Bare metal

# Configuration of this scafo node, read by scafo-node.service.
#
# The bucket is the whole registry: every node pointed at the SAME bucket and
# prefix is one installation, and nothing else makes two nodes a fleet.
# Required — the node refuses to boot without them.
SCAFO_S3_ENDPOINT=
SCAFO_S3_BUCKET=
SCAFO_S3_ACCESS_KEY=
SCAFO_S3_SECRET_KEY=
SCAFO_S3_REGION=us-east-1
# Optional: keeps this installation inside one prefix of a shared bucket.
#SCAFO_S3_PREFIX=

# The names applications are served under: <name>.<domain>. Comma-separated.
SCAFO_PLATFORM_DOMAINS=

# The node API. Loopback needs no further statement about the network; widening
# it makes the node refuse to boot until SCAFO_TRANSPORT says what that network
# is — "wireguard" to tunnel it, "none" to state that it is already private.
SCAFO_LISTEN=127.0.0.1:7400
#SCAFO_ADVERTISE=
#SCAFO_TRANSPORT=

# The ingress is not configured from here. It READS the fleet's routing off this
# node's API, at /v1/ingress/routes behind the ingress token, and follows it.

# What this machine IS, for applications that ask for a class of node.
#SCAFO_NODE_LABELS=tier=fast,region=eu-west-1

# Upstream Celld policy for every runtime process, comma-separated. Scafo adds
# no durability, idle-eviction or memory defaults. If SHUTDOWN_TOTAL_MS is
# raised above 40000, also raise TimeoutStopSec in scafo-node.service to at
# least that value plus 10 seconds.
#SCAFO_CELLD_ENV=CELLD_MAX_RSS_MB=512,CELLD_MAX_RESIDENT_CELLS=64

# Observing this node: the first switch makes it record its own events, and the
# second — which is REFUSED without the first — counts what Caddy actually
# served. Read both back with "scafo metrics" and "scafo traces".
#SCAFO_OBSERVABILITY=1
#SCAFO_INGRESS_ACCESS_LOG=/var/log/scafo-ingress/access.log

{
  "storage": { "module": "scafo" },
  "logging": {
    "logs": {
      "default": { "exclude": ["http.log.access.scafo"] },
      "scafo": {
        "writer": {
          "output": "file",
          "filename": "/var/log/scafo-ingress/access.log",
          "mode": "0644"
        },
        "encoder": { "format": "json" },
        "include": ["http.log.access.scafo"]
      }
    }
  },
  "apps": {
    "scafo": {
      "fleets": [
        {
          "name": "default",
          "endpoint": "http://127.0.0.1:7400",
          "token_file": "{env.CREDENTIALS_DIRECTORY}/ingress-token",
          "prefer": "self"
        }
      ]
    },
    "tls": {
      "automation": {
        "policies": [{ "on_demand": true }],
        "on_demand": {
          "permission": { "module": "scafo" }
        }
      }
    },
    "http": {
      "servers": {
        "scafo": {
          "listen": [":80", ":443"],
          "routes": [
            {
              "handle": [
                {
                  "handler": "reverse_proxy",
                  "dynamic_upstreams": { "source": "scafo" },
                  "load_balancing": {
                    "selection_policy": { "policy": "first" },
                    "retries": 2,
                    "try_duration": "5s"
                  },
                  "health_checks": {
                    "passive": { "fail_duration": "30s", "max_fails": 1 }
                  }
                }
              ]
            }
          ],
          "errors": {
            "routes": [
              {
                "match": [{ "vars": { "scafo.route": ["unknown", "denied"] } }],
                "handle": [
                  {
                    "handler": "static_response",
                    "status_code": 404,
                    "body": "No deployment answers to this name.\n"
                  }
                ]
              }
            ]
          },
          "logs": { "default_logger_name": "scafo" }
        }
      }
    }
  }
}

[Unit]
Description=scafo node daemon
Documentation=https://github.com/sandros94/scafo
Wants=network-online.target
After=network-online.target
# Pulled in and started BEFORE the ingress; see the comment in the installer.
Wants=caddy.service
Before=caddy.service

[Service]
Type=exec
User=scafo
Group=scafo
EnvironmentFile=/etc/scafo/node.env
Environment=SCAFO_STATE_DIR=/var/lib/scafo
# Default Celld source builds to the bundled esbuild binary.
Environment=CELLD_ESBUILD=/usr/local/bin/esbuild
Environment=SCAFO_CELLD_BIN=/usr/local/bin/celld
ExecStart=/usr/local/bin/scafo sail
Restart=on-failure
RestartSec=5s

# Signal the daemon first so it drains runtimes; kill remaining cgroup processes on timeout.
KillMode=mixed
KillSignal=SIGTERM
SendSIGKILL=yes
TimeoutStopSec=50s
# Keep runtimes in this cgroup for timeout containment.
Delegate=no

StateDirectory=scafo
StateDirectoryMode=0700
NoNewPrivileges=yes
ProtectSystem=full
ProtectHome=yes
PrivateTmp=yes
LimitNOFILE=1048576

[Install]
WantedBy=multi-user.target

[Unit]
Description=Caddy, the ingress a scafo node routes through
Documentation=https://caddyserver.com/docs/
Wants=network-online.target
After=network-online.target scafo-node.service
# The token is unavailable on first boot until the node starts. LoadCredential=
# fails before ExecStartPre, so disable start-rate limiting and retry on failure.
# Do not add Requires=: a running ingress may continue through a node restart.
StartLimitIntervalSec=0

[Service]
Type=notify
User=caddy
Group=caddy
# This gives the ingress a private copy without exposing the source token.
LoadCredential=ingress-token:/var/lib/scafo/ingress-token
ExecStart=/usr/local/bin/caddy run --config /etc/scafo/caddy.json
ExecReload=/usr/local/bin/caddy reload --config /etc/scafo/caddy.json --force
Restart=on-failure
RestartSec=5s
TimeoutStopSec=5s

# Caddy's own state directory. The certificates are NOT here — they are in the
# bucket, reached through the node — but the ACME account is: it is this
# ingress's, not the fleet's, and losing it only means registering again.
StateDirectory=caddy
Environment=XDG_DATA_HOME=/var/lib/caddy
Environment=XDG_CONFIG_HOME=/var/lib/caddy
# What the node counts requests out of, when it is told to.
LogsDirectory=scafo-ingress
LogsDirectoryMode=0755

# Binding 80 and 443 without running as root.
AmbientCapabilities=CAP_NET_BIND_SERVICE
NoNewPrivileges=yes
ProtectSystem=full
ProtectHome=yes
PrivateTmp=yes
LimitNOFILE=1048576

[Install]
WantedBy=multi-user.target

sudo scafo-uninstall --dry-run
sudo scafo-uninstall

pnpm compile