@mriekki/project-forge 4.8.1 → 4.9.0

package/assets/generated/deployment/src/project_forge_deployment/cloudflare_ingress_remote.py

@@ -0,0 +1,327 @@
+"""Remote Ubuntu script template for shared Cloudflare Tunnel ingress."""
+
+REMOTE_SCRIPT = r"""#!/usr/bin/env bash
+set -Eeuo pipefail
+
+ACTION="$1"
+SCOPE="$2"
+META="${3:-}"
+SPEC="${4:-}"
+EXPECTED="${5:-}"
+
+PLATFORM_ROOT="__PLATFORM_ROOT__"
+NETWORK_NAME="__NETWORK_NAME__"
+CADDY_CONTAINER="__CADDY_CONTAINER__"
+CLOUDFLARED_IMAGE="__CLOUDFLARED_IMAGE__@sha256:c6c7ae1d5dfdcb094ad344ed68ccffc26635c9c6be80965664c33baf064b0515"
+SCHEMA_VERSION="__SCHEMA_VERSION__"
+INGRESS_VERSION="__INGRESS_VERSION__"
+DISTRIBUTION="__DISTRIBUTION__"
+TOKEN_B64="__TOKEN_B64__"
+
+valid_slug() { [[ "$1" =~ ^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$ ]]; }
+valid_repo() { [[ "$1" =~ ^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$ ]]; }
+valid_hostname() {
+    local host="$1" label
+    [[ -n "$host" && ${#host} -le 253 ]] || return 1
+    [[ "$host" != *:* && "$host" != *" "* && "$host" != */* && "$host" != *,* ]] || return 1
+    IFS='.' read -r -a labels <<< "$host"
+    (( ${#labels[@]} >= 2 )) || return 1
+    for label in "${labels[@]}"; do
+        [[ "$label" =~ ^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$ ]] || return 1
+    done
+}
+
+valid_slug "$SCOPE" || { echo "Invalid Cloudflare ingress scope." >&2; exit 20; }
+
+ROOT="$PLATFORM_ROOT/ingress/cloudflare/$SCOPE"
+MARKER="$ROOT/ingress.env"
+TOKEN_FILE="$ROOT/tunnel-token"
+COMPOSE_FILE="$ROOT/compose.yaml"
+ROUTE_ROOT="$ROOT/routes"
+CONTAINER="project-forge-cloudflared-$SCOPE"
+LOCK_FILE="/run/lock/project-forge-cloudflare-$SCOPE.lock"
+
+marker_value() {
+    local key="$1"
+    [[ -f "$MARKER" ]] || return 1
+    sed -n "s/^${key}=//p" "$MARKER" | head -n1
+}
+
+platform_ready() {
+    [[ "$(docker inspect --format '{{.State.Status}}' "$CADDY_CONTAINER" 2>/dev/null || true)" == "running" ]] &&
+    docker network inspect "$NETWORK_NAME" >/dev/null 2>&1
+}
+
+container_running() {
+    [[ "$(docker inspect --format '{{.State.Status}}' "$CONTAINER" 2>/dev/null || true)" == "running" ]]
+}
+
+container_image() {
+    docker inspect --format '{{.Config.Image}}' "$CONTAINER" 2>/dev/null || true
+}
+
+network_attached() {
+    docker network inspect "$NETWORK_NAME" --format '{{range .Containers}}{{println .Name}}{{end}}' 2>/dev/null |
+        grep -Fxq "$CONTAINER"
+}
+
+status() {
+    local marker=false token=false running=false attached=false platform=false
+    [[ -f "$MARKER" ]] && marker=true
+    [[ -f "$TOKEN_FILE" ]] && token=true
+    container_running && running=true || true
+    network_attached && attached=true || true
+    platform_ready && platform=true || true
+
+    local state marker_schema marker_version marker_distribution marker_image runtime_image
+    marker_schema="$(marker_value SCHEMA_VERSION 2>/dev/null || true)"
+    marker_version="$(marker_value INGRESS_VERSION 2>/dev/null || true)"
+    marker_distribution="$(marker_value DISTRIBUTION 2>/dev/null || true)"
+    marker_image="$(marker_value CLOUDFLARED_IMAGE 2>/dev/null || true)"
+    runtime_image="$(container_image)"
+
+    if [[ "$platform" != true ]]; then
+        state="blocked-platform"
+    elif [[ "$marker" == false ]]; then
+        state="installable"
+    elif [[ "$marker_schema" != "$SCHEMA_VERSION" || "$marker_distribution" != "$DISTRIBUTION" ]]; then
+        state="incompatible"
+    elif [[ "$marker_version" != "$INGRESS_VERSION" || "$marker_image" != "$CLOUDFLARED_IMAGE" ]]; then
+        state="upgrade-required"
+    elif [[ "$running" == true && "$runtime_image" != "$CLOUDFLARED_IMAGE" ]]; then
+        state="drifted"
+    elif [[ "$token" == true && "$running" == true && "$attached" == true && -f "$COMPOSE_FILE" && -d "$ROUTE_ROOT" ]]; then
+        state="ready"
+    else
+        state="drifted"
+    fi
+
+    printf 'state=%s\n' "$state"
+    printf 'scope=%s\n' "$SCOPE"
+    printf 'markerPresent=%s\n' "$marker"
+    printf 'markerSchemaVersion=%s\n' "$marker_schema"
+    printf 'markerIngressVersion=%s\n' "$marker_version"
+    printf 'markerDistribution=%s\n' "$marker_distribution"
+    printf 'platformReady=%s\n' "$platform"
+    printf 'tokenPresent=%s\n' "$token"
+    printf 'containerRunning=%s\n' "$running"
+    printf 'networkAttached=%s\n' "$attached"
+    printf 'containerName=%s\n' "$CONTAINER"
+    printf 'cloudflaredImage=%s\n' "$CLOUDFLARED_IMAGE"
+    printf 'accountId=%s\n' "$(marker_value ACCOUNT_ID 2>/dev/null || true)"
+    printf 'zoneId=%s\n' "$(marker_value ZONE_ID 2>/dev/null || true)"
+    printf 'zoneName=%s\n' "$(marker_value ZONE_NAME 2>/dev/null || true)"
+    printf 'tunnelId=%s\n' "$(marker_value TUNNEL_ID 2>/dev/null || true)"
+    printf 'tunnelName=%s\n' "$(marker_value TUNNEL_NAME 2>/dev/null || true)"
+}
+
+parse_meta() {
+    IFS=$'\t' read -r M_ACCOUNT M_ZONE_ID M_ZONE_NAME M_TUNNEL_ID M_TUNNEL_NAME extra <<< "$META"
+    [[ -z "${extra:-}" && -n "$M_ACCOUNT" && -n "$M_ZONE_ID" && -n "$M_ZONE_NAME" && -n "$M_TUNNEL_ID" && -n "$M_TUNNEL_NAME" ]] || {
+        echo "Malformed Cloudflare ingress metadata." >&2
+        exit 20
+    }
+    valid_hostname "$M_ZONE_NAME" || { echo "Invalid Cloudflare zone name." >&2; exit 20; }
+}
+
+write_marker() {
+    local tmp="$MARKER.tmp.$$"
+    cat > "$tmp" <<EOF
+SCHEMA_VERSION=$SCHEMA_VERSION
+INGRESS_VERSION=$INGRESS_VERSION
+DISTRIBUTION=$DISTRIBUTION
+ACCOUNT_ID=$M_ACCOUNT
+ZONE_ID=$M_ZONE_ID
+ZONE_NAME=$M_ZONE_NAME
+TUNNEL_ID=$M_TUNNEL_ID
+TUNNEL_NAME=$M_TUNNEL_NAME
+CLOUDFLARED_IMAGE=$CLOUDFLARED_IMAGE
+EOF
+    chmod 0600 "$tmp"
+    mv -f "$tmp" "$MARKER"
+}
+
+write_compose() {
+    local tmp="$COMPOSE_FILE.tmp.$$"
+    cat > "$tmp" <<EOF
+services:
+  cloudflared:
+    image: $CLOUDFLARED_IMAGE
+    container_name: $CONTAINER
+    restart: unless-stopped
+    command: tunnel --no-autoupdate run --token-file /run/secrets/tunnel-token
+    volumes:
+      - $TOKEN_FILE:/run/secrets/tunnel-token:ro
+    networks:
+      - $NETWORK_NAME
+    logging:
+      driver: json-file
+      options:
+        max-size: "10m"
+        max-file: "3"
+
+networks:
+  $NETWORK_NAME:
+    external: true
+EOF
+    chmod 0600 "$tmp"
+    docker compose -f "$tmp" config >/dev/null
+    mv -f "$tmp" "$COMPOSE_FILE"
+}
+
+write_token() {
+    [[ -n "$TOKEN_B64" ]] || { echo "Tunnel token was not supplied." >&2; exit 20; }
+    local tmp="$TOKEN_FILE.tmp.$$"
+    printf '%s' "$TOKEN_B64" | base64 --decode > "$tmp"
+    [[ -s "$tmp" ]] || { rm -f "$tmp"; echo "Tunnel token decoded empty." >&2; exit 20; }
+    chmod 0444 "$tmp"
+    mv -f "$tmp" "$TOKEN_FILE"
+}
+
+install_or_upgrade() {
+    platform_ready || { echo "Shared Project Forge Caddy/network platform is not ready." >&2; exit 21; }
+    parse_meta
+    if [[ "$ACTION" == install && -f "$MARKER" ]]; then
+        echo "Cloudflare ingress marker already exists; use upgrade." >&2
+        exit 22
+    fi
+    if [[ "$ACTION" == upgrade && ! -f "$MARKER" ]]; then
+        echo "Cloudflare ingress marker is absent; use install." >&2
+        exit 22
+    fi
+    install -d -m 0700 "$ROOT" "$ROUTE_ROOT"
+    write_token
+    write_compose
+    write_marker
+    docker compose -f "$COMPOSE_FILE" up -d --force-recreate
+    container_running || { echo "cloudflared container did not become running." >&2; exit 23; }
+    [[ "$(container_image)" == "$CLOUDFLARED_IMAGE" ]] || { echo "cloudflared container is not running the expected pinned image." >&2; exit 23; }
+    network_attached || { echo "cloudflared container is not attached to the shared Caddy network." >&2; exit 23; }
+}
+
+parse_spec_value() {
+    IFS=$'\t' read -r R_SCHEMA R_OWNER R_ENV R_APP R_ROUTE R_PUBLIC R_ORIGIN extra <<< "$1"
+    [[ -z "${extra:-}" ]] || { echo "Malformed public-ingress route spec." >&2; exit 30; }
+    [[ "$R_SCHEMA" == "$SCHEMA_VERSION" ]] || { echo "Unsupported public-ingress route schema." >&2; exit 30; }
+    valid_repo "$R_OWNER" || { echo "Invalid route owner repo." >&2; exit 30; }
+    valid_slug "$R_ENV" || { echo "Invalid route environment." >&2; exit 30; }
+    valid_slug "$R_APP" || { echo "Invalid route app slug." >&2; exit 30; }
+    [[ "$R_ROUTE" == "$R_APP--$R_ENV" ]] || { echo "Public-ingress route ID mismatch." >&2; exit 30; }
+    valid_hostname "$R_PUBLIC" || { echo "Invalid public hostname." >&2; exit 30; }
+    [[ "$R_PUBLIC" != *.local ]] || { echo "Public hostname must not use .local." >&2; exit 30; }
+    valid_hostname "$R_ORIGIN" || { echo "Invalid origin hostname." >&2; exit 30; }
+    [[ "$R_ORIGIN" == *.local ]] || { echo "Origin hostname must be a trusted-LAN .local route." >&2; exit 30; }
+}
+
+route_path() { printf '%s/%s.route' "$ROUTE_ROOT" "$1"; }
+route_value() {
+    local path="$1" key="$2"
+    sed -n "s/^${key}=//p" "$path" | head -n1
+}
+emit_route() {
+    local path="$1"
+    printf 'ROUTE\t%s\t%s\t%s\t%s\t%s\t%s\t%s\n' \
+        "$(route_value "$path" SCHEMA_VERSION)" \
+        "$(route_value "$path" OWNER_REPO)" \
+        "$(route_value "$path" ENVIRONMENT)" \
+        "$(route_value "$path" APP_SLUG)" \
+        "$(route_value "$path" ROUTE_ID)" \
+        "$(route_value "$path" PUBLIC_HOSTNAME)" \
+        "$(route_value "$path" ORIGIN_HOSTNAME)"
+}
+route_inventory() {
+    [[ -f "$MARKER" ]] || { echo "Cloudflare ingress is not installed." >&2; exit 31; }
+    local count=0 path
+    for path in "$ROUTE_ROOT"/*.route; do [[ -f "$path" ]] && count=$((count + 1)); done
+    printf 'SUMMARY\tscope\t%s\n' "$SCOPE"
+    printf 'SUMMARY\tmanagedRouteCount\t%s\n' "$count"
+    for path in "$ROUTE_ROOT"/*.route; do [[ -f "$path" ]] && emit_route "$path"; done
+}
+
+metadata_matches() {
+    local path="$1" encoded="$2"
+    parse_spec_value "$encoded"
+    [[ "$(route_value "$path" SCHEMA_VERSION)" == "$R_SCHEMA" &&
+       "$(route_value "$path" OWNER_REPO)" == "$R_OWNER" &&
+       "$(route_value "$path" ENVIRONMENT)" == "$R_ENV" &&
+       "$(route_value "$path" APP_SLUG)" == "$R_APP" &&
+       "$(route_value "$path" ROUTE_ID)" == "$R_ROUTE" &&
+       "$(route_value "$path" PUBLIC_HOSTNAME)" == "$R_PUBLIC" &&
+       "$(route_value "$path" ORIGIN_HOSTNAME)" == "$R_ORIGIN" ]]
+}
+
+route_register() {
+    [[ "$(status | sed -n 's/^state=//p' | head -n1)" == ready ]] || {
+        echo "Cloudflare ingress runtime is not ready." >&2; exit 31;
+    }
+    parse_spec_value "$SPEC"
+    local path other public
+    path="$(route_path "$R_ROUTE")"
+    if [[ "$EXPECTED" == NONE ]]; then
+        [[ ! -e "$path" ]] || { echo "Public-ingress route appeared after planning." >&2; exit 32; }
+    else
+        [[ -f "$path" && ! -L "$path" ]] || { echo "Expected public-ingress route is missing or unsafe." >&2; exit 32; }
+        metadata_matches "$path" "$EXPECTED" || { echo "Public-ingress route changed after planning." >&2; exit 32; }
+        parse_spec_value "$SPEC"
+    fi
+    for other in "$ROUTE_ROOT"/*.route; do
+        [[ -f "$other" ]] || continue
+        [[ "$other" == "$path" ]] && continue
+        public="$(route_value "$other" PUBLIC_HOSTNAME)"
+        [[ "$public" != "$R_PUBLIC" ]] || { echo "Public hostname is already owned by another managed route." >&2; exit 33; }
+    done
+    if [[ -f "$path" ]]; then
+        [[ "$(route_value "$path" OWNER_REPO)" == "$R_OWNER" &&
+           "$(route_value "$path" ENVIRONMENT)" == "$R_ENV" &&
+           "$(route_value "$path" APP_SLUG)" == "$R_APP" ]] || {
+            echo "Existing public-ingress route ownership mismatch." >&2; exit 33;
+        }
+    fi
+    local tmp="$path.tmp.$$"
+    cat > "$tmp" <<EOF
+SCHEMA_VERSION=$R_SCHEMA
+OWNER_REPO=$R_OWNER
+ENVIRONMENT=$R_ENV
+APP_SLUG=$R_APP
+ROUTE_ID=$R_ROUTE
+PUBLIC_HOSTNAME=$R_PUBLIC
+ORIGIN_HOSTNAME=$R_ORIGIN
+EOF
+    chmod 0600 "$tmp"
+    mv -f "$tmp" "$path"
+}
+
+route_remove() {
+    parse_spec_value "$SPEC"
+    local path
+    path="$(route_path "$R_ROUTE")"
+    [[ -f "$path" && ! -L "$path" ]] || { echo "Managed public-ingress route does not exist." >&2; exit 34; }
+    metadata_matches "$path" "$SPEC" || { echo "Public-ingress route ownership/state mismatch." >&2; exit 34; }
+    rm -f "$path"
+}
+
+case "$ACTION" in
+    status)
+        status
+        ;;
+    install|upgrade)
+        exec 9>>"$LOCK_FILE"
+        flock -n 9 || { echo "Another Cloudflare ingress operation holds the lock." >&2; exit 75; }
+        install_or_upgrade
+        status
+        ;;
+    route-inventory)
+        route_inventory
+        ;;
+    route-register|route-remove)
+        exec 9>>"$LOCK_FILE"
+        flock -n 9 || { echo "Another Cloudflare ingress operation holds the lock." >&2; exit 75; }
+        if [[ "$ACTION" == route-register ]]; then route_register; else route_remove; fi
+        route_inventory
+        ;;
+    *)
+        echo "Unsupported Cloudflare ingress action: $ACTION" >&2
+        exit 2
+        ;;
+esac
+"""

package/assets/generated/deployment/src/project_forge_deployment/entrypoint.py

@@ -8,6 +8,7 @@ from .access_cli import main as access_main
 from .app_cli import main as app_main
 from .cli import main as core_main
 from .environment_cli import main as environment_main
+from .ingress_cli import main as ingress_main
 from .local_cli import main as local_main
 from .registry_cli import main as registry_main
 from .sqlite_cli import main as sqlite_main
@@ -23,6 +24,8 @@ def main(argv: list[str] | None = None) -> int:
         return app_main(args[1:])
     if args and args[0] == "environment":
         return environment_main(args[1:])
+    if args and args[0] == "ingress":
+        return ingress_main(args[1:])
     if args and args[0] == "local":
         return local_main(args[1:])
     if args and args[0] == "registry":
@@ -37,6 +40,7 @@ def main(argv: list[str] | None = None) -> int:
         print("Command group: access  Read-only strict SSH target-access diagnosis")
         print("Command group: app  Remote immutable application runtime inventory/deployment")
         print("Command group: environment  Portable profiles, Home Lab onboarding, and image transfer")
+        print("Command group: ingress  Optional public ingress such as Cloudflare Tunnel")
         print("Command group: local  Loopback-only workstation application runtime")
         print("Command group: registry  Read-only exact-image registry access verification")
         print("Command group: sqlite  SQLite persistence import/backup/migration/rollback checks")

package/assets/generated/deployment/src/project_forge_deployment/ingress_cli.py

@@ -0,0 +1,192 @@
+"""CLI for optional public-ingress providers."""
+
+from __future__ import annotations
+
+import argparse
+import json
+import os
+import sys
+from typing import Any
+
+from .cloudflare_ingress import (
+    CLOUDFLARE_API_TOKEN_ENV,
+    HOST_PUBLIC_INGRESS_WRITE_PHRASE,
+    PUBLIC_INGRESS_ROUTE_REMOVE_PHRASE,
+    PUBLIC_INGRESS_ROUTE_WRITE_PHRASE,
+    apply_cloudflare_ingress,
+    apply_public_route,
+    apply_public_route_removal,
+    cloudflare_ingress_doctor,
+    cloudflare_ingress_status,
+    cloudflare_route_inventory,
+    plan_cloudflare_ingress,
+    plan_public_route,
+    plan_public_route_removal,
+)
+from .errors import DeploymentKitError
+
+
+def _print(value: Any, *, as_json: bool) -> None:
+    if as_json:
+        print(json.dumps(value, indent=2, sort_keys=True))
+        return
+    if isinstance(value, dict):
+        for key, item in value.items():
+            if isinstance(item, (dict, list)):
+                print(f"{key}: {json.dumps(item, sort_keys=True)}")
+            else:
+                print(f"{key}: {item}")
+        return
+    print(value)
+
+
+def _token() -> str:
+    value = os.environ.get(CLOUDFLARE_API_TOKEN_ENV, "")
+    if not value.strip():
+        raise DeploymentKitError(
+            f"Cloudflare API authorization is not available. Set {CLOUDFLARE_API_TOKEN_ENV} "
+            "in the current workstation process/secret boundary; never put the token in the Project repository or command line."
+        )
+    return value.strip()
+
+
+def _confirm(args: argparse.Namespace, phrase: str, action: str) -> None:
+    if args.yes:
+        return
+    entered = input(f"Type {phrase} to {action}: ").strip()
+    if entered != phrase:
+        raise DeploymentKitError(f"{action.capitalize()} was not authorized.")
+
+
+def build_parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(prog="project-forge-deploy ingress")
+    providers = parser.add_subparsers(dest="provider", required=True)
+    cloudflare = providers.add_parser("cloudflare", help="Cloudflare Tunnel public ingress")
+    commands = cloudflare.add_subparsers(dest="command", required=True)
+
+    for command in ("status", "doctor"):
+        item = commands.add_parser(command, help=f"Read Cloudflare ingress {command} without writes")
+        item.add_argument("name", help="Logical Project Forge target profile")
+        item.add_argument("--scope", required=True, help="Shared ingress scope, for example production")
+        item.add_argument("--json", action="store_true")
+
+    configure = commands.add_parser(
+        "configure",
+        help="Create/adopt one remotely managed tunnel and install the shared cloudflared runtime",
+    )
+    configure.add_argument("name")
+    configure.add_argument("--scope", required=True)
+    configure.add_argument("--zone", required=True, help="Existing active Cloudflare zone, for example example.com")
+    configure.add_argument("--tunnel-name", help="Optional explicit tunnel name; default is project-forge-<scope>")
+    configure.add_argument("--json", action="store_true")
+    configure.add_argument("--yes", action="store_true")
+
+    route = commands.add_parser("route", help="Project-owned public hostname/DNS routes")
+    route_commands = route.add_subparsers(dest="route_command", required=True)
+
+    inventory = route_commands.add_parser("inventory", help="Read host-side managed public-route ownership")
+    inventory.add_argument("name")
+    inventory.add_argument("--scope", required=True)
+    inventory.add_argument("--json", action="store_true")
+
+    register = route_commands.add_parser(
+        "register",
+        help="Register one exact public hostname through the tunnel to an existing trusted-LAN route",
+    )
+    register.add_argument("name")
+    register.add_argument("--scope", required=True)
+    register.add_argument("--owner-repo", required=True)
+    register.add_argument("--environment", required=True)
+    register.add_argument("--app-slug", required=True)
+    register.add_argument("--public-hostname", required=True)
+    register.add_argument("--origin-hostname", required=True, help="Existing Project Forge .local Caddy hostname")
+    register.add_argument("--json", action="store_true")
+    register.add_argument("--yes", action="store_true")
+
+    remove = route_commands.add_parser("remove", help="Remove one exact owned Cloudflare public route")
+    remove.add_argument("name")
+    remove.add_argument("--scope", required=True)
+    remove.add_argument("--owner-repo", required=True)
+    remove.add_argument("--environment", required=True)
+    remove.add_argument("--app-slug", required=True)
+    remove.add_argument("--json", action="store_true")
+    remove.add_argument("--yes", action="store_true")
+    return parser
+
+
+def main(argv: list[str] | None = None) -> int:
+    args = build_parser().parse_args(argv)
+    try:
+        if args.provider != "cloudflare":
+            raise DeploymentKitError(f"Unsupported public-ingress provider: {args.provider}")
+        if args.command == "status":
+            _print(cloudflare_ingress_status(args.name, args.scope), as_json=args.json)
+            return 0
+        if args.command == "doctor":
+            _print(cloudflare_ingress_doctor(args.name, args.scope), as_json=args.json)
+            return 0
+        if args.command == "configure":
+            token = _token()
+            plan = plan_cloudflare_ingress(
+                args.name,
+                scope=args.scope,
+                zone_name=args.zone,
+                api_token=token,
+                tunnel_name=args.tunnel_name,
+            )
+            _print(plan, as_json=False)
+            _confirm(
+                args,
+                HOST_PUBLIC_INGRESS_WRITE_PHRASE,
+                f"configure Cloudflare public ingress scope {args.scope} on target {args.name}",
+            )
+            _print(apply_cloudflare_ingress(plan, api_token=token), as_json=args.json)
+            return 0
+        if args.command == "route" and args.route_command == "inventory":
+            _print(cloudflare_route_inventory(args.name, args.scope), as_json=args.json)
+            return 0
+        if args.command == "route" and args.route_command == "register":
+            token = _token()
+            plan = plan_public_route(
+                args.name,
+                scope=args.scope,
+                owner_repo=args.owner_repo,
+                environment=args.environment,
+                app_slug=args.app_slug,
+                public_hostname=args.public_hostname,
+                origin_hostname=args.origin_hostname,
+                api_token=token,
+            )
+            _print(plan, as_json=False)
+            if plan["action"] == "already-configured":
+                _print({"state": "already-configured", "route": plan["route"], "mutated": False}, as_json=args.json)
+                return 0
+            _confirm(
+                args,
+                PUBLIC_INGRESS_ROUTE_WRITE_PHRASE,
+                f"publish {args.public_hostname} for {args.owner_repo}/{args.environment}/{args.app_slug}",
+            )
+            _print(apply_public_route(plan, api_token=token), as_json=args.json)
+            return 0
+        if args.command == "route" and args.route_command == "remove":
+            token = _token()
+            plan = plan_public_route_removal(
+                args.name,
+                scope=args.scope,
+                owner_repo=args.owner_repo,
+                environment=args.environment,
+                app_slug=args.app_slug,
+                api_token=token,
+            )
+            _print(plan, as_json=False)
+            _confirm(
+                args,
+                PUBLIC_INGRESS_ROUTE_REMOVE_PHRASE,
+                f"remove public route {plan['route']['publicHostname']}",
+            )
+            _print(apply_public_route_removal(plan, api_token=token), as_json=args.json)
+            return 0
+        raise DeploymentKitError("Unsupported Cloudflare ingress command.")
+    except DeploymentKitError as error:
+        print(f"ERROR: {error}", file=sys.stderr)
+        return 2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mriekki/project-forge",
-  "version": "4.8.1",
+  "version": "4.9.0",
   "description": "Public consumer distribution and updater for Project Forge engineering assets.",
   "type": "module",
   "bin": {