aptible-cli 0.26.5 → 0.26.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 13c94bbbfe4b853700fec4e895ab0eebd02f0c5ffcddf6cfd0a597c42f665d37
-  data.tar.gz: c495f4582ca15271799caa1b71a3922c3e5bbaafa692eda9476862465971556e
+  metadata.gz: 96e4d08173fd6d471b8a0a4f625d5bc1b3cf22af4c6cf2bb71fb3da109bc27af
+  data.tar.gz: 53ff531ac50e1a925a7c6ddc01bf5cdc7c972333e4f7ef72e5af83b0001c5ae0
 SHA512:
-  metadata.gz: eb5b9e8adc78ba955f5125ca6c673894fea37fb8dd9a61775b4f44f87b9afc2c7fd9dbf8c645cd380af6fca7f754f03654a139539d9180060c6475544320b864
-  data.tar.gz: d86d87bb3c7d8dd6c57692c63c0592b99f950cd96b8b6bce1038678678a0c983c6b734ef380852b6edb8bb1e4e205fa6938b5045c8d5337f82fd4c40fb5aac2e
+  metadata.gz: dec6c2d62bbe07eb89627dad9c1984133e7768f4b87316ac3029a1fd94f71d22418ca6b3ad73efa445425e60cd620d75d9653b23e4da10c7f28a62b6fc460d69
+  data.tar.gz: fd1b7ab666de7e4e13300ba4057d265edf919f40abaddcac96a90f9437b8ad23144775f4fc49124bae2af06f668aea57bdf976eeffa1fab60a7e01abb5ffd241

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    aptible-cli (0.26.5)
+    aptible-cli (0.26.6)
       activesupport (>= 4.0, < 6.0)
       aptible-api (~> 1.12)
       aptible-auth (~> 1.4)

data/lib/aptible/cli/helpers/vhost/option_set_builder.rb

@@ -14,6 +14,35 @@ module Aptible
             alb
           ).freeze
 
+          SSL_PROTOCOL_VALUES = [
+            'TLSv1 TLSv1.1 TLSv1.2',
+            'TLSv1 TLSv1.1 TLSv1.2 PFS',
+            'TLSv1.1 TLSv1.2',
+            'TLSv1.1 TLSv1.2 PFS',
+            'TLSv1.2',
+            'TLSv1.2 PFS',
+            'TLSv1.2 PFS TLSv1.3',
+            'TLSv1.3'
+          ].freeze
+
+          ALB_PROTOCOL_VALUES = SSL_PROTOCOL_VALUES
+
+          ELB_PROTOCOL_VALUES =
+            SSL_PROTOCOL_VALUES.reject { |v| v.include?(' PFS') }.freeze
+
+          SSL_PROTOCOL_ALB_DESC = (
+            'Specify the allowed SSL protocols. Valid options: ' +
+            ALB_PROTOCOL_VALUES.map { |v| "\"#{v}\"" }.join(', ') +
+            '. PFS options require an HTTPS (ALB) endpoint. ' \
+            'Use "default" to reset to the platform default'
+          ).freeze
+
+          SSL_PROTOCOL_ELB_DESC = (
+            'Specify the allowed SSL protocols. Valid options: ' +
+            ELB_PROTOCOL_VALUES.map { |v| "\"#{v}\"" }.join(', ') +
+            '. Use "default" to reset to the platform default'
+          ).freeze
+
           def initialize(&block)
             FLAGS.each { |f| instance_variable_set("@#{f}", false) }
             instance_exec(&block) if block
@@ -53,6 +82,14 @@ module Aptible
                   )
                 end
 
+                option(
+                  :idle_timeout,
+                  type: :string,
+                  desc: 'Timeout (seconds) to enforce idle timeouts while ' \
+                        'sending and receiving responses. Use "default" to ' \
+                        'reset to the platform default'
+                )
+
                 if builder.alb?
                   option(
                     :load_balancing_algorithm_type,
@@ -69,6 +106,50 @@ module Aptible
                     desc: "Share this Endpoint's load balancer with other " \
                           'Endpoints'
                   )
+
+                  option(
+                    :force_ssl,
+                    type: :boolean,
+                    desc: 'Redirect all HTTP requests to HTTPS, and ' \
+                          'enable the Strict-Transport-Security header (HSTS)'
+                  )
+
+                  option(
+                    :maintenance_page_url,
+                    type: :string,
+                    desc: 'The URL of a maintenance page to cache and serve ' \
+                          'when requests time out, or your app is unhealthy. ' \
+                          'Use "default" to reset to the platform default'
+                  )
+
+                  option(
+                    :release_healthcheck_timeout,
+                    type: :string,
+                    desc: 'Timeout (seconds) to wait for your app to ' \
+                          'respond to a release health check. Use "default" ' \
+                          'to reset to the platform default'
+                  )
+
+                  option(
+                    :show_elb_healthchecks,
+                    type: :boolean,
+                    desc: 'Show all runtime health check requets in the ' \
+                          "endpoint's logs"
+                  )
+
+                  option(
+                    :ssl_protocols_override,
+                    type: :string,
+                    desc: SSL_PROTOCOL_ALB_DESC
+                  )
+
+                  option(
+                    :strict_health_checks,
+                    type: :boolean,
+                    desc: 'Require containers to respond to health checks ' \
+                          'with a 200 OK HTTP response.'
+                  )
+
                 end
               end
 
@@ -128,6 +209,27 @@ module Aptible
                   desc: 'The fingerprint of an existing Certificate to use ' \
                         'on this Endpoint'
                 )
+
+                unless builder.alb?
+                  option(
+                    :ssl_protocols_override,
+                    type: :string,
+                    desc: SSL_PROTOCOL_ELB_DESC
+                  )
+
+                  option(
+                    :ssl_ciphers_override,
+                    type: :string,
+                    desc: 'Specify the allowed SSL ciphers. ' \
+                          'Use "default" to reset to the platform default'
+                  )
+
+                  option(
+                    :disable_weak_cipher_suites,
+                    type: :boolean,
+                    desc: 'Block the SSLv3 protocol and RC4 ciphers'
+                  )
+                end
               end
             end
           end
@@ -137,6 +239,7 @@ module Aptible
             verify_option_conflicts(options)
 
             params = {}
+            settings = {}
 
             params[:ip_whitelist] = options.delete(:ip_whitelist) do
               create? ? [] : nil
@@ -203,6 +306,56 @@ module Aptible
               params[:shared] = options.delete(:shared)
             end
 
+            if (proto = options[:ssl_protocols_override]) &&
+               proto != 'default'
+              unless ALB_PROTOCOL_VALUES.include?(proto)
+                raise Thor::Error,
+                      "Invalid --ssl-protocols-override: \"#{proto}\". " \
+                      "Valid options are: #{ALB_PROTOCOL_VALUES.join(', ')}"
+              end
+
+              if !ELB_PROTOCOL_VALUES.include?(proto) && !alb?
+                raise Thor::Error,
+                      "Invalid --ssl-protocols-override: \"#{proto}\". " \
+                      'PFS options are only valid for an HTTPS (ALB) endpoint. ' \
+                      "Valid options are: #{ELB_PROTOCOL_VALUES.join(', ')}"
+              end
+            end
+
+            vhost_settings = %i(
+              idle_timeout
+              maintenance_page_url
+              release_healthcheck_timeout
+              ssl_protocols_override
+              ssl_ciphers_override
+            )
+
+            vhost_settings.each do |key|
+              val = options.delete(key)
+              next if val.nil?
+
+              settings[key.to_s.upcase] = case val
+                                          when 'default'
+                                            ''
+                                          else
+                                            val
+                                          end
+            end
+
+            boolean_vhost_settings = %i(
+              force_ssl
+              show_elb_healthchecks
+              strict_health_checks
+              disable_weak_cipher_suites
+            )
+
+            boolean_vhost_settings.each do |key|
+              value = options.delete(key)
+              next if value.nil?
+
+              settings[key.to_s.upcase] = value.to_s
+            end
+
             options.delete(:environment)
 
             # NOTE: This is here to ensure that specs don't test for options
@@ -210,7 +363,7 @@ module Aptible
             # this.
             raise "Unexpected options: #{options}" if options.any?
 
-            params.delete_if { |_, v| v.nil? }
+            [params.delete_if { |_, v| v.nil? }, settings]
           end
 
           FLAGS.each do |f|

data/lib/aptible/cli/helpers/vhost.rb

@@ -2,8 +2,11 @@ module Aptible
   module CLI
     module Helpers
       module Vhost
-        def provision_vhost_and_explain(service, vhost)
-          op = vhost.create_operation!(type: 'provision')
+        def provision_vhost_and_explain(service, vhost, settings)
+          op = vhost.create_operation!(
+            type: 'provision',
+            **(settings.empty? ? {} : { settings: settings })
+          )
           attach_to_operation_logs(op)
 
           Formatter.render(Renderer.current) do |root|

data/lib/aptible/cli/renderer/text.rb

@@ -7,7 +7,9 @@ module Aptible
         POST_PROCESSED_KEYS = {
           'Tls' => 'TLS',
           'Dns' => 'DNS',
-          'Ip' => 'IP'
+          'Ip' => 'IP',
+          'Ssl' => 'SSL',
+          'Elb' => 'ELB'
         }.freeze
 
         def visit(node, io)

data/lib/aptible/cli/resource_formatter.rb

@@ -213,6 +213,12 @@ module Aptible
 
           node.value('internal', vhost.internal)
 
+          unless vhost.current_setting.nil?
+            vhost.current_setting.settings.each do |k, v|
+              node.value(k.downcase, v)
+            end
+          end
+
           ip_whitelist = if vhost.ip_whitelist.any?
                            vhost.ip_whitelist.join(' ')
                          else

data/lib/aptible/cli/subcommands/endpoints.rb

@@ -27,13 +27,18 @@ module Aptible
               service = database.service
               raise Thor::Error, 'Database is not provisioned' if service.nil?
 
+              prepared_params, settings = database_create_flags.prepare(
+                database.account,
+                options
+              )
+
               vhost = service.create_vhost!(
                 type: 'tcp',
                 platform: 'elb',
-                **database_create_flags.prepare(database.account, options)
+                **prepared_params
               )
 
-              provision_vhost_and_explain(service, vhost)
+              provision_vhost_and_explain(service, vhost, settings)
             end
 
             database_modify_flags = Helpers::Vhost::OptionSetBuilder.new do
@@ -49,9 +54,14 @@ module Aptible
 
               database = ensure_database(options.merge(db: options[:database]))
               vhost = find_vhost(each_service(database), hostname)
-              vhost.update!(**database_modify_flags.prepare(database.account,
-                                                            options))
-              provision_vhost_and_explain(vhost.service, vhost)
+
+              prepared_params, settings = database_modify_flags.prepare(
+                database.account,
+                options
+              )
+
+              vhost.update!(**prepared_params)
+              provision_vhost_and_explain(vhost.service, vhost, settings)
             end
 
             tcp_create_flags = Helpers::Vhost::OptionSetBuilder.new do
@@ -246,18 +256,26 @@ module Aptible
             no_commands do
               def create_app_vhost(flags, options, process_type, **attrs)
                 service = ensure_service(options, process_type)
+
+                prepared_params, settings =
+                  flags.prepare(service.account, options)
+
                 vhost = service.create_vhost!(
-                  **flags.prepare(service.account, options),
+                  **prepared_params,
                   **attrs
                 )
-                provision_vhost_and_explain(service, vhost)
+                provision_vhost_and_explain(service, vhost, settings)
               end
 
               def modify_app_vhost(flags, options, hostname)
                 app = ensure_app(options)
                 vhost = find_vhost(each_service(app), hostname)
-                vhost.update!(**flags.prepare(vhost.service.account, options))
-                provision_vhost_and_explain(vhost.service, vhost)
+
+                prepared_params, settings =
+                  flags.prepare(vhost.service.account, options)
+
+                vhost.update!(**prepared_params)
+                provision_vhost_and_explain(vhost.service, vhost, settings)
               end
             end
           end

data/lib/aptible/cli/version.rb

@@ -1,5 +1,5 @@
 module Aptible
   module CLI
-    VERSION = '0.26.5'.freeze
+    VERSION = '0.26.6'.freeze
   end
 end

data/spec/aptible/cli/helpers/vhost/option_set_builder_spec.rb

@@ -0,0 +1,94 @@
+require 'spec_helper'
+
+describe Aptible::CLI::Helpers::Vhost::OptionSetBuilder do
+  def register_options(builder)
+    klass = Class.new(Thor) { include Aptible::CLI::Helpers::App }
+    builder.declare_options(klass)
+    klass.instance_variable_get(:@method_options)
+  end
+
+  describe '--ssl-protocols-override option description' do
+    context 'HTTPS endpoints (ALB, alb! flag set)' do
+      let(:builder) do
+        described_class.new do
+          app!
+          tls!
+          alb!
+        end
+      end
+
+      it 'includes PFS values' do
+        desc = register_options(builder)[:ssl_protocols_override].description
+        expect(desc).to include('PFS')
+      end
+    end
+
+    context 'TLS endpoints (ELB, tls! without alb!)' do
+      let(:builder) do
+        described_class.new do
+          app!
+          tls!
+        end
+      end
+
+      it 'does not include PFS values' do
+        desc = register_options(builder)[:ssl_protocols_override].description
+        expect(desc).not_to include('PFS')
+      end
+
+      it 'is still present' do
+        expect(register_options(builder)).to have_key(:ssl_protocols_override)
+      end
+    end
+
+    context 'gRPC endpoints (ELB, tls! without alb!)' do
+      let(:builder) do
+        described_class.new do
+          app!
+          port!
+          tls!
+        end
+      end
+
+      it 'does not include PFS values' do
+        desc = register_options(builder)[:ssl_protocols_override].description
+        expect(desc).not_to include('PFS')
+      end
+    end
+
+    context 'TCP endpoints (no tls! flag)' do
+      let(:builder) do
+        described_class.new do
+          app!
+          ports!
+        end
+      end
+
+      it 'is absent' do
+        expect(register_options(builder)).not_to have_key(:ssl_protocols_override)
+      end
+    end
+  end
+
+  describe 'SSL_PROTOCOL_ALB_DESC' do
+    subject { described_class::SSL_PROTOCOL_ALB_DESC }
+
+    it 'lists all PFS protocol values' do
+      pfs_values = described_class::SSL_PROTOCOL_VALUES.select { |v| v.include?('PFS') }
+      pfs_values.each { |v| is_expected.to include(v) }
+    end
+  end
+
+  describe 'SSL_PROTOCOL_ELB_DESC' do
+    subject { described_class::SSL_PROTOCOL_ELB_DESC }
+
+    it 'contains no PFS values' do
+      is_expected.not_to include('PFS')
+    end
+
+    it 'lists all non-PFS protocol values' do
+      non_pfs_values = described_class::SSL_PROTOCOL_VALUES.reject { |v| v.include?('PFS') }
+      non_pfs_values.each { |v| is_expected.to include(v) }
+    end
+  end
+end

data/spec/aptible/cli/resource_formatter_spec.rb

@@ -25,6 +25,9 @@ describe Aptible::CLI::ResourceFormatter do
         shared: false
       )
 
+      vhost.current_configuration = Fabricate(:setting, settings: {},
+                                                        vhost: vhost)
+
       expected = [
         'Id: 12',
         'Hostname: foo.io',

data/spec/aptible/cli/subcommands/endpoints_spec.rb

@@ -25,12 +25,12 @@ describe Aptible::CLI::Agent do
     end
   end
 
-  def expect_create_vhost(service, options)
+  def expect_create_vhost(service, options, settings: nil)
     expect(service).to receive(:create_vhost!).with(
       hash_including(options)
     ) do |args|
       Fabricate(:vhost, service: service, **args).tap do |v|
-        expect_operation(v, 'provision')
+        expect_operation(v, 'provision', settings: settings)
         expect(v).to receive(:reload).and_return(v)
         expect(Aptible::CLI::ResourceFormatter).to receive(:inject_vhost)
           .with(an_instance_of(Aptible::CLI::Formatter::Object), v, service)
@@ -49,8 +49,16 @@ describe Aptible::CLI::Agent do
     end
   end
 
-  def expect_operation(vhost, type)
-    expect(vhost).to receive(:create_operation!).with(type: type) do
+  def expect_operation(vhost, type, settings: nil)
+    expect(vhost).to receive(:create_operation!) do |args|
+      expect(args[:type]).to eq(type)
+
+      if settings.nil?
+        expect(args).not_to have_key(:settings)
+      else
+        expect(args[:settings]).to eq(settings)
+      end
+
       Fabricate(:operation).tap do |o|
         expect(subject).to receive(:attach_to_operation_logs).with(o)
       end
@@ -170,7 +178,13 @@ describe Aptible::CLI::Agent do
       it 'lists Endpoints' do
         s = Fabricate(:service, database: db)
         v1 = Fabricate(:vhost, service: s)
+        v1.current_setting = Fabricate(:setting,
+                                       settings: { 'IDLE_TIMEOUT' => '123' },
+                                       vhost: v1)
         v2 = Fabricate(:vhost, service: s)
+        v2.current_setting = Fabricate(:setting,
+                                       settings: { 'FORCE_SSL' => 'true' },
+                                       vhost: v2)
 
         stub_options(database: db.handle)
         subject.send('endpoints:list')
@@ -179,6 +193,8 @@ describe Aptible::CLI::Agent do
 
         expect(lines).to include("Hostname: #{v1.external_host}")
         expect(lines).to include("Hostname: #{v2.external_host}")
+        expect(lines).to include('Idle Timeout: 123')
+        expect(lines).to include('Force SSL: true')
 
         expect(lines[0]).not_to eq("\n")
         expect(lines[-1]).not_to eq("\n")
@@ -243,6 +259,105 @@ describe Aptible::CLI::Agent do
       stub_options
     end
 
+    shared_examples 'shared create and modify ALB settings examples' do |method|
+      context 'App Vhost Settings (string)' do
+        string_options = %i(
+          idle_timeout
+          maintenance_page_url
+          release_healthcheck_timeout
+        )
+
+        let(:value) { 'some value' }
+
+        string_options.each do |option|
+          context "--#{option.to_s.tr('_', '-')}" do
+            it 'passes a value if provided' do
+              wanted = { option.to_s.upcase => value }
+              expect_create_vhost(service, {}, { settings: wanted })
+              stub_options(option => value)
+              subject.send(method, 'web')
+            end
+
+            it 'passes nothing if not provided' do
+              expect_create_vhost(service, {})
+              subject.send(method, 'web')
+            end
+
+            context 'reverting to default' do
+              it 'sends an empty string if passed an empty string' do
+                wanted = { option.to_s.upcase => '' }
+                expect_create_vhost(service, {}, { settings: wanted })
+                stub_options(option => '')
+                subject.send(method, 'web')
+              end
+
+              it 'sends an empty string if passed the string "default"' do
+                wanted = { option.to_s.upcase => '' }
+                expect_create_vhost(service, {}, { settings: wanted })
+                stub_options(option => 'default')
+                subject.send(method, 'web')
+              end
+            end
+          end
+        end
+      end
+
+      context '--ssl-protocols-override' do
+        it 'passes a valid non-PFS value' do
+          wanted = { 'SSL_PROTOCOLS_OVERRIDE' => 'TLSv1.2' }
+          expect_create_vhost(service, {}, { settings: wanted })
+          stub_options(ssl_protocols_override: 'TLSv1.2')
+          subject.send(method, 'web')
+        end
+
+        it 'passes a valid PFS value' do
+          wanted = { 'SSL_PROTOCOLS_OVERRIDE' => 'TLSv1.2 PFS' }
+          expect_create_vhost(service, {}, { settings: wanted })
+          stub_options(ssl_protocols_override: 'TLSv1.2 PFS')
+          subject.send(method, 'web')
+        end
+
+        it 'raises an error for an invalid value' do
+          stub_options(ssl_protocols_override: 'TLSv1.0')
+          expect { subject.send(method, 'web') }
+            .to raise_error(/invalid --ssl-protocols-override/im)
+        end
+
+        it 'passes nothing if not provided' do
+          expect_create_vhost(service, {})
+          subject.send(method, 'web')
+        end
+
+        it 'sends an empty string if passed the string "default"' do
+          wanted = { 'SSL_PROTOCOLS_OVERRIDE' => '' }
+          expect_create_vhost(service, {}, { settings: wanted })
+          stub_options(ssl_protocols_override: 'default')
+          subject.send(method, 'web')
+        end
+      end
+
+      context 'App Vhost Settings (boolean)' do
+        boolean_options = %i(
+          force_ssl
+          show_elb_healthchecks
+          strict_health_checks
+        )
+
+        boolean_options.each do |option|
+          [true, false].each do |value|
+            context "--#{value ? '' : 'no-'}#{option.to_s.tr('_', '-')}" do
+              it "sets the value to the string '#{value}'" do
+                wanted = { option.to_s.upcase => value.to_s }
+                expect_create_vhost(service, {}, { settings: wanted })
+                stub_options(option => value)
+                subject.send(method, 'web')
+              end
+            end
+          end
+        end
+      end
+    end
+
     shared_examples 'shared create app vhost examples' do |method|
       context 'App Vhost Options' do
         it 'fails if the app does not exist' do
@@ -440,10 +555,64 @@ describe Aptible::CLI::Agent do
       end
     end
 
+    shared_examples 'shared create idle timeout examples' do |method|
+      context 'IDLE_TIMEOUT' do
+        it 'passes idle_timeout if provided' do
+          expect_create_vhost(service, {}, { settings: { 'IDLE_TIMEOUT' => '30' } })
+          stub_options(idle_timeout: '30')
+          subject.send(method, 'web')
+        end
+      end
+    end
+
+    shared_examples 'shared create non-alb tls settings examples' do |method|
+      context '--ssl-protocols-override' do
+        it 'passes a valid non-PFS value' do
+          wanted = { 'SSL_PROTOCOLS_OVERRIDE' => 'TLSv1.2' }
+          expect_create_vhost(service, {}, { settings: wanted })
+          stub_options(ssl_protocols_override: 'TLSv1.2')
+          subject.send(method, 'web')
+        end
+
+        it 'raises an error for a PFS value' do
+          stub_options(ssl_protocols_override: 'TLSv1.2 PFS')
+          expect { subject.send(method, 'web') }
+            .to raise_error(/pfs.*only.*alb/im)
+        end
+
+        it 'raises an error for an invalid value' do
+          stub_options(ssl_protocols_override: 'TLSv1.0')
+          expect { subject.send(method, 'web') }
+            .to raise_error(/invalid --ssl-protocols-override/im)
+        end
+      end
+
+      context 'SSL_CIPHERS_OVERRIDE' do
+        it 'passes ssl_ciphers_override if provided' do
+          wanted = { 'SSL_CIPHERS_OVERRIDE' => 'HIGH:!aNULL' }
+          expect_create_vhost(service, {}, { settings: wanted })
+          stub_options(ssl_ciphers_override: 'HIGH:!aNULL')
+          subject.send(method, 'web')
+        end
+      end
+
+      context 'DISABLE_WEAK_CIPHER_SUITES' do
+        [true, false].each do |value|
+          it "sets disable_weak_cipher_suites to '#{value}'" do
+            wanted = { 'DISABLE_WEAK_CIPHER_SUITES' => value.to_s }
+            expect_create_vhost(service, {}, { settings: wanted })
+            stub_options(disable_weak_cipher_suites: value)
+            subject.send(method, 'web')
+          end
+        end
+      end
+    end
+
     describe 'endpoints:tcp:create' do
       m = 'endpoints:tcp:create'
       include_examples 'shared create app vhost examples', m
       include_examples 'shared create tcp vhost examples', m
+      include_examples 'shared create idle timeout examples', m
 
       it 'creates a TCP Endpoint' do
         expect_create_vhost(
@@ -465,6 +634,8 @@ describe Aptible::CLI::Agent do
       include_examples 'shared create app vhost examples', m
       include_examples 'shared create tcp vhost examples', m
       include_examples 'shared create tls vhost examples', m
+      include_examples 'shared create idle timeout examples', m
+      include_examples 'shared create non-alb tls settings examples', m
 
       it 'creates a TLS Endpoint' do
         expect_create_vhost(
@@ -484,6 +655,7 @@ describe Aptible::CLI::Agent do
       m = 'endpoints:https:create'
       include_examples 'shared create app vhost examples', m
       include_examples 'shared create tls vhost examples', m
+      include_examples 'shared create and modify ALB settings examples', m
 
       it 'creates a HTTP Endpoint' do
         expect_create_vhost(
@@ -516,6 +688,8 @@ describe Aptible::CLI::Agent do
       m = 'endpoints:grpc:create'
       include_examples 'shared create app vhost examples', m
       include_examples 'shared create tls vhost examples', m
+      include_examples 'shared create idle timeout examples', m
+      include_examples 'shared create non-alb tls settings examples', m
 
       it 'creates a gRPC Endpoint' do
         expect_create_vhost(

data/spec/fabricators/setting_fabricator.rb

@@ -0,0 +1,8 @@
+class StubSetting < StubAptibleResource; end
+
+Fabricator(:setting, from: :stub_setting) do
+  settings { {} }
+  sensitive_settings { {} }
+
+  after_create { |setting| vhost.settings << setting }
+end

data/spec/fabricators/vhost_fabricator.rb

@@ -8,6 +8,8 @@ Fabricator(:vhost, from: :stub_vhost) do
   ip_whitelist { [] }
   container_ports { [] }
   created_at { Time.now }
+  settings { [] }
+  current_setting { nil }
 
   after_create { |vhost| vhost.service.vhosts << vhost }
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: aptible-cli
 version: !ruby/object:Gem::Version
-  version: 0.26.5
+  version: 0.26.6
 platform: ruby
 authors:
 - Frank Macreery
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-03-12 00:00:00.000000000 Z
+date: 2026-05-04 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -563,6 +563,7 @@ files:
 - spec/aptible/cli/helpers/ssh_spec.rb
 - spec/aptible/cli/helpers/token_spec.rb
 - spec/aptible/cli/helpers/tunnel_spec.rb
+- spec/aptible/cli/helpers/vhost/option_set_builder_spec.rb
 - spec/aptible/cli/renderer/json_spec.rb
 - spec/aptible/cli/renderer/text_spec.rb
 - spec/aptible/cli/resource_formatter_spec.rb
@@ -608,6 +609,7 @@ files:
 - spec/fabricators/operation_fabricator.rb
 - spec/fabricators/service_fabricator.rb
 - spec/fabricators/service_sizing_policy_fabricator.rb
+- spec/fabricators/setting_fabricator.rb
 - spec/fabricators/stack_fabricator.rb
 - spec/fabricators/vhost_fabricator.rb
 - spec/mock/git
@@ -657,6 +659,7 @@ test_files:
 - spec/aptible/cli/helpers/ssh_spec.rb
 - spec/aptible/cli/helpers/token_spec.rb
 - spec/aptible/cli/helpers/tunnel_spec.rb
+- spec/aptible/cli/helpers/vhost/option_set_builder_spec.rb
 - spec/aptible/cli/renderer/json_spec.rb
 - spec/aptible/cli/renderer/text_spec.rb
 - spec/aptible/cli/resource_formatter_spec.rb
@@ -702,6 +705,7 @@ test_files:
 - spec/fabricators/operation_fabricator.rb
 - spec/fabricators/service_fabricator.rb
 - spec/fabricators/service_sizing_policy_fabricator.rb
+- spec/fabricators/setting_fabricator.rb
 - spec/fabricators/stack_fabricator.rb
 - spec/fabricators/vhost_fabricator.rb
 - spec/mock/git