oly-apps

Publish a web app through oly

1) Locate state and enable trusted apps

1. Run oly daemon status to get ROOT (<STATE_DIR>) and the live HTTP endpoint (HTTP must be enabled).
2. Apps live at <ROOT>/wwwroot/apps/<app-name>/ and are served at http://127.0.0.1:<PORT>/apps/<app-name>/ behind the daemon's HTTP authentication.
3. Custom apps, proxies, and wwwroot overrides are disabled by default. With operator authorization, set flat "trusted_apps_enabled": true in <ROOT>/config.json and confirm hot reload.
4. Security boundary: App routes share the control-plane origin and allow inline scripts. Only publish reviewed, trusted code — never untrusted output.

2) Choose an app mode

Static HTML (no manifest needed)

Create <ROOT>/wwwroot/apps/<app-name>/index.html and relative assets (./ or /apps/<app-name>/). Discovery uses the HTML <title>.

Static app / SPA (oly.app.json)

Create <ROOT>/wwwroot/apps/<app-name>/oly.app.json:

{
  "title": "My App",
  "app_type": "spa",
  "entry": "index.html",
  "redirect_files": ["index.html"]
}

• app_type: "spa" is a display hint only; use hash routing or "redirect_files": ["index.html"] for history-route fallback (prefer /apps/<app-name>/ asset paths so deep links resolve assets cleanly).
• Every path in redirect_files must already exist on disk or the manifest is rejected.
• Local app files support GET/HEAD and always use private, no-cache with content-based ETags, even for hash-shaped filenames. Conditional requests still require auth. Other static methods return 405; proxies keep their own method/cache behavior. The built-in PWA does not runtime-cache apps.
• Keep app assets under /apps/<app-name>/; do not replace generated UI bundle URLs with mutable files, since a browser may already have an immutable copy.

Loopback service proxy (oly.app.json)

{
  "title": "Local dashboard",
  "app_type": "spa",
  "entry": "http://127.0.0.1:5173/"
}