unoverse 0.1.77 → 0.1.78

package/operator/infra/aws/variables.tf

@@ -1,13 +1,14 @@
+# NO DEFAULTS ON EITHER OF THESE — see the same note in infra/digitalocean/variables.tf.
+# Where it runs and what it is called are the developer's answers, and a default quietly
+# supplies mine instead.
 variable "region" {
   description = "AWS region. Must have Bedrock model access enabled for the models you use."
   type        = string
-  default     = "us-east-1"
 }
 
 variable "name" {
-  description = "Prefix for every resource (also the Cognito domain prefix, so keep it dns-safe)."
+  description = "Prefix for every resource (also the Cognito domain prefix, so keep it dns-safe), and the resource group they are tagged into."
   type        = string
-  default     = "universe-poc"
 }
 
 variable "admin_cidr" {

package/operator/infra/digitalocean/variables.tf

@@ -5,16 +5,18 @@ variable "do_token" {
   sensitive   = true
 }
 
+# NO DEFAULTS ON EITHER OF THESE. They used to default to "lon1" and "universe-poc", which
+# meant a tfvars missing them built somebody's universe in London under a placeholder name
+# and reported success. Where it runs and what it is called are the developer's answers, so
+# terraform should refuse to plan without them rather than quietly supply mine.
 variable "region" {
-  description = "DigitalOcean region for everything."
+  description = "DigitalOcean region for everything (doctl compute region list)."
   type        = string
-  default     = "lon1"
 }
 
 variable "name" {
-  description = "Prefix for every resource."
+  description = "Prefix for every resource, and the name of the DigitalOcean project they are grouped under."
   type        = string
-  default     = "universe-poc"
 }
 
 variable "size" {

package/operator/lib/deploy.sh

@@ -125,6 +125,24 @@ _ensure_ground_config() {
       fi
     }
     echo ""
+
+  # YOUR IP MOVED. admin_cidr is captured once, when the ground is generated, and it is
+  # the ONLY address the firewall lets near port 22. Home broadband, a phone hotspot or a
+  # different office and the address is stale — at which point terraform applies happily,
+  # every resource is correct, and the ship step dies on "connect to host ... port 22:
+  # Operation timed out" with nothing on screen connecting the two. Check it every deploy
+  # and just fix it: the firewall is ours, and a one-rule update is not a decision.
+  local cur_ip cur_cidr have_cidr
+  cur_ip=$(curl -s --max-time 5 https://api.ipify.org 2>/dev/null || curl -s --max-time 5 https://ifconfig.me 2>/dev/null)
+  have_cidr=$(grep -E '^admin_cidr[[:space:]]*=' "$tfv" 2>/dev/null | sed -E 's/.*"([^"]+)".*/\1/')
+  if [ -n "$cur_ip" ] && [ -n "$have_cidr" ] && [ "$have_cidr" != "FILL_ME" ]; then
+    cur_cidr="$cur_ip/32"
+    if [ "$have_cidr" != "$cur_cidr" ]; then
+      node -e 'const fs=require("fs");const[f,v]=process.argv.slice(1);let s=fs.readFileSync(f,"utf8");s=s.replace(/^admin_cidr(\s*)=\s*"[^"]*"/m,"admin_cidr$1= "+JSON.stringify(v));fs.writeFileSync(f,s)' "$tfv" "$cur_cidr"
+      ok "Your address changed ${DIM}($have_cidr → $cur_cidr). Admin access follows you${NC}"
+    fi
+  fi
+
     # POSTGRES: ASK, DO NOT ASSUME. The ground discovers an existing cluster and writes
   # it as a COMMENTED line, so the default silently provisions a SECOND database next
   # to one the account already pays for. A choice with a monthly bill attached is a
@@ -244,25 +262,34 @@ _ground_apply() {
     *) fail "Terraform could not plan the change:"; tail -20 "$tmp/plan.log" | sed 's/^/      /'; rm -rf "$tmp"; return 1 ;;
   esac
 
-  if ! terraform -chdir="$dir" show -json "$planfile" 2>/dev/null | node "$GRAVITY_LIB/tfsummary.mjs"; then
+  # STOPPING IS FOR LOSING SOMETHING, NOT FOR BUILDING IT. Typing `unoverse deploy` is
+  # already the decision; a y/N gate straight afterwards asks the same question twice and
+  # makes the developer's own instruction feel like a risk. The summary above still shows
+  # exactly what appears and what it costs — it is a briefing, not a checkpoint. tfsummary
+  # exits 3 when the plan destroys or replaces something, and THAT is worth interrupting.
+  local summary_rc=0
+  terraform -chdir="$dir" show -json "$planfile" 2>/dev/null | node "$GRAVITY_LIB/tfsummary.mjs"
+  summary_rc=${PIPESTATUS[1]}
+  if [ "$summary_rc" = "2" ]; then
+    # The plan could not be read, so nothing above is trustworthy. Show the real thing and
+    # fall back to asking: silence plus an unreadable plan is not consent.
     terraform -chdir="$dir" show "$planfile"
+    summary_rc=3
   fi
 
-  # `read -p` does NOT interpret escapes, so ${DIM} printed as literal \033[2m. Colour
-  # the hint with echo -e first, then take a plain prompt.
-  # EXPLICIT YES, and it says so. Everywhere else in this CLI Enter means "go"; here it
-  # means "stop", because this is the one prompt that starts a monthly bill. Keeping the
-  # safety is right — leaving it as a bare [y/N] among Enter-means-go prompts is not.
-  local REPLY
-  echo -e "  ${DIM}d shows the full technical plan${NC}"
-  read -r -p "  Type y to build this, or Enter to stop: " REPLY
-  if [[ "$REPLY" =~ ^[Dd]$ ]]; then
-    terraform -chdir="$dir" show "$planfile"
-    read -r -p "  Type y to build this, or Enter to stop: " REPLY
-  fi
-  if [[ ! "$REPLY" =~ ^[Yy]$ ]]; then
-    info "Nothing was created. Run ${BOLD}unoverse deploy${NC} when you are ready"
-    rm -rf "$tmp"; return 1
+  local docpage
+  [ "$cloud" = "aws" ] && docpage="aws" || docpage="digitalocean"
+  echo -e "  ${DIM}How it fits together: https://github.com/unoverse-platform/docs/blob/main/architecture/$docpage.md${NC}"
+  echo ""
+
+  if [ "$summary_rc" = "3" ]; then
+    local REPLY
+    echo -e "  ${RED}This removes or rebuilds things that already exist.${NC}"
+    read -r -p "  Type y to go ahead, or Enter to stop: " REPLY
+    if [[ ! "$REPLY" =~ ^[Yy]$ ]]; then
+      info "Nothing was changed. Run ${BOLD}unoverse deploy${NC} when you are ready"
+      rm -rf "$tmp"; return 1
+    fi
   fi
 
   echo ""

package/operator/lib/ground.sh

@@ -13,6 +13,44 @@ _ground_my_ip() {
   curl -s --max-time 5 https://api.ipify.org 2>/dev/null || curl -s --max-time 5 https://ifconfig.me 2>/dev/null
 }
 
+# THE UNIVERSE HAS A NAME, so ask for one. This file used to write name = "universe-poc"
+# as a literal, so every universe on every account carried the same placeholder — it names
+# the droplet, the cache, the load balancer and the cloud project, and the developer first
+# meets it in their provider dashboard, after the bill has started. A generated file is not
+# a question: nobody edits it before running deploy.
+#
+# Sets GROUND_NAME (and GROUND_REGION when a default is passed). Both are sanitised to what
+# cloud resource names allow, so a typed "My POC" cannot fail an apply five minutes in.
+_ground_identity() {
+  local valid="$1" suggest
+  suggest=$(basename "$ROOT" | tr '[:upper:]' '[:lower:]' | sed -E 's/[^a-z0-9-]+/-/g; s/^-+//; s/-+$//')
+  suggest="${suggest:-universe}"
+  echo ""
+  read -r -p "  Name this universe [$suggest]: " GROUND_NAME
+  GROUND_NAME=$(echo "${GROUND_NAME:-$suggest}" | tr '[:upper:]' '[:lower:]' | sed -E 's/[^a-z0-9-]+/-/g; s/^-+//; s/-+$//')
+  GROUND_NAME="${GROUND_NAME:-$suggest}"
+
+  # NO DEFAULT REGION. A default is a choice made on the developer's behalf, and the
+  # previous one was mine: `lon1`, written straight into the file, which is how a universe
+  # meant for Singapore was built in London. There is no neutral region to fall back to, so
+  # this asks until it gets a real answer and checks it against the provider's own list —
+  # a typo here surfaces as a five-minute apply that fails on the last resource.
+  # "-" means the region is not this ground's to ask: AWS reads it from the developer's own
+  # CLI configuration, which is already their answer.
+  GROUND_REGION=""
+  [ "$valid" = "-" ] && return 0
+  while [ -z "$GROUND_REGION" ]; do
+    read -r -p "  Which region? " GROUND_REGION
+    GROUND_REGION=$(echo "$GROUND_REGION" | tr -d '[:space:]')
+    # Validate only against a list we actually retrieved. An empty list means the lookup
+    # failed, not that every region is wrong.
+    if [ -n "$GROUND_REGION" ] && [ -n "$valid" ] && ! echo "$valid" | tr ' ' '\n' | grep -qx "$GROUND_REGION"; then
+      warn "$GROUND_REGION is not a region in your account. Pick one from the list above"
+      GROUND_REGION=""
+    fi
+  done
+}
+
 _ground_do() {
   local dir="$ROOT/infra/digitalocean"
   local out="$dir/terraform.tfvars"
@@ -88,13 +126,21 @@ _ground_do() {
     info "no existing Postgres cluster. Terraform will provision one"
   fi
 
+  local regions
+  regions=$(doctl compute region list --format Slug --no-header 2>/dev/null | tr -d '\r' | xargs)
+  if [ -n "$regions" ]; then
+    echo ""
+    echo -e "  ${DIM}Regions available to you: $regions${NC}"
+  fi
+  _ground_identity "$regions"
+
   cat > "$out" <<EOF
 # Generated by \`unoverse ground do\` on $(date +%Y-%m-%d). Discovered values are
 # prefilled; every FILL_ME needs YOUR value before \`terraform apply\`.
 # Token: set DIGITALOCEAN_TOKEN in the environment (preferred) or do_token here.
 
-region       = "lon1"                    # doctl compute region list
-name         = "universe-poc"
+region       = "$GROUND_REGION"                    # doctl compute region list
+name         = "$GROUND_NAME"
 size         = "small"                   # small (POC) | medium | large
 admin_cidr   = "${ip:-FILL_ME}${ip:+/32}"        # YOUR IP — SSH + Dozzle only
 ssh_key_name = "${first_key:-FILL_ME}"   # must already exist in the DO account
@@ -185,12 +231,15 @@ _ground_aws() {
     info "multiple Route53 zones. Pick one in the file (listed there)"
   fi
 
+  # Region already came from the AWS CLI's own configuration, so only the name is asked.
+  _ground_identity "-"
+
   cat > "$out" <<EOF
 # Generated by \`unoverse ground aws\` on $(date +%Y-%m-%d). Discovered values are
 # prefilled; every FILL_ME needs YOUR value before \`terraform apply\`.
 
 region       = "$region"
-name         = "universe-poc"
+name         = "$GROUND_NAME"
 admin_cidr   = "${ip:-FILL_ME}${ip:+/32}"       # YOUR IP — the only SSH source
 ssh_key_name = "${first_key:-FILL_ME}"  # must already exist in the region
 admin_email  = "FILL_ME"                # initial admin (Cognito user, all roles; invite emailed)

package/operator/lib/tfsummary.mjs

@@ -11,6 +11,11 @@
  * their size, counts the plumbing (database users, firewall rules, generated passwords)
  * rather than listing it, and shouts about anything being destroyed.
  *
+ * EXIT CODE IS THE ANSWER TO "should the caller stop and ask?". 0 when the plan only adds
+ * or adjusts — deploy just builds, because typing `unoverse deploy` already said to. 3
+ * when something is destroyed or replaced, which is the only case worth interrupting a
+ * developer for. 2 when the JSON could not be read, so the caller shows raw terraform.
+ *
  * NOT A COST ORACLE. The developer sees an order of magnitude rather than a surprise. Rates
  * move, so the total is labelled approximate and the real bill is the provider's.
  *
@@ -138,7 +143,7 @@ process.stdin.on("end", () => {
   const out = [];
   if (total === 0) {
     console.log(`\n  ${green("●")} Your infrastructure already matches. Nothing to change.\n`);
-    process.exit(0);
+    return;
   }
 
   const width = Math.max(...Object.values(groups).flat().map((d) => d.what.length), 0) + 2;
@@ -169,4 +174,11 @@ process.stdin.on("end", () => {
   }
 
   console.log("\n" + out.join("\n"));
+
+  // Tell the caller whether this is worth stopping for. Losing something is; building
+  // something is not. `process.exitCode` rather than `process.exit`, which can cut off
+  // the output above while it is still draining down a pipe.
+  const destructive =
+    groups.delete.length + groups.replace.length + supporting.delete + supporting.replace;
+  if (destructive) process.exitCode = 3;
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unoverse",
-  "version": "0.1.77",
+  "version": "0.1.78",
   "description": "The Unoverse front door — create a Studio project, a universe, or a client app, and launch Studio.",
   "license": "SEE LICENSE IN README.md",
   "type": "module",