Documentation
¶
Overview ¶
Package platformimport reads apps from another self-hosted platform (read-only) into a neutral model and maps it to this platform's resources. The source credential is used in memory only.
Index ¶
- Constants
- Variables
- func CheckCompose(body string) (volumes, blocked []string)
- func CleanSourceCommand(field, cmd string, values ...string) (string, error)
- func CleanSourcePath(field, p string) (string, error)
- func CommandHasSecret(cmd string) bool
- func DisplayRepoURL(raw string) (string, bool)
- func EnvironmentKey(project, name string) string
- func FileLooksSecret(p string, content []byte) bool
- func HostAccessBlocked(body string) []string
- func ImportCommandMax() int
- func ImportComposeMax() int
- func LooksSecret(key string) bool
- func NormalizeSchedule(s string) string
- func ParseDBVersions(raw string) (map[string]string, error)
- func ParseNodeMap(raw string) (map[string]string, error)
- func ParseSourceTags(raw json.RawMessage) []string
- func ResolveNodeMap(m map[string]string, nodes []NodeRef) (map[string]string, error)
- func SanitizeJobName(s string) string
- func SanitizeName(s string) string
- func ValidateDestinationEndpoint(ctx context.Context, raw string, p NetworkPolicy) error
- func ValidateNotifyEndpoint(ctx context.Context, raw string, p NetworkPolicy) error
- func ValidateVercelTeam(s string) (string, error)
- func ValueLooksSecret(v string) bool
- type APIError
- type App
- type AppFile
- type AppPlan
- type Applier
- type BackupDestination
- type BackupSchedule
- type BuildSettings
- type CapRoverSource
- type ClientOptions
- type ComposeApp
- type ComposeSource
- type CoolifySource
- type Cron
- type CronPlan
- type Database
- type DatabasePlan
- type Discovery
- type DockerSSHSource
- type DockerSource
- type DokkuEnvSource
- type DokployPolicies
- type DokployPort
- type DokployRedirect
- type DokploySecurity
- type DokploySource
- func (s *DokploySource) DestinationCredentials(ctx context.Context, sourceID string) (accessKey, secretKey string, err error)
- func (s *DokploySource) Discover(ctx context.Context) (*Discovery, error)
- func (s *DokploySource) NotificationTarget(ctx context.Context, sourceID string) (NotifyTarget, error)
- type DokployTranslation
- type DomainPolicy
- type EmitApp
- type EmitConnection
- type EmitDatabase
- type EmitFile
- type EmitInput
- type EmitJob
- type EmitOptions
- type EmitSecret
- type Env
- type EnvironmentApplier
- type EnvironmentPlan
- type HealthCheck
- type HealthPlan
- type HerokuSource
- type IngressPlan
- type IngressSource
- type InspectReader
- type Item
- type NetworkPolicy
- type NodeRef
- type Note
- type NotificationProvider
- type NotifyTarget
- type Plan
- type PlanOptions
- type Platform
- type RenderSource
- type Report
- type Server
- type Service
- type Source
- type SourceEnvironment
- type SourceKind
- type Unsupported
- type VercelSource
- type Volume
- type VolumePlan
Constants ¶
const ( EmitStackFile = "stack.yaml" EmitProjectFile = "project.yaml" EmitDatabasesFile = "databases.yaml" EmitAppsFile = "apps.yaml" EmitDomainsFile = "domains.yaml" EmitSecretsFile = "SECRETS.md" EmitNotesFile = "MIGRATION.md" )
Emitted file names, stable so a migration PR diffs cleanly.
const ( AllowPrivateEnv = "APP_IMPORT_ALLOW_PRIVATE_NETWORKS" AllowLoopbackEnv = "APP_IMPORT_ALLOW_LOOPBACK" )
Environment variables that must be set before a request may opt in to private or loopback source addresses. Both the env var and the request field are required, so a leaked API token alone cannot aim the control plane at the internal network.
const ( MaxLabelBytesEnv = "APP_IMPORT_MAX_LABEL_BYTES" MaxRegexInstsEnv = "APP_IMPORT_MAX_REGEX_INSTS" MaxRedirectURLLenEnv = "APP_IMPORT_MAX_REDIRECT_URL_LEN" OpaqueValueMinEnv = "APP_IMPORT_OPAQUE_VALUE_MIN_LEN" )
Environment variables that cap how much untrusted proxy label input the importer reads.
const ( LabelSourceID = "import/source-id" LabelSourcePlatform = "import/source-platform" LabelSourceName = "import/source-name" // LabelSession ties a staged app to the guided import session that created it. LabelSession = "import/session" )
Labels stamped on every imported resource. The source-id label is what makes a re-run idempotent and lets an operator find imports to delete.
const ( StatusMapped = "mapped" StatusNeedsAttention = "needs-attention" StatusUnsupported = "unsupported" StatusAlready = "already-imported" StatusSkipped = "skipped" StatusCreated = "created" StatusFailed = "failed" )
Item statuses in a Report.
const ( CollisionSuffix = "suffix" CollisionSkip = "skip" )
Collision modes for a target name that is already taken.
const ( ComposeReady = "ready" ComposeBlocked = "blocked" )
Compose app verdicts.
const ConnectionHint = "database connection string, created empty here: set it after the database exists, or run databases link"
ConnectionHint is the SECRETS.md note for a variable that carries a database connection string.
const DataNote = "" /* 171-byte string literal not displayed */
DataNote is added to every report that contains databases.
const DefaultHerokuURL = "https://api.heroku.com"
DefaultHerokuURL is the public Heroku Platform API.
const DefaultRenderURL = "https://api.render.com/v1"
DefaultRenderURL is the public Render REST API.
const DefaultVercelURL = "https://api.vercel.com"
DefaultVercelURL is the public Vercel REST API.
const ImportCommandMaxEnv = "APP_IMPORT_COMMAND_MAX"
ImportCommandMaxEnv overrides the longest build or deploy command an import carries over.
const ImportComposeMaxEnv = "APP_IMPORT_COMPOSE_MAX_BYTES"
ImportComposeMaxEnv overrides the largest compose file an import accepts, in bytes.
const ImportValueMatchMinEnv = "APP_IMPORT_VALUE_MATCH_MIN"
ImportValueMatchMinEnv overrides the shortest fetched env value that a command is checked for.
const (
// MaxPages bounds every paginated or fan-out walk.
MaxPages = 200
)
const SecretMask = "********"
SecretMask replaces a secret value stored in a Service.
Variables ¶
var ErrBlockedAddress = errors.New("platformimport: source address is not allowed")
ErrBlockedAddress is returned when the source URL resolves to an address the network policy forbids.
var ErrNoCredentials = errors.New("the source returned no usable credentials for this destination")
ErrNoCredentials means the source did not hand over usable keys for a destination.
var ErrNoNotificationSecret = errors.New("the source returned no usable credentials for this notification provider")
ErrNoNotificationSecret means the source did not hand over a usable token or URL for a provider.
var NodePinKeys = []string{"NIXPACKS_NODE_VERSION", "NODE_VERSION"}
NodePinKeys are the variables the source build packs read to pin the Node version.
Functions ¶
func CheckCompose ¶
CheckCompose parses and validates an untrusted compose body. It returns the named volumes it declares and one reason per rule it breaks; no file or network is read.
func CleanSourceCommand ¶
CleanSourceCommand validates one source command: single line, within ImportCommandMax, no inline secret and none of the fetched env values. The error never quotes the command.
func CleanSourcePath ¶
CleanSourcePath turns a source path such as "/apps/web" into a repository relative one. A traversal, absolute drive path or control character is rejected, never rewritten.
func CommandHasSecret ¶
CommandHasSecret reports whether a command carries a credential inline: a secret-looking variable or flag, -p<value>, URL userinfo or an auth header, so it is never copied into a spec or printed.
func DisplayRepoURL ¶
DisplayRepoURL returns raw without userinfo, secret query values or fragment, and whether anything was removed. An unparseable URL form yields "" so the original is never echoed.
func EnvironmentKey ¶
EnvironmentKey is the identity of a project environment in plans and reports.
func FileLooksSecret ¶
FileLooksSecret reports whether a file name or its content suggests a credential.
func HostAccessBlocked ¶
HostAccessBlocked enforces the compose host-access rules even on a file the full parser rejects, so a privileged service or socket mount is never staged as ready.
func ImportCommandMax ¶
func ImportCommandMax() int
ImportCommandMax returns the command length cap, from ImportCommandMaxEnv when it is a positive integer.
func ImportComposeMax ¶
func ImportComposeMax() int
ImportComposeMax returns the compose size cap, from ImportComposeMaxEnv when it is a positive integer.
func LooksSecret ¶
LooksSecret reports whether an env var name suggests a secret value.
func NormalizeSchedule ¶
NormalizeSchedule expands the named frequencies a source accepts into a cron expression.
func ParseDBVersions ¶
ParseDBVersions reads "postgres=16,redis=7" into an engine to version map.
func ParseNodeMap ¶
ParseNodeMap reads a "source-server=node,other=node" flag value into a server to node map.
func ParseSourceTags ¶
func ParseSourceTags(raw json.RawMessage) []string
ParseSourceTags reads a tag list given either as strings or as objects with a name.
func ResolveNodeMap ¶
ResolveNodeMap swaps each mapped node name for its ID from the real node list, refusing any name the cluster does not have, so nothing is applied with a bad placement.
func SanitizeJobName ¶
SanitizeJobName turns a source task name into a valid scheduled job name.
func SanitizeName ¶
SanitizeName turns a source name into a valid resource name.
func ValidateDestinationEndpoint ¶
func ValidateDestinationEndpoint(ctx context.Context, raw string, p NetworkPolicy) error
ValidateDestinationEndpoint applies the import network policy to an object-storage endpoint: https only, no credentials in the URL, and no blocked address behind the host.
func ValidateNotifyEndpoint ¶
func ValidateNotifyEndpoint(ctx context.Context, raw string, p NetworkPolicy) error
ValidateNotifyEndpoint applies the import network policy to a webhook or provider URL. Errors never echo the URL, since the path or query may carry a token.
func ValidateVercelTeam ¶
ValidateVercelTeam trims and checks a team id or slug before it reaches a query string.
func ValueLooksSecret ¶
ValueLooksSecret reports whether a value embeds URL credentials, such as amqp://u:p@host.
Types ¶
type App ¶
type App struct {
SourceID string
Name string
Project string
Environment string
// Server names the source host the app runs on, empty when unreported.
Server string
// BuildPack is the source's own build method name, unmapped.
BuildPack string
// PrivateRepo is true when the source needs credentials to clone.
PrivateRepo bool
Kind SourceKind
Image string
// ImageID is the source host's local image ID, set by snapshot sources.
ImageID string
// SourceContainer is the running container's ID on the source host, set by live Docker sources.
SourceContainer string
// HostBuilt marks an image built on the source host and absent from any registry.
HostBuilt bool
GitURL string
GitBranch string
BuildMethod string
BuildPath string
Port int
Env []Env
Domains []string
Volumes []Volume
Replicas int
Health *HealthCheck
Crons []Cron
MemoryBytes int64
NanoCPUs int64
// Policy carries the source's proxy flags. Never a credential or hash.
Policy DomainPolicy
// Build is how the source builds and deploys the app, validated and secret free.
Build BuildSettings
// Files are config file mounts copied byte for byte from the source.
Files []AppFile
// Ingress is basic auth, redirects and header rules translated from the source proxy settings.
Ingress *IngressPlan
// Previews is true when the source ran preview deployments for the app.
Previews bool
// NetworkPeers names the other resources that shared a custom network with the app.
NetworkPeers []string
Notes []Note
}
App is one application in the neutral model.
type AppFile ¶
type AppFile struct {
Path string `json:"path"`
Content []byte `json:"-"`
Secret bool `json:"secret,omitempty"`
}
AppFile is a config file mounted into an app. Content is never serialized; a secret file goes through the encrypted secret store when it is created.
type AppPlan ¶
type AppPlan struct {
SourceID string `json:"source_id"`
SourceName string `json:"source_name"`
Name string `json:"name"`
Image string `json:"image"`
Port int `json:"port"`
Env map[string]string `json:"env,omitempty"`
Secrets map[string]string `json:"-"`
Domains []string `json:"domains,omitempty"`
Volumes []VolumePlan `json:"volumes,omitempty"`
Replicas int `json:"replicas"`
Health *HealthPlan `json:"health,omitempty"`
MemoryBytes int64 `json:"memory_bytes,omitempty"`
NanoCPUs int64 `json:"nano_cpus,omitempty"`
Labels map[string]string `json:"labels"`
Project string `json:"project,omitempty"`
Environment string `json:"environment,omitempty"`
GitURL string `json:"git_url,omitempty"`
GitBranch string `json:"git_branch,omitempty"`
BuildMethod string `json:"build_method,omitempty"`
BuildPath string `json:"build_path,omitempty"`
Crons []CronPlan `json:"crons,omitempty"`
Policy DomainPolicy `json:"-"`
// UnreadSecrets names secret variables the source would not reveal.
UnreadSecrets []string `json:"-"`
}
AppPlan is one app create request. Secrets holds plaintext and is never serialized.
type Applier ¶
type Applier interface {
CreateApp(ctx context.Context, p AppPlan) (warnings []string, err error)
CreateDatabase(ctx context.Context, p DatabasePlan) (warnings []string, err error)
}
Applier creates resources on this platform. Implementations must be safe to call again after a partial failure.
type BackupDestination ¶
type BackupDestination struct {
SourceID string
Name string
Provider string
Endpoint string
Region string
Bucket string
// HasCredentials is false when the source returned no keys or masked ones.
HasCredentials bool
}
BackupDestination is an object-storage target read from the source. It never holds the access keys: those are read only at apply time through DestinationCredentials.
type BackupSchedule ¶
type BackupSchedule struct {
Schedule string
Enabled bool
// Remote is true when the source also uploads the backup to S3.
Remote bool
// SourceID, DestinationID and KeepLatest are set by sources that bind a schedule to a destination.
SourceID string
DestinationID string
KeepLatest int
}
BackupSchedule is one scheduled database backup on the source.
type BuildSettings ¶
type BuildSettings struct {
BaseDirectory string
DockerfilePath string
InstallCommand string
BuildCommand string
StartCommand string
PublishDir string
PreDeploy string
PostDeploy string
// BuildTimeKeys names the variables the source only exposes during the build.
BuildTimeKeys []string
}
BuildSettings carries the source's build and deploy settings so a staged app builds the same way. Paths are repository relative; a command that holds a secret-looking value is never kept here.
type CapRoverSource ¶
type CapRoverSource struct {
// contains filtered or unexported fields
}
CapRoverSource reads a CapRover instance. The login POST is the only non-GET call it makes.
func NewCapRover ¶
func NewCapRover(baseURL, password string, o ClientOptions) (*CapRoverSource, error)
NewCapRover builds a CapRover source. The password is exchanged for a session token in memory and never stored.
type ClientOptions ¶
type ClientOptions struct {
Policy NetworkPolicy
Insecure bool
// Team scopes a Vercel source to one team id or slug, other platforms reject it.
Team string
}
ClientOptions configure the source HTTP client.
type ComposeApp ¶
type ComposeApp struct {
SourceID string `json:"source_id"`
Name string `json:"name"`
Project string `json:"project,omitempty"`
Environment string `json:"environment,omitempty"`
Compose string `json:"-"`
Env []Env `json:"-"`
Domains []string `json:"domains,omitempty"`
Volumes []string `json:"volumes,omitempty"`
Verdict string `json:"verdict"`
Blocked []string `json:"blocked,omitempty"`
Notes []Note `json:"notes,omitempty"`
}
ComposeApp is a multi-service stack imported as one compose app. Compose is the source text and may hold inline values, so it is never serialized; Env carries the secret flag per key.
func NewComposeApp ¶
func NewComposeApp(sourceID, name, project, body string, env []Env, domains []string) ComposeApp
NewComposeApp checks body with the same validation a manual compose deploy runs and sets the verdict, so an imported stack is never more permissive than a pasted one.
func (ComposeApp) SplitEnv ¶
func (c ComposeApp) SplitEnv() (plain, secrets map[string]string)
SplitEnv returns the plain values and the secret values of the stack env, never mixed.
type ComposeSource ¶
type ComposeSource struct {
Data []byte
}
ComposeSource maps a plain compose file, one app per service.
type CoolifySource ¶
type CoolifySource struct {
// contains filtered or unexported fields
}
CoolifySource reads a Coolify instance through its bearer-token API v1.
func NewCoolify ¶
func NewCoolify(baseURL, token string, o ClientOptions) (*CoolifySource, error)
NewCoolify builds a Coolify source. The token is kept in memory only.
type CronPlan ¶
type CronPlan struct {
Name string `json:"name"`
Schedule string `json:"schedule"`
Command string `json:"command"`
}
CronPlan is a scheduled command that becomes a scheduled job on the new app.
type Database ¶
type Database struct {
SourceID string
Name string
Project string
Engine string
Version string
// Environment and InternalHost are set by sources that give each
// database an in-network hostname apps connect to.
Environment string
InternalHost string
// Server, User, DBName, Public and PublicPort describe how the source
// exposes the database. No credential is ever read here.
Server string
User string
DBName string
Public bool
PublicPort int
Backups []BackupSchedule
}
Database is a managed database in the source platform.
type DatabasePlan ¶
type DatabasePlan struct {
SourceID string `json:"source_id"`
SourceName string `json:"source_name"`
Name string `json:"name"`
Engine string `json:"engine"`
Version string `json:"version"`
Project string `json:"project,omitempty"`
Environment string `json:"environment,omitempty"`
}
DatabasePlan is one managed database create request (empty, no data).
type Discovery ¶
type Discovery struct {
Platform Platform
Projects []string
// Environments lists every source environment, including empty ones.
Environments []SourceEnvironment
Apps []App
Databases []Database
Unsupported []Unsupported
// Services holds each one-click service's masked compose body and env.
Services []Service
// ComposeApps are multi-service stacks imported as compose apps.
ComposeApps []ComposeApp
Servers []Server
// Destinations are object-storage backup targets, read without their keys.
Destinations []BackupDestination
// Notifications are alert providers, read without their tokens or webhook URLs.
Notifications []NotificationProvider
// Warnings are source reads that failed softly, so the plan lacks that detail.
Warnings []string
}
Discovery is everything read from a source.
type DockerSSHSource ¶
type DockerSSHSource struct {
Reader InspectReader
}
DockerSSHSource reads a host's containers through a read-only Docker socket tunnel and maps them like a pasted docker inspect snapshot. Env comes from each container's runtime config; the old platform's own stored config (Coolify's database, CapRover's /captain/data, Dokku's /home/dokku) is not read.
type DockerSource ¶
type DockerSource struct {
Data []byte
}
DockerSource maps a `docker inspect` snapshot of every container on a host into the neutral model. It is read-only and needs no credential for the platform that launched the containers, so it works when only the Docker host is reachable (no Coolify token, no Dokploy key).
type DokkuEnvSource ¶
DokkuEnvSource maps one Dokku app from a `dokku config:export` style dump (KEY=VALUE lines). It never contacts a Dokku host.
type DokployPolicies ¶
type DokployPolicies struct {
Redirects []DokployRedirect
Security []DokploySecurity
Ports []DokployPort
PreDeploy string
PostDeploy string
}
DokployPolicies carries the proxy rules, extra ports and deploy commands of one application.
type DokployPort ¶
type DokployPort struct {
Published int `json:"publishedPort"`
Target int `json:"targetPort"`
Protocol string `json:"protocol"`
}
DokployPort is one extra published port of a Dokploy application.
type DokployRedirect ¶
type DokployRedirect struct {
Regex string `json:"regex"`
Replacement string `json:"replacement"`
Permanent bool `json:"permanent"`
}
DokployRedirect is one redirect rule of a Dokploy application.
type DokploySecurity ¶
type DokploySecurity struct {
Username string `json:"username"`
}
DokploySecurity is one basic-auth user. The password field is left undeclared so a hash or secret from the source API can never reach the model, a log or a report.
type DokploySource ¶
type DokploySource struct {
// contains filtered or unexported fields
}
DokploySource reads a Dokploy instance through its x-api-key API.
func NewDokploy ¶
func NewDokploy(baseURL, apiKey string, o ClientOptions) (*DokploySource, error)
NewDokploy builds a Dokploy source. The API key is kept in memory only.
func (*DokploySource) DestinationCredentials ¶
func (s *DokploySource) DestinationCredentials(ctx context.Context, sourceID string) (accessKey, secretKey string, err error)
DestinationCredentials re-reads one destination's keys for an apply run. Callers pass them straight to the target's create call and keep them out of every report and log.
func (*DokploySource) Discover ¶
func (s *DokploySource) Discover(ctx context.Context) (*Discovery, error)
Discover lists projects (which embed their resources) and reads each app.
func (*DokploySource) NotificationTarget ¶
func (s *DokploySource) NotificationTarget(ctx context.Context, sourceID string) (NotifyTarget, error)
NotificationTarget re-reads one provider for an apply run. Callers compare Kind and Server with the plan and pass URL straight to the channel create call, never to a log.
type DokployTranslation ¶
type DokployTranslation struct {
Ingress *IngressPlan
PreDeploy, PostDeploy string
Notes []Note
}
DokployTranslation is the result of TranslateDokployPolicies.
func TranslateDokployPolicies ¶
func TranslateDokployPolicies(p DokployPolicies, firstDomain string, values []string) DokployTranslation
TranslateDokployPolicies maps redirects, basic auth, extra ports and deploy commands. Values are the app's env values, so a command that embeds one is dropped instead of copied.
type DomainPolicy ¶
DomainPolicy is the neutral form of per-app proxy flags. Basic auth keeps only the user name: the source hash is never read into the model.
func (DomainPolicy) Empty ¶
func (p DomainPolicy) Empty() bool
Empty reports whether the source set no proxy flag.
type EmitApp ¶
type EmitApp struct {
Name string
// Project and Environment override the stack-wide ones when set.
Project string
Environment string
// Image is the prebuilt image. Empty means use EmitOptions.ImageRepo.
Image string
Port int
Replicas int
Env map[string]string
Secrets []EmitSecret
Domains []string
MemoryBytes int64
// Memory is a ready "512Mi" string and wins over MemoryBytes.
Memory string
NanoCPUs int64
HealthPath string
// HealthExec, when set, emits an exec probe instead of the HTTP path.
HealthExec []string
HealthInterval int
HealthTimeout int
HealthRetries int
Command []string
PreDeploy string
PostDeploy string
// Connections maps an env var to the emitted database it reads from.
Connections map[string]EmitConnection
Jobs []EmitJob
// Policy lists proxy flags for the domain steps in MIGRATION.md.
Policy DomainPolicy
// Notes are follow-ups for MIGRATION.md that the documents cannot express.
Notes []string
}
EmitApp is one app to write as a kind: App document.
type EmitConnection ¶
EmitConnection is a { from: { database, field } } env reference.
type EmitDatabase ¶
EmitDatabase is one kind: Database document.
type EmitInput ¶
type EmitInput struct {
// Source names where the data came from, for the checklist header.
Source string
Apps []EmitApp
Databases []EmitDatabase
// Notes are source-wide follow-ups for MIGRATION.md.
Notes []string
// Environments are extra project environments to declare.
Environments []SourceEnvironment
}
EmitInput is everything an emit needs, from any source adapter.
type EmitJob ¶
type EmitJob struct {
Name string
Schedule string
Command []string
// Mode is "exec" to run in the app's running container; empty means a fresh one.
Mode string
Timezone string
}
EmitJob is one scheduled job of an App document.
type EmitOptions ¶
type EmitOptions struct {
Stack string
Project string
Environment string
// ImageRepo prefixes the image of an app that has none, as REPO/APP:latest.
ImageRepo string
}
EmitOptions name the stack and fill what the source does not know.
type EmitSecret ¶
EmitSecret is a secret the emitted documents reference by name. The value is never held here.
type Env ¶
type Env struct {
Key string
Value string
Secret bool
// BuildTime marks a variable the source only exposes during the image build.
BuildTime bool
}
Env is one environment variable. Secret is true when the source marked it secret or the key looks like one.
type EnvironmentApplier ¶
type EnvironmentApplier interface {
CreateEnvironment(ctx context.Context, p EnvironmentPlan) (warnings []string, err error)
}
EnvironmentApplier is implemented by an Applier that can create project environments. Appliers without it keep the old single-environment behavior.
type EnvironmentPlan ¶
type EnvironmentPlan struct {
SourceID string `json:"source_id"`
Project string `json:"project"`
Name string `json:"name"`
}
EnvironmentPlan is one project environment to create before its apps.
type HealthCheck ¶
type HealthCheck struct {
Path string
Exec []string
IntervalSeconds int
TimeoutSeconds int
Retries int
}
HealthCheck is an HTTP probe, or an exec probe when Exec is set.
type HealthPlan ¶
type HealthPlan struct {
Path string
Exec []string
IntervalSeconds int
TimeoutSeconds int
Failures int
}
HealthPlan is an HTTP readiness probe, or an exec probe when Exec is set.
type HerokuSource ¶
type HerokuSource struct {
// contains filtered or unexported fields
}
HerokuSource reads a Heroku account through the Platform API, GET only.
func NewHeroku ¶
func NewHeroku(baseURL, token string, o ClientOptions) (*HerokuSource, error)
NewHeroku builds a Heroku source. The API token is kept in memory only. An empty baseURL means the public API.
type IngressPlan ¶
type IngressPlan struct {
// BasicAuth gates every domain with a placeholder credential the operator replaces.
BasicAuth bool `json:"basic_auth,omitempty"`
// Canonical is a www redirect preset (www-to-apex or apex-to-www).
Canonical string `json:"canonical,omitempty"`
ForceHTTPS bool `json:"force_https,omitempty"`
Forwarders []trafficpolicy.Forwarder `json:"forwarders,omitempty"`
Headers []trafficpolicy.HeaderRule `json:"headers,omitempty"`
// Manual lists label keys and settings with no translation, each with a reason; values are never kept.
Manual []Note `json:"manual,omitempty"`
}
IngressPlan is the ingress settings translated from a source app's proxy settings. It never holds a credential: basic auth is a flag, and a header with a secret-looking name or value is left manual.
func TranslateIngress ¶
func TranslateIngress(src IngressSource, getenv func(string) string) IngressPlan
TranslateIngress turns basic auth, the www rule and common proxy label middleware into ingress settings. Every value is untrusted, so each rule passes the domain policy validators or stays manual.
func (IngressPlan) Translated ¶
func (p IngressPlan) Translated() bool
Translated reports whether the plan carries any setting to apply.
type IngressSource ¶
type IngressSource struct {
Labels string
BasicAuth bool
// Redirect is the source's www rule: www, non-www or both.
Redirect string
// App is the target app name a strip-prefix rule forwards back to.
App string
// Domain is the first domain, used as the validation context.
Domain string
}
IngressSource is the proxy configuration read from one source app.
type InspectReader ¶
InspectReader returns the inspect JSON of every container on a host as one array.
type Item ¶
type Item struct {
Kind string `json:"kind"`
SourceID string `json:"source_id"`
SourceName string `json:"source_name"`
Target string `json:"target,omitempty"`
Status string `json:"status"`
Reasons []string `json:"reasons,omitempty"`
Manual []string `json:"manual,omitempty"`
}
Item is one report row.
type NetworkPolicy ¶
NetworkPolicy decides which destinations the source client may dial. Cloud metadata and link-local addresses are never allowed.
type Note ¶
type Note struct {
// Area groups notes in the exit report, such as "webhook" or "command". Empty means general.
Area string
Reason string
Manual string
}
Note is a per-item caveat found while reading the source.
type NotificationProvider ¶
type NotificationProvider struct {
SourceID string
Name string
// Kind is the source's provider type, lowercased.
Kind string
// Server is the non-secret base URL of a self-hosted provider (gotify, ntfy).
Server string
// Recipient is the email address for an email provider; it is not a credential.
Recipient string
// ExtraRecipients counts email addresses beyond the first.
ExtraRecipients int
// HasSecret is false when the source returned no usable token or masked one.
HasSecret bool
// HasHeaders is true for a custom webhook that sends extra headers, which do not carry over.
HasHeaders bool
// HasAccessToken is true for an ntfy provider protected by a token.
HasAccessToken bool
// Mismatch is true when the sub-object named by the kind is missing.
Mismatch bool
}
NotificationProvider is one alert provider read from the source. It never holds a token, webhook URL or password: those are read only at apply time through NotificationTarget.
type NotifyTarget ¶
NotifyTarget is a provider's notify_url plus the non-secret parts an apply run compares with its plan. URL is a secret and never leaves the apply call.
type Plan ¶
type Plan struct {
Environments []EnvironmentPlan
Apps []AppPlan
Databases []DatabasePlan
Report Report
}
Plan is the mapped result of a Discovery.
func BuildPlan ¶
func BuildPlan(d *Discovery, o PlanOptions) *Plan
BuildPlan maps a Discovery onto create requests and a Report.
type PlanOptions ¶
type PlanOptions struct {
// Only restricts the plan to these source ids or source names. Empty means all.
Only []string
// Collision is CollisionSuffix (default) or CollisionSkip.
Collision string
// ExistingApps maps an import label value (platform:sourceID) to the
// app already created for it. TakenApps is every app name in use.
ExistingApps map[string]string
TakenApps map[string]bool
// ExistingDatabases maps a database name to "engine:version".
ExistingDatabases map[string]string
// ExistingEnvironments holds "project/environment" keys that already exist.
ExistingEnvironments map[string]bool
// DBVersions is the engine version the user chose per engine, and
// LatestDBVersions the newest catalog version per engine. Both fill in
// databases whose source reports no version.
DBVersions map[string]string
LatestDBVersions map[string]string
}
PlanOptions steer mapping.
type Platform ¶
type Platform string
Platform identifies a supported source.
const ( Coolify Platform = "coolify" Dokploy Platform = "dokploy" CapRover Platform = "caprover" Heroku Platform = "heroku" Vercel Platform = "vercel" Render Platform = "render" Compose Platform = "compose" Dokku Platform = "dokku" // Docker is a docker inspect snapshot of one host, no platform API. Docker Platform = "docker" // DockerSSH reads one host's Docker socket through an SSH login, no platform API. DockerSSH Platform = "docker-ssh" )
Supported source platforms.
func ParsePlatform ¶
ParsePlatform validates a platform name: a live source or a pasted file.
type RenderSource ¶
type RenderSource struct {
// contains filtered or unexported fields
}
RenderSource reads a Render workspace through the REST API, GET only.
func NewRender ¶
func NewRender(baseURL, token string, o ClientOptions) (*RenderSource, error)
NewRender builds a Render source. The API key is kept in memory only. An empty baseURL means the public API.
type Report ¶
type Report struct {
Platform Platform `json:"platform"`
Items []Item `json:"items"`
Counts map[string]int `json:"counts"`
Notes []string `json:"notes,omitempty"`
}
Report is the per-item outcome of a discover, plan or apply.
type Server ¶
type Server struct {
Name string
Address string
// Proxy names the reverse proxy the source runs there, empty when none.
Proxy string
// BuildServer is true when the source uses the host only to build images.
BuildServer bool
Reachable bool
}
Server is a host the source platform deploys to.
type Service ¶
type Service struct {
SourceID string
Name string
Project string
Environment string
Server string
Type string
Compose string
Env []Env
}
Service is a one-click service stack read from the source. Compose is the stack's compose body with inline secret values masked; Env values of secret keys are masked too. Both are empty when the source read failed softly.
type SourceEnvironment ¶
SourceEnvironment is one environment of a source project.
type SourceKind ¶
type SourceKind string
SourceKind says where an app's code comes from.
const ( SourceImage SourceKind = "image" SourceGit SourceKind = "git" SourceUnknown SourceKind = "unknown" )
Where an app comes from.
type Unsupported ¶
type Unsupported struct {
Kind string
SourceID string
Name string
Reason string
Manual string
// Context the source reported about the unsupported item, for display.
Project string
Environment string
Server string
Source string
Domains []string
Port int
}
Unsupported is something that cannot be imported.
type VercelSource ¶
type VercelSource struct {
// TeamID scopes every call to a team, empty means the token's personal account.
TeamID string
// contains filtered or unexported fields
}
VercelSource reads a Vercel account or team through the REST API, GET only.
func NewVercel ¶
func NewVercel(baseURL, token string, o ClientOptions) (*VercelSource, error)
NewVercel builds a Vercel source. The API token is kept in memory only. An empty baseURL means the public API.
func (*VercelSource) Discover ¶
func (s *VercelSource) Discover(ctx context.Context) (*Discovery, error)
Discover lists projects, then reads env keys and domains for each.
func (*VercelSource) WithTeam ¶
func (s *VercelSource) WithTeam(id string) *VercelSource
WithTeam scopes the source to one team id (team_...).
Source Files
¶
Directories
¶
| Path | Synopsis |
|---|---|
|
Package dokployextras plans and applies the parts of a Dokploy import that are not apps: S3 backup destinations, database backup schedules and alert channels.
|
Package dokployextras plans and applies the parts of a Dokploy import that are not apps: S3 backup destinations, database backup schedules and alert channels. |
|
Package fakecoolify is a read-only stand-in for the Coolify v4 REST API, shaped from the documented responses the importer consumes.
|
Package fakecoolify is a read-only stand-in for the Coolify v4 REST API, shaped from the documented responses the importer consumes. |
|
cmd/fakecoolify
command
Command fakecoolify serves the read-only fake Coolify API for local runs of the app import flow.
|
Command fakecoolify serves the read-only fake Coolify API for local runs of the app import flow. |
|
Package fakeheroku is a read-only stand-in for the Heroku Platform API, shaped from the documented responses the importer consumes.
|
Package fakeheroku is a read-only stand-in for the Heroku Platform API, shaped from the documented responses the importer consumes. |
|
Package fakerender is a read-only stand-in for the Render REST API, shaped from the documented responses the importer consumes.
|
Package fakerender is a read-only stand-in for the Render REST API, shaped from the documented responses the importer consumes. |
|
Package fakevercel is a read-only stand-in for the Vercel REST API, shaped from the documented responses the importer consumes.
|
Package fakevercel is a read-only stand-in for the Vercel REST API, shaped from the documented responses the importer consumes. |