unoverse 0.1.61 → 0.1.63

package/operator/lib/deploy.sh

@@ -1,6 +1,54 @@
 #!/usr/bin/env bash
 # unoverse deploy — deploy to production VM from local
 
+# ── Provisioning, spoken plainly ─────────────────────────────────────────────
+#
+# `terraform apply` shows ~200 lines of attributes and asks for a typed "yes". That is
+# the right ceremony for an infrastructure engineer and the wrong first impression for a
+# developer, who needs to know what will exist and what it costs. So: plan into a file,
+# summarise it (tfsummary.mjs), take ONE clear answer, apply that exact plan.
+#
+# Nothing is softened. Destroys are shouted, the full technical plan is one keystroke
+# away, and the SAVED plan is what runs, so what was approved is what happens. Identical
+# for every cloud: the summary reads the plan JSON, which is provider-agnostic.
+_ground_apply() {
+  local cloud="$1" dir="$ROOT/infra/$cloud" tmp planfile rc
+  tmp=$(mktemp -d); planfile="$tmp/plan"
+
+  terraform -chdir="$dir" init -input=false >/dev/null 2>&1 || { fail "terraform init failed"; rm -rf "$tmp"; return 1; }
+
+  info "Working out what needs to change..."
+  terraform -chdir="$dir" plan -input=false -detailed-exitcode -out="$planfile" >"$tmp/plan.log" 2>&1
+  rc=$?
+  case "$rc" in
+    0) rm -rf "$tmp"; return 3 ;;
+    2) : ;;
+    *) fail "Terraform could not plan the change:"; tail -20 "$tmp/plan.log" | sed 's/^/      /'; rm -rf "$tmp"; return 1 ;;
+  esac
+
+  if ! terraform -chdir="$dir" show -json "$planfile" 2>/dev/null | node "$GRAVITY_LIB/tfsummary.mjs"; then
+    terraform -chdir="$dir" show "$planfile"
+  fi
+
+  local REPLY
+  read -r -p "  Go ahead? [y/N] ${DIM}(d for the full technical plan)${NC} " REPLY
+  if [[ "$REPLY" =~ ^[Dd]$ ]]; then
+    terraform -chdir="$dir" show "$planfile"
+    read -r -p "  Go ahead? [y/N] " REPLY
+  fi
+  if [[ ! "$REPLY" =~ ^[Yy]$ ]]; then
+    info "Nothing was created. Run ${BOLD}unoverse deploy${NC} when you are ready"
+    rm -rf "$tmp"; return 1
+  fi
+
+  echo ""
+  info "Building. Managed databases take a few minutes on the provider's side"
+  echo ""
+  terraform -chdir="$dir" apply -input=false "$planfile" || { fail "The build did not finish. Re-run: unoverse deploy"; rm -rf "$tmp"; return 1; }
+  rm -rf "$tmp"
+  return 0
+}
+
 cmd_deploy() {
 
   local env_prod="$ROOT/.env.production"
@@ -18,6 +66,27 @@ cmd_deploy() {
     done
   fi
 
+  # INFRA CHANGES SHIP TOO. If the ground has pending changes (edited tfvars, a new
+  # resource in main.tf from an update), deploy applies them first — through
+  # terraform's own plan-and-yes gate — then re-renders the env, since outputs may
+  # have changed. Without this, deploy only ever shipped images once a server
+  # existed, and infrastructure edits silently rotted.
+  local g_applied
+  if command -v terraform >/dev/null 2>&1; then
+    local g rc
+    for g in digitalocean aws; do
+      [ -d "$ROOT/infra/$g/.terraform" ] || continue
+      _ground_apply "$g"; rc=$?
+      [ "$rc" = "1" ] && exit 1
+      if [ "$rc" = "0" ]; then
+        terraform -chdir="$ROOT/infra/$g" output -raw env_production > "$env_prod" 2>/dev/null \
+          && ok "Refreshed .env.production from the ground"
+        g_applied=1
+      fi
+      break
+    done
+  fi
+
   # Missing .env.production is not an error if a ground has been applied — the
   # file is just a Terraform output, so render it ourselves. Reading state is
   # not wrapping terraform: apply stays the developer's explicit act.
@@ -113,8 +182,6 @@ cmd_deploy() {
     # for billable infrastructure; a [Y/n] in front of it was asking permission to ask
     # permission. Answering "no" is terraform's "no".
     echo ""
-    info "Provisioning. Terraform shows the plan and asks for your ${BOLD}yes${NC} before creating anything"
-    echo ""
     # Terraform is one static binary: install it directly from the official release
     # rather than sending anyone to brew (whose compile chain can demand Xcode Command
     # Line Tools updates for a tool that needs no compiling).
@@ -132,8 +199,7 @@ cmd_deploy() {
       rm -rf "$tf_dir"
       ok "terraform $(terraform version | head -1 | awk '{print $2}') installed"
     fi
-    terraform -chdir="$ROOT/infra/$cloud" init -input=false >/dev/null 2>&1 || { fail "terraform init failed"; exit 1; }
-    terraform -chdir="$ROOT/infra/$cloud" apply || { fail "apply did not complete. Re-run: unoverse deploy"; exit 1; }
+    _ground_apply "$cloud" || exit 1
     echo ""
     ok "Infrastructure is up. Shipping the platform onto it..."
     echo ""

package/operator/lib/tfsummary.mjs

@@ -0,0 +1,145 @@
+#!/usr/bin/env node
+/**
+ * The Terraform plan, in plain English.
+ *
+ * `terraform plan` prints ~200 lines of every attribute of every resource, most of them
+ * "(known after apply)". It is written for someone auditing infrastructure, and it is the
+ * first thing a developer deploying a universe ever sees. They need two facts: what will
+ * exist afterwards, and what it will cost. Everything else is noise at that moment.
+ *
+ * Reads `terraform show -json <planfile>` on stdin. Prints the headline resources with
+ * their size, counts the plumbing (database users, firewall rules, generated passwords)
+ * rather than listing it, and shouts about anything being destroyed.
+ *
+ * NOT A COST ORACLE. Prices are DigitalOcean's published monthly rates for the sizes this
+ * ground uses, so the developer sees an order of magnitude rather than a surprise. They
+ * move, so the total is labelled approximate and the real bill is the provider's.
+ */
+
+const COLOR = !process.env.NO_COLOR;
+const paint = (c) => (s) => (COLOR ? `\x1b[${c}m${s}\x1b[0m` : s);
+const bold = paint("1");
+const dim = paint("2");
+const green = paint("32");
+const red = paint("31");
+const yellow = paint("33");
+
+/** Monthly USD for the sizes these grounds use. Absent size → no guess. */
+const PRICE = {
+  "s-1vcpu-1gb": 6, "s-1vcpu-2gb": 12, "s-2vcpu-2gb": 18, "s-2vcpu-4gb": 24,
+  "s-4vcpu-8gb": 48, "s-4vcpu-16gb-amd": 96, "s-8vcpu-16gb": 96,
+  "db-s-1vcpu-1gb": 15, "db-s-1vcpu-2gb": 30, "db-s-2vcpu-4gb": 60,
+  lb: 12,
+  "t3.large": 60, "t3.xlarge": 120, "db.t3.medium": 50, "cache.t3.micro": 12,
+};
+
+/** vCPU/RAM read out of a size slug, when it says so. */
+function spec(size) {
+  if (!size) return "";
+  const m = /(\d+)vcpu-(\d+)gb/.exec(size);
+  return m ? `${m[1]} vCPU, ${m[2]} GB` : size;
+}
+
+/**
+ * What a resource IS, to a person. Returns null for plumbing: a database user, a
+ * connection pool and a generated password are all part of "a PostgreSQL database",
+ * and listing them separately turns one decision into eleven.
+ */
+function describe(r) {
+  const a = r.change?.after ?? {};
+  switch (r.type) {
+    case "digitalocean_droplet":
+      return { what: "Server", detail: `${spec(a.size)} · ${a.region ?? ""}`, price: PRICE[a.size] };
+    case "digitalocean_database_cluster":
+      return a.engine === "redis"
+        ? { what: "Redis cache", detail: `${spec(a.size)} · v${a.version ?? ""}`, price: PRICE[a.size] }
+        : { what: "PostgreSQL database", detail: `${spec(a.size)} · v${a.version ?? ""}`, price: PRICE[a.size] };
+    case "digitalocean_loadbalancer":
+      return { what: "Load balancer", detail: "the public way in", price: PRICE.lb };
+    case "digitalocean_firewall":
+      return { what: "Firewall", detail: "admin ports limited to your IP" };
+    case "digitalocean_certificate":
+      return { what: "TLS certificate", detail: "HTTPS for your domain" };
+    case "digitalocean_record":
+      return { what: "DNS record", detail: a.name ? `${a.name}.${a.domain ?? ""}` : "" };
+    case "aws_instance":
+      return { what: "Server", detail: a.instance_type ?? "", price: PRICE[a.instance_type] };
+    case "aws_db_instance":
+      return { what: "PostgreSQL database", detail: a.instance_class ?? "", price: PRICE[a.instance_class] };
+    case "aws_elasticache_cluster":
+    case "aws_elasticache_replication_group":
+      return { what: "Redis cache", detail: a.node_type ?? "", price: PRICE[a.node_type] };
+    case "aws_lb":
+      return { what: "Load balancer", detail: "the public way in", price: 18 };
+    case "aws_cognito_user_pool":
+      return { what: "Login (Cognito)", detail: "who may use your universe" };
+    case "aws_acm_certificate":
+      return { what: "TLS certificate", detail: "HTTPS for your domain" };
+    default:
+      return null; // plumbing: counted, not listed
+  }
+}
+
+const ACTION = { create: "Creating", update: "Changing", delete: "Destroying", "replace": "Replacing" };
+
+function action(ch) {
+  const acts = ch.actions ?? [];
+  if (acts.includes("delete") && acts.includes("create")) return "replace";
+  if (acts.includes("create")) return "create";
+  if (acts.includes("delete")) return "delete";
+  if (acts.includes("update")) return "update";
+  return null; // no-op / read
+}
+
+let raw = "";
+process.stdin.on("data", (d) => (raw += d));
+process.stdin.on("end", () => {
+  let plan;
+  try {
+    plan = JSON.parse(raw);
+  } catch {
+    process.exit(2); // caller falls back to raw terraform output
+  }
+
+  const groups = { create: [], update: [], delete: [], replace: [] };
+  const supporting = { create: 0, update: 0, delete: 0, replace: 0 };
+
+  for (const r of plan.resource_changes ?? []) {
+    const act = action(r.change ?? {});
+    if (!act) continue;
+    const d = describe(r);
+    if (d) groups[act].push(d);
+    else supporting[act]++;
+  }
+
+  const total = Object.values(groups).flat().length + Object.values(supporting).reduce((a, b) => a + b, 0);
+  const out = [];
+  if (total === 0) {
+    console.log(`\n  ${green("●")} Your infrastructure already matches. Nothing to change.\n`);
+    process.exit(0);
+  }
+
+  const width = Math.max(...Object.values(groups).flat().map((d) => d.what.length), 0) + 2;
+
+  for (const act of ["create", "update", "replace", "delete"]) {
+    const list = groups[act];
+    const extra = supporting[act];
+    if (!list.length && !extra) continue;
+    const colour = act === "delete" || act === "replace" ? red : act === "update" ? yellow : green;
+    out.push(`  ${bold(ACTION[act])}${act === "delete" ? red("  (this removes things that exist)") : ""}`);
+    for (const d of list) {
+      const price = d.price ? dim(`  ~$${d.price}/mo`) : "";
+      out.push(`    ${colour("●")} ${d.what.padEnd(width)}${dim(d.detail)}${price}`);
+    }
+    if (extra) out.push(`    ${dim(`plus ${extra} supporting ${extra === 1 ? "resource" : "resources"} (users, rules, keys)`)}`);
+    out.push("");
+  }
+
+  const monthly = Object.values(groups).flat().reduce((sum, d) => sum + (d.price ?? 0), 0);
+  if (monthly) {
+    out.push(`  ${bold("Roughly")} ${bold(`$${monthly}/month`)} ${dim("at your provider's current prices, billed by them, not by unoverse")}`);
+    out.push("");
+  }
+
+  console.log("\n" + out.join("\n"));
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unoverse",
-  "version": "0.1.61",
+  "version": "0.1.63",
   "description": "The Unoverse front door — create a Studio project, a universe, or a client app, and launch Studio.",
   "license": "SEE LICENSE IN README.md",
   "type": "module",