altaire-siren 0.1.0 → 0.1.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2c2c8b0c8610868e3400d37267b62e46e46a8151cc9bfc71ec606d2de5b5c9b4
-  data.tar.gz: a40f94a53642d50b7e07e956fd785d796826ad4107fb653ddadc439e99aa09b9
+  metadata.gz: b643929d013ecfea84037c6606ca2e9b99c06b393bf9c1a1a666d9c41ad3bb2b
+  data.tar.gz: 7430a99fb970c6a786ebbad3854823454da1e8502d70272abf91a5dc0d752a07
 SHA512:
-  metadata.gz: '086793744a02fba270cf0441ac85cc406383898d9c1488b07129a15eedbb551b80d8fb142da7ab5beb31f8a57be1118ca0b4d80be30aba7c912a87d62aaaa53d'
-  data.tar.gz: de3aaea9db9eb23c1a26257f49cea1ec0638a8c2e0b6f15fa67311046083df194826f7a953cbdd3a6244db2cdb20444ab7a56600eb3c32c98ca881370c8ee5ce
+  metadata.gz: d6f64e1a3bb9d88ec27362b18e0ec7b62bc7c344ae2597abe5922c961d12fbc8fb6af143b91bc808b77286d2eadbef0de5982179a204deecbb03b20d8ce1f3e7
+  data.tar.gz: 414dd254d30288e6bc9d1e810b49a5e75522cdd548fbd8b422e1ce7e2937452955e7e00aa40262ffd084d537a73f8c03a0f789b331d1c7c6090dca6f74563f4a

data/.gitignore

@@ -6,5 +6,5 @@
 /pkg/
 /spec/reports/
 /tmp/
-/data/songs/*.yaml
-/private.jwk
+/data/
+/private.jwk

data/Gemfile

@@ -1,4 +1,3 @@
 source "https://rubygems.org"
 
-# Specify your gem's dependencies in stack.gemspec
 gemspec

data/Gemfile.lock

@@ -1,13 +1,16 @@
 PATH
   remote: .
   specs:
-    altaire-siren (0.1.0)
+    altaire-siren (0.1.1)
       clamp (= 1.3.1)
       jose (= 1.1.3)
+      json-schema (= 2.8.1)
 
 GEM
   remote: https://rubygems.org/
   specs:
+    addressable (2.7.0)
+      public_suffix (>= 2.0.2, < 5.0)
     aruba (0.14.12)
       childprocess (>= 0.6.3, < 4.0.0)
       contracts (~> 0.9)
@@ -44,8 +47,11 @@ GEM
       concurrent-ruby (~> 1.0)
     jose (1.1.3)
       hamster
+    json-schema (2.8.1)
+      addressable (>= 2.4)
     multi_json (1.14.1)
     multi_test (0.1.2)
+    public_suffix (4.0.1)
     rake (10.5.0)
     rspec (3.9.0)
       rspec-core (~> 3.9.0)

data/altaire-siren.gemspec

@@ -23,6 +23,7 @@ Gem::Specification.new do |spec|
 
   spec.add_dependency "jose", "1.1.3"
   spec.add_dependency "clamp", "1.3.1"
+  spec.add_dependency "json-schema", "2.8.1"
 
   spec.add_development_dependency "bundler", "~> 2.0"
   spec.add_development_dependency "rake", "~> 10.0"

data/build-schema.rb

@@ -0,0 +1,206 @@
+require 'siren/schemabuilder'
+require 'json'
+require 'yaml'
+
+Siren::JSONSchema::SchemaBuilder.new do
+
+  def hashlike
+    any(array(string), hash(string))
+  end
+
+  def resources
+    object(cpus: string, memory: string)
+  end
+
+  def duration
+    string(/^(\d+h)?(\d+m)?(\d+s)?(\d+ms)?(\d+us)?$/)
+  end
+
+  def bytesize
+    string(/^(\d+)(b|k|m|g|kb|mb|gb)?$/)
+  end
+
+  def build
+    o = object(
+      version: string,
+      services: hash(object(
+        image: string,
+        build: string,
+        ports: array(string),
+        volumes: array(string),
+        environment: hashlike,
+        deploy: object(
+          replicas: integer,
+        ),
+        command: any(string, array(string)),
+      )),
+      "x-domains": array(object(
+        name: string,
+        path: string,
+        service: string,
+        port: string,
+        auth: string,
+      )),
+      "x-ports": array(object(
+        service: string,
+        inside: string,
+        outside: string,
+        protocol: string,
+      )),
+      "x-env": hash(string),
+      # services: hash(
+      #   build: any(string, object(
+      #     context: string,
+      #     dockerfile: string,
+      #     args: hashlike,
+      #     cache_from: array(string),
+      #     labels: hashlike,
+      #     shm_size: string,
+      #     target: string)
+      #   ),
+      #   command: any(string, array(string)),
+      #   configs: array(any(string, object(
+      #     source: string, target: string, uid: any(string, integer), gid: any(string, integer), mode: any(string, integer)
+      #   ))),
+      #   container_name: string,
+      #   credential_spec: any(object(file: string), object(registry: string), object(config: string)),
+      #   deploy: object(
+      #     endpoint_mode: string(["vip", "dnsrr"]),
+      #     labels: hashlike,
+      #     mode: string(["global", "replicated"]),
+      #     placement: object(
+      #       constraints: array(string),
+      #       preferences: array(object(spread: string)),
+      #     ),
+      #     replicas: integer,
+      #     resources: object(
+      #       limits: resources,
+      #       reservations: resources,
+      #     ),
+      #     restart_policy: object(
+      #       condition: string(["none", "on-failure", "any"]),
+      #       delay: duration,
+      #       max_attemtps: integer,
+      #       window: duration,
+      #     ),
+      #     rollback_config: object(
+      #       parallelism: integer,
+      #       delay: duration,
+      #       failure_action: string(["continue", "pause"]),
+      #       monitor: duration,
+      #       max_failure_ratio: number,
+      #       order: string(["stop-first", "start-first"]),
+      #     ),
+      #     update_config: object(
+      #       parallelism: integer,
+      #       delay: duration,
+      #       failure_action: string(["continue", "pause", "rollback"]),
+      #       monitor: duration,
+      #       max_failure_ratio: number,
+      #       order: string(["stop-first", "start-first"]),
+      #     ),
+      #   ),
+      #   dns: any(string, array(string)),
+      #   dns_search: any(string, array(string)),
+      #   entrypoint: any(string, array(string)),
+      #   environment: hashlike,
+      #   expose: array(string),
+      #   extra_hosts: array(string),
+      #   healthcheck: object(
+      #     test: any(string, array(string)),
+      #     interval: duration,
+      #     timeout: duration,
+      #     retries: integer,
+      #     start_period: duration,
+      #   ),
+      #   image: string,
+      #   init: bool,
+      #   labels: hashlike,
+      #   logging: object(
+      #     driver: string,
+      #     options: hash(string),
+      #   ),
+      #   networks: any(array(string), hash(object(aliases: array(string), ipv4_address: string, ipv6_address: string))),
+      #   pid: string("host"),
+      #   ports: array(any(string, object(target: integer, published: integer, protocol: string(["tcp", "udp"]), mode: string(["host", "ingress"])))),
+      #   secrets: array(any(string, object(source: string, target: string, uid: integer, gid: integer, mode: integer))),
+      #   stop_grace_period: duration,
+      #   stop_signal: string(/^SIG/),
+      #   sysctls: hashlike,
+      #   ulimits: hash(any(integer, object(soft: integer, hard: integer))),
+      #   volumes: array(any(string,
+      #     object(type: string(["volume", "bind", "tmpfs", "npipe"]),
+      #            source: string, target: string, read_only: boolean,
+      #            consistency: string(["consistent", "cached", "delegated"]),
+      #            volume: object(nocopy: boolean), bind: object(propagation: string),
+      #            tmpfs: object(size: bytesize)),
+      #   )),
+      #   domainname: string,
+      #   hostname: string,
+      #   ipc: string,
+      #   mac_address: string,
+      #   privileged: boolean,
+      #   read_only: boolean,
+      #   shm_size: bytesize,
+      #   stdin_open: boolean,
+      #   tty: boolean,
+      #   user: any(string, integer),
+      #   working_dir: string,
+      # ),
+      # volumes: hash(any(null, object(driver: string, driver_opts: hash(string), external: boolean, labels: hashlike, name: string))),
+      # networks: hash(any(null, object(
+      #   driver: string,
+      #   driver_opts: hash(string),
+      #   external: any(boolean, object(name: string)),
+      #   attachable: boolean,
+      #   ipam: object(
+      #     driver: string,
+      #     config: array(object(subnet: string))
+      #   ),
+      #   internal: boolean,
+      #   labels: hashlike,
+      #   name: string,
+      # ))),
+      # configs: hash(object(file: string, external: any(boolean, object(name: string)))),
+      # secrets: hash(object(file: string, external: boolean, name: string)),
+    )
+    # o.delete(:additionalProperties)
+    # o[:patternProperties] = {"^x-" => {}}
+    o
+  end
+
+end
+
+#         cap_add: *string-array
+#         cap_drop: *string-array
+#         cgroup_parent: *string
+#         command: *string-or-array
+#         configs:
+#           type: array
+#           items:
+#             anyOf:
+#             - type: string
+#             - type: object
+#               additionalProperties: false
+#               properties:
+#                 source: *string
+#                 target: *string
+#                 uid: *string-or-number
+#                 gid: *string-or-number
+#                 mode: *string-or-number
+#         volumes:
+#           type: array
+#           items:
+#             type: string
+#         ports:
+#           type: array
+#           items:
+#             anyOf:
+#             - type: string
+#             - type: object
+#               additionalProperties: false
+#               properties:
+#                 context: *string
+#                 dockerfile: *string
+#                 args: *string-array
+#         environment: *key-values

data/docs/docs/commands/song.md

@@ -51,6 +51,9 @@ spec:
     publish:
     - # The port the service is listening on.
       port: 8081
+      # Expose this port on a dedicated load balancer.
+      # If unset, expose the port via Traefik.
+      loadBalancer: lb-name
       # Domain name to use.
       domain: builder.k9.altaire.xyz
       # Use built-in Altaire auth.

data/fantasia-export.rb

@@ -0,0 +1,16 @@
+require 'pg'
+require 'yaml'
+
+db = PG::Connection.open(host: "db.altaire.com", user: "postgres", dbname: "fantasia")
+
+db.exec("SELECT name, composefile, fantasiafile, envfile, tags FROM stacks WHERE archived_at IS NULL").each do |row|
+  name, compose, fantasia, env, tags = row.values
+  compose = YAML.load(compose)
+  fantasia = YAML.load(fantasia)
+  File.open("data/stacks/#{name}.yml", "w") do |file|
+    compose["x-domains"] = fantasia["domains"]
+    compose["x-ports"] = fantasia["ports"]
+    compose["x-env"] = env.split("\n").map{|l|l.split("=", 2)}.to_h
+    file.puts compose.to_yaml
+  end
+end

data/lib/siren.rb

@@ -1,9 +1,11 @@
 require "siren/version"
 require "siren/crypto"
 require "siren/song"
+require "siren/compose"
 require "siren/stack"
 
 module Siren
+  ROOT = File.join(__dir__, "..")
   class Error < StandardError; end
   # Your code goes here...
 end

data/lib/siren/cli.rb

@@ -5,6 +5,20 @@ require 'siren'
 module Siren
 module CLI
 
+  class ComposeCommand < Clamp::Command
+
+    subcommand %w(c conv convert), "Convert compose file to resources" do
+      parameter "COMPOSE", "the compose file", default: "docker-compose.yml"
+      def execute
+        song = Siren::Compose.load(compose)
+        # open(compose.gsub(/[^.]+$/, 'k8s.yaml'), "w") do |io|
+          puts song.to_stack.to_yaml
+        # end
+      end
+    end
+
+  end
+
   class SongfileCommand < Clamp::Command
 
     subcommand %w(c conv convert), "Convert songfile to resources" do
@@ -70,7 +84,8 @@ module CLI
       end
     end
 
-    subcommand %w(c crypto cryptography), "Cryptography (JOSE) commands", CryptoCommand
+    # subcommand %w(c crypto cryptography), "Cryptography (JOSE) commands", CryptoCommand
+    subcommand %w(c compose docker-compose), "Docker compose file commands", ComposeCommand
     subcommand %w(s song songs songfile), "Songfile commands", SongfileCommand
 
   end

data/lib/siren/compose.rb

@@ -0,0 +1,103 @@
+require 'json-schema'
+require 'yaml'
+require_relative 'compose/types'
+
+module Siren
+
+  class Compose
+
+    attr_reader :name, :xports, :xdomains, :xenv
+
+    def self.load (filename)
+      new(YAML.load(File.read(filename)).deep_compact, filename)
+    end
+
+    def namify (*items)
+      items.flatten.compact.join("-").downcase.gsub(/[^a-z\d]/, '-').gsub(/-+/, "-")
+    end
+
+    def initialize (data, filename)
+      @filename = filename
+      @services = {}
+      @networks = {}
+      @configs = {}
+      @secrets = {}
+      @xports = []
+      @xdomains = []
+      @xenv = {}
+      @name = data["x-name"] || namify(File.basename(filename.chomp(File.extname(filename))))
+      data = data
+      schema = YAML.load(File.read(File.join(Siren::ROOT, "schemas/docker-compose.yaml")))
+      begin
+        JSON::Validator.validate!(schema, data)
+      rescue JSON::Schema::ValidationError => e
+        # puts filename
+        p e
+        exit 1
+      end
+      data["x-ports"]&.each do |data|
+        next unless data["outside"]
+        @xports << data
+      end
+      data["x-domains"]&.each do |data|
+        data["name"].gsub! ".altaire.xyz", ".k9.altaire.xyz"
+        next unless data["name"] =~ /k9.altaire.xyz$/
+        data.delete("path") if data["path"] == ""
+        @xdomains << data
+      end
+      data["x-env"]&.each do |key, value|
+        @xenv[key] = value
+      end
+      data["services"].each do |name, data|
+        @services[name] = Service.new(self, {name: name}.merge(data))
+      end if data["services"]
+      data["networks"].each do |name, data|
+        @networks[name] = Network.new(self, {name: name}.merge(data))
+      end if data["networks"]
+      data["configs"].each do |name, data|
+        @configs[name] = Config.new(self, {name: name}.merge(data))
+      end if data["configs"]
+      data["secrets"].each do |name, data|
+        @secrets[name] = Secret.new(self, {name: name}.merge(data))
+      end if data["secrets"]
+    end
+
+    def to_stack ()
+      stack = Stack.new
+      stack << {
+        kind: "Namespace",
+        apiVersion: "v1",
+        metadata: {
+          name: name
+        },
+      }
+      stack << {
+        kind: "Secret",
+        apiVersion: "v1",
+        metadata: {
+          namespace: name,
+          name: "image-pull-secrets",
+        },
+        data: {
+          ".dockerconfigjson": "ewoJImF1dGhzIjogewoJCSJodHRwczovL2FzaWEtbWlycm9yLmdjci5pbyI6IHsKCQkJImF1dGgiOiAiYjJGMWRHZ3lZV05qWlhOemRHOXJaVzQ2ZVdFeU9TNUhiSG95UWtGdk1tTnlZWEJJUkZabllWWTViak5oVFdKWFpFVkNZVWd3UlZNM2RIQXdjVUZzT1ZsdUxUWlRiVVZ5UjFoR1pXUXhhaTAwYlhCMVJYcDFlVlJNU0RSV1dGVlZaMnRyV0VwR1FuZEJhbk5zV2xsYU9HeFJTWFk0VFRKblVUVm5OVEk1TVUxTVQydG9abWN0V2s1VGFVVmpXVWszWld4ZlZIYz0iLAoJCQkiZW1haWwiOiAibm90QHZhbC5pZCIKCQl9LAoJCSJodHRwczovL2FzaWEuZ2NyLmlvIjogewoJCQkiYXV0aCI6ICJiMkYxZEdneVlXTmpaWE56ZEc5clpXNDZlV0V5T1M1SGJIb3lRa0Z2TW1OeVlYQklSRlpuWVZZNWJqTmhUV0pYWkVWQ1lVZ3dSVk0zZEhBd2NVRnNPVmx1TFRaVGJVVnlSMWhHWldReGFpMDBiWEIxUlhwMWVWUk1TRFJXV0ZWVloydHJXRXBHUW5kQmFuTnNXbGxhT0d4UlNYWTRUVEpuVVRWbk5USTVNVTFNVDJ0b1ptY3RXazVUYVVWaldVazNaV3hmVkhjPSIsCgkJCSJlbWFpbCI6ICJub3RAdmFsLmlkIgoJCX0sCgkJImh0dHBzOi8vZXUtbWlycm9yLmdjci5pbyI6IHsKCQkJImF1dGgiOiAiYjJGMWRHZ3lZV05qWlhOemRHOXJaVzQ2ZVdFeU9TNUhiSG95UWtGdk1tTnlZWEJJUkZabllWWTViak5oVFdKWFpFVkNZVWd3UlZNM2RIQXdjVUZzT1ZsdUxUWlRiVVZ5UjFoR1pXUXhhaTAwYlhCMVJYcDFlVlJNU0RSV1dGVlZaMnRyV0VwR1FuZEJhbk5zV2xsYU9HeFJTWFk0VFRKblVUVm5OVEk1TVUxTVQydG9abWN0V2s1VGFVVmpXVWszWld4ZlZIYz0iLAoJCQkiZW1haWwiOiAibm90QHZhbC5pZCIKCQl9LAoJCSJodHRwczovL2V1Lmdjci5pbyI6IHsKCQkJImF1dGgiOiAiYjJGMWRHZ3lZV05qWlhOemRHOXJaVzQ2ZVdFeU9TNUhiSG95UWtGdk1tTnlZWEJJUkZabllWWTViak5oVFdKWFpFVkNZVWd3UlZNM2RIQXdjVUZzT1ZsdUxUWlRiVVZ5UjFoR1pXUXhhaTAwYlhCMVJYcDFlVlJNU0RSV1dGVlZaMnRyV0VwR1FuZEJhbk5zV2xsYU9HeFJTWFk0VFRKblVUVm5OVEk1TVUxTVQydG9abWN0V2s1VGFVVmpXVWszWld4ZlZIYz0iLAoJCQkiZW1haWwiOiAibm90QHZhbC5pZCIKCQl9LAoJCSJodHRwczovL2djci5pbyI6IHsKCQkJImF1dGgiOiAiYjJGMWRHZ3lZV05qWlhOemRHOXJaVzQ2ZVdFeU9TNUhiSG95UWtGdk1tTnlZWEJJUkZabllWWTViak5oVFdKWFpFVkNZVWd3UlZNM2RIQXdjVUZzT1ZsdUxUWlRiVVZ5UjFoR1pXUXhhaTAwYlhCMVJYcDFlVlJNU0RSV1dGVlZaMnRyV0VwR1FuZEJhbk5zV2xsYU9HeFJTWFk0VFRKblVUVm5OVEk1TVUxTVQydG9abWN0V2s1VGFVVmpXVWszWld4ZlZIYz0iLAoJCQkiZW1haWwiOiAibm90QHZhbC5pZCIKCQl9LAoJCSJodHRwczovL2luZGV4LmRvY2tlci5pby92MS8iOiB7CgkJCSJhdXRoIjogIllXeDBZV2x5Wld4MFpEcGFkbWhpYTNnelJHMTFaMjAwTkVWRVdIUjBlQT09IgoJCX0sCgkJImh0dHBzOi8vbC5nY3IuaW8iOiB7CgkJCSJhdXRoIjogImIyRjFkR2d5WVdOalpYTnpkRzlyWlc0NmVXRXlPUzVIYkhveVFrRnZNbU55WVhCSVJGWm5ZVlk1YmpOaFRXSlhaRVZDWVVnd1JWTTNkSEF3Y1VGc09WbHVMVFpUYlVWeVIxaEdaV1F4YWkwMGJYQjFSWHAxZVZSTVNEUldXRlZWWjJ0cldFcEdRbmRCYW5Oc1dsbGFPR3hSU1hZNFRUSm5VVFZuTlRJNU1VMU1UMnRvWm1jdFdrNVRhVVZqV1VrM1pXeGZWSGM9IiwKCQkJImVtYWlsIjogIm5vdEB2YWwuaWQiCgkJfSwKCQkiaHR0cHM6Ly9sYXVuY2hlci5nY3IuaW8iOiB7CgkJCSJhdXRoIjogImIyRjFkR2d5WVdOalpYTnpkRzlyWlc0NmVXRXlPUzVIYkhveVFrRnZNbU55WVhCSVJGWm5ZVlk1YmpOaFRXSlhaRVZDWVVnd1JWTTNkSEF3Y1VGc09WbHVMVFpUYlVWeVIxaEdaV1F4YWkwMGJYQjFSWHAxZVZSTVNEUldXRlZWWjJ0cldFcEdRbmRCYW5Oc1dsbGFPR3hSU1hZNFRUSm5VVFZuTlRJNU1VMU1UMnRvWm1jdFdrNVRhVVZqV1VrM1pXeGZWSGM9IiwKCQkJImVtYWlsIjogIm5vdEB2YWwuaWQiCgkJfSwKCQkiaHR0cHM6Ly9taXJyb3IuZ2NyLmlvIjogewoJCQkiYXV0aCI6ICJiMkYxZEdneVlXTmpaWE56ZEc5clpXNDZlV0V5T1M1SGJIb3lRa0Z2TW1OeVlYQklSRlpuWVZZNWJqTmhUV0pYWkVWQ1lVZ3dSVk0zZEhBd2NVRnNPVmx1TFRaVGJVVnlSMWhHWldReGFpMDBiWEIxUlhwMWVWUk1TRFJXV0ZWVloydHJXRXBHUW5kQmFuTnNXbGxhT0d4UlNYWTRUVEpuVVRWbk5USTVNVTFNVDJ0b1ptY3RXazVUYVVWaldVazNaV3hmVkhjPSIsCgkJCSJlbWFpbCI6ICJub3RAdmFsLmlkIgoJCX0sCgkJImh0dHBzOi8vdXMtbWlycm9yLmdjci5pbyI6IHsKCQkJImF1dGgiOiAiYjJGMWRHZ3lZV05qWlhOemRHOXJaVzQ2ZVdFeU9TNUhiSG95UWtGdk1tTnlZWEJJUkZabllWWTViak5oVFdKWFpFVkNZVWd3UlZNM2RIQXdjVUZzT1ZsdUxUWlRiVVZ5UjFoR1pXUXhhaTAwYlhCMVJYcDFlVlJNU0RSV1dGVlZaMnRyV0VwR1FuZEJhbk5zV2xsYU9HeFJTWFk0VFRKblVUVm5OVEk1TVUxTVQydG9abWN0V2s1VGFVVmpXVWszWld4ZlZIYz0iLAoJCQkiZW1haWwiOiAibm90QHZhbC5pZCIKCQl9LAoJCSJodHRwczovL3VzLmdjci5pbyI6IHsKCQkJImF1dGgiOiAiYjJGMWRHZ3lZV05qWlhOemRHOXJaVzQ2ZVdFeU9TNUhiSG95UWtGdk1tTnlZWEJJUkZabllWWTViak5oVFdKWFpFVkNZVWd3UlZNM2RIQXdjVUZzT1ZsdUxUWlRiVVZ5UjFoR1pXUXhhaTAwYlhCMVJYcDFlVlJNU0RSV1dGVlZaMnRyV0VwR1FuZEJhbk5zV2xsYU9HeFJTWFk0VFRKblVUVm5OVEk1TVUxTVQydG9abWN0V2s1VGFVVmpXVWszWld4ZlZIYz0iLAoJCQkiZW1haWwiOiAibm90QHZhbC5pZCIKCQl9LAoJCSJyZWdpc3RyeS5hbHRhaXJlLnRlY2g6NTAwMCI6IHsKCQkJImF1dGgiOiAiYm1GMGFHRnVPbTVoZEdoaGJnPT0iCgkJfSwKCQkicmVnaXN0cnkuYWx0YWlyZS54eXoiOiB7CgkJCSJhdXRoIjogIlpHOWphMlZ5T201bGVtNWhkRzFsZFdOamFXZHZZblJ2ZDJwcGJVZHZhbkJoZEhCdmIzSjAiCgkJfQoJfSwKCSJIdHRwSGVhZGVycyI6IHsKCQkiVXNlci1BZ2VudCI6ICJEb2NrZXItQ2xpZW50LzE4LjA5LjUtY2UgKGxpbnV4KSIKCX0KfQ=="
+        },
+        type: "kubernetes.io/dockerconfigjson"
+      }
+      @services.each do |name, service|
+        service.to_stack(stack)
+      end
+      @networks.each do |name, network|
+        network.to_stack(stack)
+      end
+      @configs.each do |name, config|
+        config.to_stack(stack)
+      end
+      @secrets.each do |name, secret|
+        secret.to_stack(stack)
+      end
+      stack
+    end
+
+  end
+
+end