boring_services 0.8.0 → 0.8.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d1211d9bead3bd016414ec0b41c4750d59bb3afabb1e892ea9e05488bdb12dd2
-  data.tar.gz: a813b195971c06f10bae0989255fb0a63d99158d2afbcc4ea6aecb756e291a93
+  metadata.gz: d26c6e6770c20727d68f773f48f1505b9eaeedef20b72d73cd9af76668773bc4
+  data.tar.gz: b6d7d7ca8c099f958c51f542ff0f7eb64d6b23ae1241ca62e27041c044867f1b
 SHA512:
-  metadata.gz: 3c321ae267b8eb3594955db1d965da1633a9f879db5a3bd8986939cfa3770dd54b18fad07299c0bf7a375e9e3ef05224e3303b9e8d1a5af631119698847a6016
-  data.tar.gz: 1462cef1c4ff1f49c993da325c5db5d847fab9636fbfe66f03c92f96def0c899ba01309f18ce192195029da6be159e0f36fb4c76c0f04acd11674415482554fc
+  metadata.gz: eab7cdbc819793e3f49ebb6a2212f37cd5d4c2019d8d96b15e70ca9431732a823ec51a689c450a9f8fd9b2fa8e3e7db849d716428044c988e697701bb36b45f6
+  data.tar.gz: 23d2c7f46e5e6a14a1f6adf143771a1869e5dbb66401f7ac175ba70797b0c70ba0a4b114ac5cede972f2dd68c6ace88a46ecd2258033a1226533c0579b461519

data/CHANGELOG.md

@@ -0,0 +1,56 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.8.1] - 2026-08-20
+
+### Changed
+
+- Require Ruby 4.0 or newer.
+- Align runtime and development dependencies with the maintained toolchain.
+- Add blocking test, lint, dependency-audit, and package-build CI checks.
+- Add automated Bundler and GitHub Actions dependency updates.
+- Clarify that private IP metadata does not configure bind addresses or
+  firewalls.
+
+## [0.1.0] - 2025-01-21
+
+### Added
+- Initial release of BoringServices
+- Deploy infrastructure services (Memcached, Redis, HAProxy, Nginx) via SSH
+- Rails integration with generators and rake tasks
+- Standalone Ruby support (no Rails dependency required)
+- Configuration override support for HAProxy via `custom_params`:
+  - `timeout_connect`, `timeout_client`, `timeout_server`
+  - `balance` algorithm (roundrobin, leastconn, etc.)
+  - `health_check_path` customization
+  - `ssl_ciphers` and `ssl_options` for SSL/TLS configuration
+- Configuration override support for Memcached via `custom_params`:
+  - `listen_address`, `max_connections`
+  - `max_item_size`, `verbosity`
+- Custom config template support:
+  - HAProxy: `custom_config_template` option to provide your own config file
+  - Memcached: `custom_config_template` option to provide your own config file
+- VPN/private network support with `private_ip` field for tracking internal IPs
+- Multi-host deployment support for services
+- Environment-based configuration (development, staging, production)
+- Secret management via environment variables or command execution
+- SSL/TLS support for HAProxy with automatic certificate management
+- Health checking and status monitoring
+- SSH key-based authentication with configurable options
+
+### Changed
+- Made railties dependency optional for standalone Ruby usage
+- Improved documentation with comprehensive examples
+- Updated Ruby requirement to >= 3.0.0 (from >= 3.4.0)
+
+### Technical Details
+- Uses SSHKit for SSH operations
+- Supports Ubuntu 20.04+ servers (Debian-based distributions)
+- YAML-based configuration with ERB support
+- Thor-based CLI interface

data/README.md

@@ -371,9 +371,15 @@ BoringServices supports deploying services over VPN or private networks (e.g., W
 
 - **Public IPs** (`host`) for SSH deployment access
 - **Private IPs** (`private_ip`) for service communication
-- Services listen on all interfaces (0.0.0.0) by default
+- Some generated service configurations listen on all interfaces (`0.0.0.0`)
+  by default
 - Accessible via private network IPs
-- No public exposure of services
+- `private_ip` documents the address clients should use; it does not change the
+  service bind address or configure a firewall
+
+Before deploying, restrict each service port to the intended private CIDRs with
+the provider firewall and the host firewall, or set a supported service-specific
+listen address. A public SSH address does not make a service endpoint private.
 
 **Example with Private IPs:**
 
@@ -428,7 +434,7 @@ haproxy: healthy
 
 ## Requirements
 
-- Ruby 3.0+
+- Ruby 4.0+
 - Ubuntu 20.04+ servers (Debian-based distributions)
 - SSH key-based authentication
 - Optional: VPN solution (WireGuard, Tailscale, etc.) for private networking

data/SECURITY.md

@@ -0,0 +1,22 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+Please do not open a public issue for a potential vulnerability. Email
+[security@boringcache.com](mailto:security@boringcache.com) or use
+[GitHub private vulnerability reporting](https://github.com/boringcache/services/security/advisories/new).
+
+Include the affected version, service, expected impact, and enough reproduction
+detail for us to investigate. Do not include live credentials, private keys,
+certificates, customer data, or production configuration.
+
+## Supported Versions
+
+Only the latest published release is supported. Security fixes are normally
+shipped in a new release rather than backported.
+
+## Scope
+
+Reports about SSH host verification, network exposure, secret handling,
+generated service configuration, command execution, or release integrity are
+welcome.

data/lib/boring_services/cli.rb

@@ -52,7 +52,8 @@ module BoringServices
       exit 1
     end
 
-    desc 'reconfigure [SERVICE]', 'Reconfigure service(s) - skips package installation, only updates config and restarts'
+    desc 'reconfigure [SERVICE]',
+         'Reconfigure service(s) - skips package installation, only updates config and restarts'
     def reconfigure(service_name = nil)
       config = Configuration.load(options[:config], options[:environment])
       installer = Installer.new(config)
@@ -108,7 +109,7 @@ module BoringServices
     end
 
     def print_memcached_stats(stats)
-      bytes = format_bytes(stats['bytes']&.to_i || 0)
+      bytes = format_bytes(stats['bytes'].to_i)
       conns = stats['curr_connections'] || '0'
       items = stats['curr_items'] || '0'
       hit_rate = calculate_hit_rate(stats['get_hits'], stats['get_misses'])
@@ -116,8 +117,8 @@ module BoringServices
     end
 
     def calculate_hit_rate(hits, misses)
-      hits = hits&.to_i || 0
-      misses = misses&.to_i || 0
+      hits = hits.to_i
+      misses = misses.to_i
       total = hits + misses
       total.positive? ? ((hits.to_f / total) * 100).round(1) : 0
     end

data/lib/boring_services/installer.rb

@@ -115,9 +115,9 @@ module BoringServices
     end
 
     def print_credentials_summary(hints)
-      puts "\n" + "=" * 50
-      puts "📋 Add to Rails credentials:"
-      puts "=" * 50
+      puts "\n#{'=' * 50}"
+      puts '📋 Add to Rails credentials:'
+      puts '=' * 50
 
       # Group by service type
       grouped = hints.group_by { |h| h[:type] }
@@ -129,14 +129,14 @@ module BoringServices
         by_region = entries.group_by { |e| e[:region] }
         by_region.each do |region, region_entries|
           puts "  #{region}:"
-          puts "    servers:"
+          puts '    servers:'
           region_entries.each do |entry|
             puts "      - #{entry[:server]}  # #{entry[:label]}"
           end
         end
       end
 
-      puts "\n" + "=" * 50
+      puts "\n#{'=' * 50}"
     end
   end
 end

data/lib/boring_services/secrets.rb

@@ -1,4 +1,7 @@
 require 'English'
+require 'open3'
+require 'shellwords'
+
 module BoringServices
   class Secrets
     def self.resolve(value)
@@ -8,10 +11,10 @@ module BoringServices
 
       if value_str.start_with?('credentials:')
         resolve_rails_credentials(value_str)
-      elsif value_str.start_with?('$')
-        resolve_env_var(value_str)
       elsif value_str.start_with?('$(') && value_str.end_with?(')')
         resolve_command(value_str[2..-2])
+      elsif value_str.start_with?('$')
+        resolve_env_var(value_str)
       else
         value_str
       end
@@ -24,16 +27,19 @@ module BoringServices
 
       # Use rails credentials:show to fetch the value
       # This requires being run from the Rails root directory
-      command = "RAILS_ENV=production bundle exec rails runner \"puts Rails.application.credentials.dig(#{keys.map { |k| ":#{k}" }.join(', ')})\""
-      result = `#{command}`.strip
+      runner = "puts Rails.application.credentials.dig(#{keys.map { |key| key.to_sym.inspect }.join(', ')})"
+      result, stderr, status = Open3.capture3(
+        { 'RAILS_ENV' => ENV.fetch('RAILS_ENV', 'production') },
+        'bundle', 'exec', 'rails', 'runner', runner
+      )
 
-      unless $CHILD_STATUS.success?
-        raise Error, "Failed to resolve Rails credentials: #{key_path}. Make sure you're running from the Rails root directory."
+      unless status.success?
+        detail = stderr.strip.empty? ? 'Make sure you are running from the Rails root directory.' : stderr.strip
+        raise Error, "Failed to resolve Rails credentials: #{key_path}. #{detail}"
       end
 
-      if result.empty?
-        raise Error, "Rails credentials key not found: #{key_path}"
-      end
+      result = result.strip
+      raise Error, "Rails credentials key not found: #{key_path}" if result.empty?
 
       result
     end
@@ -46,10 +52,13 @@ module BoringServices
     end
 
     def self.resolve_command(command)
-      result = `#{command}`.strip
-      raise Error, "Command failed: #{command}" unless $CHILD_STATUS.success?
+      argv = Shellwords.split(command)
+      raise Error, 'Command secret is empty' if argv.empty?
 
-      result
+      result, stderr, status = Open3.capture3(*argv)
+      raise Error, "Command failed: #{argv.first}: #{stderr.strip}" unless status.success?
+
+      result.strip
     end
   end
 end

data/lib/boring_services/service_locator.rb

@@ -66,7 +66,7 @@ module BoringServices
 
       return nil if hosts.empty?
 
-      port = port_for('memcached') || 11211
+      port = port_for('memcached') || 11_211
       hosts.map { |h| "#{h}:#{port}" }.join(',')
     end
 

data/lib/boring_services/services/haproxy.rb

@@ -9,7 +9,7 @@ module BoringServices
           configure_haproxy
           validate_config
           ssh_executor.systemd_enable('haproxy')
-          ssh_executor.systemd_restart('haproxy')  # Use restart instead of start to reload config
+          ssh_executor.systemd_restart('haproxy') # Use restart instead of start to reload config
           verify_listening_ports
         end
       end
@@ -257,7 +257,7 @@ module BoringServices
         ports_to_check << stats_port
 
         ports_to_check.each do |check_port|
-          result = execute :sudo, :ss, '-tlnp', '|', :grep, "-E", "':#{check_port} '", raise_on_error: false
+          result = execute :sudo, :ss, '-tlnp', '|', :grep, '-E', "':#{check_port} '", raise_on_error: false
           if result
             puts "    ✓ Port #{check_port} is listening"
           else

data/lib/boring_services/services/redis.rb

@@ -42,7 +42,7 @@ module BoringServices
         listen_port = port || 6379
         password = resolve_secret('redis_password') if config.secrets['redis_password']
         has_private_ip = !private_ip.to_s.strip.empty?
-        bind_address = has_private_ip ? "127.0.0.1 #{private_ip}" : "0.0.0.0"
+        bind_address = has_private_ip ? "127.0.0.1 #{private_ip}" : '0.0.0.0'
 
         config_content = <<~REDIS
           bind #{bind_address}
@@ -62,9 +62,7 @@ module BoringServices
         execute :sudo, :chmod, '640', '/etc/redis/redis.conf'
 
         # If using private IP (WireGuard), ensure Redis starts after WireGuard
-        if has_private_ip
-          configure_wireguard_dependency
-        end
+        configure_wireguard_dependency if has_private_ip
 
         # Set vm.overcommit_memory for Redis background saves
         execute :sudo, :sysctl, '-w', 'vm.overcommit_memory=1'

data/lib/boring_services/ssh_executor.rb

@@ -152,10 +152,10 @@ module BoringServices
       end
     end
 
-    def capture_on_host(host, *args)
+    def capture_on_host(host, *)
       output = nil
       execute_on_host(host) do
-        output = capture(*args, raise_on_non_zero_exit: false)
+        output = capture(*, raise_on_non_zero_exit: false)
       end
       output
     end

data/lib/boring_services/version.rb

@@ -1,3 +1,3 @@
 module BoringServices
-  VERSION = '0.8.0'.freeze
+  VERSION = '0.8.1'.freeze
 end

data/lib/boring_services.rb

@@ -71,7 +71,7 @@ module BoringServices
 
     # Get Memcached port
     def memcached_port
-      locator.port_for('memcached') || 11211
+      locator.port_for('memcached') || 11_211
     end
 
     # Get Memcached servers string (host:port,host:port)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: boring_services
 version: !ruby/object:Gem::Version
-  version: 0.8.0
+  version: 0.8.1
 platform: ruby
 authors:
 - BoringCache
@@ -29,84 +29,42 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.3'
+        version: '1.4'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.3'
+        version: '1.4'
 - !ruby/object:Gem::Dependency
   name: sshkit
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.21'
+        version: '1.25'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.21'
+        version: '1.25'
 - !ruby/object:Gem::Dependency
   name: thor
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.3'
+        version: '1.5'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.3'
-- !ruby/object:Gem::Dependency
-  name: minitest
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '5.0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '5.0'
-- !ruby/object:Gem::Dependency
-  name: rubocop
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '1.50'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '1.50'
-- !ruby/object:Gem::Dependency
-  name: simplecov
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '0.22'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '0.22'
+        version: '1.5'
 description: Simple deployment and management of infrastructure services like Memcached,
   Redis, HAProxy, and Nginx. Works standalone or with Rails.
 email:
@@ -116,8 +74,10 @@ executables:
 extensions: []
 extra_rdoc_files: []
 files:
+- CHANGELOG.md
 - LICENSE
 - README.md
+- SECURITY.md
 - exe/boringservices
 - lib/boring_services.rb
 - lib/boring_services/cli.rb
@@ -136,14 +96,14 @@ files:
 - lib/boring_services/ssh_executor.rb
 - lib/boring_services/version.rb
 - lib/tasks/services.rake
-homepage: https://github.com/boringcache/boring_services
+homepage: https://github.com/boringcache/services
 licenses:
 - MIT
 metadata:
-  homepage_uri: https://github.com/boringcache/boring_services
-  source_code_uri: https://github.com/boringcache/boring_services
-  documentation_uri: https://github.com/boringcache/boring_services/blob/main/README.md
-  changelog_uri: https://github.com/boringcache/boring_services/blob/main/CHANGELOG.md
+  source_code_uri: https://github.com/boringcache/services
+  documentation_uri: https://github.com/boringcache/services/blob/main/README.md
+  changelog_uri: https://github.com/boringcache/services/blob/main/CHANGELOG.md
+  bug_tracker_uri: https://github.com/boringcache/services/issues
   rubygems_mfa_required: 'true'
 rdoc_options: []
 require_paths:
@@ -152,14 +112,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '3.4'
+      version: 4.0.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.9
+rubygems_version: 4.0.16
 specification_version: 4
 summary: Deploy infrastructure services for Ruby & Rails apps
 test_files: []