empeira 0.1.0.pre.alpha.3 → 0.1.0.pre.alpha.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c856b6d473f798e1882b261f6dec67a20ebaa89142a073ba9b977265cd24cd6f
-  data.tar.gz: ac23a47ef8ecf4abfdd8d48557cee762f5954e69c40c335b12e7d6428e376709
+  metadata.gz: 4e4e7094658b9e3d8f4ee0edbafa3e4e45be28921900cce8eb4af7d66096cee6
+  data.tar.gz: 7f062dc35a9cef14ad52f55362beba6c4a5a0ab1b57225ce27a191123dc01fc9
 SHA512:
-  metadata.gz: 30b50d1c33a73512fdd2067064e0f17b63dda84204045b90994137ec79ee8374c466501b232119ea2fff3b81f9dda39c62edd8fed47b5ee50a528f75f063dbf6
-  data.tar.gz: 8daa8af9f4f9bb5ffcc1751cf3c8714e6853142dd59878ba6791150b79511549b626cc3edd9eafc95e36adfed3b00f793e8f97d78a607ac6d29dd70865e91dc4
+  metadata.gz: 8410139aeffa1ccaab90f3ddac57a809a86420e385f1354f801f8181c936ecf5653762cc4dbade0178d6df99b2dad1cc8b68cb8d537013132ec09e2ed65aefa1
+  data.tar.gz: 52ba2b37546bc90263d9834193b5080440e2a66425c9f9403b19800e791bf5f26b895d4c4e1af4bc218951b3a0e433437c07c550f493f4577e4e8dfd156a06bb

data/README.md

@@ -6,7 +6,7 @@
 [![OpenVox E2E](https://img.shields.io/github/actions/workflow/status/c8m6/empeira/openvox.yml?branch=main&label=OpenVox%20E2E)](https://github.com/c8m6/empeira/actions/workflows/openvox.yml)
 [![Release](https://img.shields.io/github/v/release/c8m6/empeira?include_prereleases&sort=date&label=Release)](https://github.com/c8m6/empeira/releases)
 [![Ruby: 3.1–4.0](https://img.shields.io/badge/Ruby-3.1%20%7C%203.2%20%7C%203.3%20%7C%203.4%20%7C%204.0-CC342D)](docs/installation.md)
-[![License: AGPL-3.0-only](https://img.shields.io/badge/License-AGPL--3.0--only-blue)](LICENSE)
+[![License: AGPL-3.0-or-later](https://img.shields.io/badge/License-AGPL--3.0--or--later-blue)](LICENSE)
 
 **ἐμπειρία (empeiría)** — experience gained through practice. The name reflects
 learning about infrastructure by experimenting, testing and seeing what happens.
@@ -149,6 +149,6 @@ and [pull requests](https://github.com/c8m6/empeira/pulls) are welcome. Follow t
 [security policy](SECURITY.md).
 
 Project-owned code and documentation are licensed under
-[AGPL-3.0-only](LICENSE). Third-party packages and images retain their own licenses
+[AGPL-3.0-or-later](LICENSE). Third-party packages and images retain their own licenses
 and notices and are obtained from upstream; empeira does not bundle them or
 redistribute proprietary Puppet Enterprise software.

data/docs/architecture.md

@@ -184,9 +184,12 @@ there are no implicit database-major migrations or automatic node replacements.
 
 Managed servers disable environment caching through native Puppet configuration
 (`environment_timeout = 0` in `[server]`), applied by the startup wrapper before
-the configured image entrypoint. `up` checks the actual native setting and restarts
-only a server whose setting changed; it preserves every other configuration key
-and retained storage. The configured Puppet confdir must agree with Puppetserver
+the configured image entrypoint. An independent `environment.conf` copy in the
+managed environment enforces zero even when the control repository specifies
+`unlimited`; the original remains unchanged and read-only. `up` refreshes the copy,
+checks both native and selected-environment settings, and restarts only a server
+whose native setting changed. It preserves every other configuration key and
+retained storage. The configured Puppet confdir must agree with Puppetserver
 HOCON `master-conf-dir`. Catalog
 requests reload live code without repository hashes or environment-cache checkpoints.
 See [nodes](nodes.md#environment-cache-and-live-code).

data/docs/configuration.md

@@ -404,20 +404,25 @@ runtime values without inferring them from the image name. Missing or unsafe
 runtime fields fail configuration validation. Managed servers use
 `environment_timeout = 0` in the native `[server]` section. The startup wrapper
 uses `puppet config set` before the configured entrypoint, independently of image
-environment-variable mappings. Startup and `up` read Puppet's native server
-settings without selecting an environment override, against the
-confdir containing `server.runtime.paths.puppetdb_config`; custom Puppetserver
+environment-variable mappings. Empeira also prepares an independent copy of the
+project's `environment.conf` in its managed environment directory, replacing or
+adding only `environment_timeout = 0`. Other settings, including `modulepath` and
+`config_version`, are preserved. The original file and the control repository
+remain read-only in the server. The copy is refreshed during `up`, including when
+the project has no `environment.conf` or Hiera mounts.
+
+`up` verifies both the native server setting and the effective timeout for
+`server.environment`, against the confdir containing
+`server.runtime.paths.puppetdb_config`; custom Puppetserver
 `jruby-puppet.master-conf-dir` must refer to that same directory. Puppetserver
-HOCON master directories take precedence over Puppet CLI defaults. A changed
-effective timeout updates only that key and restarts the same owned server; an
+HOCON master directories take precedence over Puppet CLI defaults. Native setting
+drift updates only that key and restarts the same owned server; an
 entrypoint that overwrites it fails verification. CA, SSL and database storage
 are preserved. The next catalog request reloads live code without
-an Empeira content scan or admin API invalidation. An explicit `environment.conf`
-can override this server setting; keep its timeout at zero for immediate edits.
-Such overrides are preserved and do not prevent server startup or cause repeated
-restarts. `puppet config print environment_timeout --section server` includes the
-selected environment's override, so it can report `unlimited` while the native
-server setting is zero. Inspect both configuration layers when diagnosing caching.
+an Empeira content scan or admin API invalidation. A project timeout of `unlimited`
+therefore stays unchanged in the checkout while the managed server uses zero.
+To verify it, run `puppet config print environment_timeout --section server
+--environment ENVIRONMENT` inside the server with the configured environment name.
 
 `puppetdb.runtime` holds the independent OpenVoxDB process contract. Custom
 images may override its executable, numeric user, Java and main arguments,

data/docs/development.md

@@ -253,6 +253,7 @@ The APT authentication regression uses a local HTTPS repository with synthetic B
 credentials and an ephemeral GPG signing key. It checks the helper's effective
 `auth.conf.d` configuration, private file mode and exact credential bytes, then
 verifies metadata returns 401 before one interactive login and 200 after the retry.
+The fixture omits the 401 reason phrase to exercise APT's bare status/IP diagnostic.
 The selected package download must reuse that login and pass its SHA-256 check.
 It requires host `gpg`/`gpgconf` and a locally reachable container engine; helper and
 host TLS verification remain enabled. Run it explicitly for either engine:
@@ -511,9 +512,10 @@ Run `EMPEIRA_INTEGRATION=server-environment bundle exec rspec spec/integration/s
 to check native timeout 0, live edits, CA retention, PuppetDB and idempotent up
 under Docker/rootless Podman with the default server and a custom entrypoint
 that ignores timeout environment mapping.
-The same gate verifies startup and idempotent `up` with an explicit
-`environment.conf` timeout override, preserving the file and distinguishing its
-effective value from the native server setting.
+The same gate verifies that an explicit `environment.conf` timeout of `unlimited`
+is zero in the managed copy while the original stays unchanged. It edits a Ruby
+Puppet function between catalogs and checks the changed result without `up` or a
+restart, followed by an idempotent `up`.
 
 Run the isolated diagnostics/recovery gate with each native runtime:
 

data/docs/hiera-and-eyaml.md

@@ -105,7 +105,8 @@ An optional mount is not permission to ignore unsafe configuration.
 Puppet's [default modulepath](https://help.puppet.com/core/current/Content/PuppetCore/config_file_environment.htm)
 includes the environment's `modules` directory. Empeira checks explicit
 `environment.conf` modulepaths and reports a known exclusion before startup. It
-never rewrites that file. Expressions containing unresolved Puppet variables cannot
+never rewrites the original file. Its managed copy changes only
+`environment_timeout` to zero. Expressions containing unresolved Puppet variables cannot
 be verified completely from the CLI host; ensure the effective server modulepath
 includes the mount destination. Environment mounts can be referenced by ordinary
 relative paths in `hiera.yaml`, such as `data/external` or `external` when the datadir
@@ -117,7 +118,8 @@ an image rebuild, `up`, or a service restart.
 Empeira neither copies their data nor writes probe files into them. It uses a managed
 environment directory containing links to the read-only control repository so nested
 mount targets can exist without modifying control code. Existing control files and
-linked directories remain live. `up` refreshes links for new control entries under
+linked directories remain live; `environment.conf` is an independent copy refreshed
+by `up`. `up` also refreshes links for new top-level control entries and entries under
 projected ancestor directories. EYAML keys remain configured separately in `eyaml`,
 and decryption runs on the server.
 

data/docs/nodes.md

@@ -87,18 +87,22 @@ Managed servers enforce native `[server] environment_timeout = 0` before startup
 and verify the effective setting during `up`, independently of image environment
 variable support. Existing workspaces adopt it on
 their next `up`; run that once after updating from a version that enabled caching.
+Adopting the managed environment copy changes the server mount and recreates its
+container once, retaining CA, SSL and database storage.
 Each catalog request reloads live control code, modules and mounted Hiera data.
 Empeira does not hash these trees,
 persist content checkpoints or call the environment-cache admin API. Code edits
 need neither `up` nor a server restart, including for agents invoked manually.
 Empeira does not enable `use_cached_catalog`.
 
-A repository's own `environment.conf` can override the server timeout; use zero
-for immediate edits. Avoid concurrent edits during a catalog run. Existing files
-and directories in projected environments stay live through read-only links.
-New siblings under ancestors projected for nested Hiera mounts require `up` to
-create their links. `node start` resumes the node without invoking Puppet; Puppet
-services enabled by a catalog may run independently on startup.
+Empeira copies `environment.conf` into its managed environment and sets its timeout
+to zero there, preserving all other settings and the original file. Run `up` to
+refresh this copy after editing other environment settings. Avoid concurrent edits
+during a catalog run. Existing files and directories stay live through read-only
+links. New top-level entries and new siblings under ancestors projected for nested
+Hiera mounts require `up` to create their links. `node start` resumes the node
+without invoking Puppet; Puppet services enabled by a catalog may run independently
+on startup.
 
 ## Distribution package sources
 

data/docs/troubleshooting.md

@@ -33,6 +33,14 @@ HTTP 403 does not trigger login, and HTTP 407 identifies proxy authentication. R
 authentication continues to use native `docker login` / `podman login` and the reported
 registry host; Empeira does not log into registries automatically.
 
+APT can report an HTTP status without a reason phrase, for example
+`401 [IP: 192.0.2.1 443]`. This still triggers the single repository login attempt
+when no ENV credentials are set and both standard input and standard error are
+connected to a TTY. The corresponding `403` and `407` forms retain their access-denied
+and proxy-authentication diagnoses without prompting. A node retained as `incomplete`
+after an acquisition failure must be destroyed with `empeira node destroy HOSTNAME`
+and recreated with the original `empeira node run` arguments after resolving the cause.
+
 APT helper credentials use literal `login` and `password` tokens in a temporary
 0600 file under `/etc/apt/auth.conf.d`. APT treats surrounding quotes and added
 backslashes as credential bytes, so Empeira does not add them. A successful login
@@ -140,11 +148,14 @@ problem. A successful probe with different directory listings indicates a
 different engine view of the source. Empeira does not weaken mount checks or
 change host permissions automatically.
 
-An explicit `environment_timeout` in the project's `environment.conf` overrides
-the native server setting. Empeira preserves it. Bare `puppet config print`
-includes that override; server startup and reconciliation verify only the native
-server value. Set the environment override to zero or remove it when immediate
-code reloads are required. No explicit cache invalidation is performed.
+Empeira enforces `environment_timeout = 0` in both the native server setting and
+its independent copy of `environment.conf`. The project's original file remains
+unchanged, even when it specifies `unlimited`. Run `up` after updating Empeira or
+editing other settings in `environment.conf` to refresh the managed copy. Inside
+the server, `puppet config print environment_timeout --section server --environment
+ENVIRONMENT` must report `0` for the configured environment. A different value
+fails startup verification; check the custom server's confdir and environmentpath.
+No explicit cache invalidation is performed.
 
 `config show` includes `effective_hiera_mounts`. A skipped optional source is
 reported during `up`; mount it locally or correct the source path, then run `up`

data/lib/empeira/agent/native_commands.rb

@@ -39,11 +39,11 @@ module Empeira
         diagnostic = Execution::Diagnostics.native(result.with(stderr: text, stdout: ''),
                                                    operation: "Agent #{operation}", tool: arguments.first)
         case text
-        when /407\s+Proxy Authentication Required|(?:HTTP|Status code|HTTP code)\s*:?\s*407\b/i
+        when /407\s+Proxy Authentication Required|(?:HTTP|Status code|HTTP code)\s*:?\s*407\b|\b407[ \t]+\[IP:/i
           raise Error, "Host helper proxy authentication failed\n#{diagnostic}", cause: nil
-        when /401\s+Unauthorized|(?:HTTP|Status code|HTTP code)\s*:?\s*401\b/i
+        when /401\s+Unauthorized|(?:HTTP|Status code|HTTP code)\s*:?\s*401\b|\b401[ \t]+\[IP:/i
           raise Agent::AuthenticationRequired, diagnostic, cause: nil
-        when /403\s+Forbidden|(?:HTTP|Status code|HTTP code)\s*:?\s*403\b/i
+        when /403\s+Forbidden|(?:HTTP|Status code|HTTP code)\s*:?\s*403\b|\b403[ \t]+\[IP:/i
           raise Error, "Agent repository access denied\n#{diagnostic}", cause: nil
         end
         raise Error, "Agent #{operation} failed\n#{diagnostic}", cause: nil

data/lib/empeira/build.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.1.0-alpha.3",
-  "revision": "bfada39f711fd74dae3f061f80e1c5293bd13eec",
-  "build_time": "2026-10-15T13:10:56Z"
+  "version": "0.1.0-alpha.4",
+  "revision": "b073c6a15db14c4dace4a732703240f4289cbb48",
+  "build_time": "2026-10-21T11:41:02Z"
 }

data/lib/empeira/control_plane/controller.rb

@@ -350,10 +350,11 @@ module Empeira
 
       def reconcile_server_environment
         environment = Server::EnvironmentConfiguration.new(runtime: @runtime, plan: @plan)
-        return unless environment.reconcile(@observed.fetch('server'))
+        if environment.reconcile(@observed.fetch('server'))
+          @changed = true
+          @health.wait('server', @observed)
+        end
 
-        @changed = true
-        @health.wait('server', @observed)
         environment.verify!(@observed.fetch('server'))
       end
 

data/lib/empeira/control_plane/environment.rb

@@ -9,7 +9,7 @@ module Empeira
       def initialize(context:, hiera:)
         @project = context.project.path
         @root = root(context)
-        @targets = mount_targets(hiera)
+        @targets = ['environment.conf', *mount_targets(hiera)]
         @modules = Modules::Storage.new(context: context).root if @project.join('Puppetfile').file?
         @targets |= ['modules'] if @modules
         @base = context.locations.workspace(context.workspace).join('environments')
@@ -17,14 +17,11 @@ module Empeira
       end
 
       def mounts
-        return [bind(@project, @root)] if @targets.empty?
-
         [bind(@project, CONTROL), bind(@directory, @root),
          *(@modules ? [bind(@modules, "#{@root}/modules")] : [])]
       end
 
       def prepare
-        return if @targets.empty?
         raise Error, 'Managed environment directory must not be a symlink' if @directory.symlink?
 
         FileUtils.mkdir_p(@directory, mode: 0o755)
@@ -81,13 +78,36 @@ module Empeira
       end
 
       def create_entry(relative, destination)
-        if @targets.any? { |target| target == relative || target.start_with?("#{relative}/") }
+        if relative == 'environment.conf'
+          prepare_configuration(destination)
+        elsif @targets.any? { |target| target == relative || target.start_with?("#{relative}/") }
           create_target(relative, destination)
         else
           create_link(relative, destination)
         end
       end
 
+      def prepare_configuration(destination)
+        content = environment_configuration
+        return if !destination.symlink? && destination.file? && destination.binread == content
+
+        Tempfile.create('environment-', @directory) do |file|
+          file.chmod(0o644)
+          file.write(content)
+          file.flush
+          File.rename(file.path, destination)
+        end
+      end
+
+      def environment_configuration
+        source = @project.join('environment.conf')
+        content = source.exist? ? source.binread : ''
+        content = content.gsub(/^[ \t]*environment_timeout[ \t]*=[^\r\n]*/, 'environment_timeout = 0')
+        content += "\n" unless content.empty? || content.end_with?("\n")
+        content += "environment_timeout = 0\n" unless content.match?(/^environment_timeout = 0\r?$/)
+        content
+      end
+
       def create_target(relative, destination)
         raise Error, 'Managed environment destination is unsafe' if destination.symlink?
 

data/lib/empeira/server/environment_configuration.rb

@@ -24,10 +24,10 @@ module Empeira
       end
 
       def verify!(resource)
-        return if current(resource) == '0'
+        return if current(resource) == '0' && effective(resource) == '0'
 
         raise Error, 'Puppetserver environment_timeout is not 0 after startup; the custom entrypoint or ' \
-                     'server confdir overrides the managed setting; inspect the server runtime contract'
+                     'server confdir/environment overrides the managed setting; inspect the server runtime contract'
       end
 
       private
@@ -36,6 +36,12 @@ module Empeira
         execute(resource, [ControlPlane::Health::RUBY, READER, '--confdir', confdir]).stdout.strip
       end
 
+      def effective(resource)
+        arguments = [PUPPET, 'config', 'print', 'environment_timeout', '--section', 'server',
+                     '--confdir', confdir, '--environment', @plan.config.dig('server', 'environment')]
+        execute(resource, arguments).stdout.strip
+      end
+
       def execute(resource, arguments)
         result = @runtime.service_exec(resource, arguments)
         return result if result.success?

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: empeira
 version: !ruby/object:Gem::Version
-  version: 0.1.0.pre.alpha.3
+  version: 0.1.0.pre.alpha.4
 platform: ruby
 authors:
 - Christian Meißner (c8m6)
@@ -304,7 +304,7 @@ files:
 - resources/relay/server_start.sh
 homepage: https://github.com/c8m6/empeira
 licenses:
-- AGPL-3.0-only
+- AGPL-3.0-or-later
 metadata:
   rubygems_mfa_required: 'true'
 rdoc_options: []