kdeploy 1.3.4 → 1.4.1

data/lib/kdeploy/dsl/dsl.rb

@@ -22,12 +22,132 @@ module Kdeploy
     end
   end
 
+  # Per-invocation collector so parallel hosts do not race on DSL ivars.
+  class TaskContext
+    def initialize(dsl, commands, on_failure_commands, vars)
+      @dsl = dsl
+      @commands = commands
+      @on_failure_commands = on_failure_commands
+      @vars = vars.transform_keys(&:to_sym)
+      @failure_mode = false
+    end
+
+    def on_failure(&block)
+      raise ArgumentError, 'on_failure requires a block' unless block
+
+      previous = @failure_mode
+      @failure_mode = true
+      instance_eval(&block)
+    ensure
+      @failure_mode = previous
+    end
+
+    def run(command, sudo: nil)
+      buf << { type: :run, command: interpolate(command), sudo: sudo }
+    end
+
+    def upload(source, destination)
+      buf << { type: :upload, source: interpolate(source), destination: interpolate(destination) }
+    end
+
+    def upload_template(source, destination, variables = {})
+      buf << {
+        type: :upload_template,
+        source: interpolate(source),
+        destination: interpolate(destination),
+        variables: interpolate_hash(variables)
+      }
+    end
+
+    def sync(source, destination, ignore: [], delete: false, exclude: [], fast: nil, parallel: nil)
+      buf << {
+        type: :sync,
+        source: interpolate(source),
+        destination: interpolate(destination),
+        ignore: Array(ignore).map { |p| interpolate(p.to_s) },
+        exclude: Array(exclude).map { |p| interpolate(p.to_s) },
+        delete: delete,
+        fast: fast,
+        parallel: parallel
+      }
+    end
+
+    def package(name, version: nil, platform: :apt)
+      cmd = @dsl.build_package_command(interpolate(name.to_s), version && interpolate(version.to_s), platform)
+      buf << { type: :run, command: cmd, sudo: true }
+    end
+
+    def service(name, action: :start)
+      Array(action).each do |a|
+        cmd = "systemctl #{a} #{Shellwords.escape(interpolate(name.to_s))}"
+        buf << { type: :run, command: cmd, sudo: true }
+      end
+    end
+
+    def template(destination, source: nil, variables: nil, &block)
+      if block
+        opts = TemplateOptions.new
+        opts.instance_eval(&block)
+        src = opts.source || raise(ArgumentError, 'template requires source')
+        vars = opts.variables || {}
+      else
+        raise ArgumentError, 'template requires source' unless source
+
+        src = source
+        vars = variables || {}
+      end
+      upload_template(src, destination, vars)
+    end
+
+    def file(destination, source:)
+      upload(source, destination)
+    end
+
+    def directory(path, mode: nil)
+      cmd = "mkdir -p #{Shellwords.escape(interpolate(path.to_s))}"
+      buf << { type: :run, command: cmd, sudo: true }
+      return unless mode
+
+      buf << { type: :run, command: "chmod #{mode} #{Shellwords.escape(interpolate(path.to_s))}", sudo: true }
+    end
+
+    def wait_port(port, timeout: 30, interval: 1)
+      buf << {
+        type: :wait_port,
+        port: port.to_i,
+        timeout: timeout.to_f,
+        interval: interval.to_f
+      }
+    end
+
+    def wait_http(url, timeout: 30, interval: 1, code: 200)
+      buf << {
+        type: :wait_http,
+        url: interpolate(url),
+        timeout: timeout.to_f,
+        interval: interval.to_f,
+        code: code.to_i
+      }
+    end
+
+    private
+
+    def buf
+      @failure_mode ? @on_failure_commands : @commands
+    end
+
+    def interpolate(value)
+      @dsl.interpolate_string(value, @vars)
+    end
+
+    def interpolate_hash(hash)
+      hash.to_h.transform_values { |v| v.is_a?(String) ? interpolate(v) : v }
+    end
+  end
+
   # Domain-specific language for defining hosts, roles, and tasks
   module DSL
     def self.included(base)
-      # Support `include Kdeploy::DSL` by promoting the DSL methods to class methods.
-      # This keeps tests and external integrations simpler while preserving the
-      # primary usage pattern (CLI uses `extend DSL`).
       base.extend(self)
     end
 
@@ -35,10 +155,9 @@ module Kdeploy
       base.instance_variable_set(:@kdeploy_hosts, {})
       base.instance_variable_set(:@kdeploy_tasks, {})
       base.instance_variable_set(:@kdeploy_roles, {})
+      base.instance_variable_set(:@kdeploy_vars, {})
     end
 
-    # Stable read accessors for tests/integrations.
-    # Keep these as aliases so internal storage can evolve without breaking callers.
     def hosts
       kdeploy_hosts
     end
@@ -63,6 +182,44 @@ module Kdeploy
       @kdeploy_roles ||= {}
     end
 
+    def kdeploy_vars
+      @kdeploy_vars ||= {}
+    end
+
+    def clear_inventory!
+      kdeploy_hosts.clear
+      kdeploy_roles.clear
+      kdeploy_tasks.clear
+      kdeploy_vars.clear
+    end
+
+    def vars(hash = nil, **kwargs)
+      merged = {}
+      merged.merge!(hash) if hash.is_a?(Hash)
+      merged.merge!(kwargs)
+      merged.each { |k, v| kdeploy_vars[k.to_sym] = v }
+      kdeploy_vars
+    end
+
+    def merge_extra_vars!(extra)
+      return if extra.nil? || extra.empty?
+
+      extra.each { |k, v| kdeploy_vars[k.to_sym] = v }
+    end
+
+    def interpolate_string(value, local_vars = {})
+      return value unless value.is_a?(String)
+      return value unless value.include?('%{')
+
+      binding_vars = kdeploy_vars.merge(local_vars.transform_keys(&:to_sym))
+      value.gsub(/%\{(\w+)\}/) do
+        key = Regexp.last_match(1).to_sym
+        raise ArgumentError, "Unknown variable %{#{key}}" unless binding_vars.key?(key)
+
+        binding_vars[key].to_s
+      end
+    end
+
     def host(name, **options)
       kdeploy_hosts[name] = options.merge(name: name)
     end
@@ -71,46 +228,37 @@ module Kdeploy
       kdeploy_roles[name] = hosts
     end
 
-    def task(name, on: nil, roles: nil, &block)
+    def task(name, on: nil, roles: nil, tags: nil, &block)
       kdeploy_tasks[name] = {
         hosts: normalize_hosts_option(on),
         roles: normalize_roles_option(roles),
+        tags: normalize_tags_option(tags),
         block: create_task_block(block)
       }
     end
 
-    # Assign task to roles or hosts after task definition
-    def assign_task(task_name, on: nil, roles: nil)
+    def assign_task(task_name, on: nil, roles: nil, tags: nil)
       task = kdeploy_tasks[task_name.to_sym]
       raise ArgumentError, "Task #{task_name} not found" unless task
 
       task[:hosts] = normalize_hosts_option(on) if on
       task[:roles] = normalize_roles_option(roles) if roles
+      task[:tags] = normalize_tags_option(tags) if tags
     end
 
-    # Include task file and automatically assign all tasks to specified roles or hosts
     def include_tasks(file_path, roles: nil, on: nil)
-      # Resolve relative paths based on the caller's file location
       unless File.absolute_path?(file_path)
         caller_file = caller_locations(1, 1).first.path
         base_dir = File.dirname(File.expand_path(caller_file))
         file_path = File.expand_path(file_path, base_dir)
       end
 
-      # Store tasks before loading
       tasks_before = kdeploy_tasks.keys
-
-      # Load the task file
       module_eval(File.read(file_path), file_path)
+      new_tasks = kdeploy_tasks.keys - tasks_before
 
-      # Get newly added tasks
-      tasks_after = kdeploy_tasks.keys
-      new_tasks = tasks_after - tasks_before
-
-      # Assign roles/hosts to all new tasks (only if task doesn't already have hosts/roles)
       new_tasks.each do |task_name|
         task = kdeploy_tasks[task_name]
-        # Only assign if task doesn't already have hosts or roles defined
         next if task[:hosts] || task[:roles]
 
         assign_task(task_name, roles: roles, on: on) if roles || on
@@ -119,7 +267,6 @@ module Kdeploy
 
     def normalize_hosts_option(on)
       return on if on.is_a?(Array)
-
       return [on] if on
 
       nil
@@ -127,106 +274,40 @@ module Kdeploy
 
     def normalize_roles_option(roles)
       return roles if roles.is_a?(Array)
-
       return [roles] if roles
 
       nil
     end
 
-    def create_task_block(block)
-      lambda {
-        @kdeploy_commands = []
-        instance_eval(&block)
-        @kdeploy_commands
-      }
-    end
+    def normalize_tags_option(tags)
+      return nil if tags.nil?
 
-    def run(command, sudo: nil)
-      @kdeploy_commands ||= []
-      @kdeploy_commands << { type: :run, command: command, sudo: sudo }
+      Array(tags).map { |t| t.to_s.to_sym }
     end
 
-    def upload(source, destination)
-      @kdeploy_commands ||= []
-      @kdeploy_commands << { type: :upload, source: source, destination: destination }
-    end
-
-    def upload_template(source, destination, variables = {})
-      @kdeploy_commands ||= []
-      @kdeploy_commands << {
-        type: :upload_template,
-        source: source,
-        destination: destination,
-        variables: variables
-      }
-    end
-
-    def sync(source, destination, ignore: [], delete: false, exclude: [], fast: nil, parallel: nil)
-      @kdeploy_commands ||= []
-      @kdeploy_commands << {
-        type: :sync,
-        source: source,
-        destination: destination,
-        ignore: Array(ignore),
-        exclude: Array(exclude),
-        delete: delete,
-        fast: fast,
-        parallel: parallel
+    def create_task_block(block)
+      dsl = self
+      lambda {
+        commands = []
+        on_failure = []
+        ctx = TaskContext.new(dsl, commands, on_failure, dsl.kdeploy_vars.dup)
+        ctx.instance_eval(&block)
+        { commands: commands, on_failure: on_failure }
       }
     end
 
-    # -------------------------------------------------------------------------
-    # Chef-style resource DSL (compiles to run/upload/upload_template)
-    # -------------------------------------------------------------------------
-
-    # Install a system package. Defaults to apt; supports platform: :yum.
-    def package(name, version: nil, platform: :apt)
-      @kdeploy_commands ||= []
-      cmd = build_package_command(name, version, platform)
-      @kdeploy_commands << { type: :run, command: cmd, sudo: true }
-    end
-
-    # Manage a systemd service. action supports :start, :stop, :restart, :reload, :enable, :disable.
-    def service(name, action: :start)
-      @kdeploy_commands ||= []
-      actions = Array(action)
-      actions.each do |a|
-        cmd = "systemctl #{a} #{Shellwords.escape(name.to_s)}"
-        @kdeploy_commands << { type: :run, command: cmd, sudo: true }
-      end
-    end
-
-    # Deploy an ERB template to a remote path. Supports block and keyword args.
-    def template(destination, source: nil, variables: nil, &block)
-      @kdeploy_commands ||= []
-      if block
-        opts = TemplateOptions.new
-        opts.instance_eval(&block)
-        src = opts.source || raise(ArgumentError, 'template requires source')
-        vars = opts.variables || {}
+    def self.normalize_plan(raw)
+      case raw
+      when Hash
+        {
+          commands: Array(raw[:commands] || raw['commands']),
+          on_failure: Array(raw[:on_failure] || raw['on_failure'])
+        }
+      when Array
+        { commands: raw, on_failure: [] }
       else
-        raise ArgumentError, 'template requires source' unless source
-
-        src = source
-        vars = variables || {}
+        { commands: Array(raw), on_failure: [] }
       end
-      upload_template(src, destination, vars)
-    end
-
-    # Upload a local file to a remote path.
-    def file(destination, source:)
-      @kdeploy_commands ||= []
-      upload(source, destination)
-    end
-
-    # Ensure a remote directory exists. Supports mode option.
-    def directory(path, mode: nil)
-      @kdeploy_commands ||= []
-      cmd = "mkdir -p #{Shellwords.escape(path.to_s)}"
-      @kdeploy_commands << { type: :run, command: cmd, sudo: true }
-      return unless mode
-
-      @kdeploy_commands << { type: :run, command: "chmod #{mode} #{Shellwords.escape(path.to_s)}", sudo: true }
     end
 
     def inventory(&block)
@@ -243,23 +324,43 @@ module Kdeploy
       hosts.to_a
     end
 
+    def tasks_matching_tags(tag_list)
+      wanted = Array(tag_list).map { |t| t.to_s.to_sym }
+      return kdeploy_tasks.keys if wanted.empty?
+
+      kdeploy_tasks.select do |_name, task|
+        task[:tags]&.any? { |t| wanted.include?(t) }
+      end.keys
+    end
+
     def task_empty?(task)
       !task || (!task[:hosts] && !task[:roles])
     end
 
     def add_explicit_hosts(task, hosts)
       task[:hosts]&.each do |host|
-        hosts.add(host) if kdeploy_hosts.key?(host)
+        if kdeploy_hosts.key?(host)
+          hosts.add(host)
+        else
+          warn "Warning: task host not in inventory (skipped): #{host}"
+        end
       end
     end
 
     def add_role_hosts(task, hosts)
       task[:roles]&.each do |role|
         role_hosts = kdeploy_roles[role]
-        next unless role_hosts
+        unless role_hosts
+          warn "Warning: task role not defined (skipped): #{role}"
+          next
+        end
 
         role_hosts.each do |host|
-          hosts.add(host) if kdeploy_hosts.key?(host)
+          if kdeploy_hosts.key?(host)
+            hosts.add(host)
+          else
+            warn "Warning: role #{role} host not in inventory (skipped): #{host}"
+          end
         end
       end
     end

data/lib/kdeploy/dsl/initializer.rb

@@ -13,6 +13,7 @@ module Kdeploy
       create_directory_structure
       create_deploy_file
       create_config_files
+      create_kdeploy_yml
       create_readme
       show_success_message
     end
@@ -165,6 +166,20 @@ module Kdeploy
       CONF
     end
 
+    def create_kdeploy_yml
+      path = File.join(@target_dir, '.kdeploy.yml')
+      return if File.exist?(path)
+
+      File.write(path, <<~YAML)
+        # Kdeploy project config (see SECURITY.md in the kdeploy repo)
+        parallel: 10
+        ssh_timeout: 30
+        # Library default is accept_new (safer). Use never only for ephemeral labs.
+        verify_host_key: accept_new
+        retries: 0
+      YAML
+    end
+
     def create_readme
       File.write(File.join(@target_dir, 'README.md'), <<~MD)
         # Deployment Project
@@ -215,6 +230,10 @@ module Kdeploy
 
         See the main documentation for more details on sudo usage.
 
+        ## Security
+
+        Default `verify_host_key` is `accept_new`. Use `always` for strict known_hosts, or `never` only for ephemeral labs.
+
         ## 🚀 Usage
 
         ### Task Execution
@@ -283,6 +302,7 @@ module Kdeploy
         #{pastel.dim("  #{File.join(@target_dir, 'config/nginx.conf.erb')}")}
         #{pastel.dim("  #{File.join(@target_dir, 'config/app.conf')}")}
         #{pastel.dim("  #{File.join(@target_dir, 'README.md')}")}
+        #{pastel.dim("  #{File.join(@target_dir, '.kdeploy.yml')}")}
 
         #{pastel.bright_white('Try running:')}
         #{pastel.bright_cyan("  kdeploy execute #{File.join(@target_dir, 'deploy.rb')} deploy_web --dry-run")}

data/lib/kdeploy/executor/command_executor.rb

@@ -1,6 +1,9 @@
 # frozen_string_literal: true
 
 require 'timeout'
+require 'socket'
+require 'uri'
+require 'net/http'
 
 module Kdeploy
   # Executes a single command and records execution time
@@ -83,6 +86,32 @@ module Kdeploy
       build_sync_result(source, destination, result, duration)
     end
 
+    def execute_wait_port(command, _host_name)
+      port = command[:port]
+      timeout = command[:timeout] || 30
+      interval = command[:interval] || 1
+      ip = @executor.host_ip
+      _result, duration = measure_time do
+        with_timeout { wait_until(timeout, interval, "port #{ip}:#{port}") { port_open?(ip, port) } }
+      end
+      { command: "wait_port: #{ip}:#{port}", duration: duration, type: :wait_port }
+    end
+
+    # -- runtime %{ip}/%{host} placeholders
+    def execute_wait_http(command, host_name)
+      url = command[:url].to_s.gsub('%{ip}', @executor.host_ip.to_s).gsub('%{host}', host_name.to_s)
+      # rubocop:enable Style/FormatStringToken
+      timeout = command[:timeout] || 30
+      interval = command[:interval] || 1
+      expect_code = command[:code] || 200
+      _result, duration = measure_time do
+        with_timeout do
+          wait_until(timeout, interval, "http #{url}") { http_ok?(url, expect_code) }
+        end
+      end
+      { command: "wait_http: #{url} (#{expect_code})", duration: duration, type: :wait_http }
+    end
+
     private
 
     def build_sync_result(source, destination, result, duration)
@@ -112,7 +141,7 @@ module Kdeploy
         attempts += 1
         yield
       rescue SSHError, SCPError, TemplateError => e
-        raise if e.is_a?(SSHError) && e.exit_status && !retry_on_exit_status?(e.exit_status, exit_codes)
+        raise unless retryable_error?(e, exit_codes)
         raise if attempts > (max_retries + 1)
 
         sleep(@retry_delay) if @retry_delay.positive?
@@ -120,14 +149,61 @@ module Kdeploy
       end
     end
 
+    def retryable_error?(error, exit_codes)
+      return true unless error.is_a?(SSHError)
+      return retry_on_exit_status?(error.exit_status, exit_codes) if error.exit_status
+
+      !authentication_error?(error)
+    end
+
+    def authentication_error?(error)
+      original = error.respond_to?(:original_error) ? error.original_error : nil
+      return true if original && original.class.name.include?('AuthenticationFailed')
+
+      error.message.match?(/authentication failed/i)
+    end
+
     def with_timeout(&block)
       return yield unless @step_timeout&.positive?
 
       Timeout.timeout(@step_timeout, &block)
     rescue Timeout::Error
+      @executor.abort! if @executor.respond_to?(:abort!)
       raise StepTimeoutError, "exceeded #{@step_timeout}s"
     end
 
+    def wait_until(timeout, interval, label)
+      deadline = Time.now + timeout.to_f
+      loop do
+        return true if yield
+        raise StepTimeoutError, "#{label} not ready within #{timeout}s" if Time.now >= deadline
+
+        sleep([interval.to_f, 0.1].max)
+      end
+    end
+
+    def port_open?(ip, port)
+      Socket.tcp(ip, port, connect_timeout: 2) { true }
+    rescue StandardError
+      false
+    end
+
+    def http_ok?(url, expect_code)
+      uri = URI.parse(url)
+      response = Net::HTTP.start(
+        uri.host,
+        uri.port,
+        use_ssl: uri.scheme == 'https',
+        open_timeout: 2,
+        read_timeout: 2
+      ) do |http|
+        http.request(Net::HTTP::Get.new(uri.request_uri))
+      end
+      response.code.to_i == expect_code.to_i
+    rescue StandardError
+      false
+    end
+
     def retries_for(step_type)
       return @retries unless @retry_policy.is_a?(Hash) && step_type