merge to main

.env.example

@@ -0,0 +1,20 @@
+# Dequel Environment Configuration
+# Copy to .env and fill in values. Never commit .env.
+
+# PostgreSQL
+POSTGRES_USER=dequel
+POSTGRES_PASSWORD=changeme
+POSTGRES_DB=dequel
+DATABASE_URL=postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB}
+
+# Caddy
+CADDY_BASE_DOMAIN=localhost
+CADDY_EMAIL=
+
+# Encryption
+ENV_ENCRYPTION_KEY=changeme
+
+# GitHub (optional)
+GITHUB_CLIENT_ID=
+GITHUB_CLIENT_SECRET=
+GITHUB_WEBHOOK_SECRET=

.githooks/pre-commit

@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Pre-commit hook: format staged .ts/.tsx files with Biome
+# Install: git config core.hooksPath .githooks
+
+STAGED_FILES=$(git diff --cached --name-only --diff-filter=ACM | grep -E '\.(ts|tsx|json)$' || true)
+
+if [ -z "$STAGED_FILES" ]; then
+  exit 0
+fi
+
+echo "Formatting staged files with Biome..."
+echo "$STAGED_FILES" | xargs ./node_modules/.bin/biome format --write --no-errors-on-unmatched 2>/dev/null || true
+
+# Re-stage formatted files
+echo "$STAGED_FILES" | xargs git add 2>/dev/null || true
+
+echo "Biome format passed."

.github/workflows/release.yml

@@ -19,15 +19,23 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
 
-      - name: Extract version from tag
+      - name: Extract version and release type
         id: version
-        run: echo "VERSION=${GITHUB_REF_NAME#v}" >> $GITHUB_OUTPUT
+        run: |
+          VERSION="${GITHUB_REF_NAME#v}"
+          echo "VERSION=${VERSION}" >> $GITHUB_OUTPUT
+          if [[ "$VERSION" =~ [-] ]]; then
+            echo "IS_PRERELEASE=true" >> $GITHUB_OUTPUT
+          else
+            echo "IS_PRERELEASE=false" >> $GITHUB_OUTPUT
+          fi
 
       - name: Set image names
         run: |
           REPO_LC="${REPO,,}"
           echo "API_IMAGE=ghcr.io/${REPO_LC}/api" >> $GITHUB_ENV
           echo "WEB_IMAGE=ghcr.io/${REPO_LC}/web" >> $GITHUB_ENV
+          echo "AGENT_IMAGE=ghcr.io/${REPO_LC}/agent" >> $GITHUB_ENV
         env:
           REPO: ${{ github.repository }}
 
@@ -46,11 +54,13 @@ jobs:
         with:
           context: apps/api
           push: true
+          build-args: |
+            BUILD_TIME=${{ github.sha }}
           tags: |
             ${{ env.API_IMAGE }}:${{ steps.version.outputs.VERSION }}
-            ${{ env.API_IMAGE }}:latest
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+            ${{ steps.version.outputs.IS_PRERELEASE == 'false' && format('{0}:latest', env.API_IMAGE) || format('{0}:next', env.API_IMAGE) }}
+          cache-from: type=gha,scope=api-${{ github.sha }}
+          cache-to: type=gha,scope=api-${{ github.sha }},mode=max
 
       - name: Build and push Web image
         uses: docker/build-push-action@v6
@@ -59,35 +69,54 @@ jobs:
           push: true
           build-args: |
             DEQUEL_VERSION=${{ steps.version.outputs.VERSION }}
+            BUILD_TIME=${{ github.sha }}
           tags: |
             ${{ env.WEB_IMAGE }}:${{ steps.version.outputs.VERSION }}
-            ${{ env.WEB_IMAGE }}:latest
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+            ${{ steps.version.outputs.IS_PRERELEASE == 'false' && format('{0}:latest', env.WEB_IMAGE) || format('{0}:next', env.WEB_IMAGE) }}
+          cache-from: type=gha,scope=web-${{ github.sha }}
+          cache-to: type=gha,scope=web-${{ github.sha }},mode=max
+
+      - name: Build and push Agent image
+        uses: docker/build-push-action@v6
+        with:
+          context: apps/agent
+          push: true
+          build-args: |
+            BUILD_TIME=${{ github.sha }}
+          tags: |
+            ${{ env.AGENT_IMAGE }}:${{ steps.version.outputs.VERSION }}
+            ${{ steps.version.outputs.IS_PRERELEASE == 'false' && format('{0}:latest', env.AGENT_IMAGE) || format('{0}:next', env.AGENT_IMAGE) }}
+          cache-from: type=gha,scope=agent-${{ github.sha }}
+          cache-to: type=gha,scope=agent-${{ github.sha }},mode=max
 
       - name: Build config tarball
         run: |
           VERSION="${{ steps.version.outputs.VERSION }}"
           TAR_DIR=_tar
-          mkdir -p "$TAR_DIR/infra/caddy" "$TAR_DIR/infra/monitoring/grafana/datasources"
+          mkdir -p "$TAR_DIR/infra/caddy" "$TAR_DIR/infra/monitoring/grafana/datasources" "$TAR_DIR/scripts/auth"
           cp docker-compose.yml "$TAR_DIR/"
           cp scripts/dequel "$TAR_DIR/dequel"
           cp infra/caddy/Caddyfile "$TAR_DIR/infra/caddy/"
           cp -r infra/monitoring "$TAR_DIR/infra/"
+          cp -r scripts/auth/* "$TAR_DIR/scripts/auth/"
           cd "$TAR_DIR" && tar -czf "../dequel-config-${VERSION}.tar.gz" .
 
       - name: Extract changelog entry for this version
         run: |
           VERSION="${{ steps.version.outputs.VERSION }}"
-          awk '/^## \['"$VERSION"'\] -/{flag=1; next} /^## \[/{if(flag) exit} flag' CHANGELOG.md > release-notes.md
-          if [ ! -s release-notes.md ]; then
-            echo "No changelog entry for v$VERSION, will use auto-generated notes"
+          CHANGELOG="apps/docs/src/content/changelogs/v${VERSION}.md"
+          if [ -f "$CHANGELOG" ]; then
+            sed '1,/^---$/d' "$CHANGELOG" | sed '1,/^---$/d' > release-notes.md
+            echo "Extracted changelog from $CHANGELOG"
+          else
+            echo "No changelog file at $CHANGELOG, will use auto-generated notes"
           fi
 
       - name: Create GitHub Release
         uses: softprops/action-gh-release@v2
         with:
           name: v${{ steps.version.outputs.VERSION }}
+          prerelease: ${{ steps.version.outputs.IS_PRERELEASE == 'true' }}
           body_path: release-notes.md
           generate_release_notes: true
           files: |

.gitignore

@@ -14,3 +14,10 @@ bump.sh
 scripts/workflow/bump.sh
 __pycache__
 .tegami/changes-*
+SETUP_GUIDE.md
+bun.lock
+apps/docs/.blume/
+FEATURES.md
+.agents
+.worktrees/
+artifacts

AGENTS.md

@@ -8,7 +8,7 @@ Self-hosted deployment platform. Deploy apps from Git, ZIP, or Docker Compose wi
 - **Backend**: ElysiaJS (`apps/api/`) — TypeScript, port 3001
 - **Frontend**: React 18 + Vite + TanStack Router + TanStack Query (`apps/web/`) — port 3000
 - **Docs**: Astro 4 + Tailwind CSS (`apps/docs/`) — deployed to Vercel
-- **Database**: SQLite (`data/dequel.db`) — raw SQL
+- **Database**: PostgreSQL (via Drizzle ORM + node-postgres)
 - **Queue**: Redis (`ioredis`) for async job queue
 - **Container build**: Railpack CLI + BuildKit daemon
 - **Container runtime**: Docker Engine API (mounted Docker socket)
@@ -20,12 +20,12 @@ Self-hosted deployment platform. Deploy apps from Git, ZIP, or Docker Compose wi
 Caddy ──▶ API ──▶ Buildkit
   │          │
   ▼          ▼
- Web      SQLite    Redis
+ Web      PostgreSQL  Redis
 
 Observability: cAdvisor → Prometheus → Grafana / Loki
 ```
 
-Services run in Docker Compose: Caddy, API, Web, Buildkit, Redis, cAdvisor, Prometheus, Loki, Promtail, Grafana.
+Services run in Docker Compose: Caddy, API, Web, Buildkit, PostgreSQL, Redis, cAdvisor, Prometheus, Loki, Promtail, Grafana.
 
 ## Directory Structure
 
@@ -61,7 +61,6 @@ Services run in Docker Compose: Caddy, API, Web, Buildkit, Redis, cAdvisor, Prom
 ├── scripts/
 │   ├── install.sh    # One-command install script
 │   └── dequel        # CLI for managing the platform
-├── data/             # SQLite database (persisted)
 ├── workspace/        # Build staging area
 ├── docker-compose.yml
 ├── VERSION           # Single source of truth for version
@@ -75,7 +74,7 @@ Services run in Docker Compose: Caddy, API, Web, Buildkit, Redis, cAdvisor, Prom
 |------|---------|
 | `apps/api/src/index.ts` | API entry point — bootstraps DB, queue, scaling engine, etc. |
 | `apps/api/src/db/schema.ts` | Drizzle ORM schema definitions (all tables) |
-| `apps/api/src/db/drizzle.ts` | Drizzle client wrapper (wraps `bun:sqlite`) |
+| `apps/api/src/db/db-provider.ts` | Database DI provider (setDbProvider/getDb) |
 | `apps/api/src/db/migrations/` | Drizzle Kit migration files (`drizzle-kit generate` outputs here) |
 | `apps/api/drizzle.config.ts` | Drizzle Kit configuration |
 | `apps/web/src/main.tsx` | Frontend entry point |
@@ -115,7 +114,7 @@ docker compose up -d               # Start full stack
 docker compose up -d --build       # Rebuild and start
 
 # Install / Manage
-curl -fsSL https://raw.githubusercontent.com/Lftobs/dequel/main/scripts/install.sh | sh
+curl -fsSL https://github.com/Lftobs/dequel/releases/latest/download/install.sh | bash
 scripts/dequel start               # Start platform
 scripts/dequel uninstall           # Remove everything (prompts)
 
@@ -176,7 +175,7 @@ Requires secrets: `VERCEL_TOKEN`, `VERCEL_ORG_ID`, `VERCEL_PROJECT_ID`
 | Variable | Default | Description |
 |----------|---------|-------------|
 | `PORT` | `3001` | API listen port |
-| `DATABASE_PATH` | `./data/dequel.db` | SQLite database |
+| `DATABASE_URL` | `postgresql://dequel:dequel@localhost:5432/dequel` | PostgreSQL connection string |
 | `WORKSPACE_ROOT` | `./workspace` | Build staging |
 | `CADDY_ROUTES_DIR` | `./infra/caddy/routes` | Caddy route output |
 | `CADDY_BASE_DOMAIN` | `localhost` | Base domain for deployment subdomains. Set to a real domain (e.g. `example.com`) for Let's Encrypt auto-SSL. |
@@ -189,7 +188,7 @@ Requires secrets: `VERCEL_TOKEN`, `VERCEL_ORG_ID`, `VERCEL_PROJECT_ID`
 
 - Never commit secrets or `.env` files
 - Drizzle ORM for migrations; raw SQL is still used in `repo.ts` for queries (may be migrated incrementally)
-- Database: SQLite with `bun:sqlite` (future: Drizzle ORM + PostgreSQL)
+- Database: PostgreSQL (via Drizzle ORM + node-postgres)
 - `.gitignore` ignores `infra/caddy/routes/`, NOT `apps/web/src/routes/`
 - Always run `bun test` in `apps/api/` before committing API changes
 - Docs landing page (`index.astro`) is standalone — no shared layout

CHANGELOG.md

@@ -5,6 +5,22 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.3.0-rc.1] - 2026-08-25
+
+### Added
+
+- Multi-server architecture supporting Direct SSH (`mode: 'ssh'`) and Direct P2P WireGuard Agent (`mode: 'agent'`) modes
+- Target-aware container deployment and remote SFTP Caddy route synchronization
+- Cross-server autoscaling with fleet load evaluation and spillover placement
+- Direct WireGuard P2P tunneling (`10.200.0.x`) with Curve25519 key generation and real-time metric sync
+- Domain verification with A/CNAME record matching against assigned target server IPs
+- Safe pre-release CI/CD workflow preventing pre-release images from overriding `:latest`
+
+### Changed
+
+- Migrated platform database from SQLite to PostgreSQL with Drizzle ORM
+- Streamlined server connection modes strictly to Direct SSH and Direct P2P WireGuard Agent
+
 ## [0.1.1] - 2026-06-19
 
 ### Added

README.md

@@ -61,7 +61,7 @@ and in the `apps/docs/` directory of this repository.
 ## Quick Start
 
 ```bash
-curl -fsSL https://raw.githubusercontent.com/Lftobs/dequel/main/scripts/install.sh | sh
+curl -fsSL https://github.com/Lftobs/dequel/releases/latest/download/install.sh | bash
 ```
 
 Once installed, manage Dequel with the `dequel` CLI:

VERSION

@@ -1 +1 @@
-0.2.0
+0.3.0

apps/agent/Dockerfile

@@ -0,0 +1,22 @@
+FROM oven/bun:1
+
+ARG BUILD_TIME=0
+
+RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates curl git caddy gnupg iproute2 wireguard-tools \
+  && install -m 0755 -d /etc/apt/keyrings \
+  && curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc \
+  && chmod a+r /etc/apt/keyrings/docker.asc \
+  && echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/debian $(. /etc/os-release && echo $VERSION_CODENAME) stable" > /etc/apt/sources.list.d/docker.list \
+  && apt-get update \
+  && apt-get install -y --no-install-recommends docker-ce-cli docker-buildx-plugin docker-compose-plugin \
+  && rm -rf /var/lib/apt/lists/*
+
+RUN curl -sSL https://railpack.com/install.sh | sh -s -- --bin-dir /usr/local/bin
+
+WORKDIR /app
+COPY package.json ./
+COPY src ./src
+
+RUN mkdir -p /var/lib/dequel/workspace
+
+CMD ["bun", "src/index.ts"]

apps/agent/package.json

@@ -0,0 +1,11 @@
+{
+  "name": "dequel-agent",
+  "version": "0.3.0",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "dev": "bun --watch src/index.ts",
+    "start": "bun src/index.ts",
+    "test": "bun test"
+  }
+}

apps/agent/src/capabilities.ts

@@ -0,0 +1,35 @@
+import { spawn } from "node:child_process";
+import { statfs } from "node:fs/promises";
+import { arch, availableParallelism, freemem, totalmem } from "node:os";
+import type { AgentCapabilities } from "./protocol";
+
+const succeeds = (command: string, args: string[]) =>
+	new Promise<boolean>((resolve) => {
+		const child = spawn(command, args, { stdio: "ignore", timeout: 10_000 });
+		child.on("error", () => resolve(false));
+		child.on("close", (code) => resolve(code === 0));
+	});
+
+export const collectCapabilities = async (): Promise<AgentCapabilities> => {
+	const [docker, buildkit, caddy, compose, disk] = await Promise.all([
+		succeeds("docker", ["info"]),
+		succeeds("docker", ["buildx", "version"]),
+		succeeds("caddy", ["version"]),
+		succeeds("docker", ["compose", "version"]),
+		statfs("/").catch(() => null),
+	]);
+	return {
+		docker,
+		buildkit,
+		caddy,
+		compose,
+		architectures: [arch()],
+		cpuCount: availableParallelism(),
+		memoryBytes: totalmem(),
+		diskBytes: disk ? disk.blocks * disk.bsize : 0,
+	};
+};
+
+export const collectResourceUsage = () => ({
+	memoryUsedMb: Math.round((totalmem() - freemem()) / 1024 / 1024),
+});

apps/agent/src/config.ts

@@ -0,0 +1,27 @@
+import { homedir } from "node:os";
+import { join } from "node:path";
+
+export interface WireGuardPeerConfig {
+	peerIp: string;
+	privateKey: string;
+	serverPublicKey: string;
+	serverEndpoint: string;
+	allowedIps: string;
+}
+
+export const config = {
+	controlPlaneUrl: process.env.DEQUEL_CONTROL_PLANE?.replace(/\/+$/, "") || "",
+	tunnelUrl: process.env.DEQUEL_AGENT_TUNNEL_URL?.replace(/\/+$/, "") || "",
+	registrationToken: process.env.DEQUEL_REGISTRATION_TOKEN,
+	credentialPath: process.env.DEQUEL_AGENT_CREDENTIAL_PATH || join(homedir(), ".dequel", "agent.json"),
+	agentVersion: process.env.DEQUEL_AGENT_VERSION || "0.2.1",
+	publicHost: process.env.DEQUEL_AGENT_PUBLIC_HOST,
+	workspaceRoot: process.env.DEQUEL_AGENT_WORKSPACE || "/var/lib/dequel/workspace",
+	caddyRoutesDir: process.env.DEQUEL_AGENT_CADDY_ROUTES || "/etc/dequel/caddy/routes",
+	dockerNetwork: process.env.DEQUEL_DOCKER_NETWORK || "dequel_net",
+};
+
+export const requireControlPlaneUrl = () => {
+	if (!config.controlPlaneUrl) throw new Error("DEQUEL_CONTROL_PLANE is required");
+	return config.controlPlaneUrl;
+};