@yunuseon/kayra 0.6.0 → 0.7.0

package/ansible/roles/docker/tasks/main.yml

@@ -33,10 +33,11 @@
   become: true
 
 # Unrotated json-file logs grow until the disk is full. `local` is compressed
-# and rotated; it applies to containers created after the change.
+# and rotated; it applies to containers created after the change. The build
+# cache of `docker build` (a CI runner's, say) grows the same way.
 - name: Configure the Docker daemon
   ansible.builtin.copy:
-    content: "{{ {'log-driver': 'local', 'log-opts': {'max-size': '10m', 'max-file': '3'}} | to_nice_json }}\n"
+    content: "{{ {'log-driver': 'local', 'log-opts': {'max-size': '10m', 'max-file': '3'}, 'builder': {'gc': {'enabled': true, 'defaultKeepStorage': '5GB'}}} | to_nice_json }}\n"
     dest: /etc/docker/daemon.json
     owner: root
     group: root

package/ansible/roles/platform/tasks/main.yml

@@ -231,10 +231,14 @@
 # Start. `up` recreates any container whose interpolated config changed, so
 # a changed .env needs nothing extra.
 # ---------------------------------------------------------------------------
+# Pinned by digest, so an image that is there is the right one: pulling only
+# what is missing makes a run without changes report none (and `kayra plan`
+# exact, where policy always is changed in check mode by definition).
 - name: Pull platform images
   community.docker.docker_compose_v2_pull:
     project_src: "{{ platform_dir }}"
     ignore_buildable: true
+    policy: missing
 
 - name: Start platform
   community.docker.docker_compose_v2:
@@ -249,6 +253,14 @@
   when: traefik_static_config is changed
   changed_when: true
 
+# buildkitd reads its config once at startup, like Traefik.
+- name: Restart BuildKit when its config changed
+  ansible.builtin.command: docker compose restart buildkitd
+  args:
+    chdir: "{{ platform_dir }}"
+  when: platform_files.results | selectattr('item', 'eq', 'buildkit/') | selectattr('changed') | list | length > 0
+  changed_when: true
+
 # Inside the controller, not through Traefik: jenkins.<domain> sits behind
 # Authelia, which would answer every call here with a login redirect.
 - name: Wait for Jenkins

package/cli/dist/cli.js

@@ -1,7 +1,7 @@
 import { command, constant, multiple, object, option, optional, or } from "@optique/core";
 import { message } from "@optique/core/message";
 import { argument } from "@optique/core/primitives";
-import { choice } from "@optique/core/valueparser";
+import { choice, string } from "@optique/core/valueparser";
 import { appNameParser, domainParser, subdomainParser } from "./brand.js";
 /** The arguments kayra takes; server names are the fleet's, so they complete and are checked while parsing. */
 export const parser = (fleet) => {
@@ -12,7 +12,7 @@ export const parser = (fleet) => {
         dryRun: option("--dry-run", { description: message `Print the plan instead of running it.` }),
         command: or(
         // On one server
-        or(onServer("up", message `Provision, set up everything, point /etc/hosts at it.`), onServer("provision", message `Create or update the machine (target home: build the image to import).`), onServer("deploy", message `Host setup and every app, no provisioning.`), onServer("setup", message `The host layer only: the playbook for the server's kind.`), onServer("plan", message `What provision and setup would change, changing nothing (OpenTofu plan, Ansible check mode).`), onServer("apps", message `Make the server's apps match server.yml: register each, remove the rest (data kept).`), onServer("hosts", message `Point the domain at a multipass VM in /etc/hosts (sudo).`), onServer("ssh", message `SSH into the server.`), onServer("down", message `Destroy the machine.`), onServer("adopt", message `Once, for a server we did not create: add the deploy user as root.`), command("backup", command("test", object({ name: constant("backup test"), server })), {
+        or(onServer("up", message `Provision, set up everything, point /etc/hosts at it.`), onServer("provision", message `Create or update the machine (target home: build the image to import).`), onServer("deploy", message `Host setup and every app, no provisioning.`), onServer("setup", message `The host layer only: the playbook for the server's kind.`), onServer("plan", message `What provision and setup would change, changing nothing (OpenTofu plan, Ansible check mode).`), onServer("apps", message `Make the server's apps match server.yml: register each, remove the rest (data kept).`), onServer("hosts", message `Point the domain at a multipass VM in /etc/hosts (sudo).`), command("ssh", object({ name: constant("ssh"), server, remote: multiple(argument(string({ metavar: "COMMAND" }))) }), { brief: message `SSH into the server, or run a command there (after --).` }), onServer("down", message `Destroy the machine.`), onServer("adopt", message `Once, for a server we did not create: add the deploy user as root.`), command("backup", command("test", object({ name: constant("backup test"), server })), {
             brief: message `Restore the latest backup to a scratch dir, check it, delete it.`,
         }), command("app", command("purge", object({ name: constant("app purge"), server, app: argument(appNameParser) })), { brief: message `Delete a removed app's volumes: its data, irreversibly.` })), 
         // On the whole fleet

package/cli/dist/commands/server.js

@@ -26,6 +26,13 @@ const fromMain = (engine, server) => ({
     probe: { kind: "exits-zero", argv: ["bash", script(engine, "require-main.sh"), server.name], env: fleetEnv(engine) },
     onFailure: "stop",
 });
+/** OpenTofu only on the newest committed state: none waiting on an unmerged branch. */
+const latestState = (engine, server) => ({
+    kind: "check",
+    label: `${server.name}'s OpenTofu state is the newest`,
+    probe: { kind: "exits-zero", argv: ["bash", script(engine, "require-latest-state.sh"), within(server.dir, "terraform")] },
+    onFailure: "stop",
+});
 /** Before Ansible's UNREACHABLE: why a home machine cannot be reached. */
 const reachable = (engine, server) => server.target === "home"
     ? [
@@ -59,7 +66,11 @@ export const provision = (engine, server) => ok([
     fromMain(engine, server),
     ...(server.vm ? [run(["bash", script(engine, "home-image.sh"), server.name], fleetEnv(engine))] : []),
     ...(server.terraform
-        ? [run(["tofu", terraform(server), "init", "-input=false"]), run(["tofu", terraform(server), "apply", "-auto-approve"])]
+        ? [
+            latestState(engine, server),
+            run(["tofu", terraform(server), "init", "-input=false"]),
+            run(["tofu", terraform(server), "apply", "-auto-approve"]),
+        ]
         : []),
 ]);
 /** The playbook for the server's kind, as setup runs it; plan adds check mode. */
@@ -99,7 +110,11 @@ export const setup = (engine, server) => ok([
 export const preview = (engine, server) => ok([
     ...reachable(engine, server),
     ...(server.terraform
-        ? [run(["tofu", terraform(server), "init", "-input=false"]), run(["tofu", terraform(server), "plan", "-input=false", "-lock=false"])]
+        ? [
+            latestState(engine, server),
+            run(["tofu", terraform(server), "init", "-input=false"]),
+            run(["tofu", terraform(server), "plan", "-input=false", "-lock=false"]),
+        ]
         : []),
     collections(engine, vaultEnv(server)),
     hostPlaybook(engine, server, ["--check", "--diff"]),
@@ -137,8 +152,9 @@ export const hosts = (engine, server) => ok(server.target === "multipass"
 const sequence = (plans) => map(all(plans), (each) => each.flat());
 export const deploy = (engine, server) => sequence([setup(engine, server), apps(engine, server)]);
 export const up = (engine, server) => sequence([provision(engine, server), deploy(engine, server), hosts(engine, server)]);
-export const down = (server) => server.terraform
+export const down = (engine, server) => server.terraform
     ? ok([
+        latestState(engine, server),
         ...(server.target === "hetzner"
             ? [
                 {
@@ -212,7 +228,8 @@ export const backupTest = (engine, server) => {
         ]),
     ]);
 };
-export const ssh = (server) => server.inventory === undefined
+/** An interactive shell, or the remote command as ssh runs it (the remote shell reads it). */
+export const ssh = (server, remote) => server.inventory === undefined
     ? err(`no inventory for '${server.name}' — provision it first.`)
     : ok([
         run([
@@ -226,6 +243,7 @@ export const ssh = (server) => server.inventory === undefined
             "-o",
             "UserKnownHostsFile=/dev/null",
             `${server.inventory.user}@${server.inventory.host}`,
+            ...remote,
         ]),
     ]);
 /** mkcert certs for a domain and its subdomains, for local dev and multipass. */

package/cli/dist/main.js

@@ -40,9 +40,9 @@ const onServer = (on, target, command) => {
         case "hosts":
             return server.hosts(on, target);
         case "ssh":
-            return server.ssh(target);
+            return server.ssh(target, command.remote);
         case "down":
-            return server.down(target);
+            return server.down(on, target);
         case "adopt":
             return server.adopt(on, target);
         case "backup test":

package/compose/buildkit/buildkitd.toml

@@ -8,6 +8,13 @@
   # Rootless: no process sandbox, and the rootless worker cannot use overlayfs
   # on every kernel, so let BuildKit pick a snapshotter it can actually run.
   max-parallelism = 2
+  # The cache shares the server's disk with everything else; unbounded, it
+  # filled alaz (27 GB). Collected down to maxUsedSpace, sooner when the disk
+  # has less than minFreeSpace left; never below reservedSpace.
+  gc = true
+  reservedSpace = "2GB"
+  maxUsedSpace = "10GB"
+  minFreeSpace = "20%"
 
 [registry."registry:5000"]
   http = true

package/compose/docker-compose.ci.yml

@@ -6,7 +6,7 @@
 
 services:
   registry:
-    image: registry:2.8.3
+    image: registry:2.8.3@sha256:a3d8aaa63ed8681a604f1dea0aa03f100d5895b6a58ace528858a7b332415373
     restart: unless-stopped
     environment:
       # registry-gc.sh deletes manifests nothing references any more.
@@ -30,7 +30,7 @@ services:
   # container, not the box.
   # ---------------------------------------------------------------------------
   buildkitd:
-    image: moby/buildkit:v0.34.0-rootless
+    image: moby/buildkit:v0.34.0-rootless@sha256:65eca3c01cd1180c8f64565c4e3c5983af5145818b0e6fa863385d099eb73855
     restart: unless-stopped
     # Flags go in the command: this image does not read BUILDKITD_FLAGS (that
     # is a buildx convention), and without them it listens on a unix socket

package/compose/docker-compose.yml

@@ -5,7 +5,7 @@
 
 services:
   traefik:
-    image: traefik:v3.7.14
+    image: traefik:v3.7.14@sha256:575fa15b135078fe5e50aa847987d96dbddd7b093c172429618404df73f3fa7c
     restart: unless-stopped
     ports:
       - "80:80"
@@ -39,7 +39,7 @@ services:
   # with no route out that nothing but Traefik joins.
   # ---------------------------------------------------------------------------
   socket-proxy:
-    image: tecnativa/docker-socket-proxy:v0.5.0
+    image: tecnativa/docker-socket-proxy:v0.5.0@sha256:1f5038b54f06c3e18422902cf00ba21803d1c97805aae032e5e6673d532d3459
     restart: unless-stopped
     environment:
       - CONTAINERS=1
@@ -60,7 +60,7 @@ services:
   # infinite redirect. The portal has to stay reachable to authenticate anyone.
   # ---------------------------------------------------------------------------
   authelia:
-    image: authelia/authelia:4.39.28
+    image: authelia/authelia:4.39.28@sha256:bd97cff4fcbf715b5ff1f9ae286afbe6033afce385302520b0368122d43a6f54
     restart: unless-stopped
     environment:
       - X_AUTHELIA_CONFIG=/config/configuration.yml

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yunuseon/kayra",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "A self-hosted app platform and the CLI that runs it: Traefik, Authelia, Jenkins, a registry and rootless BuildKit per server, set up with OpenTofu and Ansible.",
   "license": "MIT",
   "author": "Yunus Öztürk",

package/scripts/local/require-latest-state.sh

@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+# Refuse to run OpenTofu on a state that an unmerged branch has moved past.
+#
+# The fleet commits its (encrypted) states, each change through a PR. Until
+# that PR is merged, main holds the state from before: an apply from there
+# would work from a stale state. The envelope keeps lineage and serial in
+# plaintext, so a newer state is one with the same lineage and a higher
+# serial on any branch of origin.
+#
+# Usage: require-latest-state.sh <terraform-dir>
+set -euo pipefail
+
+dir="${1:?Usage: require-latest-state.sh <terraform-dir>}"
+state="${dir}/terraform.tfstate"
+[ -f "$state" ] || exit 0
+cd "$dir"
+git ls-files --error-unmatch terraform.tfstate >/dev/null 2>&1 || exit 0
+
+path="$(git rev-parse --show-prefix)terraform.tfstate"
+lineage="$(jq -r .lineage terraform.tfstate)"
+serial="$(jq -r .serial terraform.tfstate)"
+git fetch -q --prune origin || { echo "ERROR: could not fetch origin to compare ${path} against." >&2; exit 1; }
+
+newer=()
+while read -r ref; do
+    theirs="$(git show "${ref}:${path}" 2>/dev/null)" || continue
+    [ "$(jq -r .lineage <<<"$theirs")" = "$lineage" ] || continue
+    their_serial="$(jq -r .serial <<<"$theirs")"
+    [ "$their_serial" -gt "$serial" ] && newer+=("${ref#refs/remotes/} (serial ${their_serial})")
+done < <(git for-each-ref --format='%(refname)' refs/remotes/origin | grep -v '/HEAD$')
+
+[ "${#newer[@]}" -eq 0 ] && exit 0
+echo "ERROR: ${path} here is serial ${serial}; a newer one waits on:" >&2
+printf '  %s\n' "${newer[@]}" >&2
+echo "  Merge that PR, then: git pull" >&2
+exit 1