lazycat-dynamic-deploy

Lazy Cat Microservices Dynamic Deployment and Injection

Before generating any configuration, first confirm the target lzcos and lzc-cli, and read references/spec-sync.md to calibrate against the official specification on site according to the process. The examples in this article are organized according to LPK V2 (lzcos >= 1.5.0、lzc-cli >= 2.0.0); dynamic rendering capability begins with lzcos 1.3.8+。

Choosing the Correct Layer

Problem to Solve	Mechanism	Required Reading
Collect user input during installation/reconfiguration	lzc-deploy-params.yml	references/deploy-params.md
Write deployment input or system values into the runtime manifest	Go text/template rendering	references/manifest-render.md
Dynamically rewrite behavior by page or request	application.injects	references/injects.md

Do not use deploy render for request-level routing, and do not use inject to replace manifest configuration that can be expressed statically.

Deployment Parameters and Rendering

lzc-deploy-params.yml：

params:
  - id: target_host
    type: string
    name: 目标主机
    description: 要连接的主机名或 IP
  - id: admin_password
    type: secret
    name: 管理员密码
    description: 留空时由系统生成随机初始密码
    default_value: "$random(len=20)"

lzc-manifest.yml fragment:

services:
  web:
    environment:
      TARGET_HOST: {{ .U.target_host | quote }}
      ADMIN_PASSWORD: {{ .U.admin_password | quote }}
      INTERNAL_SECRET: {{ stable_secret "internal_secret" | quote }}

• User parameter is .U/.UserParams; IDs containing . use index .U "listen.port"。
• System parameter is .S/.SysParams。
• stable_secret is used for internal random secrets that remain stable across restarts; do not truncate it into a short weak password.
• Template sources containing {{ ... }} cannot be directly handed to an ordinary YAML parser as final YAML; the rendered /lzcapp/run/manifest.yml。
• LPK V2 static metadata only writes package.yml, do not mix it back into the manifest top level.

Three-Stage inject

• browser: real browser environment; for HTML pages, hash matching can be used.
• request: lzcinit synchronous sandbox before forwarding to upstream; can modify Header/Body/routing.
• response: lzcinit synchronous sandbox after the upstream response; can commit status or modify the response by status code.

request/response can handle non-HTML traffic such as JSON; only browser injection requires an HTML page capable of carrying scripts. Matching rules use when/unless/do, there is no include/exclude/mode/scripts。

When user state needs to be remembered across requests: request only writes the candidate value into ctx.flow，response Confirm business successonly then write ctx.persist, and browser then reads it through the $persist parameter. Failed login/password-change data must not be persisted first during the request stage.

application:
  injects:
    - id: login-autofill
      when:
        - /login
      do:
        - src: builtin://simple-inject-password
          params:
            user: admin
            password:
              $persist: app.password
            autoSubmit: false

Script sources only use the officially listed inline,builtin://... or file:///...; do not claim or rely on remote URL script sources not listed in the official specification.

Security and Delivery Checks

• Parameters only collect the data actually needed, passwords use secret, and examples do not hard-code weak passwords.
• auth_required keep the default true, unless there is a genuine need for unauthenticated traffic and a risk analysis has been completed;ctx.persist requires a non-empty ctx.safe_uid。
• when precise to the required path;/api/* does not match /api, declare them separately when needed.
• Official scripts should preferably be provided with the package; do not load remote mutable code.
• request/response do not use Promise/async; browser's ctx.persist API is asynchronous.
• ctx.dump do not output passwords, Tokens, or sensitive request body information.
• Compare against references/injects.md complete built-in parameter table and official topic before delivery.