0.19.0 (#940)

* prodproxy

* update CHANGELOG

* fix tests

* formatting

* fix linting

* bump deps

* clarity

* update CHANGELOG

Co-authored-by: Troy Coutu <Autre31415@gmail.com>

CHANGELOG.md

@@ -4,6 +4,15 @@
 
 - Put your changes here...
 
+## 0.19.0
+
+- Breaking: Production mode behavior [changed significantly](https://github.com/rooseveltframework/roosevelt/issues/934):
+  - `localhostOnly` and `alwaysHostPublic` defaults were flipped to false and true respectively.
+  - `alwaysHostPublic` was renamed to `hostPublic`.
+  - The `--host-public` command line flag was removed, since it is no logner needed because `hostPublic` defaults to true now.
+  - New command line flag added called `production-proxy` to let you opt-in to `localhostOnly` and `alwaysHostPublic` being set to true and false respectively as before.
+- Various dependencies bumped.
+
 ## 0.18.3
 
 - You can now [use PHP as your templating engine](https://github.com/rooseveltframework/express-php-view-engine) in a Roosevelt app or any other Express application. PHP should be faster than any JS-based templating engine for complex templates since its parser is written in C rather than JS.

README.md

@@ -141,10 +141,11 @@ Roosevelt apps created with the app generator come with the following notable [n
     - `npm run dev`
     - `npm run d`
   - Script is short for: `nodemon app.js --development-mode`
-- `npm run proddev`: Runs the app in production mode, but with the public folder hosted by the Roosevelt app. This is useful for doing development in production mode without having to stage a complex simulation of your production environment, which would likely include hosting static files via another web server better-suited to serving statics like Apache or nginx.
+- `npm run production-proxy`: Runs the app in production mode, but with `localhostOnly` set to true and `hostPublic` set to false. This mode will make it so your app only listens to requests coming from localhost and does not serve anything in the public folder. This mode is useful when you want to host your app behind a reverse proxy from a web server like Apache or nginx and [is considered a best practice for Node.js deployments](https://expressjs.com/en/advanced/best-practice-performance.html#use-a-reverse-proxy).
   - Default shorthands:
-    - `npm run pd`
-  - Script is short for: `nodemon app.js --host-public`
+    - `npm run prodproxy`
+    - `npm run x`
+  - Script is short for: `nodemon app.js --production-proxy`
 - `npm run config-audit`: Scans current `rooseveltConfig` and `scripts` in `package.json` and warns about any parameters or npm scripts that don't match the current Roosevelt API:
   - Default shorthand:
     - `npm run a`
@@ -174,7 +175,7 @@ Roosevelt apps created with the app generator come with the following notable [n
   - Default shorthands:
     - `--raw`
     - `-r`
-- `node app.js --host-public`: Forces Roosevelt to always host the [public folder](https://github.com/rooseveltframework/roosevelt#public-folder-parameters) even when `alwaysHostPublic` is set to false. Useful for testing production mode.
+- `node app.js --host-public`: Forces Roosevelt to always host the [public folder](https://github.com/rooseveltframework/roosevelt#public-folder-parameters) even when `hostPublic` is set to false. Useful for testing `production-proxy` mode.
   - Default shorthands:
     - `--statics`
     - `-s`
@@ -805,7 +806,7 @@ Resolves to:
 
   ## Public folder parameters
 
-- `publicFolder`: All files and folders in this directory will be exposed as static files in development mode or when `alwaysHostPublic` is enabled.
+- `publicFolder`: All files and folders in this directory will be exposed as static files in development mode or when `hostPublic` is enabled.
 
   - Default: *[String]* `"public"`.
 
@@ -839,7 +840,7 @@ Resolves to:
 
   - Default: *[Boolean]* `false`.
 
-- `alwaysHostPublic`:  By default in production mode Roosevelt will not expose the public folder. It's recommended instead that you host the public folder yourself directly through another web server, such as Apache or nginx. However, if you wish to override this behavior and have Roosevelt host your public folder even in production mode, then set this setting to true.
+- `hostPublic`: Whether or not to allow Roosevelt to host the public folder. By default in `production-proxy` mode Roosevelt will not expose the public folder. It's recommended instead that you host the public folder yourself directly through another web server, such as Apache or nginx.
 
   - Default: *[Boolean]* `false`.
 

lib/defaults/config.json

@@ -3,7 +3,7 @@
   "mode": "production",
   "enableCLIFlags": true,
   "generateFolderStructure": false,
-  "localhostOnly": true,
+  "localhostOnly": false,
   "logging": {
     "methods": {
       "http": true,
@@ -101,7 +101,7 @@
   "favicon": "none",
   "symlinks": [],
   "versionedPublic": false,
-  "alwaysHostPublic": false,
+  "hostPublic": true,
   "clientViews": {
     "allowlist": {},
     "blocklist": {},

lib/mapRoutes.js

@@ -111,7 +111,7 @@ module.exports = app => {
   fsr.ensureDirSync(app.get('controllersPath'))
 
   // map statics for developer mode
-  if (params.alwaysHostPublic || app.get('env') === 'development') {
+  if (params.hostPublic || app.get('env') === 'development') {
     app.use(prefix || '/', express.static(app.get('publicFolder')))
   }
 

lib/scripts/configAuditor.js

@@ -100,7 +100,7 @@ function configAudit (appDir) {
 
       keyStack.push(key)
       switch (key) {
-        case 'alwaysHostPublic':
+        case 'hostPublic':
           checkTypes(userParam, key, ['boolean'])
           break
         case 'checkDependencies':

lib/sourceParams.js

@@ -43,8 +43,10 @@ module.exports = (params, app) => {
     logging: false,
     // handle configuration edge cases
     transform: (params, flags) => {
-      // handle --production-mode, --prod, -p cli flags
-      if (flags.productionMode || flags.prod || flags.p) {
+      // handle --production-mode, --prod, -p cli flags etc
+      if (flags.productionProxyMode || flags.prodproxy || flags.x) {
+        params.mode = 'production-proxy'
+      } else if (flags.productionMode || flags.prod || flags.p) {
         params.mode = 'production'
       } else if (flags.developmentMode || flags.dev || flags.d) {
         // handle --development-mode, --dev, -d cli flags
@@ -60,7 +62,7 @@ module.exports = (params, app) => {
       }
 
       // default mode param to production if its value is invalid
-      if (params.mode !== 'production' && params.mode !== 'development') {
+      if (params.mode !== 'production-proxy' && params.mode !== 'production' && params.mode !== 'development') {
         params.mode = 'production'
       }
 
@@ -286,9 +288,8 @@ module.exports = (params, app) => {
     versionedPublic: {
       default: defaults.versionedPublic
     },
-    alwaysHostPublic: {
-      commandLineArg: ['--host-public', '--statics', '-s'],
-      default: defaults.alwaysHostPublic
+    hostPublic: {
+      default: defaults.hostPublic
     },
     clientViews: {
       allowlist: {
@@ -400,7 +401,7 @@ module.exports = (params, app) => {
   const logger = new Logger(params.logging)
 
   // set mode specific overrides
-  if (params.mode === 'production') {
+  if (params.mode === 'production' || params.mode === 'production-proxy') {
     process.env.NODE_ENV = 'production'
 
     // html validator is always disabled in production mode
@@ -412,6 +413,17 @@ module.exports = (params, app) => {
     params.minify = false
   }
 
+  // hostPublic always true in dev mode
+  if (params.mode === 'development') {
+    params.hostPublic = true
+  }
+
+  // force localhostOnly and hostPublic off in production-proxy mode
+  if (params.mode === 'production-proxy') {
+    params.localhostOnly = true
+    params.hostPublic = false
+  }
+
   // handle HTTP_PROXY edge case
   if (process.env.HTTP_PROXY || process.env.HTTPS_PROXY) {
     if (process.env.NO_PROXY && !process.env.NO_PROXY.includes('localhost')) {