empeira 0.1.0.pre.alpha.1

data/lib/empeira/configuration/agent_values.rb

@@ -0,0 +1,54 @@
+# frozen_string_literal: true
+
+module Empeira
+  module Configuration
+    # Scalar validation shared by fragments and resolved agent sources.
+    module AgentValues
+      def required!(data, keys, path)
+        keys.each { |key| raise ConfigurationError, "#{path}.#{key} is required" unless data.key?(key) }
+      end
+
+      def package_token!(value, path)
+        return if value.is_a?(String) && value.match?(/\A[a-zA-Z0-9][a-zA-Z0-9_.+-]*\z/)
+
+        raise ConfigurationError, "#{path} must be a package name"
+      end
+
+      def token!(value, path)
+        return if value.is_a?(String) && value.match?(/\A[a-zA-Z0-9][a-zA-Z0-9_.+:~-]*\z/)
+
+        raise ConfigurationError, "#{path} must be a package/version token"
+      end
+
+      def suffix!(value, path)
+        return if value.is_a?(String) && value.match?(/\A[-+a-zA-Z0-9.]+\z/)
+
+        raise ConfigurationError, "#{path} is invalid"
+      end
+
+      def digest!(value, path)
+        return if value.is_a?(String) && value.match?(/\A[a-f0-9]{64}\z/)
+
+        raise ConfigurationError, "#{path} must be a SHA-256 digest"
+      end
+
+      def boolean!(value, path)
+        raise ConfigurationError, "#{path} must be boolean" unless [true, false].include?(value)
+      end
+
+      def https_url!(value, path)
+        uri = URI(value)
+        return if https_endpoint?(uri) && !value.match?(/[\s\x00-\x1f\x7f]/)
+
+        raise ConfigurationError, "#{path} must be a credential-free HTTPS URL"
+      rescue URI::InvalidURIError, TypeError
+        raise ConfigurationError, "#{path} must be a credential-free HTTPS URL"
+      end
+
+      def https_endpoint?(uri)
+        uri.is_a?(URI::HTTPS) && uri.host && !uri.host.empty? && uri.userinfo.nil? &&
+          uri.query.nil? && uri.fragment.nil?
+      end
+    end
+  end
+end

data/lib/empeira/configuration/bootstrap_guests.rb

@@ -0,0 +1,42 @@
+# frozen_string_literal: true
+
+module Empeira
+  module Configuration
+    module BootstrapGuests
+      def self.validate!(data, path)
+        NodeImages.validate!(data, path) do |versions, os_path|
+          NodeImages.validate!(versions, os_path) do |guest, guest_path|
+            NodeImages.validate!(guest, guest_path) { |value, field| validate_field!(value, field) }
+          end
+        end
+      end
+
+      def self.effective!(data)
+        data.each do |os, versions|
+          versions.each do |version, guest|
+            fields = %w[agent_preinstalled destinations]
+            fields << 'baseurl' if %w[rocky almalinux].include?(os)
+            NodeImages.required!(guest, fields, "bootstrap.guests.#{os}.#{version}")
+          end
+        end
+      end
+
+      def self.destinations?(value)
+        value.is_a?(Array) && value.all? { |domain| Network::ProxyPolicy.valid_domain?(domain) }
+      end
+
+      def self.validate_field!(value, field)
+        key = field.split('.').last
+        valid = case key
+                when 'agent_preinstalled' then [true, false].include?(value)
+                when 'destinations'
+                  destinations?(value)
+                when 'archive', 'security', 'ports', 'baseurl'
+                  value.is_a?(String) && value.match?(%r{\Ahttps?://[a-z0-9./_-]+\z})
+                else false
+                end
+        raise ConfigurationError, "#{field} is invalid or unsupported" unless valid
+      end
+    end
+  end
+end

data/lib/empeira/configuration/command_mocks.rb

@@ -0,0 +1,65 @@
+# frozen_string_literal: true
+
+module Empeira
+  module Configuration
+    class CommandMocks
+      FIELDS = %w[path mock_to exit_code].freeze
+      NAME = /\A[a-zA-Z0-9_][a-zA-Z0-9_.-]*\z/
+
+      def self.validate!(commands, path = 'mocks.commands', effective: false)
+        raise ConfigurationError, "#{path} must be a mapping" unless commands.is_a?(Hash)
+
+        targets = []
+        commands.each do |name, entry|
+          unless name.is_a?(String) && name.match?(NAME)
+            raise ConfigurationError, "#{path} keys must be logical command names"
+          end
+
+          location = "#{path}.#{name}"
+          entry!(entry, location, effective: effective)
+          next unless entry.key?('path')
+
+          target!(entry['path'], location, targets: targets)
+          targets << entry['path']
+        end
+      end
+
+      def self.entry!(entry, path, effective:)
+        unless entry.is_a?(Hash) && (entry.keys - FIELDS).empty?
+          raise ConfigurationError, "#{path} must contain only path, mock_to and exit_code"
+        end
+
+        require_fields!(entry, path) if effective
+        mock_to!(entry['mock_to'], "#{path}.mock_to") if entry.key?('mock_to')
+        exit_code!(entry['exit_code'], "#{path}.exit_code") if entry.key?('exit_code')
+      end
+
+      def self.require_fields!(entry, path)
+        FIELDS.each do |field|
+          raise ConfigurationError, "#{path}.#{field} is required" unless entry.key?(field)
+        end
+      end
+
+      def self.exit_code!(value, path)
+        return if value == 'passthrough' || (value.is_a?(Integer) && value.between?(0, 255))
+
+        raise ConfigurationError, "#{path} must be an integer from 0 to 255 or passthrough"
+      end
+
+      def self.target!(target, path, targets: [])
+        unless ServiceConfiguration.safe_target?(target)
+          raise ConfigurationError, "#{path}.path must be a safe absolute file path without traversal"
+        end
+
+        reserved = ServiceConfiguration::RUNTIME_TARGETS + [Node::ExternalFact::PATH]
+        ServiceConfiguration.validate_targets!(target, reserved + targets, path, field: 'path')
+      end
+
+      def self.mock_to!(value, path)
+        return if value == 'echo' || ServiceConfiguration.safe_target?(value)
+
+        raise ConfigurationError, "#{path} must be echo or a safe absolute executable path"
+      end
+    end
+  end
+end

data/lib/empeira/configuration/display.rb

@@ -0,0 +1,20 @@
+# frozen_string_literal: true
+
+module Empeira
+  module Configuration
+    module Display
+      SENSITIVE = /password|secret|token|credential|authorization|private.?key/i
+
+      module_function
+
+      def redact(value)
+        case value
+        when Hash
+          value.to_h { |key, child| [key, key.to_s.match?(SENSITIVE) ? '[REDACTED]' : redact(child)] }
+        when Array then value.map { |child| redact(child) }
+        else value
+        end
+      end
+    end
+  end
+end

data/lib/empeira/configuration/dns_rewrites.rb

@@ -0,0 +1,58 @@
+# frozen_string_literal: true
+
+module Empeira
+  module Configuration
+    class DNSRewrites
+      def self.normalize(name)
+        name.downcase.delete_suffix('.')
+      end
+
+      def self.entries(config)
+        normalized = config.dig('dns', 'rewrites').map do |entry|
+          entry.transform_values { |name| normalize(name) }
+        end
+        normalized.sort_by { |entry| entry.fetch('from') }
+      end
+
+      def self.validate!(entries, path)
+        raise ConfigurationError, "#{path} must be an array" unless entries.is_a?(Array)
+
+        sources = []
+        entries.each_with_index do |entry, index|
+          location = "#{path}[#{index}]"
+          validate_entry!(entry, location)
+          source = normalize(entry.fetch('from'))
+          raise ConfigurationError, "#{location}.from duplicates another rewrite source" if sources.include?(source)
+
+          sources << source
+        end
+      end
+
+      def self.validate_entry!(entry, path)
+        unless entry.is_a?(Hash) && entry.size == 2 && %w[from to].all? { |key| entry.key?(key) }
+          raise ConfigurationError, "#{path} requires only from and to"
+        end
+
+        %w[from to].each { |key| hostname!(entry.fetch(key), "#{path}.#{key}") }
+        validate_zones!(normalize(entry.fetch('from')), normalize(entry.fetch('to')), path)
+      end
+
+      def self.validate_zones!(source, target, path)
+        if source == Network::Naming::DOMAIN || source.end_with?(".#{Network::Naming::DOMAIN}")
+          raise ConfigurationError, "#{path}.from must be outside empeira.internal; " \
+                                    'self references and cycles are forbidden'
+        end
+        return if target.match?(/\A#{Schema::DNS_LABEL}\.empeira\.internal\z/)
+
+        raise ConfigurationError, "#{path}.to must be an internal service hostname: <service>.empeira.internal"
+      end
+
+      def self.hostname!(name, path)
+        return if name.is_a?(String) && normalize(name).size <= 253 && name.match?(Schema::DNS_NAME) &&
+                  !name.match?(/\A[\d.]+\z/)
+
+        raise ConfigurationError, "#{path} must be an exact DNS hostname without wildcards, URLs or IP addresses"
+      end
+    end
+  end
+end

data/lib/empeira/configuration/document.rb

@@ -0,0 +1,67 @@
+# frozen_string_literal: true
+
+require 'yaml'
+
+module Empeira
+  module Configuration
+    class Document
+      SERVICE_CONTENT = /\Acontainers\.additional\.\d+\.configuration\.content\z/
+
+      def read(path)
+        text = File.read(path)
+        documents = Psych.parse_stream(text).children
+        return {} if documents.empty?
+        raise ConfigurationError, 'configuration must contain exactly one YAML document' unless documents.size == 1
+
+        check_keys!(documents.first.root, [])
+        YAML.safe_load(text, permitted_classes: [], permitted_symbols: [], aliases: false)
+      rescue Psych::Exception
+        raise ConfigurationError, "#{File.basename(path)} must contain valid YAML without aliases or object tags"
+      rescue SystemCallError
+        raise ConfigurationError, "#{File.basename(path)} could not be read"
+      end
+
+      private
+
+      # rubocop:disable-next Metrics/AbcSize -- Recursively check mapping keys, including service arrays.
+      def check_keys!(node, path)
+        check_plain_data!(node, path) if path.join('.').match?(SERVICE_CONTENT)
+        if node.is_a?(Psych::Nodes::Sequence)
+          node.children.each_with_index { |child, index| check_keys!(child, path + [index.to_s]) }
+          return
+        end
+        return unless node.is_a?(Psych::Nodes::Mapping)
+
+        seen = []
+        node.children.each_slice(2) do |key, value|
+          check_key!(key, path)
+
+          child_path = path + [key.value]
+          raise ConfigurationError, "#{location(child_path)} is defined more than once" if seen.include?(key.value)
+
+          seen << key.value
+          check_keys!(value, child_path)
+        end
+      end
+
+      def check_plain_data!(node, path)
+        if node.is_a?(Psych::Nodes::Alias) || node.tag || node.anchor
+          raise ConfigurationError, "#{location(path)} must not contain YAML tags, anchors or aliases"
+        end
+
+        Array(node.children).each { |child| check_plain_data!(child, path) }
+      end
+
+      def check_key!(key, path)
+        raise ConfigurationError, "#{location(path)} contains a non-string key" unless key.is_a?(Psych::Nodes::Scalar)
+        return unless key.value.match?(/[\p{Cc}\p{Cf}]/)
+
+        raise ConfigurationError, "#{location(path)} contains a key with control characters"
+      end
+
+      def location(path)
+        path.empty? ? '$' : path.join('.')
+      end
+    end
+  end
+end

data/lib/empeira/configuration/eyaml.rb

@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+
+module Empeira
+  module Configuration
+    # Resolve paths without reading or copying key material.
+    class Eyaml
+      DESTINATION = '/etc/puppetlabs/puppet/eyaml'
+
+      def initialize(config:, project:)
+        @config = config
+        @project = project
+      end
+
+      def mounts(destination: DESTINATION)
+        return [] unless @config.fetch('enabled')
+
+        %w[private_key public_key].map do |key|
+          source = resolve(key)
+          "type=bind,src=#{source},dst=#{destination}/#{key}.pkcs7.pem,readonly"
+        end
+      end
+
+      private
+
+      def safe_path?(value)
+        value.is_a?(String) && !value.empty? && !value.match?(/[\x00-\x1f,]/)
+      end
+
+      def resolve(key)
+        value = @config[key]
+        unless safe_path?(value)
+          raise ConfigurationError, "eyaml.#{key} must be a safe local file path when eyaml.enabled=true"
+        end
+
+        path = Pathname(value).expand_path(@project).realpath
+        unless path.file? && path.readable? && safe_path?(path.to_s)
+          raise ConfigurationError, "eyaml.#{key} must be a readable regular file with a safe mount path"
+        end
+
+        path
+      rescue SystemCallError, ArgumentError
+        raise ConfigurationError, "eyaml.#{key} must resolve to a readable regular file", cause: nil
+      end
+    end
+  end
+end

data/lib/empeira/configuration/hiera_modulepath.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+module Empeira
+  module Configuration
+    class HieraModulepath
+      def initialize(project:, environment:)
+        @project = project
+        @environment = environment
+      end
+
+      def verify!
+        value = configured_path
+        return unless value
+        return if value.strip.split(':').any? { |path| included_or_unknown?(path) }
+
+        raise ConfigurationError,
+              'hiera.mounts/Puppetfile module destinations are excluded by environment.conf modulepath; ' \
+              'include modules in the environment modulepath'
+      rescue SystemCallError
+        raise ConfigurationError, 'Cannot read environment.conf to verify the modulepath', cause: nil
+      end
+
+      private
+
+      def configured_path
+        file = @project.join('environment.conf')
+        return unless file.exist?
+
+        file.read.lines.filter_map { |line| line.match(/^\s*modulepath\s*=\s*([^#]*)/)&.captures&.first }.last
+      end
+
+      def included_or_unknown?(path)
+        path = path.gsub('$codedir', '/etc/puppetlabs/code').gsub('$environment', @environment)
+        relative = Pathname(path).cleanpath.to_s
+        relative == 'modules' || relative == "/etc/puppetlabs/code/environments/#{@environment}/modules" ||
+          (path.include?('$') && path != '$basemodulepath')
+      end
+    end
+  end
+end

data/lib/empeira/configuration/hiera_mount_schema.rb

@@ -0,0 +1,62 @@
+# frozen_string_literal: true
+
+module Empeira
+  module Configuration
+    class HieraMountSchema
+      FIELDS = %w[source type name target required].freeze
+      NAME = /\A[a-z][a-z0-9_]*\z/
+      PATH = %r{\A[a-zA-Z0-9_.-]+(?:/[a-zA-Z0-9_.-]+)*\z}
+
+      def self.validate!(entries, path = 'hiera.mounts')
+        raise ConfigurationError, "#{path} must be an array of mounts" unless entries.is_a?(Array)
+
+        targets = entries.each_with_index.map do |entry, index|
+          location = "#{path}.#{index}"
+          validate_entry!(entry, location)
+          entry['type'] == 'module' ? "modules/#{entry['name']}" : entry['target']
+        end
+        targets.each_with_index do |target, index|
+          next unless targets.take(index).any? { |other| overlap?(target, other) }
+
+          raise ConfigurationError, "#{path}.#{index} overlaps another mount target"
+        end
+      end
+
+      def self.overlap?(left, right)
+        left == right || left.start_with?("#{right}/") || right.start_with?("#{left}/")
+      end
+
+      def self.safe_source?(value)
+        value.is_a?(String) && !value.empty? && !value.match?(/[\x00-\x1f,]/)
+      end
+
+      def self.safe_target?(value)
+        value.is_a?(String) && value.match?(PATH) && !value.split('/').intersect?(%w[. ..])
+      end
+
+      # Validate every definition even when its optional source is unavailable.
+      # rubocop:disable-next Metrics/AbcSize, Metrics/MethodLength, Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity -- Validate the discriminated public mount shape together.
+      def self.validate_entry!(entry, path)
+        raise ConfigurationError, "#{path} must be a mount mapping" unless entry.is_a?(Hash)
+        raise ConfigurationError, "#{path} contains unsupported fields" unless (entry.keys - FIELDS).empty?
+        raise ConfigurationError, "#{path}.source must be a safe local path" unless safe_source?(entry['source'])
+        unless %w[module environment].include?(entry['type'])
+          raise ConfigurationError, "#{path}.type must be module or environment"
+        end
+        if entry.key?('required') && ![true, false].include?(entry['required'])
+          raise ConfigurationError, "#{path}.required must be a boolean"
+        end
+
+        if entry['type'] == 'module'
+          unless entry['name'].is_a?(String) && entry['name'].match?(NAME) && !entry.key?('target')
+            raise ConfigurationError, "#{path}.name must be a Puppet module name; module mounts do not accept target"
+          end
+        elsif !safe_target?(entry['target']) || entry.key?('name')
+          raise ConfigurationError,
+                "#{path}.target must be a safe environment-relative path; " \
+                'environment mounts do not accept name'
+        end
+      end
+    end
+  end
+end

data/lib/empeira/configuration/hiera_mounts.rb

@@ -0,0 +1,83 @@
+# frozen_string_literal: true
+
+module Empeira
+  module Configuration
+    # Puppet destinations and source availability share one resolution boundary.
+    class HieraMounts
+      attr_reader :entries
+
+      def initialize(config:, project:, environment:)
+        @project = Pathname(project).realpath
+        @environment = environment
+        HieraMountSchema.validate!(config.fetch('mounts'))
+        @entries = config.fetch('mounts').each_with_index.map { |entry, index| resolve(entry, index) }
+        HieraModulepath.new(project: @project, environment: @environment).verify! if entries.any? do |entry|
+          entry['type'] == 'module'
+        end
+      end
+
+      def mounts
+        entries.filter_map do |entry|
+          next unless entry['status'] == 'available'
+
+          "type=bind,src=#{entry['resolved_source']},dst=#{entry['destination']},readonly"
+        end
+      end
+
+      def warnings
+        entries.filter_map do |entry|
+          next if entry['status'] == 'available'
+
+          "Warning: optional Hiera source is unavailable: #{entry['source']}; " \
+            "mount #{entry['destination']} skipped (#{entry['reason']})"
+        end
+      end
+
+      private
+
+      # rubocop:disable-next Metrics/AbcSize, Metrics/MethodLength, Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity -- Classify source availability without suppressing structural errors.
+      def resolve(entry, index)
+        target = entry['type'] == 'module' ? "modules/#{entry['name']}" : entry['target']
+        validate_destination!(target, index)
+        definition = entry.merge('required' => entry.fetch('required', false),
+                                 'destination' => "#{environment_root}/#{target}")
+        source = Pathname(entry['source']).expand_path(@project).realpath
+        unless source.directory? && HieraMountSchema.safe_source?(source.to_s)
+          raise ConfigurationError, "hiera.mounts.#{index}.source must resolve to a directory with a safe mount path"
+        end
+        raise Errno::EACCES unless source.readable? && source.executable?
+
+        definition.merge('resolved_source' => source.to_s, 'status' => 'available')
+      rescue Errno::ENOENT, Errno::EACCES, Errno::EPERM => e
+        if entry['required']
+          raise ConfigurationError, "hiera.mounts.#{index}.source is required but unavailable (#{e.class})",
+                cause: nil
+        end
+
+        definition.merge('status' => 'skipped',
+                         'reason' => e.is_a?(Errno::ENOENT) ? 'missing source' : 'inaccessible source')
+      rescue SystemCallError
+        raise ConfigurationError, "hiera.mounts.#{index}.source cannot be resolved safely", cause: nil
+      end
+
+      def environment_root
+        "/etc/puppetlabs/code/environments/#{@environment}"
+      end
+
+      def validate_destination!(target, index)
+        current = @project
+        target.split('/').each do |part|
+          current = current.join(part)
+          next unless current.exist? || current.symlink?
+
+          resolved = current.realpath
+          unless resolved.directory? && resolved.to_s.start_with?("#{@project}/")
+            raise ConfigurationError, "hiera.mounts.#{index}.target must remain a directory inside the environment"
+          end
+        end
+      rescue SystemCallError
+        raise ConfigurationError, "hiera.mounts.#{index}.target cannot be resolved safely", cause: nil
+      end
+    end
+  end
+end

data/lib/empeira/configuration/image_schema.rb

@@ -0,0 +1,68 @@
+# frozen_string_literal: true
+
+module Empeira
+  module Configuration
+    class ImageSchema
+      PATTERNS = {
+        'repository' => Images::Configuration::REPOSITORY, 'tag' => Images::Configuration::TAG,
+        'digest' => Images::Configuration::DIGEST, 'build' => %r{\A[a-zA-Z0-9_/-]+/Containerfile\z}
+      }.freeze
+
+      def self.validate!(value, path, effective: false)
+        raise ConfigurationError, "#{path} must be an image mapping" unless value.is_a?(Hash)
+
+        value.each do |key, item|
+          raise ConfigurationError, "#{path}.#{key} is invalid or unsupported" unless valid_field?(key, item)
+        end
+        validate_combination!(value, path) if effective || value.key?('reference')
+      end
+
+      def self.valid_field?(key, item)
+        return reference?(item) if key == 'reference'
+
+        item.is_a?(String) && PATTERNS.key?(key) && item.match?(PATTERNS[key])
+      end
+
+      def self.reference?(value)
+        return false unless value.is_a?(String)
+
+        repository, digest = value.split('@', 2)
+        if digest
+          return repository.match?(Images::Configuration::REPOSITORY) && digest.match?(Images::Configuration::DIGEST)
+        end
+
+        repository, _, tag = value.rpartition(':')
+        repository.match?(Images::Configuration::REPOSITORY) && tag.match?(Images::Configuration::TAG)
+      end
+
+      def self.validate_combination!(value, path)
+        return validate_reference!(value, path) if value['reference']
+
+        if value['build']
+          raise ConfigurationError, "#{path}.build cannot be combined with an image reference" if value.keys.size > 1
+
+          return
+        end
+        return if value['repository'] && (value['tag'] || value['digest'])
+
+        raise ConfigurationError, "#{path} requires repository and tag/digest, reference, or build"
+      end
+
+      def self.validate_reference!(value, path)
+        return if value.keys.size == 1
+
+        raise ConfigurationError, "#{path}.reference cannot be combined with repository, tag, digest or build"
+      end
+
+      # Explicit image selections replace inherited pins; a tag alongside an explicit digest is descriptive.
+      def self.override_base(lower, higher)
+        return {} if higher.key?('reference') || higher.key?('build')
+        return lower unless higher.keys.intersect?(%w[repository tag digest])
+
+        value = lower.except('reference', 'build')
+        value.delete('digest') if !higher.key?('digest') && higher.keys.intersect?(%w[repository tag])
+        value
+      end
+    end
+  end
+end

data/lib/empeira/configuration/loader.rb

@@ -0,0 +1,70 @@
+# frozen_string_literal: true
+
+require 'yaml'
+require 'pathname'
+
+module Empeira
+  module Configuration
+    class Loader
+      DEFAULTS = File.expand_path('../../../config/defaults.yaml', __dir__).freeze
+      CLI_PATHS = [%w[runtime container_engine], %w[node_defaults os], %w[node_defaults version],
+                   %w[node_defaults memory], %w[node_defaults cpus]].map(&:freeze).freeze
+
+      attr_reader :ssh_preferences
+
+      def initialize(project_path: Dir.pwd, defaults_path: DEFAULTS, schema: Schema.new,
+                     locations: Platform::Locations.new)
+        @project_path = ProjectRoot.resolve(project_path).path
+        @defaults_path = defaults_path
+        @schema = schema
+        @locations = locations
+        @ssh_preferences = {}.freeze
+      end
+
+      def load(overrides: {})
+        raise ConfigurationError, 'project path must be an existing directory' unless @project_path.directory?
+
+        defaults = read(@defaults_path)
+        project_file = @project_path.join('.empeira.yaml')
+        project = read(project_file)
+        user = User.new(path: @locations.user_configuration, schema: @schema).load
+        @ssh_preferences = Immutable.deep_freeze(user.delete('ssh') || {})
+        validate_overrides!(overrides)
+        effective([project, user, overrides].reduce(defaults) { |lower, higher| Merge.call(lower, higher) })
+      end
+
+      # Recovery operations must not depend on a broken project or user file.
+      def load_defaults(overrides: {})
+        @ssh_preferences = {}.freeze
+        validate_overrides!(overrides)
+        effective(Merge.call(read(@defaults_path), overrides))
+      end
+
+      private
+
+      def effective(data)
+        @schema.validate_effective!(data)
+        HieraMounts.new(config: data.fetch('hiera'), project: @project_path,
+                        environment: data.dig('server', 'environment'))
+        Eyaml.new(config: data.fetch('eyaml'), project: @project_path).mounts
+        ServerMounts.new(entries: data.dig('server', 'mounts'), project: @project_path)
+        data
+      end
+
+      def read(path)
+        data = @schema.validate_fragment!(Document.new.read(path))
+        data.fetch('network', {}).delete('internet')
+        data
+      end
+
+      def validate_overrides!(overrides)
+        @schema.validate_fragment!(overrides)
+        overrides.each do |section, values|
+          unless values.is_a?(Hash) && values.keys.all? { |key| CLI_PATHS.include?([section, key]) }
+            raise ConfigurationError, "#{section} cannot be overridden through the CLI"
+          end
+        end
+      end
+    end
+  end
+end