unoverse 0.1.81 → 0.1.83

package/lib/urls.mjs

@@ -9,8 +9,8 @@
  * PROBED, not recited. Every address is actually requested and reported by what
  * answered. A URL you cannot click is a hope, not an address.
  *
- * Deployed facts come from .env.production first, the ground's terraform outputs as
- * enrichment. Local needs no config: a port is either listening or it is not.
+ * Deployed facts come from the ground's terraform outputs, which built the thing they
+ * describe. Local needs no config: a port is either listening or it is not.
  *
  * Named `urls` until 0.1.5; that spelling still works as an alias.
  */
@@ -36,31 +36,29 @@ function section(title, rows, subtitle) {
   }
 }
 
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync } from "node:fs";
 import { join, resolve, dirname } from "node:path";
 import { spawnSync } from "node:child_process";
 
 import { bold, dim, cyan, green, red } from "./ui.mjs";
 
-/** Walk up from cwd to the folder holding .env.production (a universe checkout). */
+/**
+ * Walk up from cwd to the universe root, identified by its docker-compose.yml.
+ *
+ * It used to look for .env.production, which is no longer a file: deploy renders it from
+ * terraform into a temp file and deletes it. Every deployed fact below comes from the
+ * ground's outputs now, which is where it was always true — a rendered env file was only
+ * ever a copy, and a copy that outlived the server it described.
+ */
 function findUniverseRoot() {
   for (let dir = process.cwd(); ; ) {
-    if (existsSync(join(dir, ".env.production"))) return dir;
+    if (existsSync(join(dir, "docker-compose.yml"))) return dir;
     const parent = resolve(dir, "..");
     if (parent === dir) return null;
     dir = parent;
   }
 }
 
-function parseEnv(file) {
-  const env = {};
-  for (const line of readFileSync(file, "utf8").split("\n")) {
-    const m = /^([A-Z0-9_]+)=(.*)$/.exec(line.trim());
-    if (m) env[m[1]] = m[2];
-  }
-  return env;
-}
-
 /** The ground's terraform outputs, when a state is present. Best-effort. */
 function terraformOutputs(root) {
   for (const ground of ["infra/digitalocean", "infra/aws"]) {
@@ -93,17 +91,16 @@ export async function urls() {
   // a fact, not a configuration question, so it needs no universe folder to answer.
   const local = await Promise.all(LOCAL.map(async (c) => ({ ...c, ...(await probe(c.url)) })));
 
-  // DEPLOYED, only if this checkout has been deployed. No .env.production is not an
-  // error: plenty of universes only ever run locally.
+  // DEPLOYED, only if this universe has a ground with state. No outputs is not an error:
+  // plenty of universes only ever run locally. Every address here comes from terraform,
+  // which built the thing it is describing — the ground already resolves DOMAIN into
+  // api_url, so there is nothing left to work out on this side.
   let deployed = [];
   let domain = "";
   if (root) {
-    const env = parseEnv(join(root, ".env.production"));
     const tf = terraformOutputs(root);
-    domain = env.DOMAIN || "";
-    // The same law as the ground: DOMAIN drives HTTPS URLs; without it, the
-    // explicit API_URL (rendered by terraform) carries the LB address.
-    const apiBase = domain ? `https://api.${domain}` : env.API_URL || tf.api_url || "";
+    const apiBase = tf.api_url || "";
+    domain = /^https:\/\/api\.(.+)$/.exec(apiBase)?.[1] || "";
     const candidates = [];
     if (apiBase) {
       candidates.push({ label: "API", url: apiBase, note: "MCP at /mcp" });
@@ -111,7 +108,7 @@ export async function urls() {
     }
     const canvas = tf.canvas_url && tf.canvas_url.startsWith("http") ? tf.canvas_url : null;
     if (canvas) candidates.push({ label: "Canvas", url: canvas, note: "add to IdP origins" });
-    if (env.DEPLOY_HOST) candidates.push({ label: "Logs", url: `http://${env.DEPLOY_HOST}:8080`, note: "admin IP only" });
+    if (tf.deploy_host) candidates.push({ label: "Logs", url: `http://${tf.deploy_host}:8080`, note: "admin IP only" });
     if (tf.cognito_hosted_ui) candidates.push({ label: "Login", url: tf.cognito_hosted_ui });
     deployed = await Promise.all(candidates.map(async (c) => ({ ...c, ...(await probe(c.url)) })));
   }

package/operator/ansible/playbooks/db-setup.yml

@@ -17,15 +17,21 @@
   become: yes
 
   tasks:
+    # REGISTER NAMES MUST NOT COLLIDE WITH -e VARIABLES. This registered into `env_file`,
+    # which is also the name deploy passes on the command line as the path to the rendered
+    # settings. Extra vars outrank registered ones in Ansible's precedence, so the register
+    # never took: the variable stayed a string and the very next line asked a string for
+    # `.stat`, failing with "object of type 'str' has no attribute 'stat'" — an error that
+    # says nothing about the actual cause.
     - name: "[1/5] Verify .env exists"
       stat:
         path: /opt/gravity/.env
-      register: env_file
+      register: remote_env
 
     - name: "[1/5] Fail if .env missing"
       fail:
         msg: ".env file not found at /opt/gravity/.env - run install.yml first"
-      when: not env_file.stat.exists
+      when: not remote_env.stat.exists
 
     - name: "[2/5] Check DATABASE_URL is configured"
       shell: grep -q "^DATABASE_URL=" /opt/gravity/.env

package/operator/ansible/playbooks/install.yml

@@ -126,15 +126,12 @@
         owner: "{{ ansible_user }}"
         mode: "0644"
 
-    # Studio (the dev workbench) is ON in the local compose. Production NEVER runs it:
-    # force UNOVERSE_WORKBENCH=0 in the deployed compose. This is the structural off-switch
-    # — it always runs on deploy, so Studio can't reach production regardless of the source.
-    - name: "[7b/12] Force Studio (workbench) OFF for production"
-      ansible.builtin.replace:
-        path: "{{ gravity_dir }}/docker-compose.yml"
-        regexp: '^\s*-\s*UNOVERSE_WORKBENCH=1\s*$'
-        replace: '      - UNOVERSE_WORKBENCH=0'
-
+    # NO WORKBENCH STEP HERE. This used to force UNOVERSE_WORKBENCH=0 in the deployed
+    # compose, back when Studio shipped inside the platform image and had to be switched
+    # off for production. Studio is a separate CLI-launched app now and the variable is
+    # gone from docker-compose.yml entirely, so the task matched nothing and reported "ok"
+    # anyway — a step that proves a safeguard is working while doing nothing at all is
+    # worse than no step.
     - name: "[8/12] Copy .env file"
       copy:
         # Same trap as the compose above: a path relative to the playbook is the monorepo's

package/operator/lib/deploy.sh

@@ -302,7 +302,19 @@ _ground_apply() {
 
 cmd_deploy() {
 
-  local env_prod="$ROOT/.env.production"
+  # .env.production IS NOT A FILE IN THE UNIVERSE. It is `terraform output -raw
+  # env_production`: derived, complete, and regenerated in full on every deploy. Writing it
+  # to the universe root put a second env file next to `.env`, which reads like something
+  # to edit and is not — the next deploy overwrites it — and it outlived the server it
+  # described, so a torn-down universe still looked deployed. Render it to a private temp
+  # file, ship it, delete it. The ground stays the only source of truth.
+  local env_prod
+  env_prod=$(mktemp -t unoverse-env-prod) || exit 1
+  chmod 600 "$env_prod"
+  trap 'rm -f "$env_prod" 2>/dev/null' EXIT
+  # Older universes have one on disk. It is stale by definition now, and leaving it means
+  # the confusing second env file simply never goes away.
+  rm -f "$ROOT/.env.production"
 
   _ground_credentials
 
@@ -343,26 +355,22 @@ cmd_deploy() {
 
   _ground_apply "$cloud"; rc=$?
   [ "$rc" = "1" ] && exit 1
-  if [ "$rc" = "0" ] || [ ! -f "$env_prod" ]; then
-    terraform -chdir="$ROOT/infra/$cloud" output -raw env_production > "$env_prod" 2>/dev/null \
-      && ok "Rendered .env.production from your $cloud ground"
-  fi
-
-  if [ ! -f "$env_prod" ]; then
-    fail ".env.production could not be rendered — has the ground been applied?"
+  terraform -chdir="$ROOT/infra/$cloud" output -raw env_production > "$env_prod" 2>/dev/null
+  if [ ! -s "$env_prod" ]; then
+    fail "Could not read this universe's settings from your $cloud ground. Has it been applied?"
     exit 1
   fi
 
   _adopted_db_access "$cloud" grant
 
 
-  # Read deploy target from .env.production
+  # Read the deploy target from the rendered settings
   local deploy_host deploy_user
   deploy_host=$(grep '^DEPLOY_HOST=' "$env_prod" | cut -d= -f2- | tr -d '\r\n' | xargs)
   deploy_user=$(grep '^DEPLOY_USER=' "$env_prod" | cut -d= -f2- | tr -d '\r\n' | xargs)
 
   if [ -z "$deploy_host" ] || [ "$deploy_host" = "your-vm-ip" ]; then
-    fail "DEPLOY_HOST is not set in .env.production"
+    fail "This ground has no server address yet. Has it been applied?"
     exit 1
   fi
   deploy_user="${deploy_user:-root}"
@@ -379,7 +387,7 @@ cmd_deploy() {
   fi
   ok "Ansible available"
 
-  # Generate a temporary inventory from .env.production
+  # Generate a temporary inventory from the rendered settings
   local tmp_inventory
   tmp_inventory=$(mktemp).yml
   cat > "$tmp_inventory" << 'EOF'
@@ -421,11 +429,17 @@ EOF
   # install.yml creates. The remedy was to know that `unoverse deploy init` exists, which
   # is exactly the kind of knowledge this CLI is supposed to remove: deploy owns the whole
   # journey, so it asks the server what it is and picks the right playbook itself.
+  # THE MARKER IS "SETUP FINISHED", NOT "A DIRECTORY EXISTS". Testing for /opt/gravity
+  # looked right and was not: install.yml creates that directory as its seventh task, so a
+  # first-time setup that then FAILED at the database step still left it behind. The next
+  # deploy saw it, decided the server was ready, shipped images onto a database that had
+  # never been migrated, and reported success. The stamp is written only after install,
+  # database and verify have all passed, so an interrupted setup resumes as a setup.
   if [ -z "$subcommand" ]; then
     if ! ssh -o BatchMode=yes -o StrictHostKeyChecking=accept-new -o ConnectTimeout=15 \
-         "$deploy_user@$deploy_host" 'test -d /opt/gravity' >/dev/null 2>&1; then
+         "$deploy_user@$deploy_host" 'test -f /opt/gravity/.setup-complete' >/dev/null 2>&1; then
       echo ""
-      info "New server. Running the full first-time setup ${DIM}(install, database, verify)${NC}"
+      info "This server's setup has not finished. Running it ${DIM}(install, database, verify)${NC}"
       subcommand="init"
     fi
   fi
@@ -470,6 +484,9 @@ EOF
         "$ansible_dir/playbooks/test-connectivity.yml" \
         -e "universe_root=$ROOT" \
         -e "env_file=$env_prod" || { rm -f "$tmp_inventory"; fail "verification failed — inspect and re-run: unoverse deploy test"; exit 1; }
+      # Only now. Every step passed, so the next deploy can safely be an image push.
+      ssh -o BatchMode=yes -o StrictHostKeyChecking=accept-new -o ConnectTimeout=15 \
+        "$deploy_user@$deploy_host" 'touch /opt/gravity/.setup-complete' >/dev/null 2>&1
       echo ""
       ok "Your universe is up. From now on, deploys are just: unoverse deploy"
       info "Keeping it? Harden the VM when you're ready: unoverse deploy harden"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unoverse",
-  "version": "0.1.81",
+  "version": "0.1.83",
   "description": "The Unoverse front door — create a Studio project, a universe, or a client app, and launch Studio.",
   "license": "SEE LICENSE IN README.md",
   "type": "module",