Bugs fixes - #45
Merged
Merged
Conversation
- Add `apps/agent` for remote deployment orchestration - Implement agent-server P2P protocol with heartbeat, job leasing, and task execution - Add WireGuard tunneling support for agent-to-server connectivity - Extend API to support agent registration, job queuing, and status sync - Update UI to allow selecting deployment targets for projects - Add database migrations for agent foundations, credentials, and job state management
failover - Implement `prepare` service for remote SSH and Agent server setup. - Add `failoverProject` logic to automatically redeploy projects when servers become unreachable. - Introduce `routes` database table and ingress routing management. - Add `platform_settings` table to track ingress server configuration. - Update Docker Compose to support configurable profiles (default: control-plane).
Update Caddy and database utilities to accept dependencies via options, enabling synchronous file system access and easier mocking in tests.
…rch-scaling-eng # Conflicts: # .gitignore # apps/agent/src/config.ts # apps/agent/src/executor.test.ts # apps/agent/src/executor.ts # apps/agent/src/protocol.ts # apps/agent/src/stats.ts # apps/api/src/agents/deployments.ts # apps/api/src/agents/job-channel.ts # apps/api/src/agents/protocol.ts # apps/api/src/agents/stats-cache.ts # apps/api/src/api/deployments/index.ts # apps/api/src/api/projects/index.ts # apps/api/src/api/servers/index.ts # apps/api/src/db/migrations/meta/_journal.json # apps/api/src/db/repo/servers.ts # apps/api/src/db/schema.ts # apps/api/src/executors/__tests__/dispatch.test.ts # apps/api/src/executors/agent.ts # apps/api/src/executors/ssh.ts # apps/api/src/orchestrator/runtime.ts # apps/api/src/servers/manager.ts # apps/web/src/routes/Settings.tsx # apps/web/src/types/index.ts
- Update Drizzle configuration and schema to PostgreSQL - Replace `bun:sqlite` with `pg` and `drizzle-orm/node-postgres` - Update migrations to use PostgreSQL syntax - Reorganize test infrastructure to support Postgres pools - Update configuration to use `DATABASE_URL` instead of `DATABASE_PATH`
- Replace SQLite with PostgreSQL - Introduce `deployment_events` table for tracking - Add event repository - Update migration runner to handle existing tables - Update docker-compose and test configurations
external runners Move complex database-dependent tests to standalone runners to ensure proper environment setup, and update repository and orchestrator logic to support required operations.
improve stability - Introduce `docker_tcp` server mode - Add timeout configurations for SSH and API operations - Enhance WireGuard tunnel recovery logic - Improve agent registration error handling and stats validation - Update server preparation and scaling engine for better compatibility
update release pipeline - Introduce standardized `ApiResponse` type and helper functions (`ok`, `created`, `fail`) - Update API routes to use new response wrappers - Update CI workflow to support pre-release tagging and image naming - Enhance CLI `update` and `install` scripts to support pre-release versions
- Add `.env.example` for better configuration management - Enhance database security with generated passwords and improved URL handling - Update `rerenderAllIngressRoutes` to prevent unnecessary route syncing - Fix race conditions in `AgentStatsCache` and `domains-status-runner` - Improve database connection management in tests and migrations - Add `isPrivateGitUrl` utility for improved security validation
…and database provisioning issues
- Fix secure cookie blocking HTTP login (derive from X-Forwarded-Proto) - Add getCaddyContainer function for Caddy reload - Add missing DB migration for ssh_key/ssh_password columns - Document E2E test findings
- Added 5s AbortController timeout to request-logs Loki fetch to prevent infinite loading - Changed LogsTab default from 'request' to 'runtime' since request logs require Loki
The monitoring stack (Loki, Promtail, Grafana, Prometheus, cAdvisor) is required for request logs to work. Profiles added complexity and broke features silently when the default excluded monitoring. - Remove profiles: ['monitoring'] from cadvisor, prometheus, loki, promtail, grafana - Remove profile logic from dequel CLI and install.sh - Update docs to reflect simplified setup - All services now start with 'dequel start' or 'docker compose up -d'
- Textarea for pasting PEM private key content - Key shown in server table as [key] indicator - API already supports sshKey field, UI was missing it
- Add ssh_key_iv and ssh_key_tag columns to servers table - Encrypt sshKey with AES-256-GCM before storing in database - Decrypt on read in mapServer and listServerConnections - Uses existing encryptValue/decryptValue from crypto.ts - Migration: 0003_add_server_ssh_key_encryption.sql
…start - dequel update vX.Y.Z-rc.N | --rc | --pre | --pre-release targets - pull images before recreating only api/web (deployed apps untouched) - graceful caddy reload applies new Caddyfile without dropped traffic - health check after update with rollback hint
Remove hardcoded default email and update base domain handling to support flexible deployment environments.
# Conflicts: # apps/agent/src/executor.ts
- New ssh-compose-script.ts: bash script generator, result parser, destroy script - SSH executor now checks buildType and branches to compose path - Full ingress routing: worker Caddy gets :80 listener, control plane gets hostname route - Compose-aware destroy and rollback rejection
Worker Caddy only exposes port 80 via Docker. Hostname-only routes
(open-saas-openship.intrep.xyz { }) default to HTTPS (port 443) which
is unreachable. Append :80 to all domains in each route block when
viaIngress is true, so Caddy creates a single HTTP server that can
match on hostname. This fixes multi-project routing on workers where
Superteam's catch-all :80 route was winning over hostname-specific
routes.
Also moved ingress detection before snippet generation for cleaner
control flow.
Add BUILD_TIME build arg and scope cache per image per commit. This prevents stale layer reuse when only source files change between tag pushes.
Previously, deployComposeRemote() only created one ingress route on the
control plane Caddy for the primary hostname. Subdomains like
api.{slug}.{domain} had Caddy blocks on the worker but no matching
route on the control plane, so external traffic to those subdomains
never reached the worker.
- Add computeComposeIngressHostnames() to compute all ingress hostnames
for a compose stack (primary + subdomains), excluding DB services
- Add syncComposeIngressRoutes() and removeComposeIngressRoutes() to
manage per-subdomain route files on the control plane
- Add listRoutesByDeployment() query for cleanup
- Modify deployComposeRemote() to create routes for all subdomains
- Modify destroy() to clean up all subdomain route files from both
worker and control plane
Non-primary services without custom mappings (e.g. 'server' when no composeServicesJson is configured) were excluded from webServices, causing computeComposeIngressHostnames to only see the primary service and produce no subdomain routes.
…routes
The remote compose script now outputs port mappings via
docker compose ps --format '{{.Service}}|{{.Name}}|{{.Ports}}'.
parseRemoteComposeResult extracts the host port from each service.
The webServices array now uses these parsed ports for Caddy reverse
proxy configuration, ensuring routes point to the correct container
port (e.g. server:3001 instead of server:3000).
The regex now captures group 2 (container port) instead of group 1 (host port) from docker compose ps port output like '0.0.0.0:32793->3001/tcp'. Caddy runs on the same Docker network and needs the container-internal port to connect.
- buildCaddySnippet now falls back to slug.baseDomain if defaultDomains is empty, preventing catch-all :80 blocks - deployComposeRemote adds a safety check: if the generated snippet starts with ':' (empty domain), it rebuilds with slug.baseDomain - Fixes superteam catch-all :80 overriding specific hostname routes
modularize settings page
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Team Run ID: 📒 Files selected for processing (38)
Disabled knowledge base sources:
📝 WalkthroughWalkthroughThe release becomes stable and adds scoped image builds. The API adds encrypted GitHub session storage and remote Docker Compose deployment. The web adds settings management screens. Ingress and Caddy configuration now support Compose services and reject bare port domains. ChangesRelease and deployment platform
Estimated code review effort: 5 (Critical) | ~90+ minutes Sequence Diagram(s)sequenceDiagram
participant SSHExecutor
participant RemoteHost
participant DockerCompose
participant RouteStore
SSHExecutor->>RemoteHost: Run generated Compose script
RemoteHost->>DockerCompose: Build and start deployment
DockerCompose-->>RemoteHost: Return containers and ports
RemoteHost-->>SSHExecutor: Return parsed Compose result
SSHExecutor->>RouteStore: Upsert service ingress routes
SSHExecutor->>RemoteHost: Write Caddy routes
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
When GitHub OAuth sessions are lost (e.g. API restart), the RepoPicker now shows a 'Connect GitHub' button alongside 'Retry' so users can re-authenticate without manually navigating to the OAuth URL. Also passes onConnectGithub from SourceSelectionSection to RepoPicker.
Replace in-memory file-based GitHub sessions with encrypted DB storage. Sessions survive API container restarts. Uses the same encryptValue/ decryptValue pattern as env vars and SSH keys.
remote ingress routes
Lftobs
marked this pull request as ready for review
September 5, 2026 14:59
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary by CodeRabbit
New Features
Bug Fixes
Release
0.3.0-rc.8to stable version0.3.0.