aptible-cli 0.26.5 → 0.26.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 13c94bbbfe4b853700fec4e895ab0eebd02f0c5ffcddf6cfd0a597c42f665d37
-  data.tar.gz: c495f4582ca15271799caa1b71a3922c3e5bbaafa692eda9476862465971556e
+  metadata.gz: d11060c760d01bcedf1163619f8412205f95dec58b2fe1f40f58378854e7aefb
+  data.tar.gz: a1b8645bb717f084310500ac86e8e1d92c14ac78cc5883019c7de29a737fc1be
 SHA512:
-  metadata.gz: eb5b9e8adc78ba955f5125ca6c673894fea37fb8dd9a61775b4f44f87b9afc2c7fd9dbf8c645cd380af6fca7f754f03654a139539d9180060c6475544320b864
-  data.tar.gz: d86d87bb3c7d8dd6c57692c63c0592b99f950cd96b8b6bce1038678678a0c983c6b734ef380852b6edb8bb1e4e205fa6938b5045c8d5337f82fd4c40fb5aac2e
+  metadata.gz: edc9d96e02224c1d9520bc382a5415c9425bdc108ff045d6f55d87aca2376985c99749a82d2496c37a18c9066da704bb2625edde5bb00ef870e95e2bd4e3a948
+  data.tar.gz: 91c07735699ab92a1ca5f0facb86835a0271e3a5486f8965b45d2dd4f9579268edb240ba3be6f0682c3f341db31fb3e207500ef87284704fedcde301786b839a

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    aptible-cli (0.26.5)
+    aptible-cli (0.26.7)
       activesupport (>= 4.0, < 6.0)
       aptible-api (~> 1.12)
       aptible-auth (~> 1.4)

data/README.md

@@ -31,6 +31,7 @@ Commands:
   aptible apps:deprovision [--app APP]                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       # Deprovision an app
   aptible apps:rename OLD_HANDLE NEW_HANDLE [--environment ENVIRONMENT_HANDLE]                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               # Rename an app handle. In order for the new app handle to appear in log drain and metric drain destinations, you must restart the app.
   aptible apps:scale [--app APP] SERVICE [--container-count COUNT] [--container-size SIZE_MB] [--container-profile PROFILE]                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  # Scale a service
+  aptible apps:settings HANDLE                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               # Display deployment related settings for an app
   aptible backup:list DB_HANDLE                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              # List backups for a database
   aptible backup:orphaned                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    # List backups associated with deprovisioned databases
   aptible backup:purge BACKUP_ID                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             # Permanently delete a backup and any copies of it

data/lib/aptible/cli/helpers/app.rb

@@ -209,6 +209,17 @@ module Aptible
           )
         end
 
+        def current_setting(app)
+          setting_link = app.links['current_setting']
+          return unless setting_link
+
+          Aptible::Api::Setting.find_by_url(
+            setting_link.href,
+            token: fetch_token,
+            headers: { 'Prefer' => 'no_sensitive_extras=false' }
+          )
+        end
+
         private
 
         def handle_strategies

data/lib/aptible/cli/helpers/vhost/option_set_builder.rb

@@ -14,6 +14,35 @@ module Aptible
             alb
           ).freeze
 
+          SSL_PROTOCOL_VALUES = [
+            'TLSv1 TLSv1.1 TLSv1.2',
+            'TLSv1 TLSv1.1 TLSv1.2 PFS',
+            'TLSv1.1 TLSv1.2',
+            'TLSv1.1 TLSv1.2 PFS',
+            'TLSv1.2',
+            'TLSv1.2 PFS',
+            'TLSv1.2 PFS TLSv1.3',
+            'TLSv1.3'
+          ].freeze
+
+          ALB_PROTOCOL_VALUES = SSL_PROTOCOL_VALUES
+
+          ELB_PROTOCOL_VALUES =
+            SSL_PROTOCOL_VALUES.reject { |v| v.include?(' PFS') }.freeze
+
+          SSL_PROTOCOL_ALB_DESC = (
+            'Specify the allowed SSL protocols. Valid options: ' +
+            ALB_PROTOCOL_VALUES.map { |v| "\"#{v}\"" }.join(', ') +
+            '. PFS options require an HTTPS (ALB) endpoint. ' \
+            'Use "default" to reset to the platform default'
+          ).freeze
+
+          SSL_PROTOCOL_ELB_DESC = (
+            'Specify the allowed SSL protocols. Valid options: ' +
+            ELB_PROTOCOL_VALUES.map { |v| "\"#{v}\"" }.join(', ') +
+            '. Use "default" to reset to the platform default'
+          ).freeze
+
           def initialize(&block)
             FLAGS.each { |f| instance_variable_set("@#{f}", false) }
             instance_exec(&block) if block
@@ -53,6 +82,14 @@ module Aptible
                   )
                 end
 
+                option(
+                  :idle_timeout,
+                  type: :string,
+                  desc: 'Timeout (seconds) to enforce idle timeouts while ' \
+                        'sending and receiving responses. Use "default" to ' \
+                        'reset to the platform default'
+                )
+
                 if builder.alb?
                   option(
                     :load_balancing_algorithm_type,
@@ -69,6 +106,50 @@ module Aptible
                     desc: "Share this Endpoint's load balancer with other " \
                           'Endpoints'
                   )
+
+                  option(
+                    :force_ssl,
+                    type: :boolean,
+                    desc: 'Redirect all HTTP requests to HTTPS, and ' \
+                          'enable the Strict-Transport-Security header (HSTS)'
+                  )
+
+                  option(
+                    :maintenance_page_url,
+                    type: :string,
+                    desc: 'The URL of a maintenance page to cache and serve ' \
+                          'when requests time out, or your app is unhealthy. ' \
+                          'Use "default" to reset to the platform default'
+                  )
+
+                  option(
+                    :release_healthcheck_timeout,
+                    type: :string,
+                    desc: 'Timeout (seconds) to wait for your app to ' \
+                          'respond to a release health check. Use "default" ' \
+                          'to reset to the platform default'
+                  )
+
+                  option(
+                    :show_elb_healthchecks,
+                    type: :boolean,
+                    desc: 'Show all runtime health check requets in the ' \
+                          "endpoint's logs"
+                  )
+
+                  option(
+                    :ssl_protocols_override,
+                    type: :string,
+                    desc: SSL_PROTOCOL_ALB_DESC
+                  )
+
+                  option(
+                    :strict_health_checks,
+                    type: :boolean,
+                    desc: 'Require containers to respond to health checks ' \
+                          'with a 200 OK HTTP response.'
+                  )
+
                 end
               end
 
@@ -128,6 +209,27 @@ module Aptible
                   desc: 'The fingerprint of an existing Certificate to use ' \
                         'on this Endpoint'
                 )
+
+                unless builder.alb?
+                  option(
+                    :ssl_protocols_override,
+                    type: :string,
+                    desc: SSL_PROTOCOL_ELB_DESC
+                  )
+
+                  option(
+                    :ssl_ciphers_override,
+                    type: :string,
+                    desc: 'Specify the allowed SSL ciphers. ' \
+                          'Use "default" to reset to the platform default'
+                  )
+
+                  option(
+                    :disable_weak_cipher_suites,
+                    type: :boolean,
+                    desc: 'Block the SSLv3 protocol and RC4 ciphers'
+                  )
+                end
               end
             end
           end
@@ -137,6 +239,7 @@ module Aptible
             verify_option_conflicts(options)
 
             params = {}
+            settings = {}
 
             params[:ip_whitelist] = options.delete(:ip_whitelist) do
               create? ? [] : nil
@@ -203,6 +306,56 @@ module Aptible
               params[:shared] = options.delete(:shared)
             end
 
+            if (proto = options[:ssl_protocols_override]) &&
+               proto != 'default'
+              unless ALB_PROTOCOL_VALUES.include?(proto)
+                raise Thor::Error,
+                      "Invalid --ssl-protocols-override: \"#{proto}\". " \
+                      "Valid options are: #{ALB_PROTOCOL_VALUES.join(', ')}"
+              end
+
+              if !ELB_PROTOCOL_VALUES.include?(proto) && !alb?
+                raise Thor::Error,
+                      "Invalid --ssl-protocols-override: \"#{proto}\". " \
+                      'PFS options are only valid for an HTTPS (ALB) endpoint. ' \
+                      "Valid options are: #{ELB_PROTOCOL_VALUES.join(', ')}"
+              end
+            end
+
+            vhost_settings = %i(
+              idle_timeout
+              maintenance_page_url
+              release_healthcheck_timeout
+              ssl_protocols_override
+              ssl_ciphers_override
+            )
+
+            vhost_settings.each do |key|
+              val = options.delete(key)
+              next if val.nil?
+
+              settings[key.to_s.upcase] = case val
+                                          when 'default'
+                                            ''
+                                          else
+                                            val
+                                          end
+            end
+
+            boolean_vhost_settings = %i(
+              force_ssl
+              show_elb_healthchecks
+              strict_health_checks
+              disable_weak_cipher_suites
+            )
+
+            boolean_vhost_settings.each do |key|
+              value = options.delete(key)
+              next if value.nil?
+
+              settings[key.to_s.upcase] = value.to_s
+            end
+
             options.delete(:environment)
 
             # NOTE: This is here to ensure that specs don't test for options
@@ -210,7 +363,7 @@ module Aptible
             # this.
             raise "Unexpected options: #{options}" if options.any?
 
-            params.delete_if { |_, v| v.nil? }
+            [params.delete_if { |_, v| v.nil? }, settings]
           end
 
           FLAGS.each do |f|

data/lib/aptible/cli/helpers/vhost.rb

@@ -2,8 +2,11 @@ module Aptible
   module CLI
     module Helpers
       module Vhost
-        def provision_vhost_and_explain(service, vhost)
-          op = vhost.create_operation!(type: 'provision')
+        def provision_vhost_and_explain(service, vhost, settings)
+          op = vhost.create_operation!(
+            type: 'provision',
+            **(settings.empty? ? {} : { settings: settings })
+          )
           attach_to_operation_logs(op)
 
           Formatter.render(Renderer.current) do |root|

data/lib/aptible/cli/renderer/text.rb

@@ -7,7 +7,9 @@ module Aptible
         POST_PROCESSED_KEYS = {
           'Tls' => 'TLS',
           'Dns' => 'DNS',
-          'Ip' => 'IP'
+          'Ip' => 'IP',
+          'Ssl' => 'SSL',
+          'Elb' => 'ELB'
         }.freeze
 
         def visit(node, io)

data/lib/aptible/cli/resource_formatter.rb

@@ -95,11 +95,14 @@ module Aptible
           node.value('created_at', operation.created_at)
         end
 
-        def inject_app(node, app, account)
+        def inject_app(node, app, account, setting = nil,
+                       include_services: true)
           node.value('id', app.id)
           node.value('handle', app.handle)
           node.value('created_at', app.created_at)
 
+          attach_account(node, account)
+
           node.value('status', app.status)
           node.value('git_remote', app.git_repo)
 
@@ -109,15 +112,24 @@ module Aptible
             end
           end
 
-          node.list('services') do |services_list|
-            app.each_service do |service|
-              services_list.object do |n|
-                inject_service(n, service, NO_NESTING)
+          if include_services
+            node.list('services') do |services_list|
+              app.each_service do |service|
+                services_list.object do |n|
+                  inject_service(n, service, NO_NESTING)
+                end
               end
             end
           end
 
-          attach_account(node, account)
+          unless setting.nil?
+            node.value('docker_image',
+                       setting.settings['APTIBLE_DOCKER_IMAGE'])
+            node.value('private_registry_username',
+                       setting.sensitive_settings['APTIBLE_PRIVATE_REGISTRY_USERNAME'])
+            node.value('private_registry_password',
+                       setting.sensitive_settings['APTIBLE_PRIVATE_REGISTRY_PASSWORD'])
+          end
         end
 
         def inject_database_minimal(node, database, account)
@@ -213,6 +225,12 @@ module Aptible
 
           node.value('internal', vhost.internal)
 
+          unless vhost.current_setting.nil?
+            vhost.current_setting.settings.each do |k, v|
+              node.value(k.downcase, v)
+            end
+          end
+
           ip_whitelist = if vhost.ip_whitelist.any?
                            vhost.ip_whitelist.join(' ')
                          else

data/lib/aptible/cli/subcommands/apps.rb

@@ -26,7 +26,8 @@ module Aptible
                     accounts.each do |account|
                       account.each_app do |app|
                         node.object do |n|
-                          ResourceFormatter.inject_app(n, app, account)
+                          setting = current_setting(app)
+                          ResourceFormatter.inject_app(n, app, account, setting)
                         end
                       end
                     end
@@ -125,6 +126,32 @@ module Aptible
               end
             end
 
+            desc 'apps:settings HANDLE', 'Display deployment related settings for an app'
+            option :environment, aliases: '--env'
+            define_method 'apps:settings' do |handle|
+              telemetry(__method__, options.merge(handle: handle))
+
+              environment = nil
+              if options[:environment]
+                environment = environment_from_handle(options[:environment])
+              end
+              app = app_from_handle(handle, environment)
+
+              raise Thor::Error, "Could not find app #{handle}" if app.nil?
+
+              app = with_sensitive(app)
+              setting = current_setting(app)
+
+              Formatter.render(Renderer.current) do |root|
+                root.object do |node|
+                  ResourceFormatter.inject_app(
+                    node, app, app.account, setting,
+                    include_services: false
+                  )
+                end
+              end
+            end
+
             desc 'apps:rename OLD_HANDLE NEW_HANDLE [--environment'\
                  ' ENVIRONMENT_HANDLE]', 'Rename an app handle. In order'\
                  ' for the new app handle to appear in log drain and metric'\

data/lib/aptible/cli/subcommands/endpoints.rb

@@ -27,13 +27,18 @@ module Aptible
               service = database.service
               raise Thor::Error, 'Database is not provisioned' if service.nil?
 
+              prepared_params, settings = database_create_flags.prepare(
+                database.account,
+                options
+              )
+
               vhost = service.create_vhost!(
                 type: 'tcp',
                 platform: 'elb',
-                **database_create_flags.prepare(database.account, options)
+                **prepared_params
               )
 
-              provision_vhost_and_explain(service, vhost)
+              provision_vhost_and_explain(service, vhost, settings)
             end
 
             database_modify_flags = Helpers::Vhost::OptionSetBuilder.new do
@@ -49,9 +54,14 @@ module Aptible
 
               database = ensure_database(options.merge(db: options[:database]))
               vhost = find_vhost(each_service(database), hostname)
-              vhost.update!(**database_modify_flags.prepare(database.account,
-                                                            options))
-              provision_vhost_and_explain(vhost.service, vhost)
+
+              prepared_params, settings = database_modify_flags.prepare(
+                database.account,
+                options
+              )
+
+              vhost.update!(**prepared_params)
+              provision_vhost_and_explain(vhost.service, vhost, settings)
             end
 
             tcp_create_flags = Helpers::Vhost::OptionSetBuilder.new do
@@ -246,18 +256,26 @@ module Aptible
             no_commands do
               def create_app_vhost(flags, options, process_type, **attrs)
                 service = ensure_service(options, process_type)
+
+                prepared_params, settings =
+                  flags.prepare(service.account, options)
+
                 vhost = service.create_vhost!(
-                  **flags.prepare(service.account, options),
+                  **prepared_params,
                   **attrs
                 )
-                provision_vhost_and_explain(service, vhost)
+                provision_vhost_and_explain(service, vhost, settings)
               end
 
               def modify_app_vhost(flags, options, hostname)
                 app = ensure_app(options)
                 vhost = find_vhost(each_service(app), hostname)
-                vhost.update!(**flags.prepare(vhost.service.account, options))
-                provision_vhost_and_explain(vhost.service, vhost)
+
+                prepared_params, settings =
+                  flags.prepare(vhost.service.account, options)
+
+                vhost.update!(**prepared_params)
+                provision_vhost_and_explain(vhost.service, vhost, settings)
               end
             end
           end

data/lib/aptible/cli/version.rb

@@ -1,5 +1,5 @@
 module Aptible
   module CLI
-    VERSION = '0.26.5'.freeze
+    VERSION = '0.26.7'.freeze
   end
 end

data/spec/aptible/cli/helpers/vhost/option_set_builder_spec.rb

@@ -0,0 +1,94 @@
+require 'spec_helper'
+
+describe Aptible::CLI::Helpers::Vhost::OptionSetBuilder do
+  def register_options(builder)
+    klass = Class.new(Thor) { include Aptible::CLI::Helpers::App }
+    builder.declare_options(klass)
+    klass.instance_variable_get(:@method_options)
+  end
+
+  describe '--ssl-protocols-override option description' do
+    context 'HTTPS endpoints (ALB, alb! flag set)' do
+      let(:builder) do
+        described_class.new do
+          app!
+          tls!
+          alb!
+        end
+      end
+
+      it 'includes PFS values' do
+        desc = register_options(builder)[:ssl_protocols_override].description
+        expect(desc).to include('PFS')
+      end
+    end
+
+    context 'TLS endpoints (ELB, tls! without alb!)' do
+      let(:builder) do
+        described_class.new do
+          app!
+          tls!
+        end
+      end
+
+      it 'does not include PFS values' do
+        desc = register_options(builder)[:ssl_protocols_override].description
+        expect(desc).not_to include('PFS')
+      end
+
+      it 'is still present' do
+        expect(register_options(builder)).to have_key(:ssl_protocols_override)
+      end
+    end
+
+    context 'gRPC endpoints (ELB, tls! without alb!)' do
+      let(:builder) do
+        described_class.new do
+          app!
+          port!
+          tls!
+        end
+      end
+
+      it 'does not include PFS values' do
+        desc = register_options(builder)[:ssl_protocols_override].description
+        expect(desc).not_to include('PFS')
+      end
+    end
+
+    context 'TCP endpoints (no tls! flag)' do
+      let(:builder) do
+        described_class.new do
+          app!
+          ports!
+        end
+      end
+
+      it 'is absent' do
+        expect(register_options(builder)).not_to have_key(:ssl_protocols_override)
+      end
+    end
+  end
+
+  describe 'SSL_PROTOCOL_ALB_DESC' do
+    subject { described_class::SSL_PROTOCOL_ALB_DESC }
+
+    it 'lists all PFS protocol values' do
+      pfs_values = described_class::SSL_PROTOCOL_VALUES.select { |v| v.include?('PFS') }
+      pfs_values.each { |v| is_expected.to include(v) }
+    end
+  end
+
+  describe 'SSL_PROTOCOL_ELB_DESC' do
+    subject { described_class::SSL_PROTOCOL_ELB_DESC }
+
+    it 'contains no PFS values' do
+      is_expected.not_to include('PFS')
+    end
+
+    it 'lists all non-PFS protocol values' do
+      non_pfs_values = described_class::SSL_PROTOCOL_VALUES.reject { |v| v.include?('PFS') }
+      non_pfs_values.each { |v| is_expected.to include(v) }
+    end
+  end
+end

data/spec/aptible/cli/resource_formatter_spec.rb

@@ -25,6 +25,9 @@ describe Aptible::CLI::ResourceFormatter do
         shared: false
       )
 
+      vhost.current_configuration = Fabricate(:setting, settings: {},
+                                                        vhost: vhost)
+
       expected = [
         'Id: 12',
         'Hostname: foo.io',

data/spec/aptible/cli/subcommands/apps_spec.rb

@@ -101,98 +101,218 @@ describe Aptible::CLI::Agent do
         .to eq("=== #{account2.handle}\n#{app2.handle}\n")
     end
 
-    it 'includes services in JSON' do
-      account = Fabricate(:account, handle: 'account')
-      app = Fabricate(:app, account: account, handle: 'app')
-      allow(Aptible::Api::Account).to receive(:all).and_return([account])
-      allow(Aptible::Api::App).to receive(:all).and_return([app])
+    context 'with JSON output format' do
+      around do |example|
+        ClimateControl.modify(APTIBLE_OUTPUT_FORMAT: 'json') { example.run }
+      end
 
-      s1 = Fabricate(
-        :service,
-        app: app, process_type: 's1', command: 'true', container_count: 2,
-        instance_class: 'm5'
-      )
-      s2 = Fabricate(
-        :service,
-        app: app, process_type: 's2', container_memory_limit_mb: 2048,
-        instance_class: 'r5'
-      )
+      it 'includes services in JSON' do
+        account = Fabricate(:account, handle: 'account')
+        app = Fabricate(:app, account: account, handle: 'app')
+        allow(Aptible::Api::Account).to receive(:all).and_return([account])
+        allow(Aptible::Api::App).to receive(:all).and_return([app])
+
+        s1 = Fabricate(
+          :service,
+          app: app, process_type: 's1', command: 'true', container_count: 2,
+          instance_class: 'm5'
+        )
+        s2 = Fabricate(
+          :service,
+          app: app, process_type: 's2', container_memory_limit_mb: 2048,
+          instance_class: 'r5'
+        )
 
-      expected_json = [
-        {
-          'environment' => {
-            'id' => account.id,
-            'handle' => account.handle,
-            'created_at' => fmt_time(account.created_at)
-          },
-          'handle' => app.handle,
-          'id' => app.id,
-          'status' => app.status,
-          'git_remote' => app.git_repo,
-          'created_at' => fmt_time(app.created_at),
-          'services' => [
-            {
-              'service' => s1.process_type,
-              'id' => s1.id,
-              'command' => s1.command,
-              'container_count' => s1.container_count,
-              'container_profile' => 'm',
-              'container_size' => s1.container_memory_limit_mb,
-              'created_at' => fmt_time(s1.created_at)
+        expected_json = [
+          {
+            'environment' => {
+              'id' => account.id,
+              'handle' => account.handle,
+              'created_at' => fmt_time(account.created_at)
             },
-            {
-              'service' => s2.process_type,
-              'id' => s2.id,
-              'command' => 'CMD',
-              'container_count' => s2.container_count,
-              'container_profile' => 'r',
-              'container_size' => s2.container_memory_limit_mb,
-              'created_at' => fmt_time(s2.created_at)
-            }
-          ]
-        }
-      ]
+            'handle' => app.handle,
+            'id' => app.id,
+            'status' => app.status,
+            'git_remote' => app.git_repo,
+            'created_at' => fmt_time(app.created_at),
+            'services' => [
+              {
+                'service' => s1.process_type,
+                'id' => s1.id,
+                'command' => s1.command,
+                'container_count' => s1.container_count,
+                'container_profile' => 'm',
+                'container_size' => s1.container_memory_limit_mb,
+                'created_at' => fmt_time(s1.created_at)
+              },
+              {
+                'service' => s2.process_type,
+                'id' => s2.id,
+                'command' => 'CMD',
+                'container_count' => s2.container_count,
+                'container_profile' => 'r',
+                'container_size' => s2.container_memory_limit_mb,
+                'created_at' => fmt_time(s2.created_at)
+              }
+            ]
+          }
+        ]
 
-      subject.send('apps')
+        subject.send('apps')
 
-      expect(captured_output_json).to eq(expected_json)
-    end
+        expect(captured_output_json).to eq(expected_json)
+      end
 
-    it 'includes the last deploy operation in JSON' do
-      account = Fabricate(:account, handle: 'account')
-      op = Fabricate(:operation, type: 'deploy', status: 'succeeded')
-      app = Fabricate(:app, account: account, handle: 'app',
-                            last_deploy_operation: op)
-      allow(Aptible::Api::Account).to receive(:all).and_return([account])
-      allow(Aptible::Api::App).to receive(:all).and_return([app])
-
-      expected_json = [
-        {
-          'environment' => {
-            'id' => account.id,
-            'handle' => account.handle,
-            'created_at' => fmt_time(account.created_at)
-          },
-          'handle' => app.handle,
-          'id' => app.id,
-          'status' => app.status,
-          'git_remote' => app.git_repo,
-          'created_at' => fmt_time(app.created_at),
-          'last_deploy_operation' =>
-            {
-              'id' => op.id,
-              'status' => op.status,
-              'git_ref' => op.git_ref,
-              'user_email' => op.user_email,
-              'created_at' => op.created_at
+      it 'includes the last deploy operation in JSON' do
+        account = Fabricate(:account, handle: 'account')
+        op = Fabricate(:operation, type: 'deploy', status: 'succeeded')
+        app = Fabricate(:app, account: account, handle: 'app',
+                              last_deploy_operation: op)
+        allow(Aptible::Api::Account).to receive(:all).and_return([account])
+        allow(Aptible::Api::App).to receive(:all).and_return([app])
+
+        expected_json = [
+          {
+            'environment' => {
+              'id' => account.id,
+              'handle' => account.handle,
+              'created_at' => fmt_time(account.created_at)
+            },
+            'handle' => app.handle,
+            'id' => app.id,
+            'status' => app.status,
+            'git_remote' => app.git_repo,
+            'created_at' => fmt_time(app.created_at),
+            'last_deploy_operation' =>
+              {
+                'id' => op.id,
+                'status' => op.status,
+                'git_ref' => op.git_ref,
+                'user_email' => op.user_email,
+                'created_at' => op.created_at
+              },
+            'services' => []
+          }
+        ]
+
+        subject.send('apps')
+
+        expect(captured_output_json).to eq(expected_json)
+      end
+
+      it 'includes docker image and registry settings' do
+        account = Fabricate(:account, handle: 'account')
+        setting = Fabricate(
+          :setting,
+          settings: { 'APTIBLE_DOCKER_IMAGE' => 'quay.io/myorg/myapp:latest' },
+          sensitive_settings: {
+            'APTIBLE_PRIVATE_REGISTRY_USERNAME' => 'registryuser',
+            'APTIBLE_PRIVATE_REGISTRY_PASSWORD' => 'registrypass'
+          }
+        )
+        app = Fabricate(:app, account: account, handle: 'app')
+        allow(Aptible::Api::Account).to receive(:all).and_return([account])
+        allow(subject).to receive(:current_setting).with(app)
+          .and_return(setting)
+
+        expected_json = [
+          {
+            'environment' => {
+              'id' => account.id,
+              'handle' => account.handle,
+              'created_at' => fmt_time(account.created_at)
             },
-          'services' => []
+            'handle' => app.handle,
+            'id' => app.id,
+            'status' => app.status,
+            'git_remote' => app.git_repo,
+            'created_at' => fmt_time(app.created_at),
+            'services' => [],
+            'docker_image' => 'quay.io/myorg/myapp:latest',
+            'private_registry_username' => 'registryuser',
+            'private_registry_password' => 'registrypass'
+          }
+        ]
+
+        subject.send('apps')
+
+        expect(captured_output_json).to eq(expected_json)
+      end
+
+      it 'omits docker image and registry settings when no current_setting' do
+        account = Fabricate(:account, handle: 'account')
+        app = Fabricate(:app, account: account, handle: 'app')
+        allow(Aptible::Api::Account).to receive(:all).and_return([account])
+        allow(subject).to receive(:current_setting).with(app)
+          .and_return(nil)
+
+        subject.send('apps')
+
+        json = captured_output_json
+        expect(json.first).not_to have_key('docker_image')
+        expect(json.first).not_to have_key('private_registry_username')
+        expect(json.first).not_to have_key('private_registry_password')
+      end
+    end
+  end
+
+  describe '#apps:settings' do
+    it 'displays app settings in JSON' do
+      ClimateControl.modify(APTIBLE_OUTPUT_FORMAT: 'json') do
+        setting = Fabricate(
+          :setting,
+          settings: { 'APTIBLE_DOCKER_IMAGE' => 'quay.io/myorg/myapp:latest' },
+          sensitive_settings: {
+            'APTIBLE_PRIVATE_REGISTRY_USERNAME' => 'registryuser',
+            'APTIBLE_PRIVATE_REGISTRY_PASSWORD' => 'registrypass'
+          }
+        )
+        allow(subject).to receive(:app_from_handle)
+          .with('hello', nil).and_return(app)
+        allow(subject).to receive(:current_setting).with(app)
+          .and_return(setting)
+
+        subject.send('apps:settings', 'hello')
+
+        json = captured_output_json
+        expect(json['handle']).to eq('hello')
+        expect(json['docker_image']).to eq('quay.io/myorg/myapp:latest')
+        expect(json['private_registry_username']).to eq('registryuser')
+        expect(json['private_registry_password']).to eq('registrypass')
+        expect(json).not_to have_key('services')
+        expect(json).not_to have_key('last_deploy_operation')
+      end
+    end
+
+    it 'displays app settings in text' do
+      setting = Fabricate(
+        :setting,
+        settings: { 'APTIBLE_DOCKER_IMAGE' => 'quay.io/myorg/myapp:latest' },
+        sensitive_settings: {
+          'APTIBLE_PRIVATE_REGISTRY_USERNAME' => 'registryuser',
+          'APTIBLE_PRIVATE_REGISTRY_PASSWORD' => 'registrypass'
         }
-      ]
+      )
+      allow(subject).to receive(:app_from_handle)
+        .with('hello', nil).and_return(app)
+      allow(subject).to receive(:current_setting).with(app)
+        .and_return(setting)
+
+      subject.send('apps:settings', 'hello')
+
+      output = captured_output_text
+      expect(output).to include('quay.io/myorg/myapp:latest')
+      expect(output).to include('registryuser')
+      expect(output).to include('registrypass')
+      expect(output).not_to include('services')
+    end
 
-      subject.send('apps')
+    it 'raises an error when app is not found' do
+      allow(subject).to receive(:app_from_handle)
+        .with('nope', nil).and_return(nil)
 
-      expect(captured_output_json).to eq(expected_json)
+      expect { subject.send('apps:settings', 'nope') }
+        .to raise_error(Thor::Error, /Could not find app nope/)
     end
   end
 

data/spec/aptible/cli/subcommands/endpoints_spec.rb

@@ -25,12 +25,12 @@ describe Aptible::CLI::Agent do
     end
   end
 
-  def expect_create_vhost(service, options)
+  def expect_create_vhost(service, options, settings: nil)
     expect(service).to receive(:create_vhost!).with(
       hash_including(options)
     ) do |args|
       Fabricate(:vhost, service: service, **args).tap do |v|
-        expect_operation(v, 'provision')
+        expect_operation(v, 'provision', settings: settings)
         expect(v).to receive(:reload).and_return(v)
         expect(Aptible::CLI::ResourceFormatter).to receive(:inject_vhost)
           .with(an_instance_of(Aptible::CLI::Formatter::Object), v, service)
@@ -49,8 +49,16 @@ describe Aptible::CLI::Agent do
     end
   end
 
-  def expect_operation(vhost, type)
-    expect(vhost).to receive(:create_operation!).with(type: type) do
+  def expect_operation(vhost, type, settings: nil)
+    expect(vhost).to receive(:create_operation!) do |args|
+      expect(args[:type]).to eq(type)
+
+      if settings.nil?
+        expect(args).not_to have_key(:settings)
+      else
+        expect(args[:settings]).to eq(settings)
+      end
+
       Fabricate(:operation).tap do |o|
         expect(subject).to receive(:attach_to_operation_logs).with(o)
       end
@@ -170,7 +178,13 @@ describe Aptible::CLI::Agent do
       it 'lists Endpoints' do
         s = Fabricate(:service, database: db)
         v1 = Fabricate(:vhost, service: s)
+        v1.current_setting = Fabricate(:setting,
+                                       settings: { 'IDLE_TIMEOUT' => '123' },
+                                       vhost: v1)
         v2 = Fabricate(:vhost, service: s)
+        v2.current_setting = Fabricate(:setting,
+                                       settings: { 'FORCE_SSL' => 'true' },
+                                       vhost: v2)
 
         stub_options(database: db.handle)
         subject.send('endpoints:list')
@@ -179,6 +193,8 @@ describe Aptible::CLI::Agent do
 
         expect(lines).to include("Hostname: #{v1.external_host}")
         expect(lines).to include("Hostname: #{v2.external_host}")
+        expect(lines).to include('Idle Timeout: 123')
+        expect(lines).to include('Force SSL: true')
 
         expect(lines[0]).not_to eq("\n")
         expect(lines[-1]).not_to eq("\n")
@@ -243,6 +259,105 @@ describe Aptible::CLI::Agent do
       stub_options
     end
 
+    shared_examples 'shared create and modify ALB settings examples' do |method|
+      context 'App Vhost Settings (string)' do
+        string_options = %i(
+          idle_timeout
+          maintenance_page_url
+          release_healthcheck_timeout
+        )
+
+        let(:value) { 'some value' }
+
+        string_options.each do |option|
+          context "--#{option.to_s.tr('_', '-')}" do
+            it 'passes a value if provided' do
+              wanted = { option.to_s.upcase => value }
+              expect_create_vhost(service, {}, { settings: wanted })
+              stub_options(option => value)
+              subject.send(method, 'web')
+            end
+
+            it 'passes nothing if not provided' do
+              expect_create_vhost(service, {})
+              subject.send(method, 'web')
+            end
+
+            context 'reverting to default' do
+              it 'sends an empty string if passed an empty string' do
+                wanted = { option.to_s.upcase => '' }
+                expect_create_vhost(service, {}, { settings: wanted })
+                stub_options(option => '')
+                subject.send(method, 'web')
+              end
+
+              it 'sends an empty string if passed the string "default"' do
+                wanted = { option.to_s.upcase => '' }
+                expect_create_vhost(service, {}, { settings: wanted })
+                stub_options(option => 'default')
+                subject.send(method, 'web')
+              end
+            end
+          end
+        end
+      end
+
+      context '--ssl-protocols-override' do
+        it 'passes a valid non-PFS value' do
+          wanted = { 'SSL_PROTOCOLS_OVERRIDE' => 'TLSv1.2' }
+          expect_create_vhost(service, {}, { settings: wanted })
+          stub_options(ssl_protocols_override: 'TLSv1.2')
+          subject.send(method, 'web')
+        end
+
+        it 'passes a valid PFS value' do
+          wanted = { 'SSL_PROTOCOLS_OVERRIDE' => 'TLSv1.2 PFS' }
+          expect_create_vhost(service, {}, { settings: wanted })
+          stub_options(ssl_protocols_override: 'TLSv1.2 PFS')
+          subject.send(method, 'web')
+        end
+
+        it 'raises an error for an invalid value' do
+          stub_options(ssl_protocols_override: 'TLSv1.0')
+          expect { subject.send(method, 'web') }
+            .to raise_error(/invalid --ssl-protocols-override/im)
+        end
+
+        it 'passes nothing if not provided' do
+          expect_create_vhost(service, {})
+          subject.send(method, 'web')
+        end
+
+        it 'sends an empty string if passed the string "default"' do
+          wanted = { 'SSL_PROTOCOLS_OVERRIDE' => '' }
+          expect_create_vhost(service, {}, { settings: wanted })
+          stub_options(ssl_protocols_override: 'default')
+          subject.send(method, 'web')
+        end
+      end
+
+      context 'App Vhost Settings (boolean)' do
+        boolean_options = %i(
+          force_ssl
+          show_elb_healthchecks
+          strict_health_checks
+        )
+
+        boolean_options.each do |option|
+          [true, false].each do |value|
+            context "--#{value ? '' : 'no-'}#{option.to_s.tr('_', '-')}" do
+              it "sets the value to the string '#{value}'" do
+                wanted = { option.to_s.upcase => value.to_s }
+                expect_create_vhost(service, {}, { settings: wanted })
+                stub_options(option => value)
+                subject.send(method, 'web')
+              end
+            end
+          end
+        end
+      end
+    end
+
     shared_examples 'shared create app vhost examples' do |method|
       context 'App Vhost Options' do
         it 'fails if the app does not exist' do
@@ -440,10 +555,64 @@ describe Aptible::CLI::Agent do
       end
     end
 
+    shared_examples 'shared create idle timeout examples' do |method|
+      context 'IDLE_TIMEOUT' do
+        it 'passes idle_timeout if provided' do
+          expect_create_vhost(service, {}, { settings: { 'IDLE_TIMEOUT' => '30' } })
+          stub_options(idle_timeout: '30')
+          subject.send(method, 'web')
+        end
+      end
+    end
+
+    shared_examples 'shared create non-alb tls settings examples' do |method|
+      context '--ssl-protocols-override' do
+        it 'passes a valid non-PFS value' do
+          wanted = { 'SSL_PROTOCOLS_OVERRIDE' => 'TLSv1.2' }
+          expect_create_vhost(service, {}, { settings: wanted })
+          stub_options(ssl_protocols_override: 'TLSv1.2')
+          subject.send(method, 'web')
+        end
+
+        it 'raises an error for a PFS value' do
+          stub_options(ssl_protocols_override: 'TLSv1.2 PFS')
+          expect { subject.send(method, 'web') }
+            .to raise_error(/pfs.*only.*alb/im)
+        end
+
+        it 'raises an error for an invalid value' do
+          stub_options(ssl_protocols_override: 'TLSv1.0')
+          expect { subject.send(method, 'web') }
+            .to raise_error(/invalid --ssl-protocols-override/im)
+        end
+      end
+
+      context 'SSL_CIPHERS_OVERRIDE' do
+        it 'passes ssl_ciphers_override if provided' do
+          wanted = { 'SSL_CIPHERS_OVERRIDE' => 'HIGH:!aNULL' }
+          expect_create_vhost(service, {}, { settings: wanted })
+          stub_options(ssl_ciphers_override: 'HIGH:!aNULL')
+          subject.send(method, 'web')
+        end
+      end
+
+      context 'DISABLE_WEAK_CIPHER_SUITES' do
+        [true, false].each do |value|
+          it "sets disable_weak_cipher_suites to '#{value}'" do
+            wanted = { 'DISABLE_WEAK_CIPHER_SUITES' => value.to_s }
+            expect_create_vhost(service, {}, { settings: wanted })
+            stub_options(disable_weak_cipher_suites: value)
+            subject.send(method, 'web')
+          end
+        end
+      end
+    end
+
     describe 'endpoints:tcp:create' do
       m = 'endpoints:tcp:create'
       include_examples 'shared create app vhost examples', m
       include_examples 'shared create tcp vhost examples', m
+      include_examples 'shared create idle timeout examples', m
 
       it 'creates a TCP Endpoint' do
         expect_create_vhost(
@@ -465,6 +634,8 @@ describe Aptible::CLI::Agent do
       include_examples 'shared create app vhost examples', m
       include_examples 'shared create tcp vhost examples', m
       include_examples 'shared create tls vhost examples', m
+      include_examples 'shared create idle timeout examples', m
+      include_examples 'shared create non-alb tls settings examples', m
 
       it 'creates a TLS Endpoint' do
         expect_create_vhost(
@@ -484,6 +655,7 @@ describe Aptible::CLI::Agent do
       m = 'endpoints:https:create'
       include_examples 'shared create app vhost examples', m
       include_examples 'shared create tls vhost examples', m
+      include_examples 'shared create and modify ALB settings examples', m
 
       it 'creates a HTTP Endpoint' do
         expect_create_vhost(
@@ -516,6 +688,8 @@ describe Aptible::CLI::Agent do
       m = 'endpoints:grpc:create'
       include_examples 'shared create app vhost examples', m
       include_examples 'shared create tls vhost examples', m
+      include_examples 'shared create idle timeout examples', m
+      include_examples 'shared create non-alb tls settings examples', m
 
       it 'creates a gRPC Endpoint' do
         expect_create_vhost(

data/spec/fabricators/app_fabricator.rb

@@ -28,6 +28,7 @@ Fabricator(:app, from: :stub_app) do
   services { [] }
   configurations { [] }
   current_configuration { nil }
+  current_setting { nil }
   errors { Aptible::Resource::Errors.new }
   created_at { Time.now }
 
@@ -37,6 +38,11 @@ Fabricator(:app, from: :stub_app) do
         href: "/accounts/#{attrs[:account].id}"
       )
     }
+    if attrs[:current_setting]
+      hash[:current_setting] = OpenStruct.new(
+        href: "/settings/#{attrs[:current_setting].id}"
+      )
+    end
     OpenStruct.new(hash)
   end
 

data/spec/fabricators/setting_fabricator.rb

@@ -0,0 +1,8 @@
+class StubSetting < StubAptibleResource; end
+
+Fabricator(:setting, from: :stub_setting) do
+  settings { {} }
+  sensitive_settings { {} }
+
+  after_create { |setting| setting.vhost.settings << setting if setting.vhost }
+end

data/spec/fabricators/vhost_fabricator.rb

@@ -8,6 +8,8 @@ Fabricator(:vhost, from: :stub_vhost) do
   ip_whitelist { [] }
   container_ports { [] }
   created_at { Time.now }
+  settings { [] }
+  current_setting { nil }
 
   after_create { |vhost| vhost.service.vhosts << vhost }
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: aptible-cli
 version: !ruby/object:Gem::Version
-  version: 0.26.5
+  version: 0.26.7
 platform: ruby
 authors:
 - Frank Macreery
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-03-12 00:00:00.000000000 Z
+date: 2026-06-08 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -563,6 +563,7 @@ files:
 - spec/aptible/cli/helpers/ssh_spec.rb
 - spec/aptible/cli/helpers/token_spec.rb
 - spec/aptible/cli/helpers/tunnel_spec.rb
+- spec/aptible/cli/helpers/vhost/option_set_builder_spec.rb
 - spec/aptible/cli/renderer/json_spec.rb
 - spec/aptible/cli/renderer/text_spec.rb
 - spec/aptible/cli/resource_formatter_spec.rb
@@ -608,6 +609,7 @@ files:
 - spec/fabricators/operation_fabricator.rb
 - spec/fabricators/service_fabricator.rb
 - spec/fabricators/service_sizing_policy_fabricator.rb
+- spec/fabricators/setting_fabricator.rb
 - spec/fabricators/stack_fabricator.rb
 - spec/fabricators/vhost_fabricator.rb
 - spec/mock/git
@@ -657,6 +659,7 @@ test_files:
 - spec/aptible/cli/helpers/ssh_spec.rb
 - spec/aptible/cli/helpers/token_spec.rb
 - spec/aptible/cli/helpers/tunnel_spec.rb
+- spec/aptible/cli/helpers/vhost/option_set_builder_spec.rb
 - spec/aptible/cli/renderer/json_spec.rb
 - spec/aptible/cli/renderer/text_spec.rb
 - spec/aptible/cli/resource_formatter_spec.rb
@@ -702,6 +705,7 @@ test_files:
 - spec/fabricators/operation_fabricator.rb
 - spec/fabricators/service_fabricator.rb
 - spec/fabricators/service_sizing_policy_fabricator.rb
+- spec/fabricators/setting_fabricator.rb
 - spec/fabricators/stack_fabricator.rb
 - spec/fabricators/vhost_fabricator.rb
 - spec/mock/git