@yunuseon/kayra 0.7.1 → 0.8.1

package/cli/dist/main.js

@@ -1,8 +1,7 @@
 #!/usr/bin/env node
 import { run } from "@optique/run";
-import { readFileSync } from "node:fs";
 import { createInterface } from "node:readline/promises";
-import { absolutePath, kayraRoot, kayraVersion, within } from "./brand.js";
+import { absolutePath, kayraRoot, within } from "./brand.js";
 import { parser } from "./cli.js";
 import { doctor } from "./commands/doctor.js";
 import * as server from "./commands/server.js";
@@ -19,10 +18,11 @@ const engine = absolutePath(import.meta.dirname);
 if (!here.ok || !engine.ok)
     throw new Error("node reported a relative path");
 const kayra = kayraRoot(within(engine.value, "..", ".."));
-const manifest = JSON.parse(readFileSync(within(kayra, "package.json"), "utf8"));
-const version = kayraVersion(typeof manifest === "object" && manifest !== null && "version" in manifest ? manifest.version : undefined);
-if (!version.ok)
-    throw new Error(`kayra's package.json: ${version.error}`);
+const appKinds = { "app runs": "runs", "app logs": "logs", "app deploy": "deploy", "app rollback": "rollback" };
+const isDeployer = (command) => command.name === "job" || command.name in appKinds;
+const deployerCommand = (command) => command.name === "job"
+    ? { kind: "job", job: command.job, noPrs: command.noPrs }
+    : { kind: appKinds[command.name], app: command.app, more: "more" in command ? command.more : undefined };
 const onServer = (on, target, command) => {
     switch (command.name) {
         case "up":
@@ -50,13 +50,17 @@ const onServer = (on, target, command) => {
     }
 };
 const plan = (fleet, command) => {
-    const on = { kayra, version: version.value, fleet: fleet.root };
+    const on = { kayra, fleet: fleet.root };
     if (command.name === "doctor")
         return ok(doctor(fleet, kayra));
     if (command.name === "certs")
         return server.certsFor(on, command.domain, command.subdomains);
     if (command.name === "app purge")
         return flatMap(serverNamed(fleet, command.server), (target) => server.appPurge(on, target, command.app));
+    if (isDeployer(command)) {
+        const deployerArgs = deployerCommand(command);
+        return flatMap(serverNamed(fleet, command.server), (target) => server.deployer(target, deployerArgs));
+    }
     return flatMap(serverNamed(fleet, command.server), (target) => onServer(on, target, command));
 };
 const io = {

package/cli/dist/settings.js

@@ -15,16 +15,13 @@ export const settings = [
     setting("acme_email", ["platform", "edge"], text, "The Let's Encrypt account contact: expiry warnings land here."),
     setting("docker_version", ["platform", "edge"], text, "The Docker CE major the docker role pins and holds, as an apt version glob (default 5:29*)."),
     // platform: the platform role
-    setting("git_remote_url", platform, text, "kayra's repository: Jenkins loads the pipeline library and platform jobs from it."),
-    setting("platform_ref", platform, text, "The ref of git_remote_url Jenkins loads from; defaults to the tag of the kayra version that ran (v<version>). Only a test server sets a branch."),
-    setting("jenkins_admin_user", platform, text, "Jenkins' local admin user (default admin)."),
     setting("authelia_policy", platform, z.enum(["one_factor", "two_factor"]), "What Authelia asks of staff: two_factor (default) or one_factor."),
     setting("authelia_smtp_address", platform, text, "SMTP server for Authelia's mails (passkey enrolment); empty: mails go to a file."),
     setting("authelia_smtp_username", platform, text, "SMTP user for Authelia."),
     setting("authelia_smtp_sender", platform, text, "Sender address of Authelia's mails."),
     setting("acme_dns", platform, z.enum(["", "hetzner"]), "Certificates by DNS-01 instead of HTTP-01, for a server the internet never reaches: the DNS provider (hetzner)."),
-    setting("renovate_repositories", platform, texts, "owner/repo of the repos this server's platform-renovate keeps up to date; the job exists only where the list is not empty."),
-    setting("renovate_schedule", platform, text, "When platform-renovate runs, as a Jenkins cron spec (default weekly: H 4 * * 1)."),
+    setting("renovate_repositories", platform, texts, "owner/repo of the repos this server's Renovate job keeps up to date; the job runs only where the list is not empty."),
+    setting("renovate_schedule", platform, text, "When the Renovate job runs, as a five-field cron spec in the server's time (default weekly: 0 4 * * 1)."),
     setting("renovate_platform", platform, z.enum(["github", "forgejo"]), "Where the repos live: github (default) or forgejo."),
     setting("renovate_endpoint", platform, text, "With a Forgejo: its API on platform-internal, e.g. http://forgejo:3000/api/v1."),
     setting("renovate_git_url", platform, z.enum(["default", "ssh", "endpoint"]), "How Renovate clones; endpoint with a Forgejo, so it uses the internal address."),
@@ -74,10 +71,9 @@ export const settings = [
         repositories: z.array(record({ name: text, url: text, user: text, restore_test_max_days: z.number().optional() })),
     }), "The hourly check of the private network's backups: when a snapshot is stale, where issues go, which repositories."),
     // Secrets
-    secret("jenkins_admin_password", platform, text, "Jenkins' admin password."),
-    secret("git_token", platform, text, "Token Jenkins clones and posts commit statuses with."),
-    secret("github_webhook_secret", platform, text, "HMAC secret of the apps' GitHub push webhooks."),
-    secret("renovate_token", platform, text, "Token platform-renovate opens PRs with."),
+    secret("git_token", platform, text, "Token the builder clones app repos with and the deployer posts commit statuses with."),
+    secret("webhook_secret", platform, text, "HMAC secret the apps' push webhooks (deploy.<domain>/hook/<app>) are signed with."),
+    secret("renovate_token", platform, text, "Token the Renovate job opens PRs with."),
     secret("renovate_github_com_token", platform, text, "Public-read GitHub token for Renovate's lookups off GitHub."),
     secret("authelia_session_secret", platform, text, "Authelia's session secret."),
     secret("authelia_storage_encryption_key", platform, text, "Authelia's storage encryption key."),
@@ -110,7 +106,7 @@ export const defaultsSchema = z.strictObject(shape(settings.filter((each) => !ea
 export const secretsSchema = (kind) => z.looseObject(shape(settingsFor(kind, true)));
 /** server.yml: topology only. */
 export const serverSchema = z.strictObject({
-    kind: z.enum(serverKinds).optional().describe("Which playbook: platform (default; Traefik, Authelia, Jenkins, apps), edge or nas."),
+    kind: z.enum(serverKinds).optional().describe("Which playbook: platform (default; Traefik, Authelia, the deployer, apps), edge or nas."),
     target: z.enum(["hetzner", "multipass", "home"]).describe("Where it runs: hetzner, multipass (a local VM) or home (a machine nothing creates)."),
     domain: z.string().describe("The server's domain; platform subdomains and the apps' hang off it."),
     vault: z.boolean().optional().describe("secrets.yml is vault-encrypted (required outside multipass)."),

package/compose/authelia/configuration.yml

@@ -1,5 +1,5 @@
 # =============================================================================
-# Authelia — login for the platform's own pages (Jenkins, Traefik's
+# Authelia — login for the platform's own pages (the runs pages, Traefik's
 # dashboard). Apps bring their own login; their users never live here.
 #
 # Authelia does NOT expand ${VAR} the way docker compose does. Interpolation here
@@ -86,7 +86,7 @@ authentication_backend:
 access_control:
   default_policy: 'deny'
   rules:
-    - domain: 'jenkins.{{ env "DOMAIN" }}'
+    - domain: 'deploy.{{ env "DOMAIN" }}'
       policy: '{{ env "AUTH_POLICY" }}'
       subject:
         - 'group:admin'
@@ -104,7 +104,7 @@ session:
   expiration: '1 day'
   remember_me: '1 week'
   cookies:
-      # The apex, not auth.<DOMAIN> — the cookie has to reach jenkins.<DOMAIN>
+      # The apex, not auth.<DOMAIN> — the cookie has to reach deploy.<DOMAIN>
       # and traefik.<DOMAIN> too. Authelia requires this to be a suffix of (or equal to) authelia_url.
     - domain: '{{ env "DOMAIN" }}'
       authelia_url: 'https://auth.{{ env "DOMAIN" }}'

package/compose/deployer/Dockerfile.builder

@@ -0,0 +1,37 @@
+# =============================================================================
+# The builder — git, buildctl, jq, yq and node: it clones app repositories,
+# builds their images through buildkitd and answers forge webhooks.
+#
+# Deliberately has NO docker CLI and no docker socket: it handles code from
+# arbitrary commits, and the host's socket would make that host root. Images
+# are built by buildkitd over TCP. No language toolchain either: apps build and
+# test inside their Dockerfiles, so a new app never changes this image.
+#
+# Context: <platform_dir>/kayra, copied by the platform role (the deployer's
+# code and the platform scripts).
+# =============================================================================
+
+FROM node:24.21.0-trixie-slim@sha256:173f125896c3b47ddf056734c7ea789d04595a6a08769a8f78e0df642781fb66
+
+# renovate: datasource=github-releases depName=moby/buildkit
+ARG BUILDKIT_VERSION=v0.34.0
+# renovate: datasource=github-releases depName=mikefarah/yq
+ARG YQ_VERSION=v4.54.1
+
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends ca-certificates curl git jq && \
+    arch="$(dpkg --print-architecture)" && \
+    curl -fsSL "https://github.com/moby/buildkit/releases/download/${BUILDKIT_VERSION}/buildkit-${BUILDKIT_VERSION}.linux-${arch}.tar.gz" \
+      | tar -xz -C /usr/local bin/buildctl && \
+    curl -fsSL -o /usr/local/bin/yq "https://github.com/mikefarah/yq/releases/download/${YQ_VERSION}/yq_linux_${arch}" && \
+    chmod +x /usr/local/bin/yq && \
+    rm -rf /var/lib/apt/lists/* && \
+    install -d -o node -g node /work
+
+COPY --chmod=0755 kayra-deployer /usr/local/bin/kayra-deployer
+COPY app /opt/kayra
+# The code is ES modules, from either a checkout (.ts) or the package (.js).
+RUN echo '{"type": "module"}' > /opt/kayra/package.json
+
+USER node
+ENTRYPOINT ["kayra-deployer"]

package/compose/deployer/Dockerfile.deployer

@@ -0,0 +1,40 @@
+# =============================================================================
+# The deployer — node, the Docker CLI with Compose, buildctl and jq: it admits
+# and starts apps, records releases and runs the platform's jobs (registry GC,
+# Renovate). The only container of the platform's CI with the docker socket,
+# and Traefik never routes to it.
+#
+# Context: <platform_dir>/kayra, copied by the platform role.
+# =============================================================================
+
+FROM node:24.21.0-trixie-slim@sha256:173f125896c3b47ddf056734c7ea789d04595a6a08769a8f78e0df642781fb66
+
+# renovate: datasource=github-releases depName=moby/buildkit
+ARG BUILDKIT_VERSION=v0.34.0
+# What the Renovate job runs, pinned here so Renovate keeps it current itself.
+# renovate: datasource=docker depName=renovate/renovate
+ARG RENOVATE_VERSION=44.115.10
+ENV RENOVATE_IMAGE=renovate/renovate:${RENOVATE_VERSION}
+
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends ca-certificates curl gnupg jq && \
+    install -m 0755 -d /etc/apt/keyrings && \
+    curl -fsSL https://download.docker.com/linux/debian/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg && \
+    chmod a+r /etc/apt/keyrings/docker.gpg && \
+    echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] \
+      https://download.docker.com/linux/debian $(. /etc/os-release && echo "$VERSION_CODENAME") stable" \
+      > /etc/apt/sources.list.d/docker.list && \
+    apt-get update && \
+    apt-get install -y --no-install-recommends docker-ce-cli docker-compose-plugin && \
+    arch="$(dpkg --print-architecture)" && \
+    curl -fsSL "https://github.com/moby/buildkit/releases/download/${BUILDKIT_VERSION}/buildkit-${BUILDKIT_VERSION}.linux-${arch}.tar.gz" \
+      | tar -xz -C /usr/local bin/buildctl && \
+    rm -rf /var/lib/apt/lists/*
+
+COPY --chmod=0755 kayra-deployer /usr/local/bin/kayra-deployer
+COPY app /opt/kayra
+# The code is ES modules, from either a checkout (.ts) or the package (.js).
+RUN echo '{"type": "module"}' > /opt/kayra/package.json
+
+USER node
+ENTRYPOINT ["kayra-deployer"]

package/compose/deployer/kayra-deployer

@@ -0,0 +1,6 @@
+#!/bin/sh
+# kayra-deployer builder | deployer | ctl … — the deployer's one program, as
+# TypeScript from a kayra checkout or JavaScript from the published package.
+main=/opt/kayra/deployer/main.ts
+[ -e "$main" ] || main=/opt/kayra/deployer/main.js
+exec node "$main" "$@"

package/compose/docker-compose.ci.yml

@@ -1,5 +1,5 @@
 # =============================================================================
-# Platform CI overlay — Docker Registry + Jenkins (controller + agent)
+# Platform CI overlay — Docker Registry, BuildKit, the builder and the deployer
 # App-agnostic: provides CI/CD infrastructure for any application.
 # Usage: docker compose -f docker-compose.yml -f docker-compose.ci.yml up
 # =============================================================================
@@ -53,104 +53,96 @@ services:
     networks:
       - internal
 
-  jenkins-controller:
+  # ---------------------------------------------------------------------------
+  # The builder: clones app repos and builds their images through buildkitd,
+  # answers forge webhooks, shows the runs. Faces app code and the internet,
+  # so it gets no docker socket, no docker CLI and no app secrets.
+  # ---------------------------------------------------------------------------
+  builder:
     build:
-      context: ./jenkins
-      dockerfile: Dockerfile
-    # The controller runs as jenkins (uid/gid 1000) and reaches the socket via
-    # the host's docker group, whose GID differs per host.
+      context: ./deployer
+      dockerfile: Dockerfile.builder
+    restart: unless-stopped
+    command: ["builder"]
+    environment:
+      - WEBHOOK_SECRET=${WEBHOOK_SECRET:-}
+      - BUILDKIT_HOST=tcp://buildkitd:1234
+      - REGISTRY_PUSH_HOST=registry:5000
+    volumes:
+      - builder-work:/work
+      - ./apps:/opt/platform/apps:ro
+      - ./runs:/opt/platform/runs:ro
+      # GIT_TOKEN, to clone. Files, so a new one needs no restart.
+      - ./platform-secrets:/run/platform-secrets:ro
+    mem_limit: 512m
+    labels:
+      - "traefik.enable=true"
+      - "traefik.docker.network=platform-internal"
+      - "traefik.http.routers.deploy.rule=Host(`deploy.${DOMAIN:-localhost}`)"
+      - "traefik.http.routers.deploy.entrypoints=websecure"
+      - "traefik.http.routers.deploy.tls.certresolver=le"
+      - "traefik.http.routers.deploy.middlewares=authelia@file"
+      - "traefik.http.routers.deploy.service=deploy"
+      # Forges cannot log in; the builder checks the payload's HMAC instead.
+      - "traefik.http.routers.deploy-hook.rule=Host(`deploy.${DOMAIN:-localhost}`) && PathPrefix(`/hook/`)"
+      - "traefik.http.routers.deploy-hook.entrypoints=websecure"
+      - "traefik.http.routers.deploy-hook.tls.certresolver=le"
+      - "traefik.http.routers.deploy-hook.priority=100"
+      - "traefik.http.routers.deploy-hook.service=deploy"
+      - "traefik.http.services.deploy.loadbalancer.server.port=8080"
+    networks:
+      - internal
+    depends_on:
+      buildkitd:
+        condition: service_started
+
+  # ---------------------------------------------------------------------------
+  # The deployer: the queue, admission, `docker compose up`, release records,
+  # commit statuses, and the platform's jobs (registry GC, Renovate, the
+  # hourly poll). The one container here with the docker socket and the app
+  # secrets; Traefik never routes to it. Everything it gets from the builder
+  # is checked again, and compose files still go through the policy.
+  #
+  # No COMPOSE_PROJECT_NAME here on purpose: every deploy runs `docker
+  # compose -p <app>`, and an exported project name would beat it. The
+  # platform's directories are mounted at their own paths.
+  # ---------------------------------------------------------------------------
+  deployer:
+    build:
+      context: ./deployer
+      dockerfile: Dockerfile.deployer
+    restart: unless-stopped
+    command: ["deployer"]
+    # The socket's group, whose GID differs per host.
     group_add:
       - ${DOCKER_GID:?}
-    restart: unless-stopped
-    # No COMPOSE_PROJECT_NAME here on purpose: every app's deploy runs
-    # `docker compose` from this container, and an exported project name would
-    # beat the one the deploy passes. APPS_DIR is where app .env files live.
     environment:
-      - JENKINS_ADMIN_USER=${JENKINS_ADMIN_USER:-admin}
-      - JENKINS_ADMIN_PASSWORD=${JENKINS_ADMIN_PASSWORD:-admin}
-      - JENKINS_GIT_REPO=${GIT_REMOTE_URL:?}
-      - GITHUB_WEBHOOK_SECRET=${GITHUB_WEBHOOK_SECRET:-}
       - DOMAIN=${DOMAIN:-localhost}
       - APPS_DIR=${APPS_DIR:?}
-      - PLATFORM_REF=${PLATFORM_REF:?}
+      - PLATFORM_DIR=/opt/platform
       - PLATFORM_RENOVATE=${PLATFORM_RENOVATE:-false}
-      - RENOVATE_SCHEDULE=${RENOVATE_SCHEDULE:-H 4 * * 1}
+      - RENOVATE_SCHEDULE=${RENOVATE_SCHEDULE:-0 4 * * 1}
       - RENOVATE_PLATFORM=${RENOVATE_PLATFORM:-github}
       - RENOVATE_ENDPOINT=${RENOVATE_ENDPOINT:-}
       - RENOVATE_GIT_URL=${RENOVATE_GIT_URL:-}
       - RENOVATE_GITHUB_COM_TOKEN=${RENOVATE_GITHUB_COM_TOKEN:-}
       - RENOVATE_HOST_RULES=${RENOVATE_HOST_RULES:-}
       - RENOVATE_REPOSITORIES=${RENOVATE_REPOSITORIES:-}
-      # Tell JCasC to merge every YAML in this directory at startup.
-      - CASC_JENKINS_CONFIG=/var/jenkins_home/casc
     volumes:
-      - jenkins-home:/var/jenkins_home
-      # The controller is the only node with the docker socket, and it runs
-      # the deploy stage, so it needs the app's compose directory too.
       - /var/run/docker.sock:/var/run/docker.sock
       - ${APPS_DIR:?}:${APPS_DIR:?}:ro
-      - ./jenkins/casc:/var/jenkins_home/casc:ro
-      # One directory per app, one file per secret; JCasC reads them with
-      # ${readFile:...}. Written by bin/jenkins-app-apply.
-      - ./jenkins-secrets:/run/app-secrets:ro
-      # GIT_TOKEN and RENOVATE_TOKEN, likewise: files, so a new one needs a
-      # reload, not a restart. Written by the platform role (or forgejo-config).
+      - ./apps:/opt/platform/apps:ro
+      - ./runs:/opt/platform/runs
+      - ./releases:/opt/platform/releases
+      # One directory per app, one file per secret. Written by bin/app-apply.
+      - ./app-secrets:/run/app-secrets:ro
+      # GIT_TOKEN (commit statuses) and RENOVATE_TOKEN.
       - ./platform-secrets:/run/platform-secrets:ro
-    labels:
-      - "traefik.enable=true"
-      - "traefik.docker.network=platform-internal"
-      - "traefik.http.routers.jenkins.rule=Host(`jenkins.${DOMAIN:-localhost}`)"
-      - "traefik.http.routers.jenkins.entrypoints=websecure"
-      - "traefik.http.routers.jenkins.tls.certresolver=le"
-      - "traefik.http.routers.jenkins.middlewares=authelia@file"
-      - "traefik.http.routers.jenkins.service=jenkins"
-      # GitHub cannot log in; the plugin checks the payload's HMAC instead.
-      - "traefik.http.routers.jenkins-webhook.rule=Host(`jenkins.${DOMAIN:-localhost}`) && Path(`/github-webhook/`)"
-      - "traefik.http.routers.jenkins-webhook.entrypoints=websecure"
-      - "traefik.http.routers.jenkins-webhook.tls.certresolver=le"
-      - "traefik.http.routers.jenkins-webhook.priority=100"
-      - "traefik.http.routers.jenkins-webhook.service=jenkins"
-      - "traefik.http.services.jenkins.loadbalancer.server.port=8080"
+    mem_limit: 512m
     networks:
       - internal
-    healthcheck:
-      test: ["CMD", "curl", "-sf", "http://127.0.0.1:8080/login"]
-      interval: 15s
-      timeout: 5s
-      retries: 10
-      start_period: 60s
-
-  jenkins-agent:
-    build:
-      context: ./jenkins-agent
-      dockerfile: Dockerfile
-    restart: unless-stopped
-    # Written by the platform role once Jenkins is up; absent on first start,
-    # when the agent crash-loops until the role recreates it with the secret.
-    env_file:
-      - path: ./jenkins-agent.env
-        required: false
-    environment:
-      - JENKINS_URL=http://jenkins-controller:8080
-      - JENKINS_AGENT_NAME=builder
-      - JENKINS_AGENT_WORKDIR=/home/jenkins/agent
-      - DOMAIN=${DOMAIN:-localhost}
-      # Builds go to buildkitd, not to a docker daemon. This agent runs pipeline
-      # code from untrusted branches and deliberately has no docker socket.
-      - BUILDKIT_HOST=tcp://buildkitd:1234
-      - REGISTRY_PUSH_HOST=registry:5000
-    volumes:
-      - jenkins-agent-workdir:/home/jenkins/agent
-    networks:
-      - internal
-    depends_on:
-      jenkins-controller:
-        condition: service_healthy
-      buildkitd:
-        condition: service_started
 
 volumes:
   registry-data:
   buildkit-cache:
-  jenkins-home:
-  jenkins-agent-workdir:
+  builder-work:

package/hosts.conf

@@ -1,6 +1,6 @@
 # Platform subdomains to add to /etc/hosts and to the mkcert SAN list.
 # App subdomains live in each app's app.yml; apps may not claim these.
-# One subdomain per line. Read by infrastructure/scripts/local/setup-hosts.sh and infrastructure/scripts/local/certs.sh.
-jenkins
+# One subdomain per line. Read by scripts/local/setup-hosts.sh and scripts/local/certs.sh.
+deploy
 auth
 traefik

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@yunuseon/kayra",
-  "version": "0.7.1",
-  "description": "A self-hosted app platform and the CLI that runs it: Traefik, Authelia, Jenkins, a registry and rootless BuildKit per server, set up with OpenTofu and Ansible.",
+  "version": "0.8.1",
+  "description": "A self-hosted app platform and the CLI that runs it: Traefik, Authelia, a registry, rootless BuildKit and a small deployer per server, set up with OpenTofu and Ansible.",
   "license": "MIT",
   "author": "Yunus Öztürk",
   "repository": {
@@ -69,7 +69,6 @@
     "self-hosted",
     "platform",
     "traefik",
-    "jenkins",
     "ansible",
     "opentofu",
     "hetzner",

package/schema/defaults.json

@@ -10,18 +10,6 @@
       "type": "string",
       "description": "The Docker CE major the docker role pins and holds, as an apt version glob (default 5:29*)."
     },
-    "git_remote_url": {
-      "type": "string",
-      "description": "kayra's repository: Jenkins loads the pipeline library and platform jobs from it."
-    },
-    "platform_ref": {
-      "type": "string",
-      "description": "The ref of git_remote_url Jenkins loads from; defaults to the tag of the kayra version that ran (v<version>). Only a test server sets a branch."
-    },
-    "jenkins_admin_user": {
-      "type": "string",
-      "description": "Jenkins' local admin user (default admin)."
-    },
     "authelia_policy": {
       "type": "string",
       "enum": [
@@ -55,11 +43,11 @@
       "items": {
         "type": "string"
       },
-      "description": "owner/repo of the repos this server's platform-renovate keeps up to date; the job exists only where the list is not empty."
+      "description": "owner/repo of the repos this server's Renovate job keeps up to date; the job runs only where the list is not empty."
     },
     "renovate_schedule": {
       "type": "string",
-      "description": "When platform-renovate runs, as a Jenkins cron spec (default weekly: H 4 * * 1)."
+      "description": "When the Renovate job runs, as a five-field cron spec in the server's time (default weekly: 0 4 * * 1)."
     },
     "renovate_platform": {
       "type": "string",

package/schema/server.json

@@ -3,7 +3,7 @@
   "type": "object",
   "properties": {
     "kind": {
-      "description": "Which playbook: platform (default; Traefik, Authelia, Jenkins, apps), edge or nas.",
+      "description": "Which playbook: platform (default; Traefik, Authelia, the deployer, apps), edge or nas.",
       "type": "string",
       "enum": [
         "platform",

package/schema/vars-platform.json

@@ -10,18 +10,6 @@
       "type": "string",
       "description": "The Docker CE major the docker role pins and holds, as an apt version glob (default 5:29*)."
     },
-    "git_remote_url": {
-      "type": "string",
-      "description": "kayra's repository: Jenkins loads the pipeline library and platform jobs from it."
-    },
-    "platform_ref": {
-      "type": "string",
-      "description": "The ref of git_remote_url Jenkins loads from; defaults to the tag of the kayra version that ran (v<version>). Only a test server sets a branch."
-    },
-    "jenkins_admin_user": {
-      "type": "string",
-      "description": "Jenkins' local admin user (default admin)."
-    },
     "authelia_policy": {
       "type": "string",
       "enum": [
@@ -55,11 +43,11 @@
       "items": {
         "type": "string"
       },
-      "description": "owner/repo of the repos this server's platform-renovate keeps up to date; the job exists only where the list is not empty."
+      "description": "owner/repo of the repos this server's Renovate job keeps up to date; the job runs only where the list is not empty."
     },
     "renovate_schedule": {
       "type": "string",
-      "description": "When platform-renovate runs, as a Jenkins cron spec (default weekly: H 4 * * 1)."
+      "description": "When the Renovate job runs, as a five-field cron spec in the server's time (default weekly: 0 4 * * 1)."
     },
     "renovate_platform": {
       "type": "string",

package/scripts/local/require-main.sh

@@ -6,7 +6,9 @@
 # every other server is only ever changed from a clean main that matches
 # origin/main, so what runs there is exactly what was reviewed and merged.
 # Uncommitted changes in other servers' folders do not count: a test server's
-# branch pointers must not block a prod deploy.
+# branch pointers must not block a prod deploy. The kayra that runs must be the
+# release the fleet pins, not a linked checkout: everything the server runs,
+# its deploy pipeline included, is copied from it.
 #
 # Usage: FLEET_ROOT=<fleet> bash scripts/local/require-main.sh <server-name>
 set -euo pipefail
@@ -23,6 +25,8 @@ fail() {
 }
 
 cd "$FLEET_ROOT"
+[ ! -L node_modules/@yunuseon/kayra ] \
+    || fail "node_modules/@yunuseon/kayra is a linked checkout. Release it, bump package.json, then: npm ci"
 branch="$(git branch --show-current)"
 [ "$branch" = "main" ] || fail "The checkout is on '${branch:-a detached HEAD}'. Merge it, then: git switch main && git pull"
 git fetch -q origin main || fail "Could not fetch origin/main to compare against."

package/scripts/platform/compose-policy.sh

@@ -0,0 +1,84 @@
+#!/usr/bin/env bash
+# =============================================================================
+# compose-policy.sh <app> <allowed-host>... < config.json
+#
+# The platform's admission check, run by the deployer before every
+# `docker compose up`. Input is `docker compose config --no-env-resolution
+# --format json`: the fully resolved config, so variables, overlays and
+# defaults cannot hide anything. Env files stay unresolved on purpose: the
+# deployer would read them from its own filesystem, platform secrets
+# included. Prints one line per violation and exits 1 if there is any.
+#
+# An allow-list: a service key the platform has not thought about is refused,
+# rather than a new Compose feature quietly opening a hole. Modelled on
+# Kubernetes' Pod Security "restricted" profile, adapted to what matters on a
+# shared Docker host: an app must not reach the host, other apps, or the
+# platform, must not claim anyone else's hostnames or Traefik names, and must
+# declare how much memory it may take. Running as root inside the container is
+# allowed (unlike restricted): without capabilities or host access it gets
+# nothing a non-root user would not.
+# =============================================================================
+set -euo pipefail
+
+app="${1:?Usage: compose-policy.sh <app> <allowed-host>... < config.json}"
+shift
+hosts=$(printf '%s\n' "$@" | jq -R . | jq -s .)
+
+jq -r --arg app "$app" --argjson hosts "$hosts" '
+  def own($name): $name | startswith($app + "_");
+  def registry_ref: test("^(localhost|registry):5000/");
+  def allowed: ["image", "command", "entrypoint", "environment", "labels",
+    "networks", "volumes", "tmpfs", "healthcheck", "depends_on", "restart",
+    "user", "working_dir", "init", "read_only", "expose", "stop_grace_period",
+    "stop_signal", "mem_limit", "mem_reservation", "cpus", "deploy"];
+
+  . as $root |
+  (.services // {} | to_entries[] | .key as $svc | .value as $s |
+    (
+      ($s | keys - allowed | .[] | "\(.) is not allowed"),
+      ($s.deploy // {} | keys - ["resources", "placement", "replicas"] | .[] | "deploy.\(.) is not allowed"),
+      (if ($s.deploy.resources.reservations.devices // []) | length > 0
+        then "deploy.resources.reservations.devices is not allowed" else empty end),
+      (if ($s.mem_limit // $s.deploy.resources.limits.memory) == null
+        then "no memory limit (set mem_limit)" else empty end),
+      ($s.networks // {} | to_entries[] | .key as $net | .value // {} |
+        (keys - ["aliases"] | .[] | "networks.\($net).\(.) is not allowed"),
+        (select($root.networks[$net].name == "platform-public") | .aliases // [] | .[]
+          | select(startswith($app + "-") | not)
+          | "alias \(.) on platform-public must start with \($app)-")),
+      ($s.volumes // [] | .[] | select(.type != "volume" and .type != "tmpfs")
+        | "\(.type) mount \(.source // "") -> \(.target) (named volumes only)"),
+      (if ($s.image // "") | registry_ref and (test("^[^/]+/" + $app + "/") | not)
+        then "image \($s.image) is outside the \($app)/ namespace" else empty end),
+      ($s.labels // {} | to_entries[] |
+        (select(.key | test("^traefik\\.(tcp|udp)\\.")) | "\(.key) (HTTP routers only)"),
+        (select(.key | test("^traefik\\.http\\.(routers|services|middlewares)\\."))
+          | (.key | split(".")[3]) as $name
+          | select($name | startswith($app + "-") | not)
+          | "\(.key): Traefik names must start with \($app)-"),
+        (select(.value | test("@internal")) | "\(.key) references an @internal service"),
+        (select(.key | test("^traefik\\.http\\.routers\\.[^.]+\\.middlewares$"))
+          | select(.value | split(",") | map(gsub("\\s"; "")) | index("authelia@file"))
+          | "\(.key): authelia@file is the platform'"'"'s login; apps bring their own"),
+        (select(.key | test("^traefik\\.http\\.routers\\.[^.]+\\.rule$")) | .key as $k | .value as $rule |
+          ([$rule | scan("Host\\(`([^`]*)`\\)") | .[0]]) as $claimed |
+          if ($rule | test("HostRegexp|HostSNI")) then "\($k): only Host() rules are allowed"
+          elif ($claimed | length) == 0 then "\($k): rule must name a Host()"
+          else ($claimed[] | select(. as $h | $hosts | index($h) | not)
+                | "\($k): host \(.) is not one of this app'"'"'s")
+          end)
+      )
+    ) | "service \($svc): \(.)"
+  ),
+  (.networks // {} | to_entries[] | .value as $n |
+    (select(($n.name // "") != "platform-public" and (own($n.name // "") | not))
+      | "network \(.key): \($n.name // "?") is neither the app'"'"'s own nor platform-public"),
+    (select($n.name == "platform-public" and $n.external != true)
+      | "network \(.key): platform-public is the platform'"'"'s, declare it external: true")),
+  (.volumes // {} | to_entries[] | .value as $v |
+    (select($v.external) | "volume \(.key): external volumes are not allowed"),
+    (select(($v.driver_opts // {}) | length > 0) | "volume \(.key): driver_opts are not allowed"),
+    (select(own($v.name // "") | not) | "volume \(.key): \($v.name) belongs to another project")),
+  (.secrets // {}, .configs // {} | to_entries[] | select(.value.file)
+    | "\(.key): file-backed secrets/configs read the host filesystem")
+' | { violations=$(cat); [ -z "$violations" ] || { echo "$violations"; exit 1; }; }