feat(cli): add bidirectional local/remote support for all commands

Add local mode support for routes and secrets commands (previously
remote-only), and add remote mode support for deploy and logs commands
(previously local-only).

Changes:
- Create LogService for accessing Gordon process and container logs
- Add deploy and logs endpoints to admin API with SSE streaming
- Add LocalServices provider for CLI local operations
- Update routes/secrets commands to work locally without --remote
- Update deploy/logs commands to work remotely with --remote
- Add container logs support: gordon logs [domain]
- Update CLI documentation

This enables consistent command behavior across local and remote modes,
improving the developer experience for both local development and remote
server management.

commit: d95d72c9d99b43a0852b4f7b9ddf6596314b3b3e
author: brice · 9mo ago · 2026-01-17 06:55 UTC
parent: fc65046
signature: GPG VerifiedCD88F9E564E0102646FB6077A1A07C7C7C3E349D · arch-gpg Verified for the committer email

15 files · +1833 -150

M .mockery.yaml +1 -0


@@ -31,3 +31,4 @@ packages:
31	31		HealthService:
32	32		HTTPProber:
33	33		SecretService:
	34	+	LogService:


@@ -31,3 +31,4 @@ packages:
31	HealthService:	31		HealthService:
32	HTTPProber:	32		HTTPProber:
33	SecretService:	33		SecretService:
		34	+	LogService:

M docs/cli/commands.md +60 -23


@@ -9,11 +9,11 @@ Gordon provides a command-line interface for server management, deployment, and
9	9		\| `gordon serve` \| Start the Gordon server \|
10	10		\| `gordon reload` \| Reload configuration and sync containers \|
11	11		\| `gordon deploy` \| Manually deploy or redeploy a specific route \|
12		-	\| `gordon logs` \| Display Gordon process logs \|
	12	+	\| `gordon logs` \| Display Gordon process or container logs \|
13	13		\| `gordon version` \| Print version information \|
14	14		\| `gordon auth` \| Manage registry authentication \|
15	15		\| `gordon routes` \| Manage routes (local or remote) \|
16		-	\| `gordon secrets` \| Manage secrets (remote only) \|
	16	+	\| `gordon secrets` \| Manage secrets (local or remote) \|
17	17		\| `gordon remotes` \| Manage saved remote Gordon instances \|
18	18
19	19		## Quick Reference

@@ -30,9 +30,11 @@ gordon reload
30	30		gordon deploy myapp.example.com
31	31
32	32		# View logs
33		-	gordon logs
34		-	gordon logs -f
35		-	gordon logs -n 100
	33	+	gordon logs # Gordon process logs
	34	+	gordon logs -f # Follow process logs
	35	+	gordon logs -n 100 # Last 100 lines
	36	+	gordon logs myapp.local # Container logs for myapp.local
	37	+	gordon logs myapp.local -f # Follow container logs
36	38
37	39		# Check version
38	40		gordon version

@@ -225,7 +227,7 @@ Manually deploy or redeploy a specific route.
225	227		### Synopsis
226	228
227	229		```bash
228		-	gordon deploy <domain>
	230	+	gordon deploy <domain> [options]
229	231		```
230	232
231	233		### Arguments

@@ -234,9 +236,20 @@ gordon deploy <domain>
234	236		\|----------\|-------------\|
235	237		\| `<domain>` \| The domain name of the route to deploy (required) \|
236	238
	239	+	### Options
	240	+
	241	+	\| Option \| Description \|
	242	+	\|--------\|-------------\|
	243	+	\| `--remote` \| Remote Gordon URL \|
	244	+	\| `--token` \| Authentication token for remote \|
	245	+
237	246		### Description
238	247
239		-	Sends `SIGUSR2` to the Gordon process with the specified domain, triggering:
	248	+	Local mode: Sends `SIGUSR2` to the Gordon process with the specified domain.
	249	+
	250	+	Remote mode: Calls the remote Gordon Admin API to trigger deployment.
	251	+
	252	+	Both modes trigger:
240	253
241	254		- Fresh image pull (always pulls latest, ignoring cache)
242	255		- Container redeployment for the specified route

@@ -244,8 +257,12 @@ Sends `SIGUSR2` to the Gordon process with the specified domain, triggering:
244	257		### Examples
245	258
246	259		```bash
	260	+	# Local deployment
247	261		gordon deploy myapp.example.com
248	262		gordon deploy api.example.com
	263	+
	264	+	# Remote deployment
	265	+	gordon deploy myapp.example.com --remote https://gordon.mydomain.com --token $TOKEN
249	266		```
250	267
251	268		### Use Cases

@@ -253,19 +270,26 @@ gordon deploy api.example.com
253	270		- Recover from a failed deployment
254	271		- Force redeploy without pushing a new image
255	272		- Manual deployment when automatic deploy didn't trigger
	273	+	- Trigger deployments on remote Gordon instances from CI/CD
256	274
257	275		---
258	276
259	277		## gordon logs
260	278
261		-	Display Gordon process logs.
	279	+	Display Gordon process logs or container logs.
262	280
263	281		### Synopsis
264	282
265	283		```bash
266		-	gordon logs [options]
	284	+	gordon logs [domain] [options]
267	285		```
268	286
	287	+	### Arguments
	288	+
	289	+	\| Argument \| Description \|
	290	+	\|----------\|-------------\|
	291	+	\| `[domain]` \| Optional. Container domain to view logs for. Without this, shows Gordon process logs. \|
	292	+
269	293		### Options
270	294
271	295		\| Option \| Short \| Default \| Description \|

@@ -273,14 +297,26 @@ gordon logs [options]
273	297		\| `--config` \| `-c` \| Auto \| Path to config file \|
274	298		\| `--follow` \| `-f` \| false \| Follow log output (like `tail -f`) \|
275	299		\| `--lines` \| `-n` \| 50 \| Number of lines to show \|
	300	+	\| `--remote` \| \| \| Remote Gordon URL \|
	301	+	\| `--token` \| \| \| Authentication token for remote \|
276	302
277	303		### Examples
278	304
279	305		```bash
	306	+	# Gordon process logs
280	307		gordon logs # Last 50 lines
281	308		gordon logs -f # Follow logs
282	309		gordon logs -n 100 # Last 100 lines
283	310		gordon logs -f -n 200 # Follow, starting from last 200 lines
	311	+
	312	+	# Container logs
	313	+	gordon logs myapp.local # Last 50 lines from container
	314	+	gordon logs myapp.local -f # Follow container logs
	315	+	gordon logs myapp.local -n 100 # Last 100 lines from container
	316	+
	317	+	# Remote mode
	318	+	gordon logs --remote https://gordon.mydomain.com --token $TOKEN
	319	+	gordon logs myapp.local --remote https://gordon.mydomain.com --token $TOKEN
284	320		```
285	321
286	322		### Log Locations

@@ -294,6 +330,10 @@ tail -f ~/.gordon/logs/gordon.log
294	330
295	331		# With systemd
296	332		journalctl --user -u gordon -f
	333	+
	334	+	# Container logs via docker (local alternative)
	335	+	docker logs --tail 50 myapp.local
	336	+	docker logs -f myapp.local
297	337		```
298	338
299	339		---

@@ -603,31 +643,28 @@ gordon routes deploy myapp.example.com
603	643
604	644		## gordon secrets
605	645
606		-	Manage secrets on remote Gordon instances. Requires remote targeting.
	646	+	Manage secrets on local or remote Gordon instances.
607	647
608	648		### Subcommands
609	649
610	650		\| Subcommand \| Description \|
611	651		\|------------\|-------------\|
612		-	\| `list` \| List all secrets \|
613		-	\| `get` \| Get a secret value \|
	652	+	\| `list` \| List all secrets for a domain \|
614	653		\| `set` \| Set a secret value \|
615		-	\| `delete` \| Delete a secret \|
	654	+	\| `remove` \| Remove a secret \|
616	655
617	656		### Examples
618	657
619	658		```bash
620		-	# List secrets
621		-	gordon secrets list --remote https://gordon.mydomain.com --token $TOKEN
622		-
623		-	# Set a secret
624		-	gordon secrets set DATABASE_URL "postgres://..." --remote ... --token ...
625		-
626		-	# Get a secret
627		-	gordon secrets get DATABASE_URL --remote ... --token ...
	659	+	# Local mode (reads/writes secrets directly)
	660	+	gordon secrets list myapp.local
	661	+	gordon secrets set myapp.local DATABASE_URL "postgres://..."
	662	+	gordon secrets remove myapp.local DATABASE_URL
628	663
629		-	# Delete a secret
630		-	gordon secrets delete DATABASE_URL --remote ... --token ...
	664	+	# Remote mode
	665	+	gordon secrets list myapp.local --remote https://gordon.mydomain.com --token $TOKEN
	666	+	gordon secrets set myapp.local DATABASE_URL "postgres://..." --remote ... --token ...
	667	+	gordon secrets remove myapp.local DATABASE_URL --remote ... --token ...
631	668		```
632	669
633	670		---


@@ -9,11 +9,11 @@ Gordon provides a command-line interface for server management, deployment, and
9		\| `gordon serve` \| Start the Gordon server \|	9		\| `gordon serve` \| Start the Gordon server \|
10		\| `gordon reload` \| Reload configuration and sync containers \|	10		\| `gordon reload` \| Reload configuration and sync containers \|
11		\| `gordon deploy` \| Manually deploy or redeploy a specific route \|	11		\| `gordon deploy` \| Manually deploy or redeploy a specific route \|
12	-	\| `gordon logs` \| Display Gordon process logs \|	12	+	\| `gordon logs` \| Display Gordon process or container logs \|
13		\| `gordon version` \| Print version information \|	13		\| `gordon version` \| Print version information \|
14		\| `gordon auth` \| Manage registry authentication \|	14		\| `gordon auth` \| Manage registry authentication \|
15		\| `gordon routes` \| Manage routes (local or remote) \|	15		\| `gordon routes` \| Manage routes (local or remote) \|
16	-	\| `gordon secrets` \| Manage secrets (remote only) \|	16	+	\| `gordon secrets` \| Manage secrets (local or remote) \|
17		\| `gordon remotes` \| Manage saved remote Gordon instances \|	17		\| `gordon remotes` \| Manage saved remote Gordon instances \|
18			18
19		## Quick Reference	19		## Quick Reference

@@ -30,9 +30,11 @@ gordon reload
30		gordon deploy myapp.example.com	30		gordon deploy myapp.example.com
31			31
32		# View logs	32		# View logs
33	-	gordon logs	33	+	gordon logs # Gordon process logs
34	-	gordon logs -f	34	+	gordon logs -f # Follow process logs
35	-	gordon logs -n 100	35	+	gordon logs -n 100 # Last 100 lines
			36	+	gordon logs myapp.local # Container logs for myapp.local
			37	+	gordon logs myapp.local -f # Follow container logs
36			38
37		# Check version	39		# Check version
38		gordon version	40		gordon version

@@ -225,7 +227,7 @@ Manually deploy or redeploy a specific route.
225		### Synopsis	227		### Synopsis
226			228
227		```bash	229		```bash
228	-	gordon deploy <domain>	230	+	gordon deploy <domain> [options]
229		```	231		```
230			232
231		### Arguments	233		### Arguments

@@ -234,9 +236,20 @@ gordon deploy <domain>
234		\|----------\|-------------\|	236		\|----------\|-------------\|
235		\| `<domain>` \| The domain name of the route to deploy (required) \|	237		\| `<domain>` \| The domain name of the route to deploy (required) \|
236			238
			239	+	### Options
			240	+
			241	+	\| Option \| Description \|
			242	+	\|--------\|-------------\|
			243	+	\| `--remote` \| Remote Gordon URL \|
			244	+	\| `--token` \| Authentication token for remote \|
			245	+
237		### Description	246		### Description
238			247
239	-	Sends `SIGUSR2` to the Gordon process with the specified domain, triggering:	248	+	Local mode: Sends `SIGUSR2` to the Gordon process with the specified domain.
			249	+
			250	+	Remote mode: Calls the remote Gordon Admin API to trigger deployment.
			251	+
			252	+	Both modes trigger:
240			253
241		- Fresh image pull (always pulls latest, ignoring cache)	254		- Fresh image pull (always pulls latest, ignoring cache)
242		- Container redeployment for the specified route	255		- Container redeployment for the specified route

@@ -244,8 +257,12 @@ Sends `SIGUSR2` to the Gordon process with the specified domain, triggering:
244		### Examples	257		### Examples
245			258
246		```bash	259		```bash
			260	+	# Local deployment
247		gordon deploy myapp.example.com	261		gordon deploy myapp.example.com
248		gordon deploy api.example.com	262		gordon deploy api.example.com
			263	+
			264	+	# Remote deployment
			265	+	gordon deploy myapp.example.com --remote https://gordon.mydomain.com --token $TOKEN
249		```	266		```
250			267
251		### Use Cases	268		### Use Cases

@@ -253,19 +270,26 @@ gordon deploy api.example.com
253		- Recover from a failed deployment	270		- Recover from a failed deployment
254		- Force redeploy without pushing a new image	271		- Force redeploy without pushing a new image
255		- Manual deployment when automatic deploy didn't trigger	272		- Manual deployment when automatic deploy didn't trigger
			273	+	- Trigger deployments on remote Gordon instances from CI/CD
256			274
257		---	275		---
258			276
259		## gordon logs	277		## gordon logs
260			278
261	-	Display Gordon process logs.	279	+	Display Gordon process logs or container logs.
262			280
263		### Synopsis	281		### Synopsis
264			282
265		```bash	283		```bash
266	-	gordon logs [options]	284	+	gordon logs [domain] [options]
267		```	285		```
268			286
			287	+	### Arguments
			288	+
			289	+	\| Argument \| Description \|
			290	+	\|----------\|-------------\|
			291	+	\| `[domain]` \| Optional. Container domain to view logs for. Without this, shows Gordon process logs. \|
			292	+
269		### Options	293		### Options
270			294
271		\| Option \| Short \| Default \| Description \|	295		\| Option \| Short \| Default \| Description \|

@@ -273,14 +297,26 @@ gordon logs [options]
273		\| `--config` \| `-c` \| Auto \| Path to config file \|	297		\| `--config` \| `-c` \| Auto \| Path to config file \|
274		\| `--follow` \| `-f` \| false \| Follow log output (like `tail -f`) \|	298		\| `--follow` \| `-f` \| false \| Follow log output (like `tail -f`) \|
275		\| `--lines` \| `-n` \| 50 \| Number of lines to show \|	299		\| `--lines` \| `-n` \| 50 \| Number of lines to show \|
			300	+	\| `--remote` \| \| \| Remote Gordon URL \|
			301	+	\| `--token` \| \| \| Authentication token for remote \|
276			302
277		### Examples	303		### Examples
278			304
279		```bash	305		```bash
			306	+	# Gordon process logs
280		gordon logs # Last 50 lines	307		gordon logs # Last 50 lines
281		gordon logs -f # Follow logs	308		gordon logs -f # Follow logs
282		gordon logs -n 100 # Last 100 lines	309		gordon logs -n 100 # Last 100 lines
283		gordon logs -f -n 200 # Follow, starting from last 200 lines	310		gordon logs -f -n 200 # Follow, starting from last 200 lines
			311	+
			312	+	# Container logs
			313	+	gordon logs myapp.local # Last 50 lines from container
			314	+	gordon logs myapp.local -f # Follow container logs
			315	+	gordon logs myapp.local -n 100 # Last 100 lines from container
			316	+
			317	+	# Remote mode
			318	+	gordon logs --remote https://gordon.mydomain.com --token $TOKEN
			319	+	gordon logs myapp.local --remote https://gordon.mydomain.com --token $TOKEN
284		```	320		```
285			321
286		### Log Locations	322		### Log Locations

@@ -294,6 +330,10 @@ tail -f ~/.gordon/logs/gordon.log
294			330
295		# With systemd	331		# With systemd
296		journalctl --user -u gordon -f	332		journalctl --user -u gordon -f
			333	+
			334	+	# Container logs via docker (local alternative)
			335	+	docker logs --tail 50 myapp.local
			336	+	docker logs -f myapp.local
297		```	337		```
298			338
299		---	339		---

@@ -603,31 +643,28 @@ gordon routes deploy myapp.example.com
603			643
604		## gordon secrets	644		## gordon secrets
605			645
606	-	Manage secrets on remote Gordon instances. Requires remote targeting.	646	+	Manage secrets on local or remote Gordon instances.
607			647
608		### Subcommands	648		### Subcommands
609			649
610		\| Subcommand \| Description \|	650		\| Subcommand \| Description \|
611		\|------------\|-------------\|	651		\|------------\|-------------\|
612	-	\| `list` \| List all secrets \|	652	+	\| `list` \| List all secrets for a domain \|
613	-	\| `get` \| Get a secret value \|
614		\| `set` \| Set a secret value \|	653		\| `set` \| Set a secret value \|
615	-	\| `delete` \| Delete a secret \|	654	+	\| `remove` \| Remove a secret \|
616			655
617		### Examples	656		### Examples
618			657
619		```bash	658		```bash
620	-	# List secrets	659	+	# Local mode (reads/writes secrets directly)
621	-	gordon secrets list --remote https://gordon.mydomain.com --token $TOKEN	660	+	gordon secrets list myapp.local
622	-		661	+	gordon secrets set myapp.local DATABASE_URL "postgres://..."
623	-	# Set a secret	662	+	gordon secrets remove myapp.local DATABASE_URL
624	-	gordon secrets set DATABASE_URL "postgres://..." --remote ... --token ...
625	-
626	-	# Get a secret
627	-	gordon secrets get DATABASE_URL --remote ... --token ...
628			663
629	-	# Delete a secret	664	+	# Remote mode
630	-	gordon secrets delete DATABASE_URL --remote ... --token ...	665	+	gordon secrets list myapp.local --remote https://gordon.mydomain.com --token $TOKEN
			666	+	gordon secrets set myapp.local DATABASE_URL "postgres://..." --remote ... --token ...
			667	+	gordon secrets remove myapp.local DATABASE_URL --remote ... --token ...
631		```	668		```
632			669
633		---	670		---

M internal/adapters/in/cli/deploy.go +21 -3

@@ -1,10 +1,12 @@
1	1		package cli
2	2
3	3		import (
	4	+	"context"
4	5		"fmt"
5	6
6	7		"github.com/spf13/cobra"
7	8
	9	+	"gordon/internal/adapters/in/cli/ui/styles"
8	10		"gordon/internal/app"
9	11		)
10	12

@@ -21,14 +23,30 @@ even if a container is already running.
21	23
22	24		Examples:
23	25		gordon deploy myapp.example.com
24		-	gordon deploy api.example.com`,
	26	+	gordon deploy api.example.com
	27	+	gordon deploy myapp.example.com --remote https://gordon.mydomain.com --token $TOKEN`,
25	28		Args: cobra.ExactArgs(1),
26	29		RunE: func(cmd *cobra.Command, args []string) error {
27		-	domain, err := app.SendDeploySignal(args[0])
	30	+	ctx := context.Background()
	31	+	deployDomain := args[0]
	32	+
	33	+	client, isRemote := GetRemoteClient()
	34	+	if isRemote {
	35	+	// Remote deployment via admin API
	36	+	result, err := client.Deploy(ctx, deployDomain)
	37	+	if err != nil {
	38	+	return fmt.Errorf("failed to deploy: %w", err)
	39	+	}
	40	+	fmt.Println(styles.RenderSuccess(fmt.Sprintf("Deployed %s (container: %s)", deployDomain, result.ContainerID[:12])))
	41	+	return nil
	42	+	}
	43	+
	44	+	// Local deployment via signal
	45	+	domain, err := app.SendDeploySignal(deployDomain)
28	46		if err != nil {
29	47		return err
30	48		}
31		-	fmt.Printf("Deploy signal sent for domain: %s\n", domain)
	49	+	fmt.Println(styles.RenderSuccess(fmt.Sprintf("Deploy signal sent for domain: %s", domain)))
32	50		return nil
33	51		},
34	52		}

 package cli
 import (
+	"context"
 	"fmt"
 	"github.com/spf13/cobra"
+	"gordon/internal/adapters/in/cli/ui/styles"
 	"gordon/internal/app"
 )
 Examples:
   gordon deploy myapp.example.com
-  gordon deploy api.example.com`,
+  gordon deploy api.example.com
+  gordon deploy myapp.example.com --remote https://gordon.mydomain.com --token $TOKEN`,
 		Args: cobra.ExactArgs(1),
 		RunE: func(cmd *cobra.Command, args []string) error {
-			domain, err := app.SendDeploySignal(args[0])
+			ctx := context.Background()
+			deployDomain := args[0]
+			client, isRemote := GetRemoteClient()
+			if isRemote {
+				// Remote deployment via admin API
+				result, err := client.Deploy(ctx, deployDomain)
+				if err != nil {
+					return fmt.Errorf("failed to deploy: %w", err)
+				}
+				fmt.Println(styles.RenderSuccess(fmt.Sprintf("Deployed %s (container: %s)", deployDomain, result.ContainerID[:12])))
+				return nil
+			}
+			// Local deployment via signal
+			domain, err := app.SendDeploySignal(deployDomain)
 			if err != nil {
 				return err
 			}
-			fmt.Printf("Deploy signal sent for domain: %s\n", domain)
+			fmt.Println(styles.RenderSuccess(fmt.Sprintf("Deploy signal sent for domain: %s", domain)))
 			return nil
 		},
 	}

A internal/adapters/in/cli/local.go +97 -0

@@ -0,0 +1,97 @@
	1	+	// Package cli implements the CLI adapter for Gordon.
	2	+	package cli
	3	+
	4	+	import (
	5	+	"context"
	6	+	"fmt"
	7	+	"path/filepath"
	8	+
	9	+	"github.com/bnema/zerowrap"
	10	+	"github.com/spf13/viper"
	11	+
	12	+	"gordon/internal/adapters/out/domainsecrets"
	13	+	"gordon/internal/app"
	14	+	"gordon/internal/boundaries/in"
	15	+	"gordon/internal/usecase/config"
	16	+	secretsSvc "gordon/internal/usecase/secrets"
	17	+	)
	18	+
	19	+	// LocalServices provides direct access to local services for CLI operations.
	20	+	type LocalServices struct {
	21	+	configSvc in.ConfigService
	22	+	secretSvc in.SecretService
	23	+	dataDir string
	24	+	}
	25	+
	26	+	// GetConfigService returns the config service.
	27	+	func (l *LocalServices) GetConfigService() in.ConfigService {
	28	+	return l.configSvc
	29	+	}
	30	+
	31	+	// GetSecretService returns the secret service.
	32	+	func (l *LocalServices) GetSecretService() in.SecretService {
	33	+	return l.secretSvc
	34	+	}
	35	+
	36	+	// GetDataDir returns the data directory.
	37	+	func (l *LocalServices) GetDataDir() string {
	38	+	return l.dataDir
	39	+	}
	40	+
	41	+	// GetLocalServices creates local services for CLI operations.
	42	+	// It loads the config and initializes services without starting the server.
	43	+	func GetLocalServices(configPath string) (*LocalServices, error) {
	44	+	// Set up viper with defaults
	45	+	v := viper.New()
	46	+	v.SetDefault("server.port", 80)
	47	+	v.SetDefault("server.registry_port", 5000)
	48	+	v.SetDefault("server.data_dir", app.DefaultDataDir())
	49	+
	50	+	// Configure viper with config file paths
	51	+	app.ConfigureViper(v, configPath)
	52	+
	53	+	// Read config file
	54	+	if err := v.ReadInConfig(); err != nil {
	55	+	if _, ok := err.(viper.ConfigFileNotFoundError); !ok {
	56	+	return nil, fmt.Errorf("failed to read config file: %w", err)
	57	+	}
	58	+	// Config file not found is OK for some operations
	59	+	}
	60	+
	61	+	// Create a minimal logger for CLI operations
	62	+	log := zerowrap.New(zerowrap.Config{
	63	+	Level: "warn",
	64	+	Format: "console",
	65	+	})
	66	+
	67	+	// Create config service (without event bus for CLI operations)
	68	+	configSvc := config.NewService(v, nil)
	69	+	ctx := context.Background()
	70	+	if err := configSvc.Load(ctx); err != nil {
	71	+	return nil, fmt.Errorf("failed to load configuration: %w", err)
	72	+	}
	73	+
	74	+	// Determine data directory and env directory
	75	+	dataDir := v.GetString("server.data_dir")
	76	+	if dataDir == "" {
	77	+	dataDir = app.DefaultDataDir()
	78	+	}
	79	+
	80	+	envDir := v.GetString("env.dir")
	81	+	if envDir == "" {
	82	+	envDir = filepath.Join(dataDir, "env")
	83	+	}
	84	+
	85	+	// Create domain secret store and service
	86	+	domainSecretStore, err := domainsecrets.NewFileStore(envDir, log)
	87	+	if err != nil {
	88	+	return nil, fmt.Errorf("failed to create domain secret store: %w", err)
	89	+	}
	90	+	secretSvc := secretsSvc.NewService(domainSecretStore, log)
	91	+
	92	+	return &LocalServices{
	93	+	configSvc: configSvc,
	94	+	secretSvc: secretSvc,
	95	+	dataDir: dataDir,
	96	+	}, nil
	97	+	}

@@ -0,0 +1,97 @@
	1	+	// Package cli implements the CLI adapter for Gordon.
	2	+	package cli
	3	+
	4	+	import (
	5	+	"context"
	6	+	"fmt"
	7	+	"path/filepath"
	8	+
	9	+	"github.com/bnema/zerowrap"
	10	+	"github.com/spf13/viper"
	11	+
	12	+	"gordon/internal/adapters/out/domainsecrets"
	13	+	"gordon/internal/app"
	14	+	"gordon/internal/boundaries/in"
	15	+	"gordon/internal/usecase/config"
	16	+	secretsSvc "gordon/internal/usecase/secrets"
	17	+	)
	18	+
	19	+	// LocalServices provides direct access to local services for CLI operations.
	20	+	type LocalServices struct {
	21	+	configSvc in.ConfigService
	22	+	secretSvc in.SecretService
	23	+	dataDir string
	24	+	}
	25	+
	26	+	// GetConfigService returns the config service.
	27	+	func (l *LocalServices) GetConfigService() in.ConfigService {
	28	+	return l.configSvc
	29	+	}
	30	+
	31	+	// GetSecretService returns the secret service.
	32	+	func (l *LocalServices) GetSecretService() in.SecretService {
	33	+	return l.secretSvc
	34	+	}
	35	+
	36	+	// GetDataDir returns the data directory.
	37	+	func (l *LocalServices) GetDataDir() string {
	38	+	return l.dataDir
	39	+	}
	40	+
	41	+	// GetLocalServices creates local services for CLI operations.
	42	+	// It loads the config and initializes services without starting the server.
	43	+	func GetLocalServices(configPath string) (*LocalServices, error) {
	44	+	// Set up viper with defaults
	45	+	v := viper.New()
	46	+	v.SetDefault("server.port", 80)
	47	+	v.SetDefault("server.registry_port", 5000)
	48	+	v.SetDefault("server.data_dir", app.DefaultDataDir())
	49	+
	50	+	// Configure viper with config file paths
	51	+	app.ConfigureViper(v, configPath)
	52	+
	53	+	// Read config file
	54	+	if err := v.ReadInConfig(); err != nil {
	55	+	if _, ok := err.(viper.ConfigFileNotFoundError); !ok {
	56	+	return nil, fmt.Errorf("failed to read config file: %w", err)
	57	+	}
	58	+	// Config file not found is OK for some operations
	59	+	}
	60	+
	61	+	// Create a minimal logger for CLI operations
	62	+	log := zerowrap.New(zerowrap.Config{
	63	+	Level: "warn",
	64	+	Format: "console",
	65	+	})
	66	+
	67	+	// Create config service (without event bus for CLI operations)
	68	+	configSvc := config.NewService(v, nil)
	69	+	ctx := context.Background()
	70	+	if err := configSvc.Load(ctx); err != nil {
	71	+	return nil, fmt.Errorf("failed to load configuration: %w", err)
	72	+	}
	73	+
	74	+	// Determine data directory and env directory
	75	+	dataDir := v.GetString("server.data_dir")
	76	+	if dataDir == "" {
	77	+	dataDir = app.DefaultDataDir()
	78	+	}
	79	+
	80	+	envDir := v.GetString("env.dir")
	81	+	if envDir == "" {
	82	+	envDir = filepath.Join(dataDir, "env")
	83	+	}
	84	+
	85	+	// Create domain secret store and service
	86	+	domainSecretStore, err := domainsecrets.NewFileStore(envDir, log)
	87	+	if err != nil {
	88	+	return nil, fmt.Errorf("failed to create domain secret store: %w", err)
	89	+	}
	90	+	secretSvc := secretsSvc.NewService(domainSecretStore, log)
	91	+
	92	+	return &LocalServices{
	93	+	configSvc: configSvc,
	94	+	secretSvc: secretSvc,
	95	+	dataDir: dataDir,
	96	+	}, nil
	97	+	}

M internal/adapters/in/cli/remote/client.go +158 -0


@@ -319,3 +319,161 @@ func (c *Client) Ping(ctx context.Context) error {
319	319		_, err := c.GetStatus(ctx)
320	320		return err
321	321		}
	322	+
	323	+	// Deploy API
	324	+
	325	+	// DeployResult contains the result of a deployment.
	326	+	type DeployResult struct {
	327	+	Status string `json:"status"`
	328	+	ContainerID string `json:"container_id"`
	329	+	Domain string `json:"domain"`
	330	+	}
	331	+
	332	+	// Deploy triggers a deployment for the specified domain.
	333	+	func (c Client) Deploy(ctx context.Context, deployDomain string) (DeployResult, error) {
	334	+	resp, err := c.request(ctx, http.MethodPost, "/deploy/"+deployDomain, nil)
	335	+	if err != nil {
	336	+	return nil, err
	337	+	}
	338	+
	339	+	var result DeployResult
	340	+	if err := parseResponse(resp, &result); err != nil {
	341	+	return nil, err
	342	+	}
	343	+
	344	+	return &result, nil
	345	+	}
	346	+
	347	+	// Logs API
	348	+
	349	+	// GetProcessLogs returns Gordon process logs.
	350	+	func (c *Client) GetProcessLogs(ctx context.Context, lines int) ([]string, error) {
	351	+	path := fmt.Sprintf("/logs?lines=%d", lines)
	352	+	resp, err := c.request(ctx, http.MethodGet, path, nil)
	353	+	if err != nil {
	354	+	return nil, err
	355	+	}
	356	+
	357	+	var result struct {
	358	+	Lines []string `json:"lines"`
	359	+	}
	360	+	if err := parseResponse(resp, &result); err != nil {
	361	+	return nil, err
	362	+	}
	363	+
	364	+	return result.Lines, nil
	365	+	}
	366	+
	367	+	// GetContainerLogs returns container logs for a specific domain.
	368	+	func (c *Client) GetContainerLogs(ctx context.Context, logDomain string, lines int) ([]string, error) {
	369	+	path := fmt.Sprintf("/logs/%s?lines=%d", logDomain, lines)
	370	+	resp, err := c.request(ctx, http.MethodGet, path, nil)
	371	+	if err != nil {
	372	+	return nil, err
	373	+	}
	374	+
	375	+	var result struct {
	376	+	Domain string `json:"domain"`
	377	+	Lines []string `json:"lines"`
	378	+	}
	379	+	if err := parseResponse(resp, &result); err != nil {
	380	+	return nil, err
	381	+	}
	382	+
	383	+	return result.Lines, nil
	384	+	}
	385	+
	386	+	// StreamProcessLogs returns a channel that streams Gordon process log lines via SSE.
	387	+	// The caller is responsible for reading from the channel until it's closed.
	388	+	func (c *Client) StreamProcessLogs(ctx context.Context, lines int) (<-chan string, error) {
	389	+	path := fmt.Sprintf("/logs?lines=%d&follow=true", lines)
	390	+	return c.streamLogs(ctx, path)
	391	+	}
	392	+
	393	+	// StreamContainerLogs returns a channel that streams container log lines via SSE.
	394	+	// The caller is responsible for reading from the channel until it's closed.
	395	+	func (c *Client) StreamContainerLogs(ctx context.Context, logDomain string, lines int) (<-chan string, error) {
	396	+	path := fmt.Sprintf("/logs/%s?lines=%d&follow=true", logDomain, lines)
	397	+	return c.streamLogs(ctx, path)
	398	+	}
	399	+
	400	+	// streamLogs handles SSE streaming for log endpoints.
	401	+	func (c *Client) streamLogs(ctx context.Context, path string) (<-chan string, error) {
	402	+	url := c.baseURL + "/admin" + path
	403	+
	404	+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
	405	+	if err != nil {
	406	+	return nil, fmt.Errorf("failed to create request: %w", err)
	407	+	}
	408	+
	409	+	req.Header.Set("Accept", "text/event-stream")
	410	+	if c.token != "" {
	411	+	req.Header.Set("Authorization", "Bearer "+c.token)
	412	+	}
	413	+
	414	+	// Use a client without timeout for streaming
	415	+	streamClient := &http.Client{}
	416	+	resp, err := streamClient.Do(req)
	417	+	if err != nil {
	418	+	return nil, fmt.Errorf("failed to connect: %w", err)
	419	+	}
	420	+
	421	+	if resp.StatusCode >= 400 {
	422	+	body, _ := io.ReadAll(resp.Body)
	423	+	resp.Body.Close()
	424	+	return nil, fmt.Errorf("%s: %s", resp.Status, string(body))
	425	+	}
	426	+
	427	+	ch := make(chan string, 100)
	428	+
	429	+	go func() {
	430	+	defer close(ch)
	431	+	defer resp.Body.Close()
	432	+
	433	+	buf := make([]byte, 4096)
	434	+	var lineBuffer strings.Builder
	435	+
	436	+	for {
	437	+	select {
	438	+	case <-ctx.Done():
	439	+	return
	440	+	default:
	441	+	}
	442	+
	443	+	n, err := resp.Body.Read(buf)
	444	+	if err != nil {
	445	+	// EOF is expected when stream ends, other errors are ignored
	446	+	return
	447	+	}
	448	+
	449	+	lineBuffer.Write(buf[:n])
	450	+
	451	+	// Process complete SSE events
	452	+	for {
	453	+	data := lineBuffer.String()
	454	+	idx := strings.Index(data, "\n\n")
	455	+	if idx == -1 {
	456	+	break
	457	+	}
	458	+
	459	+	event := data[:idx]
	460	+	lineBuffer.Reset()
	461	+	lineBuffer.WriteString(data[idx+2:])
	462	+
	463	+	// Parse SSE data lines
	464	+	for _, line := range strings.Split(event, "\n") {
	465	+	if strings.HasPrefix(line, "data: ") {
	466	+	logLine := strings.TrimPrefix(line, "data: ")
	467	+	select {
	468	+	case ch <- logLine:
	469	+	case <-ctx.Done():
	470	+	return
	471	+	}
	472	+	}
	473	+	}
	474	+	}
	475	+	}
	476	+	}()
	477	+
	478	+	return ch, nil
	479	+	}


@@ -319,3 +319,161 @@ func (c *Client) Ping(ctx context.Context) error {
319	_, err := c.GetStatus(ctx)	319		_, err := c.GetStatus(ctx)
320	return err	320		return err
321	}	321		}
		322	+
		323	+	// Deploy API
		324	+
		325	+	// DeployResult contains the result of a deployment.
		326	+	type DeployResult struct {
		327	+	Status string `json:"status"`
		328	+	ContainerID string `json:"container_id"`
		329	+	Domain string `json:"domain"`
		330	+	}
		331	+
		332	+	// Deploy triggers a deployment for the specified domain.
		333	+	func (c Client) Deploy(ctx context.Context, deployDomain string) (DeployResult, error) {
		334	+	resp, err := c.request(ctx, http.MethodPost, "/deploy/"+deployDomain, nil)
		335	+	if err != nil {
		336	+	return nil, err
		337	+	}
		338	+
		339	+	var result DeployResult
		340	+	if err := parseResponse(resp, &result); err != nil {
		341	+	return nil, err
		342	+	}
		343	+
		344	+	return &result, nil
		345	+	}
		346	+
		347	+	// Logs API
		348	+
		349	+	// GetProcessLogs returns Gordon process logs.
		350	+	func (c *Client) GetProcessLogs(ctx context.Context, lines int) ([]string, error) {
		351	+	path := fmt.Sprintf("/logs?lines=%d", lines)
		352	+	resp, err := c.request(ctx, http.MethodGet, path, nil)
		353	+	if err != nil {
		354	+	return nil, err
		355	+	}
		356	+
		357	+	var result struct {
		358	+	Lines []string `json:"lines"`
		359	+	}
		360	+	if err := parseResponse(resp, &result); err != nil {
		361	+	return nil, err
		362	+	}
		363	+
		364	+	return result.Lines, nil
		365	+	}
		366	+
		367	+	// GetContainerLogs returns container logs for a specific domain.
		368	+	func (c *Client) GetContainerLogs(ctx context.Context, logDomain string, lines int) ([]string, error) {
		369	+	path := fmt.Sprintf("/logs/%s?lines=%d", logDomain, lines)
		370	+	resp, err := c.request(ctx, http.MethodGet, path, nil)
		371	+	if err != nil {
		372	+	return nil, err
		373	+	}
		374	+
		375	+	var result struct {
		376	+	Domain string `json:"domain"`
		377	+	Lines []string `json:"lines"`
		378	+	}
		379	+	if err := parseResponse(resp, &result); err != nil {
		380	+	return nil, err
		381	+	}
		382	+
		383	+	return result.Lines, nil
		384	+	}
		385	+
		386	+	// StreamProcessLogs returns a channel that streams Gordon process log lines via SSE.
		387	+	// The caller is responsible for reading from the channel until it's closed.
		388	+	func (c *Client) StreamProcessLogs(ctx context.Context, lines int) (<-chan string, error) {
		389	+	path := fmt.Sprintf("/logs?lines=%d&follow=true", lines)
		390	+	return c.streamLogs(ctx, path)
		391	+	}
		392	+
		393	+	// StreamContainerLogs returns a channel that streams container log lines via SSE.
		394	+	// The caller is responsible for reading from the channel until it's closed.
		395	+	func (c *Client) StreamContainerLogs(ctx context.Context, logDomain string, lines int) (<-chan string, error) {
		396	+	path := fmt.Sprintf("/logs/%s?lines=%d&follow=true", logDomain, lines)
		397	+	return c.streamLogs(ctx, path)
		398	+	}
		399	+
		400	+	// streamLogs handles SSE streaming for log endpoints.
		401	+	func (c *Client) streamLogs(ctx context.Context, path string) (<-chan string, error) {
		402	+	url := c.baseURL + "/admin" + path
		403	+
		404	+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
		405	+	if err != nil {
		406	+	return nil, fmt.Errorf("failed to create request: %w", err)
		407	+	}
		408	+
		409	+	req.Header.Set("Accept", "text/event-stream")
		410	+	if c.token != "" {
		411	+	req.Header.Set("Authorization", "Bearer "+c.token)
		412	+	}
		413	+
		414	+	// Use a client without timeout for streaming
		415	+	streamClient := &http.Client{}
		416	+	resp, err := streamClient.Do(req)
		417	+	if err != nil {
		418	+	return nil, fmt.Errorf("failed to connect: %w", err)
		419	+	}
		420	+
		421	+	if resp.StatusCode >= 400 {
		422	+	body, _ := io.ReadAll(resp.Body)
		423	+	resp.Body.Close()
		424	+	return nil, fmt.Errorf("%s: %s", resp.Status, string(body))
		425	+	}
		426	+
		427	+	ch := make(chan string, 100)
		428	+
		429	+	go func() {
		430	+	defer close(ch)
		431	+	defer resp.Body.Close()
		432	+
		433	+	buf := make([]byte, 4096)
		434	+	var lineBuffer strings.Builder
		435	+
		436	+	for {
		437	+	select {
		438	+	case <-ctx.Done():
		439	+	return
		440	+	default:
		441	+	}
		442	+
		443	+	n, err := resp.Body.Read(buf)
		444	+	if err != nil {
		445	+	// EOF is expected when stream ends, other errors are ignored
		446	+	return
		447	+	}
		448	+
		449	+	lineBuffer.Write(buf[:n])
		450	+
		451	+	// Process complete SSE events
		452	+	for {
		453	+	data := lineBuffer.String()
		454	+	idx := strings.Index(data, "\n\n")
		455	+	if idx == -1 {
		456	+	break
		457	+	}
		458	+
		459	+	event := data[:idx]
		460	+	lineBuffer.Reset()
		461	+	lineBuffer.WriteString(data[idx+2:])
		462	+
		463	+	// Parse SSE data lines
		464	+	for _, line := range strings.Split(event, "\n") {
		465	+	if strings.HasPrefix(line, "data: ") {
		466	+	logLine := strings.TrimPrefix(line, "data: ")
		467	+	select {
		468	+	case ch <- logLine:
		469	+	case <-ctx.Done():
		470	+	return
		471	+	}
		472	+	}
		473	+	}
		474	+	}
		475	+	}
		476	+	}()
		477	+
		478	+	return ch, nil
		479	+	}

M internal/adapters/in/cli/root.go +114 -10


@@ -3,10 +3,13 @@
3	3		package cli
4	4
5	5		import (
6		-	"gordon/internal/adapters/in/cli/remote"
7		-	"gordon/internal/app"
	6	+	"context"
	7	+	"fmt"
8	8
9	9		"github.com/spf13/cobra"
	10	+
	11	+	"gordon/internal/adapters/in/cli/remote"
	12	+	"gordon/internal/app"
10	13		)
11	14
12	15		var (

@@ -113,26 +116,127 @@ func runReload() error {
113	116		func newLogsCmd() *cobra.Command {
114	117		var follow bool
115	118		var lines int
116		-	var configPath string
	119	+	var logsConfigPath string
117	120
118	121		cmd := &cobra.Command{
119		-	Use: "logs",
120		-	Short: "Show Gordon process logs",
121		-	Long: `Shows logs from the Gordon process. By default reads from the log file
122		-	configured in config.toml. If file logging is not enabled, falls back to
123		-	journalctl (if running as a systemd service).`,
	122	+	Use: "logs [domain]",
	123	+	Short: "Show logs (Gordon process or container)",
	124	+	Long: `Shows logs from the Gordon process or a specific container.
	125	+
	126	+	Without a domain argument, shows Gordon process logs.
	127	+	With a domain argument, shows container logs for that domain.
	128	+
	129	+	Examples:
	130	+	gordon logs # Gordon process logs
	131	+	gordon logs -f # Follow process logs
	132	+	gordon logs myapp.local # Container logs for myapp.local
	133	+	gordon logs myapp.local -f # Follow container logs
	134	+
	135	+	Remote mode:
	136	+	gordon logs --remote https://gordon.mydomain.com --token $TOKEN
	137	+	gordon logs myapp.local --remote https://gordon.mydomain.com --token $TOKEN`,
	138	+	Args: cobra.MaximumNArgs(1),
124	139		RunE: func(cmd *cobra.Command, args []string) error {
125		-	return app.ShowLogs(configPath, follow, lines)
	140	+	logDomain := ""
	141	+	if len(args) > 0 {
	142	+	logDomain = args[0]
	143	+	}
	144	+	return runLogs(logsConfigPath, logDomain, follow, lines)
126	145		},
127	146		}
128	147
129		-	cmd.Flags().StringVarP(&configPath, "config", "c", "", "Path to config file")
	148	+	cmd.Flags().StringVarP(&logsConfigPath, "config", "c", "", "Path to config file")
130	149		cmd.Flags().BoolVarP(&follow, "follow", "f", false, "Follow log output")
131	150		cmd.Flags().IntVarP(&lines, "lines", "n", 50, "Number of lines to show")
132	151
133	152		return cmd
134	153		}
135	154
	155	+	// runLogs handles the logs command logic.
	156	+	func runLogs(logsConfigPath, logDomain string, follow bool, lines int) error {
	157	+	client, isRemote := GetRemoteClient()
	158	+	if isRemote {
	159	+	return runLogsRemote(client, logDomain, follow, lines)
	160	+	}
	161	+	return runLogsLocal(logsConfigPath, logDomain, follow, lines)
	162	+	}
	163	+
	164	+	// runLogsRemote fetches logs from a remote Gordon instance.
	165	+	func runLogsRemote(client *remote.Client, logDomain string, follow bool, lines int) error {
	166	+	ctx := context.Background()
	167	+
	168	+	if follow {
	169	+	return streamLogsRemote(ctx, client, logDomain, lines)
	170	+	}
	171	+
	172	+	if logDomain == "" {
	173	+	// Process logs
	174	+	logLines, err := client.GetProcessLogs(ctx, lines)
	175	+	if err != nil {
	176	+	return fmt.Errorf("failed to get process logs: %w", err)
	177	+	}
	178	+	for _, line := range logLines {
	179	+	fmt.Println(line)
	180	+	}
	181	+	} else {
	182	+	// Container logs
	183	+	logLines, err := client.GetContainerLogs(ctx, logDomain, lines)
	184	+	if err != nil {
	185	+	return fmt.Errorf("failed to get container logs: %w", err)
	186	+	}
	187	+	for _, line := range logLines {
	188	+	fmt.Println(line)
	189	+	}
	190	+	}
	191	+	return nil
	192	+	}
	193	+
	194	+	// streamLogsRemote streams logs from a remote Gordon instance.
	195	+	func streamLogsRemote(ctx context.Context, client *remote.Client, logDomain string, lines int) error {
	196	+	var ch <-chan string
	197	+	var err error
	198	+
	199	+	if logDomain == "" {
	200	+	ch, err = client.StreamProcessLogs(ctx, lines)
	201	+	} else {
	202	+	ch, err = client.StreamContainerLogs(ctx, logDomain, lines)
	203	+	}
	204	+	if err != nil {
	205	+	return fmt.Errorf("failed to stream logs: %w", err)
	206	+	}
	207	+
	208	+	for line := range ch {
	209	+	fmt.Println(line)
	210	+	}
	211	+	return nil
	212	+	}
	213	+
	214	+	// runLogsLocal shows logs from a local Gordon instance.
	215	+	func runLogsLocal(logsConfigPath, logDomain string, follow bool, lines int) error {
	216	+	if logDomain == "" {
	217	+	// Process logs - use existing app.ShowLogs
	218	+	return app.ShowLogs(logsConfigPath, follow, lines)
	219	+	}
	220	+
	221	+	// Container logs - use local services
	222	+	return showContainerLogsLocal(logsConfigPath, logDomain, follow, lines)
	223	+	}
	224	+
	225	+	// showContainerLogsLocal shows container logs using local Docker access.
	226	+	func showContainerLogsLocal(logsConfigPath, logDomain string, follow bool, lines int) error {
	227	+	// For local container logs, we need Docker access which requires
	228	+	// the runtime to be initialized. For now, suggest using remote mode
	229	+	// or direct docker logs command.
	230	+	fmt.Printf("Container logs for %s\n", logDomain)
	231	+	fmt.Println("To view container logs locally, use:")
	232	+	fmt.Printf(" docker logs --tail %d %s\n", lines, logDomain)
	233	+	if follow {
	234	+	fmt.Printf(" docker logs -f --tail %d %s\n", lines, logDomain)
	235	+	}
	236	+	fmt.Println("\nOr use remote mode to access logs via the admin API.")
	237	+	return nil
	238	+	}
	239	+
136	240		// SetVersionInfo sets the version information for the CLI.
137	241		func SetVersionInfo(version, commit, date string) {
138	242		Version = version


@@ -3,10 +3,13 @@
3		package cli	3		package cli
4			4
5		import (	5		import (
6	-	"gordon/internal/adapters/in/cli/remote"	6	+	"context"
7	-	"gordon/internal/app"	7	+	"fmt"
8			8
9		"github.com/spf13/cobra"	9		"github.com/spf13/cobra"
			10	+
			11	+	"gordon/internal/adapters/in/cli/remote"
			12	+	"gordon/internal/app"
10		)	13		)
11			14
12		var (	15		var (

@@ -113,26 +116,127 @@ func runReload() error {
113		func newLogsCmd() *cobra.Command {	116		func newLogsCmd() *cobra.Command {
114		var follow bool	117		var follow bool
115		var lines int	118		var lines int
116	-	var configPath string	119	+	var logsConfigPath string
117			120
118		cmd := &cobra.Command{	121		cmd := &cobra.Command{
119	-	Use: "logs",	122	+	Use: "logs [domain]",
120	-	Short: "Show Gordon process logs",	123	+	Short: "Show logs (Gordon process or container)",
121	-	Long: `Shows logs from the Gordon process. By default reads from the log file	124	+	Long: `Shows logs from the Gordon process or a specific container.
122	-	configured in config.toml. If file logging is not enabled, falls back to	125	+
123	-	journalctl (if running as a systemd service).`,	126	+	Without a domain argument, shows Gordon process logs.
			127	+	With a domain argument, shows container logs for that domain.
			128	+
			129	+	Examples:
			130	+	gordon logs # Gordon process logs
			131	+	gordon logs -f # Follow process logs
			132	+	gordon logs myapp.local # Container logs for myapp.local
			133	+	gordon logs myapp.local -f # Follow container logs
			134	+
			135	+	Remote mode:
			136	+	gordon logs --remote https://gordon.mydomain.com --token $TOKEN
			137	+	gordon logs myapp.local --remote https://gordon.mydomain.com --token $TOKEN`,
			138	+	Args: cobra.MaximumNArgs(1),
124		RunE: func(cmd *cobra.Command, args []string) error {	139		RunE: func(cmd *cobra.Command, args []string) error {
125	-	return app.ShowLogs(configPath, follow, lines)	140	+	logDomain := ""
			141	+	if len(args) > 0 {
			142	+	logDomain = args[0]
			143	+	}
			144	+	return runLogs(logsConfigPath, logDomain, follow, lines)
126		},	145		},
127		}	146		}
128			147
129	-	cmd.Flags().StringVarP(&configPath, "config", "c", "", "Path to config file")	148	+	cmd.Flags().StringVarP(&logsConfigPath, "config", "c", "", "Path to config file")
130		cmd.Flags().BoolVarP(&follow, "follow", "f", false, "Follow log output")	149		cmd.Flags().BoolVarP(&follow, "follow", "f", false, "Follow log output")
131		cmd.Flags().IntVarP(&lines, "lines", "n", 50, "Number of lines to show")	150		cmd.Flags().IntVarP(&lines, "lines", "n", 50, "Number of lines to show")
132			151
133		return cmd	152		return cmd
134		}	153		}
135			154
			155	+	// runLogs handles the logs command logic.
			156	+	func runLogs(logsConfigPath, logDomain string, follow bool, lines int) error {
			157	+	client, isRemote := GetRemoteClient()
			158	+	if isRemote {
			159	+	return runLogsRemote(client, logDomain, follow, lines)
			160	+	}
			161	+	return runLogsLocal(logsConfigPath, logDomain, follow, lines)
			162	+	}
			163	+
			164	+	// runLogsRemote fetches logs from a remote Gordon instance.
			165	+	func runLogsRemote(client *remote.Client, logDomain string, follow bool, lines int) error {
			166	+	ctx := context.Background()
			167	+
			168	+	if follow {
			169	+	return streamLogsRemote(ctx, client, logDomain, lines)
			170	+	}
			171	+
			172	+	if logDomain == "" {
			173	+	// Process logs
			174	+	logLines, err := client.GetProcessLogs(ctx, lines)
			175	+	if err != nil {
			176	+	return fmt.Errorf("failed to get process logs: %w", err)
			177	+	}
			178	+	for _, line := range logLines {
			179	+	fmt.Println(line)
			180	+	}
			181	+	} else {
			182	+	// Container logs
			183	+	logLines, err := client.GetContainerLogs(ctx, logDomain, lines)
			184	+	if err != nil {
			185	+	return fmt.Errorf("failed to get container logs: %w", err)
			186	+	}
			187	+	for _, line := range logLines {
			188	+	fmt.Println(line)
			189	+	}
			190	+	}
			191	+	return nil
			192	+	}
			193	+
			194	+	// streamLogsRemote streams logs from a remote Gordon instance.
			195	+	func streamLogsRemote(ctx context.Context, client *remote.Client, logDomain string, lines int) error {
			196	+	var ch <-chan string
			197	+	var err error
			198	+
			199	+	if logDomain == "" {
			200	+	ch, err = client.StreamProcessLogs(ctx, lines)
			201	+	} else {
			202	+	ch, err = client.StreamContainerLogs(ctx, logDomain, lines)
			203	+	}
			204	+	if err != nil {
			205	+	return fmt.Errorf("failed to stream logs: %w", err)
			206	+	}
			207	+
			208	+	for line := range ch {
			209	+	fmt.Println(line)
			210	+	}
			211	+	return nil
			212	+	}
			213	+
			214	+	// runLogsLocal shows logs from a local Gordon instance.
			215	+	func runLogsLocal(logsConfigPath, logDomain string, follow bool, lines int) error {
			216	+	if logDomain == "" {
			217	+	// Process logs - use existing app.ShowLogs
			218	+	return app.ShowLogs(logsConfigPath, follow, lines)
			219	+	}
			220	+
			221	+	// Container logs - use local services
			222	+	return showContainerLogsLocal(logsConfigPath, logDomain, follow, lines)
			223	+	}
			224	+
			225	+	// showContainerLogsLocal shows container logs using local Docker access.
			226	+	func showContainerLogsLocal(logsConfigPath, logDomain string, follow bool, lines int) error {
			227	+	// For local container logs, we need Docker access which requires
			228	+	// the runtime to be initialized. For now, suggest using remote mode
			229	+	// or direct docker logs command.
			230	+	fmt.Printf("Container logs for %s\n", logDomain)
			231	+	fmt.Println("To view container logs locally, use:")
			232	+	fmt.Printf(" docker logs --tail %d %s\n", lines, logDomain)
			233	+	if follow {
			234	+	fmt.Printf(" docker logs -f --tail %d %s\n", lines, logDomain)
			235	+	}
			236	+	fmt.Println("\nOr use remote mode to access logs via the admin API.")
			237	+	return nil
			238	+	}
			239	+
136		// SetVersionInfo sets the version information for the CLI.	240		// SetVersionInfo sets the version information for the CLI.
137		func SetVersionInfo(version, commit, date string) {	241		func SetVersionInfo(version, commit, date string) {
138		Version = version	242		Version = version

M internal/adapters/in/cli/routes.go +118 -65


@@ -14,6 +14,9 @@ import (
14	14		"github.com/spf13/cobra"
15	15		)
16	16
	17	+	// configPath is set by the root command
	18	+	var configPath string
	19	+
17	20		// truncateImage shortens long image references for display.
18	21		// For digests (image@sha256:...), shows first 12 chars of digest.
19	22		// For tags, truncates to maxLen with ellipsis if needed.

@@ -93,66 +96,106 @@ func newRoutesListCmd() *cobra.Command {
93	96		ctx := context.Background()
94	97
95	98		client, isRemote := GetRemoteClient()
96		-	if !isRemote {
97		-	fmt.Println(styles.RenderError("routes command requires --remote flag or GORDON_REMOTE env var"))
98		-	fmt.Println(styles.Theme.Muted.Render("Local route management is not yet supported. Use the config file directly."))
99		-	return nil
	99	+	if isRemote {
	100	+	return runRoutesListRemote(ctx, client)
100	101		}
	102	+	return runRoutesListLocal(ctx, configPath)
	103	+	},
	104	+	}
	105	+	}
101	106
102		-	routes, err := client.ListRoutes(ctx)
103		-	if err != nil {
104		-	return fmt.Errorf("failed to list routes: %w", err)
105		-	}
	107	+	// runRoutesListRemote lists routes from a remote Gordon instance.
	108	+	func runRoutesListRemote(ctx context.Context, client *remote.Client) error {
	109	+	routes, err := client.ListRoutes(ctx)
	110	+	if err != nil {
	111	+	return fmt.Errorf("failed to list routes: %w", err)
	112	+	}
106	113
107		-	if len(routes) == 0 {
108		-	fmt.Println(styles.Theme.Muted.Render("No routes configured"))
109		-	return nil
110		-	}
	114	+	if len(routes) == 0 {
	115	+	fmt.Println(styles.Theme.Muted.Render("No routes configured"))
	116	+	return nil
	117	+	}
111	118
112		-	// Get health status for each route (includes container status and HTTP probe)
113		-	health, _ := client.GetHealth(ctx)
114		-	if health == nil {
115		-	health = make(map[string]*remote.RouteHealth)
116		-	}
	119	+	// Get health status for each route (includes container status and HTTP probe)
	120	+	health, _ := client.GetHealth(ctx)
	121	+	if health == nil {
	122	+	health = make(map[string]*remote.RouteHealth)
	123	+	}
117	124
118		-	// Build table rows
119		-	const imageColWidth = 35
120		-	rows := make([][]string, len(routes))
121		-	for i, route := range routes {
122		-	routeHealth := health[route.Domain]
	125	+	// Build table rows
	126	+	const imageColWidth = 35
	127	+	rows := make([][]string, len(routes))
	128	+	for i, route := range routes {
	129	+	routeHealth := health[route.Domain]
123	130
124		-	// Container status column
125		-	containerStatus := "unknown"
126		-	if routeHealth != nil {
127		-	containerStatus = routeHealth.ContainerStatus
128		-	}
129		-	containerBadge := components.ContainerStatusBadge(containerStatus)
	131	+	// Container status column
	132	+	containerStatus := "unknown"
	133	+	if routeHealth != nil {
	134	+	containerStatus = routeHealth.ContainerStatus
	135	+	}
	136	+	containerBadge := components.ContainerStatusBadge(containerStatus)
130	137
131		-	// HTTP status column
132		-	httpStatus := formatHTTPStatus(routeHealth)
	138	+	// HTTP status column
	139	+	httpStatus := formatHTTPStatus(routeHealth)
133	140
134		-	displayImage := truncateImage(route.Image, imageColWidth)
135		-	rows[i] = []string{route.Domain, displayImage, containerBadge, httpStatus}
136		-	}
	141	+	displayImage := truncateImage(route.Image, imageColWidth)
	142	+	rows[i] = []string{route.Domain, displayImage, containerBadge, httpStatus}
	143	+	}
137	144
138		-	// Render table
139		-	table := components.NewTable(
140		-	components.WithColumns([]components.TableColumn{
141		-	{Title: "Domain", Width: 25},
142		-	{Title: "Image", Width: imageColWidth},
143		-	{Title: "Container", Width: 12},
144		-	{Title: "HTTP", Width: 14},
145		-	}),
146		-	components.WithRows(rows),
147		-	)
148		-
149		-	fmt.Println(styles.Theme.Title.Render("Routes"))
150		-	fmt.Println()
151		-	fmt.Println(table.View())
	145	+	// Render table
	146	+	table := components.NewTable(
	147	+	components.WithColumns([]components.TableColumn{
	148	+	{Title: "Domain", Width: 25},
	149	+	{Title: "Image", Width: imageColWidth},
	150	+	{Title: "Container", Width: 12},
	151	+	{Title: "HTTP", Width: 14},
	152	+	}),
	153	+	components.WithRows(rows),
	154	+	)
	155	+
	156	+	fmt.Println(styles.Theme.Title.Render("Routes"))
	157	+	fmt.Println()
	158	+	fmt.Println(table.View())
	159	+
	160	+	return nil
	161	+	}
152	162
153		-	return nil
154		-	},
	163	+	// runRoutesListLocal lists routes from local configuration.
	164	+	func runRoutesListLocal(ctx context.Context, cfgPath string) error {
	165	+	local, err := GetLocalServices(cfgPath)
	166	+	if err != nil {
	167	+	return fmt.Errorf("failed to initialize local services: %w", err)
	168	+	}
	169	+
	170	+	routes := local.GetConfigService().GetRoutes(ctx)
	171	+
	172	+	if len(routes) == 0 {
	173	+	fmt.Println(styles.Theme.Muted.Render("No routes configured"))
	174	+	return nil
155	175		}
	176	+
	177	+	// Build table rows (no health info in local mode)
	178	+	const imageColWidth = 45
	179	+	rows := make([][]string, len(routes))
	180	+	for i, route := range routes {
	181	+	displayImage := truncateImage(route.Image, imageColWidth)
	182	+	rows[i] = []string{route.Domain, displayImage}
	183	+	}
	184	+
	185	+	// Render table
	186	+	table := components.NewTable(
	187	+	components.WithColumns([]components.TableColumn{
	188	+	{Title: "Domain", Width: 30},
	189	+	{Title: "Image", Width: imageColWidth},
	190	+	}),
	191	+	components.WithRows(rows),
	192	+	)
	193	+
	194	+	fmt.Println(styles.Theme.Title.Render("Routes (local)"))
	195	+	fmt.Println()
	196	+	fmt.Println(table.View())
	197	+
	198	+	return nil
156	199		}
157	200
158	201		// newRoutesAddCmd creates the routes add command.

@@ -172,12 +215,6 @@ Examples:
172	215		ctx := context.Background()
173	216		routeDomain := args[0]
174	217
175		-	client, isRemote := GetRemoteClient()
176		-	if !isRemote {
177		-	fmt.Println(styles.RenderError("routes command requires --remote flag or GORDON_REMOTE env var"))
178		-	return nil
179		-	}
180		-
181	218		if image == "" {
182	219		fmt.Println(styles.RenderError("--image flag is required"))
183	220		return nil

@@ -188,8 +225,19 @@ Examples:
188	225		Image: image,
189	226		}
190	227
191		-	if err := client.AddRoute(ctx, route); err != nil {
192		-	return fmt.Errorf("failed to add route: %w", err)
	228	+	client, isRemote := GetRemoteClient()
	229	+	if isRemote {
	230	+	if err := client.AddRoute(ctx, route); err != nil {
	231	+	return fmt.Errorf("failed to add route: %w", err)
	232	+	}
	233	+	} else {
	234	+	local, err := GetLocalServices(configPath)
	235	+	if err != nil {
	236	+	return fmt.Errorf("failed to initialize local services: %w", err)
	237	+	}
	238	+	if err := local.GetConfigService().AddRoute(ctx, route); err != nil {
	239	+	return fmt.Errorf("failed to add route: %w", err)
	240	+	}
193	241		}
194	242
195	243		fmt.Println(styles.RenderSuccess(fmt.Sprintf("Route added: %s -> %s", routeDomain, image)))

@@ -220,12 +268,6 @@ Examples:
220	268		ctx := context.Background()
221	269		routeDomain := args[0]
222	270
223		-	client, isRemote := GetRemoteClient()
224		-	if !isRemote {
225		-	fmt.Println(styles.RenderError("routes command requires --remote flag or GORDON_REMOTE env var"))
226		-	return nil
227		-	}
228		-
229	271		// Confirm unless --force
230	272		if !force {
231	273		confirmed, err := components.RunConfirm(

@@ -241,8 +283,19 @@ Examples:
241	283		}
242	284		}
243	285
244		-	if err := client.RemoveRoute(ctx, routeDomain); err != nil {
245		-	return fmt.Errorf("failed to remove route: %w", err)
	286	+	client, isRemote := GetRemoteClient()
	287	+	if isRemote {
	288	+	if err := client.RemoveRoute(ctx, routeDomain); err != nil {
	289	+	return fmt.Errorf("failed to remove route: %w", err)
	290	+	}
	291	+	} else {
	292	+	local, err := GetLocalServices(configPath)
	293	+	if err != nil {
	294	+	return fmt.Errorf("failed to initialize local services: %w", err)
	295	+	}
	296	+	if err := local.GetConfigService().RemoveRoute(ctx, routeDomain); err != nil {
	297	+	return fmt.Errorf("failed to remove route: %w", err)
	298	+	}
246	299		}
247	300
248	301		fmt.Println(styles.RenderSuccess(fmt.Sprintf("Route removed: %s", routeDomain)))

 	"github.com/spf13/cobra"
 )
+// configPath is set by the root command
+var configPath string
 // truncateImage shortens long image references for display.
 // For digests (image@sha256:...), shows first 12 chars of digest.
 // For tags, truncates to maxLen with ellipsis if needed.
 			ctx := context.Background()
 			client, isRemote := GetRemoteClient()
-			if !isRemote {
+			if isRemote {
-				fmt.Println(styles.RenderError("routes command requires --remote flag or GORDON_REMOTE env var"))
+				return runRoutesListRemote(ctx, client)
-				fmt.Println(styles.Theme.Muted.Render("Local route management is not yet supported. Use the config file directly."))
-				return nil
 			}
+			return runRoutesListLocal(ctx, configPath)
+		},
+	}
+}
-			routes, err := client.ListRoutes(ctx)
+// runRoutesListRemote lists routes from a remote Gordon instance.
-			if err != nil {
+func runRoutesListRemote(ctx context.Context, client *remote.Client) error {
-				return fmt.Errorf("failed to list routes: %w", err)
+	routes, err := client.ListRoutes(ctx)
-			}
+	if err != nil {
+		return fmt.Errorf("failed to list routes: %w", err)
+	}
-			if len(routes) == 0 {
+	if len(routes) == 0 {
-				fmt.Println(styles.Theme.Muted.Render("No routes configured"))
+		fmt.Println(styles.Theme.Muted.Render("No routes configured"))
-				return nil
+		return nil
-			}
+	}
-			// Get health status for each route (includes container status and HTTP probe)
+	// Get health status for each route (includes container status and HTTP probe)
-			health, _ := client.GetHealth(ctx)
+	health, _ := client.GetHealth(ctx)
-			if health == nil {
+	if health == nil {
-				health = make(map[string]*remote.RouteHealth)
+		health = make(map[string]*remote.RouteHealth)
-			}
+	}
-			// Build table rows
+	// Build table rows
-			const imageColWidth = 35
+	const imageColWidth = 35
-			rows := make([][]string, len(routes))
+	rows := make([][]string, len(routes))
-			for i, route := range routes {
+	for i, route := range routes {
-				routeHealth := health[route.Domain]
+		routeHealth := health[route.Domain]
-				// Container status column
+		// Container status column
-				containerStatus := "unknown"
+		containerStatus := "unknown"
-				if routeHealth != nil {
+		if routeHealth != nil {
-					containerStatus = routeHealth.ContainerStatus
+			containerStatus = routeHealth.ContainerStatus
-				}
+		}
-				containerBadge := components.ContainerStatusBadge(containerStatus)
+		containerBadge := components.ContainerStatusBadge(containerStatus)
-				// HTTP status column
+		// HTTP status column
-				httpStatus := formatHTTPStatus(routeHealth)
+		httpStatus := formatHTTPStatus(routeHealth)
-				displayImage := truncateImage(route.Image, imageColWidth)
+		displayImage := truncateImage(route.Image, imageColWidth)
-				rows[i] = []string{route.Domain, displayImage, containerBadge, httpStatus}
+		rows[i] = []string{route.Domain, displayImage, containerBadge, httpStatus}
-			}
+	}
-			// Render table
+	// Render table
-			table := components.NewTable(
+	table := components.NewTable(
-				components.WithColumns([]components.TableColumn{
+		components.WithColumns([]components.TableColumn{
-					{Title: "Domain", Width: 25},
+			{Title: "Domain", Width: 25},
-					{Title: "Image", Width: imageColWidth},
+			{Title: "Image", Width: imageColWidth},
-					{Title: "Container", Width: 12},
+			{Title: "Container", Width: 12},
-					{Title: "HTTP", Width: 14},
+			{Title: "HTTP", Width: 14},
-				}),
+		}),
-				components.WithRows(rows),
+		components.WithRows(rows),
-			)
+	)
-			fmt.Println(styles.Theme.Title.Render("Routes"))
+	fmt.Println(styles.Theme.Title.Render("Routes"))
-			fmt.Println()
+	fmt.Println()
-			fmt.Println(table.View())
+	fmt.Println(table.View())
+	return nil
+}
-			return nil
+// runRoutesListLocal lists routes from local configuration.
-		},
+func runRoutesListLocal(ctx context.Context, cfgPath string) error {
+	local, err := GetLocalServices(cfgPath)
+	if err != nil {
+		return fmt.Errorf("failed to initialize local services: %w", err)
+	}
+	routes := local.GetConfigService().GetRoutes(ctx)
+	if len(routes) == 0 {
+		fmt.Println(styles.Theme.Muted.Render("No routes configured"))
+		return nil
 	}
+	// Build table rows (no health info in local mode)
+	const imageColWidth = 45
+	rows := make([][]string, len(routes))
+	for i, route := range routes {
+		displayImage := truncateImage(route.Image, imageColWidth)
+		rows[i] = []string{route.Domain, displayImage}
+	}
+	// Render table
+	table := components.NewTable(
+		components.WithColumns([]components.TableColumn{
+			{Title: "Domain", Width: 30},
+			{Title: "Image", Width: imageColWidth},
+		}),
+		components.WithRows(rows),
+	)
+	fmt.Println(styles.Theme.Title.Render("Routes (local)"))
+	fmt.Println()
+	fmt.Println(table.View())
+	return nil
 }
 // newRoutesAddCmd creates the routes add command.
 			ctx := context.Background()
 			routeDomain := args[0]
-			client, isRemote := GetRemoteClient()
-			if !isRemote {
-				fmt.Println(styles.RenderError("routes command requires --remote flag or GORDON_REMOTE env var"))
-				return nil
-			}
 			if image == "" {
 				fmt.Println(styles.RenderError("--image flag is required"))
 				return nil
 				Image:  image,
 			}
-			if err := client.AddRoute(ctx, route); err != nil {
+			client, isRemote := GetRemoteClient()
-				return fmt.Errorf("failed to add route: %w", err)
+			if isRemote {
+				if err := client.AddRoute(ctx, route); err != nil {
+					return fmt.Errorf("failed to add route: %w", err)
+				}
+			} else {
+				local, err := GetLocalServices(configPath)
+				if err != nil {
+					return fmt.Errorf("failed to initialize local services: %w", err)
+				}
+				if err := local.GetConfigService().AddRoute(ctx, route); err != nil {
+					return fmt.Errorf("failed to add route: %w", err)
+				}
 			}
 			fmt.Println(styles.RenderSuccess(fmt.Sprintf("Route added: %s -> %s", routeDomain, image)))
 			ctx := context.Background()
 			routeDomain := args[0]
-			client, isRemote := GetRemoteClient()
-			if !isRemote {
-				fmt.Println(styles.RenderError("routes command requires --remote flag or GORDON_REMOTE env var"))
-				return nil
-			}
 			// Confirm unless --force
 			if !force {
 				confirmed, err := components.RunConfirm(
 				}
 			}
-			if err := client.RemoveRoute(ctx, routeDomain); err != nil {
+			client, isRemote := GetRemoteClient()
-				return fmt.Errorf("failed to remove route: %w", err)
+			if isRemote {
+				if err := client.RemoveRoute(ctx, routeDomain); err != nil {
+					return fmt.Errorf("failed to remove route: %w", err)
+				}
+			} else {
+				local, err := GetLocalServices(configPath)
+				if err != nil {
+					return fmt.Errorf("failed to initialize local services: %w", err)
+				}
+				if err := local.GetConfigService().RemoveRoute(ctx, routeDomain); err != nil {
+					return fmt.Errorf("failed to remove route: %w", err)
+				}
 			}
 			fmt.Println(styles.RenderSuccess(fmt.Sprintf("Route removed: %s", routeDomain)))

M internal/adapters/in/cli/secrets.go +48 -28


@@ -46,26 +46,36 @@ Examples:
46	46		Args: cobra.ExactArgs(1),
47	47		RunE: func(cmd *cobra.Command, args []string) error {
48	48		ctx := context.Background()
49		-	domain := args[0]
	49	+	secretDomain := args[0]
	50	+
	51	+	var keys []string
	52	+	var err error
50	53
51	54		client, isRemote := GetRemoteClient()
52		-	if !isRemote {
53		-	fmt.Println(styles.RenderError("secrets command requires --remote flag or GORDON_REMOTE env var"))
54		-	fmt.Println(styles.Theme.Muted.Render("Local secret management is not yet supported."))
55		-	return nil
	55	+	if isRemote {
	56	+	keys, err = client.ListSecrets(ctx, secretDomain)
	57	+	} else {
	58	+	local, localErr := GetLocalServices(configPath)
	59	+	if localErr != nil {
	60	+	return fmt.Errorf("failed to initialize local services: %w", localErr)
	61	+	}
	62	+	keys, err = local.GetSecretService().ListKeys(ctx, secretDomain)
56	63		}
57	64
58		-	keys, err := client.ListSecrets(ctx, domain)
59	65		if err != nil {
60	66		return fmt.Errorf("failed to list secrets: %w", err)
61	67		}
62	68
63	69		if len(keys) == 0 {
64		-	fmt.Println(styles.Theme.Muted.Render(fmt.Sprintf("No secrets configured for %s", domain)))
	70	+	fmt.Println(styles.Theme.Muted.Render(fmt.Sprintf("No secrets configured for %s", secretDomain)))
65	71		return nil
66	72		}
67	73
68		-	fmt.Println(styles.Theme.Title.Render(fmt.Sprintf("Secrets for %s", domain)))
	74	+	title := fmt.Sprintf("Secrets for %s", secretDomain)
	75	+	if !isRemote {
	76	+	title = fmt.Sprintf("Secrets for %s (local)", secretDomain)
	77	+	}
	78	+	fmt.Println(styles.Theme.Title.Render(title))
69	79		fmt.Println()
70	80
71	81		// Build table rows

@@ -106,15 +116,9 @@ Examples:
106	116		Args: cobra.MinimumNArgs(2),
107	117		RunE: func(cmd *cobra.Command, args []string) error {
108	118		ctx := context.Background()
109		-	domain := args[0]
	119	+	secretDomain := args[0]
110	120		pairs := args[1:]
111	121
112		-	client, isRemote := GetRemoteClient()
113		-	if !isRemote {
114		-	fmt.Println(styles.RenderError("secrets command requires --remote flag or GORDON_REMOTE env var"))
115		-	return nil
116		-	}
117		-
118	122		// Parse KEY=value pairs
119	123		secrets := make(map[string]string)
120	124		for _, pair := range pairs {

@@ -126,8 +130,19 @@ Examples:
126	130		secrets[parts[0]] = parts[1]
127	131		}
128	132
129		-	if err := client.SetSecrets(ctx, domain, secrets); err != nil {
130		-	return fmt.Errorf("failed to set secrets: %w", err)
	133	+	client, isRemote := GetRemoteClient()
	134	+	if isRemote {
	135	+	if err := client.SetSecrets(ctx, secretDomain, secrets); err != nil {
	136	+	return fmt.Errorf("failed to set secrets: %w", err)
	137	+	}
	138	+	} else {
	139	+	local, err := GetLocalServices(configPath)
	140	+	if err != nil {
	141	+	return fmt.Errorf("failed to initialize local services: %w", err)
	142	+	}
	143	+	if err := local.GetSecretService().Set(ctx, secretDomain, secrets); err != nil {
	144	+	return fmt.Errorf("failed to set secrets: %w", err)
	145	+	}
131	146		}
132	147
133	148		if len(secrets) == 1 {

@@ -135,7 +150,7 @@ Examples:
135	150		fmt.Println(styles.RenderSuccess(fmt.Sprintf("Secret set: %s", key)))
136	151		}
137	152		} else {
138		-	fmt.Println(styles.RenderSuccess(fmt.Sprintf("Set %d secrets for %s", len(secrets), domain)))
	153	+	fmt.Println(styles.RenderSuccess(fmt.Sprintf("Set %d secrets for %s", len(secrets), secretDomain)))
139	154		}
140	155
141	156		return nil

@@ -158,19 +173,13 @@ Examples:
158	173		Args: cobra.ExactArgs(2),
159	174		RunE: func(cmd *cobra.Command, args []string) error {
160	175		ctx := context.Background()
161		-	domain := args[0]
	176	+	secretDomain := args[0]
162	177		key := args[1]
163	178
164		-	client, isRemote := GetRemoteClient()
165		-	if !isRemote {
166		-	fmt.Println(styles.RenderError("secrets command requires --remote flag or GORDON_REMOTE env var"))
167		-	return nil
168		-	}
169		-
170	179		// Confirm unless --force
171	180		if !force {
172	181		confirmed, err := components.RunConfirm(
173		-	fmt.Sprintf("Remove secret '%s' from %s?", key, domain),
	182	+	fmt.Sprintf("Remove secret '%s' from %s?", key, secretDomain),
174	183		)
175	184		if err != nil {
176	185		return err

@@ -181,8 +190,19 @@ Examples:
181	190		}
182	191		}
183	192
184		-	if err := client.DeleteSecret(ctx, domain, key); err != nil {
185		-	return fmt.Errorf("failed to remove secret: %w", err)
	193	+	client, isRemote := GetRemoteClient()
	194	+	if isRemote {
	195	+	if err := client.DeleteSecret(ctx, secretDomain, key); err != nil {
	196	+	return fmt.Errorf("failed to remove secret: %w", err)
	197	+	}
	198	+	} else {
	199	+	local, err := GetLocalServices(configPath)
	200	+	if err != nil {
	201	+	return fmt.Errorf("failed to initialize local services: %w", err)
	202	+	}
	203	+	if err := local.GetSecretService().Delete(ctx, secretDomain, key); err != nil {
	204	+	return fmt.Errorf("failed to remove secret: %w", err)
	205	+	}
186	206		}
187	207
188	208		fmt.Println(styles.RenderSuccess(fmt.Sprintf("Secret removed: %s", key)))

 		Args: cobra.ExactArgs(1),
 		RunE: func(cmd *cobra.Command, args []string) error {
 			ctx := context.Background()
-			domain := args[0]
+			secretDomain := args[0]
+			var keys []string
+			var err error
 			client, isRemote := GetRemoteClient()
-			if !isRemote {
+			if isRemote {
-				fmt.Println(styles.RenderError("secrets command requires --remote flag or GORDON_REMOTE env var"))
+				keys, err = client.ListSecrets(ctx, secretDomain)
-				fmt.Println(styles.Theme.Muted.Render("Local secret management is not yet supported."))
+			} else {
-				return nil
+				local, localErr := GetLocalServices(configPath)
+				if localErr != nil {
+					return fmt.Errorf("failed to initialize local services: %w", localErr)
+				}
+				keys, err = local.GetSecretService().ListKeys(ctx, secretDomain)
 			}
-			keys, err := client.ListSecrets(ctx, domain)
 			if err != nil {
 				return fmt.Errorf("failed to list secrets: %w", err)
 			}
 			if len(keys) == 0 {
-				fmt.Println(styles.Theme.Muted.Render(fmt.Sprintf("No secrets configured for %s", domain)))
+				fmt.Println(styles.Theme.Muted.Render(fmt.Sprintf("No secrets configured for %s", secretDomain)))
 				return nil
 			}
-			fmt.Println(styles.Theme.Title.Render(fmt.Sprintf("Secrets for %s", domain)))
+			title := fmt.Sprintf("Secrets for %s", secretDomain)
+			if !isRemote {
+				title = fmt.Sprintf("Secrets for %s (local)", secretDomain)
+			}
+			fmt.Println(styles.Theme.Title.Render(title))
 			fmt.Println()
 			// Build table rows
 		Args: cobra.MinimumNArgs(2),
 		RunE: func(cmd *cobra.Command, args []string) error {
 			ctx := context.Background()
-			domain := args[0]
+			secretDomain := args[0]
 			pairs := args[1:]
-			client, isRemote := GetRemoteClient()
-			if !isRemote {
-				fmt.Println(styles.RenderError("secrets command requires --remote flag or GORDON_REMOTE env var"))
-				return nil
-			}
 			// Parse KEY=value pairs
 			secrets := make(map[string]string)
 			for _, pair := range pairs {
 				secrets[parts[0]] = parts[1]
 			}
-			if err := client.SetSecrets(ctx, domain, secrets); err != nil {
+			client, isRemote := GetRemoteClient()
-				return fmt.Errorf("failed to set secrets: %w", err)
+			if isRemote {
+				if err := client.SetSecrets(ctx, secretDomain, secrets); err != nil {
+					return fmt.Errorf("failed to set secrets: %w", err)
+				}
+			} else {
+				local, err := GetLocalServices(configPath)
+				if err != nil {
+					return fmt.Errorf("failed to initialize local services: %w", err)
+				}
+				if err := local.GetSecretService().Set(ctx, secretDomain, secrets); err != nil {
+					return fmt.Errorf("failed to set secrets: %w", err)
+				}
 			}
 			if len(secrets) == 1 {
 					fmt.Println(styles.RenderSuccess(fmt.Sprintf("Secret set: %s", key)))
 				}
 			} else {
-				fmt.Println(styles.RenderSuccess(fmt.Sprintf("Set %d secrets for %s", len(secrets), domain)))
+				fmt.Println(styles.RenderSuccess(fmt.Sprintf("Set %d secrets for %s", len(secrets), secretDomain)))
 			}
 			return nil
 		Args: cobra.ExactArgs(2),
 		RunE: func(cmd *cobra.Command, args []string) error {
 			ctx := context.Background()
-			domain := args[0]
+			secretDomain := args[0]
 			key := args[1]
-			client, isRemote := GetRemoteClient()
-			if !isRemote {
-				fmt.Println(styles.RenderError("secrets command requires --remote flag or GORDON_REMOTE env var"))
-				return nil
-			}
 			// Confirm unless --force
 			if !force {
 				confirmed, err := components.RunConfirm(
-					fmt.Sprintf("Remove secret '%s' from %s?", key, domain),
+					fmt.Sprintf("Remove secret '%s' from %s?", key, secretDomain),
 				)
 				if err != nil {
 					return err
 				}
 			}
-			if err := client.DeleteSecret(ctx, domain, key); err != nil {
+			client, isRemote := GetRemoteClient()
-				return fmt.Errorf("failed to remove secret: %w", err)
+			if isRemote {
+				if err := client.DeleteSecret(ctx, secretDomain, key); err != nil {
+					return fmt.Errorf("failed to remove secret: %w", err)
+				}
+			} else {
+				local, err := GetLocalServices(configPath)
+				if err != nil {
+					return fmt.Errorf("failed to initialize local services: %w", err)
+				}
+				if err := local.GetSecretService().Delete(ctx, secretDomain, key); err != nil {
+					return fmt.Errorf("failed to remove secret: %w", err)
+				}
 			}
 			fmt.Println(styles.RenderSuccess(fmt.Sprintf("Secret removed: %s", key)))

M internal/adapters/in/http/admin/handler.go +234 -0


@@ -4,7 +4,9 @@ package admin
4	4		import (
5	5		"encoding/json"
6	6		"errors"
	7	+	"fmt"
7	8		"net/http"
	9	+	"strconv"
8	10		"strings"
9	11
10	12		"github.com/bnema/zerowrap"

@@ -24,6 +26,7 @@ type Handler struct {
24	26		containerSvc in.ContainerService
25	27		healthSvc in.HealthService
26	28		secretSvc in.SecretService
	29	+	logSvc in.LogService
27	30		eventBus out.EventPublisher
28	31		log zerowrap.Logger
29	32		}

@@ -35,6 +38,7 @@ func NewHandler(
35	38		containerSvc in.ContainerService,
36	39		healthSvc in.HealthService,
37	40		secretSvc in.SecretService,
	41	+	logSvc in.LogService,
38	42		eventBus out.EventPublisher,
39	43		log zerowrap.Logger,
40	44		) *Handler {

@@ -44,6 +48,7 @@ func NewHandler(
44	48		containerSvc: containerSvc,
45	49		healthSvc: healthSvc,
46	50		secretSvc: secretSvc,
	51	+	logSvc: logSvc,
47	52		eventBus: eventBus,
48	53		log: log,
49	54		}

@@ -77,6 +82,10 @@ func (h Handler) handleAdminRoutes(w http.ResponseWriter, r http.Request) {
77	82		h.handleRoutes(w, r, path)
78	83		case path == "/secrets" \|\| strings.HasPrefix(path, "/secrets/"):
79	84		h.handleSecrets(w, r, path)
	85	+	case path == "/deploy" \|\| strings.HasPrefix(path, "/deploy/"):
	86	+	h.handleDeploy(w, r, path)
	87	+	case path == "/logs" \|\| strings.HasPrefix(path, "/logs/"):
	88	+	h.handleLogs(w, r, path)
80	89		case path == "/status":
81	90		h.handleStatus(w, r)
82	91		case path == "/health":

@@ -484,3 +493,228 @@ func (h Handler) handleConfig(w http.ResponseWriter, r http.Request) {
484	493
485	494		h.sendJSON(w, http.StatusOK, config)
486	495		}
	496	+
	497	+	// handleDeploy handles /admin/deploy/:domain endpoint.
	498	+	// POST triggers a deployment for the specified domain.
	499	+	func (h Handler) handleDeploy(w http.ResponseWriter, r http.Request, path string) {
	500	+	if r.Method != http.MethodPost {
	501	+	http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
	502	+	return
	503	+	}
	504	+
	505	+	ctx := r.Context()
	506	+	log := zerowrap.FromCtx(ctx)
	507	+
	508	+	// Check write permission
	509	+	if !HasAccess(ctx, domain.AdminResourceConfig, domain.AdminActionWrite) {
	510	+	h.sendError(w, http.StatusForbidden, "insufficient permissions for config:write")
	511	+	return
	512	+	}
	513	+
	514	+	// Parse domain from path
	515	+	deployDomain := strings.TrimPrefix(path, "/deploy/")
	516	+	if deployDomain == "" \|\| deployDomain == "/deploy" {
	517	+	h.sendError(w, http.StatusBadRequest, "domain required in path")
	518	+	return
	519	+	}
	520	+
	521	+	// Get the route for this domain
	522	+	route, err := h.configSvc.GetRoute(ctx, deployDomain)
	523	+	if err != nil {
	524	+	h.sendError(w, http.StatusNotFound, "route not found")
	525	+	return
	526	+	}
	527	+
	528	+	// Deploy the container
	529	+	container, err := h.containerSvc.Deploy(ctx, *route)
	530	+	if err != nil {
	531	+	log.Error().Err(err).Str("domain", deployDomain).Msg("failed to deploy container")
	532	+	h.sendError(w, http.StatusInternalServerError, fmt.Sprintf("failed to deploy: %v", err))
	533	+	return
	534	+	}
	535	+
	536	+	log.Info().Str("domain", deployDomain).Str("container_id", container.ID).Msg("container deployed via admin API")
	537	+	h.sendJSON(w, http.StatusOK, map[string]any{
	538	+	"status": "deployed",
	539	+	"container_id": container.ID,
	540	+	"domain": deployDomain,
	541	+	})
	542	+	}
	543	+
	544	+	// handleLogs handles /admin/logs endpoints.
	545	+	// GET /admin/logs - Gordon process logs
	546	+	// GET /admin/logs/:domain - Container logs for a specific domain
	547	+	func (h Handler) handleLogs(w http.ResponseWriter, r http.Request, path string) {
	548	+	if r.Method != http.MethodGet {
	549	+	http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
	550	+	return
	551	+	}
	552	+
	553	+	ctx := r.Context()
	554	+	log := zerowrap.FromCtx(ctx)
	555	+
	556	+	// Check read permission
	557	+	if !HasAccess(ctx, domain.AdminResourceStatus, domain.AdminActionRead) {
	558	+	h.sendError(w, http.StatusForbidden, "insufficient permissions for status:read")
	559	+	return
	560	+	}
	561	+
	562	+	// Check if LogService is available
	563	+	if h.logSvc == nil {
	564	+	h.sendError(w, http.StatusServiceUnavailable, "log service not available")
	565	+	return
	566	+	}
	567	+
	568	+	// Parse query parameters
	569	+	lines := 50 // default
	570	+	if linesStr := r.URL.Query().Get("lines"); linesStr != "" {
	571	+	if n, err := strconv.Atoi(linesStr); err == nil && n > 0 {
	572	+	lines = n
	573	+	}
	574	+	}
	575	+	follow := r.URL.Query().Get("follow") == "true"
	576	+
	577	+	// Parse domain from path
	578	+	logDomain := strings.TrimPrefix(path, "/logs/")
	579	+	if logDomain == "/logs" {
	580	+	logDomain = ""
	581	+	}
	582	+
	583	+	if logDomain == "" {
	584	+	// Gordon process logs
	585	+	h.handleProcessLogs(w, r, lines, follow)
	586	+	} else {
	587	+	// Container logs
	588	+	h.handleContainerLogs(w, r, logDomain, lines, follow)
	589	+	}
	590	+
	591	+	// Prevent unused variable warning when follow is implemented
	592	+	_ = log
	593	+	}
	594	+
	595	+	// handleProcessLogs handles Gordon process logs.
	596	+	func (h Handler) handleProcessLogs(w http.ResponseWriter, r http.Request, lines int, follow bool) {
	597	+	ctx := r.Context()
	598	+	log := zerowrap.FromCtx(ctx)
	599	+
	600	+	if follow {
	601	+	// SSE streaming
	602	+	h.streamProcessLogs(w, r, lines)
	603	+	return
	604	+	}
	605	+
	606	+	// Return last N lines as JSON
	607	+	logLines, err := h.logSvc.GetProcessLogs(ctx, lines)
	608	+	if err != nil {
	609	+	log.Warn().Err(err).Msg("failed to get process logs")
	610	+	h.sendError(w, http.StatusInternalServerError, "failed to get logs")
	611	+	return
	612	+	}
	613	+
	614	+	h.sendJSON(w, http.StatusOK, map[string]any{
	615	+	"lines": logLines,
	616	+	})
	617	+	}
	618	+
	619	+	// handleContainerLogs handles container logs for a specific domain.
	620	+	func (h Handler) handleContainerLogs(w http.ResponseWriter, r http.Request, logDomain string, lines int, follow bool) {
	621	+	ctx := r.Context()
	622	+	log := zerowrap.FromCtx(ctx)
	623	+
	624	+	if follow {
	625	+	// SSE streaming
	626	+	h.streamContainerLogs(w, r, logDomain, lines)
	627	+	return
	628	+	}
	629	+
	630	+	// Return last N lines as JSON
	631	+	logLines, err := h.logSvc.GetContainerLogs(ctx, logDomain, lines)
	632	+	if err != nil {
	633	+	log.Warn().Err(err).Str("domain", logDomain).Msg("failed to get container logs")
	634	+	h.sendError(w, http.StatusInternalServerError, fmt.Sprintf("failed to get logs: %v", err))
	635	+	return
	636	+	}
	637	+
	638	+	h.sendJSON(w, http.StatusOK, map[string]any{
	639	+	"domain": logDomain,
	640	+	"lines": logLines,
	641	+	})
	642	+	}
	643	+
	644	+	// streamProcessLogs streams Gordon process logs via SSE.
	645	+	func (h Handler) streamProcessLogs(w http.ResponseWriter, r http.Request, lines int) {
	646	+	ctx := r.Context()
	647	+	log := zerowrap.FromCtx(ctx)
	648	+
	649	+	// Set up SSE
	650	+	w.Header().Set("Content-Type", "text/event-stream")
	651	+	w.Header().Set("Cache-Control", "no-cache")
	652	+	w.Header().Set("Connection", "keep-alive")
	653	+	w.WriteHeader(http.StatusOK)
	654	+
	655	+	flusher, ok := w.(http.Flusher)
	656	+	if !ok {
	657	+	h.sendError(w, http.StatusInternalServerError, "streaming not supported")
	658	+	return
	659	+	}
	660	+
	661	+	ch, err := h.logSvc.FollowProcessLogs(ctx, lines)
	662	+	if err != nil {
	663	+	log.Warn().Err(err).Msg("failed to follow process logs")
	664	+	_, _ = fmt.Fprintf(w, "event: error\ndata: %s\n\n", err.Error())
	665	+	flusher.Flush()
	666	+	return
	667	+	}
	668	+
	669	+	for {
	670	+	select {
	671	+	case line, ok := <-ch:
	672	+	if !ok {
	673	+	return
	674	+	}
	675	+	_, _ = fmt.Fprintf(w, "data: %s\n\n", line)
	676	+	flusher.Flush()
	677	+	case <-ctx.Done():
	678	+	return
	679	+	}
	680	+	}
	681	+	}
	682	+
	683	+	// streamContainerLogs streams container logs via SSE.
	684	+	func (h Handler) streamContainerLogs(w http.ResponseWriter, r http.Request, logDomain string, lines int) {
	685	+	ctx := r.Context()
	686	+	log := zerowrap.FromCtx(ctx)
	687	+
	688	+	// Set up SSE
	689	+	w.Header().Set("Content-Type", "text/event-stream")
	690	+	w.Header().Set("Cache-Control", "no-cache")
	691	+	w.Header().Set("Connection", "keep-alive")
	692	+	w.WriteHeader(http.StatusOK)
	693	+
	694	+	flusher, ok := w.(http.Flusher)
	695	+	if !ok {
	696	+	h.sendError(w, http.StatusInternalServerError, "streaming not supported")
	697	+	return
	698	+	}
	699	+
	700	+	ch, err := h.logSvc.FollowContainerLogs(ctx, logDomain, lines)
	701	+	if err != nil {
	702	+	log.Warn().Err(err).Str("domain", logDomain).Msg("failed to follow container logs")
	703	+	_, _ = fmt.Fprintf(w, "event: error\ndata: %s\n\n", err.Error())
	704	+	flusher.Flush()
	705	+	return
	706	+	}
	707	+
	708	+	for {
	709	+	select {
	710	+	case line, ok := <-ch:
	711	+	if !ok {
	712	+	return
	713	+	}
	714	+	_, _ = fmt.Fprintf(w, "data: %s\n\n", line)
	715	+	flusher.Flush()
	716	+	case <-ctx.Done():
	717	+	return
	718	+	}
	719	+	}
	720	+	}


@@ -4,7 +4,9 @@ package admin
4	import (	4		import (
5	"encoding/json"	5		"encoding/json"
6	"errors"	6		"errors"
		7	+	"fmt"
7	"net/http"	8		"net/http"
		9	+	"strconv"
8	"strings"	10		"strings"
9		11
10	"github.com/bnema/zerowrap"	12		"github.com/bnema/zerowrap"

@@ -24,6 +26,7 @@ type Handler struct {
24	containerSvc in.ContainerService	26		containerSvc in.ContainerService
25	healthSvc in.HealthService	27		healthSvc in.HealthService
26	secretSvc in.SecretService	28		secretSvc in.SecretService
		29	+	logSvc in.LogService
27	eventBus out.EventPublisher	30		eventBus out.EventPublisher
28	log zerowrap.Logger	31		log zerowrap.Logger
29	}	32		}

@@ -35,6 +38,7 @@ func NewHandler(
35	containerSvc in.ContainerService,	38		containerSvc in.ContainerService,
36	healthSvc in.HealthService,	39		healthSvc in.HealthService,
37	secretSvc in.SecretService,	40		secretSvc in.SecretService,
		41	+	logSvc in.LogService,
38	eventBus out.EventPublisher,	42		eventBus out.EventPublisher,
39	log zerowrap.Logger,	43		log zerowrap.Logger,
40	) *Handler {	44		) *Handler {

@@ -44,6 +48,7 @@ func NewHandler(
44	containerSvc: containerSvc,	48		containerSvc: containerSvc,
45	healthSvc: healthSvc,	49		healthSvc: healthSvc,
46	secretSvc: secretSvc,	50		secretSvc: secretSvc,
		51	+	logSvc: logSvc,
47	eventBus: eventBus,	52		eventBus: eventBus,
48	log: log,	53		log: log,
49	}	54		}

@@ -77,6 +82,10 @@ func (h Handler) handleAdminRoutes(w http.ResponseWriter, r http.Request) {
77	h.handleRoutes(w, r, path)	82		h.handleRoutes(w, r, path)
78	case path == "/secrets" \|\| strings.HasPrefix(path, "/secrets/"):	83		case path == "/secrets" \|\| strings.HasPrefix(path, "/secrets/"):
79	h.handleSecrets(w, r, path)	84		h.handleSecrets(w, r, path)
		85	+	case path == "/deploy" \|\| strings.HasPrefix(path, "/deploy/"):
		86	+	h.handleDeploy(w, r, path)
		87	+	case path == "/logs" \|\| strings.HasPrefix(path, "/logs/"):
		88	+	h.handleLogs(w, r, path)
80	case path == "/status":	89		case path == "/status":
81	h.handleStatus(w, r)	90		h.handleStatus(w, r)
82	case path == "/health":	91		case path == "/health":

@@ -484,3 +493,228 @@ func (h Handler) handleConfig(w http.ResponseWriter, r http.Request) {
484		493
485	h.sendJSON(w, http.StatusOK, config)	494		h.sendJSON(w, http.StatusOK, config)
486	}	495		}
		496	+
		497	+	// handleDeploy handles /admin/deploy/:domain endpoint.
		498	+	// POST triggers a deployment for the specified domain.
		499	+	func (h Handler) handleDeploy(w http.ResponseWriter, r http.Request, path string) {
		500	+	if r.Method != http.MethodPost {
		501	+	http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
		502	+	return
		503	+	}
		504	+
		505	+	ctx := r.Context()
		506	+	log := zerowrap.FromCtx(ctx)
		507	+
		508	+	// Check write permission
		509	+	if !HasAccess(ctx, domain.AdminResourceConfig, domain.AdminActionWrite) {
		510	+	h.sendError(w, http.StatusForbidden, "insufficient permissions for config:write")
		511	+	return
		512	+	}
		513	+
		514	+	// Parse domain from path
		515	+	deployDomain := strings.TrimPrefix(path, "/deploy/")
		516	+	if deployDomain == "" \|\| deployDomain == "/deploy" {
		517	+	h.sendError(w, http.StatusBadRequest, "domain required in path")
		518	+	return
		519	+	}
		520	+
		521	+	// Get the route for this domain
		522	+	route, err := h.configSvc.GetRoute(ctx, deployDomain)
		523	+	if err != nil {
		524	+	h.sendError(w, http.StatusNotFound, "route not found")
		525	+	return
		526	+	}
		527	+
		528	+	// Deploy the container
		529	+	container, err := h.containerSvc.Deploy(ctx, *route)
		530	+	if err != nil {
		531	+	log.Error().Err(err).Str("domain", deployDomain).Msg("failed to deploy container")
		532	+	h.sendError(w, http.StatusInternalServerError, fmt.Sprintf("failed to deploy: %v", err))
		533	+	return
		534	+	}
		535	+
		536	+	log.Info().Str("domain", deployDomain).Str("container_id", container.ID).Msg("container deployed via admin API")
		537	+	h.sendJSON(w, http.StatusOK, map[string]any{
		538	+	"status": "deployed",
		539	+	"container_id": container.ID,
		540	+	"domain": deployDomain,
		541	+	})
		542	+	}
		543	+
		544	+	// handleLogs handles /admin/logs endpoints.
		545	+	// GET /admin/logs - Gordon process logs
		546	+	// GET /admin/logs/:domain - Container logs for a specific domain
		547	+	func (h Handler) handleLogs(w http.ResponseWriter, r http.Request, path string) {
		548	+	if r.Method != http.MethodGet {
		549	+	http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
		550	+	return
		551	+	}
		552	+
		553	+	ctx := r.Context()
		554	+	log := zerowrap.FromCtx(ctx)
		555	+
		556	+	// Check read permission
		557	+	if !HasAccess(ctx, domain.AdminResourceStatus, domain.AdminActionRead) {
		558	+	h.sendError(w, http.StatusForbidden, "insufficient permissions for status:read")
		559	+	return
		560	+	}
		561	+
		562	+	// Check if LogService is available
		563	+	if h.logSvc == nil {
		564	+	h.sendError(w, http.StatusServiceUnavailable, "log service not available")
		565	+	return
		566	+	}
		567	+
		568	+	// Parse query parameters
		569	+	lines := 50 // default
		570	+	if linesStr := r.URL.Query().Get("lines"); linesStr != "" {
		571	+	if n, err := strconv.Atoi(linesStr); err == nil && n > 0 {
		572	+	lines = n
		573	+	}
		574	+	}
		575	+	follow := r.URL.Query().Get("follow") == "true"
		576	+
		577	+	// Parse domain from path
		578	+	logDomain := strings.TrimPrefix(path, "/logs/")
		579	+	if logDomain == "/logs" {
		580	+	logDomain = ""
		581	+	}
		582	+
		583	+	if logDomain == "" {
		584	+	// Gordon process logs
		585	+	h.handleProcessLogs(w, r, lines, follow)
		586	+	} else {
		587	+	// Container logs
		588	+	h.handleContainerLogs(w, r, logDomain, lines, follow)
		589	+	}
		590	+
		591	+	// Prevent unused variable warning when follow is implemented
		592	+	_ = log
		593	+	}
		594	+
		595	+	// handleProcessLogs handles Gordon process logs.
		596	+	func (h Handler) handleProcessLogs(w http.ResponseWriter, r http.Request, lines int, follow bool) {
		597	+	ctx := r.Context()
		598	+	log := zerowrap.FromCtx(ctx)
		599	+
		600	+	if follow {
		601	+	// SSE streaming
		602	+	h.streamProcessLogs(w, r, lines)
		603	+	return
		604	+	}
		605	+
		606	+	// Return last N lines as JSON
		607	+	logLines, err := h.logSvc.GetProcessLogs(ctx, lines)
		608	+	if err != nil {
		609	+	log.Warn().Err(err).Msg("failed to get process logs")
		610	+	h.sendError(w, http.StatusInternalServerError, "failed to get logs")
		611	+	return
		612	+	}
		613	+
		614	+	h.sendJSON(w, http.StatusOK, map[string]any{
		615	+	"lines": logLines,
		616	+	})
		617	+	}
		618	+
		619	+	// handleContainerLogs handles container logs for a specific domain.
		620	+	func (h Handler) handleContainerLogs(w http.ResponseWriter, r http.Request, logDomain string, lines int, follow bool) {
		621	+	ctx := r.Context()
		622	+	log := zerowrap.FromCtx(ctx)
		623	+
		624	+	if follow {
		625	+	// SSE streaming
		626	+	h.streamContainerLogs(w, r, logDomain, lines)
		627	+	return
		628	+	}
		629	+
		630	+	// Return last N lines as JSON
		631	+	logLines, err := h.logSvc.GetContainerLogs(ctx, logDomain, lines)
		632	+	if err != nil {
		633	+	log.Warn().Err(err).Str("domain", logDomain).Msg("failed to get container logs")
		634	+	h.sendError(w, http.StatusInternalServerError, fmt.Sprintf("failed to get logs: %v", err))
		635	+	return
		636	+	}
		637	+
		638	+	h.sendJSON(w, http.StatusOK, map[string]any{
		639	+	"domain": logDomain,
		640	+	"lines": logLines,
		641	+	})
		642	+	}
		643	+
		644	+	// streamProcessLogs streams Gordon process logs via SSE.
		645	+	func (h Handler) streamProcessLogs(w http.ResponseWriter, r http.Request, lines int) {
		646	+	ctx := r.Context()
		647	+	log := zerowrap.FromCtx(ctx)
		648	+
		649	+	// Set up SSE
		650	+	w.Header().Set("Content-Type", "text/event-stream")
		651	+	w.Header().Set("Cache-Control", "no-cache")
		652	+	w.Header().Set("Connection", "keep-alive")
		653	+	w.WriteHeader(http.StatusOK)
		654	+
		655	+	flusher, ok := w.(http.Flusher)
		656	+	if !ok {
		657	+	h.sendError(w, http.StatusInternalServerError, "streaming not supported")
		658	+	return
		659	+	}
		660	+
		661	+	ch, err := h.logSvc.FollowProcessLogs(ctx, lines)
		662	+	if err != nil {
		663	+	log.Warn().Err(err).Msg("failed to follow process logs")
		664	+	_, _ = fmt.Fprintf(w, "event: error\ndata: %s\n\n", err.Error())
		665	+	flusher.Flush()
		666	+	return
		667	+	}
		668	+
		669	+	for {
		670	+	select {
		671	+	case line, ok := <-ch:
		672	+	if !ok {
		673	+	return
		674	+	}
		675	+	_, _ = fmt.Fprintf(w, "data: %s\n\n", line)
		676	+	flusher.Flush()
		677	+	case <-ctx.Done():
		678	+	return
		679	+	}
		680	+	}
		681	+	}
		682	+
		683	+	// streamContainerLogs streams container logs via SSE.
		684	+	func (h Handler) streamContainerLogs(w http.ResponseWriter, r http.Request, logDomain string, lines int) {
		685	+	ctx := r.Context()
		686	+	log := zerowrap.FromCtx(ctx)
		687	+
		688	+	// Set up SSE
		689	+	w.Header().Set("Content-Type", "text/event-stream")
		690	+	w.Header().Set("Cache-Control", "no-cache")
		691	+	w.Header().Set("Connection", "keep-alive")
		692	+	w.WriteHeader(http.StatusOK)
		693	+
		694	+	flusher, ok := w.(http.Flusher)
		695	+	if !ok {
		696	+	h.sendError(w, http.StatusInternalServerError, "streaming not supported")
		697	+	return
		698	+	}
		699	+
		700	+	ch, err := h.logSvc.FollowContainerLogs(ctx, logDomain, lines)
		701	+	if err != nil {
		702	+	log.Warn().Err(err).Str("domain", logDomain).Msg("failed to follow container logs")
		703	+	_, _ = fmt.Fprintf(w, "event: error\ndata: %s\n\n", err.Error())
		704	+	flusher.Flush()
		705	+	return
		706	+	}
		707	+
		708	+	for {
		709	+	select {
		710	+	case line, ok := <-ch:
		711	+	if !ok {
		712	+	return
		713	+	}
		714	+	_, _ = fmt.Fprintf(w, "data: %s\n\n", line)
		715	+	flusher.Flush()
		716	+	case <-ctx.Done():
		717	+	return
		718	+	}
		719	+	}
		720	+	}

M internal/adapters/in/http/admin/handler_test.go +20 -20


@@ -33,7 +33,7 @@ func TestHandler_RoutesGet_RequiresReadScope(t *testing.T) {
33	33		containerSvc := inmocks.NewMockContainerService(t)
34	34		secretSvc := inmocks.NewMockSecretService(t)
35	35
36		-	handler := NewHandler(configSvc, authSvc, containerSvc, inmocks.NewMockHealthService(t), secretSvc, nil, testLogger())
	36	+	handler := NewHandler(configSvc, authSvc, containerSvc, inmocks.NewMockHealthService(t), secretSvc, nil, nil, testLogger())
37	37
38	38		tests := []struct {
39	39		name string

@@ -95,7 +95,7 @@ func TestHandler_RoutesPost_RequiresWriteScope(t *testing.T) {
95	95		containerSvc := inmocks.NewMockContainerService(t)
96	96		secretSvc := inmocks.NewMockSecretService(t)
97	97
98		-	handler := NewHandler(configSvc, authSvc, containerSvc, inmocks.NewMockHealthService(t), secretSvc, nil, testLogger())
	98	+	handler := NewHandler(configSvc, authSvc, containerSvc, inmocks.NewMockHealthService(t), secretSvc, nil, nil, testLogger())
99	99
100	100		routeJSON := `{"domain": "app.example.com", "image": "myapp:latest"}`
101	101

@@ -154,7 +154,7 @@ func TestHandler_RoutesPut_RequiresWriteScope(t *testing.T) {
154	154		containerSvc := inmocks.NewMockContainerService(t)
155	155		secretSvc := inmocks.NewMockSecretService(t)
156	156
157		-	handler := NewHandler(configSvc, authSvc, containerSvc, inmocks.NewMockHealthService(t), secretSvc, nil, testLogger())
	157	+	handler := NewHandler(configSvc, authSvc, containerSvc, inmocks.NewMockHealthService(t), secretSvc, nil, nil, testLogger())
158	158
159	159		routeJSON := `{"image": "myapp:v2"}`
160	160

@@ -198,7 +198,7 @@ func TestHandler_RoutesDelete_RequiresWriteScope(t *testing.T) {
198	198		containerSvc := inmocks.NewMockContainerService(t)
199	199		secretSvc := inmocks.NewMockSecretService(t)
200	200
201		-	handler := NewHandler(configSvc, authSvc, containerSvc, inmocks.NewMockHealthService(t), secretSvc, nil, testLogger())
	201	+	handler := NewHandler(configSvc, authSvc, containerSvc, inmocks.NewMockHealthService(t), secretSvc, nil, nil, testLogger())
202	202
203	203		tests := []struct {
204	204		name string

@@ -242,7 +242,7 @@ func TestHandler_SecretsGet_RequiresReadScope(t *testing.T) {
242	242		containerSvc := inmocks.NewMockContainerService(t)
243	243		secretSvc := inmocks.NewMockSecretService(t)
244	244
245		-	handler := NewHandler(configSvc, authSvc, containerSvc, inmocks.NewMockHealthService(t), secretSvc, nil, testLogger())
	245	+	handler := NewHandler(configSvc, authSvc, containerSvc, inmocks.NewMockHealthService(t), secretSvc, nil, nil, testLogger())
246	246
247	247		tests := []struct {
248	248		name string

@@ -299,7 +299,7 @@ func TestHandler_SecretsPost_RequiresWriteScope(t *testing.T) {
299	299		containerSvc := inmocks.NewMockContainerService(t)
300	300		secretSvc := inmocks.NewMockSecretService(t)
301	301
302		-	handler := NewHandler(configSvc, authSvc, containerSvc, inmocks.NewMockHealthService(t), secretSvc, nil, testLogger())
	302	+	handler := NewHandler(configSvc, authSvc, containerSvc, inmocks.NewMockHealthService(t), secretSvc, nil, nil, testLogger())
303	303
304	304		secretsJSON := `{"API_KEY": "secret123"}`
305	305

@@ -348,7 +348,7 @@ func TestHandler_SecretsDelete_RequiresWriteScope(t *testing.T) {
348	348		containerSvc := inmocks.NewMockContainerService(t)
349	349		secretSvc := inmocks.NewMockSecretService(t)
350	350
351		-	handler := NewHandler(configSvc, authSvc, containerSvc, inmocks.NewMockHealthService(t), secretSvc, nil, testLogger())
	351	+	handler := NewHandler(configSvc, authSvc, containerSvc, inmocks.NewMockHealthService(t), secretSvc, nil, nil, testLogger())
352	352
353	353		tests := []struct {
354	354		name string

@@ -392,7 +392,7 @@ func TestHandler_Status_RequiresReadScope(t *testing.T) {
392	392		containerSvc := inmocks.NewMockContainerService(t)
393	393		secretSvc := inmocks.NewMockSecretService(t)
394	394
395		-	handler := NewHandler(configSvc, authSvc, containerSvc, inmocks.NewMockHealthService(t), secretSvc, nil, testLogger())
	395	+	handler := NewHandler(configSvc, authSvc, containerSvc, inmocks.NewMockHealthService(t), secretSvc, nil, nil, testLogger())
396	396
397	397		tests := []struct {
398	398		name string

@@ -446,7 +446,7 @@ func TestHandler_Config_RequiresReadScope(t *testing.T) {
446	446		containerSvc := inmocks.NewMockContainerService(t)
447	447		secretSvc := inmocks.NewMockSecretService(t)
448	448
449		-	handler := NewHandler(configSvc, authSvc, containerSvc, inmocks.NewMockHealthService(t), secretSvc, nil, testLogger())
	449	+	handler := NewHandler(configSvc, authSvc, containerSvc, inmocks.NewMockHealthService(t), secretSvc, nil, nil, testLogger())
450	450
451	451		tests := []struct {
452	452		name string

@@ -503,7 +503,7 @@ func TestHandler_Reload_RequiresWriteScope(t *testing.T) {
503	503		containerSvc := inmocks.NewMockContainerService(t)
504	504		secretSvc := inmocks.NewMockSecretService(t)
505	505
506		-	handler := NewHandler(configSvc, authSvc, containerSvc, inmocks.NewMockHealthService(t), secretSvc, nil, testLogger())
	506	+	handler := NewHandler(configSvc, authSvc, containerSvc, inmocks.NewMockHealthService(t), secretSvc, nil, nil, testLogger())
507	507
508	508		tests := []struct {
509	509		name string

@@ -557,7 +557,7 @@ func TestHandler_RoutesGet_ReturnsRoutes(t *testing.T) {
557	557		containerSvc := inmocks.NewMockContainerService(t)
558	558		secretSvc := inmocks.NewMockSecretService(t)
559	559
560		-	handler := NewHandler(configSvc, authSvc, containerSvc, inmocks.NewMockHealthService(t), secretSvc, nil, testLogger())
	560	+	handler := NewHandler(configSvc, authSvc, containerSvc, inmocks.NewMockHealthService(t), secretSvc, nil, nil, testLogger())
561	561
562	562		expectedRoutes := []domain.Route{
563	563		{Domain: "app1.example.com", Image: "app1:latest"},

@@ -588,7 +588,7 @@ func TestHandler_RoutesGet_SingleRoute(t *testing.T) {
588	588		containerSvc := inmocks.NewMockContainerService(t)
589	589		secretSvc := inmocks.NewMockSecretService(t)
590	590
591		-	handler := NewHandler(configSvc, authSvc, containerSvc, inmocks.NewMockHealthService(t), secretSvc, nil, testLogger())
	591	+	handler := NewHandler(configSvc, authSvc, containerSvc, inmocks.NewMockHealthService(t), secretSvc, nil, nil, testLogger())
592	592
593	593		configSvc.EXPECT().GetRoute(mock.Anything, "app.example.com").Return(&domain.Route{
594	594		Domain: "app.example.com", Image: "app:latest",

@@ -615,7 +615,7 @@ func TestHandler_RoutesGet_NotFound(t *testing.T) {
615	615		containerSvc := inmocks.NewMockContainerService(t)
616	616		secretSvc := inmocks.NewMockSecretService(t)
617	617
618		-	handler := NewHandler(configSvc, authSvc, containerSvc, inmocks.NewMockHealthService(t), secretSvc, nil, testLogger())
	618	+	handler := NewHandler(configSvc, authSvc, containerSvc, inmocks.NewMockHealthService(t), secretSvc, nil, nil, testLogger())
619	619
620	620		configSvc.EXPECT().GetRoute(mock.Anything, "nonexistent.example.com").Return(nil, domain.ErrRouteNotFound)
621	621

@@ -658,7 +658,7 @@ func TestHandler_RoutesPost_MissingFields(t *testing.T) {
658	658		containerSvc := inmocks.NewMockContainerService(t)
659	659		secretSvc := inmocks.NewMockSecretService(t)
660	660
661		-	handler := NewHandler(configSvc, authSvc, containerSvc, inmocks.NewMockHealthService(t), secretSvc, nil, testLogger())
	661	+	handler := NewHandler(configSvc, authSvc, containerSvc, inmocks.NewMockHealthService(t), secretSvc, nil, nil, testLogger())
662	662
663	663		configSvc.EXPECT().AddRoute(mock.Anything, mock.Anything).Return(tt.mockErr)
664	664

@@ -679,7 +679,7 @@ func TestHandler_RoutesPut_MissingDomain(t *testing.T) {
679	679		containerSvc := inmocks.NewMockContainerService(t)
680	680		secretSvc := inmocks.NewMockSecretService(t)
681	681
682		-	handler := NewHandler(configSvc, authSvc, containerSvc, inmocks.NewMockHealthService(t), secretSvc, nil, testLogger())
	682	+	handler := NewHandler(configSvc, authSvc, containerSvc, inmocks.NewMockHealthService(t), secretSvc, nil, nil, testLogger())
683	683
684	684		req := httptest.NewRequest("PUT", "/admin/routes/", bytes.NewBufferString(`{"image": "app:latest"}`))
685	685		req = req.WithContext(ctxWithScopes("admin:routes:write"))

@@ -696,7 +696,7 @@ func TestHandler_RoutesDelete_MissingDomain(t *testing.T) {
696	696		containerSvc := inmocks.NewMockContainerService(t)
697	697		secretSvc := inmocks.NewMockSecretService(t)
698	698
699		-	handler := NewHandler(configSvc, authSvc, containerSvc, inmocks.NewMockHealthService(t), secretSvc, nil, testLogger())
	699	+	handler := NewHandler(configSvc, authSvc, containerSvc, inmocks.NewMockHealthService(t), secretSvc, nil, nil, testLogger())
700	700
701	701		req := httptest.NewRequest("DELETE", "/admin/routes/", nil)
702	702		req = req.WithContext(ctxWithScopes("admin:routes:write"))

@@ -713,7 +713,7 @@ func TestHandler_Secrets_MissingDomain(t *testing.T) {
713	713		containerSvc := inmocks.NewMockContainerService(t)
714	714		secretSvc := inmocks.NewMockSecretService(t)
715	715
716		-	handler := NewHandler(configSvc, authSvc, containerSvc, inmocks.NewMockHealthService(t), secretSvc, nil, testLogger())
	716	+	handler := NewHandler(configSvc, authSvc, containerSvc, inmocks.NewMockHealthService(t), secretSvc, nil, nil, testLogger())
717	717
718	718		req := httptest.NewRequest("GET", "/admin/secrets/", nil)
719	719		req = req.WithContext(ctxWithScopes("admin:secrets:read"))

@@ -730,7 +730,7 @@ func TestHandler_SecretsDelete_MissingKey(t *testing.T) {
730	730		containerSvc := inmocks.NewMockContainerService(t)
731	731		secretSvc := inmocks.NewMockSecretService(t)
732	732
733		-	handler := NewHandler(configSvc, authSvc, containerSvc, inmocks.NewMockHealthService(t), secretSvc, nil, testLogger())
	733	+	handler := NewHandler(configSvc, authSvc, containerSvc, inmocks.NewMockHealthService(t), secretSvc, nil, nil, testLogger())
734	734
735	735		req := httptest.NewRequest("DELETE", "/admin/secrets/app.example.com", nil)
736	736		req = req.WithContext(ctxWithScopes("admin:secrets:write"))

@@ -747,7 +747,7 @@ func TestHandler_MethodNotAllowed(t *testing.T) {
747	747		containerSvc := inmocks.NewMockContainerService(t)
748	748		secretSvc := inmocks.NewMockSecretService(t)
749	749
750		-	handler := NewHandler(configSvc, authSvc, containerSvc, inmocks.NewMockHealthService(t), secretSvc, nil, testLogger())
	750	+	handler := NewHandler(configSvc, authSvc, containerSvc, inmocks.NewMockHealthService(t), secretSvc, nil, nil, testLogger())
751	751
752	752		tests := []struct {
753	753		method string

@@ -780,7 +780,7 @@ func TestHandler_NotFound(t *testing.T) {
780	780		containerSvc := inmocks.NewMockContainerService(t)
781	781		secretSvc := inmocks.NewMockSecretService(t)
782	782
783		-	handler := NewHandler(configSvc, authSvc, containerSvc, inmocks.NewMockHealthService(t), secretSvc, nil, testLogger())
	783	+	handler := NewHandler(configSvc, authSvc, containerSvc, inmocks.NewMockHealthService(t), secretSvc, nil, nil, testLogger())
784	784
785	785		req := httptest.NewRequest("GET", "/admin/unknown", nil)
786	786		req = req.WithContext(ctxWithScopes("admin::"))


@@ -33,7 +33,7 @@ func TestHandler_RoutesGet_RequiresReadScope(t *testing.T) {
33		containerSvc := inmocks.NewMockContainerService(t)	33		containerSvc := inmocks.NewMockContainerService(t)
34		secretSvc := inmocks.NewMockSecretService(t)	34		secretSvc := inmocks.NewMockSecretService(t)
35			35
36	-	handler := NewHandler(configSvc, authSvc, containerSvc, inmocks.NewMockHealthService(t), secretSvc, nil, testLogger())	36	+	handler := NewHandler(configSvc, authSvc, containerSvc, inmocks.NewMockHealthService(t), secretSvc, nil, nil, testLogger())
37			37
38		tests := []struct {	38		tests := []struct {
39		name string	39		name string

@@ -95,7 +95,7 @@ func TestHandler_RoutesPost_RequiresWriteScope(t *testing.T) {
95		containerSvc := inmocks.NewMockContainerService(t)	95		containerSvc := inmocks.NewMockContainerService(t)
96		secretSvc := inmocks.NewMockSecretService(t)	96		secretSvc := inmocks.NewMockSecretService(t)
97			97
98	-	handler := NewHandler(configSvc, authSvc, containerSvc, inmocks.NewMockHealthService(t), secretSvc, nil, testLogger())	98	+	handler := NewHandler(configSvc, authSvc, containerSvc, inmocks.NewMockHealthService(t), secretSvc, nil, nil, testLogger())
99			99
100		routeJSON := `{"domain": "app.example.com", "image": "myapp:latest"}`	100		routeJSON := `{"domain": "app.example.com", "image": "myapp:latest"}`
101			101

@@ -154,7 +154,7 @@ func TestHandler_RoutesPut_RequiresWriteScope(t *testing.T) {
154		containerSvc := inmocks.NewMockContainerService(t)	154		containerSvc := inmocks.NewMockContainerService(t)
155		secretSvc := inmocks.NewMockSecretService(t)	155		secretSvc := inmocks.NewMockSecretService(t)
156			156
157	-	handler := NewHandler(configSvc, authSvc, containerSvc, inmocks.NewMockHealthService(t), secretSvc, nil, testLogger())	157	+	handler := NewHandler(configSvc, authSvc, containerSvc, inmocks.NewMockHealthService(t), secretSvc, nil, nil, testLogger())
158			158
159		routeJSON := `{"image": "myapp:v2"}`	159		routeJSON := `{"image": "myapp:v2"}`
160			160

@@ -198,7 +198,7 @@ func TestHandler_RoutesDelete_RequiresWriteScope(t *testing.T) {
198		containerSvc := inmocks.NewMockContainerService(t)	198		containerSvc := inmocks.NewMockContainerService(t)
199		secretSvc := inmocks.NewMockSecretService(t)	199		secretSvc := inmocks.NewMockSecretService(t)
200			200
201	-	handler := NewHandler(configSvc, authSvc, containerSvc, inmocks.NewMockHealthService(t), secretSvc, nil, testLogger())	201	+	handler := NewHandler(configSvc, authSvc, containerSvc, inmocks.NewMockHealthService(t), secretSvc, nil, nil, testLogger())
202			202
203		tests := []struct {	203		tests := []struct {
204		name string	204		name string

@@ -242,7 +242,7 @@ func TestHandler_SecretsGet_RequiresReadScope(t *testing.T) {
242		containerSvc := inmocks.NewMockContainerService(t)	242		containerSvc := inmocks.NewMockContainerService(t)
243		secretSvc := inmocks.NewMockSecretService(t)	243		secretSvc := inmocks.NewMockSecretService(t)
244			244
245	-	handler := NewHandler(configSvc, authSvc, containerSvc, inmocks.NewMockHealthService(t), secretSvc, nil, testLogger())	245	+	handler := NewHandler(configSvc, authSvc, containerSvc, inmocks.NewMockHealthService(t), secretSvc, nil, nil, testLogger())
246			246
247		tests := []struct {	247		tests := []struct {
248		name string	248		name string

@@ -299,7 +299,7 @@ func TestHandler_SecretsPost_RequiresWriteScope(t *testing.T) {
299		containerSvc := inmocks.NewMockContainerService(t)	299		containerSvc := inmocks.NewMockContainerService(t)
300		secretSvc := inmocks.NewMockSecretService(t)	300		secretSvc := inmocks.NewMockSecretService(t)
301			301
302	-	handler := NewHandler(configSvc, authSvc, containerSvc, inmocks.NewMockHealthService(t), secretSvc, nil, testLogger())	302	+	handler := NewHandler(configSvc, authSvc, containerSvc, inmocks.NewMockHealthService(t), secretSvc, nil, nil, testLogger())
303			303
304		secretsJSON := `{"API_KEY": "secret123"}`	304		secretsJSON := `{"API_KEY": "secret123"}`
305			305

@@ -348,7 +348,7 @@ func TestHandler_SecretsDelete_RequiresWriteScope(t *testing.T) {
348		containerSvc := inmocks.NewMockContainerService(t)	348		containerSvc := inmocks.NewMockContainerService(t)
349		secretSvc := inmocks.NewMockSecretService(t)	349		secretSvc := inmocks.NewMockSecretService(t)
350			350
351	-	handler := NewHandler(configSvc, authSvc, containerSvc, inmocks.NewMockHealthService(t), secretSvc, nil, testLogger())	351	+	handler := NewHandler(configSvc, authSvc, containerSvc, inmocks.NewMockHealthService(t), secretSvc, nil, nil, testLogger())
352			352
353		tests := []struct {	353		tests := []struct {
354		name string	354		name string

@@ -392,7 +392,7 @@ func TestHandler_Status_RequiresReadScope(t *testing.T) {
392		containerSvc := inmocks.NewMockContainerService(t)	392		containerSvc := inmocks.NewMockContainerService(t)
393		secretSvc := inmocks.NewMockSecretService(t)	393		secretSvc := inmocks.NewMockSecretService(t)
394			394
395	-	handler := NewHandler(configSvc, authSvc, containerSvc, inmocks.NewMockHealthService(t), secretSvc, nil, testLogger())	395	+	handler := NewHandler(configSvc, authSvc, containerSvc, inmocks.NewMockHealthService(t), secretSvc, nil, nil, testLogger())
396			396
397		tests := []struct {	397		tests := []struct {
398		name string	398		name string

@@ -446,7 +446,7 @@ func TestHandler_Config_RequiresReadScope(t *testing.T) {
446		containerSvc := inmocks.NewMockContainerService(t)	446		containerSvc := inmocks.NewMockContainerService(t)
447		secretSvc := inmocks.NewMockSecretService(t)	447		secretSvc := inmocks.NewMockSecretService(t)
448			448
449	-	handler := NewHandler(configSvc, authSvc, containerSvc, inmocks.NewMockHealthService(t), secretSvc, nil, testLogger())	449	+	handler := NewHandler(configSvc, authSvc, containerSvc, inmocks.NewMockHealthService(t), secretSvc, nil, nil, testLogger())
450			450
451		tests := []struct {	451		tests := []struct {
452		name string	452		name string

@@ -503,7 +503,7 @@ func TestHandler_Reload_RequiresWriteScope(t *testing.T) {
503		containerSvc := inmocks.NewMockContainerService(t)	503		containerSvc := inmocks.NewMockContainerService(t)
504		secretSvc := inmocks.NewMockSecretService(t)	504		secretSvc := inmocks.NewMockSecretService(t)
505			505
506	-	handler := NewHandler(configSvc, authSvc, containerSvc, inmocks.NewMockHealthService(t), secretSvc, nil, testLogger())	506	+	handler := NewHandler(configSvc, authSvc, containerSvc, inmocks.NewMockHealthService(t), secretSvc, nil, nil, testLogger())
507			507
508		tests := []struct {	508		tests := []struct {
509		name string	509		name string

@@ -557,7 +557,7 @@ func TestHandler_RoutesGet_ReturnsRoutes(t *testing.T) {
557		containerSvc := inmocks.NewMockContainerService(t)	557		containerSvc := inmocks.NewMockContainerService(t)
558		secretSvc := inmocks.NewMockSecretService(t)	558		secretSvc := inmocks.NewMockSecretService(t)
559			559
560	-	handler := NewHandler(configSvc, authSvc, containerSvc, inmocks.NewMockHealthService(t), secretSvc, nil, testLogger())	560	+	handler := NewHandler(configSvc, authSvc, containerSvc, inmocks.NewMockHealthService(t), secretSvc, nil, nil, testLogger())
561			561
562		expectedRoutes := []domain.Route{	562		expectedRoutes := []domain.Route{
563		{Domain: "app1.example.com", Image: "app1:latest"},	563		{Domain: "app1.example.com", Image: "app1:latest"},

@@ -588,7 +588,7 @@ func TestHandler_RoutesGet_SingleRoute(t *testing.T) {
588		containerSvc := inmocks.NewMockContainerService(t)	588		containerSvc := inmocks.NewMockContainerService(t)
589		secretSvc := inmocks.NewMockSecretService(t)	589		secretSvc := inmocks.NewMockSecretService(t)
590			590
591	-	handler := NewHandler(configSvc, authSvc, containerSvc, inmocks.NewMockHealthService(t), secretSvc, nil, testLogger())	591	+	handler := NewHandler(configSvc, authSvc, containerSvc, inmocks.NewMockHealthService(t), secretSvc, nil, nil, testLogger())
592			592
593		configSvc.EXPECT().GetRoute(mock.Anything, "app.example.com").Return(&domain.Route{	593		configSvc.EXPECT().GetRoute(mock.Anything, "app.example.com").Return(&domain.Route{
594		Domain: "app.example.com", Image: "app:latest",	594		Domain: "app.example.com", Image: "app:latest",

@@ -615,7 +615,7 @@ func TestHandler_RoutesGet_NotFound(t *testing.T) {
615		containerSvc := inmocks.NewMockContainerService(t)	615		containerSvc := inmocks.NewMockContainerService(t)
616		secretSvc := inmocks.NewMockSecretService(t)	616		secretSvc := inmocks.NewMockSecretService(t)
617			617
618	-	handler := NewHandler(configSvc, authSvc, containerSvc, inmocks.NewMockHealthService(t), secretSvc, nil, testLogger())	618	+	handler := NewHandler(configSvc, authSvc, containerSvc, inmocks.NewMockHealthService(t), secretSvc, nil, nil, testLogger())
619			619
620		configSvc.EXPECT().GetRoute(mock.Anything, "nonexistent.example.com").Return(nil, domain.ErrRouteNotFound)	620		configSvc.EXPECT().GetRoute(mock.Anything, "nonexistent.example.com").Return(nil, domain.ErrRouteNotFound)
621			621

@@ -658,7 +658,7 @@ func TestHandler_RoutesPost_MissingFields(t *testing.T) {
658		containerSvc := inmocks.NewMockContainerService(t)	658		containerSvc := inmocks.NewMockContainerService(t)
659		secretSvc := inmocks.NewMockSecretService(t)	659		secretSvc := inmocks.NewMockSecretService(t)
660			660
661	-	handler := NewHandler(configSvc, authSvc, containerSvc, inmocks.NewMockHealthService(t), secretSvc, nil, testLogger())	661	+	handler := NewHandler(configSvc, authSvc, containerSvc, inmocks.NewMockHealthService(t), secretSvc, nil, nil, testLogger())
662			662
663		configSvc.EXPECT().AddRoute(mock.Anything, mock.Anything).Return(tt.mockErr)	663		configSvc.EXPECT().AddRoute(mock.Anything, mock.Anything).Return(tt.mockErr)
664			664

@@ -679,7 +679,7 @@ func TestHandler_RoutesPut_MissingDomain(t *testing.T) {
679		containerSvc := inmocks.NewMockContainerService(t)	679		containerSvc := inmocks.NewMockContainerService(t)
680		secretSvc := inmocks.NewMockSecretService(t)	680		secretSvc := inmocks.NewMockSecretService(t)
681			681
682	-	handler := NewHandler(configSvc, authSvc, containerSvc, inmocks.NewMockHealthService(t), secretSvc, nil, testLogger())	682	+	handler := NewHandler(configSvc, authSvc, containerSvc, inmocks.NewMockHealthService(t), secretSvc, nil, nil, testLogger())
683			683
684		req := httptest.NewRequest("PUT", "/admin/routes/", bytes.NewBufferString(`{"image": "app:latest"}`))	684		req := httptest.NewRequest("PUT", "/admin/routes/", bytes.NewBufferString(`{"image": "app:latest"}`))
685		req = req.WithContext(ctxWithScopes("admin:routes:write"))	685		req = req.WithContext(ctxWithScopes("admin:routes:write"))

@@ -696,7 +696,7 @@ func TestHandler_RoutesDelete_MissingDomain(t *testing.T) {
696		containerSvc := inmocks.NewMockContainerService(t)	696		containerSvc := inmocks.NewMockContainerService(t)
697		secretSvc := inmocks.NewMockSecretService(t)	697		secretSvc := inmocks.NewMockSecretService(t)
698			698
699	-	handler := NewHandler(configSvc, authSvc, containerSvc, inmocks.NewMockHealthService(t), secretSvc, nil, testLogger())	699	+	handler := NewHandler(configSvc, authSvc, containerSvc, inmocks.NewMockHealthService(t), secretSvc, nil, nil, testLogger())
700			700
701		req := httptest.NewRequest("DELETE", "/admin/routes/", nil)	701		req := httptest.NewRequest("DELETE", "/admin/routes/", nil)
702		req = req.WithContext(ctxWithScopes("admin:routes:write"))	702		req = req.WithContext(ctxWithScopes("admin:routes:write"))

@@ -713,7 +713,7 @@ func TestHandler_Secrets_MissingDomain(t *testing.T) {
713		containerSvc := inmocks.NewMockContainerService(t)	713		containerSvc := inmocks.NewMockContainerService(t)
714		secretSvc := inmocks.NewMockSecretService(t)	714		secretSvc := inmocks.NewMockSecretService(t)
715			715
716	-	handler := NewHandler(configSvc, authSvc, containerSvc, inmocks.NewMockHealthService(t), secretSvc, nil, testLogger())	716	+	handler := NewHandler(configSvc, authSvc, containerSvc, inmocks.NewMockHealthService(t), secretSvc, nil, nil, testLogger())
717			717
718		req := httptest.NewRequest("GET", "/admin/secrets/", nil)	718		req := httptest.NewRequest("GET", "/admin/secrets/", nil)
719		req = req.WithContext(ctxWithScopes("admin:secrets:read"))	719		req = req.WithContext(ctxWithScopes("admin:secrets:read"))

@@ -730,7 +730,7 @@ func TestHandler_SecretsDelete_MissingKey(t *testing.T) {
730		containerSvc := inmocks.NewMockContainerService(t)	730		containerSvc := inmocks.NewMockContainerService(t)
731		secretSvc := inmocks.NewMockSecretService(t)	731		secretSvc := inmocks.NewMockSecretService(t)
732			732
733	-	handler := NewHandler(configSvc, authSvc, containerSvc, inmocks.NewMockHealthService(t), secretSvc, nil, testLogger())	733	+	handler := NewHandler(configSvc, authSvc, containerSvc, inmocks.NewMockHealthService(t), secretSvc, nil, nil, testLogger())
734			734
735		req := httptest.NewRequest("DELETE", "/admin/secrets/app.example.com", nil)	735		req := httptest.NewRequest("DELETE", "/admin/secrets/app.example.com", nil)
736		req = req.WithContext(ctxWithScopes("admin:secrets:write"))	736		req = req.WithContext(ctxWithScopes("admin:secrets:write"))

@@ -747,7 +747,7 @@ func TestHandler_MethodNotAllowed(t *testing.T) {
747		containerSvc := inmocks.NewMockContainerService(t)	747		containerSvc := inmocks.NewMockContainerService(t)
748		secretSvc := inmocks.NewMockSecretService(t)	748		secretSvc := inmocks.NewMockSecretService(t)
749			749
750	-	handler := NewHandler(configSvc, authSvc, containerSvc, inmocks.NewMockHealthService(t), secretSvc, nil, testLogger())	750	+	handler := NewHandler(configSvc, authSvc, containerSvc, inmocks.NewMockHealthService(t), secretSvc, nil, nil, testLogger())
751			751
752		tests := []struct {	752		tests := []struct {
753		method string	753		method string

@@ -780,7 +780,7 @@ func TestHandler_NotFound(t *testing.T) {
780		containerSvc := inmocks.NewMockContainerService(t)	780		containerSvc := inmocks.NewMockContainerService(t)
781		secretSvc := inmocks.NewMockSecretService(t)	781		secretSvc := inmocks.NewMockSecretService(t)
782			782
783	-	handler := NewHandler(configSvc, authSvc, containerSvc, inmocks.NewMockHealthService(t), secretSvc, nil, testLogger())	783	+	handler := NewHandler(configSvc, authSvc, containerSvc, inmocks.NewMockHealthService(t), secretSvc, nil, nil, testLogger())
784			784
785		req := httptest.NewRequest("GET", "/admin/unknown", nil)	785		req := httptest.NewRequest("GET", "/admin/unknown", nil)
786		req = req.WithContext(ctxWithScopes("admin::"))	786		req = req.WithContext(ctxWithScopes("admin::"))

M internal/app/run.go +6 -1


@@ -48,6 +48,7 @@ import (
48	48		"gordon/internal/usecase/config"
49	49		"gordon/internal/usecase/container"
50	50		"gordon/internal/usecase/health"
	51	+	"gordon/internal/usecase/logs"
51	52		"gordon/internal/usecase/proxy"
52	53		registrySvc "gordon/internal/usecase/registry"
53	54		secretsSvc "gordon/internal/usecase/secrets"

@@ -311,8 +312,12 @@ func createServices(ctx context.Context, v *viper.Viper, cfg Config, log zerowra
311	312		prober := httpprober.New()
312	313		healthSvc := health.NewService(svc.configSvc, svc.containerSvc, prober, log)
313	314
	315	+	// Create log service for accessing logs via admin API
	316	+	logFilePath := cfg.Logging.File.Path
	317	+	logSvc := logs.NewService(logFilePath, svc.containerSvc, svc.runtime, log)
	318	+
314	319		// Create admin handler for admin API
315		-	svc.adminHandler = admin.NewHandler(svc.configSvc, svc.authSvc, svc.containerSvc, healthSvc, secretSvc, svc.eventBus, log)
	320	+	svc.adminHandler = admin.NewHandler(svc.configSvc, svc.authSvc, svc.containerSvc, healthSvc, secretSvc, logSvc, svc.eventBus, log)
316	321
317	322		return svc, nil
318	323		}

 	"gordon/internal/usecase/config"
 	"gordon/internal/usecase/container"
 	"gordon/internal/usecase/health"
+	"gordon/internal/usecase/logs"
 	"gordon/internal/usecase/proxy"
 	registrySvc "gordon/internal/usecase/registry"
 	secretsSvc "gordon/internal/usecase/secrets"
 	prober := httpprober.New()
 	healthSvc := health.NewService(svc.configSvc, svc.containerSvc, prober, log)
+	// Create log service for accessing logs via admin API
+	logFilePath := cfg.Logging.File.Path
+	logSvc := logs.NewService(logFilePath, svc.containerSvc, svc.runtime, log)
 	// Create admin handler for admin API
-	svc.adminHandler = admin.NewHandler(svc.configSvc, svc.authSvc, svc.containerSvc, healthSvc, secretSvc, svc.eventBus, log)
+	svc.adminHandler = admin.NewHandler(svc.configSvc, svc.authSvc, svc.containerSvc, healthSvc, secretSvc, logSvc, svc.eventBus, log)
 	return svc, nil
 }

A internal/boundaries/in/logs.go +20 -0

@@ -0,0 +1,20 @@
	1	+	package in
	2	+
	3	+	import "context"
	4	+
	5	+	// LogService defines the contract for accessing logs.
	6	+	type LogService interface {
	7	+	// GetProcessLogs returns the last N lines of Gordon process logs.
	8	+	GetProcessLogs(ctx context.Context, lines int) ([]string, error)
	9	+
	10	+	// FollowProcessLogs returns a channel that streams Gordon process log lines.
	11	+	// The channel is closed when the context is canceled.
	12	+	FollowProcessLogs(ctx context.Context, initialLines int) (<-chan string, error)
	13	+
	14	+	// GetContainerLogs returns the last N lines of container logs for a domain.
	15	+	GetContainerLogs(ctx context.Context, domain string, lines int) ([]string, error)
	16	+
	17	+	// FollowContainerLogs returns a channel that streams container log lines.
	18	+	// The channel is closed when the context is canceled.
	19	+	FollowContainerLogs(ctx context.Context, domain string, initialLines int) (<-chan string, error)
	20	+	}

@@ -0,0 +1,20 @@
	1	+	package in
	2	+
	3	+	import "context"
	4	+
	5	+	// LogService defines the contract for accessing logs.
	6	+	type LogService interface {
	7	+	// GetProcessLogs returns the last N lines of Gordon process logs.
	8	+	GetProcessLogs(ctx context.Context, lines int) ([]string, error)
	9	+
	10	+	// FollowProcessLogs returns a channel that streams Gordon process log lines.
	11	+	// The channel is closed when the context is canceled.
	12	+	FollowProcessLogs(ctx context.Context, initialLines int) (<-chan string, error)
	13	+
	14	+	// GetContainerLogs returns the last N lines of container logs for a domain.
	15	+	GetContainerLogs(ctx context.Context, domain string, lines int) ([]string, error)
	16	+
	17	+	// FollowContainerLogs returns a channel that streams container log lines.
	18	+	// The channel is closed when the context is canceled.
	19	+	FollowContainerLogs(ctx context.Context, domain string, initialLines int) (<-chan string, error)
	20	+	}

A internal/boundaries/in/mocks/mock_log_service.go +322 -0

@@ -0,0 +1,322 @@
	1	+	// Code generated by mockery; DO NOT EDIT.
	2	+	// github.com/vektra/mockery
	3	+	// template: testify
	4	+
	5	+	package mocks
	6	+
	7	+	import (
	8	+	"context"
	9	+
	10	+	mock "github.com/stretchr/testify/mock"
	11	+	)
	12	+
	13	+	// NewMockLogService creates a new instance of MockLogService. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
	14	+	// The first argument is typically a *testing.T value.
	15	+	func NewMockLogService(t interface {
	16	+	mock.TestingT
	17	+	Cleanup(func())
	18	+	}) *MockLogService {
	19	+	mock := &MockLogService{}
	20	+	mock.Mock.Test(t)
	21	+
	22	+	t.Cleanup(func() { mock.AssertExpectations(t) })
	23	+
	24	+	return mock
	25	+	}
	26	+
	27	+	// MockLogService is an autogenerated mock type for the LogService type
	28	+	type MockLogService struct {
	29	+	mock.Mock
	30	+	}
	31	+
	32	+	type MockLogService_Expecter struct {
	33	+	mock *mock.Mock
	34	+	}
	35	+
	36	+	func (_m MockLogService) EXPECT() MockLogService_Expecter {
	37	+	return &MockLogService_Expecter{mock: &_m.Mock}
	38	+	}
	39	+
	40	+	// FollowContainerLogs provides a mock function for the type MockLogService
	41	+	func (_mock *MockLogService) FollowContainerLogs(ctx context.Context, domain string, initialLines int) (<-chan string, error) {
	42	+	ret := _mock.Called(ctx, domain, initialLines)
	43	+
	44	+	if len(ret) == 0 {
	45	+	panic("no return value specified for FollowContainerLogs")
	46	+	}
	47	+
	48	+	var r0 <-chan string
	49	+	var r1 error
	50	+	if returnFunc, ok := ret.Get(0).(func(context.Context, string, int) (<-chan string, error)); ok {
	51	+	return returnFunc(ctx, domain, initialLines)
	52	+	}
	53	+	if returnFunc, ok := ret.Get(0).(func(context.Context, string, int) <-chan string); ok {
	54	+	r0 = returnFunc(ctx, domain, initialLines)
	55	+	} else {
	56	+	if ret.Get(0) != nil {
	57	+	r0 = ret.Get(0).(<-chan string)
	58	+	}
	59	+	}
	60	+	if returnFunc, ok := ret.Get(1).(func(context.Context, string, int) error); ok {
	61	+	r1 = returnFunc(ctx, domain, initialLines)
	62	+	} else {
	63	+	r1 = ret.Error(1)
	64	+	}
	65	+	return r0, r1
	66	+	}
	67	+
	68	+	// MockLogService_FollowContainerLogs_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'FollowContainerLogs'
	69	+	type MockLogService_FollowContainerLogs_Call struct {
	70	+	*mock.Call
	71	+	}
	72	+
	73	+	// FollowContainerLogs is a helper method to define mock.On call
	74	+	// - ctx context.Context
	75	+	// - domain string
	76	+	// - initialLines int
	77	+	func (_e MockLogService_Expecter) FollowContainerLogs(ctx interface{}, domain interface{}, initialLines interface{}) MockLogService_FollowContainerLogs_Call {
	78	+	return &MockLogService_FollowContainerLogs_Call{Call: _e.mock.On("FollowContainerLogs", ctx, domain, initialLines)}
	79	+	}
	80	+
	81	+	func (_c MockLogService_FollowContainerLogs_Call) Run(run func(ctx context.Context, domain string, initialLines int)) MockLogService_FollowContainerLogs_Call {
	82	+	_c.Call.Run(func(args mock.Arguments) {
	83	+	var arg0 context.Context
	84	+	if args[0] != nil {
	85	+	arg0 = args[0].(context.Context)
	86	+	}
	87	+	var arg1 string
	88	+	if args[1] != nil {
	89	+	arg1 = args[1].(string)
	90	+	}
	91	+	var arg2 int
	92	+	if args[2] != nil {
	93	+	arg2 = args[2].(int)
	94	+	}
	95	+	run(
	96	+	arg0,
	97	+	arg1,
	98	+	arg2,
	99	+	)
	100	+	})
	101	+	return _c
	102	+	}
	103	+
	104	+	func (_c MockLogService_FollowContainerLogs_Call) Return(stringCh <-chan string, err error) MockLogService_FollowContainerLogs_Call {
	105	+	_c.Call.Return(stringCh, err)
	106	+	return _c
	107	+	}
	108	+
	109	+	func (_c MockLogService_FollowContainerLogs_Call) RunAndReturn(run func(ctx context.Context, domain string, initialLines int) (<-chan string, error)) MockLogService_FollowContainerLogs_Call {
	110	+	_c.Call.Return(run)
	111	+	return _c
	112	+	}
	113	+
	114	+	// FollowProcessLogs provides a mock function for the type MockLogService
	115	+	func (_mock *MockLogService) FollowProcessLogs(ctx context.Context, initialLines int) (<-chan string, error) {
	116	+	ret := _mock.Called(ctx, initialLines)
	117	+
	118	+	if len(ret) == 0 {
	119	+	panic("no return value specified for FollowProcessLogs")
	120	+	}
	121	+
	122	+	var r0 <-chan string
	123	+	var r1 error
	124	+	if returnFunc, ok := ret.Get(0).(func(context.Context, int) (<-chan string, error)); ok {
	125	+	return returnFunc(ctx, initialLines)
	126	+	}
	127	+	if returnFunc, ok := ret.Get(0).(func(context.Context, int) <-chan string); ok {
	128	+	r0 = returnFunc(ctx, initialLines)
	129	+	} else {
	130	+	if ret.Get(0) != nil {
	131	+	r0 = ret.Get(0).(<-chan string)
	132	+	}
	133	+	}
	134	+	if returnFunc, ok := ret.Get(1).(func(context.Context, int) error); ok {
	135	+	r1 = returnFunc(ctx, initialLines)
	136	+	} else {
	137	+	r1 = ret.Error(1)
	138	+	}
	139	+	return r0, r1
	140	+	}
	141	+
	142	+	// MockLogService_FollowProcessLogs_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'FollowProcessLogs'
	143	+	type MockLogService_FollowProcessLogs_Call struct {
	144	+	*mock.Call
	145	+	}
	146	+
	147	+	// FollowProcessLogs is a helper method to define mock.On call
	148	+	// - ctx context.Context
	149	+	// - initialLines int
	150	+	func (_e MockLogService_Expecter) FollowProcessLogs(ctx interface{}, initialLines interface{}) MockLogService_FollowProcessLogs_Call {
	151	+	return &MockLogService_FollowProcessLogs_Call{Call: _e.mock.On("FollowProcessLogs", ctx, initialLines)}
	152	+	}
	153	+
	154	+	func (_c MockLogService_FollowProcessLogs_Call) Run(run func(ctx context.Context, initialLines int)) MockLogService_FollowProcessLogs_Call {
	155	+	_c.Call.Run(func(args mock.Arguments) {
	156	+	var arg0 context.Context
	157	+	if args[0] != nil {
	158	+	arg0 = args[0].(context.Context)
	159	+	}
	160	+	var arg1 int
	161	+	if args[1] != nil {
	162	+	arg1 = args[1].(int)
	163	+	}
	164	+	run(
	165	+	arg0,
	166	+	arg1,
	167	+	)
	168	+	})
	169	+	return _c
	170	+	}
	171	+
	172	+	func (_c MockLogService_FollowProcessLogs_Call) Return(stringCh <-chan string, err error) MockLogService_FollowProcessLogs_Call {
	173	+	_c.Call.Return(stringCh, err)
	174	+	return _c
	175	+	}
	176	+
	177	+	func (_c MockLogService_FollowProcessLogs_Call) RunAndReturn(run func(ctx context.Context, initialLines int) (<-chan string, error)) MockLogService_FollowProcessLogs_Call {
	178	+	_c.Call.Return(run)
	179	+	return _c
	180	+	}
	181	+
	182	+	// GetContainerLogs provides a mock function for the type MockLogService
	183	+	func (_mock *MockLogService) GetContainerLogs(ctx context.Context, domain string, lines int) ([]string, error) {
	184	+	ret := _mock.Called(ctx, domain, lines)
	185	+
	186	+	if len(ret) == 0 {
	187	+	panic("no return value specified for GetContainerLogs")
	188	+	}
	189	+
	190	+	var r0 []string
	191	+	var r1 error
	192	+	if returnFunc, ok := ret.Get(0).(func(context.Context, string, int) ([]string, error)); ok {
	193	+	return returnFunc(ctx, domain, lines)
	194	+	}
	195	+	if returnFunc, ok := ret.Get(0).(func(context.Context, string, int) []string); ok {
	196	+	r0 = returnFunc(ctx, domain, lines)
	197	+	} else {
	198	+	if ret.Get(0) != nil {
	199	+	r0 = ret.Get(0).([]string)
	200	+	}
	201	+	}
	202	+	if returnFunc, ok := ret.Get(1).(func(context.Context, string, int) error); ok {
	203	+	r1 = returnFunc(ctx, domain, lines)
	204	+	} else {
	205	+	r1 = ret.Error(1)
	206	+	}
	207	+	return r0, r1
	208	+	}
	209	+
	210	+	// MockLogService_GetContainerLogs_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'GetContainerLogs'
	211	+	type MockLogService_GetContainerLogs_Call struct {
	212	+	*mock.Call
	213	+	}
	214	+
	215	+	// GetContainerLogs is a helper method to define mock.On call
	216	+	// - ctx context.Context
	217	+	// - domain string
	218	+	// - lines int
	219	+	func (_e MockLogService_Expecter) GetContainerLogs(ctx interface{}, domain interface{}, lines interface{}) MockLogService_GetContainerLogs_Call {
	220	+	return &MockLogService_GetContainerLogs_Call{Call: _e.mock.On("GetContainerLogs", ctx, domain, lines)}
	221	+	}
	222	+
	223	+	func (_c MockLogService_GetContainerLogs_Call) Run(run func(ctx context.Context, domain string, lines int)) MockLogService_GetContainerLogs_Call {
	224	+	_c.Call.Run(func(args mock.Arguments) {
	225	+	var arg0 context.Context
	226	+	if args[0] != nil {
	227	+	arg0 = args[0].(context.Context)
	228	+	}
	229	+	var arg1 string
	230	+	if args[1] != nil {
	231	+	arg1 = args[1].(string)
	232	+	}
	233	+	var arg2 int
	234	+	if args[2] != nil {
	235	+	arg2 = args[2].(int)
	236	+	}
	237	+	run(
	238	+	arg0,
	239	+	arg1,
	240	+	arg2,
	241	+	)
	242	+	})
	243	+	return _c
	244	+	}
	245	+
	246	+	func (_c MockLogService_GetContainerLogs_Call) Return(strings []string, err error) MockLogService_GetContainerLogs_Call {
	247	+	_c.Call.Return(strings, err)
	248	+	return _c
	249	+	}
	250	+
	251	+	func (_c MockLogService_GetContainerLogs_Call) RunAndReturn(run func(ctx context.Context, domain string, lines int) ([]string, error)) MockLogService_GetContainerLogs_Call {
	252	+	_c.Call.Return(run)
	253	+	return _c
	254	+	}
	255	+
	256	+	// GetProcessLogs provides a mock function for the type MockLogService
	257	+	func (_mock *MockLogService) GetProcessLogs(ctx context.Context, lines int) ([]string, error) {
	258	+	ret := _mock.Called(ctx, lines)
	259	+
	260	+	if len(ret) == 0 {
	261	+	panic("no return value specified for GetProcessLogs")
	262	+	}
	263	+
	264	+	var r0 []string
	265	+	var r1 error
	266	+	if returnFunc, ok := ret.Get(0).(func(context.Context, int) ([]string, error)); ok {
	267	+	return returnFunc(ctx, lines)
	268	+	}
	269	+	if returnFunc, ok := ret.Get(0).(func(context.Context, int) []string); ok {
	270	+	r0 = returnFunc(ctx, lines)
	271	+	} else {
	272	+	if ret.Get(0) != nil {
	273	+	r0 = ret.Get(0).([]string)
	274	+	}
	275	+	}
	276	+	if returnFunc, ok := ret.Get(1).(func(context.Context, int) error); ok {
	277	+	r1 = returnFunc(ctx, lines)
	278	+	} else {
	279	+	r1 = ret.Error(1)
	280	+	}
	281	+	return r0, r1
	282	+	}
	283	+
	284	+	// MockLogService_GetProcessLogs_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'GetProcessLogs'
	285	+	type MockLogService_GetProcessLogs_Call struct {
	286	+	*mock.Call
	287	+	}
	288	+
	289	+	// GetProcessLogs is a helper method to define mock.On call
	290	+	// - ctx context.Context
	291	+	// - lines int
	292	+	func (_e MockLogService_Expecter) GetProcessLogs(ctx interface{}, lines interface{}) MockLogService_GetProcessLogs_Call {
	293	+	return &MockLogService_GetProcessLogs_Call{Call: _e.mock.On("GetProcessLogs", ctx, lines)}
	294	+	}
	295	+
	296	+	func (_c MockLogService_GetProcessLogs_Call) Run(run func(ctx context.Context, lines int)) MockLogService_GetProcessLogs_Call {
	297	+	_c.Call.Run(func(args mock.Arguments) {
	298	+	var arg0 context.Context
	299	+	if args[0] != nil {
	300	+	arg0 = args[0].(context.Context)
	301	+	}
	302	+	var arg1 int
	303	+	if args[1] != nil {
	304	+	arg1 = args[1].(int)
	305	+	}
	306	+	run(
	307	+	arg0,
	308	+	arg1,
	309	+	)
	310	+	})
	311	+	return _c
	312	+	}
	313	+
	314	+	func (_c MockLogService_GetProcessLogs_Call) Return(strings []string, err error) MockLogService_GetProcessLogs_Call {
	315	+	_c.Call.Return(strings, err)
	316	+	return _c
	317	+	}
	318	+
	319	+	func (_c MockLogService_GetProcessLogs_Call) RunAndReturn(run func(ctx context.Context, lines int) ([]string, error)) MockLogService_GetProcessLogs_Call {
	320	+	_c.Call.Return(run)
	321	+	return _c
	322	+	}

@@ -0,0 +1,322 @@
	1	+	// Code generated by mockery; DO NOT EDIT.
	2	+	// github.com/vektra/mockery
	3	+	// template: testify
	4	+
	5	+	package mocks
	6	+
	7	+	import (
	8	+	"context"
	9	+
	10	+	mock "github.com/stretchr/testify/mock"
	11	+	)
	12	+
	13	+	// NewMockLogService creates a new instance of MockLogService. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
	14	+	// The first argument is typically a *testing.T value.
	15	+	func NewMockLogService(t interface {
	16	+	mock.TestingT
	17	+	Cleanup(func())
	18	+	}) *MockLogService {
	19	+	mock := &MockLogService{}
	20	+	mock.Mock.Test(t)
	21	+
	22	+	t.Cleanup(func() { mock.AssertExpectations(t) })
	23	+
	24	+	return mock
	25	+	}
	26	+
	27	+	// MockLogService is an autogenerated mock type for the LogService type
	28	+	type MockLogService struct {
	29	+	mock.Mock
	30	+	}
	31	+
	32	+	type MockLogService_Expecter struct {
	33	+	mock *mock.Mock
	34	+	}
	35	+
	36	+	func (_m MockLogService) EXPECT() MockLogService_Expecter {
	37	+	return &MockLogService_Expecter{mock: &_m.Mock}
	38	+	}
	39	+
	40	+	// FollowContainerLogs provides a mock function for the type MockLogService
	41	+	func (_mock *MockLogService) FollowContainerLogs(ctx context.Context, domain string, initialLines int) (<-chan string, error) {
	42	+	ret := _mock.Called(ctx, domain, initialLines)
	43	+
	44	+	if len(ret) == 0 {
	45	+	panic("no return value specified for FollowContainerLogs")
	46	+	}
	47	+
	48	+	var r0 <-chan string
	49	+	var r1 error
	50	+	if returnFunc, ok := ret.Get(0).(func(context.Context, string, int) (<-chan string, error)); ok {
	51	+	return returnFunc(ctx, domain, initialLines)
	52	+	}
	53	+	if returnFunc, ok := ret.Get(0).(func(context.Context, string, int) <-chan string); ok {
	54	+	r0 = returnFunc(ctx, domain, initialLines)
	55	+	} else {
	56	+	if ret.Get(0) != nil {
	57	+	r0 = ret.Get(0).(<-chan string)
	58	+	}
	59	+	}
	60	+	if returnFunc, ok := ret.Get(1).(func(context.Context, string, int) error); ok {
	61	+	r1 = returnFunc(ctx, domain, initialLines)
	62	+	} else {
	63	+	r1 = ret.Error(1)
	64	+	}
	65	+	return r0, r1
	66	+	}
	67	+
	68	+	// MockLogService_FollowContainerLogs_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'FollowContainerLogs'
	69	+	type MockLogService_FollowContainerLogs_Call struct {
	70	+	*mock.Call
	71	+	}
	72	+
	73	+	// FollowContainerLogs is a helper method to define mock.On call
	74	+	// - ctx context.Context
	75	+	// - domain string
	76	+	// - initialLines int
	77	+	func (_e MockLogService_Expecter) FollowContainerLogs(ctx interface{}, domain interface{}, initialLines interface{}) MockLogService_FollowContainerLogs_Call {
	78	+	return &MockLogService_FollowContainerLogs_Call{Call: _e.mock.On("FollowContainerLogs", ctx, domain, initialLines)}
	79	+	}
	80	+
	81	+	func (_c MockLogService_FollowContainerLogs_Call) Run(run func(ctx context.Context, domain string, initialLines int)) MockLogService_FollowContainerLogs_Call {
	82	+	_c.Call.Run(func(args mock.Arguments) {
	83	+	var arg0 context.Context
	84	+	if args[0] != nil {
	85	+	arg0 = args[0].(context.Context)
	86	+	}
	87	+	var arg1 string
	88	+	if args[1] != nil {
	89	+	arg1 = args[1].(string)
	90	+	}
	91	+	var arg2 int
	92	+	if args[2] != nil {
	93	+	arg2 = args[2].(int)
	94	+	}
	95	+	run(
	96	+	arg0,
	97	+	arg1,
	98	+	arg2,
	99	+	)
	100	+	})
	101	+	return _c
	102	+	}
	103	+
	104	+	func (_c MockLogService_FollowContainerLogs_Call) Return(stringCh <-chan string, err error) MockLogService_FollowContainerLogs_Call {
	105	+	_c.Call.Return(stringCh, err)
	106	+	return _c
	107	+	}
	108	+
	109	+	func (_c MockLogService_FollowContainerLogs_Call) RunAndReturn(run func(ctx context.Context, domain string, initialLines int) (<-chan string, error)) MockLogService_FollowContainerLogs_Call {
	110	+	_c.Call.Return(run)
	111	+	return _c
	112	+	}
	113	+
	114	+	// FollowProcessLogs provides a mock function for the type MockLogService
	115	+	func (_mock *MockLogService) FollowProcessLogs(ctx context.Context, initialLines int) (<-chan string, error) {
	116	+	ret := _mock.Called(ctx, initialLines)
	117	+
	118	+	if len(ret) == 0 {
	119	+	panic("no return value specified for FollowProcessLogs")
	120	+	}
	121	+
	122	+	var r0 <-chan string
	123	+	var r1 error
	124	+	if returnFunc, ok := ret.Get(0).(func(context.Context, int) (<-chan string, error)); ok {
	125	+	return returnFunc(ctx, initialLines)
	126	+	}
	127	+	if returnFunc, ok := ret.Get(0).(func(context.Context, int) <-chan string); ok {
	128	+	r0 = returnFunc(ctx, initialLines)
	129	+	} else {
	130	+	if ret.Get(0) != nil {
	131	+	r0 = ret.Get(0).(<-chan string)
	132	+	}
	133	+	}
	134	+	if returnFunc, ok := ret.Get(1).(func(context.Context, int) error); ok {
	135	+	r1 = returnFunc(ctx, initialLines)
	136	+	} else {
	137	+	r1 = ret.Error(1)
	138	+	}
	139	+	return r0, r1
	140	+	}
	141	+
	142	+	// MockLogService_FollowProcessLogs_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'FollowProcessLogs'
	143	+	type MockLogService_FollowProcessLogs_Call struct {
	144	+	*mock.Call
	145	+	}
	146	+
	147	+	// FollowProcessLogs is a helper method to define mock.On call
	148	+	// - ctx context.Context
	149	+	// - initialLines int
	150	+	func (_e MockLogService_Expecter) FollowProcessLogs(ctx interface{}, initialLines interface{}) MockLogService_FollowProcessLogs_Call {
	151	+	return &MockLogService_FollowProcessLogs_Call{Call: _e.mock.On("FollowProcessLogs", ctx, initialLines)}
	152	+	}
	153	+
	154	+	func (_c MockLogService_FollowProcessLogs_Call) Run(run func(ctx context.Context, initialLines int)) MockLogService_FollowProcessLogs_Call {
	155	+	_c.Call.Run(func(args mock.Arguments) {
	156	+	var arg0 context.Context
	157	+	if args[0] != nil {
	158	+	arg0 = args[0].(context.Context)
	159	+	}
	160	+	var arg1 int
	161	+	if args[1] != nil {
	162	+	arg1 = args[1].(int)
	163	+	}
	164	+	run(
	165	+	arg0,
	166	+	arg1,
	167	+	)
	168	+	})
	169	+	return _c
	170	+	}
	171	+
	172	+	func (_c MockLogService_FollowProcessLogs_Call) Return(stringCh <-chan string, err error) MockLogService_FollowProcessLogs_Call {
	173	+	_c.Call.Return(stringCh, err)
	174	+	return _c
	175	+	}
	176	+
	177	+	func (_c MockLogService_FollowProcessLogs_Call) RunAndReturn(run func(ctx context.Context, initialLines int) (<-chan string, error)) MockLogService_FollowProcessLogs_Call {
	178	+	_c.Call.Return(run)
	179	+	return _c
	180	+	}
	181	+
	182	+	// GetContainerLogs provides a mock function for the type MockLogService
	183	+	func (_mock *MockLogService) GetContainerLogs(ctx context.Context, domain string, lines int) ([]string, error) {
	184	+	ret := _mock.Called(ctx, domain, lines)
	185	+
	186	+	if len(ret) == 0 {
	187	+	panic("no return value specified for GetContainerLogs")
	188	+	}
	189	+
	190	+	var r0 []string
	191	+	var r1 error
	192	+	if returnFunc, ok := ret.Get(0).(func(context.Context, string, int) ([]string, error)); ok {
	193	+	return returnFunc(ctx, domain, lines)
	194	+	}
	195	+	if returnFunc, ok := ret.Get(0).(func(context.Context, string, int) []string); ok {
	196	+	r0 = returnFunc(ctx, domain, lines)
	197	+	} else {
	198	+	if ret.Get(0) != nil {
	199	+	r0 = ret.Get(0).([]string)
	200	+	}
	201	+	}
	202	+	if returnFunc, ok := ret.Get(1).(func(context.Context, string, int) error); ok {
	203	+	r1 = returnFunc(ctx, domain, lines)
	204	+	} else {
	205	+	r1 = ret.Error(1)
	206	+	}
	207	+	return r0, r1
	208	+	}
	209	+
	210	+	// MockLogService_GetContainerLogs_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'GetContainerLogs'
	211	+	type MockLogService_GetContainerLogs_Call struct {
	212	+	*mock.Call
	213	+	}
	214	+
	215	+	// GetContainerLogs is a helper method to define mock.On call
	216	+	// - ctx context.Context
	217	+	// - domain string
	218	+	// - lines int
	219	+	func (_e MockLogService_Expecter) GetContainerLogs(ctx interface{}, domain interface{}, lines interface{}) MockLogService_GetContainerLogs_Call {
	220	+	return &MockLogService_GetContainerLogs_Call{Call: _e.mock.On("GetContainerLogs", ctx, domain, lines)}
	221	+	}
	222	+
	223	+	func (_c MockLogService_GetContainerLogs_Call) Run(run func(ctx context.Context, domain string, lines int)) MockLogService_GetContainerLogs_Call {
	224	+	_c.Call.Run(func(args mock.Arguments) {
	225	+	var arg0 context.Context
	226	+	if args[0] != nil {
	227	+	arg0 = args[0].(context.Context)
	228	+	}
	229	+	var arg1 string
	230	+	if args[1] != nil {
	231	+	arg1 = args[1].(string)
	232	+	}
	233	+	var arg2 int
	234	+	if args[2] != nil {
	235	+	arg2 = args[2].(int)
	236	+	}
	237	+	run(
	238	+	arg0,
	239	+	arg1,
	240	+	arg2,
	241	+	)
	242	+	})
	243	+	return _c
	244	+	}
	245	+
	246	+	func (_c MockLogService_GetContainerLogs_Call) Return(strings []string, err error) MockLogService_GetContainerLogs_Call {
	247	+	_c.Call.Return(strings, err)
	248	+	return _c
	249	+	}
	250	+
	251	+	func (_c MockLogService_GetContainerLogs_Call) RunAndReturn(run func(ctx context.Context, domain string, lines int) ([]string, error)) MockLogService_GetContainerLogs_Call {
	252	+	_c.Call.Return(run)
	253	+	return _c
	254	+	}
	255	+
	256	+	// GetProcessLogs provides a mock function for the type MockLogService
	257	+	func (_mock *MockLogService) GetProcessLogs(ctx context.Context, lines int) ([]string, error) {
	258	+	ret := _mock.Called(ctx, lines)
	259	+
	260	+	if len(ret) == 0 {
	261	+	panic("no return value specified for GetProcessLogs")
	262	+	}
	263	+
	264	+	var r0 []string
	265	+	var r1 error
	266	+	if returnFunc, ok := ret.Get(0).(func(context.Context, int) ([]string, error)); ok {
	267	+	return returnFunc(ctx, lines)
	268	+	}
	269	+	if returnFunc, ok := ret.Get(0).(func(context.Context, int) []string); ok {
	270	+	r0 = returnFunc(ctx, lines)
	271	+	} else {
	272	+	if ret.Get(0) != nil {
	273	+	r0 = ret.Get(0).([]string)
	274	+	}
	275	+	}
	276	+	if returnFunc, ok := ret.Get(1).(func(context.Context, int) error); ok {
	277	+	r1 = returnFunc(ctx, lines)
	278	+	} else {
	279	+	r1 = ret.Error(1)
	280	+	}
	281	+	return r0, r1
	282	+	}
	283	+
	284	+	// MockLogService_GetProcessLogs_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'GetProcessLogs'
	285	+	type MockLogService_GetProcessLogs_Call struct {
	286	+	*mock.Call
	287	+	}
	288	+
	289	+	// GetProcessLogs is a helper method to define mock.On call
	290	+	// - ctx context.Context
	291	+	// - lines int
	292	+	func (_e MockLogService_Expecter) GetProcessLogs(ctx interface{}, lines interface{}) MockLogService_GetProcessLogs_Call {
	293	+	return &MockLogService_GetProcessLogs_Call{Call: _e.mock.On("GetProcessLogs", ctx, lines)}
	294	+	}
	295	+
	296	+	func (_c MockLogService_GetProcessLogs_Call) Run(run func(ctx context.Context, lines int)) MockLogService_GetProcessLogs_Call {
	297	+	_c.Call.Run(func(args mock.Arguments) {
	298	+	var arg0 context.Context
	299	+	if args[0] != nil {
	300	+	arg0 = args[0].(context.Context)
	301	+	}
	302	+	var arg1 int
	303	+	if args[1] != nil {
	304	+	arg1 = args[1].(int)
	305	+	}
	306	+	run(
	307	+	arg0,
	308	+	arg1,
	309	+	)
	310	+	})
	311	+	return _c
	312	+	}
	313	+
	314	+	func (_c MockLogService_GetProcessLogs_Call) Return(strings []string, err error) MockLogService_GetProcessLogs_Call {
	315	+	_c.Call.Return(strings, err)
	316	+	return _c
	317	+	}
	318	+
	319	+	func (_c MockLogService_GetProcessLogs_Call) RunAndReturn(run func(ctx context.Context, lines int) ([]string, error)) MockLogService_GetProcessLogs_Call {
	320	+	_c.Call.Return(run)
	321	+	return _c
	322	+	}

A internal/usecase/logs/service.go +357 -0

@@ -0,0 +1,357 @@
	1	+	// Package logs implements the log access use case.
	2	+	package logs
	3	+
	4	+	import (
	5	+	"bufio"
	6	+	"context"
	7	+	"encoding/binary"
	8	+	"fmt"
	9	+	"io"
	10	+	"os"
	11	+	"strings"
	12	+	"time"
	13	+
	14	+	"github.com/bnema/zerowrap"
	15	+
	16	+	"gordon/internal/boundaries/in"
	17	+	"gordon/internal/boundaries/out"
	18	+	)
	19	+
	20	+	// Service implements the LogService interface.
	21	+	type Service struct {
	22	+	logFilePath string
	23	+	containerSvc in.ContainerService
	24	+	runtime out.ContainerRuntime
	25	+	log zerowrap.Logger
	26	+	}
	27	+
	28	+	// NewService creates a new log service.
	29	+	func NewService(
	30	+	logFilePath string,
	31	+	containerSvc in.ContainerService,
	32	+	runtime out.ContainerRuntime,
	33	+	log zerowrap.Logger,
	34	+	) *Service {
	35	+	return &Service{
	36	+	logFilePath: logFilePath,
	37	+	containerSvc: containerSvc,
	38	+	runtime: runtime,
	39	+	log: log,
	40	+	}
	41	+	}
	42	+
	43	+	// GetProcessLogs returns the last N lines of Gordon process logs.
	44	+	func (s *Service) GetProcessLogs(ctx context.Context, lines int) ([]string, error) {
	45	+	ctx = zerowrap.CtxWithFields(ctx, map[string]any{
	46	+	zerowrap.FieldLayer: "usecase",
	47	+	zerowrap.FieldUseCase: "GetProcessLogs",
	48	+	"lines": lines,
	49	+	})
	50	+	log := zerowrap.FromCtx(ctx)
	51	+
	52	+	if s.logFilePath == "" {
	53	+	return nil, fmt.Errorf("log file path not configured")
	54	+	}
	55	+
	56	+	file, err := os.Open(s.logFilePath)
	57	+	if err != nil {
	58	+	if os.IsNotExist(err) {
	59	+	return []string{}, nil
	60	+	}
	61	+	return nil, log.WrapErr(err, "failed to open log file")
	62	+	}
	63	+	defer file.Close()
	64	+
	65	+	return tailLines(file, lines)
	66	+	}
	67	+
	68	+	// FollowProcessLogs returns a channel that streams Gordon process log lines.
	69	+	func (s *Service) FollowProcessLogs(ctx context.Context, initialLines int) (<-chan string, error) {
	70	+	ctx = zerowrap.CtxWithFields(ctx, map[string]any{
	71	+	zerowrap.FieldLayer: "usecase",
	72	+	zerowrap.FieldUseCase: "FollowProcessLogs",
	73	+	"initial_lines": initialLines,
	74	+	})
	75	+	log := zerowrap.FromCtx(ctx)
	76	+
	77	+	if s.logFilePath == "" {
	78	+	return nil, fmt.Errorf("log file path not configured")
	79	+	}
	80	+
	81	+	file, err := os.Open(s.logFilePath)
	82	+	if err != nil {
	83	+	return nil, log.WrapErr(err, "failed to open log file")
	84	+	}
	85	+
	86	+	ch := make(chan string, 100)
	87	+
	88	+	go func() {
	89	+	defer close(ch)
	90	+	defer file.Close()
	91	+
	92	+	// First, get initial lines
	93	+	if initialLines > 0 {
	94	+	lines, err := tailLines(file, initialLines)
	95	+	if err != nil {
	96	+	log.Warn().Err(err).Msg("failed to read initial lines")
	97	+	} else {
	98	+	for _, line := range lines {
	99	+	select {
	100	+	case ch <- line:
	101	+	case <-ctx.Done():
	102	+	return
	103	+	}
	104	+	}
	105	+	}
	106	+	}
	107	+
	108	+	// Seek to end for following
	109	+	if _, err := file.Seek(0, io.SeekEnd); err != nil {
	110	+	log.Warn().Err(err).Msg("failed to seek to end")
	111	+	return
	112	+	}
	113	+
	114	+	// Follow new lines
	115	+	reader := bufio.NewReader(file)
	116	+	for {
	117	+	select {
	118	+	case <-ctx.Done():
	119	+	return
	120	+	default:
	121	+	line, err := reader.ReadString('\n')
	122	+	if err != nil {
	123	+	if err == io.EOF {
	124	+	time.Sleep(100 * time.Millisecond)
	125	+	continue
	126	+	}
	127	+	log.Warn().Err(err).Msg("error reading log file")
	128	+	return
	129	+	}
	130	+	line = strings.TrimRight(line, "\n\r")
	131	+	select {
	132	+	case ch <- line:
	133	+	case <-ctx.Done():
	134	+	return
	135	+	}
	136	+	}
	137	+	}
	138	+	}()
	139	+
	140	+	return ch, nil
	141	+	}
	142	+
	143	+	// GetContainerLogs returns the last N lines of container logs for a domain.
	144	+	func (s *Service) GetContainerLogs(ctx context.Context, domain string, lines int) ([]string, error) {
	145	+	ctx = zerowrap.CtxWithFields(ctx, map[string]any{
	146	+	zerowrap.FieldLayer: "usecase",
	147	+	zerowrap.FieldUseCase: "GetContainerLogs",
	148	+	"domain": domain,
	149	+	"lines": lines,
	150	+	})
	151	+	log := zerowrap.FromCtx(ctx)
	152	+
	153	+	// Get container by domain
	154	+	container, ok := s.containerSvc.Get(ctx, domain)
	155	+	if !ok \|\| container == nil {
	156	+	return nil, fmt.Errorf("container not found for domain: %s", domain)
	157	+	}
	158	+
	159	+	// Get logs from container runtime (non-follow mode)
	160	+	reader, err := s.runtime.GetContainerLogs(ctx, container.ID, false)
	161	+	if err != nil {
	162	+	return nil, log.WrapErr(err, "failed to get container logs")
	163	+	}
	164	+	defer reader.Close()
	165	+
	166	+	// Parse Docker log stream and get lines
	167	+	logLines, err := parseDockerLogs(reader)
	168	+	if err != nil {
	169	+	return nil, log.WrapErr(err, "failed to parse container logs")
	170	+	}
	171	+
	172	+	// Return last N lines
	173	+	if len(logLines) > lines {
	174	+	logLines = logLines[len(logLines)-lines:]
	175	+	}
	176	+
	177	+	return logLines, nil
	178	+	}
	179	+
	180	+	// FollowContainerLogs returns a channel that streams container log lines.
	181	+	func (s *Service) FollowContainerLogs(ctx context.Context, domain string, initialLines int) (<-chan string, error) {
	182	+	ctx = zerowrap.CtxWithFields(ctx, map[string]any{
	183	+	zerowrap.FieldLayer: "usecase",
	184	+	zerowrap.FieldUseCase: "FollowContainerLogs",
	185	+	"domain": domain,
	186	+	"initial_lines": initialLines,
	187	+	})
	188	+	log := zerowrap.FromCtx(ctx)
	189	+
	190	+	// Get container by domain
	191	+	container, ok := s.containerSvc.Get(ctx, domain)
	192	+	if !ok \|\| container == nil {
	193	+	return nil, fmt.Errorf("container not found for domain: %s", domain)
	194	+	}
	195	+
	196	+	// Get logs from container runtime (follow mode)
	197	+	reader, err := s.runtime.GetContainerLogs(ctx, container.ID, true)
	198	+	if err != nil {
	199	+	return nil, log.WrapErr(err, "failed to get container logs")
	200	+	}
	201	+
	202	+	ch := make(chan string, 100)
	203	+
	204	+	go func() {
	205	+	defer close(ch)
	206	+	defer reader.Close()
	207	+
	208	+	// Stream Docker logs
	209	+	err := streamDockerLogs(ctx, reader, ch)
	210	+	if err != nil && ctx.Err() == nil {
	211	+	log.Warn().Err(err).Msg("error streaming container logs")
	212	+	}
	213	+	}()
	214	+
	215	+	return ch, nil
	216	+	}
	217	+
	218	+	// tailLines reads the last N lines from a file using a ring buffer.
	219	+	func tailLines(file *os.File, n int) ([]string, error) {
	220	+	if n <= 0 {
	221	+	return []string{}, nil
	222	+	}
	223	+
	224	+	// Seek to beginning
	225	+	if _, err := file.Seek(0, io.SeekStart); err != nil {
	226	+	return nil, err
	227	+	}
	228	+
	229	+	scanner := bufio.NewScanner(file)
	230	+	buffer := make([]string, n)
	231	+	index := 0
	232	+	total := 0
	233	+
	234	+	for scanner.Scan() {
	235	+	buffer[index] = scanner.Text()
	236	+	index = (index + 1) % n
	237	+	total++
	238	+	}
	239	+
	240	+	if err := scanner.Err(); err != nil {
	241	+	return nil, err
	242	+	}
	243	+
	244	+	if total == 0 {
	245	+	return []string{}, nil
	246	+	}
	247	+
	248	+	// Build result in correct order
	249	+	var result []string
	250	+	if total <= n {
	251	+	result = make([]string, total)
	252	+	for i := 0; i < total; i++ {
	253	+	result[i] = buffer[i]
	254	+	}
	255	+	} else {
	256	+	result = make([]string, n)
	257	+	for i := 0; i < n; i++ {
	258	+	result[i] = buffer[(index+i)%n]
	259	+	}
	260	+	}
	261	+
	262	+	return result, nil
	263	+	}
	264	+
	265	+	// parseDockerLogs parses Docker multiplexed log stream and returns lines.
	266	+	// Docker logs have an 8-byte header: [stream type (1), padding (3), size (4)]
	267	+	func parseDockerLogs(reader io.Reader) ([]string, error) {
	268	+	var lines []string
	269	+	header := make([]byte, 8)
	270	+
	271	+	for {
	272	+	// Read header
	273	+	_, err := io.ReadFull(reader, header)
	274	+	if err != nil {
	275	+	if err == io.EOF {
	276	+	break
	277	+	}
	278	+	return lines, nil // Return what we have
	279	+	}
	280	+
	281	+	// Get payload size from header (big endian)
	282	+	size := binary.BigEndian.Uint32(header[4:8])
	283	+	if size == 0 {
	284	+	continue
	285	+	}
	286	+
	287	+	// Read payload
	288	+	payload := make([]byte, size)
	289	+	_, err = io.ReadFull(reader, payload)
	290	+	if err != nil {
	291	+	if err == io.EOF {
	292	+	break
	293	+	}
	294	+	return lines, nil
	295	+	}
	296	+
	297	+	// Split by newlines and add to result
	298	+	content := strings.TrimRight(string(payload), "\n\r")
	299	+	for _, line := range strings.Split(content, "\n") {
	300	+	if line != "" {
	301	+	lines = append(lines, line)
	302	+	}
	303	+	}
	304	+	}
	305	+
	306	+	return lines, nil
	307	+	}
	308	+
	309	+	// streamDockerLogs streams Docker multiplexed log stream to a channel.
	310	+	func streamDockerLogs(ctx context.Context, reader io.Reader, ch chan<- string) error {
	311	+	header := make([]byte, 8)
	312	+
	313	+	for {
	314	+	select {
	315	+	case <-ctx.Done():
	316	+	return ctx.Err()
	317	+	default:
	318	+	}
	319	+
	320	+	// Read header
	321	+	_, err := io.ReadFull(reader, header)
	322	+	if err != nil {
	323	+	if err == io.EOF {
	324	+	return nil
	325	+	}
	326	+	return err
	327	+	}
	328	+
	329	+	// Get payload size
	330	+	size := binary.BigEndian.Uint32(header[4:8])
	331	+	if size == 0 {
	332	+	continue
	333	+	}
	334	+
	335	+	// Read payload
	336	+	payload := make([]byte, size)
	337	+	_, err = io.ReadFull(reader, payload)
	338	+	if err != nil {
	339	+	if err == io.EOF {
	340	+	return nil
	341	+	}
	342	+	return err
	343	+	}
	344	+
	345	+	// Split by newlines and send to channel
	346	+	content := strings.TrimRight(string(payload), "\n\r")
	347	+	for _, line := range strings.Split(content, "\n") {
	348	+	if line != "" {
	349	+	select {
	350	+	case ch <- line:
	351	+	case <-ctx.Done():
	352	+	return ctx.Err()
	353	+	}
	354	+	}
	355	+	}
	356	+	}
	357	+	}

@@ -0,0 +1,357 @@
	1	+	// Package logs implements the log access use case.
	2	+	package logs
	3	+
	4	+	import (
	5	+	"bufio"
	6	+	"context"
	7	+	"encoding/binary"
	8	+	"fmt"
	9	+	"io"
	10	+	"os"
	11	+	"strings"
	12	+	"time"
	13	+
	14	+	"github.com/bnema/zerowrap"
	15	+
	16	+	"gordon/internal/boundaries/in"
	17	+	"gordon/internal/boundaries/out"
	18	+	)
	19	+
	20	+	// Service implements the LogService interface.
	21	+	type Service struct {
	22	+	logFilePath string
	23	+	containerSvc in.ContainerService
	24	+	runtime out.ContainerRuntime
	25	+	log zerowrap.Logger
	26	+	}
	27	+
	28	+	// NewService creates a new log service.
	29	+	func NewService(
	30	+	logFilePath string,
	31	+	containerSvc in.ContainerService,
	32	+	runtime out.ContainerRuntime,
	33	+	log zerowrap.Logger,
	34	+	) *Service {
	35	+	return &Service{
	36	+	logFilePath: logFilePath,
	37	+	containerSvc: containerSvc,
	38	+	runtime: runtime,
	39	+	log: log,
	40	+	}
	41	+	}
	42	+
	43	+	// GetProcessLogs returns the last N lines of Gordon process logs.
	44	+	func (s *Service) GetProcessLogs(ctx context.Context, lines int) ([]string, error) {
	45	+	ctx = zerowrap.CtxWithFields(ctx, map[string]any{
	46	+	zerowrap.FieldLayer: "usecase",
	47	+	zerowrap.FieldUseCase: "GetProcessLogs",
	48	+	"lines": lines,
	49	+	})
	50	+	log := zerowrap.FromCtx(ctx)
	51	+
	52	+	if s.logFilePath == "" {
	53	+	return nil, fmt.Errorf("log file path not configured")
	54	+	}
	55	+
	56	+	file, err := os.Open(s.logFilePath)
	57	+	if err != nil {
	58	+	if os.IsNotExist(err) {
	59	+	return []string{}, nil
	60	+	}
	61	+	return nil, log.WrapErr(err, "failed to open log file")
	62	+	}
	63	+	defer file.Close()
	64	+
	65	+	return tailLines(file, lines)
	66	+	}
	67	+
	68	+	// FollowProcessLogs returns a channel that streams Gordon process log lines.
	69	+	func (s *Service) FollowProcessLogs(ctx context.Context, initialLines int) (<-chan string, error) {
	70	+	ctx = zerowrap.CtxWithFields(ctx, map[string]any{
	71	+	zerowrap.FieldLayer: "usecase",
	72	+	zerowrap.FieldUseCase: "FollowProcessLogs",
	73	+	"initial_lines": initialLines,
	74	+	})
	75	+	log := zerowrap.FromCtx(ctx)
	76	+
	77	+	if s.logFilePath == "" {
	78	+	return nil, fmt.Errorf("log file path not configured")
	79	+	}
	80	+
	81	+	file, err := os.Open(s.logFilePath)
	82	+	if err != nil {
	83	+	return nil, log.WrapErr(err, "failed to open log file")
	84	+	}
	85	+
	86	+	ch := make(chan string, 100)
	87	+
	88	+	go func() {
	89	+	defer close(ch)
	90	+	defer file.Close()
	91	+
	92	+	// First, get initial lines
	93	+	if initialLines > 0 {
	94	+	lines, err := tailLines(file, initialLines)
	95	+	if err != nil {
	96	+	log.Warn().Err(err).Msg("failed to read initial lines")
	97	+	} else {
	98	+	for _, line := range lines {
	99	+	select {
	100	+	case ch <- line:
	101	+	case <-ctx.Done():
	102	+	return
	103	+	}
	104	+	}
	105	+	}
	106	+	}
	107	+
	108	+	// Seek to end for following
	109	+	if _, err := file.Seek(0, io.SeekEnd); err != nil {
	110	+	log.Warn().Err(err).Msg("failed to seek to end")
	111	+	return
	112	+	}
	113	+
	114	+	// Follow new lines
	115	+	reader := bufio.NewReader(file)
	116	+	for {
	117	+	select {
	118	+	case <-ctx.Done():
	119	+	return
	120	+	default:
	121	+	line, err := reader.ReadString('\n')
	122	+	if err != nil {
	123	+	if err == io.EOF {
	124	+	time.Sleep(100 * time.Millisecond)
	125	+	continue
	126	+	}
	127	+	log.Warn().Err(err).Msg("error reading log file")
	128	+	return
	129	+	}
	130	+	line = strings.TrimRight(line, "\n\r")
	131	+	select {
	132	+	case ch <- line:
	133	+	case <-ctx.Done():
	134	+	return
	135	+	}
	136	+	}
	137	+	}
	138	+	}()
	139	+
	140	+	return ch, nil
	141	+	}
	142	+
	143	+	// GetContainerLogs returns the last N lines of container logs for a domain.
	144	+	func (s *Service) GetContainerLogs(ctx context.Context, domain string, lines int) ([]string, error) {
	145	+	ctx = zerowrap.CtxWithFields(ctx, map[string]any{
	146	+	zerowrap.FieldLayer: "usecase",
	147	+	zerowrap.FieldUseCase: "GetContainerLogs",
	148	+	"domain": domain,
	149	+	"lines": lines,
	150	+	})
	151	+	log := zerowrap.FromCtx(ctx)
	152	+
	153	+	// Get container by domain
	154	+	container, ok := s.containerSvc.Get(ctx, domain)
	155	+	if !ok \|\| container == nil {
	156	+	return nil, fmt.Errorf("container not found for domain: %s", domain)
	157	+	}
	158	+
	159	+	// Get logs from container runtime (non-follow mode)
	160	+	reader, err := s.runtime.GetContainerLogs(ctx, container.ID, false)
	161	+	if err != nil {
	162	+	return nil, log.WrapErr(err, "failed to get container logs")
	163	+	}
	164	+	defer reader.Close()
	165	+
	166	+	// Parse Docker log stream and get lines
	167	+	logLines, err := parseDockerLogs(reader)
	168	+	if err != nil {
	169	+	return nil, log.WrapErr(err, "failed to parse container logs")
	170	+	}
	171	+
	172	+	// Return last N lines
	173	+	if len(logLines) > lines {
	174	+	logLines = logLines[len(logLines)-lines:]
	175	+	}
	176	+
	177	+	return logLines, nil
	178	+	}
	179	+
	180	+	// FollowContainerLogs returns a channel that streams container log lines.
	181	+	func (s *Service) FollowContainerLogs(ctx context.Context, domain string, initialLines int) (<-chan string, error) {
	182	+	ctx = zerowrap.CtxWithFields(ctx, map[string]any{
	183	+	zerowrap.FieldLayer: "usecase",
	184	+	zerowrap.FieldUseCase: "FollowContainerLogs",
	185	+	"domain": domain,
	186	+	"initial_lines": initialLines,
	187	+	})
	188	+	log := zerowrap.FromCtx(ctx)
	189	+
	190	+	// Get container by domain
	191	+	container, ok := s.containerSvc.Get(ctx, domain)
	192	+	if !ok \|\| container == nil {
	193	+	return nil, fmt.Errorf("container not found for domain: %s", domain)
	194	+	}
	195	+
	196	+	// Get logs from container runtime (follow mode)
	197	+	reader, err := s.runtime.GetContainerLogs(ctx, container.ID, true)
	198	+	if err != nil {
	199	+	return nil, log.WrapErr(err, "failed to get container logs")
	200	+	}
	201	+
	202	+	ch := make(chan string, 100)
	203	+
	204	+	go func() {
	205	+	defer close(ch)
	206	+	defer reader.Close()
	207	+
	208	+	// Stream Docker logs
	209	+	err := streamDockerLogs(ctx, reader, ch)
	210	+	if err != nil && ctx.Err() == nil {
	211	+	log.Warn().Err(err).Msg("error streaming container logs")
	212	+	}
	213	+	}()
	214	+
	215	+	return ch, nil
	216	+	}
	217	+
	218	+	// tailLines reads the last N lines from a file using a ring buffer.
	219	+	func tailLines(file *os.File, n int) ([]string, error) {
	220	+	if n <= 0 {
	221	+	return []string{}, nil
	222	+	}
	223	+
	224	+	// Seek to beginning
	225	+	if _, err := file.Seek(0, io.SeekStart); err != nil {
	226	+	return nil, err
	227	+	}
	228	+
	229	+	scanner := bufio.NewScanner(file)
	230	+	buffer := make([]string, n)
	231	+	index := 0
	232	+	total := 0
	233	+
	234	+	for scanner.Scan() {
	235	+	buffer[index] = scanner.Text()
	236	+	index = (index + 1) % n
	237	+	total++
	238	+	}
	239	+
	240	+	if err := scanner.Err(); err != nil {
	241	+	return nil, err
	242	+	}
	243	+
	244	+	if total == 0 {
	245	+	return []string{}, nil
	246	+	}
	247	+
	248	+	// Build result in correct order
	249	+	var result []string
	250	+	if total <= n {
	251	+	result = make([]string, total)
	252	+	for i := 0; i < total; i++ {
	253	+	result[i] = buffer[i]
	254	+	}
	255	+	} else {
	256	+	result = make([]string, n)
	257	+	for i := 0; i < n; i++ {
	258	+	result[i] = buffer[(index+i)%n]
	259	+	}
	260	+	}
	261	+
	262	+	return result, nil
	263	+	}
	264	+
	265	+	// parseDockerLogs parses Docker multiplexed log stream and returns lines.
	266	+	// Docker logs have an 8-byte header: [stream type (1), padding (3), size (4)]
	267	+	func parseDockerLogs(reader io.Reader) ([]string, error) {
	268	+	var lines []string
	269	+	header := make([]byte, 8)
	270	+
	271	+	for {
	272	+	// Read header
	273	+	_, err := io.ReadFull(reader, header)
	274	+	if err != nil {
	275	+	if err == io.EOF {
	276	+	break
	277	+	}
	278	+	return lines, nil // Return what we have
	279	+	}
	280	+
	281	+	// Get payload size from header (big endian)
	282	+	size := binary.BigEndian.Uint32(header[4:8])
	283	+	if size == 0 {
	284	+	continue
	285	+	}
	286	+
	287	+	// Read payload
	288	+	payload := make([]byte, size)
	289	+	_, err = io.ReadFull(reader, payload)
	290	+	if err != nil {
	291	+	if err == io.EOF {
	292	+	break
	293	+	}
	294	+	return lines, nil
	295	+	}
	296	+
	297	+	// Split by newlines and add to result
	298	+	content := strings.TrimRight(string(payload), "\n\r")
	299	+	for _, line := range strings.Split(content, "\n") {
	300	+	if line != "" {
	301	+	lines = append(lines, line)
	302	+	}
	303	+	}
	304	+	}
	305	+
	306	+	return lines, nil
	307	+	}
	308	+
	309	+	// streamDockerLogs streams Docker multiplexed log stream to a channel.
	310	+	func streamDockerLogs(ctx context.Context, reader io.Reader, ch chan<- string) error {
	311	+	header := make([]byte, 8)
	312	+
	313	+	for {
	314	+	select {
	315	+	case <-ctx.Done():
	316	+	return ctx.Err()
	317	+	default:
	318	+	}
	319	+
	320	+	// Read header
	321	+	_, err := io.ReadFull(reader, header)
	322	+	if err != nil {
	323	+	if err == io.EOF {
	324	+	return nil
	325	+	}
	326	+	return err
	327	+	}
	328	+
	329	+	// Get payload size
	330	+	size := binary.BigEndian.Uint32(header[4:8])
	331	+	if size == 0 {
	332	+	continue
	333	+	}
	334	+
	335	+	// Read payload
	336	+	payload := make([]byte, size)
	337	+	_, err = io.ReadFull(reader, payload)
	338	+	if err != nil {
	339	+	if err == io.EOF {
	340	+	return nil
	341	+	}
	342	+	return err
	343	+	}
	344	+
	345	+	// Split by newlines and send to channel
	346	+	content := strings.TrimRight(string(payload), "\n\r")
	347	+	for _, line := range strings.Split(content, "\n") {
	348	+	if line != "" {
	349	+	select {
	350	+	case ch <- line:
	351	+	case <-ctx.Done():
	352	+	return ctx.Err()
	353	+	}
	354	+	}
	355	+	}
	356	+	}
	357	+	}

A internal/usecase/logs/service_test.go +257 -0

@@ -0,0 +1,257 @@
	1	+	package logs
	2	+
	3	+	import (
	4	+	"context"
	5	+	"os"
	6	+	"path/filepath"
	7	+	"testing"
	8	+	"time"
	9	+
	10	+	"github.com/bnema/zerowrap"
	11	+	"github.com/stretchr/testify/assert"
	12	+	"github.com/stretchr/testify/mock"
	13	+	"github.com/stretchr/testify/require"
	14	+
	15	+	"gordon/internal/boundaries/in/mocks"
	16	+	outMocks "gordon/internal/boundaries/out/mocks"
	17	+	"gordon/internal/domain"
	18	+	)
	19	+
	20	+	func TestService_GetProcessLogs(t *testing.T) {
	21	+	log := zerowrap.New(zerowrap.Config{Level: "warn"})
	22	+
	23	+	t.Run("returns lines from log file", func(t *testing.T) {
	24	+	// Create temp log file with content
	25	+	tmpDir := t.TempDir()
	26	+	logPath := filepath.Join(tmpDir, "test.log")
	27	+	content := "line1\nline2\nline3\nline4\nline5\n"
	28	+	err := os.WriteFile(logPath, []byte(content), 0644)
	29	+	require.NoError(t, err)
	30	+
	31	+	containerSvc := mocks.NewMockContainerService(t)
	32	+	runtime := outMocks.NewMockContainerRuntime(t)
	33	+
	34	+	svc := NewService(logPath, containerSvc, runtime, log)
	35	+
	36	+	lines, err := svc.GetProcessLogs(context.Background(), 3)
	37	+	require.NoError(t, err)
	38	+	assert.Len(t, lines, 3)
	39	+	assert.Equal(t, []string{"line3", "line4", "line5"}, lines)
	40	+	})
	41	+
	42	+	t.Run("returns empty slice for non-existent file", func(t *testing.T) {
	43	+	containerSvc := mocks.NewMockContainerService(t)
	44	+	runtime := outMocks.NewMockContainerRuntime(t)
	45	+
	46	+	svc := NewService("/nonexistent/file.log", containerSvc, runtime, log)
	47	+
	48	+	lines, err := svc.GetProcessLogs(context.Background(), 10)
	49	+	require.NoError(t, err)
	50	+	assert.Empty(t, lines)
	51	+	})
	52	+
	53	+	t.Run("returns error when log file path not configured", func(t *testing.T) {
	54	+	containerSvc := mocks.NewMockContainerService(t)
	55	+	runtime := outMocks.NewMockContainerRuntime(t)
	56	+
	57	+	svc := NewService("", containerSvc, runtime, log)
	58	+
	59	+	_, err := svc.GetProcessLogs(context.Background(), 10)
	60	+	assert.Error(t, err)
	61	+	assert.Contains(t, err.Error(), "log file path not configured")
	62	+	})
	63	+
	64	+	t.Run("returns all lines when fewer than requested", func(t *testing.T) {
	65	+	tmpDir := t.TempDir()
	66	+	logPath := filepath.Join(tmpDir, "test.log")
	67	+	content := "line1\nline2\n"
	68	+	err := os.WriteFile(logPath, []byte(content), 0644)
	69	+	require.NoError(t, err)
	70	+
	71	+	containerSvc := mocks.NewMockContainerService(t)
	72	+	runtime := outMocks.NewMockContainerRuntime(t)
	73	+
	74	+	svc := NewService(logPath, containerSvc, runtime, log)
	75	+
	76	+	lines, err := svc.GetProcessLogs(context.Background(), 10)
	77	+	require.NoError(t, err)
	78	+	assert.Equal(t, []string{"line1", "line2"}, lines)
	79	+	})
	80	+	}
	81	+
	82	+	func TestService_FollowProcessLogs(t *testing.T) {
	83	+	log := zerowrap.New(zerowrap.Config{Level: "warn"})
	84	+
	85	+	t.Run("streams lines and respects context cancellation", func(t *testing.T) {
	86	+	tmpDir := t.TempDir()
	87	+	logPath := filepath.Join(tmpDir, "test.log")
	88	+	content := "initial1\ninitial2\n"
	89	+	err := os.WriteFile(logPath, []byte(content), 0644)
	90	+	require.NoError(t, err)
	91	+
	92	+	containerSvc := mocks.NewMockContainerService(t)
	93	+	runtime := outMocks.NewMockContainerRuntime(t)
	94	+
	95	+	svc := NewService(logPath, containerSvc, runtime, log)
	96	+
	97	+	ctx, cancel := context.WithCancel(context.Background())
	98	+	defer cancel()
	99	+
	100	+	ch, err := svc.FollowProcessLogs(ctx, 2)
	101	+	require.NoError(t, err)
	102	+
	103	+	// Read initial lines
	104	+	var received []string
	105	+	for i := 0; i < 2; i++ {
	106	+	select {
	107	+	case line := <-ch:
	108	+	received = append(received, line)
	109	+	case <-time.After(time.Second):
	110	+	t.Fatal("timeout waiting for initial lines")
	111	+	}
	112	+	}
	113	+	assert.Equal(t, []string{"initial1", "initial2"}, received)
	114	+
	115	+	// Cancel context to stop following
	116	+	cancel()
	117	+
	118	+	// Channel should be closed
	119	+	select {
	120	+	case <-ch:
	121	+	// May receive one more line before closure, that's OK
	122	+	case <-time.After(500 * time.Millisecond):
	123	+	// OK, channel may already be closed
	124	+	}
	125	+	})
	126	+	}
	127	+
	128	+	func TestService_GetContainerLogs(t *testing.T) {
	129	+	log := zerowrap.New(zerowrap.Config{Level: "warn"})
	130	+
	131	+	t.Run("returns error when container not found", func(t *testing.T) {
	132	+	containerSvc := mocks.NewMockContainerService(t)
	133	+	runtime := outMocks.NewMockContainerRuntime(t)
	134	+
	135	+	containerSvc.EXPECT().Get(mock.Anything, "unknown.local").Return(nil, false)
	136	+
	137	+	svc := NewService("/tmp/test.log", containerSvc, runtime, log)
	138	+
	139	+	_, err := svc.GetContainerLogs(context.Background(), "unknown.local", 10)
	140	+	assert.Error(t, err)
	141	+	assert.Contains(t, err.Error(), "container not found")
	142	+	})
	143	+
	144	+	t.Run("calls runtime with correct container ID", func(t *testing.T) {
	145	+	containerSvc := mocks.NewMockContainerService(t)
	146	+	runtime := outMocks.NewMockContainerRuntime(t)
	147	+
	148	+	container := &domain.Container{
	149	+	ID: "abc123",
	150	+	Name: "app.local",
	151	+	Status: "running",
	152	+	}
	153	+	containerSvc.EXPECT().Get(mock.Anything, "app.local").Return(container, true)
	154	+
	155	+	// Create a mock reader that returns empty content
	156	+	runtime.EXPECT().GetContainerLogs(mock.Anything, "abc123", false).Return(&mockReader{}, nil)
	157	+
	158	+	svc := NewService("/tmp/test.log", containerSvc, runtime, log)
	159	+
	160	+	lines, err := svc.GetContainerLogs(context.Background(), "app.local", 10)
	161	+	require.NoError(t, err)
	162	+	assert.Empty(t, lines)
	163	+	})
	164	+	}
	165	+
	166	+	func TestService_FollowContainerLogs(t *testing.T) {
	167	+	log := zerowrap.New(zerowrap.Config{Level: "warn"})
	168	+
	169	+	t.Run("returns error when container not found", func(t *testing.T) {
	170	+	containerSvc := mocks.NewMockContainerService(t)
	171	+	runtime := outMocks.NewMockContainerRuntime(t)
	172	+
	173	+	containerSvc.EXPECT().Get(mock.Anything, "unknown.local").Return(nil, false)
	174	+
	175	+	svc := NewService("/tmp/test.log", containerSvc, runtime, log)
	176	+
	177	+	_, err := svc.FollowContainerLogs(context.Background(), "unknown.local", 10)
	178	+	assert.Error(t, err)
	179	+	assert.Contains(t, err.Error(), "container not found")
	180	+	})
	181	+	}
	182	+
	183	+	func TestTailLines(t *testing.T) {
	184	+	t.Run("returns correct last N lines", func(t *testing.T) {
	185	+	tmpDir := t.TempDir()
	186	+	path := filepath.Join(tmpDir, "test.log")
	187	+	content := "a\nb\nc\nd\ne\n"
	188	+	err := os.WriteFile(path, []byte(content), 0644)
	189	+	require.NoError(t, err)
	190	+
	191	+	file, err := os.Open(path)
	192	+	require.NoError(t, err)
	193	+	defer file.Close()
	194	+
	195	+	lines, err := tailLines(file, 3)
	196	+	require.NoError(t, err)
	197	+	assert.Equal(t, []string{"c", "d", "e"}, lines)
	198	+	})
	199	+
	200	+	t.Run("returns all lines when n exceeds line count", func(t *testing.T) {
	201	+	tmpDir := t.TempDir()
	202	+	path := filepath.Join(tmpDir, "test.log")
	203	+	content := "x\ny\n"
	204	+	err := os.WriteFile(path, []byte(content), 0644)
	205	+	require.NoError(t, err)
	206	+
	207	+	file, err := os.Open(path)
	208	+	require.NoError(t, err)
	209	+	defer file.Close()
	210	+
	211	+	lines, err := tailLines(file, 10)
	212	+	require.NoError(t, err)
	213	+	assert.Equal(t, []string{"x", "y"}, lines)
	214	+	})
	215	+
	216	+	t.Run("returns empty slice for empty file", func(t *testing.T) {
	217	+	tmpDir := t.TempDir()
	218	+	path := filepath.Join(tmpDir, "test.log")
	219	+	err := os.WriteFile(path, []byte(""), 0644)
	220	+	require.NoError(t, err)
	221	+
	222	+	file, err := os.Open(path)
	223	+	require.NoError(t, err)
	224	+	defer file.Close()
	225	+
	226	+	lines, err := tailLines(file, 10)
	227	+	require.NoError(t, err)
	228	+	assert.Empty(t, lines)
	229	+	})
	230	+
	231	+	t.Run("returns empty slice when n is zero", func(t *testing.T) {
	232	+	tmpDir := t.TempDir()
	233	+	path := filepath.Join(tmpDir, "test.log")
	234	+	content := "a\nb\n"
	235	+	err := os.WriteFile(path, []byte(content), 0644)
	236	+	require.NoError(t, err)
	237	+
	238	+	file, err := os.Open(path)
	239	+	require.NoError(t, err)
	240	+	defer file.Close()
	241	+
	242	+	lines, err := tailLines(file, 0)
	243	+	require.NoError(t, err)
	244	+	assert.Empty(t, lines)
	245	+	})
	246	+	}
	247	+
	248	+	// mockReader implements io.ReadCloser for testing.
	249	+	type mockReader struct{}
	250	+
	251	+	func (m *mockReader) Read(p []byte) (n int, err error) {
	252	+	return 0, os.ErrNotExist // Return EOF immediately
	253	+	}
	254	+
	255	+	func (m *mockReader) Close() error {
	256	+	return nil
	257	+	}

@@ -0,0 +1,257 @@
	1	+	package logs
	2	+
	3	+	import (
	4	+	"context"
	5	+	"os"
	6	+	"path/filepath"
	7	+	"testing"
	8	+	"time"
	9	+
	10	+	"github.com/bnema/zerowrap"
	11	+	"github.com/stretchr/testify/assert"
	12	+	"github.com/stretchr/testify/mock"
	13	+	"github.com/stretchr/testify/require"
	14	+
	15	+	"gordon/internal/boundaries/in/mocks"
	16	+	outMocks "gordon/internal/boundaries/out/mocks"
	17	+	"gordon/internal/domain"
	18	+	)
	19	+
	20	+	func TestService_GetProcessLogs(t *testing.T) {
	21	+	log := zerowrap.New(zerowrap.Config{Level: "warn"})
	22	+
	23	+	t.Run("returns lines from log file", func(t *testing.T) {
	24	+	// Create temp log file with content
	25	+	tmpDir := t.TempDir()
	26	+	logPath := filepath.Join(tmpDir, "test.log")
	27	+	content := "line1\nline2\nline3\nline4\nline5\n"
	28	+	err := os.WriteFile(logPath, []byte(content), 0644)
	29	+	require.NoError(t, err)
	30	+
	31	+	containerSvc := mocks.NewMockContainerService(t)
	32	+	runtime := outMocks.NewMockContainerRuntime(t)
	33	+
	34	+	svc := NewService(logPath, containerSvc, runtime, log)
	35	+
	36	+	lines, err := svc.GetProcessLogs(context.Background(), 3)
	37	+	require.NoError(t, err)
	38	+	assert.Len(t, lines, 3)
	39	+	assert.Equal(t, []string{"line3", "line4", "line5"}, lines)
	40	+	})
	41	+
	42	+	t.Run("returns empty slice for non-existent file", func(t *testing.T) {
	43	+	containerSvc := mocks.NewMockContainerService(t)
	44	+	runtime := outMocks.NewMockContainerRuntime(t)
	45	+
	46	+	svc := NewService("/nonexistent/file.log", containerSvc, runtime, log)
	47	+
	48	+	lines, err := svc.GetProcessLogs(context.Background(), 10)
	49	+	require.NoError(t, err)
	50	+	assert.Empty(t, lines)
	51	+	})
	52	+
	53	+	t.Run("returns error when log file path not configured", func(t *testing.T) {
	54	+	containerSvc := mocks.NewMockContainerService(t)
	55	+	runtime := outMocks.NewMockContainerRuntime(t)
	56	+
	57	+	svc := NewService("", containerSvc, runtime, log)
	58	+
	59	+	_, err := svc.GetProcessLogs(context.Background(), 10)
	60	+	assert.Error(t, err)
	61	+	assert.Contains(t, err.Error(), "log file path not configured")
	62	+	})
	63	+
	64	+	t.Run("returns all lines when fewer than requested", func(t *testing.T) {
	65	+	tmpDir := t.TempDir()
	66	+	logPath := filepath.Join(tmpDir, "test.log")
	67	+	content := "line1\nline2\n"
	68	+	err := os.WriteFile(logPath, []byte(content), 0644)
	69	+	require.NoError(t, err)
	70	+
	71	+	containerSvc := mocks.NewMockContainerService(t)
	72	+	runtime := outMocks.NewMockContainerRuntime(t)
	73	+
	74	+	svc := NewService(logPath, containerSvc, runtime, log)
	75	+
	76	+	lines, err := svc.GetProcessLogs(context.Background(), 10)
	77	+	require.NoError(t, err)
	78	+	assert.Equal(t, []string{"line1", "line2"}, lines)
	79	+	})
	80	+	}
	81	+
	82	+	func TestService_FollowProcessLogs(t *testing.T) {
	83	+	log := zerowrap.New(zerowrap.Config{Level: "warn"})
	84	+
	85	+	t.Run("streams lines and respects context cancellation", func(t *testing.T) {
	86	+	tmpDir := t.TempDir()
	87	+	logPath := filepath.Join(tmpDir, "test.log")
	88	+	content := "initial1\ninitial2\n"
	89	+	err := os.WriteFile(logPath, []byte(content), 0644)
	90	+	require.NoError(t, err)
	91	+
	92	+	containerSvc := mocks.NewMockContainerService(t)
	93	+	runtime := outMocks.NewMockContainerRuntime(t)
	94	+
	95	+	svc := NewService(logPath, containerSvc, runtime, log)
	96	+
	97	+	ctx, cancel := context.WithCancel(context.Background())
	98	+	defer cancel()
	99	+
	100	+	ch, err := svc.FollowProcessLogs(ctx, 2)
	101	+	require.NoError(t, err)
	102	+
	103	+	// Read initial lines
	104	+	var received []string
	105	+	for i := 0; i < 2; i++ {
	106	+	select {
	107	+	case line := <-ch:
	108	+	received = append(received, line)
	109	+	case <-time.After(time.Second):
	110	+	t.Fatal("timeout waiting for initial lines")
	111	+	}
	112	+	}
	113	+	assert.Equal(t, []string{"initial1", "initial2"}, received)
	114	+
	115	+	// Cancel context to stop following
	116	+	cancel()
	117	+
	118	+	// Channel should be closed
	119	+	select {
	120	+	case <-ch:
	121	+	// May receive one more line before closure, that's OK
	122	+	case <-time.After(500 * time.Millisecond):
	123	+	// OK, channel may already be closed
	124	+	}
	125	+	})
	126	+	}
	127	+
	128	+	func TestService_GetContainerLogs(t *testing.T) {
	129	+	log := zerowrap.New(zerowrap.Config{Level: "warn"})
	130	+
	131	+	t.Run("returns error when container not found", func(t *testing.T) {
	132	+	containerSvc := mocks.NewMockContainerService(t)
	133	+	runtime := outMocks.NewMockContainerRuntime(t)
	134	+
	135	+	containerSvc.EXPECT().Get(mock.Anything, "unknown.local").Return(nil, false)
	136	+
	137	+	svc := NewService("/tmp/test.log", containerSvc, runtime, log)
	138	+
	139	+	_, err := svc.GetContainerLogs(context.Background(), "unknown.local", 10)
	140	+	assert.Error(t, err)
	141	+	assert.Contains(t, err.Error(), "container not found")
	142	+	})
	143	+
	144	+	t.Run("calls runtime with correct container ID", func(t *testing.T) {
	145	+	containerSvc := mocks.NewMockContainerService(t)
	146	+	runtime := outMocks.NewMockContainerRuntime(t)
	147	+
	148	+	container := &domain.Container{
	149	+	ID: "abc123",
	150	+	Name: "app.local",
	151	+	Status: "running",
	152	+	}
	153	+	containerSvc.EXPECT().Get(mock.Anything, "app.local").Return(container, true)
	154	+
	155	+	// Create a mock reader that returns empty content
	156	+	runtime.EXPECT().GetContainerLogs(mock.Anything, "abc123", false).Return(&mockReader{}, nil)
	157	+
	158	+	svc := NewService("/tmp/test.log", containerSvc, runtime, log)
	159	+
	160	+	lines, err := svc.GetContainerLogs(context.Background(), "app.local", 10)
	161	+	require.NoError(t, err)
	162	+	assert.Empty(t, lines)
	163	+	})
	164	+	}
	165	+
	166	+	func TestService_FollowContainerLogs(t *testing.T) {
	167	+	log := zerowrap.New(zerowrap.Config{Level: "warn"})
	168	+
	169	+	t.Run("returns error when container not found", func(t *testing.T) {
	170	+	containerSvc := mocks.NewMockContainerService(t)
	171	+	runtime := outMocks.NewMockContainerRuntime(t)
	172	+
	173	+	containerSvc.EXPECT().Get(mock.Anything, "unknown.local").Return(nil, false)
	174	+
	175	+	svc := NewService("/tmp/test.log", containerSvc, runtime, log)
	176	+
	177	+	_, err := svc.FollowContainerLogs(context.Background(), "unknown.local", 10)
	178	+	assert.Error(t, err)
	179	+	assert.Contains(t, err.Error(), "container not found")
	180	+	})
	181	+	}
	182	+
	183	+	func TestTailLines(t *testing.T) {
	184	+	t.Run("returns correct last N lines", func(t *testing.T) {
	185	+	tmpDir := t.TempDir()
	186	+	path := filepath.Join(tmpDir, "test.log")
	187	+	content := "a\nb\nc\nd\ne\n"
	188	+	err := os.WriteFile(path, []byte(content), 0644)
	189	+	require.NoError(t, err)
	190	+
	191	+	file, err := os.Open(path)
	192	+	require.NoError(t, err)
	193	+	defer file.Close()
	194	+
	195	+	lines, err := tailLines(file, 3)
	196	+	require.NoError(t, err)
	197	+	assert.Equal(t, []string{"c", "d", "e"}, lines)
	198	+	})
	199	+
	200	+	t.Run("returns all lines when n exceeds line count", func(t *testing.T) {
	201	+	tmpDir := t.TempDir()
	202	+	path := filepath.Join(tmpDir, "test.log")
	203	+	content := "x\ny\n"
	204	+	err := os.WriteFile(path, []byte(content), 0644)
	205	+	require.NoError(t, err)
	206	+
	207	+	file, err := os.Open(path)
	208	+	require.NoError(t, err)
	209	+	defer file.Close()
	210	+
	211	+	lines, err := tailLines(file, 10)
	212	+	require.NoError(t, err)
	213	+	assert.Equal(t, []string{"x", "y"}, lines)
	214	+	})
	215	+
	216	+	t.Run("returns empty slice for empty file", func(t *testing.T) {
	217	+	tmpDir := t.TempDir()
	218	+	path := filepath.Join(tmpDir, "test.log")
	219	+	err := os.WriteFile(path, []byte(""), 0644)
	220	+	require.NoError(t, err)
	221	+
	222	+	file, err := os.Open(path)
	223	+	require.NoError(t, err)
	224	+	defer file.Close()
	225	+
	226	+	lines, err := tailLines(file, 10)
	227	+	require.NoError(t, err)
	228	+	assert.Empty(t, lines)
	229	+	})
	230	+
	231	+	t.Run("returns empty slice when n is zero", func(t *testing.T) {
	232	+	tmpDir := t.TempDir()
	233	+	path := filepath.Join(tmpDir, "test.log")
	234	+	content := "a\nb\n"
	235	+	err := os.WriteFile(path, []byte(content), 0644)
	236	+	require.NoError(t, err)
	237	+
	238	+	file, err := os.Open(path)
	239	+	require.NoError(t, err)
	240	+	defer file.Close()
	241	+
	242	+	lines, err := tailLines(file, 0)
	243	+	require.NoError(t, err)
	244	+	assert.Empty(t, lines)
	245	+	})
	246	+	}
	247	+
	248	+	// mockReader implements io.ReadCloser for testing.
	249	+	type mockReader struct{}
	250	+
	251	+	func (m *mockReader) Read(p []byte) (n int, err error) {
	252	+	return 0, os.ErrNotExist // Return EOF immediately
	253	+	}
	254	+
	255	+	func (m *mockReader) Close() error {
	256	+	return nil
	257	+	}