unoverse 0.1.76 → 0.1.78

package/operator/infra/aws/main.tf

@@ -14,8 +14,41 @@ terraform {
   }
 }
 
+# ── One universe, one group ───────────────────────────────────────────────────
+#
+# AWS has no projects. Its equivalent is TAGS, and `default_tags` is the only honest way
+# to apply them: it stamps every resource this configuration creates, so nothing is
+# forgotten the day someone adds a resource and does not think about tagging. The console
+# view comes from the Resource Group below, and the same tag drives cost allocation, which
+# a DigitalOcean project cannot do.
+#
+# It touches ONLY what this stack creates. An adopted database keeps its own tags, in
+# keeping with the rule that a universe never takes ownership of what it borrowed
+# (INFRASTRUCTURE.md, "Borrowed resources are never owned").
 provider "aws" {
   region = var.region
+
+  default_tags {
+    tags = {
+      Universe  = var.name
+      ManagedBy = "unoverse"
+      Size      = var.size
+    }
+  }
+}
+
+# The console's answer to "what does this universe own". A tag query rather than a
+# membership list, so it stays correct as the ground grows without anyone maintaining it.
+resource "aws_resourcegroups_group" "universe" {
+  name        = var.name
+  description = "unoverse universe: ${var.name}"
+
+  resource_query {
+    query = jsonencode({
+      ResourceTypeFilters = ["AWS::AllSupported"]
+      TagFilters          = [{ Key = "Universe", Values = [var.name] }]
+    })
+  }
 }
 
 # ── Network: default VPC + two security groups ─────────────────────────────────

package/operator/infra/aws/variables.tf

@@ -1,13 +1,14 @@
+# NO DEFAULTS ON EITHER OF THESE — see the same note in infra/digitalocean/variables.tf.
+# Where it runs and what it is called are the developer's answers, and a default quietly
+# supplies mine instead.
 variable "region" {
   description = "AWS region. Must have Bedrock model access enabled for the models you use."
   type        = string
-  default     = "us-east-1"
 }
 
 variable "name" {
-  description = "Prefix for every resource (also the Cognito domain prefix, so keep it dns-safe)."
+  description = "Prefix for every resource (also the Cognito domain prefix, so keep it dns-safe), and the resource group they are tagged into."
   type        = string
-  default     = "universe-poc"
 }
 
 variable "admin_cidr" {

package/operator/infra/digitalocean/variables.tf

@@ -5,16 +5,18 @@ variable "do_token" {
   sensitive   = true
 }
 
+# NO DEFAULTS ON EITHER OF THESE. They used to default to "lon1" and "universe-poc", which
+# meant a tfvars missing them built somebody's universe in London under a placeholder name
+# and reported success. Where it runs and what it is called are the developer's answers, so
+# terraform should refuse to plan without them rather than quietly supply mine.
 variable "region" {
-  description = "DigitalOcean region for everything."
+  description = "DigitalOcean region for everything (doctl compute region list)."
   type        = string
-  default     = "lon1"
 }
 
 variable "name" {
-  description = "Prefix for every resource."
+  description = "Prefix for every resource, and the name of the DigitalOcean project they are grouped under."
   type        = string
-  default     = "universe-poc"
 }
 
 variable "size" {

package/operator/lib/deploy.sh

@@ -20,16 +20,23 @@
 # trusted-sources list, so pointing it at a borrowed cluster deletes the operator's own
 # IP, their other droplets and their apps. Read the rules, add ours if missing, write
 # them back. Nothing else moves, and running it twice changes nothing.
-_grant_droplet_to_adopted_db() {
+# Add or remove THIS universe's droplet in an adopted cluster's trusted sources.
+#   _adopted_db_access <cloud> grant|revoke [droplet_id]
+# Symmetric on purpose. The grant existed and nothing revoked it, so a teardown left a
+# stale rule behind — and worse, terraform's own destroy of an authoritative firewall
+# resource PUT an EMPTY list and locked the operator out of a database it had borrowed.
+# Both directions now touch exactly one rule and never the list.
+_adopted_db_access() {
   local cloud="$1" dir="$ROOT/infra/$cloud" cluster droplet_id
+  local mode="$2"
   cluster=$(grep -E '^existing_pg_cluster_name[[:space:]]*=' "$dir/terraform.tfvars" 2>/dev/null | sed -E 's/.*"([^"]+)".*/\1/')
   [ -n "$cluster" ] || return 0
   [ -n "${DIGITALOCEAN_TOKEN:-}" ] || return 0
-  droplet_id=$(terraform -chdir="$dir" state show digitalocean_droplet.app 2>/dev/null | awk -F'"' '/^ *id *=/{print $2; exit}')
+  droplet_id="${3:-$(terraform -chdir="$dir" state show digitalocean_droplet.app 2>/dev/null | awk -F'"' '/^ *id *=/{print $2; exit}')}"
   [ -n "$droplet_id" ] || return 0
 
-  node - "$cluster" "$droplet_id" <<'NODE'
-const [cluster, droplet] = process.argv.slice(2);
+  node - "$cluster" "$droplet_id" "$mode" <<'NODE'
+const [cluster, droplet, mode] = process.argv.slice(2);
 const T = process.env.DIGITALOCEAN_TOKEN;
 const H = { Authorization: `Bearer ${T}`, "Content-Type": "application/json" };
 const api = (p, o = {}) => fetch(`https://api.digitalocean.com/v2${p}`, { headers: H, ...o });
@@ -38,13 +45,21 @@ const api = (p, o = {}) => fetch(`https://api.digitalocean.com/v2${p}`, { header
   const db = (list.databases || []).find((d) => d.name === cluster);
   if (!db) return;
   const fw = await (await api(`/databases/${db.id}/firewall`)).json();
-  const rules = (fw.rules || []).map((r) => ({ type: r.type, value: r.value }));
-  if (rules.some((r) => r.type === "droplet" && String(r.value) === String(droplet))) return;
-  rules.push({ type: "droplet", value: String(droplet) });
+  let rules = (fw.rules || []).map((r) => ({ type: r.type, value: r.value }));
+  const mine = (r) => r.type === "droplet" && String(r.value) === String(droplet);
+  const has = rules.some(mine);
+  if (mode === "revoke") {
+    if (!has) return;
+    rules = rules.filter((r) => !mine(r));   // ours only; every other rule survives
+  } else {
+    if (has) return;
+    rules.push({ type: "droplet", value: String(droplet) });
+  }
   const res = await api(`/databases/${db.id}/firewall`, { method: "PUT", body: JSON.stringify({ rules }) });
+  const what = mode === "revoke" ? "no longer reaches" : "may reach";
   console.log(res.ok
-    ? `  \x1b[32m✓\x1b[0m This universe may reach ${cluster} \x1b[2m(added to its trusted sources, nothing else changed)\x1b[0m`
-    : `  \x1b[33m!\x1b[0m Could not update ${cluster}'s trusted sources — add droplet ${droplet} by hand`);
+    ? `  \x1b[32m✓\x1b[0m This universe ${what} ${cluster} \x1b[2m(one rule changed, ${rules.length} left in place)\x1b[0m`
+    : `  \x1b[33m!\x1b[0m Could not update ${cluster}'s trusted sources — adjust droplet ${droplet} by hand`);
 })().catch(() => {});
 NODE
 }
@@ -110,6 +125,24 @@ _ensure_ground_config() {
       fi
     }
     echo ""
+
+  # YOUR IP MOVED. admin_cidr is captured once, when the ground is generated, and it is
+  # the ONLY address the firewall lets near port 22. Home broadband, a phone hotspot or a
+  # different office and the address is stale — at which point terraform applies happily,
+  # every resource is correct, and the ship step dies on "connect to host ... port 22:
+  # Operation timed out" with nothing on screen connecting the two. Check it every deploy
+  # and just fix it: the firewall is ours, and a one-rule update is not a decision.
+  local cur_ip cur_cidr have_cidr
+  cur_ip=$(curl -s --max-time 5 https://api.ipify.org 2>/dev/null || curl -s --max-time 5 https://ifconfig.me 2>/dev/null)
+  have_cidr=$(grep -E '^admin_cidr[[:space:]]*=' "$tfv" 2>/dev/null | sed -E 's/.*"([^"]+)".*/\1/')
+  if [ -n "$cur_ip" ] && [ -n "$have_cidr" ] && [ "$have_cidr" != "FILL_ME" ]; then
+    cur_cidr="$cur_ip/32"
+    if [ "$have_cidr" != "$cur_cidr" ]; then
+      node -e 'const fs=require("fs");const[f,v]=process.argv.slice(1);let s=fs.readFileSync(f,"utf8");s=s.replace(/^admin_cidr(\s*)=\s*"[^"]*"/m,"admin_cidr$1= "+JSON.stringify(v));fs.writeFileSync(f,s)' "$tfv" "$cur_cidr"
+      ok "Your address changed ${DIM}($have_cidr → $cur_cidr). Admin access follows you${NC}"
+    fi
+  fi
+
     # POSTGRES: ASK, DO NOT ASSUME. The ground discovers an existing cluster and writes
   # it as a COMMENTED line, so the default silently provisions a SECOND database next
   # to one the account already pays for. A choice with a monthly bill attached is a
@@ -229,25 +262,34 @@ _ground_apply() {
     *) fail "Terraform could not plan the change:"; tail -20 "$tmp/plan.log" | sed 's/^/      /'; rm -rf "$tmp"; return 1 ;;
   esac
 
-  if ! terraform -chdir="$dir" show -json "$planfile" 2>/dev/null | node "$GRAVITY_LIB/tfsummary.mjs"; then
+  # STOPPING IS FOR LOSING SOMETHING, NOT FOR BUILDING IT. Typing `unoverse deploy` is
+  # already the decision; a y/N gate straight afterwards asks the same question twice and
+  # makes the developer's own instruction feel like a risk. The summary above still shows
+  # exactly what appears and what it costs — it is a briefing, not a checkpoint. tfsummary
+  # exits 3 when the plan destroys or replaces something, and THAT is worth interrupting.
+  local summary_rc=0
+  terraform -chdir="$dir" show -json "$planfile" 2>/dev/null | node "$GRAVITY_LIB/tfsummary.mjs"
+  summary_rc=${PIPESTATUS[1]}
+  if [ "$summary_rc" = "2" ]; then
+    # The plan could not be read, so nothing above is trustworthy. Show the real thing and
+    # fall back to asking: silence plus an unreadable plan is not consent.
     terraform -chdir="$dir" show "$planfile"
+    summary_rc=3
   fi
 
-  # `read -p` does NOT interpret escapes, so ${DIM} printed as literal \033[2m. Colour
-  # the hint with echo -e first, then take a plain prompt.
-  # EXPLICIT YES, and it says so. Everywhere else in this CLI Enter means "go"; here it
-  # means "stop", because this is the one prompt that starts a monthly bill. Keeping the
-  # safety is right — leaving it as a bare [y/N] among Enter-means-go prompts is not.
-  local REPLY
-  echo -e "  ${DIM}d shows the full technical plan${NC}"
-  read -r -p "  Type y to build this, or Enter to stop: " REPLY
-  if [[ "$REPLY" =~ ^[Dd]$ ]]; then
-    terraform -chdir="$dir" show "$planfile"
-    read -r -p "  Type y to build this, or Enter to stop: " REPLY
-  fi
-  if [[ ! "$REPLY" =~ ^[Yy]$ ]]; then
-    info "Nothing was created. Run ${BOLD}unoverse deploy${NC} when you are ready"
-    rm -rf "$tmp"; return 1
+  local docpage
+  [ "$cloud" = "aws" ] && docpage="aws" || docpage="digitalocean"
+  echo -e "  ${DIM}How it fits together: https://github.com/unoverse-platform/docs/blob/main/architecture/$docpage.md${NC}"
+  echo ""
+
+  if [ "$summary_rc" = "3" ]; then
+    local REPLY
+    echo -e "  ${RED}This removes or rebuilds things that already exist.${NC}"
+    read -r -p "  Type y to go ahead, or Enter to stop: " REPLY
+    if [[ ! "$REPLY" =~ ^[Yy]$ ]]; then
+      info "Nothing was changed. Run ${BOLD}unoverse deploy${NC} when you are ready"
+      rm -rf "$tmp"; return 1
+    fi
   fi
 
   echo ""
@@ -311,7 +353,7 @@ cmd_deploy() {
     exit 1
   fi
 
-  _grant_droplet_to_adopted_db "$cloud"
+  _adopted_db_access "$cloud" grant
 
 
   # Read deploy target from .env.production

package/operator/lib/destroy.sh

@@ -91,6 +91,14 @@ cmd_destroy() {
     return 1
   fi
 
+  # Take our rule out of the borrowed cluster BEFORE the state goes, while the droplet id
+  # is still readable. One rule, ours, never the list.
+  if [ -n "$kept" ]; then
+    local dropped
+    dropped=$(terraform -chdir="$dir" state show digitalocean_droplet.app 2>/dev/null | awk -F'"' '/^ *id *=/{print $2; exit}')
+    [ -n "$dropped" ] && _adopted_db_access "$cloud" revoke "$dropped"
+  fi
+
   echo ""
   info "Taking it down..."
   echo ""

package/operator/lib/ground.sh

@@ -13,6 +13,44 @@ _ground_my_ip() {
   curl -s --max-time 5 https://api.ipify.org 2>/dev/null || curl -s --max-time 5 https://ifconfig.me 2>/dev/null
 }
 
+# THE UNIVERSE HAS A NAME, so ask for one. This file used to write name = "universe-poc"
+# as a literal, so every universe on every account carried the same placeholder — it names
+# the droplet, the cache, the load balancer and the cloud project, and the developer first
+# meets it in their provider dashboard, after the bill has started. A generated file is not
+# a question: nobody edits it before running deploy.
+#
+# Sets GROUND_NAME (and GROUND_REGION when a default is passed). Both are sanitised to what
+# cloud resource names allow, so a typed "My POC" cannot fail an apply five minutes in.
+_ground_identity() {
+  local valid="$1" suggest
+  suggest=$(basename "$ROOT" | tr '[:upper:]' '[:lower:]' | sed -E 's/[^a-z0-9-]+/-/g; s/^-+//; s/-+$//')
+  suggest="${suggest:-universe}"
+  echo ""
+  read -r -p "  Name this universe [$suggest]: " GROUND_NAME
+  GROUND_NAME=$(echo "${GROUND_NAME:-$suggest}" | tr '[:upper:]' '[:lower:]' | sed -E 's/[^a-z0-9-]+/-/g; s/^-+//; s/-+$//')
+  GROUND_NAME="${GROUND_NAME:-$suggest}"
+
+  # NO DEFAULT REGION. A default is a choice made on the developer's behalf, and the
+  # previous one was mine: `lon1`, written straight into the file, which is how a universe
+  # meant for Singapore was built in London. There is no neutral region to fall back to, so
+  # this asks until it gets a real answer and checks it against the provider's own list —
+  # a typo here surfaces as a five-minute apply that fails on the last resource.
+  # "-" means the region is not this ground's to ask: AWS reads it from the developer's own
+  # CLI configuration, which is already their answer.
+  GROUND_REGION=""
+  [ "$valid" = "-" ] && return 0
+  while [ -z "$GROUND_REGION" ]; do
+    read -r -p "  Which region? " GROUND_REGION
+    GROUND_REGION=$(echo "$GROUND_REGION" | tr -d '[:space:]')
+    # Validate only against a list we actually retrieved. An empty list means the lookup
+    # failed, not that every region is wrong.
+    if [ -n "$GROUND_REGION" ] && [ -n "$valid" ] && ! echo "$valid" | tr ' ' '\n' | grep -qx "$GROUND_REGION"; then
+      warn "$GROUND_REGION is not a region in your account. Pick one from the list above"
+      GROUND_REGION=""
+    fi
+  done
+}
+
 _ground_do() {
   local dir="$ROOT/infra/digitalocean"
   local out="$dir/terraform.tfvars"
@@ -88,13 +126,21 @@ _ground_do() {
     info "no existing Postgres cluster. Terraform will provision one"
   fi
 
+  local regions
+  regions=$(doctl compute region list --format Slug --no-header 2>/dev/null | tr -d '\r' | xargs)
+  if [ -n "$regions" ]; then
+    echo ""
+    echo -e "  ${DIM}Regions available to you: $regions${NC}"
+  fi
+  _ground_identity "$regions"
+
   cat > "$out" <<EOF
 # Generated by \`unoverse ground do\` on $(date +%Y-%m-%d). Discovered values are
 # prefilled; every FILL_ME needs YOUR value before \`terraform apply\`.
 # Token: set DIGITALOCEAN_TOKEN in the environment (preferred) or do_token here.
 
-region       = "lon1"                    # doctl compute region list
-name         = "universe-poc"
+region       = "$GROUND_REGION"                    # doctl compute region list
+name         = "$GROUND_NAME"
 size         = "small"                   # small (POC) | medium | large
 admin_cidr   = "${ip:-FILL_ME}${ip:+/32}"        # YOUR IP — SSH + Dozzle only
 ssh_key_name = "${first_key:-FILL_ME}"   # must already exist in the DO account
@@ -185,12 +231,15 @@ _ground_aws() {
     info "multiple Route53 zones. Pick one in the file (listed there)"
   fi
 
+  # Region already came from the AWS CLI's own configuration, so only the name is asked.
+  _ground_identity "-"
+
   cat > "$out" <<EOF
 # Generated by \`unoverse ground aws\` on $(date +%Y-%m-%d). Discovered values are
 # prefilled; every FILL_ME needs YOUR value before \`terraform apply\`.
 
 region       = "$region"
-name         = "universe-poc"
+name         = "$GROUND_NAME"
 admin_cidr   = "${ip:-FILL_ME}${ip:+/32}"       # YOUR IP — the only SSH source
 ssh_key_name = "${first_key:-FILL_ME}"  # must already exist in the region
 admin_email  = "FILL_ME"                # initial admin (Cognito user, all roles; invite emailed)

package/operator/lib/tfsummary.mjs

@@ -11,6 +11,11 @@
  * their size, counts the plumbing (database users, firewall rules, generated passwords)
  * rather than listing it, and shouts about anything being destroyed.
  *
+ * EXIT CODE IS THE ANSWER TO "should the caller stop and ask?". 0 when the plan only adds
+ * or adjusts — deploy just builds, because typing `unoverse deploy` already said to. 3
+ * when something is destroyed or replaced, which is the only case worth interrupting a
+ * developer for. 2 when the JSON could not be read, so the caller shows raw terraform.
+ *
  * NOT A COST ORACLE. The developer sees an order of magnitude rather than a surprise. Rates
  * move, so the total is labelled approximate and the real bill is the provider's.
  *
@@ -138,7 +143,7 @@ process.stdin.on("end", () => {
   const out = [];
   if (total === 0) {
     console.log(`\n  ${green("●")} Your infrastructure already matches. Nothing to change.\n`);
-    process.exit(0);
+    return;
   }
 
   const width = Math.max(...Object.values(groups).flat().map((d) => d.what.length), 0) + 2;
@@ -169,4 +174,11 @@ process.stdin.on("end", () => {
   }
 
   console.log("\n" + out.join("\n"));
+
+  // Tell the caller whether this is worth stopping for. Losing something is; building
+  // something is not. `process.exitCode` rather than `process.exit`, which can cut off
+  // the output above while it is still draining down a pipe.
+  const destructive =
+    groups.delete.length + groups.replace.length + supporting.delete + supporting.replace;
+  if (destructive) process.exitCode = 3;
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unoverse",
-  "version": "0.1.76",
+  "version": "0.1.78",
   "description": "The Unoverse front door — create a Studio project, a universe, or a client app, and launch Studio.",
   "license": "SEE LICENSE IN README.md",
   "type": "module",