@mriekki/lean 0.1.0 → 0.2.0

package/assets/generated/deployment/src/lean_poc_deployment/box_platform.py

@@ -1,208 +1,208 @@
-"""Shared Ubuntu box platform ownership and lifecycle operations."""
-
-from __future__ import annotations
-
-import base64
-import hashlib
-import json
-import shlex
-import subprocess
-from typing import Any
-
-from .box_platform_assets import (
-    AVAHI_SERVICE,
-    CADDYFILE,
-    CADDY_CONTAINER,
-    CADDY_IMAGE,
-    COMPOSE_YAML,
-    HOST_PLATFORM_WRITE_PHRASE,
-    NETWORK_NAME,
-    PLATFORM_DISTRIBUTION,
-    PLATFORM_ROOT,
-    PLATFORM_SCHEMA_VERSION,
-    PLATFORM_VERSION,
-    PUBLISH_ALIAS_SH,
-)
-from .box_platform_remote import REMOTE_SCRIPT
-from .errors import DeploymentKitError
-from .profiles import load_profile
-from .ssh import ssh_args, verify_access
-
-_BOOL_KEYS = {
-    "markerPresent",
-    "prerequisitesReady",
-    "networkPresent",
-    "caddyRunning",
-    "avahiRunning",
-    "port80InUse",
-}
-_EXPECTED_KEYS = {
-    "state",
-    "markerPresent",
-    "markerSchemaVersion",
-    "markerDistribution",
-    "markerPlatformVersion",
-    "expectedPlatformVersion",
-    "prerequisitesReady",
-    "networkPresent",
-    "caddyRunning",
-    "avahiRunning",
-    "port80InUse",
-    "platformRoot",
-    "networkName",
-    "caddyContainer",
-}
-
-
-def build_remote_script() -> str:
-    replacements = {
-        "__PLATFORM_ROOT__": PLATFORM_ROOT,
-        "__NETWORK_NAME__": NETWORK_NAME,
-        "__CADDY_CONTAINER__": CADDY_CONTAINER,
-        "__CADDY_IMAGE__": CADDY_IMAGE,
-        "__SCHEMA_VERSION__": str(PLATFORM_SCHEMA_VERSION),
-        "__PLATFORM_VERSION__": PLATFORM_VERSION,
-        "__DISTRIBUTION__": PLATFORM_DISTRIBUTION,
-        "__COMPOSE_B64__": base64.b64encode(COMPOSE_YAML.encode()).decode("ascii"),
-        "__CADDYFILE_B64__": base64.b64encode(CADDYFILE.encode()).decode("ascii"),
-        "__PUBLISH_ALIAS_B64__": base64.b64encode(PUBLISH_ALIAS_SH.encode()).decode("ascii"),
-        "__AVAHI_SERVICE_B64__": base64.b64encode(AVAHI_SERVICE.encode()).decode("ascii"),
-    }
-    script = REMOTE_SCRIPT
-    for placeholder, value in replacements.items():
-        script = script.replace(placeholder, value)
-    if "__" in script:
-        raise DeploymentKitError("Internal host-platform script contains an unresolved placeholder.")
-    return script
-
-
-def _parse_status(output: str) -> dict[str, Any]:
-    result: dict[str, Any] = {}
-    for raw in output.splitlines():
-        if not raw.strip():
-            continue
-        if "=" not in raw:
-            raise DeploymentKitError(f"Malformed host-platform status line: {raw!r}")
-        key, value = raw.split("=", 1)
-        if key not in _EXPECTED_KEYS or key in result:
-            raise DeploymentKitError(f"Unexpected or duplicate host-platform status key: {key!r}")
-        if key in _BOOL_KEYS:
-            if value not in {"true", "false"}:
-                raise DeploymentKitError(f"Invalid boolean host-platform status value for {key}.")
-            result[key] = value == "true"
-        else:
-            result[key] = value
-    missing = _EXPECTED_KEYS - result.keys()
-    if missing:
-        raise DeploymentKitError(
-            "Host-platform status omitted required keys: " + ", ".join(sorted(missing))
-        )
-    return result
-
-
-def _run_remote(profile: dict[str, Any], address: str, action: str, *, sudo: bool) -> str:
-    if action not in {"status", "install", "upgrade"}:
-        raise DeploymentKitError(f"Unsupported host-platform action: {action}")
-    remote_command = "bash -s -- " + shlex.quote(action)
-    if sudo:
-        remote_command = "sudo -n " + remote_command
-    command = ssh_args(profile, address, command=remote_command)
-    completed = subprocess.run(
-        command,
-        input=build_remote_script().encode("utf-8"),
-        check=False,
-        capture_output=True,
-    )
-    stdout = completed.stdout.decode("utf-8", errors="replace")
-    stderr = completed.stderr.decode("utf-8", errors="replace")
-    if completed.returncode != 0:
-        detail = stderr.strip() or stdout.strip() or f"exit {completed.returncode}"
-        raise DeploymentKitError(f"Remote host-platform {action} failed: {detail}")
-    return stdout
-
-
-def platform_status(name: str) -> dict[str, Any]:
-    profile = load_profile(name)
-    evidence = verify_access(profile)
-    status = _parse_status(_run_remote(profile, evidence["address"], "status", sudo=True))
-    status["targetName"] = name
-    status["verifiedAddress"] = evidence["address"]
-    return status
-
-
-def platform_doctor(name: str) -> dict[str, Any]:
-    status = platform_status(name)
-    next_actions = {
-        "installable": "platform-install",
-        "upgrade-required": "platform-upgrade",
-        "drifted": "inspect-platform-drift",
-        "blocked": "prepare-host-prerequisites",
-        "blocked-port-80": "identify-existing-port-80-owner",
-        "incompatible": "manual-platform-recovery",
-        "ready": "none",
-    }
-    status["nextAction"] = next_actions.get(status["state"], "manual-review")
-    status["mutated"] = False
-    return status
-
-
-def _snapshot(status: dict[str, Any]) -> str:
-    selected = {key: status[key] for key in sorted(_EXPECTED_KEYS)}
-    return hashlib.sha256(json.dumps(selected, sort_keys=True, separators=(",", ":")).encode()).hexdigest()
-
-
-def plan_platform_change(name: str, action: str) -> dict[str, Any]:
-    if action not in {"install", "upgrade"}:
-        raise DeploymentKitError("Platform change action must be install or upgrade.")
-    status = platform_status(name)
-    expected_state = "installable" if action == "install" else "upgrade-required"
-    if status["state"] != expected_state:
-        raise DeploymentKitError(
-            f"Platform {action} requires state '{expected_state}', but target '{name}' is '{status['state']}'."
-        )
-    return {
-        "targetName": name,
-        "action": action,
-        "fromState": status["state"],
-        "toPlatformVersion": PLATFORM_VERSION,
-        "distribution": PLATFORM_DISTRIBUTION,
-        "platformRoot": PLATFORM_ROOT,
-        "preserves": ["route-conf.d", "route-registry", "caddy-data", "caddy-config", "shared-network"],
-        "doesNotOwn": ["application-containers", "application-data", "application-routes"],
-        "statusSnapshot": _snapshot(status),
-    }
-
-
-def apply_platform_change(plan: dict[str, Any]) -> dict[str, Any]:
-    required = {
-        "targetName",
-        "action",
-        "fromState",
-        "toPlatformVersion",
-        "distribution",
-        "platformRoot",
-        "preserves",
-        "doesNotOwn",
-        "statusSnapshot",
-    }
-    if not isinstance(plan, dict) or set(plan) != required:
-        raise DeploymentKitError("Malformed host-platform change plan.")
-    name = plan["targetName"]
-    action = plan["action"]
-    if action not in {"install", "upgrade"}:
-        raise DeploymentKitError("Malformed host-platform change action.")
-    current = platform_status(name)
-    if _snapshot(current) != plan["statusSnapshot"]:
-        raise DeploymentKitError(
-            "Host-platform state changed after the plan was reviewed; create and authorize a fresh plan."
-        )
-    profile = load_profile(name)
-    evidence = verify_access(profile)
-    _run_remote(profile, evidence["address"], action, sudo=True)
-    final = platform_status(name)
-    if final["state"] != "ready":
-        raise DeploymentKitError(
-            f"Host-platform {action} completed but readiness is '{final['state']}', not 'ready'."
-        )
-    final["mutated"] = True
-    return final
+"""Shared Ubuntu box platform ownership and lifecycle operations."""
+
+from __future__ import annotations
+
+import base64
+import hashlib
+import json
+import shlex
+import subprocess
+from typing import Any
+
+from .box_platform_assets import (
+    AVAHI_SERVICE,
+    CADDYFILE,
+    CADDY_CONTAINER,
+    CADDY_IMAGE,
+    COMPOSE_YAML,
+    HOST_PLATFORM_WRITE_PHRASE,
+    NETWORK_NAME,
+    PLATFORM_DISTRIBUTION,
+    PLATFORM_ROOT,
+    PLATFORM_SCHEMA_VERSION,
+    PLATFORM_VERSION,
+    PUBLISH_ALIAS_SH,
+)
+from .box_platform_remote import REMOTE_SCRIPT
+from .errors import DeploymentKitError
+from .profiles import load_profile
+from .ssh import ssh_args, verify_access
+
+_BOOL_KEYS = {
+    "markerPresent",
+    "prerequisitesReady",
+    "networkPresent",
+    "caddyRunning",
+    "avahiRunning",
+    "port80InUse",
+}
+_EXPECTED_KEYS = {
+    "state",
+    "markerPresent",
+    "markerSchemaVersion",
+    "markerDistribution",
+    "markerPlatformVersion",
+    "expectedPlatformVersion",
+    "prerequisitesReady",
+    "networkPresent",
+    "caddyRunning",
+    "avahiRunning",
+    "port80InUse",
+    "platformRoot",
+    "networkName",
+    "caddyContainer",
+}
+
+
+def build_remote_script() -> str:
+    replacements = {
+        "__PLATFORM_ROOT__": PLATFORM_ROOT,
+        "__NETWORK_NAME__": NETWORK_NAME,
+        "__CADDY_CONTAINER__": CADDY_CONTAINER,
+        "__CADDY_IMAGE__": CADDY_IMAGE,
+        "__SCHEMA_VERSION__": str(PLATFORM_SCHEMA_VERSION),
+        "__PLATFORM_VERSION__": PLATFORM_VERSION,
+        "__DISTRIBUTION__": PLATFORM_DISTRIBUTION,
+        "__COMPOSE_B64__": base64.b64encode(COMPOSE_YAML.encode()).decode("ascii"),
+        "__CADDYFILE_B64__": base64.b64encode(CADDYFILE.encode()).decode("ascii"),
+        "__PUBLISH_ALIAS_B64__": base64.b64encode(PUBLISH_ALIAS_SH.encode()).decode("ascii"),
+        "__AVAHI_SERVICE_B64__": base64.b64encode(AVAHI_SERVICE.encode()).decode("ascii"),
+    }
+    script = REMOTE_SCRIPT
+    for placeholder, value in replacements.items():
+        script = script.replace(placeholder, value)
+    if "__" in script:
+        raise DeploymentKitError("Internal host-platform script contains an unresolved placeholder.")
+    return script
+
+
+def _parse_status(output: str) -> dict[str, Any]:
+    result: dict[str, Any] = {}
+    for raw in output.splitlines():
+        if not raw.strip():
+            continue
+        if "=" not in raw:
+            raise DeploymentKitError(f"Malformed host-platform status line: {raw!r}")
+        key, value = raw.split("=", 1)
+        if key not in _EXPECTED_KEYS or key in result:
+            raise DeploymentKitError(f"Unexpected or duplicate host-platform status key: {key!r}")
+        if key in _BOOL_KEYS:
+            if value not in {"true", "false"}:
+                raise DeploymentKitError(f"Invalid boolean host-platform status value for {key}.")
+            result[key] = value == "true"
+        else:
+            result[key] = value
+    missing = _EXPECTED_KEYS - result.keys()
+    if missing:
+        raise DeploymentKitError(
+            "Host-platform status omitted required keys: " + ", ".join(sorted(missing))
+        )
+    return result
+
+
+def _run_remote(profile: dict[str, Any], address: str, action: str, *, sudo: bool) -> str:
+    if action not in {"status", "install", "upgrade"}:
+        raise DeploymentKitError(f"Unsupported host-platform action: {action}")
+    remote_command = "bash -s -- " + shlex.quote(action)
+    if sudo:
+        remote_command = "sudo -n " + remote_command
+    command = ssh_args(profile, address, command=remote_command)
+    completed = subprocess.run(
+        command,
+        input=build_remote_script().encode("utf-8"),
+        check=False,
+        capture_output=True,
+    )
+    stdout = completed.stdout.decode("utf-8", errors="replace")
+    stderr = completed.stderr.decode("utf-8", errors="replace")
+    if completed.returncode != 0:
+        detail = stderr.strip() or stdout.strip() or f"exit {completed.returncode}"
+        raise DeploymentKitError(f"Remote host-platform {action} failed: {detail}")
+    return stdout
+
+
+def platform_status(name: str) -> dict[str, Any]:
+    profile = load_profile(name)
+    evidence = verify_access(profile)
+    status = _parse_status(_run_remote(profile, evidence["address"], "status", sudo=True))
+    status["targetName"] = name
+    status["verifiedAddress"] = evidence["address"]
+    return status
+
+
+def platform_doctor(name: str) -> dict[str, Any]:
+    status = platform_status(name)
+    next_actions = {
+        "installable": "platform-install",
+        "upgrade-required": "platform-upgrade",
+        "drifted": "inspect-platform-drift",
+        "blocked": "prepare-host-prerequisites",
+        "blocked-port-80": "identify-existing-port-80-owner",
+        "incompatible": "manual-platform-recovery",
+        "ready": "none",
+    }
+    status["nextAction"] = next_actions.get(status["state"], "manual-review")
+    status["mutated"] = False
+    return status
+
+
+def _snapshot(status: dict[str, Any]) -> str:
+    selected = {key: status[key] for key in sorted(_EXPECTED_KEYS)}
+    return hashlib.sha256(json.dumps(selected, sort_keys=True, separators=(",", ":")).encode()).hexdigest()
+
+
+def plan_platform_change(name: str, action: str) -> dict[str, Any]:
+    if action not in {"install", "upgrade"}:
+        raise DeploymentKitError("Platform change action must be install or upgrade.")
+    status = platform_status(name)
+    expected_state = "installable" if action == "install" else "upgrade-required"
+    if status["state"] != expected_state:
+        raise DeploymentKitError(
+            f"Platform {action} requires state '{expected_state}', but target '{name}' is '{status['state']}'."
+        )
+    return {
+        "targetName": name,
+        "action": action,
+        "fromState": status["state"],
+        "toPlatformVersion": PLATFORM_VERSION,
+        "distribution": PLATFORM_DISTRIBUTION,
+        "platformRoot": PLATFORM_ROOT,
+        "preserves": ["route-conf.d", "route-registry", "caddy-data", "caddy-config", "shared-network"],
+        "doesNotOwn": ["application-containers", "application-data", "application-routes"],
+        "statusSnapshot": _snapshot(status),
+    }
+
+
+def apply_platform_change(plan: dict[str, Any]) -> dict[str, Any]:
+    required = {
+        "targetName",
+        "action",
+        "fromState",
+        "toPlatformVersion",
+        "distribution",
+        "platformRoot",
+        "preserves",
+        "doesNotOwn",
+        "statusSnapshot",
+    }
+    if not isinstance(plan, dict) or set(plan) != required:
+        raise DeploymentKitError("Malformed host-platform change plan.")
+    name = plan["targetName"]
+    action = plan["action"]
+    if action not in {"install", "upgrade"}:
+        raise DeploymentKitError("Malformed host-platform change action.")
+    current = platform_status(name)
+    if _snapshot(current) != plan["statusSnapshot"]:
+        raise DeploymentKitError(
+            "Host-platform state changed after the plan was reviewed; create and authorize a fresh plan."
+        )
+    profile = load_profile(name)
+    evidence = verify_access(profile)
+    _run_remote(profile, evidence["address"], action, sudo=True)
+    final = platform_status(name)
+    if final["state"] != "ready":
+        raise DeploymentKitError(
+            f"Host-platform {action} completed but readiness is '{final['state']}', not 'ready'."
+        )
+    final["mutated"] = True
+    return final

package/assets/generated/deployment/src/lean_poc_deployment/box_platform_assets.py

@@ -1,100 +1,100 @@
-"""Static shared-box platform assets and contract constants."""
-
-PLATFORM_SCHEMA_VERSION = 1
-PLATFORM_VERSION = "2"
-PLATFORM_DISTRIBUTION = "trusted-lan-ubuntu-compose"
-PLATFORM_ROOT = "/srv/lean-poc-platform"
-NETWORK_NAME = "caddy-net"
-CADDY_CONTAINER = "lean-poc-caddy"
-CADDY_IMAGE = "caddy:2.8.4-alpine@sha256:af32e97399febea808609119bb21544d0265c58a02836576e32a2d082c262c17"
-HOST_PLATFORM_WRITE_PHRASE = "[HOST PLATFORM WRITE]"
-
-COMPOSE_YAML = f"""services:
-  caddy:
-    image: {CADDY_IMAGE}
-    container_name: {CADDY_CONTAINER}
-    restart: unless-stopped
-    ports:
-      - \"80:80\"
-    volumes:
-      - {PLATFORM_ROOT}/proxy/Caddyfile:/etc/caddy/Caddyfile:ro
-      - {PLATFORM_ROOT}/proxy/conf.d:/etc/caddy/conf.d:ro
-      - {PLATFORM_ROOT}/proxy/data:/data
-      - {PLATFORM_ROOT}/proxy/config:/config
-    networks:
-      - {NETWORK_NAME}
-    logging:
-      driver: json-file
-      options:
-        max-size: \"10m\"
-        max-file: \"3\"
-
-networks:
-  {NETWORK_NAME}:
-    external: true
-"""
-
-CADDYFILE = """{
-    auto_https off
-}
-
-import /etc/caddy/conf.d/*.caddy
-"""
-
-PUBLISH_ALIAS_SH = """#!/usr/bin/env bash
-set -Eeuo pipefail
-
-: \"${ALIAS_HOSTNAME:?ALIAS_HOSTNAME is required}\"
-
-current_ip() {
-    local ip
-    ip=\"$(ip route get 1.1.1.1 2>/dev/null | awk '{for(i=1;i<=NF;i++) if($i==\"src\") print $(i+1)}')\"
-    if [[ -z \"$ip\" ]]; then
-        ip=\"$(ip -4 addr show scope global | grep -v 'docker' | grep -v 'br-' | awk '/inet / {print $2}' | cut -d/ -f1 | head -n1)\"
-    fi
-    printf '%s\\n' \"$ip\"
-}
-
-CURRENT_IP=\"$(current_ip)\"
-if [[ -z \"$CURRENT_IP\" ]]; then
-    echo \"lean-poc alias publisher: could not determine host LAN IPv4 address.\" >&2
-    exit 1
-fi
-
-/usr/bin/avahi-publish -a -R \"$ALIAS_HOSTNAME\" \"$CURRENT_IP\" &
-AVAHI_PID=$!
-
-cleanup() {
-    kill \"$AVAHI_PID\" 2>/dev/null || true
-    wait \"$AVAHI_PID\" 2>/dev/null || true
-}
-trap cleanup SIGTERM SIGINT EXIT
-
-while kill -0 \"$AVAHI_PID\" 2>/dev/null; do
-    sleep 10
-    NEW_IP=\"$(current_ip)\"
-    if [[ -n \"$NEW_IP\" && \"$NEW_IP\" != \"$CURRENT_IP\" ]]; then
-        cleanup
-        exit 0
-    fi
-done
-wait \"$AVAHI_PID\"
-"""
-
-AVAHI_SERVICE = """[Unit]
-Description=Lean POC mDNS alias %i
-After=network-online.target avahi-daemon.service
-Wants=network-online.target
-Requires=avahi-daemon.service
-
-[Service]
-Type=simple
-EnvironmentFile=/etc/lean-poc-platform/aliases/%i.env
-ExecStart=/usr/local/lib/lean-poc-platform/publish-alias.sh
-Restart=always
-RestartSec=2
-NoNewPrivileges=true
-
-[Install]
-WantedBy=multi-user.target
-"""
+"""Static shared-box platform assets and contract constants."""
+
+PLATFORM_SCHEMA_VERSION = 1
+PLATFORM_VERSION = "2"
+PLATFORM_DISTRIBUTION = "trusted-lan-ubuntu-compose"
+PLATFORM_ROOT = "/srv/lean-poc-platform"
+NETWORK_NAME = "caddy-net"
+CADDY_CONTAINER = "lean-poc-caddy"
+CADDY_IMAGE = "caddy:2.8.4-alpine@sha256:af32e97399febea808609119bb21544d0265c58a02836576e32a2d082c262c17"
+HOST_PLATFORM_WRITE_PHRASE = "[HOST PLATFORM WRITE]"
+
+COMPOSE_YAML = f"""services:
+  caddy:
+    image: {CADDY_IMAGE}
+    container_name: {CADDY_CONTAINER}
+    restart: unless-stopped
+    ports:
+      - \"80:80\"
+    volumes:
+      - {PLATFORM_ROOT}/proxy/Caddyfile:/etc/caddy/Caddyfile:ro
+      - {PLATFORM_ROOT}/proxy/conf.d:/etc/caddy/conf.d:ro
+      - {PLATFORM_ROOT}/proxy/data:/data
+      - {PLATFORM_ROOT}/proxy/config:/config
+    networks:
+      - {NETWORK_NAME}
+    logging:
+      driver: json-file
+      options:
+        max-size: \"10m\"
+        max-file: \"3\"
+
+networks:
+  {NETWORK_NAME}:
+    external: true
+"""
+
+CADDYFILE = """{
+    auto_https off
+}
+
+import /etc/caddy/conf.d/*.caddy
+"""
+
+PUBLISH_ALIAS_SH = """#!/usr/bin/env bash
+set -Eeuo pipefail
+
+: \"${ALIAS_HOSTNAME:?ALIAS_HOSTNAME is required}\"
+
+current_ip() {
+    local ip
+    ip=\"$(ip route get 1.1.1.1 2>/dev/null | awk '{for(i=1;i<=NF;i++) if($i==\"src\") print $(i+1)}')\"
+    if [[ -z \"$ip\" ]]; then
+        ip=\"$(ip -4 addr show scope global | grep -v 'docker' | grep -v 'br-' | awk '/inet / {print $2}' | cut -d/ -f1 | head -n1)\"
+    fi
+    printf '%s\\n' \"$ip\"
+}
+
+CURRENT_IP=\"$(current_ip)\"
+if [[ -z \"$CURRENT_IP\" ]]; then
+    echo \"lean-poc alias publisher: could not determine host LAN IPv4 address.\" >&2
+    exit 1
+fi
+
+/usr/bin/avahi-publish -a -R \"$ALIAS_HOSTNAME\" \"$CURRENT_IP\" &
+AVAHI_PID=$!
+
+cleanup() {
+    kill \"$AVAHI_PID\" 2>/dev/null || true
+    wait \"$AVAHI_PID\" 2>/dev/null || true
+}
+trap cleanup SIGTERM SIGINT EXIT
+
+while kill -0 \"$AVAHI_PID\" 2>/dev/null; do
+    sleep 10
+    NEW_IP=\"$(current_ip)\"
+    if [[ -n \"$NEW_IP\" && \"$NEW_IP\" != \"$CURRENT_IP\" ]]; then
+        cleanup
+        exit 0
+    fi
+done
+wait \"$AVAHI_PID\"
+"""
+
+AVAHI_SERVICE = """[Unit]
+Description=Lean POC mDNS alias %i
+After=network-online.target avahi-daemon.service
+Wants=network-online.target
+Requires=avahi-daemon.service
+
+[Service]
+Type=simple
+EnvironmentFile=/etc/lean-poc-platform/aliases/%i.env
+ExecStart=/usr/local/lib/lean-poc-platform/publish-alias.sh
+Restart=always
+RestartSec=2
+NoNewPrivileges=true
+
+[Install]
+WantedBy=multi-user.target
+"""