hecks 3.4.2 → 3.6.0

data/lib/hecks/projections/bootstrap_table.rb

@@ -27,6 +27,28 @@ module Hecks
         # projected from is still being built (`MetaValidator.bootstrapping?`).
       RUBY
 
+      # The generated file, with `@@CALLS@@` and `@@RESOLVES@@` standing for the table rows.
+      TEMPLATE = <<~RUBY.freeze
+        #{HEADER}
+        module Hecks
+          module Bluebook
+            module DSL
+              module BootstrapTable
+                # [context, word] => the method a word's whole call forwards to.
+                CALLS = {
+        @@CALLS@@
+                }.freeze
+
+                # [word, context] => the RuleReference primitive a bare reference resolves through.
+                RESOLVES = {
+        @@RESOLVES@@
+                }.freeze
+              end
+            end
+          end
+        end
+      RUBY
+
       module_function
 
       # Projects the bootstrap fallback table; both arguments are ignored (the table is
@@ -56,12 +78,18 @@ module Hecks
       def calls(rows = live_keywords)
         rows.reject { |row| row[:calls].to_s.empty? }
             .group_by { |row| [row[:context], row[:word]] }
-            .to_h do |key, same_word|
-              targets = same_word.map { |row| row[:calls] }.uniq
-              raise Conflict, "#{key.inspect} names more than one method: #{targets.join(', ')}" if targets.size > 1
+            .to_h { |key, same_word| [key, single_target(key, same_word)] }
+      end
 
-              [key, targets.first.to_sym]
-            end
+      # @param key [Array<String>] a `[context, word]`
+      # @param same_word [Array<Hash{Symbol => String}>] the rows declaring that word
+      # @return [Symbol] the one method they all name
+      # @raise [Projections::BootstrapTable::Conflict] if they name different methods
+      def single_target(key, same_word)
+        targets = same_word.map { |row| row[:calls] }.uniq
+        raise Conflict, "#{key.inspect} names more than one method: #{targets.join(", ")}" if targets.size > 1
+
+        targets.first.to_sym
       end
 
       # `[word, context] => { resolves_via:, disambiguator: }`, in RuleReference's key order.
@@ -84,31 +112,17 @@ module Hecks
       def render(_bluebook)
         rows = live_keywords
         calls_lines = calls(rows).map { |key, target| "          #{key.inspect} => #{target.inspect}" }
-        resolves_lines = resolves(rows).map do |key, rule|
-          fields = rule.map { |name, value| "#{name}: #{value.inspect}" }.join(", ")
-          "          #{key.inspect} => { #{fields} }.freeze"
-        end
+        resolves_lines = resolves(rows).map { |key, rule| resolves_line(key, rule) }
 
-        <<~RUBY
-          #{HEADER}
-          module Hecks
-            module Bluebook
-              module DSL
-                module BootstrapTable
-                  # [context, word] => the method a word's whole call forwards to.
-                  CALLS = {
-          #{calls_lines.join(",\n")}
-                  }.freeze
-
-                  # [word, context] => the RuleReference primitive a bare reference resolves through.
-                  RESOLVES = {
-          #{resolves_lines.join(",\n")}
-                  }.freeze
-                end
-              end
-            end
-          end
-        RUBY
+        TEMPLATE.sub("@@CALLS@@") { calls_lines.join(",\n") }.sub("@@RESOLVES@@") { resolves_lines.join(",\n") }
+      end
+
+      # @param key [Array<String>] a `[word, context]`
+      # @param rule [Hash{Symbol => String}] its `resolves_via:` and `disambiguator:` columns
+      # @return [String] its entry in the `RESOLVES` literal
+      def resolves_line(key, rule)
+        fields = rule.map { |name, value| "#{name}: #{value.inspect}" }.join(", ")
+        "          #{key.inspect} => { #{fields} }.freeze"
       end
     end
   end

data/lib/hecks/projections/deploy/bastion_lines.rb

@@ -0,0 +1,32 @@
+module Hecks
+  module Projections
+    module Deploy
+      # The Makefile lines that read a stack's outputs for the temporary bastion: one `$(eval ...)`
+      # per output, and the `--parameter-overrides` the bastion stack is deployed with. Included
+      # into a stack object that answers `stack_outputs` and `bastion_parameters`.
+      module BastionLines
+        # @return [String] one `$(eval VAR := $(shell aws cloudformation describe-stacks ...))` per
+        #   output, tab-separated for a Makefile recipe
+        def eval_lines
+          stack_outputs.map { |output| eval_line(output) }.join("\n\t")
+        end
+
+        # @return [String] `Name=$(VAR)` for each bastion parameter, space-separated
+        def parameter_overrides
+          outputs = stack_outputs
+          bastion_parameters.map do |parameter|
+            source = outputs.find { |output| output[:key] == parameter[:from_output] }
+            "#{parameter[:name]}=$(#{source[:var]})"
+          end.join(" ")
+        end
+
+        private
+
+        def eval_line(output)
+          "$(eval #{output[:var]} := $(shell aws cloudformation describe-stacks --stack-name $(STACK) " \
+            "--query \"Stacks[0].Outputs[?OutputKey=='#{output[:key]}'].OutputValue\" --output text))"
+        end
+      end
+    end
+  end
+end

data/lib/hecks/projections/deploy/box/access.rb

@@ -0,0 +1,73 @@
+module Hecks
+  module Projections
+    module Deploy
+      module Box
+        # The IAM statements of the box's role: the S3 buckets it reads and writes and the Secrets
+        # Manager secrets it reads and overwrites. Mixed into `Box`, which supplies `template`.
+        module Access
+          SECRET_ARN = "arn:${AWS::Partition}:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:".freeze
+
+          # The role's S3 policy: every declared bucket readable, and writable only on a production
+          # box, so a rehearsal never changes the real objects.
+          #
+          # @param plan [Settings::Plan] the resolved settings
+          # @return [String] a policy list item, indented into the role's `Policies`, or nothing
+          def s3_policy(plan)
+            return "" if plan.s3_buckets.empty?
+
+            "#{s3_rows(plan.s3_buckets).map { |row| "        #{row}" }.join("\n")}\n"
+          end
+
+          # @param resources [Array<String>] the bucket and object ARNs a box may read
+          # @return [Array<String>] the policy's head and its read statement, relative to `Policies`
+          def s3_read_rows(resources)
+            ["- PolicyName: s3-access", "  PolicyDocument:", "    Version: \"2012-10-17\"", "    Statement:",
+             "      - Effect: Allow", "        Action: [s3:GetObject, s3:ListBucket]", "        Resource:"] +
+              resources.map { |r| "          - !Sub \"#{r}\"" }
+          end
+
+          # @param resources [Array<String>] the object ARNs a production box may write
+          # @return [Array<String>] the production-only write statement, relative to `Policies`
+          def s3_write_rows(resources)
+            ["      - !If", "        - IsProduction", "        - Effect: Allow",
+             "          Action: [s3:PutObject, s3:DeleteObject]", "          Resource:"] +
+              resources.map { |r| "            - !Sub \"#{r}\"" } + ["        - !Ref AWS::NoValue"]
+          end
+
+          # One Secrets Manager statement resource per prefix. A name without a trailing `*` gets
+          # `-*` for the random suffix AWS appends to every secret ARN.
+          #
+          # @param plan [Settings::Plan] the resolved settings
+          # @return [String] YAML list items, one per prefix, ending in a newline
+          def secret_resources(plan)
+            named = [plan.origin_secret, plan.tunnel_service&.token_secret].compact
+            arns = (plan.secret_prefixes + named).map { |name| name.end_with?("*") ? name : "#{name}-*" }
+            arns.uniq.map { |pattern| "#{" " * 18}- !Sub \"#{SECRET_ARN}#{pattern}\"\n" }.join.chomp
+          end
+
+          # The statement that lets a production box overwrite the secrets named as writable.
+          #
+          # @param plan [Settings::Plan] the resolved settings
+          # @return [String] a policy statement for the role, or nothing when none are declared
+          def writable_secrets(plan)
+            return "" if plan.writable_secrets.empty?
+
+            arns = plan.writable_secrets.map { |name| name.end_with?("*") ? name : "#{name}-*" }.uniq
+            resources = arns.map { |pattern| "#{" " * 20}- !Sub \"#{SECRET_ARN}#{pattern}\"\n" }.join
+            template("writable-secrets.yaml.tmpl", "RESOURCES" => resources.chomp).chomp
+          end
+
+          private
+
+          def s3_rows(buckets)
+            rows = s3_read_rows(buckets.flat_map { |b| [s3_arn(b.name), s3_arn("#{b.name}/*")] })
+            writes = buckets.select(&:write).map { |b| s3_arn("#{b.name}/*") }
+            writes.empty? ? rows : rows + s3_write_rows(writes)
+          end
+
+          def s3_arn(path) = "arn:${AWS::Partition}:s3:::#{path}"
+        end
+      end
+    end
+  end
+end

data/lib/hecks/projections/deploy/box/caddy.rb

@@ -0,0 +1,87 @@
+module Hecks
+  module Projections
+    module Deploy
+      module Box
+        # The proxy's `Caddyfile`: an optional origin-secret guard, one block per route and a
+        # default for everything else. Mixed into `Box`, which supplies `template` and the
+        # constants.
+        module Caddy
+          # The proxy's configuration: an optional origin-secret guard, one block per route and a
+          # default for everything else.
+          #
+          # @param plan [Settings::Plan] the resolved settings
+          # @return [String] the Caddyfile
+          def caddyfile(plan)
+            guarded = !plan.origin_header.nil?
+            site =
+              if guarded
+                "\t@origin header #{plan.origin_header} {$ORIGIN_SECRET}\n\n\thandle @origin {\n" \
+                  "#{indent(indent(route_blocks(plan)))}\t}\n\n\thandle {\n\t\trespond \"Forbidden\" 403\n\t}\n"
+              else
+                indent(route_blocks(plan))
+              end
+            "#{caddy_header(plan)}#{caddy_global(guarded)}\n:80 {\n#{site}}\n\n#{CADDY_EXTRA}"
+          end
+
+          # @param plan [Settings::Plan] the resolved settings
+          # @return [String] the `handle` blocks for each route, then the default
+          def route_blocks(plan)
+            routes = plan.routes.each_with_index.map { |route, i| route_block(plan, route, i + 1) }
+            "#{routes.join}handle {\n#{upstream(plan.default.port)}}\n"
+          end
+
+          # One upstream. A request that arrives while its container is being replaced
+          # waits, and is tried again every quarter second for up to 15 seconds, so a
+          # deploy shows a visitor a slow page instead of a 502.
+          #
+          # @param port [Integer] the container's port
+          # @return [String] the `reverse_proxy` block, one tab in, ending in a newline
+          def upstream(port)
+            "\treverse_proxy 127.0.0.1:#{port} {\n\t\tlb_try_duration 15s\n\t\tlb_try_interval 250ms\n\t}\n"
+          end
+
+          # @param plan [Settings::Plan] the resolved settings
+          # @return [String] the comment that opens the Caddyfile
+          def caddy_header(plan)
+            origin =
+              if plan.origin_header
+                "Only requests that carry #{plan.origin_header} with the origin secret are proxied;\n" \
+                  "# everything else gets a flat 403.\n"
+              else
+                "Every request is proxied.\n"
+              end
+            "# #{plan.infra_name}'s proxy. #{origin}"
+          end
+
+          # With a guard, the proxy trusts every source: a request that reaches a `handle` block has
+          # already proved it came through the CDN by presenting the secret, and everything else is
+          # refused. Caddy then keeps the client address the CDN put in X-Forwarded-For.
+          #
+          # @param guarded [Boolean] whether an origin secret guards the site
+          # @return [String] the global options block
+          def caddy_global(guarded)
+            options = "\t# No certificate for the :80 site. disable_redirects, not off, so a listener a rehearsal\n" \
+                      "\t# mounts under caddy-extra can still ask for `tls internal`.\n" \
+                      "\tauto_https disable_redirects\n\tadmin off\n"
+            return "{\n#{options}}\n" unless guarded
+
+            "{\n#{options}\tservers {\n\t\ttrusted_proxies static 0.0.0.0/0 ::/0\n\t}\n}\n"
+          end
+
+          # @param text [String] lines to indent one level with a tab
+          # @return [String] the text, each non-blank line prefixed with a tab
+          def indent(text)
+            text.lines.map { |line| line.strip.empty? ? line : "\t#{line}" }.join
+          end
+
+          private
+
+          def route_block(plan, route, number)
+            port = plan.containers.find { |c| c.name == route.container }.port
+            "@r#{number} path #{route.paths.join(" ")}\nhandle @r#{number} {\n#{upstream(port)}}\n\n"
+          end
+        end
+      end
+    end
+  end
+end

data/lib/hecks/projections/deploy/box/compose.rb

@@ -0,0 +1,70 @@
+require "json"
+
+module Hecks
+  module Projections
+    module Deploy
+      module Box
+        # What the box's Compose file is rendered from: the script that renders it and the
+        # `services.json` it reads. Mixed into `Box`, which supplies `template`.
+        module Compose
+          # @param plan [Settings::Plan] the resolved settings
+          # @param region [String] the validated region
+          # @return [String] the script that renders the Compose file, from `services.json` or from
+          #   an ECS task definition when the world names one
+          def render_compose_sh(plan, region)
+            if plan.task_definition
+              template("render-compose-taskdef.sh.tmpl", "STACK" => plan.infra_name, "FAMILY" => plan.task_definition,
+                                                          "PROXY_IMAGE" => plan.proxy_image)
+            else
+              template("render-compose.sh.tmpl", "STACK" => plan.infra_name, "REGION" => region,
+                                                 "DB_NAME" => plan.database_name, "PROXY_IMAGE" => plan.proxy_image)
+            end
+          end
+
+          # The compose source: one entry per container, plus the origin secret the proxy checks.
+          #
+          # @param plan [Settings::Plan] the resolved settings
+          # @return [String] `services.json`
+          def services_json(plan)
+            services = plan.containers.to_h { |c| [c.name, service_entry(plan, c)] }
+            document = { "services" => services, "origin" => origin_entry(plan) }
+            document["task_definition"] = plan.task_definition if plan.task_definition
+            document["tunnel"] = tunnel_entry(plan.tunnel_service) if plan.tunnel_service
+            # An empty object prints as `{}` or `{` newline `}`, depending on the json gem.
+            "#{JSON.pretty_generate(document).gsub(/\{\s*\}/, "{}")}\n"
+          end
+
+          # A container's entry. With a task definition the image, environment and secrets are read
+          # from it at deploy time, so only the name and port are written here.
+          #
+          # @param plan [Settings::Plan] the resolved settings
+          # @param container [Settings::Container] the container
+          # @return [Hash{String => Object}] its entry in `services.json`
+          def service_entry(plan, container)
+            entry = { "name" => container.name, "port" => container.port }
+            return entry if plan.task_definition
+
+            { "name" => container.name, "repository" => container.repository, "port" => container.port,
+              "env" => container.env, "secrets" => container.secrets }
+          end
+
+          # @param tunnel [Settings::Tunnel] the declared tunnel service
+          # @return [Hash{String => Object}] its entry in `services.json`
+          def tunnel_entry(tunnel)
+            { "url" => "http://127.0.0.1:#{tunnel.port}", "token_secret" => tunnel.token_secret, "image" => tunnel.image }
+          end
+
+          private
+
+          def origin_entry(plan)
+            return nil unless plan.origin_secret
+
+            origin = { "header" => plan.origin_header, "secret" => plan.origin_secret }
+            origin["env"] = plan.origin_env if plan.origin_env.any?
+            origin
+          end
+        end
+      end
+    end
+  end
+end

data/lib/hecks/projections/deploy/box/hosting.rb

@@ -1,5 +1,6 @@
 require "shellwords"
 require_relative "../scripts"
+require_relative "hosting_parts"
 
 module Hecks
   module Projections
@@ -10,6 +11,8 @@ module Hecks
         # Container names, repositories, parameters and stacks come from the resolved plan, never
         # from this file.
         module Hosting
+          extend HostingParts
+
           module_function
 
           # Adds the hosting scripts to a box file map when the world opts in.
@@ -33,9 +36,10 @@ module Hecks
           # @param plan [Settings::Plan] the resolved settings
           # @return [String] the Makefile fragment the box `Makefile` includes
           def hosting_mk(plan)
-            Box.template("hosting.mk.tmpl", "SERVICE"      => plan.containers.first.name,
-                                            "URL"          => plan.hosting.public_url.to_s,
-                                            "SMOKE_RECIPE" => Box::SMOKE_RECIPE)
+            Box.template("hosting.mk.tmpl", "SERVICE"        => plan.containers.first.name,
+                                            "URL"            => plan.hosting.public_url.to_s,
+                                            "SMOKE_RECIPE"   => Box::SMOKE_RECIPE,
+                                            "SERVICE_RECIPE" => service_recipe)
           end
 
           # @param plan [Settings::Plan] the resolved settings
@@ -50,120 +54,24 @@ module Hecks
                          "ROLL_STEPS" => part(roll))
           end
 
+          # @return [String] the `deploy-service` recipe: the `service_roll.run` command
+          def service_recipe
+            args = "service=$(SERVICE) $(if $(EXISTING_TAG),existing_tag=$(EXISTING_TAG)) " \
+                   "$(if $(LOCAL_IMAGE),local_image=$(LOCAL_IMAGE))"
+            direct = "bash ./deploy-service.sh $(SERVICE)"
+            Box::RollRecipe.call(command: "service_roll.run", args: args, direct: direct)
+          end
+
           # @param plan [Settings::Plan] the resolved settings
           # @param region [String] the validated AWS region
           # @return [String] `smoke-after-deploy.sh`
           def smoke_after_deploy_sh(plan, region)
-            hosting = plan.hosting
-            image_stack = hosting.stack
+            image_stack = plan.hosting.stack
             Box.template("smoke-after-deploy.sh.tmpl",
                          "STACK" => plan.infra_name, "SETTINGS" => smoke_constants(plan, region),
                          "SETTLE_CHECKS" => settle_checks(plan),
                          "IMAGE_STACK_WAIT" => image_stack ? ", stack #{image_stack}" : "")
           end
-
-          # @param plan [Settings::Plan] the resolved settings
-          # @return [String] the sentence that says what the roll puts on the box
-          def mode_summary(plan)
-            if plan.task_definition
-              <<~TEXT.gsub(/^/, "# ").chomp
-                It then sets the stack's matching image-tag parameter (UsePreviousValue for every other
-                one, and it checks that only that one changed), reads the task definition the stack
-                registers, refuses to roll it unless it carries the pushed image, and rolls it with
-                deploy-box.sh.
-              TEXT
-            else
-              <<~TEXT.gsub(/^/, "# ").chomp
-                It then rolls the box with deploy-box.sh, naming the new tag for this container and the
-                tag the box runs now for every other one.
-              TEXT
-            end
-          end
-
-          # @param plan [Settings::Plan] the resolved settings
-          # @return [String] the comment lines that list what "settled" means
-          def settle_checks(plan)
-            stacks = plan.hosting.stack ? "the box stack and the #{plan.hosting.stack} stack are" : "the box stack is"
-            checks = ["#{stacks} CREATE_COMPLETE or UPDATE_COMPLETE, never rolled back or failed;",
-                      "every container and the proxy of the box's Compose project is up and has stayed up;"]
-            if plan.task_definition
-              checks << "each container runs the image of the task definition it was rolled from (the latest " \
-                        "#{plan.task_definition} unless TASKDEF says otherwise)."
-            end
-            checks.map { |line| "#      - #{line}" }.join("\n")
-          end
-
-          def deploy_constants(plan, region)
-            lines = { "REGION" => region }
-            if plan.task_definition
-              lines["FAMILY"] = plan.task_definition
-              lines["IMAGE_STACK"] = plan.hosting.stack
-            else
-              lines["BOX_STACK"] = plan.box_stack
-              lines["BOX_DIR"] = "/opt/#{plan.infra_name}"
-            end
-            constants(lines)
-          end
-
-          def smoke_constants(plan, region)
-            hosting = plan.hosting
-            watched = [plan.box_stack, hosting.stack].compact
-            constants(
-              "REGION" => region, "BOX_STACK" => plan.box_stack, "BOX_DIR" => "/opt/#{plan.infra_name}",
-              "WATCHED_STACKS" => watched.join(" "),
-              "EXPECTED_SERVICES" => (plan.containers.map(&:name) + ["caddy"]).join(" ")
-            ).concat("\n#{smoke_defaults(plan)}")
-          end
-
-          def smoke_defaults(plan)
-            hosting = plan.hosting
-            [
-              "TASK_DEFINITION=\"${TASKDEF:-#{plan.task_definition}}\"",
-              "REPO=\"${REPO:-#{hosting.smoke_repo}}\"",
-              "WORKFLOW=\"${WORKFLOW:-#{hosting.smoke_workflow}}\"",
-              "SMOKE_REF=\"${SMOKE_REF:-#{hosting.smoke_ref}}\""
-            ].join("\n")
-          end
-
-          def constants(values)
-            values.map { |name, value| "#{name}=#{Shellwords.escape(value)}" }.join("\n")
-          end
-
-          # One case arm per container that sets the repository and image-tag parameter to use, and
-          # the list of names the script accepts.
-          def services_block(plan)
-            arms = plan.containers.map do |container|
-              setting =
-                if plan.task_definition
-                  "CFN_PARAM_KEY=#{Shellwords.escape(container.tag_parameter)}"
-                else
-                  "ECR_REPOSITORY=#{Shellwords.escape(container.repository)}"
-                end
-              "    #{Shellwords.escape(container.name)}) #{setting} ;;"
-            end
-            <<~BASH.chomp
-              SERVICES='#{plan.containers.map(&:name).join(' ')}'
-
-              # Sets the container's settings for one service, or exits.
-              resolve_service() {
-                case "$1" in
-              #{arms.join("\n")}
-                  *) echo "unknown service '$1', must be one of: ${SERVICES}" >&2; exit 1 ;;
-                esac
-              }
-            BASH
-          end
-
-          def repository_step(plan)
-            plan.task_definition ? "#{part('deploy-service.taskdef.part')}\n\n" : ""
-          end
-
-          def part(file)
-            file ? File.read(File.join(Box::TEMPLATE_DIR, file)).chomp : ""
-          end
-
-          private_class_method :deploy_constants, :smoke_constants, :smoke_defaults, :constants,
-                               :services_block, :part, :repository_step, :settle_checks
         end
       end
     end

data/lib/hecks/projections/deploy/box/hosting_parts.rb

@@ -0,0 +1,97 @@
+require "shellwords"
+
+module Hecks
+  module Projections
+    module Deploy
+      module Box
+        # The pieces `Hosting` splices into its scripts: the settings each script starts with, the
+        # service case arms and the sentences that say what a roll does. Extended onto `Hosting`.
+        module HostingParts
+          # @param plan [Settings::Plan] the resolved settings
+          # @return [String] the sentence that says what the roll puts on the box
+          def mode_summary(plan)
+            file = plan.task_definition ? "mode-summary-taskdef.tmpl" : "mode-summary-services.tmpl"
+            Box.template(file, {}).gsub(/^/, "# ").chomp
+          end
+
+          private
+
+          # @param plan [Settings::Plan] the resolved settings
+          # @return [String] the comment lines that list what "settled" means
+          def settle_checks(plan)
+            stacks = plan.hosting.stack ? "the box stack and the #{plan.hosting.stack} stack are" : "the box stack is"
+            checks = ["#{stacks} CREATE_COMPLETE or UPDATE_COMPLETE, never rolled back or failed;",
+                      "every container and the proxy of the box's Compose project is up and has stayed up;"]
+            if plan.task_definition
+              checks << "each container runs the image of the task definition it was rolled from (the latest " \
+                        "#{plan.task_definition} unless TASKDEF says otherwise)."
+            end
+            checks.map { |line| "#      - #{line}" }.join("\n")
+          end
+
+          def deploy_constants(plan, region)
+            lines = { "REGION" => region }
+            if plan.task_definition
+              lines["FAMILY"] = plan.task_definition
+              lines["IMAGE_STACK"] = plan.hosting.stack
+            else
+              lines["BOX_STACK"] = plan.box_stack
+              lines["BOX_DIR"] = "/opt/#{plan.infra_name}"
+            end
+            constants(lines)
+          end
+
+          def smoke_constants(plan, region)
+            hosting = plan.hosting
+            watched = [plan.box_stack, hosting.stack].compact
+            constants(
+              "REGION" => region, "BOX_STACK" => plan.box_stack, "BOX_DIR" => "/opt/#{plan.infra_name}",
+              "WATCHED_STACKS" => watched.join(" "),
+              "EXPECTED_SERVICES" => (plan.containers.map(&:name) + ["caddy"]).join(" ")
+            ).concat("\n#{smoke_defaults(plan)}")
+          end
+
+          def smoke_defaults(plan)
+            hosting = plan.hosting
+            [
+              "TASK_DEFINITION=\"${TASKDEF:-#{plan.task_definition}}\"",
+              "REPO=\"${REPO:-#{hosting.smoke_repo}}\"",
+              "WORKFLOW=\"${WORKFLOW:-#{hosting.smoke_workflow}}\"",
+              "SMOKE_REF=\"${SMOKE_REF:-#{hosting.smoke_ref}}\""
+            ].join("\n")
+          end
+
+          def constants(values)
+            values.map { |name, value| "#{name}=#{Shellwords.escape(value)}" }.join("\n")
+          end
+
+          # One case arm per container that sets the repository and image-tag parameter to use, and
+          # the list of names the script accepts.
+          def services_block(plan)
+            arms = plan.containers.map { |container| service_arm(plan, container) }
+            Box.template("services-block.tmpl", "NAMES" => plan.containers.map(&:name).join(" "),
+                                                "ARMS"  => arms.join("\n")).chomp
+          end
+
+          def service_arm(plan, container)
+            setting =
+              if plan.task_definition
+                "CFN_PARAM_KEY=#{Shellwords.escape(container.tag_parameter)}"
+              else
+                "ECR_REPOSITORY=#{Shellwords.escape(container.repository)}"
+              end
+            "    #{Shellwords.escape(container.name)}) #{setting} ;;"
+          end
+
+          def repository_step(plan)
+            plan.task_definition ? "#{part("deploy-service.taskdef.part")}\n\n" : ""
+          end
+
+          def part(file)
+            file ? File.read(File.join(Box::TEMPLATE_DIR, file)).chomp : ""
+          end
+        end
+      end
+    end
+  end
+end

data/lib/hecks/projections/deploy/box/hosting_settings.rb

@@ -38,7 +38,7 @@ module Hecks
 
             unless flag
               stray = WORDS.select { |word| settings.key?(word) }
-              raise ArgumentError, "#{stray.join(', ')} only apply with hosting_scripts true" unless stray.empty?
+              raise ArgumentError, "#{stray.join(", ")} only apply with hosting_scripts true" unless stray.empty?
 
               return nil
             end