hecks 3.4.2 → 3.6.0

data/lib/hecks/projections/deploy/box/roll_recipe.rb

@@ -0,0 +1,62 @@
+module Hecks
+  module Projections
+    module Deploy
+      module Box
+        # The Makefile recipes that run a roll as `box_roll.run` or `service_roll.run`.
+        #
+        # The command rolls with the generated script and, through its policy, requests the
+        # smoke, so one deploy leaves a `BoxRoll` or `ServiceRoll` (which also records the smoke's
+        # outcome) and a `SmokeRun` in the Hecks database. A failed roll or smoke is the command's
+        # exit 1, with the script's status in its message. With no database the command never
+        # starts, so the recipe runs the script itself, states the database error apart from the
+        # deploy's result, and fails (`Error 24` if all passed).
+        module RollRecipe
+          module_function
+
+          # @param plan [Settings::Plan] the resolved settings
+          # @return [String] the `deploy` target's recipe, tab-indented: the `box_roll.run` command
+          def deploy(plan)
+            variable = plan.task_definition ? "TASKDEF" : "TAGS"
+            args = plan.task_definition ? "$(if $(TASKDEF),taskdef=$(TASKDEF))" : "$(if $(TAGS),tags=\"$(TAGS)\")"
+            direct = "bash ./deploy-box.sh $(#{variable})"
+            direct += " || exit $$?; TASKDEF=\"$(TASKDEF)\" bash ./smoke-after-deploy.sh" if plan.hosting
+            "\t#{call(command: "box_roll.run", args: args, direct: direct)}"
+          end
+
+          # @param command [String] the Deploy command, such as `box_roll.run`
+          # @param args [String] the Makefile text that turns variables into the arguments
+          # @param direct [String] the shell that runs the script when there is no database
+          # @return [String] the recipe lines, joined for a Makefile rule
+          def call(command:, args:, direct:)
+            [*run_lines(command, args), *no_database_lines(direct), *outcome_lines].join("\n\t").freeze
+          end
+
+          def run_lines(command, args)
+            ["@err=$$(mktemp); run=deploy-$$(date -u +%Y%m%d%H%M%S); \\",
+             "$(HECKS) deploy #{command} project=\"$(CURDIR)\" run=\"$$run\" #{args} \\",
+             '  $(if $(SKIP_POST_DEPLOY_SMOKE),skip_smoke=true) --wait 2>"$$err"; rc=$$?; \\']
+          end
+
+          def no_database_lines(direct)
+            ['if [ $$rc -ne 0 ] && grep -q \'^cannot open Hecks\' "$$err"; then \\',
+             '  echo "==> the deploy record was NOT written: $$(grep -m1 \'^cannot open Hecks\' "$$err")" >&2; \\',
+             '  echo "    one-time setup on this machine: a database AND a non-superuser role that owns it" >&2; \\',
+             '  echo "    (a superuser skips the era write-fence, so createdb alone fails), then set" >&2; \\',
+             '  echo "    HECKS_DATABASE=postgres://<role>@localhost/<db>" >&2; \\',
+             '  echo "    deploying anyway so the deploy is not lost" >&2; \\',
+             "  rm -f \"$$err\"; #{direct}; rc=$$?; \\",
+             '  echo "==> deploy exit $$rc. The deploy record was NOT written: the database is unavailable (see above)." >&2; \\',
+             "  [ $$rc -ne 0 ] || rc=24; exit $$rc; \\",
+             "fi; \\"]
+          end
+
+          def outcome_lines
+            ['cat "$$err" >&2; rm -f "$$err"; exit $$rc']
+          end
+
+          private_class_method :run_lines, :no_database_lines, :outcome_lines
+        end
+      end
+    end
+  end
+end

data/lib/hecks/projections/deploy/box/roll_scripts.rb

@@ -0,0 +1,135 @@
+module Hecks
+  module Projections
+    module Deploy
+      module Box
+        # The files that roll the box and move a project onto it: `deploy-box.sh`, the Makefile and,
+        # for a world that declares a `migration`, its copy scripts and runbook. Mixed into `Box`,
+        # which supplies `template`.
+        module RollScripts
+          # The tooling that moves a project's data from its old database into the RDS instance, for
+          # a world that declares a `migration`.
+          #
+          # @param plan [Settings::Plan] the resolved settings
+          # @return [Hash{String => String}] `restore-to-rds.sh`, `verify-copy.sh` and
+          #   `MIGRATION.md`,
+          #   or nothing
+          def migration_files(plan)
+            migration = plan.migration
+            return {} unless migration
+
+            values = { "STACK" => plan.infra_name, "SCHEMAS" => migration.schemas.join(" "),
+                       "SCHEMAS_CSV" => migration.schemas.join(","), "DATABASE" => migration.database,
+                       "SOURCE_DATABASE" => migration.source_database }
+            {
+              "restore-to-rds.sh" => template("restore-to-rds.sh.tmpl", values),
+              "verify-copy.sh"    => template("verify-copy.sh.tmpl", values),
+              "MIGRATION.md"      => migration_md(plan)
+            }
+          end
+
+          # @param plan [Settings::Plan] the resolved settings
+          # @return [String] the runbook for moving onto the box, in the order the steps are run
+          def migration_md(plan)
+            migration = plan.migration
+            template("MIGRATION.md.tmpl", "STACK" => plan.infra_name, "SCHEMA_LIST" => schema_list(migration),
+                                          "SOURCE_DATABASE" => migration.source_database,
+                                          "DATABASE" => migration.database, "RDS_STACK" => plan.rds_stack,
+                                          "DEPLOY" => deploy_command(plan))
+          end
+
+          # @param plan [Settings::Plan] the resolved settings
+          # @param region [String] the validated region
+          # @return [String] `deploy-box.sh`
+          def deploy_box_sh(plan, region)
+            template("deploy-box.sh.tmpl", "STACK" => plan.infra_name, "BOX_STACK" => plan.box_stack,
+                                           "RDS_STACK" => plan.rds_stack, "REGION" => region,
+                                           "DIR" => "/opt/#{plan.infra_name}", "HEALTH_CHECKS" => health_checks(plan),
+                                           "SMOKE_HEADER" => smoke_header(plan), "USAGE" => deploy_usage(plan))
+          end
+
+          # @param plan [Settings::Plan] the resolved settings
+          # @return [String] the line that adds the origin secret to the smoke listener's requests,
+          #   or
+          #   nothing when the world has no origin guard
+          def smoke_header(plan)
+            plan.origin_header ? "\t\theader_up #{plan.origin_header} {$ORIGIN_SECRET}" : ""
+          end
+
+          # @param plan [Settings::Plan] the resolved settings
+          # @return [String] the comment lines that say how to call `deploy-box.sh`
+          def deploy_usage(plan)
+            return template("deploy-usage-services.tmpl", {}) unless plan.task_definition
+
+            template("deploy-usage-taskdef.tmpl", "TASK_DEFINITION" => plan.task_definition)
+          end
+
+          # The probes the post-roll check runs on the box, against the proxy on localhost.
+          #
+          # @param plan [Settings::Plan] the resolved settings
+          # @return [String] bash lines that set `BAD=1` on a failed probe
+          def health_checks(plan)
+            probes =
+              if plan.origin_header
+                guarded_probes(plan.origin_header)
+              else
+                [health_probe("the proxy serves /", "", '[ "${code#5}" = "$code" ]')]
+              end
+            (probes + tunnel_probe(plan)).join("\n")
+          end
+
+          # @param plan [Settings::Plan] the resolved settings
+          # @return [Array<String>] the probe that waits for the tunnel to register, when one runs
+          def tunnel_probe(plan)
+            return [] unless plan.tunnel_service
+
+            [<<~SH.chomp]
+              for _ in 1 2 3 4 5 6; do
+                n=$(docker compose -f compose.json logs --no-color cloudflared 2>&1 | grep -ci "registered tunnel connection" || true)
+                [ "$n" -gt 0 ] && break
+                sleep 5
+              done
+              [ "$n" -gt 0 ] && echo "ok   the tunnel registered $n connections" || { echo "FAIL the tunnel has no connection"; BAD=1; }
+            SH
+          end
+
+          # @param plan [Settings::Plan] the resolved settings
+          # @return [String] a Makefile whose targets create the two stacks and roll the box
+          def makefile(plan)
+            hint = plan.task_definition ? "[TASKDEF=family:revision]" : '[TAGS="web=20260101 worker=20260101"]'
+            base = template("Makefile.tmpl", "STACK" => plan.infra_name, "DEPLOY_HINT" => hint,
+                                             "RDS_STACK" => plan.rds_stack, "BOX_STACK" => plan.box_stack,
+                                             "DEPLOY_RECIPE" => RollRecipe.deploy(plan))
+            plan.hosting ? "#{base}\ninclude hosting.mk\n" : base
+          end
+
+          private
+
+          def schema_list(migration)
+            migration.schemas.map { |name| "`#{name}`" }.join(", ")
+          end
+
+          def deploy_command(plan)
+            plan.task_definition ? "make deploy TASKDEF=#{plan.task_definition}:<revision>" : "make deploy"
+          end
+
+          def guarded_probes(header)
+            [
+              "S=$(grep ^ORIGIN_SECRET= caddy.secrets.env | cut -d= -f2-)",
+              health_probe("a request without the origin secret is refused", "", '[ "$code" = 403 ]'),
+              health_probe("a request with the origin secret is served", %( -H "#{header}: $S"),
+                           '[ "${code#5}" = "$code" ]')
+            ]
+          end
+
+          def health_probe(label, args, wanted)
+            write_out = '-w "%{http_code}"' # rubocop:disable Style/FormatStringToken -- curl's own token
+            <<~SH.chomp
+              code=$(curl -s -o /dev/null #{write_out} --max-time 40 localhost/#{args})
+              #{wanted} && echo "ok   #{label} -> $code" || { echo "FAIL #{label} -> $code"; BAD=1; }
+            SH
+          end
+        end
+      end
+    end
+  end
+end

data/lib/hecks/projections/deploy/box/settings/checks.rb

@@ -0,0 +1,38 @@
+module Hecks
+  module Projections
+    module Deploy
+      module Box
+        module Settings
+          # The checks every box setting goes through: a pattern, a bounded integer, a boolean, a
+          # map of strings. Extended onto `Settings`; each raises `ArgumentError` naming the
+          # setting.
+          module Checks
+            def string_map(key, value, key_pattern, value_pattern)
+              raise ArgumentError, "#{key}: expected a hash" unless value.is_a?(Hash)
+
+              value.to_h { |k, v| [check(key, k.to_s, key_pattern), check(key, v.to_s, value_pattern)] }
+            end
+
+            def check(key, value, pattern)
+              return value if value.is_a?(String) && value.match?(pattern)
+
+              raise ArgumentError, "#{key}: #{value.inspect} does not match #{pattern.inspect}"
+            end
+
+            def integer(key, value, low, high)
+              return value if value.is_a?(Integer) && value.between?(low, high)
+
+              raise ArgumentError, "#{key}: #{value.inspect} must be an integer from #{low} to #{high}"
+            end
+
+            def boolean(key, value)
+              return value if [true, false].include?(value)
+
+              raise ArgumentError, "#{key}: #{value.inspect} must be true or false"
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/hecks/projections/deploy/box/settings/containers.rb

@@ -0,0 +1,123 @@
+require_relative "patterns"
+require_relative "types"
+require_relative "../hosting_settings"
+
+module Hecks
+  module Projections
+    module Deploy
+      module Box
+        module Settings
+          # Reads the containers a box runs and what points at them: routes, the default, a tunnel.
+          # Extended onto `Settings`, which supplies the checks.
+          module ContainerReaders
+            include Patterns
+            include Types
+
+            def read_containers(list, infra_name)
+              raise ArgumentError, missing_containers unless list.is_a?(Array) && !list.empty?
+
+              containers = list.map { |c| read_container(c, infra_name) }
+              reject_repeat!(containers.map(&:name)) { |dup| "containers: two containers are named #{dup.inspect}" }
+              reject_repeat!(containers.map(&:port)) do |clash|
+                "containers: two containers listen on port #{clash}; they share the box's network"
+              end
+              containers
+            end
+
+            def read_container(spec, infra_name)
+              raise ArgumentError, "containers: each container is a hash, got #{spec.inspect}" unless spec.is_a?(Hash)
+
+              unnamed = spec.fetch(:name) { raise ArgumentError, "containers: a container has no name" }
+              name = check(:container_name, unnamed, NAME)
+              Container.new(name: name, **container_fields(spec, name, infra_name))
+            end
+
+            # @param name [String] a container name such as `web-app`
+            # @return [String] the image-tag parameter a stack names it by, such as `WebAppImageTag`
+            def default_tag_parameter(name)
+              "#{name.split("-").map(&:capitalize).join}ImageTag"
+            end
+
+            def read_routes(list, containers)
+              raise ArgumentError, "routes: expected a list" unless list.is_a?(Array)
+
+              list.map { |spec| read_route(spec, containers) }
+            end
+
+            def read_route(spec, containers)
+              container = spec.fetch(:container) { raise ArgumentError, "routes: a route has no container" }
+              name = check(:route_container, container, NAME)
+              known_container!(:routes, name, containers)
+              paths = Array(spec.fetch(:paths) { raise ArgumentError, "routes: the route for #{name} has no paths" })
+              raise ArgumentError, "routes: the route for #{name} has no paths" if paths.empty?
+
+              Route.new(container: name, paths: paths.map { |p| check(:path, p, URL_PATH) })
+            end
+
+            def read_default(name, containers)
+              return containers.first.name if name.nil? && containers.size == 1
+              raise ArgumentError, "default_container: name the container that answers every other path" if name.nil?
+
+              known_container!(:default_container, check(:default_container, name, NAME), containers)
+            end
+
+            def known_container!(key, name, containers)
+              return name if containers.any? { |c| c.name == name }
+
+              raise ArgumentError, "#{key}: #{name.inspect} is not a declared container"
+            end
+
+            # `tunnel true` only opens the outbound port; a hash also runs cloudflared as a service.
+            #
+            # @param value [Boolean, Hash{Symbol => Object}] the world's `tunnel` setting
+            # @param containers [Array<Container>] the declared containers
+            # @return [Array(Boolean, Tunnel)] whether the egress opens, and the service if one runs
+            def read_tunnel(value, containers)
+              return [boolean(:tunnel, value), nil] unless value.is_a?(Hash)
+
+              to = value.fetch(:to) { raise ArgumentError, TUNNEL_SHAPE }
+              target = known_container!(:tunnel, check(:tunnel_to, to, NAME), containers)
+              token = check(:tunnel_token_secret, value.fetch(:token_secret) { raise ArgumentError, TUNNEL_SHAPE }, SECRET_NAME)
+              image = check(:tunnel_image, value.fetch(:image, TUNNEL_IMAGE), IMAGE)
+              port = containers.find { |c| c.name == target }.port
+              [true, Tunnel.new(container: target, port: port, token_secret: token, image: image)]
+            end
+
+            def missing_containers
+              <<~MSG
+                deployed_to("AwsBox") needs at least one container. Add one, e.g.:
+
+                    deployed_to("AwsBox") do
+                      region "us-east-1"
+                      containers [{ name: "web", port: 8080 }]
+                    end
+              MSG
+            end
+
+            private
+
+            def reject_repeat!(values)
+              repeated = values.find { |value| values.count(value) > 1 }
+              raise ArgumentError, yield(repeated) if repeated
+            end
+
+            def port_of(spec, name)
+              spec.fetch(:port) { raise ArgumentError, "containers: #{name} has no port" }
+            end
+
+            def container_fields(spec, name, infra_name)
+              {
+                repository:    check(:repository, spec.fetch(:repository, "#{infra_name}-#{name}"), REPOSITORY),
+                port:          integer(:port, port_of(spec, name), 1, 65_535),
+                env:           string_map(:env, spec.fetch(:env, {}), ENV_KEY, ENV_VALUE),
+                secrets:       string_map(:secrets, spec.fetch(:secrets, {}), ENV_KEY, SECRET_NAME),
+                tag_parameter: check(:tag_parameter, spec.fetch(:tag_parameter, default_tag_parameter(name)),
+                                     HostingSettings::PARAMETER)
+              }
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/hecks/projections/deploy/box/settings/origin.rb

@@ -0,0 +1,56 @@
+require_relative "patterns"
+
+module Hecks
+  module Projections
+    module Deploy
+      module Box
+        module Settings
+          # Reads the settings that guard and scope the box's secrets: the origin header and secret,
+          # the variables that hold it, and the secret name prefixes. Extended onto `Settings`,
+          # which supplies the checks.
+          module OriginReaders
+            include Patterns
+
+            def read_origin(settings)
+              header = settings[:origin_header]
+              secret = settings[:origin_secret]
+              return [nil, nil] if header.nil? && secret.nil?
+              raise ArgumentError, ORIGIN_PAIR if header.nil? || secret.nil?
+
+              [check(:origin_header, header, HEADER), check(:origin_secret, secret, SECRET_NAME)]
+            end
+
+            # The container environment variables that hold the origin secret in the task
+            # definition. Only Caddy reads the named secret; the containers keep the task
+            # definition's copy, so a copy that differs makes every request through the CDN
+            # fail. Naming them lets deploy refuse a mismatch.
+            #
+            # @param settings [Hash{Symbol => Object}] the world's `AwsBox` settings
+            # @param secret [String, nil] the declared origin secret
+            # @param task_definition [String, nil] the declared task definition family
+            # @return [Array<String>] the variable names, empty when none are declared
+            # @raise [ArgumentError] when named without an origin secret and a task definition
+            def read_origin_env(settings, secret, task_definition)
+              names = Array(settings.fetch(:origin_env, []))
+              return [] if names.empty?
+              raise ArgumentError, ORIGIN_ENV_SHAPE if secret.nil? || task_definition.nil?
+
+              names.map { |name| check(:origin_env, name, ENV_KEY) }.uniq
+            end
+
+            def read_prefixes(settings, infra_name)
+              list = Array(settings.fetch(:secret_prefixes, ["#{infra_name}/*"]))
+              list.map { |p| check(:secret_prefixes, p, SECRET_NAME) }
+            end
+
+            # Secrets the box may overwrite, such as one an admin page stores a key in. Production
+            # only: a rehearsal box never changes a secret.
+            def read_writable_secrets(settings)
+              Array(settings.fetch(:writable_secrets, [])).map { |name| check(:writable_secrets, name, SECRET_NAME) }
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/hecks/projections/deploy/box/settings/patterns.rb

@@ -0,0 +1,43 @@
+module Hecks
+  module Projections
+    module Deploy
+      module Box
+        module Settings
+          # The patterns a world's value must match, and the defaults and refusal messages of the
+          # box settings. Included into `Settings`, so each constant reads as `Settings::NAME`.
+          module Patterns
+            NAME        = /\A[a-z][a-z0-9-]{0,40}\z/
+            REPOSITORY  = %r{\A[a-z0-9][a-z0-9._/-]{1,100}\z}
+            URL_PATH    = %r{\A/[A-Za-z0-9._~!$&'()*+,;=:@%/-]*\z}
+            SECRET_NAME = %r{\A[A-Za-z0-9/_+=.@-]{1,256}\*?\z}
+            ENV_KEY     = /\A[A-Za-z_][A-Za-z0-9_]*\z/
+            ENV_VALUE   = /\A[^\x00-\x1f\x7f]*\z/
+            HEADER      = /\A[A-Za-z][A-Za-z0-9-]{0,63}\z/
+            DB_NAME     = /\A[a-zA-Z][a-zA-Z0-9]{0,62}\z/
+            ENGINE      = /\A\d{2}(\.\d{1,2})?\z/
+            PREFIX      = /\A[a-z][a-z0-9-]{0,20}\z/
+            IMAGE       = %r{\A[a-z0-9][a-z0-9._/:@-]{1,200}\z}
+            TASKDEF     = /\A[a-zA-Z0-9_-]{1,255}\z/
+            SCHEMA      = /\A[a-z][a-z0-9_]{0,62}\z/
+            MIGRATION_SHAPE = "migration: a hash needs `schemas`, a list of the schema names to copy".freeze
+            S3_BUCKET   = /\A[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]\z/
+            S3_SHAPE    = "s3_access: a list of `{ bucket: \"name\", write: true }` hashes (write is optional)".freeze
+            FROM_TASKDEF = %i[env secrets repository].freeze
+            # Default images, each a version tag plus the digest of its multi-architecture index,
+            # so a rebuilt box pulls the same bytes.
+            TUNNEL_IMAGE = "cloudflare/cloudflared:2026.9.3" \
+                           "@sha256:072c067d25ccbe61d46e18f0d0723255f2bb5304f7317caa95b27031520ff92c".freeze
+            PROXY_IMAGE  = "public.ecr.aws/docker/library/caddy:2.8" \
+                           "@sha256:226d1f059b75399fe19182893c7184591c07b97afc8dfcf44eeb80c9a77a530f".freeze
+            TUNNEL_SHAPE = "tunnel: a hash needs `to` (the container it forwards to) and `token_secret` " \
+                           "(the secret holding the tunnel token)".freeze
+            ORIGIN_ENV_SHAPE = "origin_env: the container environment variable names that hold the origin secret " \
+                               "need an origin_secret and a task_definition to compare against".freeze
+            ORIGIN_PAIR = "origin_header and origin_secret go together: the header a CDN sends, " \
+                          "and the secret that holds its value".freeze
+          end
+        end
+      end
+    end
+  end
+end

data/lib/hecks/projections/deploy/box/settings/types.rb

@@ -0,0 +1,72 @@
+module Hecks
+  module Projections
+    module Deploy
+      module Box
+        module Settings
+          # The values a resolved box plan is made of. Included into `Settings`, so each reads as
+          # `Settings::Container`, `Settings::Plan` and so on.
+          module Types
+            # One container the box runs: its image repository, its port and its settings.
+            #
+            # @!attribute [r] name [String] the compose service name
+            # @!attribute [r] repository [String] the ECR repository holding its images
+            # @!attribute [r] port [Integer] the port it listens on, on the box's own network
+            # @!attribute [r] env [Hash{String => String}] plain environment variables
+            # @!attribute [r] secrets [Hash{String => String}] environment variable => secret name,
+            #   resolved on the box at deploy time and never written into a template
+            # @!attribute [r] tag_parameter [String] the stack parameter that holds this container's
+            #   image tag, which a hosting `deploy-service.sh` sets
+            Container = Struct.new(:name, :repository, :port, :env, :secrets, :tag_parameter, keyword_init: true)
+
+            # A set of URL paths one container serves.
+            #
+            # @!attribute [r] container [String] the container's name
+            # @!attribute [r] paths [Array<String>] Caddy path patterns, such as "/cms/*"
+            Route = Struct.new(:container, :paths, keyword_init: true)
+
+            # A Cloudflare tunnel the box runs as a service, pointed at one container.
+            #
+            # @!attribute [r] container [String] the container the tunnel forwards to
+            # @!attribute [r] port [Integer] that container's port
+            # @!attribute [r] token_secret [String] the secret holding the tunnel token
+            # @!attribute [r] image [String] the cloudflared image
+            Tunnel = Struct.new(:container, :port, :token_secret, :image, keyword_init: true)
+
+            # The data a project moves from its old database into the new RDS instance.
+            #
+            # @!attribute [r] schemas [Array<String>] the schemas to copy
+            # @!attribute [r] database [String] the database holding them on the RDS instance
+            # @!attribute [r] source_database [String] the database holding them on the old server
+            Migration = Struct.new(:schemas, :database, :source_database, keyword_init: true)
+
+            # An S3 bucket the box's role may read, and in production write.
+            #
+            # @!attribute [r] name [String] the bucket's name
+            # @!attribute [r] write [Boolean] whether a production box may also write and delete
+            Bucket = Struct.new(:name, :write, keyword_init: true)
+
+            # Everything the generator reads, checked.
+            Plan = Struct.new(
+              :infra_name, :stack_prefix, :instance_type, :volume_gb, :swap_gb, :database_class,
+              :storage_gb, :backup_days, :snapshots_keep, :database_name, :engine_version,
+              :containers, :routes, :default_container, :origin_header, :origin_secret,
+              :secret_prefixes, :writable_secrets, :origin_env, :tunnel, :tunnel_service, :proxy_image,
+              :task_definition, :migration, :s3_buckets, :hosting, keyword_init: true
+            ) do
+              # @return [String] the CloudFormation stack that holds the database
+              def rds_stack = "#{stack_prefix}-#{infra_name}-rds"
+
+              # @return [String] the CloudFormation stack that holds the box
+              def box_stack = "#{stack_prefix}-#{infra_name}-box"
+
+              # @return [Container] the container that answers every path no route claims
+              def default
+                containers.find { |c| c.name == default_container }
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end