dash 2.12.0

data/lib/kamal/configuration/proxy.rb

@@ -0,0 +1,156 @@
+class Kamal::Configuration::Proxy
+  include Kamal::Configuration::Validation
+
+  DEFAULT_LOG_REQUEST_HEADERS = [ "Cache-Control", "Last-Modified", "User-Agent" ]
+  CONTAINER_NAME = "kamal-proxy"
+  LOADBALANCER_CONTAINER_NAME = "kamal-loadbalancer"
+
+  delegate :argumentize, :optionize, to: Kamal::Utils
+
+  attr_reader :config, :proxy_config, :role_name, :run, :secrets
+  def initialize(config:, proxy_config:, role_name: nil, secrets:, context: "proxy")
+    @config = config
+    @proxy_config = proxy_config
+    @proxy_config = {} if @proxy_config.nil?
+    @role_name = role_name
+    @secrets = secrets
+    validate! @proxy_config, with: Kamal::Configuration::Validator::Proxy, context: context
+    @run = Kamal::Configuration::Proxy::Run.new(config, run_config: @proxy_config["run"], context: "#{context}/run") if @proxy_config && @proxy_config["run"].present?
+  end
+
+  def app_port
+    proxy_config.fetch("app_port", 80)
+  end
+
+  def ssl?
+    proxy_config.fetch("ssl", false)
+  end
+
+  def hosts
+    proxy_config["hosts"] || proxy_config["host"]&.split(",") || []
+  end
+
+  def loadbalancer
+    proxy_config["loadbalancer"]
+  end
+
+  def load_balancing?
+    effective_loadbalancer.present?
+  end
+
+  def effective_loadbalancer
+    return false if loadbalancer == false
+    return loadbalancer if loadbalancer.present?
+    return config.primary_role.hosts.first if config.primary_role && Array(config.primary_role.hosts).size > 1
+
+    nil
+  end
+
+  def loadbalancer_on_proxy_host?
+    load_balancing? && config.proxy_hosts.include?(effective_loadbalancer)
+  end
+
+  def custom_ssl_certificate?
+    ssl = proxy_config["ssl"]
+    return false unless ssl.is_a?(Hash)
+    ssl["certificate_pem"].present? && ssl["private_key_pem"].present?
+  end
+
+  def certificate_pem_content
+    ssl = proxy_config["ssl"]
+    return nil unless ssl.is_a?(Hash)
+    secrets[ssl["certificate_pem"]]
+  end
+
+  def private_key_pem_content
+    ssl = proxy_config["ssl"]
+    return nil unless ssl.is_a?(Hash)
+    secrets[ssl["private_key_pem"]]
+  end
+
+  def host_tls_cert
+    tls_path(config.proxy_boot.tls_directory, "cert.pem")
+  end
+
+  def host_tls_key
+    tls_path(config.proxy_boot.tls_directory, "key.pem")
+  end
+
+  def container_tls_cert
+    tls_path(config.proxy_boot.tls_container_directory, "cert.pem")
+  end
+
+  def container_tls_key
+    tls_path(config.proxy_boot.tls_container_directory, "key.pem") if custom_ssl_certificate?
+  end
+
+  def path_prefixes
+    proxy_config["path_prefixes"] || proxy_config["path_prefix"]&.split(",") || []
+  end
+
+  def deploy_options
+    opts = {
+      host: hosts,
+      tls: ssl? ? true : nil,
+      "tls-certificate-path": container_tls_cert,
+      "tls-private-key-path": container_tls_key,
+      "deploy-timeout": seconds_duration(config.deploy_timeout),
+      "drain-timeout": seconds_duration(config.drain_timeout),
+      "health-check-interval": seconds_duration(proxy_config.dig("healthcheck", "interval")),
+      "health-check-timeout": seconds_duration(proxy_config.dig("healthcheck", "timeout")),
+      "health-check-path": proxy_config.dig("healthcheck", "path"),
+      "target-timeout": seconds_duration(proxy_config["response_timeout"]),
+      "buffer-requests": proxy_config.fetch("buffering", { "requests": true }).fetch("requests", true),
+      "buffer-responses": proxy_config.fetch("buffering", { "responses": true }).fetch("responses", true),
+      "buffer-memory": proxy_config.dig("buffering", "memory"),
+      "max-request-body": proxy_config.dig("buffering", "max_request_body"),
+      "max-response-body": proxy_config.dig("buffering", "max_response_body"),
+      "path-prefix": path_prefixes,
+      "strip-path-prefix": proxy_config.dig("strip_path_prefix"),
+      "forward-headers": proxy_config.dig("forward_headers"),
+      "tls-redirect": proxy_config.dig("ssl_redirect"),
+      "log-request-header": proxy_config.dig("logging", "request_headers") || DEFAULT_LOG_REQUEST_HEADERS,
+      "log-response-header": proxy_config.dig("logging", "response_headers"),
+      "error-pages": error_pages
+    }.compact
+
+    if load_balancing?
+      opts.delete(:host)
+      opts.delete(:tls)
+    end
+
+    opts
+  end
+
+  def deploy_command_args(target:)
+    optionize ({ target: "#{target}:#{app_port}" }).merge(deploy_options), with: "="
+  end
+
+  def stop_options(drain_timeout: nil, message: nil)
+    {
+      "drain-timeout": seconds_duration(drain_timeout),
+      message: message
+    }.compact
+  end
+
+  def stop_command_args(**options)
+    optionize stop_options(**options), with: "="
+  end
+
+  def merge(other)
+    self.class.new config: config, proxy_config: other.proxy_config.deep_merge(proxy_config), role_name: role_name, secrets: secrets
+  end
+
+  private
+    def tls_path(directory, filename)
+      File.join([ directory, role_name, filename ].compact) if custom_ssl_certificate?
+    end
+
+    def seconds_duration(value)
+      value ? "#{value}s" : nil
+    end
+
+    def error_pages
+      File.join config.proxy_boot.error_pages_container_directory, config.version if config.error_pages_path
+    end
+end

data/lib/kamal/configuration/registry.rb

@@ -0,0 +1,40 @@
+class Kamal::Configuration::Registry
+  include Kamal::Configuration::Validation
+
+  def initialize(config:, secrets:, context: "registry")
+    @registry_config = config["registry"] || {}
+    @secrets = secrets
+    validate! registry_config, context: context, with: Kamal::Configuration::Validator::Registry
+  end
+
+  def server
+    registry_config["server"]
+  end
+
+  def username
+    lookup("username")
+  end
+
+  def password
+    lookup("password")
+  end
+
+  def local?
+    server.to_s.match?("^localhost[:$]")
+  end
+
+  def local_port
+    local? ? (server.split(":").last.to_i || 80) : nil
+  end
+
+  private
+    attr_reader :registry_config, :secrets
+
+    def lookup(key)
+      if registry_config[key].is_a?(Array)
+        secrets[registry_config[key].first]
+      else
+        registry_config[key]
+      end
+    end
+end

data/lib/kamal/configuration/role.rb

@@ -0,0 +1,247 @@
+class Kamal::Configuration::Role
+  include Kamal::Configuration::Validation
+
+  delegate :argumentize, :optionize, to: Kamal::Utils
+
+  attr_reader :name, :config, :specialized_env, :specialized_logging, :specialized_proxy
+
+  alias to_s name
+
+  def initialize(name, config:)
+    @name, @config = name.inquiry, config
+    validate! \
+      role_config,
+      example: validation_yml["servers"]["workers"],
+      context: "servers/#{name}",
+      with: Kamal::Configuration::Validator::Role
+
+    @specialized_env = Kamal::Configuration::Env.new \
+      config: specializations.fetch("env", {}),
+      secrets: config.secrets,
+      context: "servers/#{name}/env"
+
+    @specialized_logging = Kamal::Configuration::Logging.new \
+      logging_config: specializations.fetch("logging", {}),
+      context: "servers/#{name}/logging"
+
+    initialize_specialized_proxy
+  end
+
+  def primary_host
+    hosts.first
+  end
+
+  def hosts
+    tagged_hosts.keys
+  end
+
+  def env_tags(host)
+    tagged_hosts.fetch(host).collect { |tag| config.env_tag(tag) }.compact
+  end
+
+  def cmd
+    specializations["cmd"]
+  end
+
+  def option_args
+    optionize docker_options.reject { |key, _| key.to_s == "restart" }
+  end
+
+  def restart_policy
+    restart_policy_option || "unless-stopped"
+  end
+
+  def labels
+    default_labels.merge(custom_labels)
+  end
+
+  def label_args
+    argumentize "--label", labels
+  end
+
+  def logging_args
+    logging.args
+  end
+
+  def logging
+    @logging ||= config.logging.merge(specialized_logging)
+  end
+
+  def proxy
+    @proxy ||= specialized_proxy.merge(config.proxy) if running_proxy?
+  end
+
+  def running_proxy?
+    @running_proxy
+  end
+
+  def ssl?
+    running_proxy? && proxy.ssl?
+  end
+
+  def stop_args
+    # When deploying with the proxy, kamal-proxy will drain request before returning so we don't need to wait.
+    timeout = stop_timeout || (running_proxy? ? nil : config.drain_timeout)
+
+    [ *argumentize("-t", timeout) ]
+  end
+
+  def stop_timeout
+    specializations["stop_timeout"] || config.stop_timeout
+  end
+
+  def env(host)
+    @envs ||= {}
+    @envs[host] ||= [ config.env, specialized_env, *env_tags(host).map(&:env) ].reduce(:merge)
+  end
+
+  def env_args(host)
+    [ *env(host).clear_args, *argumentize("--env-file", secrets_path) ]
+  end
+
+  def env_directory
+    File.join(config.env_directory, "roles")
+  end
+
+  def secrets_io(host)
+    env(host).secrets_io
+  end
+
+  def secrets_path
+    File.join(config.env_directory, "roles", "#{name}.env")
+  end
+
+  def asset_volume_args
+    asset_volume&.docker_args
+  end
+
+
+  def primary?
+    name == @config.primary_role_name
+  end
+
+
+  def container_name(version = nil)
+    [ container_prefix, version || config.version ].compact.join("-")
+  end
+
+  def container_prefix
+    [ config.service, name, config.destination ].compact.join("-")
+  end
+
+
+  def asset_path
+    asset_path_config&.dig(0)
+  end
+
+  def assets?
+    asset_path.present? && running_proxy?
+  end
+
+  def asset_volume(version = config.version)
+    if assets?
+      Kamal::Configuration::Volume.new \
+        host_path: asset_volume_directory(version), container_path: asset_path, options: asset_path_options
+    end
+  end
+
+  def asset_path_options
+    asset_path_config&.dig(1)
+  end
+
+  def asset_extracted_directory(version = config.version)
+    File.join config.assets_directory, "extracted", [ name, version ].join("-")
+  end
+
+  def asset_volume_directory(version = config.version)
+    File.join config.assets_directory, "volumes", [ name, version ].join("-")
+  end
+
+  def ensure_one_host_for_ssl
+    # Skip SSL validation when a loadbalancer is present or custom certificates are provided
+    if running_proxy? && proxy.ssl? && hosts.size > 1 && !proxy.loadbalancer.present? && !proxy.custom_ssl_certificate?
+      raise Kamal::ConfigurationError, "SSL is only supported on a single server unless you provide custom certificates or configure a loadbalancer, found #{hosts.size} servers for role #{name}"
+    end
+  end
+
+  private
+    def initialize_specialized_proxy
+      proxy_specializations = specializations["proxy"]
+
+      if primary?
+        # only false means no proxy for non-primary roles
+        @running_proxy = proxy_specializations != false
+      else
+        # false and nil both mean no proxy for non-primary roles
+        @running_proxy = !!proxy_specializations
+      end
+
+      if running_proxy?
+        proxy_config = proxy_specializations == true || proxy_specializations.nil? ? {} : proxy_specializations
+
+        @specialized_proxy = Kamal::Configuration::Proxy.new \
+          config: config,
+          proxy_config: proxy_config,
+          secrets: config.secrets,
+          role_name: name,
+          context: "servers/#{name}/proxy"
+      end
+    end
+
+    def tagged_hosts
+      {}.tap do |tagged_hosts|
+        extract_hosts_from_config.map do |host_config|
+          if host_config.is_a?(Hash)
+            host, tags = host_config.first
+            tagged_hosts[host] = Array(tags)
+          elsif host_config.is_a?(String)
+            tagged_hosts[host_config] = []
+          end
+        end
+      end
+    end
+
+    def extract_hosts_from_config
+      if config.raw_config.servers.is_a?(Array)
+        config.raw_config.servers
+      else
+        servers = config.raw_config.servers[name]
+        servers.is_a?(Array) ? servers : Array(servers["hosts"])
+      end
+    end
+
+    def default_labels
+      { "service" => config.service, "role" => name, "destination" => config.destination }
+    end
+
+    def specializations
+      @specializations ||= role_config.is_a?(Array) ? {} : role_config
+    end
+
+    def role_config
+      @role_config ||= config.raw_config.servers.is_a?(Array) ? {} : config.raw_config.servers[name]
+    end
+
+    def docker_options
+      specializations["options"] || {}
+    end
+
+    def restart_policy_option
+      docker_options.find { |key, _| key.to_s == "restart" }&.last
+    end
+
+    def custom_labels
+      Hash.new.tap do |labels|
+        labels.merge!(config.labels) if config.labels.present?
+        labels.merge!(specializations["labels"]) if specializations["labels"].present?
+      end
+    end
+
+    def asset_path_config
+      raw_path = specializations["asset_path"] || config.asset_path
+      return nil unless raw_path.present?
+
+      parts = raw_path.split(":", 2)
+      [ parts[0], parts[1] ]
+    end
+end

data/lib/kamal/configuration/servers.rb

@@ -0,0 +1,25 @@
+class Kamal::Configuration::Servers
+  include Kamal::Configuration::Validation
+
+  attr_reader :config, :servers_config, :roles
+
+  def initialize(config:)
+    @config = config
+    @servers_config = config.raw_config.servers
+    validate! servers_config, with: Kamal::Configuration::Validator::Servers
+
+    @roles = role_names.map { |role_name| Kamal::Configuration::Role.new role_name, config: config }
+  end
+
+  private
+    def role_names
+      case servers_config
+      when Array
+        [ "web" ]
+      when NilClass
+        []
+      else
+        servers_config.keys.sort
+      end
+    end
+end

data/lib/kamal/configuration/ssh.rb

@@ -0,0 +1,76 @@
+class Kamal::Configuration::Ssh
+  LOGGER = ::Logger.new(STDERR)
+
+  include Kamal::Configuration::Validation
+
+  attr_reader :ssh_config, :secrets
+
+  def initialize(config:)
+    @ssh_config = config.raw_config.ssh || {}
+    @secrets = config.secrets
+    validate! ssh_config
+  end
+
+  def user
+    ssh_config.fetch("user", "root")
+  end
+
+  def port
+    ssh_config.fetch("port", 22)
+  end
+
+  def proxy
+    if (proxy = ssh_config["proxy"])
+      Net::SSH::Proxy::Jump.new(proxy.include?("@") ? proxy : "root@#{proxy}")
+    elsif (proxy_command = ssh_config["proxy_command"])
+      Net::SSH::Proxy::Command.new(proxy_command)
+    end
+  end
+
+  def keys_only
+    ssh_config["keys_only"]
+  end
+
+  def keys
+    ssh_config["keys"]
+  end
+
+  def key_data
+    key_data = ssh_config["key_data"]
+    return unless key_data
+
+    key_data.map do |k|
+      if secrets.key?(k)
+        secrets[k]
+      else
+        warn "Inline key_data usage is deprecated and will be removed in Kamal 3. Please store your key_data in a secret."
+        k
+      end
+    end
+  end
+
+  def config
+    ssh_config["config"]
+  end
+
+  def forward_agent
+    ssh_config["forward_agent"]
+  end
+
+  def options
+    { user: user, port: port, proxy: proxy, logger: logger, keepalive: true, keepalive_interval: 30, keys_only: keys_only, keys: keys, key_data: key_data, config: config, forward_agent: forward_agent }.compact
+  end
+
+  def to_h
+    options.except(:logger).merge(log_level: log_level)
+  end
+
+  private
+    def logger
+      LOGGER.tap { |logger| logger.level = log_level }
+    end
+
+    def log_level
+      ssh_config.fetch("log_level", :fatal)
+    end
+end

data/lib/kamal/configuration/sshkit.rb

@@ -0,0 +1,26 @@
+class Kamal::Configuration::Sshkit
+  include Kamal::Configuration::Validation
+
+  attr_reader :sshkit_config
+
+  def initialize(config:)
+    @sshkit_config = config.raw_config.sshkit || {}
+    validate! sshkit_config
+  end
+
+  def max_concurrent_starts
+    sshkit_config.fetch("max_concurrent_starts", 30)
+  end
+
+  def pool_idle_timeout
+    sshkit_config.fetch("pool_idle_timeout", 900)
+  end
+
+  def dns_retries
+    Integer(sshkit_config.fetch("dns_retries", 3))
+  end
+
+  def to_h
+    sshkit_config
+  end
+end

data/lib/kamal/configuration/validation.rb

@@ -0,0 +1,27 @@
+require "yaml"
+require "active_support/inflector"
+
+module Kamal::Configuration::Validation
+  extend ActiveSupport::Concern
+
+  class_methods do
+    def validation_doc
+      @validation_doc ||= File.read(File.join(File.dirname(__FILE__), "docs", "#{validation_config_key}.yml"))
+    end
+
+    def validation_config_key
+      @validation_config_key ||= name.demodulize.underscore
+    end
+  end
+
+  def validate!(config, example: nil, context: nil, with: Kamal::Configuration::Validator)
+    context ||= self.class.validation_config_key
+    example ||= validation_yml[self.class.validation_config_key]
+
+    with.new(config, example: example, context: context).validate!
+  end
+
+  def validation_yml
+    @validation_yml ||= YAML.load(self.class.validation_doc)
+  end
+end

data/lib/kamal/configuration/validator/accessory.rb

@@ -0,0 +1,13 @@
+class Kamal::Configuration::Validator::Accessory < Kamal::Configuration::Validator
+  def validate!
+    super
+
+    if (config.keys & [ "host", "hosts", "role", "roles", "tag", "tags" ]).size != 1
+      error "specify one of `host`, `hosts`, `role`, `roles`, `tag` or `tags`"
+    end
+
+    validate_labels!(config["labels"])
+
+    validate_docker_options!(config["options"])
+  end
+end

data/lib/kamal/configuration/validator/alias.rb

@@ -0,0 +1,15 @@
+class Kamal::Configuration::Validator::Alias < Kamal::Configuration::Validator
+  def validate!
+    super
+
+    name = context.delete_prefix("aliases/")
+
+    if name !~ /\A[a-z0-9_-]+\z/
+      error "Invalid alias name: '#{name}'. Must only contain lowercase letters, alphanumeric, hyphens and underscores."
+    end
+
+    if Kamal::Cli::Main.commands.include?(name)
+      error "Alias '#{name}' conflicts with a built-in command."
+    end
+  end
+end

data/lib/kamal/configuration/validator/builder.rb

@@ -0,0 +1,15 @@
+class Kamal::Configuration::Validator::Builder < Kamal::Configuration::Validator
+  def validate!
+    super
+
+    if config["cache"] && config["cache"]["type"]
+      error "Invalid cache type: #{config["cache"]["type"]}" unless [ "gha", "registry" ].include?(config["cache"]["type"])
+    end
+
+    error "Builder arch not set" unless config["arch"].present?
+
+    error "buildpacks only support building for one arch" if config["pack"] && config["arch"].is_a?(Array) && config["arch"].size > 1
+
+    error "Cannot disable local builds, no remote is set" if config["local"] == false && config["remote"].blank?
+  end
+end

data/lib/kamal/configuration/validator/configuration.rb

@@ -0,0 +1,6 @@
+class Kamal::Configuration::Validator::Configuration < Kamal::Configuration::Validator
+  private
+    def allow_extensions?
+      true
+    end
+end