Enforce container-name proxy targets

Author: cobycloud

.github/workflows/ci.yml

@@ -23,6 +23,8 @@ jobs:
       - run: npm ci
       - run: npm run check
       - run: npm run build
+      - name: Validate Docker proxy target
+        run: npm run proxy:target-check
       - name: Validate npmctl desired state
         run: npmctl validate desired-state
       - run: npm run docker:build

.github/workflows/deploy.yml

@@ -31,6 +31,8 @@ jobs:
       - run: npm ci
       - run: npm run check
       - run: npm run build
+      - name: Validate Docker proxy target
+        run: npm run proxy:target-check
       - name: Validate npmctl proxy desired state
         run: npmctl validate desired-state/proxy.yaml
       - name: Check Nginx Proxy Manager API schema

package.json

@@ -18,7 +18,8 @@
     "dns:doctor": "npmctl dns doctor --provider namecheap",
     "proxy:validate": "npmctl validate desired-state/proxy.yaml",
     "proxy:plan": "npmctl plan desired-state/proxy.yaml --owner npmctl-com",
-    "proxy:apply": "npmctl apply desired-state/proxy.yaml --owner npmctl-com"
+    "proxy:apply": "npmctl apply desired-state/proxy.yaml --owner npmctl-com",
+    "proxy:target-check": "node scripts/validate-proxy-target.mjs"
   },
   "dependencies": {
     "@mdwrk/lander-core": "^0.1.2",

scripts/validate-proxy-target.mjs

@@ -0,0 +1,27 @@
+import fs from "node:fs";
+
+const compose = fs.readFileSync("docker-compose.yaml", "utf8");
+const proxy = fs.readFileSync("desired-state/proxy.yaml", "utf8");
+
+const containerMatch = compose.match(/^[ \t]*container_name:[ \t]*([^\r\n#]+)/m);
+if (!containerMatch) {
+  throw new Error("docker-compose.yaml must define an explicit container_name for the site service");
+}
+
+const containerName = containerMatch[1].trim();
+const forwardMatches = [...proxy.matchAll(/^[ \t]*forward_host:[ \t]*([^\r\n#]+)/gm)].map((match) => match[1].trim());
+if (forwardMatches.length === 0) {
+  throw new Error("desired-state/proxy.yaml must define at least one forward_host");
+}
+
+const ipLiteral = /^(?:\d{1,3}\.){3}\d{1,3}$/;
+for (const forwardHost of forwardMatches) {
+  if (ipLiteral.test(forwardHost)) {
+    throw new Error(`forward_host must be the Docker container name, not an IP literal: ${forwardHost}`);
+  }
+  if (forwardHost !== containerName) {
+    throw new Error(`forward_host "${forwardHost}" must match docker-compose container_name "${containerName}"`);
+  }
+}
+
+console.log(`proxy target ok: ${containerName}`);