internal/

directory
v0.8.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 21, 2026 License: Apache-2.0

Directories

Path Synopsis
Package accesspolicy merges per-team session rules into one effective set and answers the questions the API middleware asks on every request.
 Package accesspolicy merges per-team session rules into one effective set and answers the questions the API middleware asks on every request.
Package agent is the transport boundary between reconcile controllers and the node they run on.
 Package agent is the transport boundary between reconcile controllers and the node they run on.
agentpb
Package agentinit renders the files "init" writes into a project: app.yaml, AGENTS.md and .mcp.json.
 Package agentinit renders the files "init" writes into a project: app.yaml, AGENTS.md and .mcp.json.
Package ai implements the BYOK assistant chat: a provider-agnostic turn engine.
 Package ai implements the BYOK assistant chat: a provider-agnostic turn engine.
Package alerting implements threshold rules over internal/telemetry's metrics and logs, and crashloop detection as a built-in rule kind sharing the same evaluate/notify path rather than a separate mechanism.
 Package alerting implements threshold rules over internal/telemetry's metrics and logs, and crashloop detection as a built-in rule kind sharing the same evaluate/notify path rather than a separate mechanism.
Package api implements the HTTP API the web frontend (1.10) and, later, the MCP layer both build on.
 Package api implements the HTTP API the web frontend (1.10) and, later, the MCP layer both build on.
Package apiclient is the one HTTP client implementation for the control plane's versioned API (internal/api, mounted at /api/v1).
 Package apiclient is the one HTTP client implementation for the control plane's versioned API (internal/api, mounted at /api/v1).
Package appimport turns a source platform's application inventory into a reviewed, staged import: per-app verdicts, a hostname mapping with a visible diff, preflight checks and a secret-free receipt.
 Package appimport turns a source platform's application inventory into a reviewed, staged import: per-app verdicts, a hostname mapping with a visible diff, preflight checks and a secret-free receipt.
Package appsleep stops opted-in apps that have had no requests for a while and wakes them on the next request, so idle apps cost no memory or CPU.
 Package appsleep stops opted-in apps that have had no requests for a while and wakes them on the next request, so idle apps cost no memory or CPU.
Package appwizard analyses a git repository through a provider file-tree API and returns pre-filled, evidence-backed suggestions for creating an app.
 Package appwizard analyses a git repository through a provider file-tree API and returns pre-filled, evidence-backed suggestions for creating an app.
Package archive moves cold rows out of the live database into zstd compressed NDJSON bundles in a local directory, and can list, browse, restore and verify them.
 Package archive moves cold rows out of the live database into zstd compressed NDJSON bundles in a local directory, and can list, browse, restore and verify them.
Package attention builds the list of things an operator should look at right now, shared by the CLI and the MCP server.
 Package attention builds the list of things an operator should look at right now, shared by the CLI and the MCP server.
Package authengine hosts the theauth-go library behind a flag.
 Package authengine hosts the theauth-go library behind a flag.
Package autoscale is the deterministic replica autoscaler: a level-triggered controller that turns observed load into a desired replica count.
 Package autoscale is the deterministic replica autoscaler: a level-triggered controller that turns observed load into a desired replica count.
Package backup drives a database backup end to end: dump a managed database container's data, stream it straight to an S3-compatible bucket, and record the attempt in store.BackupHistory.
 Package backup drives a database backup end to end: dump a managed database container's data, stream it straight to an S3-compatible bucket, and record the attempt in store.BackupHistory.
Package bench is an open-loop HTTP load driver with failure-window analysis.
 Package bench is an open-loop HTTP load driver with failure-window analysis.
Package bindaddr resolves the small bind-address vocabulary app services and managed databases use to choose which network interface a published port binds to.
 Package bindaddr resolves the small bind-address vocabulary app services and managed databases use to choose which network interface a published port binds to.
Package bindmount validates a service's bind-mount host path, shared by internal/compose and internal/spec: internal/compose imports internal/spec (a compose service expands into a spec.Service), so neither of those two packages can hold this logic without the other importing it back and cycling.
 Package bindmount validates a service's bind-mount host path, shared by internal/compose and internal/spec: internal/compose imports internal/spec (a compose service expands into a spec.Service), so neither of those two packages can hold this logic without the other importing it back and cycling.
Package bitbucketapp implements OAuth2 and the small slice of Bitbucket Cloud's REST API this control plane needs once connected.
 Package bitbucketapp implements OAuth2 and the small slice of Bitbucket Cloud's REST API this control plane needs once connected.
Package bitbucketserver is a small client for Bitbucket Server and Data Center (REST /rest/api/1.0), authenticated with a personal access token.
 Package bitbucketserver is a small client for Bitbucket Server and Data Center (REST /rest/api/1.0), authenticated with a personal access token.
Package branchdeploy holds the pure rules for branch deploys: which branches qualify and what stable name a branch gets.
 Package branchdeploy holds the pure rules for branch deploys: which branches qualify and what stable name a branch gets.
Package brand provides the branding indirection layer this project requires: no product name is ever hardcoded in source.
 Package brand provides the branding indirection layer this project requires: no product name is ever hardcoded in source.
Package build drives container image builds through BuildKit's Go client (github.com/moby/buildkit/client), never by shelling out to `docker build` or the `docker` CLI, matching the same "no CLI shelling" rule the node communication layer follows.
 Package build drives container image builds through BuildKit's Go client (github.com/moby/buildkit/client), never by shelling out to `docker build` or the `docker` CLI, matching the same "no CLI shelling" rule the node communication layer follows.
Package canary decides when a staged canary release advances, promotes or rolls back, and runs the level-triggered reconciler that applies it.
 Package canary decides when a staged canary release advances, promotes or rolls back, and runs the level-triggered reconciler that applies it.
Package canarypolicy holds the stage schedule, thresholds and env defaults of staged canary releases.
 Package canarypolicy holds the stage schedule, thresholds and env defaults of staged canary releases.
Package catalog holds Levelrail's own curated set of one-click service templates (ADR 015).
 Package catalog holds Levelrail's own curated set of one-click service templates (ADR 015).
Package certflow decides whether a domain is ready for a public certificate, tells operators the truth about the certificate it has, and retries stuck renewals with backoff.
 Package certflow decides whether a domain is ready for a public certificate, tells operators the truth about the certificate it has, and retries stuck renewals with backoff.
Package changelog parses the repo's release-please-maintained CHANGELOG.md into the entries GET /api/v1/changelog and the dashboard's "What's new" panel serve, so release notes keep exactly one source of truth instead of a second, hand-curated copy.
 Package changelog parses the repo's release-please-maintained CHANGELOG.md into the entries GET /api/v1/changelog and the dashboard's "What's new" panel serve, so release notes keep exactly one source of truth instead of a second, hand-curated copy.
Package changes answers "what changed on this app recently" by merging the app event log, deploy attempts and the audit log into one ordered list.
 Package changes answers "what changed on this app recently" by merging the app event log, deploy attempts and the audit log into one ordered list.
Package chaos describes the failure scenarios the platform is measured against and the result record they produce.
 Package chaos describes the failure scenarios the platform is measured against and the result record they produce.
live
Package live runs the chaos scenarios against real local Docker containers that carry a unique name prefix and are always removed afterwards.
 Package live runs the chaos scenarios against real local Docker containers that carry a unique name prefix and are always removed afterwards.
Package cliconsole turns one typed console line into a vetted argv for the platform CLI and runs it as a child process.
 Package cliconsole turns one typed console line into a vetted argv for the platform CLI and runs it as a child process.
Package clitree is the CLI's command tree, shared by its shell completions and the control plane's web CLI console allowlist.
 Package clitree is the CLI's command tree, shared by its shell completions and the control plane's web CLI console allowlist.
Package compliance builds access reviews and signed evidence packs from data the platform already records.
 Package compliance builds access reviews and signed evidence packs from data the platform already records.
Package compose parses a Docker Compose file into Levelrail's own desired-state model, in two shapes depending on the caller.
 Package compose parses a Docker Compose file into Levelrail's own desired-state model, in two shapes depending on the caller.
Package costbudget holds named monthly budgets scoped to a project, tag or app, and the level-triggered state machine that decides which alert thresholds fired and whether the 100 percent action is in force.
 Package costbudget holds named monthly budgets scoped to a project, tag or app, and the level-triggered state machine that decides which alert thresholds fired and whether the 100 percent action is in force.
Package costestimate is a deterministic, pure-Go engine that turns an app's CPU/memory allocation into an ESTIMATED monthly cost under a few generic reference pricing profiles (a plain VM, a managed VM, a metered container PaaS).
 Package costestimate is a deterministic, pure-Go engine that turns an app's CPU/memory allocation into an ESTIMATED monthly cost under a few generic reference pricing profiles (a plain VM, a managed VM, a metered container PaaS).
Package cpbackup manages control plane self-backups: verified SQLite snapshots kept in a directory under the data dir.
 Package cpbackup manages control plane self-backups: verified SQLite snapshots kept in a directory under the data dir.
Package cphealth turns raw control plane measurements into saturation findings with typed fixes.
 Package cphealth turns raw control plane measurements into saturation findings with typed fixes.
Package cutover plans and runs a guided, reversible move of one staged import app: readiness rules, a persisted state machine, DNS undo data.
 Package cutover plans and runs a guided, reversible move of one staged import app: readiness rules, a persisted state machine, DNS undo data.
Package dashboards defines the portable custom dashboard document, its JSON Schema and the starter templates.
 Package dashboards defines the portable custom dashboard document, its JSON Schema and the starter templates.
Package dataexport sends logs, audit events and metrics to destinations an operator already runs.
 Package dataexport sends logs, audit events and metrics to destinations an operator already runs.
Package datamigrate copies live data from a source database into a managed database here, and checks a cutover is safe.
 Package datamigrate copies live data from a source database into a managed database here, and checks a cutover is safe.
Package dbaccess manages database users, temporary credentials and network scope.
 Package dbaccess manages database users, temporary credentials and network scope.
Package dbcatalogbuild builds, validates and signs the database version catalog (databases.v1.json) from upstream registries and endoflife.date.
 Package dbcatalogbuild builds, validates and signs the database version catalog (databases.v1.json) from upstream registries and endoflife.date.
Package dbrotate rotates a managed database's owner password in the engine itself, then switches the stored credential every app reads.
 Package dbrotate rotates a managed database's owner password in the engine itself, then switches the stored credential every app reads.
Package dbupgrade advises on and automates minor and patch upgrades of managed databases: a curated version catalog, per database policies with a maintenance window, and a resumable runner that backs up, upgrades, verifies and reverts.
 Package dbupgrade advises on and automates minor and patch upgrades of managed databases: a curated version catalog, per database policies with a maintenance window, and a resumable runner that backs up, upgrades, verifies and reverts.
Package dbviewer runs read-only (and, when explicitly allowed, write) SQL against a managed database by exec'ing the engine's own client inside its container.
 Package dbviewer runs read-only (and, when explicitly allowed, write) SQL against a managed database by exec'ing the engine's own client inside its container.
Package demo builds and guards the read-only public demo instance: a seeded control plane with no Docker, ingress or agent listeners.
 Package demo builds and guards the read-only public demo instance: a seeded control plane with no Docker, ingress or agent listeners.
Package deploy is the build integration: it connects internal/spec's build declaration to internal/build's BuildKit client, and a successful build's output to internal/store's desired state, closing the loop the application controller (internal/reconcile/ application) reads from on every reconcile.
 Package deploy is the build integration: it connects internal/spec's build declaration to internal/build's BuildKit client, and a successful build's output to internal/store's desired state, closing the loop the application controller (internal/reconcile/ application) reads from on every reconcile.
secretscan
Package secretscan finds credentials committed to a build context or stored as plain environment values, and applies a per-app deploy policy.
 Package secretscan finds credentials committed to a build context or stored as plain environment values, and applies a per-app deploy policy.
Package deploycontext holds the pure rules for deploy contexts: which context a deploy runs in and how env and build settings resolve across the branch override, context and app default layers.
 Package deploycontext holds the pure rules for deploy contexts: which context a deploy runs in and how env and build settings resolve across the branch override, context and app default layers.
Package deploylog is the glue between internal/build.ProgressEvent (the progress callback all three real deploy-attempt trigger paths already thread through internal/deploy.Pipeline.Deploy) and two real consumers: a persisted, replayable row in telemetry.db (internal/telemetry's deploy_logs table) and any currently-connected SSE viewer watching that same attempt live.
 Package deploylog is the glue between internal/build.ProgressEvent (the progress callback all three real deploy-attempt trigger paths already thread through internal/deploy.Pipeline.Deploy) and two real consumers: a persisted, replayable row in telemetry.db (internal/telemetry's deploy_logs table) and any currently-connected SSE viewer watching that same attempt live.
Package deploysafety decides whether a new release may take traffic and whether a live one must be rolled back, and holds the shared reason strings.
 Package deploysafety decides whether a new release may take traffic and whether a live one must be rolled back, and holds the shared reason strings.
Package deploytrace records the step-by-step pipeline of a deploy, build or not, as rows the step stream, the log stream and the CLI all read.
 Package deploytrace records the step-by-step pipeline of a deploy, build or not, as rows the step stream, the log stream and the CLI all read.
Package deployurls keeps an immutable hostname for each recent successful deploy: a retained service that runs that attempt's pinned image and sleeps when idle, so a past deployment can be opened without rolling back.
 Package deployurls keeps an immutable hostname for each recent successful deploy: a retained service that runs that attempt's pinned image and sleeps when idle, so a past deployment can be opened without rolling back.
Package deploywatch pins released images as rollback targets and watches each new release after cutover, rolling it back when it misbehaves.
 Package deploywatch pins released images as rollback targets and watches each new release after cutover, rolling it back when it misbehaves.
Package diagnose is a deterministic, pure-Go pattern matcher over diagnostic signals the platform already collects: deploy attempt status/error, reconcile condition reason strings, crashloop alert state, and recent log lines.
 Package diagnose is a deterministic, pure-Go pattern matcher over diagnostic signals the platform already collects: deploy attempt status/error, reconcile condition reason strings, crashloop alert state, and recent log lines.
Package diskguard watches free space on the volumes the platform writes to, refuses risky operations before they fill a disk and keeps a reserve file so SQLite can still commit when space runs out.
 Package diskguard watches free space on the volumes the platform writes to, refuses risky operations before they fill a disk and keeps a reserve file so SQLite can still commit when space runs out.
Package dnsrecords builds a provider-agnostic DNS record manager from whichever ACME DNS-01 provider a control plane already has credentials for (Cloudflare or Route53), reusing libdns's own interfaces instead of inventing a second one: github.com/libdns/cloudflare and github.com/libdns/route53, both already a dependency via internal/ingress's Caddy DNS-01 wiring, implement them already.
 Package dnsrecords builds a provider-agnostic DNS record manager from whichever ACME DNS-01 provider a control plane already has credentials for (Cloudflare or Route53), reusing libdns's own interfaces instead of inventing a second one: github.com/libdns/cloudflare and github.com/libdns/route53, both already a dependency via internal/ingress's Caddy DNS-01 wiring, implement them already.
Package dnszones manages whole DNS zones at Cloudflare and Route53: zones, their assigned name servers, record sets with routing policies, delegation checks, propagation checks, zone file import and export, and templates.
 Package dnszones manages whole DNS zones at Cloudflare and Route53: zones, their assigned name servers, record sets with routing policies, delegation checks, propagation checks, zone file import and export, and templates.
Package docker wraps the Docker Engine API.
 Package docker wraps the Docker Engine API.
Package dockerguard is an in-process Unix socket proxy in front of the Docker Engine API.
 Package dockerguard is an in-process Unix socket proxy in front of the Docker Engine API.
Package dockerlint checks a Dockerfile for the handful of hints that most often cause production trouble and offers a safe patch where one exists.
 Package dockerlint checks a Dockerfile for the handful of hints that most often cause production trouble and offers a safe patch where one exists.
Package dockerssh reads a remote Docker host over an SSH login without running anything on it: SSH is only a transport to the Docker socket, and a client-side allowlist lets nothing but read-only Engine API GETs out.
 Package dockerssh reads a remote Docker host over an SSH login without running anything on it: SSH is only a transport to the Docker socket, and a client-side allowlist lets nothing but read-only Engine API GETs out.
Package dockertest holds test helpers shared by every package whose _live_test.go files need a real Docker daemon (or other real, network-dependent infra) to run.
 Package dockertest holds test helpers shared by every package whose _live_test.go files need a real Docker daemon (or other real, network-dependent infra) to run.
Package domaindoctor runs an ordered set of read-only checks against one domain (DNS, CAA, ports, TLS, HTTP, redirects, HSTS, platform state) and turns each result into a fix an operator can act on.
 Package domaindoctor runs an ordered set of read-only checks against one domain (DNS, CAA, ports, TLS, HTTP, redirects, HSTS, platform state) and turns each result into a fix an operator can act on.
Package edgefw is the ingress firewall: ordered rules, automatic bans, bot modes, a proof-of-work challenge and bounded in-memory visibility.
 Package edgefw is the ingress firewall: ordered rules, automatic bans, bot modes, a proof-of-work challenge and bounded in-memory visibility.
Package email is the platform's one email-sending capability: a narrow Sender interface plus a registry of providers (SMTP, SES, Resend, Postmark, SendGrid, Mailgun), shared by internal/alerting and internal/api so neither imports the other.
 Package email is the platform's one email-sending capability: a narrow Sender interface plus a registry of providers (SMTP, SES, Resend, Postmark, SendGrid, Mailgun), shared by internal/alerting and internal/api so neither imports the other.
Package envredact decides which environment values are sensitive and masks them for every read surface.
 Package envredact decides which environment values are sensitive and masks them for every read surface.
Package erroringest decodes Sentry SDK payloads into grouped error events.
 Package erroringest decodes Sentry SDK payloads into grouped error events.
Package eventhook delivers platform events to operator-configured HTTPS endpoints: signed, queued, retried with backoff, dead-lettered after the last attempt, and recorded in a delivery log that supports replay.
 Package eventhook delivers platform events to operator-configured HTTPS endpoints: signed, queued, retried with backoff, dead-lettered after the last attempt, and recorded in a delivery log that supports replay.
Package experimental is the single platform gate for features hidden at launch.
 Package experimental is the single platform gate for features hidden at launch.
Package exposure answers "which published container ports can the internet reach" and manages comment-tagged DOCKER-USER rules that restrict them.
 Package exposure answers "which published container ports can the internet reach" and manages comment-tagged DOCKER-USER rules that restrict them.
Package extdb connects to databases this platform does not run: validating their addresses, probing them read-only, and opening them for the viewer through short-lived helper containers.
 Package extdb connects to databases this platform does not run: validating their addresses, probing them read-only, and opening them for the viewer through short-lived helper containers.
Package failure classifies a failed, held or unhealthy deploy into one structured object shared by the API, CLI and MCP surfaces.
 Package failure classifies a failed, held or unhealthy deploy into one structured object shared by the API, CLI and MCP surfaces.
Package fixit turns failing readiness and diagnostic checks into typed, previewable, verifiable fixes with attempt memory and loop protection.
 Package fixit turns failing readiness and diagnostic checks into typed, previewable, verifiable fixes with attempt memory and loop protection.
Package footprint bounds and measures the control plane's idle cost: a default memory limit, a registry of background loops, and process stats.
 Package footprint bounds and measures the control plane's idle cost: a default memory limit, a registry of background loops, and process stats.
Package forms captures HTML form posts for static sites: parsing, spam classification, storage, notification and export.
 Package forms captures HTML form posts for static sites: parsing, spam classification, storage, notification and export.
Package frameworks is the catalog of first-class framework presets: the port, health path, build mode, env hints and volumes a framework needs to deploy with no manual build config.
 Package frameworks is the catalog of first-class framework presets: the port, health path, build mode, env hints and volumes a framework needs to deploy with no manual build config.
Package functions holds the starter handlers for scale-to-zero functions.
 Package functions holds the starter handlers for scale-to-zero functions.
Package ghactions maps a Levelrail deploy outcome onto GitHub deployment statuses and check runs, for the GitHub Actions deploy action.
 Package ghactions maps a Levelrail deploy outcome onto GitHub deployment statuses and check runs, for the GitHub Actions deploy action.
Package giteaapp implements OAuth2 and the small slice of Gitea's REST API this control plane needs once connected.
 Package giteaapp implements OAuth2 and the small slice of Gitea's REST API this control plane needs once connected.
Package githubapp implements the GitHub App manifest registration flow, App-level JWT signing (RS256, per GitHub's own App authentication spec), and the small slice of the GitHub REST API this control plane needs once an App is connected: minting installation access tokens, listing an installation's repositories, and listing a repository's branches.
 Package githubapp implements the GitHub App manifest registration flow, App-level JWT signing (RS256, per GitHub's own App authentication spec), and the small slice of the GitHub REST API this control plane needs once an App is connected: minting installation access tokens, listing an installation's repositories, and listing a repository's branches.
Package gitlabapp implements OAuth2 and the small slice of GitLab's REST API this control plane needs once connected.
 Package gitlabapp implements OAuth2 and the small slice of GitLab's REST API this control plane needs once connected.
Package gitprovider holds the small slice of REST-client plumbing that is genuinely identical across internal/githubapp, internal/gitlabapp, and internal/bitbucketapp: sending a built request and turning its response into either a decoded value or a uniform API error.
 Package gitprovider holds the small slice of REST-client plumbing that is genuinely identical across internal/githubapp, internal/gitlabapp, and internal/bitbucketapp: sending a built request and turning its response into either a decoded value or a uniform API error.
Package golive turns the platform's separate checks (app readiness, ports, host firewall, DNS, certificate, end-to-end HTTPS) into one ordered checklist for an app and a domain, each step with a status, evidence and one primary action.
 Package golive turns the platform's separate checks (app readiness, ports, host firewall, DNS, certificate, end-to-end HTTPS) into one ordered checklist for an app and a domain, each step with a status, evidence and one primary action.
Package gpu detects NVIDIA GPUs on a node by querying nvidia-smi and the Docker daemon's registered runtimes.
 Package gpu detects NVIDIA GPUs on a node by querying nvidia-smi and the Docker daemon's registered runtimes.
Package hostdiag answers a fixed set of read-only host questions for the web CLI console, in process.
 Package hostdiag answers a fixed set of read-only host questions for the web CLI console, in process.
Package hostfw reads the host firewall (ufw, firewalld, nftables, iptables) and opens exactly ports 80 and 443 in it, nothing else.
 Package hostfw reads the host firewall (ufw, firewalld, nftables, iptables) and opens exactly ports 80 and 443 in it, nothing else.
Package hostprovider names the cloud or VPS provider this server runs on, from DMI strings first and a short link-local metadata probe second, and holds the provider-specific steps for opening web ports in a firewall the control plane cannot change.
 Package hostprovider names the cloud or VPS provider this server runs on, from DMI strings first and a short link-local metadata probe second, and holds the provider-specific steps for opening web ports in a firewall the control plane cannot change.
Package iac turns multi-document YAML resource files into a plan of changes against a control plane and applies it through the ordinary REST API, so per-resource authorization applies to every item.
 Package iac turns multi-document YAML resource files into a plan of changes against a control plane and applies it through the ordinary REST API, so per-resource authorization applies to every item.
Package imagelife builds the image inventory of a node, decides which images retention may free, and verifies image signatures.
 Package imagelife builds the image inventory of a node, decides which images retention may free, and verifies image signatures.
Package imagemove streams a host-built image from a source Docker host over SSH into a target node's image store and verifies it by image ID.
 Package imagemove streams a host-built image from a source Docker host over SSH into a target node's image store and verifies it by image ID.
Package imageupdate periodically asks the control plane to check each opted-in app's image tag against its registry and redeploy when it moved.
 Package imageupdate periodically asks the control plane to check each opted-in app's image tag against its registry and redeploy when it moved.
Package importplan classifies an import input (repo URL, docker run command, image reference, compose file or Dockerfile) and builds a side-effect free deployment plan preview from it.
 Package importplan classifies an import input (repo URL, docker run command, image reference, compose file or Dockerfile) and builds a side-effect free deployment plan preview from it.
Package ingress is the Phase 0 spike for embedding Caddy as a Go library, driven entirely through its in-process admin API.
 Package ingress is the Phase 0 spike for embedding Caddy as a Go library, driven entirely through its in-process admin API.
Package integrations holds the curated catalog of third-party tools an app can attach (internal/catalog's deployable-template catalog is unrelated: this is per-app add-ons, not services to deploy).
 Package integrations holds the curated catalog of third-party tools an app can attach (internal/catalog's deployable-template catalog is unrelated: this is per-app add-ons, not services to deploy).
Package integrity checks the control plane SQLite database for corruption and stages a verified snapshot to replace it.
 Package integrity checks the control plane SQLite database for corruption and stages a verified snapshot to replace it.
Package investigate merges the signals that explain a spike (deploys, config changes, restarts, resource saturation) into one ordered timeline.
 Package investigate merges the signals that explain a spike (deploys, config changes, restarts, resource saturation) into one ordered timeline.
Package janitor runs bounded, level-triggered cleanup passes on the control plane's own node: unused Docker data, build cache over budget, orphaned volumes (quarantined first) and old failed deploy attempts.
 Package janitor runs bounded, level-triggered cleanup passes on the control plane's own node: unused Docker data, build cache over budget, orphaned volumes (quarantined first) and old failed deploy attempts.
Package keyreminder sends a scheduled notice when encryption keys are older than the operator's maximum key age policy.
 Package keyreminder sends a scheduled notice when encryption keys are older than the operator's maximum key age policy.
Package loadbalancer is the product-level load balancer model layered on the embedded Caddy reverse_proxy upstream pool (internal/ingress).
 Package loadbalancer is the product-level load balancer model layered on the embedded Caddy reverse_proxy upstream pool (internal/ingress).
lbexport
Package lbexport renders a load balancer config as Terraform, CDK, CloudFormation, Caddyfile or Caddy JSON.
 Package lbexport renders a load balancer config as Terraform, CDK, CloudFormation, Caddyfile or Caddy JSON.
Package localmode holds the pieces shared by the CLI's dev verb and the control plane's local-instance behavior.
 Package localmode holds the pieces shared by the CLI's dev verb and the control plane's local-instance behavior.
Package mailcast sends broadcasts: a queue of per-recipient messages processed in rate-limited batches, resumable after a restart and cancellable while sending.
 Package mailcast sends broadcasts: a queue of per-recipient messages processed in rate-limited batches, resumable after a restart and cancellable while sending.
Package mailgroups defines email audiences: saved rules over platform users plus manual addresses, with a suppression list and signed one-click unsubscribe tokens.
 Package mailgroups defines email audiences: saved rules over platform users plus manual addresses, with a suppression list and signed one-click unsubscribe tokens.
Package mailtemplates renders the platform's emails: a token registry, a {{token}} substitution engine with no code execution, a small safe markup and one shared branded layout around every event template.
 Package mailtemplates renders the platform's emails: a token registry, a {{token}} substitution engine with no code execution, a small safe markup and one shared branded layout around every event template.
Package maintenance holds one-off scheduled maintenance windows: their validation, state, and the lead-time announcement through alert channels.
 Package maintenance holds one-off scheduled maintenance windows: their validation, state, and the lead-time announcement through alert channels.
Package mcptools builds the MCP tool server every levelrail-mcp transport (stdio, network, and the in-process transport an embedded caller like internal/ai uses) shares: one *mcp.Server with every tool registered against the same apiclient.Client.
 Package mcptools builds the MCP tool server every levelrail-mcp transport (stdio, network, and the in-process transport an embedded caller like internal/ai uses) shares: one *mcp.Server with every tool registered against the same apiclient.Client.
Package meshpath answers one question for the ingress and application controllers: can this control plane reach a remote node's published ports over the WireGuard mesh right now, and on which address.
 Package meshpath answers one question for the ingress and application controllers: can this control plane reach a remote node's published ports over the WireGuard mesh right now, and on which address.
Package migrationplan turns a read of another platform into a reviewable plan: a per-item verdict, what would be created, and typed fixes.
 Package migrationplan turns a read of another platform into a reviewable plan: a per-item verdict, what would be created, and typed fixes.
Package models manages AI model resources: an inference engine (Ollama, vLLM, llama.cpp) running as a container on a GPU node, with an OpenAI-compatible endpoint fronted by an API-key gateway.
 Package models manages AI model resources: an inference engine (Ollama, vLLM, llama.cpp) running as a container on a GPU node, with an OpenAI-compatible endpoint fronted by an API-key gateway.
Package network is ADR 006's WireGuard mesh: the abstraction that ADR 006 says "has to be designed in Phase 1 as an interface, not a concrete WireGuard dependency" and that, until now, did not exist at all (the directory the project's repo layout reserves for it was empty).
 Package network is ADR 006's WireGuard mesh: the abstraction that ADR 006 says "has to be designed in Phase 1 as an interface, not a concrete WireGuard dependency" and that, until now, did not exist at all (the directory the project's repo layout reserves for it was empty).
Package nodecapacity judges a node's disk, inode, memory and swap headroom against warn and critical thresholds and groups cleanup candidates by safety class.
 Package nodecapacity judges a node's disk, inode, memory and swap headroom against warn and critical thresholds and groups cleanup candidates by safety class.
Package nodefailure is the opt-in, deterministic policy for nodes that stay unreachable: it reschedules stateless apps, never moves anything holding node-local data, and fences stale copies when the node returns.
 Package nodefailure is the opt-in, deterministic policy for nodes that stay unreachable: it reschedules stateless apps, never moves anything holding node-local data, and fences stale copies when the node returns.
Package nodemove runs persisted, resumable moves of apps and databases between nodes, and node drains built on those moves.
 Package nodemove runs persisted, resumable moves of apps and databases between nodes, and node drains built on those moves.
Package objectstore is the S3-compatible storage layer shared by log archive and other features that write to a connected storage destination.
 Package objectstore is the S3-compatible storage layer shared by log archive and other features that write to a connected storage destination.
objectstoretest
Package objectstoretest is an in-memory, path-style S3 server for tests.
 Package objectstoretest is an in-memory, path-style S3 server for tests.
Package oidc mints short-lived, signed OIDC tokens for pipeline jobs that opt in with `oidc: {audience: ...}`, and publishes the matching JWKS so AWS IAM, GCP workload identity federation, and Vault's JWT auth method can verify them without a long-lived credential ever touching a job.
 Package oidc mints short-lived, signed OIDC tokens for pipeline jobs that opt in with `oidc: {audience: ...}`, and publishes the matching JWKS so AWS IAM, GCP workload identity federation, and Vault's JWT auth method can verify them without a long-lived credential ever touching a job.
Package orphans is the single definition of a leftover container or volume that desired state no longer accounts for.
 Package orphans is the single definition of a leftover container or volume that desired state no longer accounts for.
Package otlpingest decodes OTLP/HTTP trace exports into stored spans.
 Package otlpingest decodes OTLP/HTTP trace exports into stored spans.
Package pipeline is a user-defined CI/CD layer on top of the existing build and deploy primitives.
 Package pipeline is a user-defined CI/CD layer on top of the existing build and deploy primitives.
Package pkgregistry renders private package registry credentials into the tool config files a Dockerfile build reads through BuildKit secret mounts, so a token is never baked into an image layer or a build log.
 Package pkgregistry renders private package registry credentials into the tool config files a Dockerfile build reads through BuildKit secret mounts, so a token is never baked into an image layer or a build log.
Package placement is the multi-node scheduler: label selectors, a fit check against node CPU, memory and disk headroom, then a spread that prefers the most headroom.
 Package placement is the multi-node scheduler: label selectors, a fit check against node CPU, memory and disk headroom, then a spread that prefers the most headroom.
Package platformimport reads apps from another self-hosted platform (read-only) into a neutral model and maps it to this platform's resources.
 Package platformimport reads apps from another self-hosted platform (read-only) into a neutral model and maps it to this platform's resources.
fakecoolify
Package fakecoolify is a read-only stand-in for the Coolify v4 REST API, shaped from the documented responses the importer consumes.
 Package fakecoolify is a read-only stand-in for the Coolify v4 REST API, shaped from the documented responses the importer consumes.
fakecoolify/cmd/fakecoolify command
Command fakecoolify serves the read-only fake Coolify API for local runs of the app import flow.
 Command fakecoolify serves the read-only fake Coolify API for local runs of the app import flow.
Package plugin runs out-of-process extensions behind a signed, digest-pinned package and an operator-approved ability list (ADR 034).
 Package plugin runs out-of-process extensions behind a signed, digest-pinned package and an operator-approved ability list (ADR 034).
pluginpb
Package policy evaluates deploy guardrail rules against what an app is about to run.
 Package policy evaluates deploy guardrail rules against what an app is about to run.
Package preflight runs deterministic pre-deploy checks (DNS, ports, disk, memory, image and git reachability, env, mounts, GPU) and reports pass, warn or fail with a reason and fix hint for each.
 Package preflight runs deterministic pre-deploy checks (DNS, ports, disk, memory, image and git reachability, env, mounts, GPU) and reports pass, warn or fail with a reason and fix hint for each.
Package preview captures a thumbnail of each deployed release with a short-lived browser container and keeps them within bounded storage.
 Package preview captures a thumbnail of each deployed release with a short-lived browser container and keeps them within bounded storage.
Package privnet models VPC-like private networks and security-group style allow rules between apps, and answers which app pairs can talk.
 Package privnet models VPC-like private networks and security-group style allow rules between apps, and answers which app pairs can talk.
Package profile is the server profile: one switch that sets which optional subsystems start.
 Package profile is the server profile: one switch that sets which optional subsystems start.
Package projecttpl renders starter project files (app.yaml and, for the pipeline starter, a pipeline file) from a small set of validated templates.
 Package projecttpl renders starter project files (app.yaml and, for the pipeline starter, a pipeline file) from a small set of validated templates.
Package prompb implements the small subset of Prometheus's remote-read wire protocol needed for a Prometheus remote read endpoint (ReadRequest/ReadResponse and their nested messages), by hand, using google.golang.org/protobuf's low-level protowire primitives (already a transitive dependency, no new module).
 Package prompb implements the small subset of Prometheus's remote-read wire protocol needed for a Prometheus remote read endpoint (ReadRequest/ReadResponse and their nested messages), by hand, using google.golang.org/protobuf's low-level protowire primitives (already a transitive dependency, no new module).
Package provision creates and tears down cloud VMs at a provider (Hetzner, DigitalOcean, Azure, GCP) so a fresh node can join the fleet through the existing join-token enrollment flow, without an operator manually clicking through a cloud console first.
 Package provision creates and tears down cloud VMs at a provider (Hetzner, DigitalOcean, Azure, GCP) so a fresh node can join the fleet through the existing join-token enrollment flow, without an operator manually clicking through a cloud console first.
Package proxycoexist helps run the dashboard behind a reverse proxy that already owns ports 80 and 443 (Traefik, Caddy, nginx), which is the normal situation on a server migrating off another platform.
 Package proxycoexist helps run the dashboard behind a reverse proxy that already owns ports 80 and 443 (Traefik, Caddy, nginx), which is the normal situation on a server migrating off another platform.
Package proxyroutes writes and maintains route files in an external reverse proxy's watched configuration directory (Traefik's file provider), so domains reach this instance through a proxy that owns ports 80 and 443.
 Package proxyroutes writes and maintains route files in an external reverse proxy's watched configuration directory (Traefik's file provider), so domains reach this instance through a proxy that owns ports 80 and 443.
Package quota holds the pure limit arithmetic for team and project resource quotas.
 Package quota holds the pure limit arithmetic for team and project resource quotas.
Package reconcile implements the core convergence loop: desired state in, observed state diffed against it, idempotent and level-triggered controllers converge the two.
 Package reconcile implements the core convergence loop: desired state in, observed state diffed against it, idempotent and level-triggered controllers converge the two.
application
Package application implements the declarative app spec's service contract and the application controller: the reconcile.Controller that converges a real, store-backed desired service to a running container, replacing nginxdemo's hardcoded desired state with the real thing.
 Package application implements the declarative app spec's service contract and the application controller: the reconcile.Controller that converges a real, store-backed desired service to a running container, replacing nginxdemo's hardcoded desired state with the real thing.
cloudflaretunnel
Package cloudflaretunnel implements the reconcile.Controller that converges a single, platform-wide desired state (store.
 Package cloudflaretunnel implements the reconcile.Controller that converges a single, platform-wide desired state (store.
database
Package database implements the managed database controller: the reconcile.Controller that converges a store-backed store.DesiredDatabase to a running, volume-backed container, the same architectural pattern internal/reconcile/application already establishes (level-triggered, deterministic naming, a narrow store interface for testability), applied to a database instead of a built application image.
 Package database implements the managed database controller: the reconcile.Controller that converges a store-backed store.DesiredDatabase to a running, volume-backed container, the same architectural pattern internal/reconcile/application already establishes (level-triggered, deterministic naming, a narrow store interface for testability), applied to a database instead of a built application image.
exposure
Package exposure converges the host's DOCKER-USER chain onto the stored exposure restrictions, so they survive a reboot or Docker restart.
 Package exposure converges the host's DOCKER-USER chain onto the stored exposure restrictions, so they survive a reboot or Docker restart.
firewall
Package firewall implements the reconcile.Controller that converges internal/store's firewall_rules table onto the local host's ufw via internal/firewall.
 Package firewall implements the reconcile.Controller that converges internal/store's firewall_rules table onto the local host's ufw via internal/firewall.
ingress
Package ingress implements the ingress controller: the reconcile.Controller that keeps Caddy's config (internal/ingress, ADR 005) in sync with every service that declares domains.
 Package ingress implements the ingress controller: the reconcile.Controller that keeps Caddy's config (internal/ingress, ADR 005) in sync with every service that declares domains.
mesh
Package mesh implements the mesh controller: the reconcile.Controller that keeps the WireGuard mesh and the internal DNS zone converged on whatever the store currently says the fleet and its placements look like.
 Package mesh implements the mesh controller: the reconcile.Controller that keeps the WireGuard mesh and the internal DNS zone converged on whatever the store currently says the fleet and its placements look like.
nginxdemo
Package nginxdemo is the Phase 0 exit criterion: one controller that keeps a single hardcoded nginx container running.
 Package nginxdemo is the Phase 0 exit criterion: one controller that keeps a single hardcoded nginx container running.
nodehealth
Package nodehealth implements the node health check: the reconcile.Controller that converges a node's observed heartbeat (internal/store's last_seen_at, kept fresh by internal/agent.Server's periodic touch loop while a node's gRPC session stays open) against its recorded Status, the same architectural pattern internal/reconcile/application and internal/reconcile/database already establish (level-triggered, a narrow store interface for testability, one controller instance per resource), applied to a node instead of a service or database.
 Package nodehealth implements the node health check: the reconcile.Controller that converges a node's observed heartbeat (internal/store's last_seen_at, kept fresh by internal/agent.Server's periodic touch loop while a node's gRPC session stays open) against its recorded Status, the same architectural pattern internal/reconcile/application and internal/reconcile/database already establish (level-triggered, a narrow store interface for testability, one controller instance per resource), applied to a node instead of a service or database.
proxyroutes
Package proxyroutes is the reconcile.Controller that keeps route files in an external Traefik's dynamic directory in step with the routed domains.
 Package proxyroutes is the reconcile.Controller that keeps route files in an external Traefik's dynamic directory in step with the routed domains.
registry
Package registry implements the reconcile.Controller that converges a single, platform-wide desired state (store.RegistrySettings plus a generated password in internal/secrets) to a running or absent registry:2 container: Levelrail's own built-in image registry, so a multi-node deployment gets a BuildKit cache/distribution backend (internal/build's WithCacheRegistry) without an operator first signing up for an external one.
 Package registry implements the reconcile.Controller that converges a single, platform-wide desired state (store.RegistrySettings plus a generated password in internal/secrets) to a running or absent registry:2 container: Levelrail's own built-in image registry, so a multi-node deployment gets a BuildKit cache/distribution backend (internal/build's WithCacheRegistry) without an operator first signing up for an external one.
Package registrycatalog implements a minimal client for the Docker Registry HTTP API v2's catalog endpoints (_catalog, <name>/tags/list), used to browse repositories and tags in Levelrail's own built-in registry (internal/reconcile/registry) from the app-creation UI.
 Package registrycatalog implements a minimal client for the Docker Registry HTTP API v2's catalog endpoints (_catalog, <name>/tags/list), used to browse repositories and tags in Levelrail's own built-in registry (internal/reconcile/registry) from the app-creation UI.
Package registryvendor is the catalog of container registry vendors the credential flow offers presets for: default host, fixed username where the vendor defines one, and how long its tokens live.
 Package registryvendor is the catalog of container registry vendors the credential flow offers presets for: default host, fixed username where the vendor defines one, and how long its tokens live.
Package repolayout inspects a repository's file tree to suggest where its build context and Dockerfile should point, so a monorepo does not silently fall back to auto-detecting the repository root.
 Package repolayout inspects a repository's file tree to suggest where its build context and Dockerfile should point, so a monorepo does not silently fall back to auto-detecting the repository root.
Package repolist caches and queries the repository lists of connected git providers: one cached snapshot per connection, filtered and paged server side so a huge account never reaches the browser in one response.
 Package repolist caches and queries the repository lists of connected git providers: one cached snapshot per connection, filtered and paged server side so a huge account never reaches the browser in one response.
Package resilience judges whether the data plane would keep serving if the control plane went away.
 Package resilience judges whether the data plane would keep serving if the control plane went away.
Package resourceadvisor turns telemetry, limits and specs into read-only resource findings.
 Package resourceadvisor turns telemetry, limits and specs into read-only resource findings.
Package rightsizing is a deterministic, pure-Go engine that turns an app's historical CPU/memory usage into a resource-limit suggestion.
 Package rightsizing is a deterministic, pure-Go engine that turns an app's historical CPU/memory usage into a resource-limit suggestion.
Package rollback plans and applies a return to an earlier control plane release.
 Package rollback plans and applies a return to an earlier control plane release.
Package safemode keeps a boot ledger so a control plane that cannot start stops restarting and serves a read-only recovery page instead.
 Package safemode keeps a boot ledger so a control plane that cannot start stops restarting and serves a read-only recovery page instead.
Package scheduledeploy checks, on an interval, which apps have a due cron schedule (store.AppSchedule, migrations/0250_app_schedules.sql) and redeploys the latest commit on their configured branch.
 Package scheduledeploy checks, on an interval, which apps have a due cron schedule (store.AppSchedule, migrations/0250_app_schedules.sql) and redeploys the latest commit on their configured branch.
Package scheduledtask runs operator-defined jobs on a cron schedule, in the running container (exec mode) or in a fresh one-off container built from the app's own spec (fresh mode), mirroring internal/backup's Runner/Scheduler split: Runner (this file) does one run and records its outcome, Scheduler (scheduler.go) decides when a run is due.
 Package scheduledtask runs operator-defined jobs on a cron schedule, in the running container (exec mode) or in a fresh one-off container built from the app's own spec (fresh mode), mirroring internal/backup's Runner/Scheduler split: Runner (this file) does one run and records its outcome, Scheduler (scheduler.go) decides when a run is due.
Package search is the unified search service: a SQLite FTS5 index fed by providers, filtered through an Authorizer before any hit leaves it.
 Package search is the unified search service: a SQLite FTS5 index fed by providers, filtered through an Authorizer before any hit leaves it.
Package secretmask masks known secret values in text before it is written to a log, audit row or stored build output.
 Package secretmask masks known secret values in text before it is written to a log, audit row or stored build output.
Package secretrotation schedules and performs per-secret rotation policies for app secrets: generate a new value, keep the old one for a grace window, restart the owning app, and record every step.
 Package secretrotation schedules and performs per-secret rotation policies for app secrets: generate a new value, keep the old one for a grace window, restart the owning app, and record every step.
Package secrets implements envelope encryption: per-app data encryption keys, wrapped by a master key held only by the control plane, using filippo.io/age for the crypto primitives.
 Package secrets implements envelope encryption: per-app data encryption keys, wrapped by a master key held only by the control plane, using filippo.io/age for the crypto primitives.
Package selfupgrade replaces the control plane binary with a verified newer release and rolls binary and data back if it does not become healthy.
 Package selfupgrade replaces the control plane binary with a verified newer release and rolls binary and data back if it does not become healthy.
Package serverready reports whether a server can run the control plane and in which mode.
 Package serverready reports whether a server can run the control plane and in which mode.
Package setupguide derives the Get started checklist from real instance state.
 Package setupguide derives the Get started checklist from real instance state.
Package sharedenv composes internal/store's shared env var tables (project_env_vars, organization_env_vars, environment_env_vars) with internal/secrets' envelope encryption, so a secret-marked shared env var resolves to its decrypted plaintext by the time internal/reconcile/application's resolveEnv merges it into a running container's environment.
 Package sharedenv composes internal/store's shared env var tables (project_env_vars, organization_env_vars, environment_env_vars) with internal/secrets' envelope encryption, so a secret-marked shared env var resolves to its decrypted plaintext by the time internal/reconcile/application's resolveEnv merges it into a running container's environment.
Package soak records control plane resource samples during a long churn run and decides pass or fail from growth between the start and the end.
 Package soak records control plane resource samples during a long churn run and decides pass or fail from growth between the start and the end.
Package sourcecache keeps a bounded bare mirror of every repository the control plane fetches, so a known commit never needs the git host again.
 Package sourcecache keeps a bounded bare mirror of every repository the control plane fetches, so a known commit never needs the git host again.
Package sourceupload packs a local directory into a deterministic archive, stores uploaded archives for a bounded time and extracts them safely.
 Package sourceupload packs a local directory into a deterministic archive, stores uploaded archives for a bounded time and extracts them safely.
Package spec parses and validates the app.yaml file: the one declarative file a user writes in their repo, per the app spec design.
 Package spec parses and validates the app.yaml file: the one declarative file a user writes in their repo, per the app spec design.
Package spendcap holds per-app monthly spend and egress guardrails: the pure threshold math and the level-triggered controller step that decides whether an app is throttled or paused.
 Package spendcap holds per-app monthly spend and egress guardrails: the pure threshold math and the level-triggered controller step that decides whether an app is throttled or paused.
Package splittest holds the pure rules of app split testing: variant validation, sticky assignment and the env defaults.
 Package splittest holds the pure rules of app split testing: variant validation, sticky assignment and the env defaults.
Package sshprovision adopts a machine the operator already has (any VPS, home server, Raspberry Pi) as a node by dialing into it over SSH and installing the node agent there.
 Package sshprovision adopts a machine the operator already has (any VPS, home server, Raspberry Pi) as a node by dialing into it over SSH and installing the node agent there.
Package standalone models domains that are not owned by any app and proxy to a target the operator picks: a local port, an address, a URL, another app's port or a container.
 Package standalone models domains that are not owned by any app and proxy to a target the operator picks: a local port, an address, a URL, another app's port or a container.
Package staticroutes parses and evaluates the in-repo routing rules of a static site: Netlify style _redirects and _headers files, the app.yaml routes and headers blocks, and the SPA, clean URL and 404 options.
 Package staticroutes parses and evaluates the in-repo routing rules of a static site: Netlify style _redirects and _headers files, the app.yaml routes and headers blocks, and the SPA, clean URL and 404 options.
Package statuspage builds the opt-in public status page: component probing, 90-day uptime bars, operator-authored incidents and the whitelisted public view.
 Package statuspage builds the opt-in public status page: component probing, 90-day uptime bars, operator-authored incidents and the whitelisted public view.
Package store is the embedded SQLite state layer: WAL mode, modernc.org/sqlite (pure Go, no cgo, keeps cross-compiling the control plane binary trivial), forward-only versioned migrations.
 Package store is the embedded SQLite state layer: WAL mode, modernc.org/sqlite (pure Go, no cgo, keeps cross-compiling the control plane binary trivial), forward-only versioned migrations.
Package stuck explains why a reconciled resource is not ready, by mapping condition reasons plus nearby context to a plain-language cause, evidence lines and typed next actions.
 Package stuck explains why a reconciled resource is not ready, by mapping condition reasons plus nearby context to a plain-language cause, evidence lines and typed next actions.
Package supplychain records the SBOM of each build, optionally scans it for known vulnerabilities in a short-lived container, and decides whether a release may go live.
 Package supplychain records the SBOM of each build, optionally scans it for known vulnerabilities in a short-lived container, and decides whether a release may go live.
Package takeover moves a server's ports 80 and 443 from the proxy of the platform it is migrating off (Coolify's Traefik, a Caddy or nginx container) to this control plane's own ingress, with a recorded way back.
 Package takeover moves a server's ports 80 and 443 from the proxy of the platform it is migrating off (Coolify's Traefik, a Caddy or nginx container) to this control plane's own ingress, with a recorded way back.
Package telemetry is the node-local metrics store, decided in ADR 009: a dedicated SQLite database (telemetry.db, separate from internal/store's levelrail.db) holding container resource-usage samples, queried in place rather than shipped anywhere centrally.
 Package telemetry is the node-local metrics store, decided in ADR 009: a dedicated SQLite database (telemetry.db, separate from internal/store's levelrail.db) holding container resource-usage samples, queried in place rather than shipped anywhere centrally.
Package tlsowner decides which component terminates TLS for a hostname, so every surface reports one coherent certificate and ACME state.
 Package tlsowner decides which component terminates TLS for a hostname, so every surface reports one coherent certificate and ACME state.
Package tokenhash is the one SHA-256 hex digest used for stored secrets.
 Package tokenhash is the one SHA-256 hex digest used for stored secrets.
Package totp holds the recovery-code format helpers and an RFC 6238 code generator the auth engine and its tests share.
 Package totp holds the recovery-code format helpers and an RFC 6238 code generator the auth engine and its tests share.
Package trafficpolicy holds the per-domain traffic control model (headers, path forwarders, geolocation, caching, redirects): the wire types the API, CLI and dashboard share, their validation, and a human readable preview.
 Package trafficpolicy holds the per-domain traffic control model (headers, path forwarders, geolocation, caching, redirects): the wire types the API, CLI and dashboard share, their validation, and a human readable preview.
Package tui is the interactive terminal UI behind the CLI's "tui" command: a live, keyboard-driven view of apps, databases, deployments, nodes, domains, alerts and backups over the public HTTP API only.
 Package tui is the interactive terminal UI behind the CLI's "tui" command: a live, keyboard-driven view of apps, databases, deployments, nodes, domains, alerts and backups over the public HTTP API only.
Package updatecheck periodically checks the configured update channel's latest release against the running build, when an operator has opted into auto-update checking (update_settings.auto_update_enabled, migrations/0258_update_settings.sql).
 Package updatecheck periodically checks the configured update channel's latest release against the running build, when an operator has opted into auto-update checking (update_settings.auto_update_enabled, migrations/0258_update_settings.sql).
Package upgradehistory records every control plane version transition at boot, however the binary was replaced, and builds the links and context the Updates page shows for it.
 Package upgradehistory records every control plane version transition at boot, however the binary was replaced, and builds the links and context the Updates page shows for it.
Package upgradesched runs scheduled and automatic control plane upgrades.
 Package upgradesched runs scheduled and automatic control plane upgrades.
Package usagecost allocates a real or configured infrastructure price to the apps and databases that consume it, then rolls the result up per project, environment and team.
 Package usagecost allocates a real or configured infrastructure price to the apps and databases that consume it, then rolls the result up per project, environment and team.
Package vault resolves a live secret value from an external HashiCorp Vault instance at container-create time, as an alternative to internal/secrets' own envelope-encrypted storage.
 Package vault resolves a live secret value from an external HashiCorp Vault instance at container-create time, as an alternative to internal/secrets' own envelope-encrypted storage.
Package version holds the control plane's own build version, injected via -ldflags at release build time (see .github/workflows/release.yml).
 Package version holds the control plane's own build version, injected via -ldflags at release build time (see .github/workflows/release.yml).
Package walship is an opt-in prototype of continuous SQLite replication by WAL frame shipping (ADR 039).
 Package walship is an opt-in prototype of continuous SQLite replication by WAL frame shipping (ADR 039).
Package webhook is the git integration: a GitHub push-webhook receiver that verifies the request signature, extracts the pushed commit SHA, fetches the repository at that SHA to a local checkout, and hands the result to internal/deploy's Pipeline, the same pipeline a manual deploy trigger will use once the HTTP API exists.
 Package webhook is the git integration: a GitHub push-webhook receiver that verifies the request signature, extracts the pushed commit SHA, fetches the repository at that SHA to a local checkout, and hands the result to internal/deploy's Pipeline, the same pipeline a manual deploy trigger will use once the HTTP API exists.
Package webpush sends browser push notifications (RFC 8030/8291) to every subscription this control plane's dashboard has registered, backing the "webpush" notification-channel kind in internal/alerting: an operator gets a deploy/alert notification even with no dashboard tab focused or open, something none of the other 17 channel kinds (all webhooks or email) can do on their own.
 Package webpush sends browser push notifications (RFC 8030/8291) to every subscription this control plane's dashboard has registered, backing the "webpush" notification-channel kind in internal/alerting: an operator gets a deploy/alert notification even with no dashboard tab focused or open, something none of the other 17 channel kinds (all webhooks or email) can do on their own.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.