@automattic/vip 4.1.5 → 4.1.6

package/internal/devenv/proxy/network_test.go

@@ -1,68 +0,0 @@
-package proxy
-
-import (
-	"context"
-	"strings"
-	"testing"
-)
-
-func TestPortsStatePathUnderXDG(t *testing.T) {
-	t.Setenv("XDG_DATA_HOME", "/data")
-	want := "/data/vip/dev-env/proxy-ports.json"
-	if got := PortsStatePath(); got != want {
-		t.Fatalf("PortsStatePath = %q, want %q", got, want)
-	}
-}
-
-// fakeRunner records docker invocations and lets a test script their outcome.
-type fakeRunner struct {
-	calls   [][]string
-	failSub string // if a docker arg list contains this, Docker returns err
-}
-
-func (f *fakeRunner) Docker(ctx context.Context, args ...string) error {
-	f.calls = append(f.calls, args)
-	if f.failSub != "" {
-		for _, a := range args {
-			if strings.Contains(a, f.failSub) {
-				return errDocker
-			}
-		}
-	}
-	return nil
-}
-
-// DockerOut mirrors Docker's scripting: a matching failSub errors, otherwise
-// empty stdout (no proxy container -> IsRunning false).
-func (f *fakeRunner) DockerOut(ctx context.Context, args ...string) ([]byte, error) {
-	return nil, f.Docker(ctx, args...)
-}
-
-func TestEnsureNetworkCreatesWhenMissing(t *testing.T) {
-	// network inspect fails (missing) -> network create is issued.
-	r := &fakeRunner{failSub: "inspect"}
-	if err := EnsureNetwork(context.Background(), r); err != nil {
-		t.Fatalf("EnsureNetwork: %v", err)
-	}
-	var sawCreate bool
-	for _, c := range r.calls {
-		if len(c) >= 2 && c[0] == "network" && c[1] == "create" {
-			sawCreate = true
-		}
-	}
-	if !sawCreate {
-		t.Fatalf("expected network create, calls=%v", r.calls)
-	}
-}
-
-func TestEnsureNetworkNoopWhenPresent(t *testing.T) {
-	r := &fakeRunner{} // inspect succeeds -> no create
-	if err := EnsureNetwork(context.Background(), r); err != nil {
-		t.Fatal(err)
-	}
-	for _, c := range r.calls {
-		if len(c) >= 2 && c[0] == "network" && c[1] == "create" {
-			t.Fatalf("should not create when network exists: %v", r.calls)
-		}
-	}
-}

package/internal/devenv/proxy/ports.go

@@ -1,104 +0,0 @@
-// Package proxy manages the shared Traefik reverse proxy (the traefik_openssl
-// image), the shared bridge network, fallback-port selection, and the local CA
-// + per-environment edge certificates for vip dev environments (spec §5/§8).
-// It drives docker through a DockerRunner (the concrete *dockercli.Runner in
-// production). Plan 4 lifecycle entry points: Ensure (start/ensure proxy with
-// bind-retry fallback ports), RemoveOrphan, Cleanup, EnsureCA, EnsureCert (one
-// central leaf cert per env, SANs from compose.CertSANs — the image runs no
-// in-service cert machinery, per Task 1 findings), ExtractCA (CA PEM to the host
-// for trust), and CAHostPath.
-package proxy
-
-import (
-	"encoding/json"
-	"errors"
-	"net"
-	"os"
-	"path/filepath"
-	"strconv"
-
-	"github.com/Automattic/vip/internal/devenv/paths"
-)
-
-// PortsStatePath is where the chosen proxy ports are persisted.
-func PortsStatePath() string {
-	return filepath.Join(paths.XDGData(), "vip", "dev-env", "proxy-ports.json")
-}
-
-// Default ports + fallbacks (parity with lando-proxy/index.js).
-const (
-	DefaultHTTP      = 80
-	DefaultHTTPS     = 443
-	ProxyBindAddress = "127.0.0.1"
-)
-
-var (
-	HTTPFallbacks  = []int{8000, 8080, 8888, 8008}
-	HTTPSFallbacks = []int{444, 4433, 4444, 4443}
-)
-
-// Ports holds the host ports the proxy is bound to.
-type Ports struct {
-	HTTP  int `json:"http"`
-	HTTPS int `json:"https"`
-}
-
-// SelectPort returns the preferred port if free, else the first free fallback.
-// free reports whether a port is bindable; production passes a net.Listen probe.
-// The caller (proxy.Ensure) re-validates via the actual Docker bind.
-func SelectPort(preferred int, fallbacks []int, free func(int) bool) (int, error) {
-	if free(preferred) {
-		return preferred, nil
-	}
-	for _, p := range fallbacks {
-		if free(p) {
-			return p, nil
-		}
-	}
-	return 0, errors.New("proxy: no free port among preferred + fallbacks")
-}
-
-// ListenProbe is the production free-port oracle. For privileged ports (<1024)
-// it is OPTIMISTIC: a non-root process cannot net.Listen on them, but the
-// Docker daemon can bind them, so we defer to the actual Docker bind (and the
-// Ensure bind-retry) as the source of truth (spec §8). For >=1024 it does a
-// real TCP listen on the proxy bind address.
-func ListenProbe(port int) bool {
-	if port < 1024 {
-		return true
-	}
-	ln, err := net.Listen("tcp", net.JoinHostPort(ProxyBindAddress, strconv.Itoa(port)))
-	if err != nil {
-		return false
-	}
-	_ = ln.Close()
-	return true
-}
-
-// SavePorts persists the chosen ports.
-func SavePorts(path string, p Ports) error {
-	if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
-		return err
-	}
-	b, err := json.Marshal(p)
-	if err != nil {
-		return err
-	}
-	return os.WriteFile(path, b, 0o644)
-}
-
-// LoadPorts reads persisted ports; a missing file yields zero Ports, no error.
-func LoadPorts(path string) (Ports, error) {
-	b, err := os.ReadFile(path)
-	if errors.Is(err, os.ErrNotExist) {
-		return Ports{}, nil
-	}
-	if err != nil {
-		return Ports{}, err
-	}
-	var p Ports
-	if err := json.Unmarshal(b, &p); err != nil {
-		return Ports{}, err
-	}
-	return p, nil
-}

package/internal/devenv/proxy/ports_test.go

@@ -1,76 +0,0 @@
-package proxy
-
-import (
-	"path/filepath"
-	"testing"
-)
-
-func TestSelectPortPrefersFirstFree(t *testing.T) {
-	free := func(p int) bool { return p != 80 } // 80 busy, 8000 free
-	got, err := SelectPort(80, []int{8000, 8080}, free)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if got != 8000 {
-		t.Fatalf("got %d, want 8000 (80 busy)", got)
-	}
-}
-
-func TestSelectPortPreferredWhenFree(t *testing.T) {
-	got, err := SelectPort(443, []int{444}, func(int) bool { return true })
-	if err != nil {
-		t.Fatal(err)
-	}
-	if got != 443 {
-		t.Fatalf("got %d, want 443", got)
-	}
-}
-
-func TestSelectPortAllBusy(t *testing.T) {
-	_, err := SelectPort(80, []int{8000}, func(int) bool { return false })
-	if err == nil {
-		t.Fatal("expected error when all candidates busy")
-	}
-}
-
-func TestPortsPersistRoundTrip(t *testing.T) {
-	dir := t.TempDir()
-	path := filepath.Join(dir, "proxy-ports.json")
-	if err := SavePorts(path, Ports{HTTP: 8080, HTTPS: 4433}); err != nil {
-		t.Fatal(err)
-	}
-	got, err := LoadPorts(path)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if got.HTTP != 8080 || got.HTTPS != 4433 {
-		t.Fatalf("round-trip mismatch: %+v", got)
-	}
-}
-
-func TestLoadPortsMissingReturnsZero(t *testing.T) {
-	got, err := LoadPorts(filepath.Join(t.TempDir(), "nope.json"))
-	if err != nil {
-		t.Fatalf("missing file should not error: %v", err)
-	}
-	if got.HTTP != 0 || got.HTTPS != 0 {
-		t.Fatalf("missing file should yield zero Ports, got %+v", got)
-	}
-}
-
-func TestSelectPortNoFallbacksAllBusy(t *testing.T) {
-	if _, err := SelectPort(80, nil, func(int) bool { return false }); err == nil {
-		t.Fatal("expected error with no fallbacks and preferred busy")
-	}
-}
-
-func TestListenProbeOptimisticForPrivilegedPorts(t *testing.T) {
-	// Ports <1024 are reported free (let Docker + retry decide), regardless of
-	// whether this non-root test process could bind them.
-	if !ListenProbe(80) {
-		t.Fatal("ListenProbe(80) should be optimistic (privileged port)")
-	}
-	if !ListenProbe(443) {
-		t.Fatal("ListenProbe(443) should be optimistic (privileged port)")
-	}
-}

package/internal/devenv/proxy/proxy.go

@@ -1,143 +0,0 @@
-package proxy
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"strings"
-)
-
-// EnsureOptions configures an Ensure call. Domain is used in Traefik env vars.
-// free is an unexported probe so in-package tests can inject a stub; when nil,
-// production falls back to ListenProbe.
-type EnsureOptions struct {
-	Domain string
-	free   func(int) bool
-}
-
-// containerState is the shared proxy container's observed state.
-type containerState int
-
-const (
-	stateAbsent  containerState = iota // no container with ProxyContainerName
-	stateStopped                       // container exists but is not running
-	stateRunning                       // container exists and is running
-)
-
-// inspectState reads the proxy container's running state via
-// `docker inspect -f {{.State.Running}}`. inspect exits 0 for a *stopped*
-// container too (printing "false"), so the exit code alone cannot tell a
-// stopped orphan from a healthy proxy: the printed value must be read.
-func inspectState(ctx context.Context, r DockerRunner) containerState {
-	out, err := r.DockerOut(ctx, "inspect", "-f", "{{.State.Running}}", ProxyContainerName)
-	if err != nil {
-		return stateAbsent
-	}
-	if strings.TrimSpace(string(out)) == "true" {
-		return stateRunning
-	}
-	return stateStopped
-}
-
-// IsRunning reports whether the proxy container exists AND is running. A
-// stopped orphan (e.g. left behind by a Docker restart or a crashed start)
-// reports false; Ensure removes it before starting a fresh proxy.
-func IsRunning(ctx context.Context, r DockerRunner) bool {
-	return inspectState(ctx, r) == stateRunning
-}
-
-// Ensure starts the shared Traefik proxy if it is not already running,
-// selecting free host ports and persisting them. On a Docker-level bind
-// failure (TOCTOU race between ListenProbe and the actual bind) it cleans up
-// the partial container and retries with the next HTTP candidate. HTTPS stays
-// fixed at the first candidate that passed the probe — advancing both
-// independently would require per-entrypoint error attribution from Docker
-// stderr, which the error-only DockerRunner does not expose; this is a
-// documented follow-up.
-func Ensure(ctx context.Context, r DockerRunner, opts EnsureOptions) (Ports, error) {
-	free := opts.free
-	if free == nil {
-		free = ListenProbe
-	}
-
-	switch inspectState(ctx, r) {
-	case stateRunning:
-		// Already running — load whatever ports were persisted last time.
-		// A missing state file yields zero Ports (no error); the caller treats
-		// that as "ports unknown".
-		ports, err := LoadPorts(PortsStatePath())
-		return ports, err
-	case stateStopped:
-		// A stopped orphan holds the container name (and its old port
-		// bindings), so `docker run --name` below would fail. Remove it and
-		// fall through to start a fresh proxy (parity: Node's
-		// ensureNoOrphantProxyContainer).
-		_ = RemoveOrphan(ctx, r)
-	}
-
-	if err := EnsureNetwork(ctx, r); err != nil {
-		return Ports{}, err
-	}
-
-	// Choose HTTPS once; advance HTTP candidate on each bind failure.
-	httpsPort, err := SelectPort(DefaultHTTPS, HTTPSFallbacks, free)
-	if err != nil {
-		return Ports{}, err
-	}
-
-	httpCandidates := append([]int{DefaultHTTP}, HTTPFallbacks...)
-
-	var lastErr error
-	for _, hp := range httpCandidates {
-		if !free(hp) {
-			continue
-		}
-		ports := Ports{HTTP: hp, HTTPS: httpsPort}
-		if err := r.Docker(ctx, proxyRunArgs(ports, opts.Domain)...); err != nil {
-			lastErr = err
-			// Clean up the name-collision / partial container before retrying.
-			_ = r.Docker(ctx, "rm", "-f", ProxyContainerName)
-			continue
-		}
-		if err := SavePorts(PortsStatePath(), ports); err != nil {
-			return Ports{}, err
-		}
-		return ports, nil
-	}
-
-	if lastErr != nil {
-		return Ports{}, fmt.Errorf("proxy: could not start after trying http candidates: %w", lastErr)
-	}
-	return Ports{}, errors.New("proxy: no free http port among preferred + fallbacks")
-}
-
-// RemoveOrphan best-effort removes a *stopped* proxy container so a fresh one
-// can bind (ports Node ensureNoOrphantProxyContainer). It uses `docker rm`
-// WITHOUT -f: that removes a stopped container but errors on a running one,
-// leaving a healthy proxy intact. All errors are intentionally ignored — the
-// expected "cannot remove a running container" error is indistinguishable from
-// a real daemon failure through the error-only runner, so we never surface it.
-func RemoveOrphan(ctx context.Context, r DockerRunner) error {
-	_ = r.Docker(ctx, "rm", ProxyContainerName)
-	return nil
-}
-
-// ForceRemove force-removes the shared proxy container (running or stopped) so a
-// subsequent Ensure rebuilds it from the correct image. Used by Lando adoption:
-// Lando's proxy shares the vip-dev-env-proxy name, and IsRunning would otherwise
-// treat it as ours and skip recreation.
-func ForceRemove(ctx context.Context, r DockerRunner) error {
-	return r.Docker(ctx, "rm", "-f", ProxyContainerName)
-}
-
-// Cleanup removes the proxy container and its proxy_config volume when no dev
-// environment remains. All errors are ignored (best-effort). The caller
-// decides when no environments remain.
-func Cleanup(ctx context.Context, r DockerRunner) error {
-	_ = r.Docker(ctx, "rm", "-f", ProxyContainerName)
-	// ProxyCertsVolume (the CA + leaf certs) is intentionally NOT removed: the CA
-	// survives teardown so the user need not re-trust it on the next create, which
-	// would otherwise cost an admin privilege prompt.
-	_ = r.Docker(ctx, "volume", "rm", ProxyConfigVolume)
-	return nil
-}

package/internal/devenv/proxy/proxy_test.go

@@ -1,149 +0,0 @@
-package proxy
-
-import (
-	"context"
-	"testing"
-)
-
-// scriptRunner returns scripted results per docker subcommand for control-flow
-// tests. runErrs is consumed in order for each `run` call (nil = success).
-type scriptRunner struct {
-	running bool    // proxy container exists and is running
-	stopped bool    // proxy container exists but is stopped (orphan)
-	runErrs []error // sequential results for `run` calls
-	calls   [][]string
-}
-
-// DockerOut scripts `inspect -f {{.State.Running}}`: exit 0 with "true" or
-// "false" when the container exists (running or stopped), error when absent.
-func (s *scriptRunner) DockerOut(ctx context.Context, args ...string) ([]byte, error) {
-	s.calls = append(s.calls, args)
-	if len(args) > 0 && args[0] == "inspect" {
-		switch {
-		case s.running:
-			return []byte("true\n"), nil
-		case s.stopped:
-			return []byte("false\n"), nil
-		}
-		return nil, errDocker
-	}
-	return nil, nil
-}
-
-func (s *scriptRunner) Docker(ctx context.Context, args ...string) error {
-	s.calls = append(s.calls, args)
-	switch {
-	case len(args) > 0 && args[0] == "run":
-		if len(s.runErrs) > 0 {
-			e := s.runErrs[0]
-			s.runErrs = s.runErrs[1:]
-			return e
-		}
-		return nil
-	}
-	return nil
-}
-
-func TestEnsureRunsProxyAndPersistsPorts(t *testing.T) {
-	t.Setenv("XDG_DATA_HOME", t.TempDir())
-	r := &scriptRunner{running: false}
-	free := func(int) bool { return true } // 80/443 free per probe
-	got, err := Ensure(context.Background(), r, EnsureOptions{Domain: "vipdev.lndo.site", free: free})
-	if err != nil {
-		t.Fatalf("Ensure: %v", err)
-	}
-	if got.HTTP != 80 || got.HTTPS != 443 {
-		t.Fatalf("expected default ports, got %+v", got)
-	}
-	persisted, _ := LoadPorts(PortsStatePath())
-	if persisted != got {
-		t.Fatalf("ports not persisted: %+v vs %+v", persisted, got)
-	}
-}
-
-func TestEnsureNoopWhenAlreadyRunning(t *testing.T) {
-	t.Setenv("XDG_DATA_HOME", t.TempDir())
-	if err := SavePorts(PortsStatePath(), Ports{HTTP: 8080, HTTPS: 4433}); err != nil {
-		t.Fatal(err)
-	}
-	r := &scriptRunner{running: true}
-	got, err := Ensure(context.Background(), r, EnsureOptions{Domain: "vipdev.lndo.site", free: func(int) bool { return true }})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if got.HTTP != 8080 || got.HTTPS != 4433 {
-		t.Fatalf("already-running path should return persisted ports, got %+v", got)
-	}
-	for _, c := range r.calls {
-		if len(c) > 0 && c[0] == "run" {
-			t.Fatalf("should not run proxy when already running: %v", r.calls)
-		}
-	}
-}
-
-func TestEnsureRemovesStoppedOrphanThenStarts(t *testing.T) {
-	t.Setenv("XDG_DATA_HOME", t.TempDir())
-	// A stopped proxy container exists: inspect succeeds but prints "false".
-	// Ensure must not treat it as running; it removes the orphan (docker rm
-	// without -f) and starts a fresh proxy.
-	r := &scriptRunner{stopped: true}
-	got, err := Ensure(context.Background(), r, EnsureOptions{Domain: "vipdev.lndo.site", free: func(int) bool { return true }})
-	if err != nil {
-		t.Fatalf("Ensure: %v", err)
-	}
-	if got.HTTP != 80 || got.HTTPS != 443 {
-		t.Fatalf("expected default ports, got %+v", got)
-	}
-	var sawRm, sawRun bool
-	for _, c := range r.calls {
-		switch {
-		case len(c) == 2 && c[0] == "rm" && c[1] == ProxyContainerName:
-			if sawRun {
-				t.Fatalf("orphan must be removed before run: %v", r.calls)
-			}
-			sawRm = true
-		case len(c) > 0 && c[0] == "run":
-			sawRun = true
-		}
-	}
-	if !sawRm || !sawRun {
-		t.Fatalf("expected rm then run, got calls: %v", r.calls)
-	}
-}
-
-func TestIsRunningReadsInspectOutput(t *testing.T) {
-	ctx := context.Background()
-	if IsRunning(ctx, &scriptRunner{running: true}) != true {
-		t.Fatal("running container should report true")
-	}
-	if IsRunning(ctx, &scriptRunner{stopped: true}) {
-		t.Fatal("stopped container must not report running")
-	}
-	if IsRunning(ctx, &scriptRunner{}) {
-		t.Fatal("absent container must not report running")
-	}
-}
-
-func TestEnsureRetriesNextPortOnBindFailure(t *testing.T) {
-	t.Setenv("XDG_DATA_HOME", t.TempDir())
-	// First run fails (port busy at bind time despite probe), second succeeds.
-	r := &scriptRunner{running: false, runErrs: []error{errDocker, nil}}
-	got, err := Ensure(context.Background(), r, EnsureOptions{Domain: "vipdev.lndo.site", free: func(int) bool { return true }})
-	if err != nil {
-		t.Fatalf("Ensure: %v", err)
-	}
-	// After the http bind failed once, the next http candidate (8000) is used.
-	if got.HTTP != 8000 {
-		t.Fatalf("expected retry to 8000 after bind failure, got %+v", got)
-	}
-	// the failed name collision is cleaned up before retry
-	var sawRm bool
-	for _, c := range r.calls {
-		if len(c) > 0 && c[0] == "rm" {
-			sawRm = true
-		}
-	}
-	if !sawRm {
-		t.Fatalf("expected rm of partial proxy before retry: %v", r.calls)
-	}
-}

package/internal/devenv/proxy/scripts/gen-certs.sh

@@ -1,73 +0,0 @@
-#!/bin/sh
-set -e
-
-# Shared CA paths inside the certs volume.
-CA_CERT="${CA_CERT:-/certs/lndo.site.pem}"
-CA_KEY="${CA_KEY:-/certs/lndo.site.key}"
-
-# quiet runs a command with its stderr captured, replaying it only on failure.
-# openssl narrates success on stderr ("Certificate request self-signature ok",
-# "subject=..."), which the CLI would otherwise tee to the user's terminal.
-quiet() {
-  _err=$(mktemp)
-  if "$@" 2>"$_err"; then
-    rm -f "$_err"
-  else
-    _st=$?
-    cat "$_err" >&2
-    rm -f "$_err"
-    return $_st
-  fi
-}
-
-# 1. Ensure the CA exists (idempotent). Subject CN parity: WPVIP Local CA.
-if [ ! -f "$CA_KEY" ]; then
-  quiet openssl genrsa -out "$CA_KEY" 2048
-fi
-if [ ! -f "$CA_CERT" ]; then
-  quiet openssl req -x509 -new -nodes -key "$CA_KEY" -sha256 -days 8675 \
-    -out "$CA_CERT" \
-    -subj "/C=US/ST=California/L=San Francisco/O=Automattic/OU=WPVIP/CN=WPVIP Local CA"
-fi
-
-# 2. Per-env leaf cert + Traefik file-provider config (only when requested).
-#    CERT_BASENAME names the cert files; CERT_SANS is a space-separated host list;
-#    CERT_CN is the cert subject CN (defaults to CERT_BASENAME).
-if [ -n "$CERT_BASENAME" ] && [ -n "$CERT_SANS" ]; then
-  CRT="/certs/${CERT_BASENAME}.crt"
-  KEY="/certs/${CERT_BASENAME}.key"
-  CSR="/certs/${CERT_BASENAME}.csr"
-  EXT="/certs/${CERT_BASENAME}.ext"
-  CN="${CERT_CN:-$CERT_BASENAME}"
-
-  {
-    printf '%s\n' "authorityKeyIdentifier=keyid,issuer"
-    printf '%s\n' "basicConstraints=CA:FALSE"
-    printf '%s\n' "keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment"
-    printf '%s\n' "extendedKeyUsage = serverAuth"
-    printf '%s\n' "subjectAltName = @alt_names"
-    printf '%s\n' "[alt_names]"
-  } > "$EXT"
-  set -f
-  i=1
-  for san in $CERT_SANS; do
-    printf 'DNS.%s = %s\n' "$i" "$san" >> "$EXT"
-    i=$((i + 1))
-  done
-  set +f
-
-  quiet openssl genrsa -out "$KEY" 2048
-  quiet openssl req -new -key "$KEY" -out "$CSR" \
-    -subj "/C=US/ST=California/L=San Francisco/O=Automattic/OU=WPVIP/CN=${CN}"
-  quiet openssl x509 -req -in "$CSR" -CA "$CA_CERT" -CAkey "$CA_KEY" \
-    -CAcreateserial -out "$CRT" -days 825 -sha256 -extfile "$EXT"
-  rm -f "$CSR" "$EXT"
-
-  mkdir -p /proxy_config
-  cat > "/proxy_config/${CERT_BASENAME}.yaml" <<EOF
-tls:
-  certificates:
-    - certFile: ${CRT}
-      keyFile: ${KEY}
-EOF
-fi

package/internal/devenv/proxy/spec.go

@@ -1,60 +0,0 @@
-package proxy
-
-import (
-	"fmt"
-
-	"github.com/Automattic/vip/internal/devenv/compose"
-)
-
-// ProxyContainerName is the shared proxy container (parity: dev-environment-lando.ts:330).
-const ProxyContainerName = "vip-dev-env-proxy"
-
-// ProxyImage is the Traefik+openssl image (parity: lando-proxy builder.js).
-const ProxyImage = "ghcr.io/automattic/vip-container-images/traefik_openssl:v3"
-
-// ProxyConfigVolume holds the Traefik file-provider configs (per-env tls certs).
-const ProxyConfigVolume = "proxy_config"
-
-// proxyCommand is the Traefik arg list (parity: lando-proxy/index.js) plus the
-// docker.network arg so Traefik resolves services on our single shared network.
-var proxyCommand = []string{
-	"--log.level=DEBUG",
-	// API enabled (no auth) for health checks on the ephemeral :8080 bind; UI off.
-	"--api.insecure=true",
-	"--api.dashboard=false",
-	"--providers.docker=true",
-	"--providers.docker.network=" + compose.ProxyNetwork,
-	"--providers.docker.exposedbydefault=false",
-	"--entrypoints.https.address=:443",
-	"--entrypoints.http.address=:80",
-	"--providers.file.directory=/proxy_config",
-	"--providers.file.watch=true",
-}
-
-// proxyRunArgs builds the `docker run` argv for the shared proxy. The cert
-// volume + boot-script mounts are appended per Task 1 findings (see Task 7);
-// this builder establishes the network, ports, socket mount, env, and command.
-func proxyRunArgs(ports Ports, domain string) []string {
-	args := []string{
-		"run", "-d",
-		"--name", ProxyContainerName,
-		"--network", compose.ProxyNetwork,
-		"--restart", "unless-stopped",
-		"-p", fmt.Sprintf("%s:%d:80", ProxyBindAddress, ports.HTTP),
-		"-p", fmt.Sprintf("%s:%d:443", ProxyBindAddress, ports.HTTPS),
-		"-p", fmt.Sprintf("%s::8080", ProxyBindAddress),
-		"-v", "/var/run/docker.sock:/var/run/docker.sock",
-		"-v", ProxyConfigVolume + ":/proxy_config",
-		"-v", ProxyCertsVolume + ":/certs",
-		// The four LANDO_* vars below are retained for Lando image parity but are
-		// inert under the stock Traefik entrypoint: the image bundles none of
-		// Lando's cert scripts that would consume them.
-		"-e", "LANDO_APP_PROJECT=_lando_",
-		"-e", fmt.Sprintf("LANDO_EXTRA_NAMES=DNS.100 = *.%s", domain),
-		"-e", "LANDO_PROXY_CONFIG_FILE=/proxy_config/proxy.yaml",
-		"-e", "LANDO_PROXY_PASSTHRU=true",
-		ProxyImage,
-	}
-	args = append(args, proxyCommand...)
-	return args
-}