@celilo/cli 1.14.0 → 2.0.0

package/src/services/alerting/hook-jail.ts

@@ -0,0 +1,70 @@
+/**
+ * Hook-jail regression — a host that used to jail its hooks and has stopped.
+ *
+ * Design D8's three states want three different things (see
+ * openspec/changes/hook-process-boundary/design.md): jailed is normal and
+ * raises nothing; a host that never jailed (a Mac) is a configuration fact
+ * that `celilo system doctor` reports and is NOT an event; a host that ran
+ * hooks jailed yesterday and runs them unjailed today is a kernel upgrade, an
+ * AppArmor policy change, or a changed container profile, and is exactly the
+ * failure that looks like nothing. Only the third state raises here.
+ *
+ * The state this reads is `hook-jail-mode.json`, written by `recordJailMode`
+ * on every real module-hook run. The transition survives the record being
+ * overwritten because an unjailed record carries `lastJailed` — the jailed
+ * record it replaced on the same host.
+ *
+ * The monitor scheduling this check is a SELF-monitor: `celilo monitor add
+ * hook_jail` creates it `suppressible: false`, so per
+ * openspec/specs/alerting/spec.md no ancestor alert and no deploy window can
+ * silence it. Losing confinement during a broad outage is precisely when it
+ * must still page.
+ *
+ * Deliberately cheap: one local file read, no remote contact, safe on every
+ * sweep.
+ */
+
+import type { AlertSeverity } from '../../db/schema';
+import type { JailModeRecord } from '../../hooks/jail';
+import { type FailingKey, builtinAlertKey } from './keys';
+
+export const HOOK_JAIL_CHECK = 'hook_jail';
+
+export interface HookJailState {
+  /** The recorded mode, or undefined when no hook has recorded one yet. */
+  record: JailModeRecord | undefined;
+  /** The host this check runs on, compared against the record's own. */
+  host: string;
+}
+
+/**
+ * One failing key when this host used to jail and has stopped; empty
+ * otherwise. The message names the host and the reason, which is what the
+ * security-model spec requires the alert to carry.
+ *
+ * A record written by another host is ignored rather than compared: a database
+ * or data directory restored onto a new box is a move, not a regression, and
+ * the new box has its own history to make.
+ */
+export function hookJailFailingKeys(state: HookJailState, severity: AlertSeverity): FailingKey[] {
+  const { record, host } = state;
+  if (!record || record.host !== host) return [];
+  if (record.mode !== 'unjailed' || !record.lastJailed) return [];
+
+  return [
+    {
+      key: builtinAlertKey(HOOK_JAIL_CHECK, 'host', host),
+      severity,
+      message:
+        `Hooks on ${host} ran jailed (${record.lastJailed.backend}) until ` +
+        `${record.lastJailed.recordedAt} and now run unjailed: ` +
+        `${record.reason ?? 'no reason was recorded'}`,
+      details:
+        'A host that quietly stops confining hooks is a failure that otherwise\n' +
+        'looks like nothing — the usual causes are a kernel upgrade, an AppArmor\n' +
+        'policy change, or a changed container profile. `celilo system doctor`\n' +
+        'reports what the host can do right now. The alert resolves when a hook\n' +
+        'runs jailed on this host again.',
+    },
+  ];
+}

package/src/services/alerting/run-monitor.test.ts

@@ -7,6 +7,7 @@ import type { DbClient } from '../../db/client';
 import { type Monitor, alerts, monitorRuns, monitors } from '../../db/schema';
 import { setupTestDatabaseAt } from '../../test-utils/database';
 import type { HealthCheckResult } from '../health-runner';
+import { HOOK_JAIL_CHECK, type HookJailState } from './hook-jail';
 import { moduleAlertKey, moduleCheckAlertKey } from './keys';
 import { type MonitorRunDeps, runOneMonitor } from './run-monitor';
 import { loadLiveAlerts, markUnsuppressed } from './store';
@@ -40,6 +41,7 @@ describe('runOneMonitor', () => {
       runModuleCheck: async () => result,
       runBuiltinCheck: async () => [],
       loadModuleCoverage: () => [],
+      loadJailState: () => ({ record: undefined, host: 'test-host' }),
       now: () => now,
       graceMs: 60_000,
     };
@@ -182,4 +184,64 @@ describe('runOneMonitor', () => {
     expect(summary.outcome).toBe('success');
     expect(liveKeys()).toEqual([]);
   });
+
+  describe('the hook-jail self-monitor (hook-process-boundary task 4.4)', () => {
+    const HOST = 'celilo-mgr';
+    const regressed: HookJailState = {
+      host: HOST,
+      record: {
+        mode: 'unjailed',
+        backend: 'none',
+        reason: 'bubblewrap is installed but could not build a namespace',
+        host: HOST,
+        recordedAt: NOW.toISOString(),
+        lastJailed: { backend: 'bubblewrap', recordedAt: '2026-07-27T03:00:00.000Z' },
+      },
+    };
+    const healed: HookJailState = {
+      host: HOST,
+      record: {
+        mode: 'jailed',
+        backend: 'bubblewrap',
+        host: HOST,
+        recordedAt: LATER.toISOString(),
+      },
+    };
+
+    let jailMonitor: Monitor;
+
+    beforeEach(() => {
+      db.insert(monitors)
+        .values({
+          id: 'mon-jail',
+          kind: 'builtin_check',
+          target: HOOK_JAIL_CHECK,
+          intervalMinutes: 15,
+          severity: 'critical',
+          suppressible: false,
+        })
+        .run();
+      jailMonitor = db.select().from(monitors).where(eq(monitors.id, 'mon-jail')).get() as Monitor;
+    });
+
+    const jailDeps = (state: HookJailState, now: Date = NOW): MonitorRunDeps => ({
+      ...deps(healthy, now),
+      loadJailState: () => state,
+    });
+
+    test('a jailed-to-unjailed transition fires an alert naming the host', async () => {
+      const summary = await runOneMonitor(db, jailMonitor, jailDeps(regressed));
+      expect(summary.outcome).toBe('success');
+      const live = loadLiveAlerts(db, jailMonitor.id);
+      expect(live.map((a) => a.key)).toEqual([`builtin:hook_jail/host:${HOST}`]);
+      const row = db.select().from(alerts).where(eq(alerts.monitorId, jailMonitor.id)).get();
+      expect(row?.message).toContain(HOST);
+    });
+
+    test('re-jailing resolves it by set difference', async () => {
+      await runOneMonitor(db, jailMonitor, jailDeps(regressed));
+      await runOneMonitor(db, jailMonitor, jailDeps(healed, LATER));
+      expect(loadLiveAlerts(db, jailMonitor.id)).toEqual([]);
+    });
+  });
 });

package/src/services/alerting/run-monitor.ts

@@ -19,6 +19,7 @@ import type { HealthCheckResult } from '../health-runner';
 import { failingKeysFromFindings } from './builtin-monitors';
 import { HEALTH_COVERAGE_CHECK, healthCoverageFailingKeys } from './health-coverage';
 import type { ModuleCoverageInput } from './health-coverage';
+import { HOOK_JAIL_CHECK, type HookJailState, hookJailFailingKeys } from './hook-jail';
 import {
   type FailingKey,
   builtinMonitorKey,
@@ -35,6 +36,8 @@ export interface MonitorRunDeps {
   runBuiltinCheck(category: DriftCategory): Promise<DriftFinding[]>;
   /** Module roster for the health-coverage check. */
   loadModuleCoverage(): ModuleCoverageInput[];
+  /** Recorded jail mode and current host, for the hook-jail self-monitor. */
+  loadJailState(): HookJailState;
   now(): Date;
   /** Grace window before a new alert may notify. */
   graceMs: number;
@@ -95,6 +98,15 @@ async function runCheck(
     };
   }
 
+  // Same shape: one local file read. This is the self-monitor for D8's third
+  // state — a host that used to jail its hooks and has stopped.
+  if (monitor.target === HOOK_JAIL_CHECK) {
+    return {
+      outcome: 'success',
+      failingKeys: hookJailFailingKeys(deps.loadJailState(), severity),
+    };
+  }
+
   const category = monitor.target as DriftCategory;
   try {
     const findings = await deps.runBuiltinCheck(category);

package/src/services/alerting/sweep-runner.test.ts

@@ -42,6 +42,7 @@ describe('runSweep', () => {
       runModuleCheck: async () => result,
       runBuiltinCheck: async () => [],
       loadModuleCoverage: () => [],
+      loadJailState: () => ({ record: undefined, host: 'test-host' }),
       now: () => now,
       graceMs: 60_000,
     };

package/src/services/backup-create.ts

@@ -41,6 +41,7 @@ import {
   refuseIfInFlight,
   startOperation,
 } from './module-operations';
+import { remoteAccessPolicy } from './remote-access';
 import { stageSystemState } from './system-state-stage';
 
 export interface BackupCreateOptions {
@@ -399,6 +400,7 @@ export async function createModuleBackup(
       {
         debug: false,
         systems: getModuleSystems(moduleId, db),
+        remoteAccess: remoteAccessPolicy(moduleId, db),
       },
     );
 
@@ -563,6 +565,7 @@ export async function importModuleBackup(
         {
           debug: false,
           systems: getModuleSystems(moduleId, db),
+          remoteAccess: remoteAccessPolicy(moduleId, db),
         },
       );
 

package/src/services/backup-restore.ts

@@ -30,6 +30,7 @@ import {
   refuseIfInFlight,
   startOperation,
 } from './module-operations';
+import { remoteAccessPolicy } from './remote-access';
 
 export interface RestoreResult {
   success: boolean;
@@ -288,6 +289,7 @@ export async function restoreModuleBackup(
       {
         debug: false,
         systems: getModuleSystems(backup.moduleId, db),
+        remoteAccess: remoteAccessPolicy(backup.moduleId, db),
       },
     );
 

package/src/services/deploy-ansible.ts

@@ -138,7 +138,7 @@ function parseAnsibleLine(line: string): string | null {
  */
 export async function executeAnsible(
   generatedPath: string,
-  options?: { noInteractive?: boolean; check?: boolean },
+  options?: { noInteractive?: boolean; check?: boolean; tags?: string[] },
 ): Promise<AnsibleResult> {
   const ansibleDir = join(generatedPath, 'ansible');
   const inventoryPath = join(ansibleDir, 'inventory', 'hosts.ini');
@@ -166,6 +166,14 @@ export async function executeAnsible(
         // stored record of the host (celilo#902 design D6). One argument, not a
         // second execution path — everything else about the run is identical.
         ...(options?.check ? ['--check'] : []),
+        // `--tags` scopes the run to the tagged tasks. The static-content
+        // converge uses it (capability-owned-tables D10): the full playbook
+        // re-templates the bootstrap Caddyfile, which would overwrite the
+        // REAL config the provider's reconcile wrote to disk and reload caddy
+        // into serving nothing. A publish converge must touch /srv/www and
+        // nothing else. An unscoped run (the deploy) still executes every
+        // untagged task alongside the tagged ones.
+        ...(options?.tags?.length ? ['--tags', options.tags.join(',')] : []),
         shellEscape(playbookPath),
       ],
       cwd: ansibleDir,

package/src/services/health-runner.ts

@@ -18,6 +18,7 @@ import type { ModuleManifest } from '../manifest/schema';
 import { decryptSecret } from '../secrets/encryption';
 import { getOrCreateMasterKey } from '../secrets/master-key';
 import { getModuleSystems } from './deployed-systems';
+import { remoteAccessPolicy } from './remote-access';
 
 export interface HealthCheckItem {
   name: string;
@@ -196,6 +197,7 @@ export async function runModuleHealthCheck(
       capabilities: capabilityFunctions,
       requiredCapabilities,
       systems: getModuleSystems(moduleId, db),
+      remoteAccess: remoteAccessPolicy(moduleId, db),
     },
   );
   presentation.finish(hookResult.success);

package/src/services/module-build.test.ts

@@ -1,8 +1,7 @@
-import { afterEach, beforeEach, describe, expect, spyOn, test } from 'bun:test';
+import { afterEach, beforeEach, describe, expect, test } from 'bun:test';
 import { existsSync } from 'node:fs';
 import { mkdir, rm, writeFile } from 'node:fs/promises';
 import { eq } from 'drizzle-orm';
-import { log } from '../cli/prompts';
 import { type DbClient, createDbClient } from '../db/client';
 import { moduleBuilds, modules } from '../db/schema';
 import { skipIntegration } from '../test-utils/integration-guard';
@@ -40,7 +39,6 @@ describe('Module Build Service', () => {
         version TEXT NOT NULL,
         built_at INTEGER NOT NULL DEFAULT (unixepoch()),
         artifacts TEXT NOT NULL,
-        environment TEXT,
         status TEXT NOT NULL,
         build_log TEXT,
         FOREIGN KEY (module_id) REFERENCES modules(id) ON DELETE CASCADE
@@ -98,65 +96,6 @@ describe('Module Build Service', () => {
       expect(result.error).toContain('does not have a build section');
     });
 
-    test('should detect Nix environment from flake.nix', async () => {
-      // Create test module directory with flake.nix
-      await mkdir(TEST_MODULE_DIR, { recursive: true });
-      await mkdir(`${TEST_MODULE_DIR}/build`, { recursive: true });
-      await writeFile(`${TEST_MODULE_DIR}/flake.nix`, '# Nix flake');
-      await writeFile(
-        `${TEST_MODULE_DIR}/build/playbook.yml`,
-        `---
-- name: Test build
-  hosts: localhost
-  gather_facts: false
-  tasks:
-    - name: Debug message
-      ansible.builtin.debug:
-        msg: "Nix build test"
-`,
-      );
-
-      db.insert(modules)
-        .values({
-          id: 'nix-module',
-          name: 'Nix Module',
-          version: '1.0.0',
-          sourcePath: TEST_MODULE_DIR,
-          manifestData: {
-            id: 'nix-module',
-            name: 'Nix Module',
-            version: '1.0.0',
-            build: {
-              script: 'build/playbook.yml',
-            },
-          },
-        })
-        .run();
-
-      // Mock log.info / log.warn to capture output (module-build.ts now
-      // routes through these instead of console.log so output flows through
-      // the active ProgressDisplay during a real deploy).
-      const logInfoSpy = spyOn(log, 'info').mockImplementation(() => {});
-      const logWarnSpy = spyOn(log, 'warn').mockImplementation(() => {});
-
-      const _result = await buildModuleFromSource('nix-module', db);
-
-      // Verify Nix detection or fallback message was logged
-      // If nix is available: "Entering Nix environment"
-      // If nix not available: "flake.nix detected but nix command not available"
-      const calls = [...logInfoSpy.mock.calls, ...logWarnSpy.mock.calls].map((c) => c[0]);
-      const hasNixMessage = calls.some(
-        (msg) => msg.includes('Nix environment') || msg.includes('flake.nix detected'),
-      );
-      expect(hasNixMessage).toBe(true);
-
-      logInfoSpy.mockRestore();
-      logWarnSpy.mockRestore();
-
-      // Build result depends on whether Nix is installed
-      // We're just testing that detection happens (message logged)
-    }, 10000); // 10 second timeout
-
     test.skipIf(skipIntegration({ tools: ['ansible'] }))(
       'should record build metadata in database',
       async () => {
@@ -208,7 +147,6 @@ describe('Module Build Service', () => {
         expect(buildRecord?.moduleId).toBe('record-test');
         expect(buildRecord?.version).toBe('1.0.0');
         expect(buildRecord?.status).toBe('success');
-        expect(buildRecord?.environment).toBe('system'); // No flake.nix
       },
       10000,
     ); // 10 second timeout for ansible execution
@@ -282,7 +220,6 @@ describe('Module Build Service', () => {
           artifacts: ['/path/to/artifact'],
           status: 'success',
           buildLog: 'Build completed',
-          environment: 'nix',
         })
         .run();
 

package/src/services/module-build.ts

@@ -1,7 +1,7 @@
 /**
  * Module Build Service
  *
- * Executes module build scripts (Ansible playbooks) in Nix environments
+ * Executes module build scripts (Ansible playbooks)
  * to compile custom software binaries before deployment.
  *
  * Example: Caddy with RFC2136 DNS provider
@@ -40,65 +40,26 @@ export interface BuildStatusRecord {
   buildLog?: string;
 }
 
-/**
- * Detect if module uses Nix environment
- * Policy function - checks for flake.nix existence
- *
- * @param modulePath - Path to module directory
- * @returns True if flake.nix exists
- */
-function detectNixEnvironment(modulePath: string): boolean {
-  const flakePath = `${modulePath}/flake.nix`;
-  return existsSync(flakePath);
-}
-
-/**
- * Check if nix command is available
- * Policy function - validates nix availability
- *
- * @returns True if nix command can be executed
- */
-async function isNixAvailable(): Promise<boolean> {
-  const { spawn } = await import('node:child_process');
-
-  return new Promise((resolve) => {
-    const child = spawn('nix', ['--version'], {
-      stdio: 'ignore',
-    });
-
-    child.on('close', (code) => {
-      resolve(code === 0);
-    });
-
-    child.on('error', () => {
-      resolve(false);
-    });
-  });
-}
-
 /**
  * Execute build playbook with streaming progress
  * Execution function - runs ansible-playbook with fuel-gauge progress indicator
  *
  * @param modulePath - Path to module directory
- * @param playbookPath - Path to build playbook (relative to module)
- * @param useNix - Whether to run inside Nix environment
+ * @param commandStr - Build command to execute
  * @returns Build result with output
  */
 async function executeBuildCommand(
   modulePath: string,
   commandStr: string,
-  useNix: boolean,
 ): Promise<{ success: boolean; output: string; error?: string }> {
   const { executeBuildWithProgress } = await import('./build-stream');
-  const { shellEscape } = await import('../utils/shell');
 
   // build-stream passes through `shell: true`, so spawn re-wraps everything in
   // `/bin/sh -c`. If we sent ['bash', '-c', commandStr] as command+args, sh
   // would re-parse the join — `&&` outside the inner quotes splits the chain
   // and `bun install` runs in modulePath instead of the cd'd subdir. Pass the
   // full command as one string so sh -c gets a single, unsplit shell command.
-  const command = useNix ? `nix develop --command bash -c ${shellEscape(commandStr)}` : commandStr;
+  const command = commandStr;
 
   const result = await executeBuildWithProgress({
     command,
@@ -117,7 +78,6 @@ async function executeBuildCommand(
 async function executeBuildScript(
   modulePath: string,
   scriptPath: string,
-  useNix: boolean,
 ): Promise<{ success: boolean; output: string; error?: string }> {
   const fullScriptPath = `${modulePath}/${scriptPath}`;
 
@@ -132,11 +92,7 @@ async function executeBuildScript(
   let command: string;
   let args: string[];
 
-  if (useNix) {
-    const innerCommand = isShellScript ? 'bash' : 'ansible-playbook';
-    command = 'nix';
-    args = ['develop', '--command', innerCommand, scriptPath];
-  } else if (isShellScript) {
+  if (isShellScript) {
     command = 'bash';
     args = [scriptPath];
   } else {
@@ -207,7 +163,6 @@ function formatBytes(bytes: number): string {
  * @param artifacts - List of artifact paths
  * @param status - Build status
  * @param buildLog - Build output log
- * @param environment - Build environment (nix or system)
  * @param db - Database client
  */
 async function recordBuildMetadata(
@@ -216,7 +171,6 @@ async function recordBuildMetadata(
   artifacts: string[],
   status: BuildStatus,
   buildLog: string,
-  environment: 'nix' | 'system' | null,
   db: DbClient,
 ): Promise<void> {
   await db.insert(moduleBuilds).values({
@@ -225,7 +179,6 @@ async function recordBuildMetadata(
     artifacts,
     status,
     buildLog,
-    environment,
   });
 }
 
@@ -268,38 +221,18 @@ export async function buildModuleFromSource(moduleId: string, db: DbClient): Pro
     };
   }
 
-  // Detect Nix environment and verify availability
-  const nixDetected = detectNixEnvironment(modulePath);
-  const nixAvailable = nixDetected ? await isNixAvailable() : false;
-  const useNix = nixDetected && nixAvailable;
-  const environment: 'nix' | 'system' = useNix ? 'nix' : 'system';
-
-  if (useNix) {
-    log.info('Entering Nix environment (flake.nix detected)...');
-  } else if (nixDetected && !nixAvailable) {
-    log.warn('flake.nix detected but nix command not available - using system Ansible');
-  }
-
   try {
     // Execute build script with streaming progress
     const buildResult = command
-      ? await executeBuildCommand(modulePath, command, useNix)
-      : await executeBuildScript(modulePath, script as string, useNix);
+      ? await executeBuildCommand(modulePath, command)
+      : await executeBuildScript(modulePath, script as string);
 
     // Check if build command failed
     if (!buildResult.success) {
       const errorMsg = buildResult.error || 'Build command failed';
 
       // Record failed build
-      await recordBuildMetadata(
-        moduleId,
-        manifest.version,
-        [],
-        'failed',
-        buildResult.output,
-        environment,
-        db,
-      );
+      await recordBuildMetadata(moduleId, manifest.version, [], 'failed', buildResult.output, db);
 
       return {
         success: false,
@@ -327,7 +260,6 @@ export async function buildModuleFromSource(moduleId: string, db: DbClient): Pro
           [],
           'failed',
           `${buildLog}\n\n${errorMsg}`,
-          environment,
           db,
         );
 
@@ -346,15 +278,7 @@ export async function buildModuleFromSource(moduleId: string, db: DbClient): Pro
 
       // Record successful build
       const artifactPaths = verification.map((v) => v.path);
-      await recordBuildMetadata(
-        moduleId,
-        manifest.version,
-        artifactPaths,
-        'success',
-        buildLog,
-        environment,
-        db,
-      );
+      await recordBuildMetadata(moduleId, manifest.version, artifactPaths, 'success', buildLog, db);
 
       return {
         success: true,
@@ -364,7 +288,7 @@ export async function buildModuleFromSource(moduleId: string, db: DbClient): Pro
     }
 
     // No artifacts defined, just record success
-    await recordBuildMetadata(moduleId, manifest.version, [], 'success', buildLog, environment, db);
+    await recordBuildMetadata(moduleId, manifest.version, [], 'success', buildLog, db);
 
     return {
       success: true,
@@ -376,7 +300,7 @@ export async function buildModuleFromSource(moduleId: string, db: DbClient): Pro
     const buildLog = `Build failed: ${errorMsg}`;
 
     // Record failed build
-    await recordBuildMetadata(moduleId, manifest.version, [], 'failed', buildLog, environment, db);
+    await recordBuildMetadata(moduleId, manifest.version, [], 'failed', buildLog, db);
 
     return {
       success: false,

package/src/services/module-deploy.ts

@@ -46,6 +46,7 @@ import {
   runProviderBackfill,
 } from './provider-arrival';
 import { checkProxmoxReachable, formatProxmoxUnreachableError } from './proxmox-preflight';
+import { remoteAccessPolicy } from './remote-access';
 import { LOCAL_MACHINE_IP, deleteTemporarySshKey, writeTemporarySshKey } from './ssh-key-manager';
 import { buildTerraformEnvForService } from './terraform-env';
 
@@ -720,6 +721,7 @@ async function deployModuleImpl(
             capabilities: capabilityFunctions,
             requiredCapabilities: manifest.requires.capabilities.map((c) => c.name),
             systems: getModuleSystems(moduleId, db),
+            remoteAccess: remoteAccessPolicy(moduleId, db),
           },
         );
 
@@ -858,6 +860,7 @@ async function deployModuleImpl(
                 capabilities: capFns,
                 requiredCapabilities: (manifest.requires?.capabilities ?? []).map((c) => c.name),
                 systems: getModuleSystems(moduleId, db),
+                remoteAccess: remoteAccessPolicy(moduleId, db),
               },
             };
           },
@@ -1159,6 +1162,7 @@ async function deployModuleImpl(
             capabilities: capFunctions,
             requiredCapabilities: providerManifest.requires.capabilities.map((c) => c.name),
             systems: getModuleSystems(capRecord.moduleId, db),
+            remoteAccess: remoteAccessPolicy(capRecord.moduleId, db),
           },
         );
 
@@ -1308,6 +1312,21 @@ async function deployModuleImpl(
       }
     }
 
+    // The provider's own deploy runs the static-content converge alongside
+    // everything else (design D10, task 4.5): the release set is written into
+    // the generated inventory, the playbook's static_content-tagged tasks
+    // converge /srv/www, and a rebuilt host recovers with no consumer
+    // involvement. Same plan + writer the publish-time converge uses — one
+    // code path, two callers.
+    if (manifest.provides?.capabilities?.some((cap) => cap.name === 'public_web')) {
+      const { writeStaticContentVars } = await import('./static-content-converge');
+      const staticVars = await writeStaticContentVars(db, moduleId, generatedPath);
+      if (!staticVars.success) {
+        return { success: false, error: staticVars.error, phases };
+      }
+      log.success('Static-content release set written to the inventory');
+    }
+
     try {
       const ansibleResult = await executeAnsible(generatedPath, {
         noInteractive: !process.stdout.isTTY,
@@ -1412,6 +1431,7 @@ async function deployModuleImpl(
                 capabilities: capFns,
                 requiredCapabilities: manifest.requires.capabilities.map((c) => c.name),
                 systems: getModuleSystems(moduleId, db),
+                remoteAccess: remoteAccessPolicy(moduleId, db),
               },
             };
           },