gemstack 0.4.2 → 0.4.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 470fa3d30b1554cfa0aa75c71518f3ec47807a2f09f634c964720133c3cbe0d8
-  data.tar.gz: 1b11a77cbac038b67fc22c1b746ef2dd8011bf729a3523b7d99bb32857c62ea5
+  metadata.gz: 6310feb0f5388f4664b5d3cc6a628487dae761765a4b8ee8c09c36e3096da3e8
+  data.tar.gz: ae643ed6d28ef9403ccc15b351adb77fddc3cb8e2573ffb27a75dd6207549a2f
 SHA512:
-  metadata.gz: 7f52cbd61e22fc289cc33b7eaa9097ad5b3f8271a5b284599a164bd688547ccbda631268256d78c8f0bee9eb253f3b9b3adc74a86ac085292ffcd6896294f516
-  data.tar.gz: ff4886ab02478e6a1355f47fbe0d072886b49be8c8c33060a06b706137f47836dfe31f2ee52db0335c71de9b82a46f980728b1a9a26e5f0614e01c8dd584b741
+  metadata.gz: d4b0d241f841248a9ffd8e9fa0947e60114299ae8d01e72cee926a48aec24e469fe47ff1dc00f9d75043453e4e90a898c2a728065fcdac1d57a89db596489e1a
+  data.tar.gz: 1c5f793e4228c3182bffb2162bf8d94ff38fc01e1aaea6b9fde397977cfcbf15d1905f1d9f962e7412a052023b8d8102fc39bba98eb92eae4eec1ad6653931b8

data/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 0.4.3
+
+See the [GemStack changelog](https://github.com/gemstack-rb/gemstack/blob/main/CHANGELOG.md).
+
 ## 0.4.2
 
 See the [GemStack changelog](https://github.com/gemstack-rb/gemstack/blob/main/CHANGELOG.md).

data/lib/gemstack/cli/commands/deploy.rb

@@ -0,0 +1,78 @@
+# frozen_string_literal: true
+
+require "open3"
+
+module GemStack
+  class CLI < Thor
+    # `gemstack deploy [KAMAL ARGS]` — Kamal with the app's root .env loaded,
+    # so .kamal/secrets ($SECRET_KEY_BASE, $DATABASE_URL, …) and the frontend's
+    # NEXT_PUBLIC_* build values come from the same file as everything else.
+    # Kamal doesn't read .env itself.
+    class DeployCommand
+      # Production values first; .env.local is left out on purpose: on a
+      # developer's machine it holds development overrides (a local
+      # DATABASE_URL…) that must never reach production.
+      ENV_FILES = %w[.env.production.local .env.production .env].freeze
+      # Kamal builds the image from a clone of the last commit: uncommitted
+      # changes wouldn't be deployed.
+      BUILDS = %w[deploy setup redeploy build].freeze
+
+      def initialize(root:, env: ENV, output: $stderr, exec: ->(*command, **opts) { Kernel.exec(*command, **opts) })
+        @root = root
+        @env = env
+        @output = output
+        @exec = exec
+      end
+
+      def run(args)
+        unless File.file?(File.join(@root, "config/deploy.yml"))
+          raise Thor::Error, "No config/deploy.yml: run `gemstack generate deploy` first (docs/deployment.md)"
+        end
+
+        args = ["deploy"] if args.empty?
+        refuse_uncommitted_changes! if BUILDS.include?(args.first)
+        load_env_files
+        @exec.call("bundle", "exec", "kamal", *args, chdir: @root)
+      end
+
+      private
+
+      def load_env_files
+        files = ENV_FILES.map { |name| File.join(@root, name) }.select { |path| File.file?(path) }
+        if files.empty?
+          return @output.puts("gemstack deploy: no .env.production or .env; .kamal/secrets reads the environment")
+        end
+
+        loaded = Dotenv.load(files, env: @env)
+        names = files.map { |path| File.basename(path) }.join(", ")
+        @output.puts("gemstack deploy: #{loaded.size} settings from #{names} (the environment wins)")
+      end
+
+      def refuse_uncommitted_changes!
+        changes, status = Open3.capture2("git", "-C", @root, "status", "--porcelain")
+        return unless status.success? && !changes.strip.empty?
+
+        raise Thor::Error, "Uncommitted changes: Kamal builds the image from the last commit, so they wouldn't " \
+                           "be deployed. Commit (or stash) them first."
+      rescue SystemCallError
+        nil # no git: nothing to check
+      end
+    end
+
+    desc "deploy [KAMAL ARGS]", "Deploy with Kamal, the root .env.production/.env loaded (or any Kamal command)"
+    long_desc <<~DESC
+      Runs `bundle exec kamal` with the app's root .env files loaded (.env.production.local,
+      .env.production, .env — earlier files win, real environment variables win over all), so
+      .kamal/secrets resolves its $VARIABLES from them. Without arguments it runs `kamal deploy`,
+      and refuses when there are uncommitted changes (Kamal builds from the last commit).
+
+        gemstack deploy                  # build, push and deploy the last commit
+        gemstack deploy setup            # the first deploy: Docker, kamal-proxy, accessories
+        gemstack deploy logs             # any Kamal command or alias: console, migrate, rollback VERSION…
+    DESC
+    stop_on_unknown_option! :deploy
+    def deploy(*args)
+      DeployCommand.new(root: Project.root!).run(args)
+    end
+  end
+end

data/lib/gemstack/cli/deploy_files.rb

@@ -0,0 +1,125 @@
+# frozen_string_literal: true
+
+require "digest"
+
+module GemStack
+  class CLI < Thor
+    # The deploy half of `gemstack update --templates`: the files
+    # `gemstack generate deploy` wrote (Dockerfile, config/deploy.yml,
+    # .kamal/secrets, bin/…). .gemstack/generators.json records each one's
+    # content as generated: a file that still matches was never edited and is
+    # updated; for one you edited, the release whose render matches is the base
+    # the merge starts from. Files a release adds (bin/deploy) are created.
+    module DeployFiles
+      DEPLOY_OWNER = "deploy:app"
+      # What DeployGenerator reads to decide what to write (frontend? database? jobs? mail?).
+      DEPLOY_INPUTS = %w[Gemfile Gemfile.lock config/app.rb config/database.yml .ruby-version .tool-versions
+                         frontend/package.json frontend/next.config.ts].freeze
+
+      private
+
+      def update_deploy_files
+        @manifest = GenerationManifest.new(@root)
+        tracked = @manifest.files.select { |_, entry| entry["owner"] == DEPLOY_OWNER }
+        return unless tracked.any? || File.file?(File.join(@root, "config/deploy.yml"))
+
+        Dir.mktmpdir("gemstack-deploy-templates") do |cache|
+          @deploy_cache = cache
+          tree = render_deploy(Generator::TEMPLATES)
+          @output.puts("  Deploy files: couldn't render this version's deploy templates; skipped") unless tree
+          tree&.each { |path, file| apply_deploy(path, file, tracked[path]) }
+        end
+        @manifest.save unless @dry_run
+      end
+
+      def apply_deploy(path, file, entry)
+        mine_path = File.join(@root, path)
+        mine = File.binread(mine_path) if File.file?(mine_path)
+        return if mine == file.content
+        return (entry ? @result.removed << path : record_deploy(path, file) { create(path, file) }) if mine.nil?
+        if entry && Digest::SHA256.hexdigest(mine) == entry["sha256"] # never edited
+          return record_deploy(path, file) { update(path, file, :updated) }
+        end
+
+        base = deploy_base(path, entry)
+        return if base == file.content # this release didn't change it: your edits are yours
+
+        bases = base ? [base] : deploy_bases(path)
+        reason = "is new in this version, and you have your own" if entry.nil? && bases.empty?
+        record_deploy(path, file) { conflict(path, file, mine, bases, **{ reason: reason }.compact) }
+      end
+
+      # Runs the write, then records what the file now derives from: the new
+      # template, unless you kept yours (skip / FILE.new).
+      def record_deploy(path, file)
+        yield
+        written = (@result.created + @result.updated + @result.merged + @result.marked).include?(path)
+        @manifest.record_content(path, owner: DEPLOY_OWNER, content: file.content) if written && !@dry_run
+      end
+
+      # The template this file was generated from: the release render whose
+      # content matches the recorded checksum.
+      def deploy_base(path, entry)
+        return nil unless entry
+
+        deploy_releases.each do |source|
+          content = deploy_render(source)&.dig(path)&.content
+          return content if content && Digest::SHA256.hexdigest(content) == entry["sha256"]
+        end
+        nil
+      end
+
+      # Without a recorded base: every earlier release's version of the file
+      # (this release's isn't a base — merging with it would just keep yours).
+      def deploy_bases(path)
+        deploy_releases.drop(1).filter_map { |source| deploy_render(source)&.dig(path)&.content }.uniq
+      end
+
+      # This release (what a merged file was recorded against), the recorded
+      # version, then every earlier release, newest first.
+      def deploy_releases
+        @deploy_releases ||= [Generator::TEMPLATES] +
+                             if @old_templates then Array(@old_templates)
+                             else ([@from] + TemplateSource.releases_before(GemStack::VERSION).reverse).compact.uniq
+                             end
+      end
+
+      def deploy_render(source)
+        (@deploy_renders ||= {}).fetch(source) do
+          templates = File.directory?(source.to_s) ? source : TemplateSource.locate(source, cache: @deploy_cache)
+          @deploy_renders[source] = templates && render_deploy(templates)
+        end
+      end
+
+      # `gemstack generate deploy` for this app (its database, frontend, jobs,
+      # pinned versions and any lib/templates/gemstack/deploy overrides), in a
+      # scratch copy of the files it reads.
+      def render_deploy(templates)
+        Dir.mktmpdir("gemstack-render-deploy") do |dir|
+          sandbox = File.join(dir, File.basename(@root))
+          copy_deploy_inputs(sandbox)
+          generator = DeployGenerator.new(root: sandbox, output: StringIO.new, templates: templates)
+          generator.run
+          generator.created.filter_map do |full|
+            rel = full.delete_prefix("#{sandbox}/")
+            [rel, TemplateUpdate::AppFile.new(File.binread(full), File.stat(full).mode)] unless rel == "vendor/.keep"
+          end.to_h
+        end
+      rescue StandardError
+        nil # a release whose deploy templates this version can't render: compare without it
+      end
+
+      def copy_deploy_inputs(sandbox)
+        globs = DEPLOY_INPUTS + %w[app/jobs/*.rb app/mailers/*.rb lib/templates/gemstack/deploy/**/*]
+        globs.flat_map { |glob| Dir.glob(glob, File::FNM_DOTMATCH, base: @root) }.each do |rel|
+          source = File.join(@root, rel)
+          next unless File.file?(source)
+
+          FileUtils.mkdir_p(File.dirname(File.join(sandbox, rel)))
+          FileUtils.cp(source, File.join(sandbox, rel))
+        end
+        File.write(File.join(sandbox, "Gemfile"), "") unless File.file?(File.join(sandbox, "Gemfile"))
+      end
+    end
+  end
+end

data/lib/gemstack/cli/deploy_generator.rb

@@ -7,11 +7,18 @@ module GemStack
     # to Ruby and handles HTTPS; database accessories), .kamal/secrets,
     # bin/docker-entrypoint and .dockerignore. Nothing is deployed anywhere.
     class DeployGenerator < Generator
-      def initialize(root:, output: $stdout, force: false)
+      # templates: another release's templates/ directory (gemstack update
+      # renders old releases' deploy files to compare with).
+      def initialize(root:, output: $stdout, force: false, templates: nil)
         super(output: output, force: force)
         @root = root
+        @templates = templates
       end
 
+      # Bundler 4 lockfiles list gem checksums; gems installed from the local
+      # cache can be added without one, so fill them in before building.
+      CHECKSUMS_HINT = ", then bundle lock --add-checksums (Gemfile.lock lists gem checksums)"
+
       KAMAL_GEM = %(gem "kamal", require: false, group: :development # bundle exec kamal deploy (config/deploy.yml)\n)
       # The image runs Next.js's standalone server (node -r … frontend/server.js); the
       # Dockerfile asks for that build with GEMSTACK_NEXT_OUTPUT=standalone.
@@ -103,7 +110,12 @@ module GemStack
         return status("identical", path, "kamal") if gemfile.match?(/^\s*gem ["']kamal["']/)
 
         File.write(path, "#{gemfile.chomp}\n\n#{KAMAL_GEM}")
-        status("gem", path, "kamal — run bundle install")
+        status("gem", path, "kamal — run bundle install#{CHECKSUMS_HINT if lockfile_checksums?}")
+      end
+
+      def lockfile_checksums?
+        lock = File.join(@root, "Gemfile.lock")
+        File.file?(lock) && File.read(lock).match?(/^CHECKSUMS$/)
       end
 
       def enable_standalone_frontend

data/lib/gemstack/cli/destroy_generator.rb

@@ -14,7 +14,8 @@ module GemStack
       # Kinds that change the API, so the TypeScript contract is regenerated after them.
       CONTRACT_KINDS = %w[model controller resource].freeze
       # What `gemstack generate deploy` writes at the app's root.
-      DEPLOY_FILES = %w[Dockerfile .dockerignore config/deploy.yml .kamal/secrets bin/docker-entrypoint].freeze
+      DEPLOY_FILES = %w[Dockerfile .dockerignore config/deploy.yml .kamal/secrets bin/docker-entrypoint
+                        bin/deploy].freeze
       SHARED = (Generator::BASE_CLASSES.values + %w[
         app/controllers/application_controller.rb test/test_helper.rb
         frontend/lib/format.ts frontend/lib/gemstack/client.ts

data/lib/gemstack/cli/generation_manifest.rb

@@ -56,6 +56,14 @@ module GemStack
         @dirty = true
       end
 
+      # Records a file as generated from `content` — what a later update
+      # compares with — whatever the file holds now (e.g. after a merge).
+      def record_content(relative, owner:, content:)
+        absolute(relative)
+        files[relative] = { "owner" => owner, "sha256" => Digest::SHA256.hexdigest(content) }
+        @dirty = true
+      end
+
       def record_route(line, owner:)
         entry = { "owner" => owner, "line" => line }
         return if routes.include?(entry)

data/lib/gemstack/cli/template_update.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require "digest"
 require "fileutils"
 require "json"
 require "net/http"
@@ -82,11 +83,19 @@ module GemStack
     # template are applied to your copy, keeping your edits. Where both changed
     # the same lines the file gets <<<<<<< conflict markers to resolve.
     #
+    # The files `gemstack generate deploy` wrote (Dockerfile, config/deploy.yml,
+    # .kamal/secrets, bin/…) are updated the same way. .gemstack/generators.json
+    # records each one's content as generated: a file that still matches was
+    # never edited; for one you edited, the release whose render matches is the
+    # base the merge starts from. Files a release adds (bin/deploy) are created.
+    #
     # Apps record the templates they're on in .gemstack/version. Older apps don't,
     # so each file is compared with every earlier release's template: matching
     # one means you never edited it (it's just out of date). Without any old
     # templates (offline), files that differ are offered, never updated.
     class TemplateUpdate
+      include DeployFiles
+
       VERSION_FILE = ".gemstack/version"
       # Managed elsewhere: the Gemfile by `gemstack update`/Bundler. Migrations
       # (db/migrations/) are the app's history and never part of an update.
@@ -121,6 +130,7 @@ module GemStack
         new_tree = render(Generator::TEMPLATES, version: GemStack::VERSION)
         old_trees = old_trees_for_comparison
         new_tree.each { |path, file| apply(path, file, old_trees.map { |tree| tree[path]&.content }) }
+        update_deploy_files
         report
         record_version unless @dry_run || @result.conflicts.any?
         @result
@@ -230,11 +240,11 @@ module GemStack
         status("update", path)
       end
 
-      def conflict(path, file, mine, bases)
+      def conflict(path, file, mine, bases, reason: "changed in this version and you edited it")
         return record_conflict(path) unless @interactive
 
         loop do
-          case @prompt.call("#{path} changed in this version and you edited it — [m]erge (keeps your edits), " \
+          case @prompt.call("#{path} #{reason} — [m]erge (keeps your edits), " \
                             "[o]verwrite, [s]kip, [d]iff, save as [n]ew file?")
           when "m"
             return if merge(path, file, mine, bases)

data/lib/gemstack/cli.rb

@@ -25,9 +25,11 @@ module GemStack
     require_relative "cli/deploy_generator"
     require_relative "cli/add_generator"
     require_relative "cli/update_generator"
+    require_relative "cli/deploy_files"
     require_relative "cli/template_update"
     require_relative "cli/commands/db"
     require_relative "cli/commands/jobs"
+    require_relative "cli/commands/deploy"
     require_relative "cli/console_methods"
     require_relative "cli/helpers"
 
@@ -238,10 +240,10 @@ module GemStack
       "~> VERSION" and runs bundle update for them. Without VERSION, uses the latest release on
       rubygems.org. Then updates the files `gemstack new` wrote (config, bin/, frontend setup…):
       files the release didn't change are left alone, new ones are created, ones you never edited
-      are updated, and for ones you edited you choose: overwrite, skip, see the diff, or FILE.new.
+      are updated, and for ones you edited you choose: merge, overwrite, skip, see the diff, or FILE.new.
 
         gemstack update                       # the latest release
-        gemstack update 0.4.2                 # a specific version
+        gemstack update 0.4.3                 # a specific version
         gemstack update --templates --dry-run # only the template step, preview
         gemstack update --templates --from 0.3.5
     DESC

data/lib/gemstack/version.rb

@@ -2,5 +2,5 @@
 
 module GemStack
   # All GemStack gems are released together under a single version.
-  VERSION = "0.4.2"
+  VERSION = "0.4.3"
 end

data/templates/deploy/bin/deploy

@@ -0,0 +1,9 @@
+#!/bin/sh
+# Deploys with Kamal, the root .env.production / .env loaded (docs/deployment.md):
+#
+#   bin/deploy                # build, push and deploy the last commit
+#   bin/deploy setup          # the first deploy: Docker, kamal-proxy, accessories
+#   bin/deploy logs           # any Kamal command or alias: console, migrate, rollback VERSION…
+set -e
+cd "$(dirname "$0")/.."
+exec bundle exec gemstack deploy "$@"

data/templates/deploy/config/deploy.yml.tt

@@ -1,10 +1,12 @@
 # Kamal deploy configuration for <%= app_name %> (gemstack generate deploy — docs/deployment.md).
 #
-#   bundle exec kamal setup    # first deploy: Docker, kamal-proxy (HTTPS) and accessories on the server
-#   bundle exec kamal deploy   # every deploy after that, with zero downtime
+#   bin/deploy setup    # first deploy: Docker, kamal-proxy (HTTPS) and accessories on the server
+#   bin/deploy          # every deploy after that (the last commit), with zero downtime
+#   bin/deploy logs     # any Kamal command or alias below: console, migrate, rollback VERSION…
 #
-# Replace the placeholders marked CHANGE. Secrets are read from .kamal/secrets,
-# which only references environment variables, never their values.
+# bin/deploy (gemstack deploy) runs Kamal with the root .env.production and .env
+# loaded. Replace the placeholders marked CHANGE. Secrets are read from
+# .kamal/secrets, which only references those variables, never their values.
 
 service: <%= service %>
 
@@ -17,6 +19,8 @@ servers:
     hosts:
       - 192.168.0.1 # CHANGE: your server's IP or hostname
     cmd: node -r ./frontend/lib/gemstack/root-env.cjs frontend/server.js
+    # Not the primary role (see primary_role below), so the proxy is enabled explicitly.
+    proxy: true
     env:
       clear:
         # Server Components call the API directly, through the alias below.
@@ -57,12 +61,21 @@ servers:
     cmd: bundle exec gemstack jobs
 <% end -%>
 
-primary_role: <%= frontend? ? "web" : "api" %>
+<% if frontend? -%>
+# The API boots first: the web role's healthcheck (/) renders pages that call it,
+# which fails on the first deploy if the web role boots before any API is running.
+<% end -%>
+primary_role: api
 
 # HTTPS with a Let's Encrypt certificate: point the domain's DNS at the server first.
 proxy:
   ssl: true
   host: app.example.com # CHANGE: your domain
+  # Serving www and the bare domain: list both (each gets a certificate) and
+  # redirect one to the other in frontend/next.config.ts (docs/deployment.md).
+  # hosts:
+  #   - www.example.com
+  #   - example.com
 <% if frontend? -%>
   app_port: 3000
   healthcheck:
@@ -74,7 +87,7 @@ proxy:
 <% end -%>
 
 registry:
-  # server: ghcr.io # for GitHub's registry; Docker Hub is the default
+  # server: ghcr.io # for GitHub's registry (password: see .kamal/secrets); Docker Hub is the default
   username: your-user # CHANGE
   password:
     - KAMAL_REGISTRY_PASSWORD
@@ -109,6 +122,10 @@ volumes:
   - "<%= service %>_data:/data"
 <% end -%>
 
+# Kamal connects as root; set the user your server logs in with (e.g. ubuntu on AWS).
+# ssh:
+#   user: ubuntu
+
 builder:
   arch: amd64
 <% if frontend? -%>
@@ -153,7 +170,7 @@ accessories:
 <% end -%>
 <% end -%>
 
-# bundle exec kamal console | logs | migrate | shell
+# bin/deploy console | logs | migrate | shell
 aliases:
   console: app exec --interactive --reuse --roles=api "bundle exec gemstack console"
   logs: app logs --follow

data/templates/deploy/dot_kamal/secrets.tt

@@ -3,12 +3,17 @@
 # This file is committed to git: only ever write REFERENCES here — environment
 # variables ($NAME) or password-manager commands ($(kamal secrets fetch ...)) —
 # never a secret's value. `gemstack doctor` flags values written in place.
+#
+# bin/deploy (gemstack deploy) loads the root .env.production.local, .env.production
+# and .env (git-ignored) before Kamal reads this file: put the production values there.
 
+# Docker Hub: an access token. GitHub's registry (ghcr.io): a token with write:packages,
+# e.g. KAMAL_REGISTRY_PASSWORD=$(gh auth token) after `gh auth refresh -s write:packages`.
 KAMAL_REGISTRY_PASSWORD=$KAMAL_REGISTRY_PASSWORD
 <% if frontend? -%>
-# The frontend's NEXT_PUBLIC_* settings from the root .env (.env.production first),
+# The frontend's NEXT_PUBLIC_* settings from the root .env files (production first),
 # compiled into the JavaScript at build time — public by design, nothing else is read.
-GEMSTACK_PUBLIC_ENV=$(grep -hsE '^(export )?NEXT_PUBLIC_' .env.production .env)
+GEMSTACK_PUBLIC_ENV=$(grep -hsE '^(export )?NEXT_PUBLIC_' .env.production.local .env.production .env)
 <% end -%>
 SECRET_KEY_BASE=$SECRET_KEY_BASE
 <% if postgresql? -%>

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: gemstack
 version: !ruby/object:Gem::Version
-  version: 0.4.2
+  version: 0.4.3
 platform: ruby
 authors:
 - Adware Technologies
@@ -44,14 +44,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.4.2
+        version: 0.4.3
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.4.2
+        version: 0.4.3
 - !ruby/object:Gem::Dependency
   name: json
   requirement: !ruby/object:Gem::Requirement
@@ -175,9 +175,11 @@ files:
 - lib/gemstack/cli/add_next_steps.rb
 - lib/gemstack/cli/app_generator.rb
 - lib/gemstack/cli/commands/db.rb
+- lib/gemstack/cli/commands/deploy.rb
 - lib/gemstack/cli/commands/jobs.rb
 - lib/gemstack/cli/console_methods.rb
 - lib/gemstack/cli/controller_generator.rb
+- lib/gemstack/cli/deploy_files.rb
 - lib/gemstack/cli/deploy_generator.rb
 - lib/gemstack/cli/destroy_generator.rb
 - lib/gemstack/cli/destroy_generator/kinds.rb
@@ -336,6 +338,7 @@ files:
 - templates/controller/app/controllers/%file_name%_controller.rb.tt
 - templates/controller/test/controllers/%file_name%_controller_test.rb.tt
 - templates/deploy/Dockerfile.tt
+- templates/deploy/bin/deploy
 - templates/deploy/bin/docker-entrypoint.tt
 - templates/deploy/config/deploy.yml.tt
 - templates/deploy/dot_dockerignore