unoverse 0.1.100 → 0.1.102

package/operator/infra/aws/main.tf

@@ -242,10 +242,22 @@ data "aws_ami" "ubuntu" {
   }
 }
 
+# The key pair, from the operator's own public key. AWS accepts an imported key, so nothing
+# has to pre-exist in the account and no private key is ever downloaded or stored.
+resource "aws_key_pair" "operator" {
+  count      = var.operator_public_key != "" ? 1 : 0
+  key_name   = "${var.name}-operator"
+  public_key = var.operator_public_key
+}
+
+locals {
+  key_name = var.operator_public_key != "" ? aws_key_pair.operator[0].key_name : var.ssh_key_name
+}
+
 resource "aws_instance" "app" {
   ami                    = data.aws_ami.ubuntu.id
   instance_type          = local.s.instance
-  key_name               = var.ssh_key_name
+  key_name               = local.key_name
   vpc_security_group_ids = [aws_security_group.app.id]
 
   root_block_device {

package/operator/infra/aws/variables.tf

@@ -102,3 +102,13 @@ variable "marketplace_url" {
   type        = string
   default     = ""
 }
+
+# YOUR public key, uploaded as this universe's EC2 key pair. Deploying means ssh-ing from
+# the machine that runs `unoverse deploy`, so the key that must work is the one that machine
+# holds — not whichever pair happens to exist in the account. Empty falls back to
+# ssh_key_name, for an operator with no local key.
+variable "operator_public_key" {
+  description = "An ssh public key (the contents of ~/.ssh/id_ed25519.pub). Empty = use ssh_key_name instead."
+  type        = string
+  default     = ""
+}

package/operator/lib/deploy.sh

@@ -366,6 +366,35 @@ _ensure_ground_config() {
     esac
   fi
 
+  # CAN THIS MACHINE ACTUALLY REACH WHAT IT IS ABOUT TO BUILD?
+  #
+  # An EC2 key pair the operator does not hold applies perfectly and then fails at the ship
+  # step: eleven minutes of RDS and ElastiCache provisioning, then "Permission denied
+  # (publickey)". Generating the ground correctly is not enough — tfvars is the developer's
+  # file and `unoverse update` never rewrites it, so a ground made before this check keeps
+  # its unusable key forever and fails the same way every time.
+  #
+  # Checked here, before the plan, because the cost of being wrong is money and eleven
+  # minutes, and the fix is one line in a file this command already edits.
+  if [ "$cloud" = "aws" ]; then
+    local named_key pub_key
+    named_key=$(grep -E '^ssh_key_name[[:space:]]*=' "$tfv" 2>/dev/null | sed -E 's/.*"([^"]*)".*/\1/')
+    if [ -n "$named_key" ] && ! grep -qE '^operator_public_key[[:space:]]*=[[:space:]]*"ssh-' "$tfv" 2>/dev/null; then
+      for pub_key in "$HOME/.ssh/id_ed25519.pub" "$HOME/.ssh/id_rsa.pub" ""; do
+        [ -n "$pub_key" ] && [ -f "$pub_key" ] && break
+      done
+      if [ -n "$pub_key" ]; then
+        node -e 'const fs=require("fs");const[f,v]=process.argv.slice(1);let s=fs.readFileSync(f,"utf8");
+          s=s.replace(/^ssh_key_name\s*=.*$/m,"ssh_key_name = \"\"  # empty = terraform uploads operator_public_key below\noperator_public_key = "+JSON.stringify(v)+"   # your key: the deploy ssh-es from this machine");
+          fs.writeFileSync(f,s)' "$tfv" "$(cat "$pub_key")"
+        ok "SSH key: your own ${DIM}($(basename "$pub_key") — replacing '"'"'$named_key'"'"', whose private half is not on this machine)${NC}"
+      else
+        warn "No ssh key on this machine. The deploy will build, then fail to reach the server"
+        info "Make one with ${BOLD}ssh-keygen -t ed25519${NC} and run this again"
+      fi
+    fi
+  fi
+
   _tf_fill docr_token     DOCR_TOKEN     "Registry access token (from your Unoverse admin)"
   _tf_fill openai_api_key OPENAI_API_KEY "OPENAI_API_KEY (powers the platform's AI)"
   if grep -q '^auth_issuer[[:space:]]*=[[:space:]]*"FILL_ME"' "$tfv" 2>/dev/null; then
@@ -540,9 +569,8 @@ _ground_apply() {
 }
 
 cmd_deploy() {
-  # A LEADING GROUND NAME IS NOT A SUBCOMMAND. `unoverse deploy aws` names the cloud;
-  # `unoverse deploy init` names the step; `unoverse deploy aws init` does both. Take the
-  # ground off the front when it is there, and leave everything else exactly as it was.
+  # A LEADING GROUND NAME IS NOT A SUBCOMMAND. `unoverse deploy aws` names the cloud. Take
+  # it off the front when it is there, and leave everything else exactly as it was.
   local GROUND_ARG=""
   case "${1:-}" in
     do|digitalocean|aws|amazon) GROUND_ARG="$1"; shift ;;
@@ -700,9 +728,8 @@ EOF
   # A FIRST DEPLOY TO A NEW SERVER IS A PROVISION, NOT AN IMAGE PULL. Bare `deploy` meant
   # only "pull the latest images and restart", which on a freshly built droplet fails on
   # "Destination directory /opt/gravity does not exist" — /opt/gravity being the directory
-  # install.yml creates. The remedy was to know that `unoverse deploy init` exists, which
-  # is exactly the kind of knowledge this CLI is supposed to remove: deploy owns the whole
-  # journey, so it asks the server what it is and picks the right playbook itself.
+  # install.yml creates. Deploy owns the whole journey, so it asks the server what it is and
+  # picks the right playbook itself rather than expecting anyone to know a second command.
   # THE MARKER IS "SETUP FINISHED", NOT "A DIRECTORY EXISTS". Testing for /opt/gravity
   # looked right and was not: install.yml creates that directory as its seventh task, so a
   # first-time setup that then FAILED at the database step still left it behind. The next
@@ -714,7 +741,7 @@ EOF
          "$deploy_user@$deploy_host" 'test -f /opt/gravity/.setup-complete' >/dev/null 2>&1; then
       echo ""
       info "This server's setup has not finished. Running it ${DIM}(install, database, verify)${NC}"
-      subcommand="init"
+      subcommand="first-time"
     fi
   fi
 
@@ -732,10 +759,10 @@ EOF
         -e "universe_root=$ROOT" \
         -e "env_file=$env_prod"
       ;;
-    init|full)
-      # FIRST-TIME setup, END TO END: install → db → verify. One command after
-      # `terraform apply`. Hardening is a deliberate follow-up choice, never a
-      # default (POCs get verified first; harden when you decide to keep it).
+    first-time)
+      # INTERNAL, never typed. Deploy reaches this by finding no .setup-complete stamp on
+      # the server: install → database → verify, end to end. Hardening stays a deliberate
+      # follow-up (POCs get verified first; harden when you decide to keep the box).
       info "First-time setup: install → database → verify"
       echo ""
       info "[1/3] Provisioning (Docker, services, mounts)..."
@@ -743,7 +770,7 @@ EOF
         -i "$tmp_inventory" \
         "$ansible_dir/playbooks/install.yml" \
         -e "universe_root=$ROOT" \
-        -e "env_file=$env_prod" || { rm -f "$tmp_inventory"; fail "install failed — fix and re-run: unoverse deploy init"; exit 1; }
+        -e "env_file=$env_prod" || { rm -f "$tmp_inventory"; fail "install failed. Fix the error above, then: unoverse deploy $cloud"; exit 1; }
       echo ""
       info "[2/3] Database setup..."
       ansible-playbook \
@@ -751,14 +778,14 @@ EOF
         "$ansible_dir/playbooks/db-setup.yml" \
         -e "universe_root=$ROOT" \
         -e "pg_admin_url=$pg_admin_url" \
-        -e "env_file=$env_prod" || { rm -f "$tmp_inventory"; fail "db setup failed — fix and re-run: unoverse deploy db"; exit 1; }
+        -e "env_file=$env_prod" || { rm -f "$tmp_inventory"; fail "database setup failed. Fix the error above, then: unoverse deploy $cloud"; exit 1; }
       echo ""
       info "[3/3] Verifying..."
       ansible-playbook \
         -i "$tmp_inventory" \
         "$ansible_dir/playbooks/test-connectivity.yml" \
         -e "universe_root=$ROOT" \
-        -e "env_file=$env_prod" || { rm -f "$tmp_inventory"; fail "verification failed — inspect and re-run: unoverse deploy test"; exit 1; }
+        -e "env_file=$env_prod" || { rm -f "$tmp_inventory"; fail "verification failed. Look at the output above, then: unoverse deploy $cloud"; exit 1; }
       # Only now. Every step passed, so the next deploy can safely be an image push.
       ssh -o BatchMode=yes -o StrictHostKeyChecking=accept-new -o ConnectTimeout=15 \
         "$deploy_user@$deploy_host" 'touch /opt/gravity/.setup-complete' >/dev/null 2>&1

package/operator/lib/ground.sh

@@ -239,9 +239,28 @@ _ground_aws() {
   region=$(aws configure get region 2>/dev/null)
   [ -n "$region" ] && ok "region: $region" || { region="us-east-1"; info "no default region configured. Using us-east-1"; }
 
+  # A KEY PAIR YOU CANNOT USE IS NOT A KEY PAIR. This took the FIRST key pair in the region,
+  # which on a real account is whatever was created years ago in the console — its private
+  # half is not on this laptop, so terraform applied happily and Ansible then died on
+  # "Permission denied (publickey)" after eleven minutes of RDS provisioning.
+  #
+  # The operator's own key is the one that works, because deploying IS ssh-ing from here.
+  # Upload it under the universe's name and use that: AWS lets terraform import a public
+  # key, so nothing has to pre-exist and nothing has to be downloaded. Fall back to the
+  # account's existing pairs only when this machine has no key at all.
+  local pubkey=""
+  for pubkey in "$HOME/.ssh/id_ed25519.pub" "$HOME/.ssh/id_rsa.pub" ""; do
+    [ -n "$pubkey" ] && [ -f "$pubkey" ] && break
+  done
+
   keys=$(aws ec2 describe-key-pairs --query 'KeyPairs[].KeyName' --output text 2>/dev/null | tr '\t' '\n')
   first_key=$(echo "$keys" | head -1)
-  if [ -n "$first_key" ]; then
+  if [ -n "$pubkey" ]; then
+    first_key=""                       # terraform creates the pair from operator_public_key
+    ok "SSH key: your own ${DIM}($(basename "$pubkey") — uploaded as ${GROUND_NAME:-this universe}-operator)${NC}"
+  elif [ -n "$first_key" ]; then
+    warn "no SSH key on this machine — using the account's ${BOLD}$first_key${NC}"
+    warn "the deploy will fail unless you hold its private half"
     ok "EC2 key pair: $first_key"
   else
     warn "no EC2 key pairs in $region. Create one first (aws ec2 create-key-pair)"
@@ -268,7 +287,8 @@ _ground_aws() {
 region       = "$region"
 name         = "$GROUND_NAME"
 admin_cidr   = "${ip:-FILL_ME}${ip:+/32}"       # YOUR IP — the only SSH source
-ssh_key_name = "${first_key:-FILL_ME}"  # must already exist in the region
+ssh_key_name = "${first_key}"  # empty = terraform uploads operator_public_key below
+operator_public_key = "$( [ -n "$pubkey" ] && cat "$pubkey" )"   # your key: the deploy ssh-es from this machine
 admin_email  = "FILL_ME"                # initial admin (Cognito user, all roles; invite emailed)
 size         = "small"                  # small (POC) | medium | large
 # Domain is OPTIONAL — empty brings the universe up on the ALB's DNS name over

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unoverse",
-  "version": "0.1.100",
+  "version": "0.1.102",
   "description": "The Unoverse front door — create a Studio project, a universe, or a client app, and launch Studio.",
   "license": "SEE LICENSE IN README.md",
   "type": "module",