@yunuseon/kayra 0.7.1 → 0.8.1

package/README.md

@@ -4,9 +4,9 @@ A self-hosted app platform for running other people's apps safely, one server
 per customer, all of it as code.
 
 kayra sets up a server (Hetzner, a machine at home, or a local Multipass VM)
-with Traefik, Authelia, Jenkins, a private registry and rootless BuildKit, and
-then builds and deploys apps from their own repositories: a push to an app's
-branch is a deploy. Servers are described in a git repository (a **fleet**);
+with Traefik, Authelia, a private registry, rootless BuildKit and a small
+deployer, and then builds and deploys apps from their own repositories: a push
+to an app's branch is a deploy. Servers are described in a git repository (a **fleet**);
 kayra is the engine that turns that description into running machines.
 
 ```
@@ -14,7 +14,7 @@ kayra is the engine that turns that description into running machines.
  ┌──────────────────────────────┐      ┌───────────────────────┐    ┌──────────────────┐
  │ CLI: kayra up/setup/apps/…   │◀─────│ servers/<name>/       │    │ app.yml          │
  │ Ansible, OpenTofu, compose   │ pins │   server.yml, vars,   │    │ Dockerfiles      │
- │ Jenkins pipeline library     │      │   vault secrets       │    └────────┬─────────┘
+ │ the deployer: build, deploy  │      │   vault secrets       │    └────────┬─────────┘
  │ compose admission policy     │      │ package.json → kayra  │             │ built & deployed
  └──────────────────────────────┘      └───────────────────────┘             ▼ by the platform
 ```
@@ -26,7 +26,7 @@ kayra is the engine that turns that description into running machines.
   modelled on Kubernetes' Pod Security "restricted" before anything starts;
   platform services sit on a network apps cannot reach.
 - **Apps are plain data.** An app is an `app.yml` and its Dockerfiles — no
-  Jenkinsfile, no Ansible. It runs without the platform locally and can leave
+  pipeline, no Ansible. It runs without the platform locally and can leave
   with its customer at any time.
 - **One server per customer, reproducible.** Everything about a server lives in
   its folder of the fleet; secrets per server in Ansible Vault; machines from

package/ansible/playbooks/apps-prune.yml

@@ -1,8 +1,8 @@
 ---
 # =============================================================================
 # Apps-prune playbook — removes every app registered on the server that
-# server.yml no longer lists. Registered = has a 10-<app>.yaml, the one file
-# every app gets. Data (volumes) is kept; see bin/app-remove.
+# server.yml no longer lists. Registered = has an apps/<app>.json, the one
+# file every app gets. Data (volumes) is kept; see bin/app-remove.
 #
 # `keep` is the list of app names in server.yml, as JSON.
 # Usage: kayra apps <server>  (runs this after registering the apps)
@@ -18,13 +18,13 @@
   tasks:
     - name: Find registered apps
       ansible.builtin.find:
-        paths: "{{ platform_dir }}/jenkins/casc"
-        patterns: "10-*.yaml"
-      register: fragments
+        paths: "{{ platform_dir }}/apps"
+        patterns: "*.json"
+      register: registrations
 
     - name: Remove apps no longer in server.yml
       ansible.builtin.command: "{{ platform_dir }}/bin/app-remove {{ item }}"
       loop: "{{ registered | difference(keep) }}"
       vars:
-        registered: "{{ fragments.files | map(attribute='path') | map('basename') | map('regex_replace', '^10-(.*)\\.yaml$', '\\1') | list }}"
+        registered: "{{ registrations.files | map(attribute='path') | map('basename') | map('regex_replace', '\\.json$', '') | list }}"
       changed_when: true

package/ansible/playbooks/platform.yml

@@ -4,14 +4,14 @@
 #
 # Play 1: Bootstrap — base packages, deploy user, Docker installation.
 #         Run once on a fresh server (idempotent, safe to re-run).
-# Play 2: Platform — Traefik + Jenkins + Registry via docker compose.
-#         Re-run whenever platform config, certs, or Jenkins config changes.
+# Play 2: Platform — Traefik, Authelia, the registry, BuildKit, the builder and the deployer via docker compose.
+#         Re-run whenever platform config, or certs change.
 #
 # The platform lives in /opt/platform and knows no app by name. Apps live in
-# /opt/apps/<name> and register with Jenkins via /opt/platform/bin/jenkins-app-apply.
+# /opt/apps/<name> and register through /opt/platform/bin/app-apply.
 #
 # server, server_dir, domain and target are passed via -e. Platform vars
-# (git_token, jenkins_admin_password, etc.) come from servers/<server>/vars.yml.
+# (git_token, webhook_secret, etc.) come from servers/<server>/vars.yml.
 #
 # Usage: kayra setup <server>
 # =============================================================================
@@ -56,7 +56,7 @@
       ansible.builtin.debug:
         msg: |
           Platform ready! ({{ server }})
-          Jenkins:   https://jenkins.{{ domain }}
+          Runs:      https://deploy.{{ domain }}
           Traefik:   https://traefik.{{ domain }}
 
           Next: `kayra apps {{ server }}` to register this server's apps.

package/ansible/roles/app/tasks/main.yml

@@ -5,14 +5,15 @@
 # plaintext) and <app>.secrets.yml (secrets, vault on real servers), and
 # registers the app:
 #   {{ apps_dir }}/<app>/.env                 operator config for compose
-#   {{ platform_dir }}/jenkins/casc/10-<app>.yaml   folder, jobs, credentials
-#   jenkins-app-apply                          secrets + JCasC reload
+#   app-apply                                  secrets → app-secrets/<app>/
+#   {{ platform_dir }}/apps/<app>.json         the registration the deployer
+#                                              and the builder read
 #
 # Compose files are not copied: the deploy takes them from the commit it
 # deploys. Nothing here is specific to any app.
 # =============================================================================
 
-# With the token Jenkins clones with, not the operator's git credentials: a
+# With the token the builder clones with, not the operator's git credentials: a
 # token that cannot read the app fails here, at registration, rather than at
 # its first build. Sent as a header via the environment, so it is neither in
 # the clone's config nor in the process list (Ansible prints the environment
@@ -89,19 +90,30 @@
     mode: "0644"
   become: true
 
-- name: Render the app's JCasC fragment
-  ansible.builtin.template:
-    src: casc-app.yaml.j2
-    dest: "{{ platform_dir }}/jenkins/casc/10-{{ app.name }}.yaml"
-    owner: deploy
-    group: deploy
-    mode: "0644"
-  become: true
-
-- name: Apply secrets and reload Jenkins
+# Secrets before the registration: a push in between finds them in place.
+- name: Apply secrets
   ansible.builtin.command:
-    cmd: "{{ platform_dir }}/bin/jenkins-app-apply {{ app.name }}"
+    cmd: "{{ platform_dir }}/bin/app-apply {{ app.name }}"
     stdin: "{% for key in manifest.secrets | default([]) %}{{ key }}={{ app_secrets[key] }}\n{% endfor %}"
   no_log: true
   become: true
   changed_when: true
+
+# What may deploy where, approved here: hosts and secret keys come from this
+# file, never from the app's repository at the commit being deployed.
+- name: Register the app
+  ansible.builtin.copy:
+    content: "{{ registration | to_nice_json }}\n"
+    dest: "{{ platform_dir }}/apps/{{ app.name }}.json"
+    owner: root
+    group: root
+    mode: "0644"
+  vars:
+    registration:
+      name: "{{ app.name }}"
+      repo: "{{ app_repo }}"
+      ref: "{{ app_ref }}"
+      path: "{{ app.path | default('.') }}"
+      hosts: "{{ manifest.subdomains | map('regex_replace', '$', '.' ~ domain) | list }}"
+      secrets: "{{ manifest.secrets | default([]) }}"
+  become: true

package/ansible/roles/app/templates/app.env.j2

@@ -1,6 +1,6 @@
 # {{ apps_dir }}/{{ app.name }}/.env — generated by the platform app role from
 # servers/{{ server }}/apps/{{ app.name }}.yml. Do not edit on the server.
-# Secrets are not here: the deploy injects them from Jenkins credentials.
+# Secrets are not here: the deployer passes them to compose in its environment.
 
 COMPOSE_PROJECT_NAME={{ app.name }}
 DOMAIN={{ domain }}

package/ansible/roles/common/tasks/main.yml

@@ -54,7 +54,7 @@
 
 # The box runs two JVMs and builds images while serving production. Swap is not
 # a substitute for RAM — it stops the OOM killer picking a random victim
-# (postgres, say) during a Jenkins build.
+# (postgres, say) during a build.
 - name: Create swapfile
   ansible.builtin.shell: fallocate -l 2G /swapfile && chmod 600 /swapfile && mkswap /swapfile
   args:

package/ansible/roles/forgejo-config/tasks/main.yml

@@ -260,7 +260,8 @@
   # Only reads, so it runs in check mode too (kayra plan).
   check_mode: false
 
-# A push to any branch calls the URL (with notifyCommit: Jenkins polls).
+# A push to any branch calls the URL, signed with webhook_secret: the
+# builder's http://builder:8080/hook/<app> over platform-internal checks it.
 - name: Add missing webhooks
   ansible.builtin.uri:
     url: "{{ forgejo_config.url }}/api/v1/repos/{{ item.0.name }}/hooks"
@@ -272,7 +273,7 @@
       active: true
       events: [push]
       branch_filter: "*"
-      config: {url: "{{ item.1 }}", content_type: json, http_method: post}
+      config: {url: "{{ item.1 }}", content_type: json, http_method: post, secret: "{{ webhook_secret }}"}
     status_code: [201]
   changed_when: true
   when: >-
@@ -318,7 +319,7 @@
   loop_control: {label: "{{ item.item.name }}"}
   no_log: true
 
-# Tokens for the platform's services on this server (Jenkins, Renovate), into
+# Tokens for the platform's services on this server (builder and deployer, Renovate), into
 # the files the platform role would otherwise fill from the vault. Nobody ever
 # sees one: kept only in that file, minted again when it is missing, wrong or
 # revoked. Unique names, since the admin token cannot delete a user's tokens.
@@ -368,9 +369,3 @@
   loop_control: {label: "{{ item.item.item.item.secret }}"}
   become: true
   no_log: true
-
-- name: Reload JCasC with the new tokens
-  ansible.builtin.command: "{{ platform_dir }}/bin/jenkins-reload"
-  when: service_tokens_minted is changed
-  become: true
-  changed_when: true

package/ansible/roles/platform/defaults/main.yml

@@ -7,11 +7,6 @@
 # live under apps_dir/<name>. Changing either means changing every app.
 platform_dir: /opt/platform
 apps_dir: /opt/apps
-# The ref of git_remote_url (kayra's repo) Jenkins loads the pipeline library
-# and platform jobs from: the tag of the release the operator ran
-# (kayra_version, passed by kayra), so the Mac and the server run the same
-# kayra. Only a test server sets a branch here instead.
-platform_ref: "v{{ kayra_version }}"
 domain: localhost
 # The engine's files (compose files, scripts) lie above the playbooks, wherever
 # the fleet it serves is; the fleet's (servers/, .cache/) above the server's
@@ -27,25 +22,23 @@ fleet_root: "{{ server_dir }}/../.."
 acme_dns: ""
 acme_dns_token: ""
 
-# Jenkins
-jenkins_admin_user: admin
-jenkins_admin_password: admin
-
-# Git
-git_remote_url: ""
+# The token the builder clones app repos with and the deployer posts commit
+# statuses with (Contents read, Commit statuses write).
 git_token: ""
+# The secret forges sign webhooks with (deploy.<domain>/hook/<app>).
+webhook_secret: ""
 
-# owner/repo of the repos this server's platform-renovate keeps up to date
-# (weekly version-bump PRs); the job exists only where the list is not empty.
+# owner/repo of the repos this server's Renovate job keeps up to date
+# (weekly version-bump PRs); the job runs only where the list is not empty.
 # renovate_token is a PAT reaching each of them: Contents, Pull requests and
 # Issues (the dependency dashboard) read & write. On a server whose own
 # Forgejo hosts them, forgejo_config.tokens mints it (and git_token) instead.
 renovate_repositories: []
 renovate_token: ""
-# When platform-renovate runs, as a Jenkins cron spec: weekly suits other
+# When the Renovate job runs, as a five-field cron spec: weekly suits other
 # people's releases; a server whose repos carry the operator's own images
 # runs it more often, so a new build reaches a PR soon after it is pushed.
-renovate_schedule: "H 4 * * 1"
+renovate_schedule: "0 4 * * 1"
 # Where those repos live: github, or forgejo with renovate_endpoint, its API
 # on platform-internal (http://forgejo:3000/api/v1). With a Forgejo, also
 # renovate_git_url: endpoint, so Renovate clones over that address and not the

package/ansible/roles/platform/tasks/main.yml

@@ -1,6 +1,7 @@
 ---
 # =============================================================================
-# Platform role — Traefik, Authelia, Registry, BuildKit and Jenkins as compose
+# Platform role — Traefik, Authelia, Registry, BuildKit, the builder and the
+# deployer as compose
 # project "platform" in {{ platform_dir }}. App-agnostic.
 #
 # {{ platform_dir }}/.env sets COMPOSE_FILE, so on the server every compose
@@ -28,17 +29,53 @@
     - "{{ platform_dir }}/authelia/secrets"
   become: true
 
-# Written by bin/jenkins-app-apply as root and chowned per app to the
-# controller's uid, so the directory itself stays root's.
-- name: Create Jenkins app secrets directory
+# app-secrets/: written by bin/app-apply as root and chowned per app to the
+# deployer's uid, so the directory itself stays root's. apps/: one
+# registration per app, written by the app role.
+- name: Create the registration and app secrets directories
   ansible.builtin.file:
-    path: "{{ platform_dir }}/jenkins-secrets"
+    path: "{{ platform_dir }}/{{ item }}"
     state: directory
     owner: root
     group: root
     mode: "0755"
+  loop: [apps, app-secrets]
   become: true
 
+# Written by the deployer (uid 1000); the builder reads runs/ for its pages.
+- name: Create the runs and releases directories
+  ansible.builtin.file:
+    path: "{{ platform_dir }}/{{ item }}"
+    state: directory
+    owner: "1000"
+    group: "1000"
+    mode: "0755"
+  loop: [runs, releases]
+  become: true
+  register: deployer_dirs
+
+# Jenkins kept the release records rollback and GC work from; carried over
+# once, the first time releases/ is created. The volume itself stays until
+# deleted by hand.
+- name: Find Jenkins' release records
+  community.docker.docker_volume_info:
+    name: platform_jenkins-home
+  register: jenkins_home
+  when: deployer_dirs.results[1] is changed
+  become: true
+
+- name: Carry Jenkins' release records over
+  ansible.builtin.shell: |
+    set -euo pipefail
+    [ -d "{{ jenkins_home.volume.Mountpoint }}/releases" ] || exit 0
+    cp -a "{{ jenkins_home.volume.Mountpoint }}/releases/." "{{ platform_dir }}/releases/"
+    chown -R 1000:1000 "{{ platform_dir }}/releases"
+  args:
+    executable: /bin/bash
+  when: deployer_dirs.results[1] is changed and jenkins_home.exists | default(false)
+  become: true
+  changed_when: true
+
 # buildkit/ matters more than it looks: without buildkitd.toml the bind mount
 # has no source, Docker creates a directory in its place, and buildkitd
 # crash-loops until the container is recreated.
@@ -55,13 +92,45 @@
     - docker-compose.acme-dns.yml
     - traefik/dynamic/
     - authelia/configuration.yml
-    - jenkins/
-    - jenkins-agent/
     - buildkit/
+    - deployer/
   become: true
   register: platform_files
 
-# Apps register with Jenkins through these, never by touching the controller.
+# The deployer's code and the scripts it and the builder run, into the build
+# context of both images: a checkout's TypeScript, or the published package's
+# JavaScript (Node strips types only outside node_modules).
+- name: Find the deployer's code
+  ansible.builtin.stat:
+    path: "{{ kayra_root }}/cli/src/deployer"
+  register: deployer_source
+  delegate_to: localhost
+  become: false
+
+- name: Copy the deployer's code
+  ansible.builtin.copy:
+    src: "{{ kayra_root }}/cli/{{ code }}/{{ item }}"
+    dest: "{{ platform_dir }}/deployer/app/{{ item }}"
+    owner: deploy
+    group: deploy
+    mode: "0644"
+  loop:
+    - deployer/
+    - "result.{{ 'ts' if deployer_source.stat.exists else 'js' }}"
+  vars:
+    code: "{{ 'src' if deployer_source.stat.exists else 'dist' }}"
+  become: true
+
+- name: Copy the platform scripts
+  ansible.builtin.copy:
+    src: "{{ kayra_root }}/scripts/platform/"
+    dest: "{{ platform_dir }}/deployer/app/scripts/platform/"
+    owner: deploy
+    group: deploy
+    mode: "0644"
+  become: true
+
+# Apps register through these, never by writing the platform's files by hand.
 - name: Install platform scripts
   ansible.builtin.copy:
     src: "{{ kayra_root }}/scripts/server/"
@@ -178,7 +247,7 @@
     database: group
     key: docker
 
-# Read by the controller as uid 1000. An empty var leaves the file as it is:
+# Read by the builder and the deployer as uid 1000. An empty var leaves the file as it is:
 # on a server whose Forgejo mints them (forgejo_config.tokens), that role
 # writes them.
 - name: Create platform secrets directory
@@ -218,6 +287,21 @@
   # It holds secrets: --diff (kayra plan) says that it would change, never how.
   diff: false
 
+# Jenkins is gone; the copies above never delete files.
+- name: Remove what Jenkins left
+  ansible.builtin.file:
+    path: "{{ platform_dir }}/{{ item }}"
+    state: absent
+  loop:
+    - jenkins
+    - jenkins-agent
+    - jenkins-secrets
+    - jenkins-agent.env
+    - bin/jenkins-api
+    - bin/jenkins-reload
+    - bin/jenkins-app-apply
+  become: true
+
 # The registry used to have a public, basic-auth router. Nothing outside the
 # server pushes or pulls, so it is gone; the copy above never deletes files.
 - name: Remove the retired registry basic auth
@@ -240,10 +324,13 @@
     ignore_buildable: true
     policy: missing
 
+# remove_orphans: services the platform dropped (Jenkins' controller and agent)
+# must not keep running.
 - name: Start platform
   community.docker.docker_compose_v2:
     project_src: "{{ platform_dir }}"
     build: always
+    remove_orphans: true
 
 # Only dynamic/ is watched; the static file is read once at startup.
 - name: Restart Traefik when its static config changed
@@ -260,57 +347,3 @@
     chdir: "{{ platform_dir }}"
   when: platform_files.results | selectattr('item', 'eq', 'buildkit/') | selectattr('changed') | list | length > 0
   changed_when: true
-
-# Inside the controller, not through Traefik: jenkins.<domain> sits behind
-# Authelia, which would answer every call here with a login redirect.
-- name: Wait for Jenkins
-  ansible.builtin.command: docker compose exec -T jenkins-controller curl -sf -o /dev/null http://127.0.0.1:8080/login
-  args:
-    chdir: "{{ platform_dir }}"
-  register: jenkins_health
-  retries: 30
-  delay: 10
-  until: jenkins_health.rc == 0
-  changed_when: false
-  # Only reads, so it runs in check mode too (kayra plan).
-  check_mode: false
-
-# casc/ is a bind mount, so a changed 00-platform.yaml only takes effect on
-# a reload; so do new tokens, read from files by ${readFile:…}.
-- name: Reload JCasC
-  ansible.builtin.command: "{{ platform_dir }}/bin/jenkins-reload"
-  when: >-
-    platform_files.results | selectattr('item', 'equalto', 'jenkins/') | selectattr('changed') | list | length > 0
-    or platform_tokens is changed
-  become: true
-  changed_when: true
-
-# ---------------------------------------------------------------------------
-# Agent secret. Fetched every run and kept in its own file: it is derived
-# from Jenkins' own state, so it has no var source, and re-rendering .env must
-# never be able to blank it. Refetching also heals a reset jenkins_home.
-# ---------------------------------------------------------------------------
-- name: Fetch Jenkins agent secret
-  ansible.builtin.command: "{{ platform_dir }}/bin/jenkins-api GET /computer/builder/jenkins-agent.jnlp"
-  register: agent_jnlp
-  no_log: true
-  changed_when: false
-  check_mode: false
-
-- name: Write Jenkins agent secret
-  ansible.builtin.copy:
-    content: "JENKINS_SECRET={{ agent_jnlp.stdout | regex_findall('<argument>([a-f0-9]{64})</argument>') | first }}\n"
-    dest: "{{ platform_dir }}/jenkins-agent.env"
-    owner: deploy
-    group: deploy
-    mode: "0600"
-  no_log: true
-  become: true
-  register: agent_secret
-
-- name: Recreate Jenkins agent with its secret
-  ansible.builtin.command: docker compose up -d --no-deps --force-recreate jenkins-agent
-  args:
-    chdir: "{{ platform_dir }}"
-  when: agent_secret is changed
-  changed_when: true

package/ansible/roles/platform/templates/platform.env.j2

@@ -3,8 +3,8 @@
 #
 # Compose reads it automatically in {{ platform_dir }}, and COMPOSE_FILE means
 # `docker compose <cmd>` there needs no -f flags. App-agnostic: app secrets
-# reach Jenkins through bin/jenkins-app-apply, app config lives in
-# {{ apps_dir }}/<app>/.env. The agent secret lives in jenkins-agent.env.
+# reach the deployer through bin/app-apply, app config lives in
+# {{ apps_dir }}/<app>/.env.
 # =============================================================================
 
 COMPOSE_PROJECT_NAME=platform
@@ -13,8 +13,6 @@ DOMAIN={{ domain }}
 AUTH_POLICY={{ authelia_policy }}
 APPS_DIR={{ apps_dir }}
 DOCKER_GID={{ ansible_facts.getent_group.docker[1] }}
-# Branch the pipeline library and platform jobs are loaded from.
-PLATFORM_REF={{ platform_ref }}
 PLATFORM_RENOVATE={{ (renovate_repositories | length > 0) | lower }}
 RENOVATE_SCHEDULE={{ renovate_schedule }}
 RENOVATE_PLATFORM={{ renovate_platform }}
@@ -24,13 +22,7 @@ RENOVATE_GITHUB_COM_TOKEN={{ renovate_github_com_token }}
 RENOVATE_HOST_RULES={{ renovate_host_rules | to_json if renovate_host_rules else '' }}
 RENOVATE_REPOSITORIES={{ renovate_repositories | to_json }}
 
-# Jenkins
-JENKINS_ADMIN_USER={{ jenkins_admin_user }}
-JENKINS_ADMIN_PASSWORD={{ jenkins_admin_password }}
-
-# Git
-GIT_REMOTE_URL={{ git_remote_url }}
-GITHUB_WEBHOOK_SECRET={{ github_webhook_secret }}
+WEBHOOK_SECRET={{ webhook_secret }}
 
 # Authelia SMTP. Empty address falls the notifier back to a file — passkey
 # enrolment then needs the code read off the server. The password is NOT here:

package/cli/dist/brand.js

@@ -19,9 +19,6 @@ export const absolutePath = (value) => {
 };
 export const kayraRoot = (path) => path;
 export const fleetRoot = (path) => path;
-export const kayraVersion = (value) => typeof value === "string" && /^\d+\.\d+\.\d+$/.test(value)
-    ? ok(value)
-    : err(`'${String(value)}' is not a version MAJOR.MINOR.PATCH`);
 export const serverDir = (root, name) => join(root, "servers", name);
 export const vaultPasswordFile = (path) => path;
 export const within = (base, ...segments) => join(base, ...segments);

package/cli/dist/cli.js

@@ -14,7 +14,16 @@ export const parser = (fleet) => {
         // On one server
         or(onServer("up", message `Provision, set up everything, point /etc/hosts at it.`), onServer("provision", message `Create or update the machine (target home: build the image to import).`), onServer("deploy", message `Host setup and every app, no provisioning.`), onServer("setup", message `The host layer only: the playbook for the server's kind.`), onServer("plan", message `What provision and setup would change, changing nothing (OpenTofu plan, Ansible check mode).`), onServer("apps", message `Make the server's apps match server.yml: register each, remove the rest (data kept).`), onServer("hosts", message `Point the domain at a multipass VM in /etc/hosts (sudo).`), command("ssh", object({ name: constant("ssh"), server, remote: multiple(argument(string({ metavar: "COMMAND" }))) }), { brief: message `SSH into the server, or run a command there (after --).` }), onServer("down", message `Destroy the machine.`), onServer("adopt", message `Once, for a server we did not create: add the deploy user as root.`), command("backup", command("test", object({ name: constant("backup test"), server })), {
             brief: message `Restore the latest backup to a scratch dir, check it, delete it.`,
-        }), command("app", command("purge", object({ name: constant("app purge"), server, app: argument(appNameParser) })), { brief: message `Delete a removed app's volumes: its data, irreversibly.` })), 
+        }), command("app", or(command("purge", object({ name: constant("app purge"), server, app: argument(appNameParser) }), {
+            brief: message `Delete a removed app's volumes: its data, irreversibly.`,
+        }), command("runs", object({ name: constant("app runs"), server, app: argument(appNameParser) }), {
+            brief: message `The app's latest runs: id, result, commit, why.`,
+        }), command("logs", object({ name: constant("app logs"), server, app: argument(appNameParser), more: optional(argument(string({ metavar: "RUN" }))) }), { brief: message `A run's log, the newest unless named.` }), command("deploy", object({ name: constant("app deploy"), server, app: argument(appNameParser), more: optional(argument(string({ metavar: "REF" }))) }), { brief: message `Build and deploy a branch, tag or commit (default: the app's ref).` }), command("rollback", object({ name: constant("app rollback"), server, app: argument(appNameParser), more: optional(argument(string({ metavar: "SHA" }))) }), { brief: message `List earlier releases, or deploy one of them again.` })), { brief: message `An app on a server: its runs, logs, deploys, rollbacks, and purging its data.` }), command("job", object({
+            name: constant("job"),
+            server,
+            job: argument(choice(["gc", "renovate"], { metavar: "JOB" })),
+            noPrs: option("--no-prs", { description: message `Renovate: log what would change, open no PRs.` }),
+        }), { brief: message `Run a platform job now: the registry GC or Renovate.` })), 
         // On the whole fleet
         or(command("status", object({ name: constant("status") }), {
             brief: message `Every server and whether a machine exists for it.`,

package/cli/dist/commands/server.js

@@ -87,8 +87,6 @@ const hostPlaybook = (engine, server, extra = []) => run([
     `domain=${server.domain}`,
     "-e",
     `target=${server.target}`,
-    "-e",
-    `kayra_version=${engine.version}`,
     ...extra,
 ], ansibleEnv(engine, vaultEnv(server)));
 /** The host layer: the playbook for the server's kind. */
@@ -246,5 +244,21 @@ export const ssh = (server, remote) => server.inventory === undefined
             ...remote,
         ]),
     ]);
+const ctlArgs = (command) => {
+    switch (command.kind) {
+        case "job":
+            return ["job", command.job, ...(command.noPrs ? ["--dry-run"] : [])];
+        case "logs":
+            return ["log", command.app, ...(command.more === undefined ? [] : [command.more])];
+        case "runs":
+        case "deploy":
+        case "rollback":
+            return [command.kind, command.app, ...(command.more === undefined ? [] : [command.more])];
+    }
+};
+/** Inside the deployer container, as the deploy user (in the docker group): nothing here needs root. */
+export const deployer = (server, command) => server.kind === "platform"
+    ? ssh(server, ["cd", "/opt/platform", "&&", "docker", "compose", "exec", "-T", "deployer", "kayra-deployer", "ctl", ...ctlArgs(command)])
+    : err(`'${server.name}' is a ${server.kind} server: only platform servers run apps.`);
 /** mkcert certs for a domain and its subdomains, for local dev and multipass. */
 export const certsFor = (engine, domain, subdomains) => ok([certs(engine, domain, subdomains)]);

package/cli/dist/deployer/app.js

@@ -0,0 +1,47 @@
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { err, ok } from "../result.js";
+import { appName } from "./brand.js";
+const strings = (value, pattern) => Array.isArray(value) && value.every((item) => typeof item === "string" && pattern.test(item))
+    ? value
+    : undefined;
+export const field = (record, key) => {
+    const value = Reflect.get(record, key);
+    return value;
+};
+export const parseApp = (expected, json) => {
+    if (typeof json !== "object" || json === null)
+        return err(`${expected}: not an object`);
+    const name = field(json, "name");
+    const repo = field(json, "repo");
+    const ref = field(json, "ref");
+    const path = field(json, "path");
+    const hosts = strings(field(json, "hosts"), /^[a-z0-9.-]+$/);
+    const secrets = strings(field(json, "secrets"), /^[A-Z][A-Z0-9_]*$/);
+    if (name !== expected)
+        return err(`${expected}: registered as ${String(name)}`);
+    const minted = appName(expected);
+    if (!minted.ok)
+        return minted;
+    if (typeof repo !== "string" || !/^(https?|ssh):\/\//.test(repo))
+        return err(`${expected}: repo ${String(repo)}`);
+    if (typeof ref !== "string" || !/^[\w./-]+$/.test(ref))
+        return err(`${expected}: ref ${String(ref)}`);
+    if (typeof path !== "string" || path.split("/").includes(".."))
+        return err(`${expected}: path ${String(path)}`);
+    if (hosts === undefined || secrets === undefined)
+        return err(`${expected}: hosts or secrets malformed`);
+    return ok({ name: minted.value, repo, ref, path, hosts, secrets });
+};
+/** An app registered on this server, from <platformDir>/apps/<name>.json. */
+export const registered = (platformDir, name) => {
+    const path = join(platformDir, "apps", `${name}.json`);
+    if (!appName(name).ok || !existsSync(path))
+        return err(`${name} is not registered here`);
+    try {
+        return parseApp(name, JSON.parse(readFileSync(path, "utf8")));
+    }
+    catch (error) {
+        return err(`${path}: ${String(error)}`);
+    }
+};

package/cli/dist/deployer/brand.js

@@ -0,0 +1,8 @@
+import { err, ok } from "../result.js";
+export const appName = (value) => /^[a-z][a-z0-9-]*$/.test(value) ? ok(value) : err(`'${value}' is not an app name`);
+export const sha = (value) => /^[0-9a-f]{40}$/.test(value) ? ok(value) : err(`'${value}' is not a full commit id`);
+export const runId = (value) => /^\d{8}T\d{6}Z-[0-9a-f]{6}$/.test(value) ? ok(value) : err(`'${value}' is not a run id`);
+export const newRunId = (now, random) => `${now.toISOString().replace(/[-:]/g, "").replace(/\.\d+Z$/, "Z")}-${random}`;
+export const appOwner = (app) => app;
+export const jobOwner = (job) => `_${job}`;
+export const owner = (value) => /^(_gc|_renovate|[a-z][a-z0-9-]*)$/.test(value) ? ok(value) : err(`'${value}' has no runs`);