kampodine 0.3.0 → 0.6.0

package/scripts/deploy.sh

@@ -3,7 +3,7 @@
 #
 #   Mac:  podman build (VITE_BUILD_ID=<sha>) -> podman save (docker-archive)
 #         streamed over SSH -> podman load on the VM
-#   VM:   retag to 127.0.0.1:5000/esellar-api:latest -> rc-service esellar-api
+#   VM:   retag to 127.0.0.1:5000/kampodine-api:latest -> rc-service kampodine-api
 #         restart (the OpenRC supervise-daemon service re-runs the whole
 #         `podman run` against :latest — no pull in the run, so restarts are
 #         offline-safe) -> exec-fetch health probe with served-sha verify ->
@@ -20,27 +20,47 @@
 #   kampodine deploy --version <sha7>     # stream an existing local build
 #   kampodine deploy --rollback [<sha7>]  # default: previous
 #   kampodine deploy --host root@<ip> ... # target VM override
+#   kampodine deploy --profile <name> ... # per-instance profile (config.json)
 #   kampodine deploy --dockerfile apps/api-go/Dockerfile.cutover  # Go api image
+#   kampodine deploy list|prune|logs|restart|shell  # lifecycle ops (each has --help)
 #   --skip-smoke      # skip the public smoke (behind a not-yet-switched proxy)
 #   --refresh-config  # ansible container-service refresh BEFORE restart
+#   --require-disk <pct>  # fail closed when VM disk usage >= pct (default: warn above 90)
 set -euo pipefail
 
+HERE="$(cd "$(dirname "$0")" && pwd)"
+# Lifecycle subcommands (list/prune/logs/restart/shell) are read-mostly
+# VM/ledger ops — they never build or stream, must work OUTSIDE the app repo,
+# and must not pay the deploy preflight (git/podman). Delegate first.
+case "${1:-}" in
+  list|prune|logs|restart|shell)
+    exec bash "$HERE/deploy-lifecycle.sh" "$@"
+    ;;
+esac
+# shellcheck source=common.sh
+source "$HERE/common.sh"
+
 REPO_ROOT="$(git rev-parse --show-toplevel)"
-ESPELLAR_HOST="${ESPELLAR_HOST:-}"
+KAMPODINE_HOST="${KAMPODINE_HOST:-}"
 PROXY_HOST="${PROXY_HOST:-app.example.com}"
-ENV_FILE_REMOTE="/etc/esellar/env"
-DEPLOYED_SHA_FILE="/etc/esellar/deployed-sha"
+ENV_FILE_REMOTE="/etc/kampodine/env"
+DEPLOYED_SHA_FILE="/etc/kampodine/deployed-sha"
 ENV_CLEAR_KEYS='^(NODE_ENV|PORT|LIBSQL_TENANT_DIR|LIBSQL_API_MOUNT|STATIC_SPA_MOUNT)='
-IMAGE="127.0.0.1:5000/esellar-api"
+IMAGE="127.0.0.1:5000/kampodine-api"
+DISK_PATH="/var/lib/containers"
 
 MODE="deploy"
 VERSION=""
 SKIP_SMOKE=0
 REFRESH_CONFIG=0
+REQUIRE_DISK=""
+PROFILE_FLAG=""
+HOST_FLAG=""
+KEY_FLAG=""
 # SSH key resolution — GENERIC, no hardcoded personal paths:
 #   1. --ssh-key flag           (explicit, per-invocation)
-#   2. KAMPODINE_SSH_KEY env    (project-level: direnv / .envrc / export)
-#   3. ESSELLAR_SSH_KEY env     (legacy alias, kept for existing setups)
+#   2. profile sshKey           (--profile | KAMPODINE_PROFILE | defaultProfile)
+#   3. KAMPODINE_SSH_KEY env    (legacy: direnv / .envrc / export)
 #   4. empty → ssh-agent and/or the operator's ~/.ssh/config Host block
 #      (the POSIX way: per-host IdentityFile belongs in ssh config, not here)
 if [ -n "${KAMPODINE_SSH_KEY:-}" ]; then
@@ -58,7 +78,7 @@ die() { printf '\033[1;31m[deploy] FAIL:\033[0m %s\n' "$*" >&2; exit 1; }
 usage() {
   cat <<'EOF'
 Usage:
-  kampodine deploy [--host root@<ip>] [--version <sha7>] [--rollback [<sha7>]]
+  kampodine deploy [--host root@<ip>] [--profile <name>] [--version <sha7>] [--rollback [<sha7>]]
                    [--dockerfile <path>] [--ssh-key <path>] [--skip-smoke] [--refresh-config]
 
 Examples:
@@ -66,16 +86,19 @@ EOF
   grep '^#   kampodine deploy' "$0" | sed 's/^#   //'
   cat <<'EOF'
 
-Host/key resolution: --host | ESPELLAR_HOST; --ssh-key | KAMPODINE_SSH_KEY |
-ESPELLAR_SSH_KEY | ssh-agent / ~/.ssh/config.
+Host/key resolution: --host | --profile <name> | KAMPODINE_PROFILE |
+config defaultProfile | KAMPODINE_HOST; --ssh-key | profile sshKey |
+KAMPODINE_SSH_KEY | ssh-agent / ~/.ssh/config. Profiles:
+kampodine config init --name prod --host root@<ip> --ssh-key <path>.
 EOF
   exit 0
 }
 
 while [[ $# -gt 0 ]]; do
   case "$1" in
-    --host) ESPELLAR_HOST="$2"; shift 2 ;;
-    --ssh-key) SSH_KEY="$2"; shift 2 ;;
+    --host) HOST_FLAG="$2"; KAMPODINE_HOST="$2"; shift 2 ;;
+    --ssh-key) KEY_FLAG="$2"; SSH_KEY="$2"; shift 2 ;;
+    --profile) PROFILE_FLAG="$2"; shift 2 ;;
     --version) VERSION="$2"; MODE="version"; shift 2 ;;
     --rollback)
       MODE="rollback"
@@ -83,19 +106,27 @@ while [[ $# -gt 0 ]]; do
       ;;
     --skip-smoke) SKIP_SMOKE=1; shift ;;
     --refresh-config) REFRESH_CONFIG=1; shift ;;
+    --require-disk) REQUIRE_DISK="$2"; shift 2 ;;
     --dockerfile) DOCKERFILE="$2"; shift 2 ;;
     -h|--help) usage ;;
     *) die "unknown argument: $1 (--help)" ;;
   esac
 done
 [[ "$VERSION" != *..* && "$VERSION" =~ ^[0-9a-f]{4,40}$|^$ ]] || die "--version must be a git sha fragment"
-[ -n "$ESPELLAR_HOST" ] || die "set ESPELLAR_HOST=root@<vm-ip> (or a ~/.ssh/config Host alias via --host)"
+[[ -z "$REQUIRE_DISK" || "$REQUIRE_DISK" =~ ^[0-9]+$ && "$REQUIRE_DISK" -le 100 ]] || die "--require-disk must be a percentage 0-100 (got: $REQUIRE_DISK)"
+# profile resolution (flag > KAMPODINE_PROFILE > defaultProfile); an explicit
+# --host/--ssh-key flag always beats the profile, the profile beats the
+# legacy env; proxyHost from the profile REPLACES the PROXY_HOST env
+profile_resolve "$PROFILE_FLAG" "$HOST_FLAG" "$KEY_FLAG"
+SSH_KEY="${KEY_FLAG:-${KAMPODINE_SSH_KEY:-}}"
+PROXY_HOST="${PROFILE_PROXY_HOST:-${PROXY_HOST:-app.example.com}}"
+[ -n "$KAMPODINE_HOST" ] || die "target required: --host root@<vm-ip>, --profile <name>, KAMPODINE_PROFILE, config defaultProfile, or KAMPODINE_HOST=root@<vm-ip>"
 
 SSH_ARGS=(-o ConnectTimeout=10 -o BatchMode=yes)
 [[ -n "$SSH_KEY" ]] && SSH_ARGS+=(-i "$SSH_KEY")
 # $1 is a composed remote command — client-side expansion is the design.
 # shellcheck disable=SC2029
-vm() { ssh "${SSH_ARGS[@]}" "$ESPELLAR_HOST" "$1"; }
+vm() { ssh "${SSH_ARGS[@]}" "$KAMPODINE_HOST" "$1"; }
 
 # --- macOS ssh-agent quirk (first deploy from a fresh machine) ---------------
 if [[ "$(uname -s)" == "Darwin" ]]; then
@@ -103,6 +134,67 @@ if [[ "$(uname -s)" == "Darwin" ]]; then
   export SSH_AUTH_SOCK
 fi
 
+# --- host init detection (first connect): openrc vs systemd + http client ----
+# Groundwork for non-Alpine targets; on Alpine the verdict is openrc and every
+# svc_action output is byte-identical to the historical strings. The verdict
+# is cached in the active profile entry ("init" field) when one resolves.
+init_detect vm >/dev/null 2>&1 || true
+
+# --- deployment ledger: every run appends to ~/.kampodine/deployments.jsonl ---
+# --- {ts, host, sha, tag, result, duration_ms, subject} — shas/tags/hosts  ----
+# --- only, NEVER secrets. The EXIT trap records failures + prints the footer --
+# --- so EVERY deploy run ends with the total deployments count.                --
+DEPLOY_START_SECONDS="$SECONDS"
+DEPLOY_RECORDING=0
+DEPLOY_APPENDED=0
+DEPLOY_RESULT="success"
+ENV_TMP=""
+deploy_on_exit() {
+  local rc=$?
+  [[ -n "$ENV_TMP" ]] && rm -f "$ENV_TMP" 2>/dev/null
+  if [[ "$DEPLOY_RECORDING" -eq 1 && "$DEPLOY_APPENDED" -ne 1 ]]; then
+    # never made it to the append: this run FAILED
+    ledger_append "$KAMPODINE_HOST" "$VER" "$VER" "failed" \
+      $(( (SECONDS - DEPLOY_START_SECONDS) * 1000 )) "" || true
+    DEPLOY_RESULT="failed"
+  fi
+  if [[ "$DEPLOY_RECORDING" -eq 1 ]]; then
+    if [[ "$DEPLOY_RESULT" == "failed" ]]; then
+      say "Total deployments: $(ledger_count "$KAMPODINE_HOST") · FAILED — attempted tag: $VER (not activated)"
+    else
+      say "Total deployments: $(ledger_count "$KAMPODINE_HOST") · current tag: $VER"
+    fi
+  fi
+  exit "$rc"
+}
+trap deploy_on_exit EXIT
+
+# --- disk guard (2026-10-08 incident class: old sha-tagged deploy images ------
+# --- silently filled the VM disk until sqlite writes failed with I/O errors). -
+# --- Read-only VM df; LOUD warning above 90%; --require-disk <pct> fails closed
+# --- BEFORE the build. phase = gate (pre-deploy, may fail) | report (warn-only)
+vm_disk_check() {
+  local phase="${1:-report}" df_out pct verdict
+  df_out="$(vm "df -P $DISK_PATH 2>/dev/null" || true)"
+  pct="$(disk_pct_from_df "$df_out")"
+  verdict="$(disk_verdict "$pct" "$REQUIRE_DISK")"
+  case "$verdict" in
+    fail)
+      die "VM disk at ${pct}% (>= --require-disk ${REQUIRE_DISK}%) — free space first: kampodine deploy prune --dry-run"
+      ;;
+    warn)
+      say "WARNING: VM disk $DISK_PATH at ${pct}% — old sha-tagged deploy images pile up (~1GB each)"
+      say "WARNING: reclaim space: kampodine deploy prune --dry-run (this deploy continues)"
+      ;;
+    unknown)
+      if [[ "$phase" == "gate" && -n "$REQUIRE_DISK" ]]; then
+        die "cannot read VM disk usage (df $DISK_PATH) — --require-disk is fail-closed"
+      fi
+      [[ "$phase" == "gate" ]] && say "disk usage unknown (df unreadable) — continuing"
+      ;;
+  esac
+}
+
 # --- preflight -----------------------------------------------------------------
 cd "$REPO_ROOT"
 if [[ "$MODE" == "deploy" ]]; then
@@ -110,10 +202,15 @@ if [[ "$MODE" == "deploy" ]]; then
 fi
 command -v podman >/dev/null 2>&1 || die "podman not found on the Mac (podman machine must run: podman machine start)"
 podman info >/dev/null 2>&1 || die "podman machine not reachable (podman machine start)"
+# disk gate: BEFORE the build — failing fast beats streaming 1GB into a full disk
+vm_disk_check gate
 # version mode: stream an EXISTING local build (no rebuild, no clean-tree gate —
 # the build already happened when that sha was HEAD)
 [[ "$MODE" == "version" ]] && VER="${VERSION:-$(git rev-parse --short HEAD)}"
 [[ "$MODE" != "version" ]] && VER="$(git rev-parse --short HEAD)"
+# from here on, every outcome is recorded in the ledger (success via the
+# append at the end; anything else via the EXIT trap)
+DEPLOY_RECORDING=1
 
 # --- build (deploy mode always builds HEAD — cached layers keep it minutes) ----
 if [[ "$MODE" == "deploy" ]]; then
@@ -141,8 +238,8 @@ vm "podman tag $IMAGE:$VER $IMAGE:latest" || die "stream retag failed"
 
 # --- env file from varlock (schema-only from HEAD; secrets from pass) ----------
 say "generating $ENV_FILE_REMOTE from varlock (schema-only from HEAD; secrets resolve from pass — no plaintext secret files)…"
-ENV_TMP="$(mktemp /tmp/esellar-env.XXXXXX)"
-trap 'rm -f "$ENV_TMP"' EXIT
+ENV_TMP="$(mktemp /tmp/kampodine-env.XXXXXX)"
+# (the EXIT trap — deploy_on_exit — removes $ENV_TMP on every exit path)
 # Schema-only resolution: extract the COMMITTED schema into a scratch dir
 # inside the repo (plugin resolution needs node_modules; local
 # .env/.env.local never enter the pipeline — varlock sees only the extracted
@@ -158,29 +255,32 @@ git -C "$REPO_ROOT" archive HEAD apps/api/.env.schema | tar -x -C "$ENV_SCHEMA_D
   | sed -E 's/^([A-Za-z_][A-Za-z0-9_]*)="(.*)"$/\1=\2/' > "$ENV_TMP" \
   || die "varlock env generation failed (pass store unlocked? schema committed?)"
 printf 'API_GIT_SHA=%s\n' "$VER" >> "$ENV_TMP"
-scp -q "${SSH_ARGS[@]}" "$ENV_TMP" "$ESPELLAR_HOST:/etc/esellar/env.tmp"
-vm "mv /etc/esellar/env.tmp $ENV_FILE_REMOTE && chmod 600 $ENV_FILE_REMOTE"
+scp -q "${SSH_ARGS[@]}" "$ENV_TMP" "$KAMPODINE_HOST:/etc/kampodine/env.tmp"
+vm "mv /etc/kampodine/env.tmp $ENV_FILE_REMOTE && chmod 600 $ENV_FILE_REMOTE"
 rm -f "$ENV_TMP"
 rm -rf "$ENV_SCHEMA_DIR"
 
 if [[ $REFRESH_CONFIG -eq 1 ]]; then
   say "ansible container-service refresh (--tags container-service — rc script/config drift repair)…"
   (cd "$REPO_ROOT/infra/alpine-host/ansible" \
-    && ansible-playbook -i "esellar-vm ansible_host=${ESPELLAR_HOST#*@},ansible_user=${ESPELLAR_HOST%%@*}," playbook.yml --tags container-service --private-key "${SSH_KEY:-~/.ssh/id_ed25519}") \
+    && ansible-playbook -i "kampodine-vm ansible_host=${KAMPODINE_HOST#*@},ansible_user=${KAMPODINE_HOST%%@*}," playbook.yml --tags container-service --private-key "${SSH_KEY:-~/.ssh/id_ed25519}") \
     || die "ansible playbook failed"
 fi
 
-say "rc-service esellar-api restart (supervise-daemon: stop-old/start-new podman run on the retagged :latest)…"
-vm "rc-service esellar-api restart" || die "esellar-api restart failed (rc-service esellar-api status)"
+RESTART_CMD="$(svc_action kampodine-api restart)" \
+  || die "neither rc-service nor systemctl found on $KAMPODINE_HOST — cannot restart the service (host init auto-detection failed)"
+STATUS_CMD="$(svc_action kampodine-api status 2>/dev/null || true)"
+say "$RESTART_CMD (supervise-daemon on Alpine: stop-old/start-new podman run on the retagged :latest)…"
+vm "$RESTART_CMD" || die "kampodine-api restart failed (${STATUS_CMD:-check the service})"
 
-say "health probe (host-side wget /api/auth/ok + served-sha — works for node AND scratch images)…"
+say "health probe (host-side fetch of /api/auth/ok + served-sha — busybox wget default, curl fallback on GNU-only hosts)…"
 HEALTH_OK=0
 for _ in $(seq 1 30); do
-  # wget runs on the VM (busybox, -p 8080:8080 publish); the served-sha
-  # grep runs LOCALLY — remote grep quoting is fragile (busybox BRE
-  # (busybox BRE alternation + nested quotes → permanent false-negative).
-  # grep -E keeps the alternation portable across BSD/GNU/busybox.
-  if vm "wget -qO- -T 3 http://127.0.0.1:8080/api/auth/ok 2>/dev/null" \
+  # the fetch runs on the VM (busybox wget by default; curl when the host has
+  # none — remote_http_cmd in common.sh); the served-sha grep runs LOCALLY —
+  # remote grep quoting is fragile (busybox BRE alternation + nested quotes →
+  # permanent false-negative). grep -E keeps the alternation portable.
+  if vm "$(remote_http_cmd "http://127.0.0.1:8080/api/auth/ok")" \
       | grep -qE "\"(git|build)\":\"$VER"; then
     HEALTH_OK=1
     break
@@ -188,17 +288,17 @@ for _ in $(seq 1 30); do
   sleep 3
 done
 if [[ $HEALTH_OK -ne 1 ]]; then
-  vm "podman logs --tail 30 esellar-api 2>&1" || true
-  vm "rc-service esellar-api status 2>&1" || true
+  vm "podman logs --tail 30 kampodine-api 2>&1" || true
+  vm "$(svc_action kampodine-api status 2>/dev/null || echo 'true') 2>&1" || true
   PREV_HINT="$(vm "test -f $DEPLOYED_SHA_FILE && cat $DEPLOYED_SHA_FILE" 2>/dev/null || true)"
   die "container never became healthy — rollback: kampodine deploy --rollback${PREV_HINT:+ $PREV_HINT}"
 fi
-CANARY="$(vm "podman logs esellar-api 2>&1 | grep -c ENV_IMPORT_SUSPECT || true")"
+CANARY="$(vm "podman logs kampodine-api 2>&1 | grep -c ENV_IMPORT_SUSPECT || true")"
 say "container healthy, env-canary hits: $CANARY"
 
 say "kamal-proxy re-point (podman exec — same invocation kamal used)…"
 if vm "podman ps --format '{{.Names}}' | grep -qx kamal-proxy"; then
-  vm "podman exec kamal-proxy kamal-proxy deploy esellar-api --host=$PROXY_HOST --target=esellar-api:8080 --tls --health-check-path=/api/auth/ok" \
+  vm "podman exec kamal-proxy kamal-proxy deploy kampodine-api --host=$PROXY_HOST --target=kampodine-api:8080 --tls --health-check-path=/api/auth/ok" \
     || die "proxy re-point failed (podman logs kamal-proxy)"
 else
   say "  kamal-proxy not running — skipping re-point"
@@ -220,4 +320,21 @@ vm "podman image prune -f >/dev/null 2>&1 || true"
 # busybox head lacks -n -N — tail -n +4 after a newest-first sort keeps 3 tags.
 vm "podman images --format '{{.Tag}} {{.CreatedAt}}' $IMAGE 2>/dev/null | grep -E '^[0-9a-f]{7,40} ' | sort -k2,2r | tail -n +4 | awk '{print \$1}' | while read -r old; do podman rmi \"$IMAGE:\$old\" >/dev/null 2>&1 || true; done" || true
 [[ "$MODE" == "rollback" ]] || vm "echo $VER > $DEPLOYED_SHA_FILE" || true
+
+# --- post-deploy disk report (warn-only — the deploy already succeeded) --------
+vm_disk_check report
+
+# --- deployment ledger append: this run made it all the way through ------------
+DEPLOY_RESULT="success"
+[[ "$MODE" == "rollback" ]] && DEPLOY_RESULT="rollback"
+if [[ "$MODE" == "rollback" ]]; then
+  # the subject of a rollback is the ORIGINAL deploy's subject — the ledger
+  # knows it; git HEAD would be the wrong commit's message
+  SUBJECT="$(ledger_subject_for_tag "$KAMPODINE_HOST" "$VER")"
+else
+  SUBJECT="$(git -C "$REPO_ROOT" log -1 --pretty=%s 2>/dev/null || true)"
+fi
+ledger_append "$KAMPODINE_HOST" "$VER" "$VER" "$DEPLOY_RESULT" \
+  $(( (SECONDS - DEPLOY_START_SECONDS) * 1000 )) "$SUBJECT" || true
+DEPLOY_APPENDED=1
 say "done (version: $VER). instant rollback: kampodine deploy --rollback"

package/scripts/dns.sh

@@ -12,8 +12,8 @@
 # Types are pinned to A | AAAA | CNAME. `add` merges into the existing RRSet
 # (round-robin records survive); `rm` filters it; both are idempotence-aware.
 #
-# Zone/compartment: OCI_PROFILE (default esellar-api), OCI_COMPARTMENT
-# (default esellar). Zone defaults to the compartment's ONLY zone; pass
+# Zone/compartment: OCI_PROFILE (default: "default"), OCI_COMPARTMENT (required)
+# (required). Zone defaults to the compartment's ONLY zone; pass
 # --zone <id-or-name> when several exist.
 #
 # Usage:
@@ -23,9 +23,21 @@
 #   (all: optional --zone <id-or-name>; --instance-principal for instance auth)
 set -euo pipefail
 
-PROFILE="${OCI_PROFILE:-esellar-api}"
-COMPARTMENT_NAME="${OCI_COMPARTMENT:-esellar}"
+# NOTE: no $(dirname) here — some hermetic test PATHs strip coreutils;
+# parameter expansion keeps HERE resolution dependency-free.
+HERE="${BASH_SOURCE[0]%/*}"
+# shellcheck source=common.sh
+source "$HERE/common.sh"
+
+# NOTE on --profile: dns.sh follows the OCI auth convention — PROFILE below is
+# the OCI CONFIG profile (OCI_PROFILE). The kampodine INSTANCE profile flag
+# (--profile <name>) is parsed into PROFILE_FLAG and validated via
+# profile_resolve (uniform resolution across every subcommand); dns consumes
+# no instance host/sshKey fields.
+PROFILE="${OCI_PROFILE:-default}"
+COMPARTMENT_NAME="${OCI_COMPARTMENT:-kampodine}"
 AUTH_ARGS=()
+PROFILE_FLAG=""
 
 say() { printf '\033[1;34m[dns]\033[0m %s\n' "$*"; }
 die() { printf '\033[1;31m[dns] FAIL:\033[0m %s\n' "$*" >&2; exit 1; }
@@ -37,13 +49,13 @@ usage() {
 
 Auth is the oci CLI's own — its config file (--profile) or instance
 principal. kampodine never accepts, stores, or logs credential material.
-Zone/compartment: OCI_PROFILE (default esellar-api), OCI_COMPARTMENT (default
-esellar). Types are pinned to A | AAAA | CNAME; ttl range 60..172800.
+Zone/compartment: OCI_PROFILE (default: "default"), OCI_COMPARTMENT (default
+kampodine). Types are pinned to A | AAAA | CNAME; ttl range 60..172800.
 
 Examples:
   kampodine dns records
-  kampodine dns records --zone esellar.example.com
-  kampodine dns add --name app --type A --value 203.0.113.10 --zone esellar.example.com
+  kampodine dns records --zone kampodine.example.com
+  kampodine dns add --name app --type A --value 203.0.113.10 --zone kampodine.example.com
   kampodine dns add --name www --type CNAME --value app.example.com --ttl 3600
   kampodine dns rm --name app --type A --value 203.0.113.10
 EOF
@@ -100,17 +112,24 @@ while [[ $# -gt 0 ]]; do
     --type) RTYPE="$2"; shift 2 ;;
     --value) VALUE="$2"; shift 2 ;;
     --ttl) TTL="$2"; shift 2 ;;
+    --profile) PROFILE_FLAG="$2"; shift 2 ;;
     --instance-principal) AUTH_ARGS=(--auth instance_principal); shift ;;
     -h|--help) usage 0 ;;
     *) die "unknown argument: $1 (--help)" ;;
   esac
 done
 
+# validate the kampodine instance profile when selected (uniform resolution);
+# dns consumes none of its host/sshKey fields
+profile_resolve "$PROFILE_FLAG" "" ""
+
 need_provider() {
   command -v oci >/dev/null 2>&1 \
     || die "oci CLI not found — brew install oci-cli (https://docs.oracle.com/en-us/iaas/Content/API/SDKDocs/cliinstall.htm), then: oci setup config"
   command -v jq >/dev/null 2>&1 \
     || die "jq not found — brew install jq (dns.sh uses it for RRSet surgery)"
+  [[ -n "${OCI_COMPARTMENT:-}" ]] \
+    || die "set OCI_COMPARTMENT=<compartment name or ocid> — no default: compartments are account-specific"
 }
 
 compartment_ocid() {

package/scripts/env.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# env.sh — manage the remote app env file (/etc/esellar/env, 0600 root).
+# env.sh — manage the remote app env file (/etc/kampodine/env, 0600 root).
 #
 # SECRETS NEVER PRINT. `env list`, `env push`, and the `env pull` summaries
 # surface FINGERPRINTS ONLY: KEY + value length + first 2 characters. Raw
@@ -8,29 +8,33 @@
 # secret ever lands in terminal output, logs, or process args.
 #
 # Host/key resolution is IDENTICAL to deploy.sh:
-#   --host root@<ip> | ESPELLAR_HOST | ~/.ssh/config Host alias
-#   --ssh-key <path> | KAMPODINE_SSH_KEY | ESPELLAR_SSH_KEY (legacy) |
+#   --host root@<ip> | KAMPODINE_HOST | ~/.ssh/config Host alias
+#   --ssh-key <path> | KAMPODINE_SSH_KEY |
 #   ssh-agent (the POSIX default; per-host IdentityFile belongs in ssh config)
 #
 # Usage:
-#   kampodine env list [--host <user@ip>]              # KEY + fingerprint table (NEVER values)
-#   kampodine env push --file <local-env-file> [...]   # upload: 0600 temp + atomic mv + restart hint
-#   kampodine env pull [--out <file>] [...]            # raw payload to stdout/--out (0600); masked summary follows it
-#   kampodine env fingerprint [--file <f>]             # preview the masking for a LOCAL file / stdin (never values)
+#   kampodine env list [--host <user@ip>] [--profile <name>]            # KEY + fingerprint table (NEVER values)
+#   kampodine env push --file <local-env-file> [...] [--profile <name>] # upload: 0600 temp + atomic mv + restart hint
+#   kampodine env pull [--out <file>] [...] [--profile <name>]          # raw payload to stdout/--out (0600); masked summary follows it
+#   kampodine env fingerprint [--file <f>]                              # preview the masking for a LOCAL file / stdin (never values)
 #
 # push sends the file VERBATIM (what you push is what lands). deploy's env
 # step additionally drops rc-script-owned CLEAR keys — keep those out of the
 # file you push unless you mean to own them here.
 set -euo pipefail
 
-ENV_FILE_REMOTE="${KAMPODINE_ENV_REMOTE:-/etc/esellar/env}"
+HERE="${BASH_SOURCE[0]%/*}"
+# shellcheck source=common.sh
+source "$HERE/common.sh"
+
+ENV_FILE_REMOTE="${KAMPODINE_ENV_REMOTE:-/etc/kampodine/env}"
 ENV_TMP_BASE="$(dirname "$ENV_FILE_REMOTE")"
 
-ESPELLAR_HOST="${ESPELLAR_HOST:-}"
+KAMPODINE_HOST="${KAMPODINE_HOST:-}"
 # SSH key resolution — same ladder as deploy.sh:
 #   1. --ssh-key flag           (explicit, per-invocation)
 #   2. KAMPODINE_SSH_KEY env    (project-level: direnv / .envrc / export)
-#   3. ESPELLAR_SSH_KEY env     (legacy alias, kept for existing setups)
+#   3. KAMPODINE_SSH_KEY env     (legacy alias, kept for existing setups)
 #   4. empty → ssh-agent and/or the operator's ~/.ssh/config Host block
 if [ -n "${KAMPODINE_SSH_KEY:-}" ]; then
     SSH_KEY="$KAMPODINE_SSH_KEY"
@@ -47,8 +51,9 @@ usage() {
 
 Fingerprints NEVER leak values: every line is KEY + value length + first 2 chars.
 Raw values move only in push's upload stream and pull's stdout/--out payload.
-Host/key resolution matches deploy.sh: --host | ESPELLAR_HOST; --ssh-key |
-KAMPODINE_SSH_KEY | ESPELLAR_SSH_KEY | ssh-agent / ~/.ssh/config.
+Host/key resolution matches deploy.sh: --host | --profile <name> |
+KAMPODINE_PROFILE | config defaultProfile | KAMPODINE_HOST; --ssh-key |
+profile sshKey | KAMPODINE_SSH_KEY | ssh-agent / ~/.ssh/config.
 
 Examples:
   kampodine env list --host root@203.0.113.10
@@ -70,10 +75,14 @@ esac
 
 FILE=""
 OUT=""
+PROFILE_FLAG=""
+HOST_FLAG=""
+KEY_FLAG=""
 while [[ $# -gt 0 ]]; do
   case "$1" in
-    --host) ESPELLAR_HOST="$2"; shift 2 ;;
-    --ssh-key) SSH_KEY="$2"; shift 2 ;;
+    --host) HOST_FLAG="$2"; KAMPODINE_HOST="$2"; shift 2 ;;
+    --ssh-key) KEY_FLAG="$2"; SSH_KEY="$2"; shift 2 ;;
+    --profile) PROFILE_FLAG="$2"; shift 2 ;;
     --file) FILE="$2"; shift 2 ;;
     --out) OUT="$2"; shift 2 ;;
     -h|--help) usage ;;
@@ -81,11 +90,16 @@ while [[ $# -gt 0 ]]; do
   esac
 done
 
+# profile resolution (flag > KAMPODINE_PROFILE > defaultProfile); an explicit
+# --host/--ssh-key flag always beats the profile
+profile_resolve "$PROFILE_FLAG" "$HOST_FLAG" "$KEY_FLAG"
+SSH_KEY="${KEY_FLAG:-${KAMPODINE_SSH_KEY:-}}"
+
 SSH_ARGS=(-o ConnectTimeout=10 -o BatchMode=yes)
 [[ -n "$SSH_KEY" ]] && SSH_ARGS+=(-i "$SSH_KEY")
 # $1 is a composed remote command — client-side expansion is the design.
 # shellcheck disable=SC2029
-vm() { ssh "${SSH_ARGS[@]}" "$ESPELLAR_HOST" "$1"; }
+vm() { ssh "${SSH_ARGS[@]}" "$KAMPODINE_HOST" "$1"; }
 
 # --- macOS ssh-agent quirk (first run from a fresh machine) -------------------
 if [[ "$(uname -s)" == "Darwin" ]]; then
@@ -94,7 +108,7 @@ if [[ "$(uname -s)" == "Darwin" ]]; then
 fi
 
 require_host() {
-  [[ -n "$ESPELLAR_HOST" ]] || die "target required: --host root@<ip> or ESPELLAR_HOST=root@<ip> (resolution matches deploy.sh)"
+  [[ -n "$KAMPODINE_HOST" ]] || die "target required: --host root@<ip>, --profile <name>, KAMPODINE_PROFILE, config defaultProfile, or KAMPODINE_HOST=root@<ip> (resolution matches deploy.sh)"
 }
 
 # env_fp_lines — env content on stdin -> fingerprint table on stdout.
@@ -126,7 +140,7 @@ env_fp_lines() {
 }
 
 fetch_remote_env() {
-  vm "cat $ENV_FILE_REMOTE" || die "cannot read $ENV_FILE_REMOTE on $ESPELLAR_HOST (no env file yet? run: kampodine env push --file <env>, or kampodine deploy)"
+  vm "cat $ENV_FILE_REMOTE" || die "cannot read $ENV_FILE_REMOTE on $KAMPODINE_HOST (no env file yet? run: kampodine env push --file <env>, or kampodine deploy)"
 }
 
 case "$SUB" in
@@ -142,7 +156,7 @@ case "$SUB" in
     require_host
     count="$(grep -cE '^[A-Za-z_][A-Za-z0-9_]*=' "$FILE" || true)"
     [[ "${count:-0}" -gt 0 ]] || die "no KEY=VALUE lines in $FILE — nothing to push"
-    say "pushing $FILE -> $ESPELLAR_HOST:$ENV_FILE_REMOTE (fingerprint summary below; values are NEVER printed)"
+    say "pushing $FILE -> $KAMPODINE_HOST:$ENV_FILE_REMOTE (fingerprint summary below; values are NEVER printed)"
     env_fp_lines < "$FILE"
     tmp_remote="$ENV_TMP_BASE/env.tmp.$$"
     # 0600 FROM CREATION: umask 077 + ssh stdin pipe — the temp is never
@@ -151,8 +165,8 @@ case "$SUB" in
     vm "umask 077; cat > $tmp_remote" < "$FILE" || die "upload failed"
     vm "chmod 600 $tmp_remote && mv -f $tmp_remote $ENV_FILE_REMOTE" \
       || die "atomic install failed (remote temp left at: $tmp_remote)"
-    say "installed $ENV_FILE_REMOTE (0600) on $ESPELLAR_HOST"
-    say "restart to apply: ssh $ESPELLAR_HOST 'rc-service esellar-api restart'   # or: kampodine deploy"
+    say "installed $ENV_FILE_REMOTE (0600) on $KAMPODINE_HOST"
+    say "restart to apply: ssh $KAMPODINE_HOST 'rc-service kampodine-api restart'   # or: kampodine deploy"
     ;;
 
   pull)
@@ -167,7 +181,7 @@ case "$SUB" in
       # stdout IS the payload (pipe into whatever needs the values);
       # the human-readable summary goes to stderr, masked.
       printf '%s\n' "$raw"
-      say "fingerprint summary for $ENV_FILE_REMOTE on $ESPELLAR_HOST (payload above on stdout):" >&2
+      say "fingerprint summary for $ENV_FILE_REMOTE on $KAMPODINE_HOST (payload above on stdout):" >&2
       env_fp_lines <<<"$raw" >&2
     fi
     ;;

package/scripts/image-import.sh

@@ -14,28 +14,29 @@
 # Auth: ~/.oci/config (brew install oci-cli; oci setup config) by default, or
 # --from-pass to source API credentials from the local pass store — the key
 # NEVER enters this repo, the image, or any log (values only go into env vars).
-# Every oci call pins --profile $PROFILE (OCI_PROFILE, default esellar-api) —
-# the CLI's DEFAULT profile is NOT the esellar tenancy.
+# Every oci call pins --profile $PROFILE (OCI_PROFILE, default "default") —
+# the CLI's DEFAULT profile is NOT the kampodine tenancy.
 # Placeholder pass paths (create yours to match):
-#   esellar/oci/user         user OCID
-#   esellar/oci/tenancy      tenancy OCID
-#   esellar/oci/fingerprint  API key fingerprint
-#   esellar/oci/api-key      PEM private key
+#   kampodine/oci/user         user OCID
+#   kampodine/oci/tenancy      tenancy OCID
+#   kampodine/oci/fingerprint  API key fingerprint
+#   kampodine/oci/api-key      PEM private key
 #
 # Usage:
 #   kampodine image-import                       # defaults below
 #   kampodine image-import --from-pass
-#   kampodine image-import --image build/esellar-alpine-3.22.6-aarch64.qcow2
+#   kampodine image-import --image build/kampodine-alpine-3.22.6-aarch64.qcow2
 set -euo pipefail
 
 REPO_ROOT="$(git rev-parse --show-toplevel)"
 IMAGE=""
-BUCKET="${OCI_IMPORT_BUCKET:-esellar-image-import}"
-NAME_PREFIX="${OCI_IMPORT_NAME:-esellar-alpine}"
-COMPARTMENT_NAME="${OCI_COMPARTMENT:-esellar}"
-PROFILE="${OCI_PROFILE:-esellar-api}"
+BUCKET="${OCI_IMPORT_BUCKET:-kampodine-image-import}"
+NAME_PREFIX="${OCI_IMPORT_NAME:-kampodine-alpine}"
+COMPARTMENT_NAME="${OCI_COMPARTMENT:-kampodine}"
+PROFILE="${OCI_PROFILE:-default}"
 FROM_PASS=0
 KEEP_OBJECT=0
+PROFILE_FLAG=""
 
 say() { printf '[import] %s\n' "$*"; }
 die() { printf '[import][FAIL] %s\n' "$*" >&2; exit 1; }
@@ -57,6 +58,7 @@ while [[ $# -gt 0 ]]; do
     --bucket) BUCKET="$2"; shift 2 ;;
     --name-prefix) NAME_PREFIX="$2"; shift 2 ;;
     --compartment) COMPARTMENT_NAME="$2"; shift 2 ;;
+    --profile) PROFILE_FLAG="$2"; shift 2 ;;
     --from-pass) FROM_PASS=1; shift ;;
     --keep-object) KEEP_OBJECT=1; shift ;;
     -h|--help) usage ;;
@@ -64,19 +66,27 @@ while [[ $# -gt 0 ]]; do
   esac
 done
 
+# validate the kampodine instance profile when selected (uniform resolution);
+# image-import consumes none of its host/sshKey fields (OCI-only surface)
+HERE="${BASH_SOURCE[0]%/*}"
+# shellcheck source=common.sh
+source "$HERE/common.sh"
+profile_resolve "$PROFILE_FLAG" "" ""
+
 command -v oci >/dev/null 2>&1 || die "oci CLI not found — brew install oci-cli, then: oci setup config (infra/oci/README.md § CLI setup)"
+[[ -n "${OCI_COMPARTMENT:-}" ]] || die "set OCI_COMPARTMENT=<compartment name or ocid> — no default: compartments are account-specific"
 command -v pass >/dev/null 2>&1 || true
 
 if [[ $FROM_PASS -eq 1 ]]; then
   command -v pass >/dev/null 2>&1 || die "pass not installed (brew install pass)"
   say "sourcing OCI API credentials from pass (values never printed/logged)…"
   for entry in user tenancy fingerprint api-key; do
-    pass show "esellar/oci/$entry" >/dev/null 2>&1 || die "missing pass entry esellar/oci/$entry"
+    pass show "kampodine/oci/$entry" >/dev/null 2>&1 || die "missing pass entry kampodine/oci/$entry"
   done
-  OCI_CLI_USER="$(pass show esellar/oci/user)"
-  OCI_CLI_TENANCY="$(pass show esellar/oci/tenancy)"
-  OCI_CLI_FINGERPRINT="$(pass show esellar/oci/fingerprint)"
-  OCI_CLI_KEY_CONTENT="$(pass show esellar/oci/api-key)"
+  OCI_CLI_USER="$(pass show kampodine/oci/user)"
+  OCI_CLI_TENANCY="$(pass show kampodine/oci/tenancy)"
+  OCI_CLI_FINGERPRINT="$(pass show kampodine/oci/fingerprint)"
+  OCI_CLI_KEY_CONTENT="$(pass show kampodine/oci/api-key)"
   export OCI_CLI_USER OCI_CLI_TENANCY OCI_CLI_FINGERPRINT OCI_CLI_KEY_CONTENT
 fi
 
@@ -84,7 +94,7 @@ fi
 if [[ -z "$IMAGE" ]]; then
   # Constrained glob (our own build output names) — ls is fine here.
   # shellcheck disable=SC2012
-  IMAGE="$(ls -t "$REPO_ROOT/infra/alpine-host/build"/esellar-alpine-*.qcow2 2>/dev/null | head -1 || true)"
+  IMAGE="$(ls -t "$REPO_ROOT/infra/alpine-host/build"/kampodine-alpine-*.qcow2 2>/dev/null | head -1 || true)"
   [[ -n "$IMAGE" ]] || die "no qcow2 under infra/alpine-host/build/ — run: (cd infra/alpine-host && packer build .)"
 fi
 [[ -f "$IMAGE" ]] || die "image not found: $IMAGE"
@@ -96,7 +106,7 @@ NAMESPACE="$(oci os ns get --profile "$PROFILE" --query data --raw-output)"
 
 STAMP="$(date +%Y%m%d-%H%M%S)"
 OBJECT_NAME="${NAME_PREFIX}-${STAMP}.qcow2"
-IMAGE_NAME="${NAME_PREFIX}-$(basename "$IMAGE" .qcow2 | sed 's/^esellar-alpine-//')-${STAMP}"
+IMAGE_NAME="${NAME_PREFIX}-$(basename "$IMAGE" .qcow2 | sed 's/^kampodine-alpine-//')-${STAMP}"
 
 say "uploading $(basename "$IMAGE") -> os://$BUCKET/$OBJECT_NAME"
 oci os object put -bn "$BUCKET" --profile "$PROFILE" --file "$IMAGE" --name "$OBJECT_NAME" --force \
@@ -162,7 +172,7 @@ say "  display   : $IMAGE_NAME"
 say "  firmware  : $IMPORT_FIRMWARE"
 say "next:"
 if [[ "$IMPORT_FIRMWARE" == "UEFI_64" ]]; then
-  say "  A1-ready. kampodine bluegreen provision <blue|green> picks this image (newest esellar-alpine*)."
+  say "  A1-ready. kampodine bluegreen provision <blue|green> picks this image (newest kampodine-alpine*)."
 else
   say "  A1 launch will REJECT this image (firmware $IMPORT_FIRMWARE) — see the WARN above."
 fi