) ? normalized : `https://${normalized}`;
|
|
const url = new URL(withProtocol);
|
|
return url.protocol === "https:" ? url.origin.toLowerCase() : "";
|
|
} catch {
|
|
return "";
|
|
}
|
|
}
|
|
|
|
function assertWebSurfaceResourceLimits(app) {
|
|
if (!isPositiveNumericLimit(app?.limits_cpus) || !hasPositiveMemoryLimit(app?.limits_memory)) {
|
|
fail("Each Coolify web surface must set positive limits_cpus and unit-suffixed limits_memory hard caps");
|
|
}
|
|
}
|
|
|
|
function assertRuntimeResourceLimits(app, label) {
|
|
if (!isPositiveNumericLimit(app?.limits_cpus) || !hasPositiveMemoryLimit(app?.limits_memory)) {
|
|
fail(`Coolify ${label} must set positive limits_cpus and unit-suffixed limits_memory hard caps`);
|
|
}
|
|
}
|
|
|
|
function selectWebSurfacePair(apps, allowed, expectedImage) {
|
|
const image = normalizedImage(expectedImage);
|
|
if (!image) fail("Coolify web surface image is required");
|
|
|
|
const allowedWebImageApps = apps.filter((app) => allowed.has(app?.uuid) && normalizedImage(app?.docker_registry_image_name) === image);
|
|
const coreMatches = allowedWebImageApps.filter((app) => normalizeCoolifyValue(app?.name) === WEB_SURFACE_IDENTITIES.core);
|
|
const adminMatches = allowedWebImageApps.filter((app) => normalizeCoolifyValue(app?.name) === WEB_SURFACE_IDENTITIES.admin);
|
|
const portalMatches = allowedWebImageApps.filter((app) => normalizeCoolifyValue(app?.name) === WEB_SURFACE_IDENTITIES.portal);
|
|
if (allowedWebImageApps.length !== 3 || coreMatches.length !== 1 || adminMatches.length !== 1 || portalMatches.length !== 1) {
|
|
fail("Coolify must contain exactly the explicit hivegrid-web, hivegrid-admin, and hivegrid-portal resources for the web image");
|
|
}
|
|
|
|
const core = coreMatches[0];
|
|
const admin = adminMatches[0];
|
|
const portal = portalMatches[0];
|
|
requireCoolifyCuid(core?.uuid || "", "hivegrid-web resource UUID");
|
|
requireCoolifyCuid(admin?.uuid || "", "hivegrid-admin resource UUID");
|
|
requireCoolifyCuid(portal?.uuid || "", "hivegrid-portal resource UUID");
|
|
if (new Set([core.uuid, admin.uuid, portal.uuid]).size !== 3) {
|
|
fail("hivegrid-web, hivegrid-admin, and hivegrid-portal must use distinct Coolify resources");
|
|
}
|
|
if ([core, admin, portal].some((app) => normalizeCoolifyValue(app?.build_pack) !== "dockerimage")) {
|
|
fail("hivegrid-web, hivegrid-admin, and hivegrid-portal must use Coolify dockerimage mode for OCI digest pinning");
|
|
}
|
|
assertWebSurfaceResourceLimits(core);
|
|
assertWebSurfaceResourceLimits(admin);
|
|
assertWebSurfaceResourceLimits(portal);
|
|
return { core, admin, portal, image };
|
|
}
|
|
|
|
function assertWebSurfacePairByUuid(core, admin, portal, coreResourceUuid, adminResourceUuid, portalResourceUuid, expectedImage) {
|
|
if (new Set([coreResourceUuid, adminResourceUuid, portalResourceUuid]).size !== 3) {
|
|
fail("hivegrid-web, hivegrid-admin, and hivegrid-portal must use distinct Coolify resources");
|
|
}
|
|
const expected = [
|
|
[core, coreResourceUuid, WEB_SURFACE_IDENTITIES.core],
|
|
[admin, adminResourceUuid, WEB_SURFACE_IDENTITIES.admin],
|
|
[portal, portalResourceUuid, WEB_SURFACE_IDENTITIES.portal],
|
|
];
|
|
for (const [app, resourceUuid, name] of expected) {
|
|
assertWebSurfaceResourceLimits(app);
|
|
if (
|
|
app?.uuid !== resourceUuid ||
|
|
normalizeCoolifyValue(app?.name) !== name ||
|
|
normalizedImage(app?.docker_registry_image_name) !== expectedImage ||
|
|
normalizeCoolifyValue(app?.build_pack) !== "dockerimage"
|
|
) {
|
|
fail("Coolify web surface release target identity does not match its explicit name, UUID, and image");
|
|
}
|
|
}
|
|
}
|
|
|
|
async function resolveWebSurfaces(allowedCsv, expectedImage) {
|
|
const allowed = allowedResourceSet(allowedCsv);
|
|
const pair = selectWebSurfacePair(applicationEntries(await coolify("/applications")), allowed, expectedImage);
|
|
const runtimeEnvs = await Promise.all([pair.core, pair.admin, pair.portal].map((app) => readApplicationEnvs(app.uuid).then(runtimeEnvEntries)));
|
|
if (runtimeEnvs.some((envs) => envs.some((entry) => envKey(entry) === "APP_REVISION"))) {
|
|
fail("Coolify web surface APP_REVISION overrides must be removed before deployment");
|
|
}
|
|
process.stdout.write(`${pair.core.uuid},${pair.admin.uuid},${pair.portal.uuid}`);
|
|
}
|
|
|
|
function coolifyDigestTag(digest) {
|
|
if (!OCI_DIGEST_PATTERN.test(digest)) {
|
|
fail("Coolify web surface release requires a sha256 registry digest");
|
|
}
|
|
// Coolify's dockerimage build pack treats sha256-<hex> as an OCI digest
|
|
// reference (image@sha256:<hex>) instead of a mutable Docker tag.
|
|
return digest.replace(":", "-");
|
|
}
|
|
|
|
function webSurfaceReleasePayload(digest) {
|
|
return {
|
|
pre_deployment_command: "",
|
|
post_deployment_command: "",
|
|
docker_registry_image_tag: coolifyDigestTag(digest),
|
|
};
|
|
}
|
|
|
|
function previousWebSurfaceReleasePayload(app) {
|
|
return {
|
|
pre_deployment_command: normalizeCoolifyValue(app?.pre_deployment_command),
|
|
post_deployment_command: normalizeCoolifyValue(app?.post_deployment_command),
|
|
docker_registry_image_tag: normalizeCoolifyValue(app?.docker_registry_image_tag),
|
|
};
|
|
}
|
|
|
|
async function restoreWebSurfaceReleases(resources) {
|
|
let failed = false;
|
|
for (const { path, previous } of [...resources].reverse()) {
|
|
try {
|
|
await coolify(path, { method: "PATCH", body: JSON.stringify(previous) });
|
|
} catch {
|
|
failed = true;
|
|
}
|
|
}
|
|
return !failed;
|
|
}
|
|
|
|
async function setWebSurfaceRelease(coreResourceUuid, adminResourceUuid, portalResourceUuid, expectedImage, revision, digest) {
|
|
requireCoolifyCuid(coreResourceUuid, "hivegrid-web resource UUID");
|
|
requireCoolifyCuid(adminResourceUuid, "hivegrid-admin resource UUID");
|
|
requireCoolifyCuid(portalResourceUuid, "hivegrid-portal resource UUID");
|
|
if (new Set([coreResourceUuid, adminResourceUuid, portalResourceUuid]).size !== 3) {
|
|
fail("hivegrid-web, hivegrid-admin, and hivegrid-portal must use distinct Coolify resources");
|
|
}
|
|
const image = normalizedImage(expectedImage);
|
|
if (!image) fail("Coolify web surface image is required");
|
|
if (!FULL_GIT_SHA_PATTERN.test(revision)) {
|
|
fail("Coolify web surface release requires a full lowercase Git SHA");
|
|
}
|
|
if (!OCI_DIGEST_PATTERN.test(digest)) {
|
|
fail("Coolify web surface release requires a sha256 registry digest");
|
|
}
|
|
|
|
const resources = [
|
|
{ uuid: coreResourceUuid, name: WEB_SURFACE_IDENTITIES.core },
|
|
{ uuid: adminResourceUuid, name: WEB_SURFACE_IDENTITIES.admin },
|
|
{ uuid: portalResourceUuid, name: WEB_SURFACE_IDENTITIES.portal },
|
|
].map((resource) => ({ ...resource, path: `/applications/${encodeURIComponent(resource.uuid)}` }));
|
|
const current = await Promise.all(resources.map((resource) => coolify(resource.path)));
|
|
assertWebSurfacePairByUuid(current[0], current[1], current[2], coreResourceUuid, adminResourceUuid, portalResourceUuid, image);
|
|
const mutations = resources.map((resource, index) => ({
|
|
...resource,
|
|
previous: previousWebSurfaceReleasePayload(current[index]),
|
|
}));
|
|
const patched = [];
|
|
|
|
try {
|
|
for (const resource of mutations) {
|
|
await coolify(resource.path, { method: "PATCH", body: JSON.stringify(webSurfaceReleasePayload(digest)) });
|
|
patched.push(resource);
|
|
}
|
|
const updated = await Promise.all(resources.map((resource) => coolify(resource.path)));
|
|
assertWebSurfacePairByUuid(updated[0], updated[1], updated[2], coreResourceUuid, adminResourceUuid, portalResourceUuid, image);
|
|
const digestTag = coolifyDigestTag(digest);
|
|
if (updated.some((app) => normalizeCoolifyValue(app?.docker_registry_image_tag) !== digestTag)) {
|
|
fail("Coolify web surface release digest was not persisted for all three resources");
|
|
}
|
|
} catch {
|
|
const restored = await restoreWebSurfaceReleases(patched);
|
|
fail(
|
|
restored
|
|
? "Coolify web surface pair mutation failed and previous resource configuration was restored"
|
|
: "Coolify web surface pair mutation failed and compensation was incomplete"
|
|
);
|
|
}
|
|
|
|
process.stdout.write(`Web surface trio configured for ${image}:${revision} as ${image}@${digest}\n`);
|
|
}
|
|
|
|
function assertCompletedWebSurfaceDeployment(payload, deploymentUuidValue, app, expectedName) {
|
|
if (normalizeCoolifyValue(payload?.deployment_uuid) !== deploymentUuidValue) {
|
|
fail("Coolify web surface deployment identity does not match the triggered deployment");
|
|
}
|
|
if (!["finished", "success", "succeeded", "completed", "done"].includes(deploymentStatus(payload))) {
|
|
fail("Coolify web surface deployment is not completed");
|
|
}
|
|
if (normalizeCoolifyValue(payload?.application_name) !== expectedName) {
|
|
fail("Coolify web surface deployment does not belong to the expected named application");
|
|
}
|
|
const applicationId = normalizeCoolifyValue(app?.id);
|
|
const deploymentApplicationId = normalizeCoolifyValue(payload?.application_id);
|
|
if (applicationId && deploymentApplicationId && applicationId !== deploymentApplicationId) {
|
|
fail("Coolify web surface deployment application identity does not match the live resource");
|
|
}
|
|
}
|
|
|
|
async function assertWebSurfaceRelease(
|
|
coreResourceUuid,
|
|
adminResourceUuid,
|
|
portalResourceUuid,
|
|
expectedImage,
|
|
revision,
|
|
digest,
|
|
coreDeploymentUuid,
|
|
adminDeploymentUuid,
|
|
portalDeploymentUuid
|
|
) {
|
|
requireCoolifyCuid(coreResourceUuid, "hivegrid-web resource UUID");
|
|
requireCoolifyCuid(adminResourceUuid, "hivegrid-admin resource UUID");
|
|
requireCoolifyCuid(portalResourceUuid, "hivegrid-portal resource UUID");
|
|
requireCoolifyCuid(coreDeploymentUuid, "hivegrid-web deployment UUID");
|
|
requireCoolifyCuid(adminDeploymentUuid, "hivegrid-admin deployment UUID");
|
|
requireCoolifyCuid(portalDeploymentUuid, "hivegrid-portal deployment UUID");
|
|
if (
|
|
new Set([coreResourceUuid, adminResourceUuid, portalResourceUuid]).size !== 3 ||
|
|
new Set([coreDeploymentUuid, adminDeploymentUuid, portalDeploymentUuid]).size !== 3
|
|
) {
|
|
fail("hivegrid-web, hivegrid-admin, and hivegrid-portal require distinct resources and deployments");
|
|
}
|
|
const image = normalizedImage(expectedImage);
|
|
if (!image) fail("Coolify web surface image is required");
|
|
if (!FULL_GIT_SHA_PATTERN.test(revision)) {
|
|
fail("Coolify web surface release proof requires a full lowercase Git SHA");
|
|
}
|
|
const digestTag = coolifyDigestTag(digest);
|
|
const resources = [
|
|
{ uuid: coreResourceUuid, deploymentUuid: coreDeploymentUuid, name: WEB_SURFACE_IDENTITIES.core },
|
|
{ uuid: adminResourceUuid, deploymentUuid: adminDeploymentUuid, name: WEB_SURFACE_IDENTITIES.admin },
|
|
{ uuid: portalResourceUuid, deploymentUuid: portalDeploymentUuid, name: WEB_SURFACE_IDENTITIES.portal },
|
|
];
|
|
const applications = await Promise.all(resources.map((resource) => coolify(`/applications/${encodeURIComponent(resource.uuid)}`)));
|
|
assertWebSurfacePairByUuid(applications[0], applications[1], applications[2], coreResourceUuid, adminResourceUuid, portalResourceUuid, image);
|
|
for (const app of applications) {
|
|
if (normalizeCoolifyValue(app?.docker_registry_image_tag) !== digestTag) {
|
|
fail("Coolify web surface is not pinned to the expected registry digest");
|
|
}
|
|
if (normalizeCoolifyValue(app?.status).toLowerCase() !== "running:healthy") {
|
|
fail("Coolify web surface is not running healthy at the expected registry digest");
|
|
}
|
|
}
|
|
|
|
const deployments = await Promise.all(resources.map((resource) => coolify(`/deployments/${encodeURIComponent(resource.deploymentUuid)}`)));
|
|
for (let index = 0; index < resources.length; index += 1) {
|
|
assertCompletedWebSurfaceDeployment(deployments[index], resources[index].deploymentUuid, applications[index], resources[index].name);
|
|
}
|
|
|
|
process.stdout.write(`Web surface trio verified for ${image}:${revision} at ${image}@${digest}\n`);
|
|
}
|
|
|
|
async function validateRequiredImages(allowedCsv, expectedImages) {
|
|
if (expectedImages.length === 0) {
|
|
fail("Coolify inventory validation requires allowed resources and expected images");
|
|
}
|
|
const allowed = allowedResourceSet(allowedCsv);
|
|
const normalizedImages = expectedImages.map(normalizedImage);
|
|
if (normalizedImages.some((image) => !image) || new Set(normalizedImages).size !== normalizedImages.length) {
|
|
fail("Coolify inventory expected images must be non-empty and unique");
|
|
}
|
|
|
|
const apps = applicationEntries(await coolify("/applications"));
|
|
const requiredApps = [];
|
|
for (const expectedImage of normalizedImages) {
|
|
const matches = apps.filter((app) => allowed.has(app?.uuid) && normalizedImage(app?.docker_registry_image_name) === expectedImage);
|
|
if (matches.length !== 1 || !COOLIFY_CUID_PATTERN.test(matches[0]?.uuid || "")) {
|
|
fail("Coolify required application inventory is missing, ambiguous, or invalid");
|
|
}
|
|
requiredApps.push(matches[0]);
|
|
}
|
|
const requiredEnvs = await Promise.all(requiredApps.map((app) => readApplicationEnvs(app.uuid).then(runtimeEnvEntries)));
|
|
if (requiredEnvs.some((envs) => envs.some((entry) => envKey(entry) === "APP_REVISION"))) {
|
|
fail("Coolify core application APP_REVISION overrides must be removed before deployment");
|
|
}
|
|
process.stdout.write("Required Coolify image inventory validated\n");
|
|
}
|
|
|
|
function selectUniqueAllowedImageApplication(apps, allowed, expectedImage, label) {
|
|
const image = normalizedImage(expectedImage);
|
|
if (!image) fail(`${label} image is required`);
|
|
const matches = apps.filter((app) => allowed.has(app?.uuid) && normalizedImage(app?.docker_registry_image_name) === image);
|
|
if (matches.length !== 1 || !COOLIFY_CUID_PATTERN.test(matches[0]?.uuid || "")) {
|
|
fail(`Coolify ${label} runtime is missing, ambiguous, or outside the resource allowlist`);
|
|
}
|
|
return matches[0];
|
|
}
|
|
|
|
function selectUniqueAllowedNamedApplication(apps, allowed, expectedName, label) {
|
|
const matches = apps.filter((app) => allowed.has(app?.uuid) && normalizeCoolifyValue(app?.name) === expectedName);
|
|
if (matches.length !== 1 || !COOLIFY_CUID_PATTERN.test(matches[0]?.uuid || "")) {
|
|
fail(`Coolify ${label} runtime is missing, ambiguous, or outside the resource allowlist`);
|
|
}
|
|
return matches[0];
|
|
}
|
|
|
|
async function assertNoAppRevisionOverride(resourceUuid) {
|
|
if (!resourceUuid) {
|
|
fail("Coolify resource UUID is required");
|
|
}
|
|
requireCoolifyCuid(resourceUuid, "Coolify resource UUID");
|
|
const envs = runtimeEnvEntries(await readApplicationEnvs(resourceUuid));
|
|
if (envs.some((entry) => envKey(entry) === "APP_REVISION")) {
|
|
fail("Coolify APP_REVISION override must be removed before deployment");
|
|
}
|
|
process.stdout.write("Application revision override absent\n");
|
|
}
|
|
|
|
function isPrivilegedDatabaseEnvKey(key) {
|
|
return (
|
|
key === "DIRECT_URL" || key === "MIGRATE_ON_BOOT" || key === "SEED_ON_BOOT" || key === "SEED_ONCE" || key.startsWith("MIGRATOR_") || key.startsWith("SEED_")
|
|
);
|
|
}
|
|
|
|
function isPortalForbiddenEnvKey(key) {
|
|
return (
|
|
key === "SESSION_SECRET" ||
|
|
key === "ADMIN_SESSION_SECRET" ||
|
|
key === "CORE_SESSION_SECRET" ||
|
|
key.startsWith("AUTHENTIK_") ||
|
|
/^(?:OAUTH|GOOGLE|MICROSOFT|APPLE)(?:_|$)/.test(key) ||
|
|
/(?:^|_)OAUTH(?:_|$)/.test(key) ||
|
|
/^(?:BILLING|LAGO|MOLLIE|STRIPE)(?:_|$)/.test(key) ||
|
|
/^(?:COOLIFY|SSH|TRAEFIK|INGRESS|CLOUDFLARE)(?:_|$)/.test(key) ||
|
|
key.startsWith("PORTAL_SERVER_") ||
|
|
/(?:^|_)DOMAIN_CONTROLLER(?:_|$)/.test(key)
|
|
);
|
|
}
|
|
|
|
function isAllowedCaptchaInstanceUrl(value) {
|
|
try {
|
|
const url = new URL(value);
|
|
const isLoopback = url.hostname === "localhost" || url.hostname === "::1" || url.hostname === "[::1]" || url.hostname.startsWith("127.");
|
|
return (
|
|
(url.protocol === "https:" || (url.protocol === "http:" && isLoopback)) &&
|
|
Boolean(url.hostname) &&
|
|
!url.username &&
|
|
!url.password &&
|
|
!url.search &&
|
|
!url.hash
|
|
);
|
|
} catch {
|
|
return false;
|
|
}
|
|
}
|
|
|
|
function isValidRedisConnectionUrl(value) {
|
|
try {
|
|
const url = new URL(value);
|
|
const database = url.pathname.replace(/^\//u, "");
|
|
return (url.protocol === "redis:" || url.protocol === "rediss:") && Boolean(url.hostname) && (!database || /^\d+$/u.test(database));
|
|
} catch {
|
|
return false;
|
|
}
|
|
}
|
|
|
|
function normalizeRedisConnectionTarget(value) {
|
|
if (!isValidRedisConnectionUrl(value)) return "";
|
|
const url = new URL(value);
|
|
const database = url.pathname.replace(/^\//u, "") || "0";
|
|
return `${url.protocol}//${url.hostname.toLowerCase()}:${url.port || "6379"}/${database}`;
|
|
}
|
|
|
|
function resolveWorkerSharedStoreRedisUrl(values) {
|
|
return values?.get("REDIS_URL")?.trim() || values?.get("BULLMQ_REDIS_URL")?.trim() || "";
|
|
}
|
|
|
|
function assertPortalAuthDependencies(values) {
|
|
const captchaProvider = values.get("CAPTCHA_PROVIDER")?.trim().toLowerCase();
|
|
if (captchaProvider !== "cap" && captchaProvider !== "mcaptcha") {
|
|
fail("Coolify hivegrid-portal runtime requires CAPTCHA_PROVIDER=cap or CAPTCHA_PROVIDER=mcaptcha");
|
|
}
|
|
|
|
if (captchaProvider === "cap") {
|
|
if (!isAllowedCaptchaInstanceUrl(values.get("CAP_INSTANCE_URL")?.trim() || "")) {
|
|
fail("Coolify hivegrid-portal runtime requires a valid CAP_INSTANCE_URL");
|
|
}
|
|
if (!values.get("CAP_SITEKEY_LOGIN")?.trim()) {
|
|
fail("Coolify hivegrid-portal runtime requires CAP_SITEKEY_LOGIN");
|
|
}
|
|
if (!values.get("CAP_SITE_SECRET_LOGIN")?.trim() && !values.get("CAP_SITE_SECRET")?.trim()) {
|
|
fail("Coolify hivegrid-portal runtime requires CAP_SITE_SECRET_LOGIN or CAP_SITE_SECRET");
|
|
}
|
|
} else {
|
|
if (!isAllowedCaptchaInstanceUrl(values.get("MCAPTCHA_INSTANCE_URL")?.trim() || "")) {
|
|
fail("Coolify hivegrid-portal runtime requires a valid MCAPTCHA_INSTANCE_URL");
|
|
}
|
|
if (!values.get("MCAPTCHA_SITEKEY_LOGIN")?.trim()) {
|
|
fail("Coolify hivegrid-portal runtime requires MCAPTCHA_SITEKEY_LOGIN");
|
|
}
|
|
if (!values.get("MCAPTCHA_ACCOUNT_SECRET")?.trim()) {
|
|
fail("Coolify hivegrid-portal runtime requires MCAPTCHA_ACCOUNT_SECRET");
|
|
}
|
|
}
|
|
|
|
const redisUrl = values.get("REDIS_URL")?.trim() || "";
|
|
if (!isValidRedisConnectionUrl(redisUrl)) {
|
|
fail("Coolify hivegrid-portal runtime requires a valid REDIS_URL for rate limits and the BullMQ fallback connection");
|
|
}
|
|
const bullmqRedisUrl = values.get("BULLMQ_REDIS_URL")?.trim();
|
|
if (bullmqRedisUrl && !isValidRedisConnectionUrl(bullmqRedisUrl)) {
|
|
fail("Coolify hivegrid-portal runtime BULLMQ_REDIS_URL must be a valid Redis connection URL when configured");
|
|
}
|
|
}
|
|
|
|
function databaseUrlRole(value) {
|
|
try {
|
|
const url = new URL(value);
|
|
if (url.protocol !== "postgres:" && url.protocol !== "postgresql:") return "";
|
|
return decodeURIComponent(url.username);
|
|
} catch {
|
|
return "";
|
|
}
|
|
}
|
|
|
|
function databaseUrlPort(value) {
|
|
try {
|
|
const url = new URL(value);
|
|
if (url.protocol !== "postgres:" && url.protocol !== "postgresql:") return "";
|
|
return url.port;
|
|
} catch {
|
|
return "";
|
|
}
|
|
}
|
|
|
|
function assertRuntimeDatabaseEntries(entries, expectedRole, surface) {
|
|
if (!RUNTIME_DATABASE_ROLES.has(expectedRole)) {
|
|
fail("Runtime database environment requires hivegrid_app, hivegrid_worker, or hivegrid_portal");
|
|
}
|
|
if (!RUNTIME_DATABASE_SURFACES.has(surface)) {
|
|
fail("Runtime database environment requires a web, portal, or service surface");
|
|
}
|
|
if (
|
|
((surface === "web" || surface === "admin") && expectedRole !== "hivegrid_app") ||
|
|
(surface === "portal" && expectedRole !== "hivegrid_portal") ||
|
|
(surface !== "portal" && expectedRole === "hivegrid_portal")
|
|
) {
|
|
fail("Runtime web surface does not match its dedicated database role");
|
|
}
|
|
|
|
const values = new Map(entries.map((entry) => [envKey(entry), normalizeEnvValue(entry)]));
|
|
if (values.has("APP_REVISION")) {
|
|
fail("Coolify runtime APP_REVISION overrides must be removed before migration");
|
|
}
|
|
const forbidden = [...values.keys()].filter(isPrivilegedDatabaseEnvKey);
|
|
if (forbidden.length > 0) {
|
|
fail("Coolify runtime contains migration or seed environment keys");
|
|
}
|
|
if (values.get("RLS_RUNTIME_MODE") !== "required") {
|
|
fail("Coolify runtime must set RLS_RUNTIME_MODE=required");
|
|
}
|
|
if (values.get("DATABASE_RUNTIME_ROLE") !== expectedRole || databaseUrlRole(values.get("DATABASE_URL") || "") !== expectedRole) {
|
|
fail("Coolify runtime database credential does not match DATABASE_RUNTIME_ROLE");
|
|
}
|
|
const databaseReadUrl = values.get("DATABASE_READ_URL")?.trim() || "";
|
|
if (databaseReadUrl && databaseUrlRole(databaseReadUrl) !== expectedRole) {
|
|
fail("Coolify runtime read database credential does not match DATABASE_RUNTIME_ROLE");
|
|
}
|
|
if (surface === "web" && values.get("WEB_RUNTIME_SURFACE") !== "core") {
|
|
fail("Coolify hivegrid-web runtime must set WEB_RUNTIME_SURFACE=core");
|
|
}
|
|
if (surface === "web" && values.has("PORTAL_SESSION_SECRET")) {
|
|
fail("Coolify hivegrid-web runtime must not contain PORTAL_SESSION_SECRET");
|
|
}
|
|
if (surface === "admin") {
|
|
if (values.get("WEB_RUNTIME_SURFACE") !== "admin") {
|
|
fail("Coolify hivegrid-admin runtime must set WEB_RUNTIME_SURFACE=admin");
|
|
}
|
|
if (!values.get("SESSION_SECRET")?.trim()) {
|
|
fail("Coolify hivegrid-admin runtime requires SESSION_SECRET");
|
|
}
|
|
if (values.has("PORTAL_SESSION_SECRET")) {
|
|
fail("Coolify hivegrid-admin runtime must not contain PORTAL_SESSION_SECRET");
|
|
}
|
|
if ((values.get("ADMIN_FALLBACK_LOGIN_ENABLED") || "false") !== "false") {
|
|
fail("Coolify hivegrid-admin runtime must set ADMIN_FALLBACK_LOGIN_ENABLED=false");
|
|
}
|
|
}
|
|
if (surface === "portal") {
|
|
if (values.get("WEB_RUNTIME_SURFACE") !== "portal") {
|
|
fail("Coolify hivegrid-portal runtime must set WEB_RUNTIME_SURFACE=portal");
|
|
}
|
|
if (!values.get("PORTAL_SESSION_SECRET")?.trim()) {
|
|
fail("Coolify hivegrid-portal runtime requires its dedicated PORTAL_SESSION_SECRET");
|
|
}
|
|
assertPortalAuthDependencies(values);
|
|
const portalForbidden = [...values.keys()].filter(isPortalForbiddenEnvKey);
|
|
if (portalForbidden.length > 0) {
|
|
fail("Coolify hivegrid-portal runtime contains forbidden core session, OAuth, billing, or ingress credentials");
|
|
}
|
|
}
|
|
const authentikKeysPresent = AUTHENTIK_ADMIN_ENV_KEYS.filter((key) => values.has(key));
|
|
if (surface !== "admin" && authentikKeysPresent.length > 0) {
|
|
fail("Authentik Admin SSO environment is restricted to the admin resource");
|
|
}
|
|
if (surface === "admin") {
|
|
const missing = AUTHENTIK_ADMIN_ENV_KEYS.filter((key) => !values.get(key)?.trim());
|
|
if (missing.length > 0) {
|
|
fail("Coolify admin Authentik SSO environment is incomplete");
|
|
}
|
|
if (databaseUrlRole(values.get("AUTHENTIK_ADMIN_JIT_DATABASE_URL") || "") !== "hivegrid_authentik_jit") {
|
|
fail("Coolify web Authentik Admin JIT credential must use hivegrid_authentik_jit");
|
|
}
|
|
}
|
|
if (!isPositiveInteger(values.get("DATABASE_POOL_MAX"))) {
|
|
fail("Coolify runtime must set an explicit positive DATABASE_POOL_MAX");
|
|
}
|
|
if (databaseUrlPort(values.get("DATABASE_URL") || "") !== "6432") {
|
|
fail("Coolify runtime DATABASE_URL must use the PgBouncer port 6432");
|
|
}
|
|
return values;
|
|
}
|
|
|
|
async function assertRuntimeDatabaseEnv(resourceUuid, expectedRole, surface) {
|
|
if (!resourceUuid) fail("Coolify resource UUID is required");
|
|
requireCoolifyCuid(resourceUuid, "Coolify resource UUID");
|
|
const entries = runtimeEnvEntries(await readApplicationEnvs(resourceUuid));
|
|
assertRuntimeDatabaseEntries(entries, expectedRole, surface);
|
|
process.stdout.write(`Runtime database environment verified for ${expectedRole}\n`);
|
|
}
|
|
|
|
async function assertRuntimePreflight(allowedCsv, webImage, apiImage, mcpImage, hocuspocusImage, workerImage) {
|
|
const allowed = allowedResourceSet(allowedCsv);
|
|
const expectedImages = [webImage, apiImage, mcpImage, hocuspocusImage, workerImage].map(normalizedImage);
|
|
if (expectedImages.some((image) => !image) || new Set(expectedImages).size !== expectedImages.length) {
|
|
fail("Coolify runtime preflight requires five non-empty, distinct runtime images");
|
|
}
|
|
|
|
const apps = applicationEntries(await coolify("/applications"));
|
|
const webPair = selectWebSurfacePair(apps, allowed, webImage);
|
|
const api = selectUniqueAllowedImageApplication(apps, allowed, apiImage, "API");
|
|
const mcp = selectUniqueAllowedImageApplication(apps, allowed, mcpImage, "MCP");
|
|
const hocuspocus = selectUniqueAllowedImageApplication(apps, allowed, hocuspocusImage, "Hocuspocus");
|
|
const portalDomainController = selectUniqueAllowedNamedApplication(
|
|
apps,
|
|
allowed,
|
|
PORTAL_DOMAIN_CONTROLLER_IDENTITY,
|
|
"portal-domain-controller"
|
|
);
|
|
const workerCandidates = apps.filter((app) => allowed.has(app?.uuid) && normalizedImage(app?.docker_registry_image_name) === normalizedImage(workerImage));
|
|
const workerCandidatesWithEnv = await Promise.all(
|
|
workerCandidates.map(async (app) => {
|
|
requireCoolifyCuid(app?.uuid || "", "Coolify worker resource UUID");
|
|
const entries = runtimeEnvEntries(await readApplicationEnvs(app.uuid));
|
|
const group = normalizeEnvValue(entries.find((entry) => envKey(entry) === "WORKER_QUEUE_GROUP"));
|
|
return { app, entries, group };
|
|
})
|
|
);
|
|
const workers = WORKER_GROUP_NAMES.map((group) => {
|
|
const matches = workerCandidatesWithEnv.filter((candidate) => candidate.group === group);
|
|
if (matches.length !== 1) {
|
|
fail(`Coolify worker-${group} runtime is missing, ambiguous, or outside the resource allowlist`);
|
|
}
|
|
return matches[0];
|
|
});
|
|
for (const [app, label] of [
|
|
[api, "API runtime"],
|
|
[mcp, "MCP runtime"],
|
|
[hocuspocus, "Hocuspocus runtime"],
|
|
]) {
|
|
assertRuntimeResourceLimits(app, label);
|
|
}
|
|
for (const worker of workers) {
|
|
assertRuntimeResourceLimits(worker.app, `worker-${worker.group} runtime`);
|
|
}
|
|
assertRuntimeResourceLimits(portalDomainController, "portal-domain-controller runtime");
|
|
|
|
const fixedResources = [
|
|
{ app: webPair.core, role: "hivegrid_app", surface: "web" },
|
|
{ app: webPair.admin, role: "hivegrid_app", surface: "admin" },
|
|
{ app: webPair.portal, role: "hivegrid_portal", surface: "portal" },
|
|
{ app: api, role: "hivegrid_app", surface: "service" },
|
|
{ app: mcp, role: "hivegrid_app", surface: "service" },
|
|
{ app: hocuspocus, role: "hivegrid_app", surface: "service" },
|
|
];
|
|
const fixedResourcesWithEnv = await Promise.all(
|
|
fixedResources.map(async (resource) => ({
|
|
...resource,
|
|
entries: runtimeEnvEntries(await readApplicationEnvs(resource.app.uuid)),
|
|
}))
|
|
);
|
|
const runtimeResources = [
|
|
...fixedResourcesWithEnv,
|
|
...workers.map((worker) => ({ app: worker.app, entries: worker.entries, role: "hivegrid_worker", surface: "service" })),
|
|
];
|
|
const allResourceUuids = [...runtimeResources.map(({ app }) => app.uuid), portalDomainController.uuid];
|
|
if (new Set(allResourceUuids).size !== allResourceUuids.length) {
|
|
fail("Coolify runtime preflight requires twelve distinct allowlisted resources");
|
|
}
|
|
|
|
const valuesByUuid = new Map();
|
|
for (const resource of runtimeResources) {
|
|
const values = assertRuntimeDatabaseEntries(resource.entries, resource.role, resource.surface);
|
|
valuesByUuid.set(resource.app.uuid, values);
|
|
}
|
|
const coreValues = valuesByUuid.get(webPair.core.uuid);
|
|
const adminValues = valuesByUuid.get(webPair.admin.uuid);
|
|
const portalValues = valuesByUuid.get(webPair.portal.uuid);
|
|
const apiValues = valuesByUuid.get(api.uuid);
|
|
const mailWorker = workers.find((worker) => worker.group === "mail");
|
|
const mailValues = valuesByUuid.get(mailWorker?.app.uuid);
|
|
const importWorker = workers.find((worker) => worker.group === "import");
|
|
const importValues = valuesByUuid.get(importWorker?.app.uuid);
|
|
const generalWorker = workers.find((worker) => worker.group === "general");
|
|
const generalValues = valuesByUuid.get(generalWorker?.app.uuid);
|
|
const importSharedStoreTarget = normalizeRedisConnectionTarget(resolveWorkerSharedStoreRedisUrl(importValues));
|
|
const generalSharedStoreTarget = normalizeRedisConnectionTarget(resolveWorkerSharedStoreRedisUrl(generalValues));
|
|
if (!importSharedStoreTarget) {
|
|
fail("Coolify worker-import runtime requires a valid REDIS_URL or BULLMQ_REDIS_URL for the tenant-export barrier");
|
|
}
|
|
if (!generalSharedStoreTarget) {
|
|
fail("Coolify worker-general runtime requires a valid REDIS_URL or BULLMQ_REDIS_URL for the tenant-export barrier");
|
|
}
|
|
if (importSharedStoreTarget !== generalSharedStoreTarget) {
|
|
fail("Coolify worker-import and worker-general must use the same Redis endpoint and database for the tenant-export barrier");
|
|
}
|
|
const coreRedisUrl = coreValues?.get("REDIS_URL")?.trim() || "";
|
|
if (!isValidRedisConnectionUrl(coreRedisUrl)) {
|
|
fail("Coolify hivegrid-web runtime requires a valid REDIS_URL for distributed GDPR export download gates");
|
|
}
|
|
const missingTenantHardDeleteSearch = ["MEILI_URL", "MEILI_API_KEY"].filter((key) => !generalValues?.get(key)?.trim());
|
|
if (missingTenantHardDeleteSearch.length > 0) {
|
|
fail(`Coolify worker-general runtime is missing required tenant hard-delete search environment keys: ${missingTenantHardDeleteSearch.join(", ")}`);
|
|
}
|
|
assertAdminConnectionMasterKeyPreflight(
|
|
[
|
|
["hivegrid-web", coreValues],
|
|
["hivegrid-admin", adminValues],
|
|
["hivegrid-api", apiValues],
|
|
...workers.map((worker) => [`worker-${worker.group}`, valuesByUuid.get(worker.app.uuid)]),
|
|
],
|
|
portalValues
|
|
);
|
|
assertGdprExportStoragePreflight(coreValues, adminValues, portalValues, importValues, generalValues);
|
|
const coreCryptoSecret = coreValues?.get("CRYPTO_SECRET")?.trim() || "";
|
|
const mailCryptoSecret = mailValues?.get("CRYPTO_SECRET")?.trim() || "";
|
|
if (!coreCryptoSecret || !mailCryptoSecret || coreCryptoSecret !== mailCryptoSecret) {
|
|
fail("Coolify hivegrid-web and worker-mail must share the same non-empty CRYPTO_SECRET for portal setup envelope delivery");
|
|
}
|
|
const coreHost = normalizeHttpsConfiguredOrigin(coreValues?.get("PORTAL_APP_HOST"));
|
|
const adminHost = normalizeHttpsConfiguredOrigin(adminValues?.get("PORTAL_APP_HOST"));
|
|
const portalHost = normalizeHttpsConfiguredOrigin(portalValues?.get("PORTAL_APP_HOST"));
|
|
const mailHost = normalizeHttpsConfiguredOrigin(mailValues?.get("PORTAL_APP_HOST"));
|
|
if (!coreHost || !adminHost || !portalHost || !mailHost || coreHost !== adminHost || adminHost !== portalHost || portalHost !== mailHost) {
|
|
fail("Coolify hivegrid-web, hivegrid-admin, hivegrid-portal, and worker-mail must use the same normalized PORTAL_APP_HOST");
|
|
}
|
|
if (portalValues?.get("APP_PROTOCOL") !== "https" || mailValues?.get("APP_PROTOCOL") !== "https") {
|
|
fail("Coolify hivegrid-portal and worker-mail must set APP_PROTOCOL=https");
|
|
}
|
|
const coreBoundaryOrigins = CORE_PUBLIC_HOST_ENV_KEYS.map((key) => {
|
|
const origin = normalizeHttpsConfiguredOrigin(coreValues?.get(key));
|
|
if (!origin) {
|
|
fail(`Coolify hivegrid-web runtime must set a valid ${key} for portal host isolation`);
|
|
}
|
|
return { key, origin };
|
|
});
|
|
if (coreBoundaryOrigins.some(({ origin }) => origin === portalHost)) {
|
|
fail("Coolify PORTAL_APP_HOST must be distinct from core APP_BASE_DOMAIN, WEB_APP_HOST, ADMIN_APP_HOST, and API_HOST");
|
|
}
|
|
for (const key of CORE_PUBLIC_HOST_ENV_KEYS) {
|
|
if (normalizeHttpsConfiguredOrigin(adminValues?.get(key)) !== normalizeHttpsConfiguredOrigin(coreValues?.get(key))) {
|
|
fail(`Coolify hivegrid-web and hivegrid-admin must use the same normalized ${key}`);
|
|
}
|
|
}
|
|
|
|
const webhookWorker = workers.find((worker) => worker.group === "webhook");
|
|
const coreRuntime = fixedResourcesWithEnv.find((resource) => resource.app.uuid === webPair.core.uuid);
|
|
assertWebPushEntries(coreRuntime?.entries || [], webhookWorker?.entries || []);
|
|
|
|
process.stdout.write("Coolify read-only runtime preflight verified\n");
|
|
}
|
|
|
|
function normalizeHttpsStorageEndpoint(value) {
|
|
try {
|
|
const url = new URL(value);
|
|
if (url.protocol !== "https:" || !url.hostname || url.username || url.password) return "";
|
|
const pathname = url.pathname.replace(/\/+$/, "");
|
|
return `${url.protocol}//${url.host.toLowerCase()}${pathname}${url.search}`;
|
|
} catch {
|
|
return "";
|
|
}
|
|
}
|
|
|
|
function normalizeStorageForcePathStyle(value) {
|
|
const normalized = value?.trim().toLowerCase() || "false";
|
|
return normalized === "true" || normalized === "false" ? normalized : "";
|
|
}
|
|
|
|
function isCanonicalBase64Key(value) {
|
|
if (!CANONICAL_BASE64_32_BYTES_PATTERN.test(value)) return false;
|
|
try {
|
|
const decoded = Buffer.from(value, "base64");
|
|
return decoded.byteLength === 32 && decoded.toString("base64") === value;
|
|
} catch {
|
|
return false;
|
|
}
|
|
}
|
|
|
|
function readOptionalBooleanGate(values, key) {
|
|
const value = values?.get(key);
|
|
if (value === undefined || value === "") return false;
|
|
if (value !== "true" && value !== "false") {
|
|
fail(`Coolify worker-import ${key} must be exactly true or false when configured`);
|
|
}
|
|
return value === "true";
|
|
}
|
|
|
|
function assertAdminConnectionMasterKeyPreflight(targets, portalValues) {
|
|
const keyName = "ADMIN_CONNECTION_MASTER_KEY";
|
|
if (portalValues?.get(keyName)?.trim()) {
|
|
fail(`Coolify hivegrid-portal must not contain ${keyName}`);
|
|
}
|
|
|
|
const invalidTargets = targets.filter(([, values]) => Buffer.byteLength(values?.get(keyName)?.trim() || "", "utf8") < 32).map(([label]) => label);
|
|
if (invalidTargets.length > 0) {
|
|
fail(`Coolify production runtimes require ${keyName} with at least 32 bytes on: ${invalidTargets.join(", ")}`);
|
|
}
|
|
|
|
const values = targets.map(([, entries]) => entries.get(keyName).trim());
|
|
if (new Set(values).size !== 1) {
|
|
fail(`Coolify production web, API, and worker runtimes must share the same ${keyName}`);
|
|
}
|
|
|
|
const masterKey = values[0];
|
|
const reusedBy = targets
|
|
.filter(([, entries]) => ["SESSION_SECRET", "CRYPTO_SECRET"].some((secretName) => entries.get(secretName)?.trim() === masterKey))
|
|
.map(([label]) => label);
|
|
if (reusedBy.length > 0) {
|
|
fail(`${keyName} must be independent from SESSION_SECRET and CRYPTO_SECRET on: ${reusedBy.join(", ")}`);
|
|
}
|
|
}
|
|
|
|
function assertGdprExportStoragePreflight(coreValues, adminValues, portalValues, importValues, generalValues) {
|
|
const importEnabled = readOptionalBooleanGate(importValues, "IMPORT_QUEUE_ENABLED");
|
|
const importRuntimeReady = readOptionalBooleanGate(importValues, "IMPORT_QUEUE_RUNTIME_READY");
|
|
const portalGdprExportEnabled = readOptionalBooleanGate(importValues, "PORTAL_GDPR_EXPORT_QUEUE_ENABLED");
|
|
const fullMode = importEnabled && importRuntimeReady && !portalGdprExportEnabled;
|
|
const dedicatedMode = !importEnabled && !importRuntimeReady && portalGdprExportEnabled;
|
|
const idleMode = !importEnabled && !importRuntimeReady && !portalGdprExportEnabled;
|
|
if (!fullMode && !dedicatedMode && !idleMode) {
|
|
fail(
|
|
"Coolify worker-import must use idle mode, full mode with both IMPORT_QUEUE gates enabled, or dedicated GDPR export mode with only PORTAL_GDPR_EXPORT_QUEUE_ENABLED enabled"
|
|
);
|
|
}
|
|
|
|
const webResources = [
|
|
["hivegrid-web", coreValues],
|
|
["hivegrid-admin", adminValues],
|
|
["hivegrid-portal", portalValues],
|
|
];
|
|
const workerStorageConfigured = GDPR_EXPORT_STORAGE_ENV_KEYS.some((key) => Boolean(importValues?.get(key)?.trim()));
|
|
const resources = fullMode || dedicatedMode || workerStorageConfigured ? [...webResources, ["worker-import", importValues]] : webResources;
|
|
const normalizedStorage = [];
|
|
for (const [label, values] of resources) {
|
|
const missing = GDPR_EXPORT_STORAGE_ENV_KEYS.filter((key) => !values?.get(key)?.trim());
|
|
if (missing.length > 0) {
|
|
fail(`Coolify ${label} runtime is missing required encrypted GDPR export environment keys: ${missing.join(", ")}`);
|
|
}
|
|
const endpoint = normalizeHttpsStorageEndpoint(values.get("STORAGE_ENDPOINT"));
|
|
if (!endpoint) {
|
|
fail(`Coolify ${label} runtime must set STORAGE_ENDPOINT to a valid HTTPS URL for encrypted GDPR exports`);
|
|
}
|
|
if (!isCanonicalBase64Key(values.get("GDPR_EXPORT_SSE_C_KEY_BASE64"))) {
|
|
fail(`Coolify ${label} runtime must set GDPR_EXPORT_SSE_C_KEY_BASE64 to canonical base64 for exactly 32 bytes`);
|
|
}
|
|
const forcePathStyle = normalizeStorageForcePathStyle(values.get("STORAGE_FORCE_PATH_STYLE"));
|
|
if (!forcePathStyle) {
|
|
fail(`Coolify ${label} runtime must set STORAGE_FORCE_PATH_STYLE to true or false when configured`);
|
|
}
|
|
normalizedStorage.push({
|
|
label,
|
|
STORAGE_ENDPOINT: endpoint,
|
|
STORAGE_REGION: values.get("STORAGE_REGION").toLowerCase(),
|
|
STORAGE_BUCKET: values.get("STORAGE_BUCKET").toLowerCase(),
|
|
STORAGE_ACCESS_KEY_ID: values.get("STORAGE_ACCESS_KEY_ID"),
|
|
STORAGE_FORCE_PATH_STYLE: forcePathStyle,
|
|
GDPR_EXPORT_SSE_C_KEY_BASE64: values.get("GDPR_EXPORT_SSE_C_KEY_BASE64"),
|
|
});
|
|
}
|
|
|
|
const equalityKeys = ["STORAGE_ENDPOINT", "STORAGE_REGION", "STORAGE_BUCKET", "STORAGE_FORCE_PATH_STYLE", "GDPR_EXPORT_SSE_C_KEY_BASE64"];
|
|
const mismatched = equalityKeys.filter((key) => new Set(normalizedStorage.map((storage) => storage[key])).size !== 1);
|
|
if (mismatched.length > 0) {
|
|
fail(`Coolify encrypted GDPR export runtime values must match after normalization for: ${mismatched.join(", ")}`);
|
|
}
|
|
|
|
if (generalValues?.get("EXPORT_RETENTION_QUEUE_ENABLED") !== "true") {
|
|
fail("Coolify worker-general must set EXPORT_RETENTION_QUEUE_ENABLED=true for automatic GDPR export hard-delete");
|
|
}
|
|
if (generalValues?.get("GDPR_EXPORT_SSE_C_KEY_BASE64")?.trim()) {
|
|
fail("Coolify worker-general must not contain GDPR_EXPORT_SSE_C_KEY_BASE64 because it is delete-only");
|
|
}
|
|
const missingRetentionStorage = GDPR_EXPORT_RETENTION_STORAGE_ENV_KEYS.filter((key) => !generalValues?.get(key)?.trim());
|
|
if (missingRetentionStorage.length > 0) {
|
|
fail(`Coolify worker-general runtime is missing required GDPR export-retention environment keys: ${missingRetentionStorage.join(", ")}`);
|
|
}
|
|
const retentionEndpoint = normalizeHttpsStorageEndpoint(generalValues.get("STORAGE_ENDPOINT"));
|
|
if (!retentionEndpoint) {
|
|
fail("Coolify worker-general runtime must set STORAGE_ENDPOINT to a valid HTTPS URL for GDPR export retention");
|
|
}
|
|
const retentionForcePathStyle = normalizeStorageForcePathStyle(generalValues.get("STORAGE_FORCE_PATH_STYLE"));
|
|
if (!retentionForcePathStyle) {
|
|
fail("Coolify worker-general runtime must set STORAGE_FORCE_PATH_STYLE to true or false when configured");
|
|
}
|
|
const retentionStorage = {
|
|
label: "worker-general",
|
|
STORAGE_ENDPOINT: retentionEndpoint,
|
|
STORAGE_REGION: generalValues.get("STORAGE_REGION").toLowerCase(),
|
|
STORAGE_BUCKET: generalValues.get("STORAGE_BUCKET").toLowerCase(),
|
|
STORAGE_ACCESS_KEY_ID: generalValues.get("STORAGE_ACCESS_KEY_ID"),
|
|
STORAGE_FORCE_PATH_STYLE: retentionForcePathStyle,
|
|
};
|
|
const writerStorage = normalizedStorage[0];
|
|
const retentionMismatched = ["STORAGE_ENDPOINT", "STORAGE_REGION", "STORAGE_BUCKET", "STORAGE_FORCE_PATH_STYLE"].filter(
|
|
(key) => retentionStorage[key] !== writerStorage[key]
|
|
);
|
|
if (retentionMismatched.length > 0) {
|
|
fail(`Coolify GDPR export-retention storage values must match the writer/readers after normalization for: ${retentionMismatched.join(", ")}`);
|
|
}
|
|
}
|
|
|
|
function isValidVapidSubject(subject) {
|
|
if (subject.length > 320 || /[\u0000-\u001F\u007F]/.test(subject)) return false;
|
|
if (subject.startsWith("mailto:")) {
|
|
return /^mailto:[^\s@]+@[^\s@]+\.[^\s@]+$/i.test(subject);
|
|
}
|
|
|
|
try {
|
|
const url = new URL(subject);
|
|
return url.protocol === "https:" && Boolean(url.hostname) && !url.username && !url.password && !url.hash;
|
|
} catch {
|
|
return false;
|
|
}
|
|
}
|
|
|
|
function isCanonicalBase64Url(value, expectedBytes, expectedFirstByte) {
|
|
if (!SAFE_BASE64URL_PATTERN.test(value)) return false;
|
|
try {
|
|
const decoded = Buffer.from(value, "base64url");
|
|
return decoded.length === expectedBytes && decoded.toString("base64url") === value && (expectedFirstByte === undefined || decoded[0] === expectedFirstByte);
|
|
} catch {
|
|
return false;
|
|
}
|
|
}
|
|
|
|
function assertWebPushEntries(webEntries, workerEntries) {
|
|
const webValues = new Map(webEntries.map((entry) => [envKey(entry), normalizeEnvValue(entry)]));
|
|
const workerValues = new Map(workerEntries.map((entry) => [envKey(entry), normalizeEnvValue(entry)]));
|
|
const webPublicKey = webValues.get("WEB_PUSH_VAPID_PUBLIC_KEY") || "";
|
|
const missingWorkerKeys = WEB_PUSH_VAPID_WORKER_ENV_KEYS.filter((key) => !workerValues.get(key));
|
|
|
|
if (!webPublicKey) {
|
|
fail("Coolify web runtime is missing WEB_PUSH_VAPID_PUBLIC_KEY");
|
|
}
|
|
if (missingWorkerKeys.length > 0) {
|
|
fail(`Coolify webhook-worker runtime is missing required Web Push environment keys: ${missingWorkerKeys.join(", ")}`);
|
|
}
|
|
|
|
const workerSubject = workerValues.get("WEB_PUSH_VAPID_SUBJECT") || "";
|
|
const workerPublicKey = workerValues.get("WEB_PUSH_VAPID_PUBLIC_KEY") || "";
|
|
const workerPrivateKey = workerValues.get("WEB_PUSH_VAPID_PRIVATE_KEY") || "";
|
|
const invalidKeys = [];
|
|
if (!isValidVapidSubject(workerSubject)) invalidKeys.push("WEB_PUSH_VAPID_SUBJECT");
|
|
if (!isCanonicalBase64Url(webPublicKey, 65, 0x04)) invalidKeys.push("WEB_PUSH_VAPID_PUBLIC_KEY (web)");
|
|
if (!isCanonicalBase64Url(workerPublicKey, 65, 0x04)) invalidKeys.push("WEB_PUSH_VAPID_PUBLIC_KEY (webhook-worker)");
|
|
if (!isCanonicalBase64Url(workerPrivateKey, 32)) invalidKeys.push("WEB_PUSH_VAPID_PRIVATE_KEY");
|
|
if (invalidKeys.length > 0) {
|
|
fail(`Coolify Web Push runtime configuration is invalid for: ${invalidKeys.join(", ")}`);
|
|
}
|
|
if (webPublicKey !== workerPublicKey) {
|
|
fail("Coolify web and webhook-worker WEB_PUSH_VAPID_PUBLIC_KEY values must match");
|
|
}
|
|
}
|
|
|
|
async function assertWebPushEnv(webResourceUuid, webhookWorkerResourceUuid) {
|
|
if (!webResourceUuid || !webhookWorkerResourceUuid) {
|
|
fail("Web and webhook-worker Coolify resource UUIDs are required");
|
|
}
|
|
requireCoolifyCuid(webResourceUuid, "Web Coolify resource UUID");
|
|
requireCoolifyCuid(webhookWorkerResourceUuid, "Webhook-worker Coolify resource UUID");
|
|
|
|
const [webEntries, workerEntries] = await Promise.all([
|
|
readApplicationEnvs(webResourceUuid).then(runtimeEnvEntries),
|
|
readApplicationEnvs(webhookWorkerResourceUuid).then(runtimeEnvEntries),
|
|
]);
|
|
assertWebPushEntries(webEntries, workerEntries);
|
|
|
|
process.stdout.write("Web Push runtime environment verified\n");
|
|
}
|
|
|
|
async function trigger(resourceUuid) {
|
|
if (!resourceUuid) {
|
|
fail("Coolify resource UUID is required");
|
|
}
|
|
requireCoolifyCuid(resourceUuid, "Coolify resource UUID");
|
|
const payload = await coolify(`/deploy?uuid=${encodeURIComponent(resourceUuid)}&force=true`, {
|
|
method: "POST",
|
|
});
|
|
const uuid = deploymentUuid(payload, resourceUuid);
|
|
if (!uuid) {
|
|
fail("Coolify deployment UUID was not returned by the deploy request");
|
|
}
|
|
process.stdout.write(uuid);
|
|
}
|
|
|
|
function normalizeCoolifyBoolean(value) {
|
|
return value === true || value === "true" || value === 1 || value === "1"
|
|
? "true"
|
|
: value === false || value === "false" || value === 0 || value === "0"
|
|
? "false"
|
|
: "";
|
|
}
|
|
|
|
function normalizeCoolifyValue(value) {
|
|
return value === null || value === undefined ? "" : String(value).trim();
|
|
}
|
|
|
|
function normalizeEnvValue(entry) {
|
|
let value = envValue(entry).trim();
|
|
while (value.length >= 2 && ((value.startsWith("'") && value.endsWith("'")) || (value.startsWith('"') && value.endsWith('"')))) {
|
|
value = value.slice(1, -1).trim();
|
|
}
|
|
return value;
|
|
}
|
|
|
|
function desiredMcpHealthConfig(expectedRevision) {
|
|
return {
|
|
docker_registry_image_tag: expectedRevision,
|
|
health_check_enabled: true,
|
|
health_check_type: "cmd",
|
|
health_check_command: `node apps/mcp/dist/deploy-health.js ${expectedRevision}`,
|
|
health_check_interval: 30,
|
|
health_check_timeout: 10,
|
|
health_check_retries: 3,
|
|
health_check_start_period: 20,
|
|
};
|
|
}
|
|
|
|
function mcpHealthConfigDrift(app, expectedRevision) {
|
|
const desired = desiredMcpHealthConfig(expectedRevision);
|
|
const expected = { ...desired, health_check_enabled: "true", custom_healthcheck_found: "false" };
|
|
const actual = {
|
|
docker_registry_image_tag: normalizeCoolifyValue(app?.docker_registry_image_tag),
|
|
health_check_enabled: normalizeCoolifyBoolean(app?.health_check_enabled),
|
|
health_check_type: normalizeCoolifyValue(app?.health_check_type),
|
|
health_check_command: normalizeCoolifyValue(app?.health_check_command),
|
|
health_check_interval: Number(app?.health_check_interval),
|
|
health_check_timeout: Number(app?.health_check_timeout),
|
|
health_check_retries: Number(app?.health_check_retries),
|
|
health_check_start_period: Number(app?.health_check_start_period),
|
|
custom_healthcheck_found: normalizeCoolifyBoolean(app?.custom_healthcheck_found),
|
|
};
|
|
return Object.keys(expected).filter((key) => actual[key] !== expected[key]);
|
|
}
|
|
|
|
function expectedRuntimeImageName(target, envName) {
|
|
const configured = normalizeCoolifyValue(process.env[envName]).replace(/\/+$/, "");
|
|
if (configured) return configured;
|
|
const registry = normalizeCoolifyValue(process.env.REGISTRY).replace(/\/+$/, "");
|
|
const namespace = normalizeCoolifyValue(process.env.IMAGE_NAMESPACE).replace(/^\/+|\/+$/g, "");
|
|
const prefix = normalizeCoolifyValue(process.env.IMAGE_PREFIX).replace(/^\/+|\/+$/g, "");
|
|
return registry && namespace && prefix ? `${registry}/${namespace}/${prefix}/${target}` : "";
|
|
}
|
|
|
|
function expectedMcpImageName() {
|
|
return expectedRuntimeImageName("mcp", "MCP_IMAGE");
|
|
}
|
|
|
|
function expectedWorkerImageName() {
|
|
return expectedRuntimeImageName("worker", "WORKER_IMAGE");
|
|
}
|
|
|
|
function isExpectedMcpImage(app) {
|
|
const actual = normalizeCoolifyValue(app?.docker_registry_image_name).replace(/\/+$/, "");
|
|
const expected = expectedMcpImageName();
|
|
return Boolean(expected) && actual === expected;
|
|
}
|
|
|
|
async function configureMcpHealthcheck(resourceUuid, expectedRevision) {
|
|
if (!resourceUuid) {
|
|
fail("Coolify resource UUID is required");
|
|
}
|
|
requireCoolifyCuid(resourceUuid, "Coolify resource UUID");
|
|
if (!FULL_GIT_SHA_PATTERN.test(expectedRevision)) {
|
|
fail("MCP deployment health requires a full lowercase Git SHA");
|
|
}
|
|
|
|
const resourcePath = `/applications/${encodeURIComponent(resourceUuid)}`;
|
|
const envPayload = await readApplicationEnvs(resourceUuid);
|
|
const envs = runtimeEnvEntries(envPayload);
|
|
if (envs.some((entry) => envKey(entry) === "APP_REVISION")) {
|
|
fail("Coolify MCP APP_REVISION override must be removed before deployment");
|
|
}
|
|
const current = await coolify(resourcePath);
|
|
if (!isExpectedMcpImage(current)) {
|
|
fail("Coolify MCP health configuration target does not use the expected MCP image");
|
|
}
|
|
if (normalizeCoolifyBoolean(current?.custom_healthcheck_found) !== "false") {
|
|
fail("Coolify MCP image healthcheck must be absent so command health can be authoritative");
|
|
}
|
|
if (mcpHealthConfigDrift(current, expectedRevision).length === 0) {
|
|
process.stdout.write("MCP deployment health already configured\n");
|
|
return;
|
|
}
|
|
|
|
await coolify(resourcePath, {
|
|
method: "PATCH",
|
|
body: JSON.stringify(desiredMcpHealthConfig(expectedRevision)),
|
|
});
|
|
const updated = await coolify(resourcePath);
|
|
if (mcpHealthConfigDrift(updated, expectedRevision).length > 0) {
|
|
fail("Coolify MCP deployment health configuration was not persisted");
|
|
}
|
|
process.stdout.write("MCP deployment health configured\n");
|
|
}
|
|
|
|
function legacyRollbackHealthConfigDrift(app, expectedRevision) {
|
|
const actual = {
|
|
docker_registry_image_tag: normalizeCoolifyValue(app?.docker_registry_image_tag),
|
|
health_check_enabled: normalizeCoolifyBoolean(app?.health_check_enabled),
|
|
health_check_command: normalizeCoolifyValue(app?.health_check_command),
|
|
};
|
|
const expected = {
|
|
docker_registry_image_tag: expectedRevision,
|
|
health_check_enabled: "false",
|
|
health_check_command: "",
|
|
};
|
|
return Object.keys(expected).filter((key) => actual[key] !== expected[key]);
|
|
}
|
|
|
|
function legacyRollbackResourceKind(app) {
|
|
const image = normalizeCoolifyValue(app?.docker_registry_image_name).replace(/\/+$/, "");
|
|
const expectedWorkerImage = expectedWorkerImageName();
|
|
const expectedMcpImage = expectedMcpImageName();
|
|
if (expectedWorkerImage && expectedWorkerImage !== expectedMcpImage && image === expectedWorkerImage) return "worker";
|
|
if (expectedMcpImage && expectedMcpImage !== expectedWorkerImage && image === expectedMcpImage) return "mcp";
|
|
return "";
|
|
}
|
|
|
|
async function configureLegacyRollbackHealthcheck(resourceUuid, expectedRevision, expectedWorkerGroup = "") {
|
|
if (!resourceUuid) {
|
|
fail("Coolify resource UUID is required");
|
|
}
|
|
requireCoolifyCuid(resourceUuid, "Coolify resource UUID");
|
|
if (!FULL_GIT_SHA_PATTERN.test(expectedRevision)) {
|
|
fail("Legacy rollback health configuration requires a full lowercase Git SHA");
|
|
}
|
|
if (expectedWorkerGroup && !WORKER_GROUPS.has(expectedWorkerGroup)) {
|
|
fail("Legacy rollback health configuration requires a valid worker group");
|
|
}
|
|
|
|
const resourcePath = `/applications/${encodeURIComponent(resourceUuid)}`;
|
|
const envPayload = await readApplicationEnvs(resourceUuid);
|
|
const envs = runtimeEnvEntries(envPayload);
|
|
if (envs.some((entry) => envKey(entry) === "APP_REVISION")) {
|
|
fail("Coolify APP_REVISION override must be removed before legacy rollback");
|
|
}
|
|
const current = await coolify(resourcePath);
|
|
const resourceKind = legacyRollbackResourceKind(current);
|
|
if (!resourceKind) {
|
|
fail("Legacy rollback health configuration is restricted to MCP and worker resources");
|
|
}
|
|
if (resourceKind === "worker" && !expectedWorkerGroup) {
|
|
fail("Legacy worker rollback requires the exact worker group");
|
|
}
|
|
if (resourceKind === "mcp" && expectedWorkerGroup) {
|
|
fail("Legacy MCP rollback must not include a worker group");
|
|
}
|
|
if (resourceKind === "worker") {
|
|
const groupEntry = envs.find((entry) => envKey(entry) === "WORKER_QUEUE_GROUP");
|
|
if (!groupEntry || normalizeEnvValue(groupEntry) !== expectedWorkerGroup) {
|
|
fail("Coolify worker group does not match the legacy rollback target");
|
|
}
|
|
}
|
|
|
|
await coolify(resourcePath, {
|
|
method: "PATCH",
|
|
body: JSON.stringify({
|
|
docker_registry_image_tag: expectedRevision,
|
|
health_check_enabled: false,
|
|
health_check_command: "",
|
|
}),
|
|
});
|
|
const updated = await coolify(resourcePath);
|
|
if (legacyRollbackHealthConfigDrift(updated, expectedRevision).length > 0) {
|
|
fail("Coolify legacy rollback health configuration was not persisted");
|
|
}
|
|
process.stdout.write("Legacy rollback image health configured\n");
|
|
}
|
|
|
|
function envKey(entry) {
|
|
return typeof entry?.key === "string" ? entry.key : "";
|
|
}
|
|
|
|
function envValue(entry) {
|
|
const value = entry?.value ?? entry?.real_value;
|
|
return typeof value === "string" ? value : "";
|
|
}
|
|
|
|
async function setEnvs(resourceUuid, pairs) {
|
|
if (!resourceUuid) {
|
|
fail("Coolify resource UUID is required");
|
|
}
|
|
requireCoolifyCuid(resourceUuid, "Coolify resource UUID");
|
|
if (pairs.length === 0) {
|
|
fail("At least one KEY=VALUE pair is required");
|
|
}
|
|
const parsed = pairs.map((pair) => {
|
|
const separator = pair.indexOf("=");
|
|
if (separator <= 0) {
|
|
fail(`Invalid KEY=VALUE pair: ${pair}`);
|
|
}
|
|
return [pair.slice(0, separator), pair.slice(separator + 1)];
|
|
});
|
|
|
|
const existingPayload = await readApplicationEnvs(resourceUuid);
|
|
const existing = runtimeEnvEntries(existingPayload);
|
|
const byKey = new Map(existing.map((entry) => [envKey(entry), entry]).filter(([key]) => key));
|
|
|
|
for (const [key, value] of parsed) {
|
|
const current = byKey.get(key);
|
|
if (current && envValue(current) === value) {
|
|
process.stdout.write(`env ${key} unchanged\n`);
|
|
continue;
|
|
}
|
|
await coolify(`/applications/${encodeURIComponent(resourceUuid)}/envs`, {
|
|
method: current ? "PATCH" : "POST",
|
|
body: JSON.stringify({
|
|
key,
|
|
value,
|
|
is_literal: true,
|
|
is_preview: false,
|
|
is_multiline: false,
|
|
is_shown_once: false,
|
|
}),
|
|
});
|
|
process.stdout.write(`env ${key} ${current ? "updated" : "created"}\n`);
|
|
}
|
|
}
|
|
|
|
async function waitForDeployment(uuid, label) {
|
|
if (!uuid) {
|
|
fail("Coolify deployment UUID is required");
|
|
}
|
|
requireCoolifyCuid(uuid, "Coolify deployment UUID");
|
|
for (let attempt = 1; attempt <= attempts; attempt += 1) {
|
|
const payload = await coolify(`/deployments/${encodeURIComponent(uuid)}`);
|
|
const status = deploymentStatus(payload);
|
|
process.stdout.write(`${label} deployment status: ${status}\n`);
|
|
if (["finished", "success", "succeeded", "completed", "done"].includes(status)) {
|
|
return;
|
|
}
|
|
if (["failed", "error", "cancelled", "canceled", "cancelled-by-user"].includes(status)) {
|
|
fail(`${label} deployment failed`);
|
|
}
|
|
await new Promise((resolve) => setTimeout(resolve, delayMs));
|
|
}
|
|
fail(`${label} deployment did not finish in time`);
|
|
}
|
|
|
|
try {
|
|
if (command === "trigger") {
|
|
await trigger(args[0] || "");
|
|
} else if (command === "wait") {
|
|
await waitForDeployment(args[0] || "", args[1] || "Coolify");
|
|
} else if (command === "set-envs") {
|
|
await setEnvs(args[0] || "", args.slice(1));
|
|
} else if (command === "resolve-web-surfaces") {
|
|
await resolveWebSurfaces(args[0] || "", args[1] || "");
|
|
} else if (command === "set-web-surface-release") {
|
|
await setWebSurfaceRelease(args[0] || "", args[1] || "", args[2] || "", args[3] || "", args[4] || "", args[5] || "");
|
|
} else if (command === "assert-web-surface-release") {
|
|
await assertWebSurfaceRelease(
|
|
args[0] || "",
|
|
args[1] || "",
|
|
args[2] || "",
|
|
args[3] || "",
|
|
args[4] || "",
|
|
args[5] || "",
|
|
args[6] || "",
|
|
args[7] || "",
|
|
args[8] || ""
|
|
);
|
|
} else if (command === "validate-required-images") {
|
|
await validateRequiredImages(args[0] || "", args.slice(1));
|
|
} else if (command === "assert-no-app-revision-override") {
|
|
await assertNoAppRevisionOverride(args[0] || "");
|
|
} else if (command === "assert-runtime-db-env") {
|
|
await assertRuntimeDatabaseEnv(args[0] || "", args[1] || "", args[2] || "");
|
|
} else if (command === "assert-runtime-preflight") {
|
|
await assertRuntimePreflight(args[0] || "", args[1] || "", args[2] || "", args[3] || "", args[4] || "", args[5] || "");
|
|
} else if (command === "assert-web-push-env") {
|
|
await assertWebPushEnv(args[0] || "", args[1] || "");
|
|
} else if (command === "configure-mcp-healthcheck") {
|
|
await configureMcpHealthcheck(args[0] || "", args[1] || "");
|
|
} else if (command === "configure-legacy-rollback-healthcheck") {
|
|
await configureLegacyRollbackHealthcheck(args[0] || "", args[1] || "", args[2] || "");
|
|
} else {
|
|
fail(
|
|
"Usage: coolify-deploy.mjs trigger <resource-uuid> | wait <deployment-uuid> <label> | set-envs <resource-uuid> KEY=VALUE... | resolve-web-surfaces <allowed-resource-csv> <web-image> | set-web-surface-release <core-resource-uuid> <admin-resource-uuid> <portal-resource-uuid> <web-image> <full-git-sha> <sha256-digest> | assert-web-surface-release <core-resource-uuid> <admin-resource-uuid> <portal-resource-uuid> <web-image> <full-git-sha> <sha256-digest> <core-deployment-uuid> <admin-deployment-uuid> <portal-deployment-uuid> | validate-required-images <allowed-resource-csv> <expected-image>... | assert-no-app-revision-override <resource-uuid> | assert-runtime-db-env <resource-uuid> <hivegrid_app|hivegrid_worker|hivegrid_portal> <web|admin|portal|service> | assert-runtime-preflight <allowed-resource-csv> <web-image> <api-image> <mcp-image> <hocuspocus-image> <worker-image> | assert-web-push-env <web-resource-uuid> <webhook-worker-resource-uuid> | configure-mcp-healthcheck <resource-uuid> <full-git-sha> | configure-legacy-rollback-healthcheck <resource-uuid> <full-git-sha> [worker-group]"
|
|
);
|
|
}
|
|
} catch (error) {
|
|
process.stderr.write(`${error instanceof Error ? error.message : "Coolify deploy helper failed"}\n`);
|
|
process.exitCode = 1;
|
|
}
|