unoverse 0.1.88 → 0.1.90

package/operator/lib/deploy.sh

@@ -260,28 +260,68 @@ _ensure_ground_config() {
     fi
   fi
 
-    # POSTGRES: ASK, DO NOT ASSUME. The ground discovers an existing cluster and writes
-  # it as a COMMENTED line, so the default silently provisions a SECOND database next
-  # to one the account already pays for. A choice with a monthly bill attached is a
-  # question, not a line to notice in a file.
+  # PRODUCTION'S DATABASE IS NOT THE ONE IN .env, AND THE QUESTION MUST SAY SO.
+  #
+  # `.env` holds the DEVELOPMENT database — what `npm run dev` talks to on the laptop. The
+  # deployed universe gets its own, so a developer cannot break production by experimenting
+  # locally. That separation is right and is the default.
+  #
+  # What was wrong was the words. This asked "You already have a database — use it?", where
+  # "it" meant the CLUSTER and "use" meant "create a new database inside it". A developer
+  # who had typed a DATABASE_URL during setup read that as "use the database I gave you",
+  # answered yes, and got an empty one — then could not find their 21 workflows and
+  # reasonably concluded the deploy had lost them. Nothing was lost; the sentence was.
+  #
+  # So: name the cluster, say a NEW database goes in it, and say what happens to the one in
+  # .env. Anyone wanting production to share the development database sets byo_postgres_url
+  # deliberately, which is a different and much louder act.
   if [ "$cloud" = "digitalocean" ] \
-     && grep -q '^#[[:space:]]*existing_pg_cluster_name' "$tfv" 2>/dev/null \
      && ! grep -q '^existing_pg_cluster_name' "$tfv" 2>/dev/null \
      && ! grep -q '^byo_postgres_url' "$tfv" 2>/dev/null; then
-    local found
-    found=$(grep '^#[[:space:]]*existing_pg_cluster_name' "$tfv" | sed -E 's/.*"([^"]+)".*/\1/')
-    if [ -n "$found" ]; then
-      echo ""
-      echo -e "  ${CYAN}${BOLD}You already have a database.${NC} ${DIM}$found${NC}"
-      echo ""
-      pick_option "Use it" "Create a new one   ~\$15/month"
-      if [ "$PICKED" = "0" ]; then
-        node -e 'const fs=require("fs");const[f,c]=process.argv.slice(1);let s=fs.readFileSync(f,"utf8");s=s.replace(/^#\s*(existing_pg_cluster_name\s*=.*)$/m,"$1");fs.writeFileSync(f,s)' "$tfv" "$found"
-        ok "Reusing $found"
-      else
-        ok "A new database will be created"
-      fi
+    local found env_db db_name
+    found=$(grep '^#[[:space:]]*existing_pg_cluster_name' "$tfv" 2>/dev/null | sed -E 's/.*"([^"]+)".*/\1/')
+    env_db=$(grep -E '^DATABASE_URL=' "$ROOT/.env" 2>/dev/null | head -1 | cut -d= -f2-)
+    db_name=$(echo "$env_db" | sed -E 's|.*/([^/?]+)(\?.*)?$|\1|')
+
+    echo ""
+    echo -e "  ${CYAN}${BOLD}Which database should the DEPLOYED universe use?${NC}"
+    echo ""
+    echo -e "  ${DIM}Your .env is your local development database and does not change.${NC}"
+    echo ""
+    local opt_new_db="" opt_share=""
+    [ -n "$found" ] && opt_new_db="Its own new database on ${found}   free"
+    [ -n "$db_name" ] && opt_share="The same one you develop against   ${db_name}"
+
+    # Order is the recommendation. Its own database first: production and development stay
+    # independent, which is what almost everyone wants and what nobody regrets.
+    if [ -n "$opt_new_db" ] && [ -n "$opt_share" ]; then
+      pick_option "$opt_new_db" "$opt_share" "A new cluster of its own   ~\$15/month"
+    elif [ -n "$opt_new_db" ]; then
+      pick_option "$opt_new_db" "A new cluster of its own   ~\$15/month"
+    elif [ -n "$opt_share" ]; then
+      pick_option "$opt_share" "A new cluster of its own   ~\$15/month"
+    else
+      PICKED=99   # nothing to reuse: the ground provisions a cluster, no question worth asking
     fi
+
+    local choice=""
+    case "$PICKED" in
+      0) [ -n "$opt_new_db" ] && choice="own" || choice="share" ;;
+      1) [ -n "$opt_new_db" ] && [ -n "$opt_share" ] && choice="share" || choice="fresh" ;;
+      *) choice="fresh" ;;
+    esac
+
+    case "$choice" in
+      own)
+        node -e 'const fs=require("fs");const[f]=process.argv.slice(1);let s=fs.readFileSync(f,"utf8");s=s.replace(/^#\s*(existing_pg_cluster_name\s*=.*)$/m,"$1");fs.writeFileSync(f,s)' "$tfv"
+        ok "Production gets its own database on $found ${DIM}(your development data is untouched)${NC}"
+        ;;
+      share)
+        node -e 'const fs=require("fs");const[f,v]=process.argv.slice(1);let s=fs.readFileSync(f,"utf8");s=s.replace(/^#?\s*byo_postgres_url\s*=.*$/m,"byo_postgres_url = "+JSON.stringify(v));fs.writeFileSync(f,s)' "$tfv" "$env_db"
+        ok "Production reads ${BOLD}$db_name${NC} ${DIM}(the same database you develop against — local changes are live)${NC}"
+        ;;
+      *) ok "A new cluster will be created for production" ;;
+    esac
   fi
 
   _tf_fill docr_token     DOCR_TOKEN     "Registry access token (from your Unoverse admin)"
@@ -401,12 +441,26 @@ _ground_apply() {
 
   if [ "$summary_rc" = "3" ]; then
     local REPLY
+    # ENTER GOES AHEAD, ESC STOPS. This asked for a typed `y` and made Enter mean "stop",
+    # which is the opposite of every other prompt in this CLI — the developer who has just
+    # read the plan and decided has to break the habit of the whole tool to act on it. One
+    # meaning for Enter throughout, and the escape hatch is the key literally named for it.
     echo -e "  ${RED}This removes or rebuilds things that already exist.${NC}"
-    read -r -p "  Type y to go ahead, or Enter to stop: " REPLY
-    if [[ ! "$REPLY" =~ ^[Yy]$ ]]; then
+    echo ""
+    echo -e "  ${DIM}Enter to go ahead   ·   Esc to stop${NC}"
+    printf "  "
+    local key=""
+    if [ -t 0 ]; then
+      IFS= read -r -s -n 1 key
+    fi
+    # \e is Escape; anything else typed (n, q, a stray letter) also stops, because only a
+    # deliberate empty Enter should destroy something.
+    if [ -n "$key" ]; then
+      echo ""
       info "Nothing was changed. Run ${BOLD}unoverse deploy${NC} when you are ready"
       rm -rf "$tmp"; return 1
     fi
+    echo ""
   fi
 
   echo ""

package/operator/lib/ground.sh

@@ -13,6 +13,31 @@ _ground_my_ip() {
   curl -s --max-time 5 https://api.ipify.org 2>/dev/null || curl -s --max-time 5 https://ifconfig.me 2>/dev/null
 }
 
+# A GROUND WRITES SECRETS TO DISK, so the ignore rule ships with the ground itself.
+#
+# terraform.tfvars holds the database URL, the registry token and every service key; the
+# state file holds those plus everything Terraform generated, in plain text. The platform
+# repo has ignored them since the grounds landed. A universe scaffolded by the CLI did not,
+# because its .gitignore comes from the starter — which only changes when the starter is
+# re-synced and pushed, long after somebody's first `git init && git add .`.
+#
+# Fixing it here means the rule exists the moment the file it protects does, on every
+# universe, without waiting for a starter release. Idempotent: it appends only what is
+# missing, and never rewrites a line the developer put there.
+_ground_protect_secrets() {
+  local gi="$ROOT/.gitignore" rule
+  [ -f "$gi" ] || : > "$gi"
+  local added=0
+  for rule in 'infra/**/.terraform/' 'infra/**/*.tfstate*' 'infra/**/terraform.tfvars' '.unoverse/'; do
+    grep -qxF "$rule" "$gi" 2>/dev/null && continue
+    [ "$added" = "0" ] && printf '\n# Terraform (infra/*) — state and vars carry secrets\n' >> "$gi"
+    printf '%s\n' "$rule" >> "$gi"
+    added=1
+  done
+  [ "$added" = "1" ] && ok "Added the terraform files to .gitignore ${DIM}(they hold your database URL and keys)${NC}"
+  return 0
+}
+
 # THE UNIVERSE HAS A NAME, so ask for one. This file used to write name = "universe-poc"
 # as a literal, so every universe on every account carried the same placeholder — it names
 # the droplet, the cache, the load balancer and the cloud project, and the developer first
@@ -132,6 +157,7 @@ _ground_do() {
     echo ""
     echo -e "  ${DIM}Regions available to you: $regions${NC}"
   fi
+  _ground_protect_secrets
   _ground_identity "$regions"
 
   cat > "$out" <<EOF
@@ -232,6 +258,7 @@ _ground_aws() {
   fi
 
   # Region already came from the AWS CLI's own configuration, so only the name is asked.
+  _ground_protect_secrets
   _ground_identity "-"
 
   cat > "$out" <<EOF

package/operator/lib/tfsummary.mjs

@@ -71,6 +71,17 @@ function describe(r) {
         price: PRICE[a.size],
       };
     }
+    // NEVER "SUPPORTING". These were counted as plumbing, which is fair when they are being
+    // created alongside the cluster they live on — and badly wrong on a REPLACE, where a
+    // dropped and recreated database takes its contents with it. "plus 1 supporting
+    // resource (users, rules, keys)" is not something anyone reads as "your data is about
+    // to be deleted". Naming them costs one line and makes that impossible to miss.
+    case "digitalocean_database_db":
+      return { what: "Database", detail: a.name ? `${a.name} — its contents live here` : "" };
+    case "digitalocean_database_user":
+      return { what: "Database user", detail: a.name ?? "" };
+    case "digitalocean_database_connection_pool":
+      return { what: "Connection pool", detail: a.name ?? "" };
     case "digitalocean_loadbalancer":
       return { what: "Load balancer", detail: "the public way in", price: PRICE.lb };
     case "digitalocean_firewall":
@@ -168,7 +179,11 @@ process.stdin.on("end", () => {
     plan.planned_values?.outputs?.monthly_estimate?.value ??
     plan.outputs?.monthly_estimate?.value;
   const monthly = ground ?? Object.values(groups).flat().reduce((sum, d) => sum + (d.price ?? 0), 0);
+  // THE TOTAL, NOT THE PRICE OF THIS CHANGE. `monthly_estimate` is what the whole universe
+  // costs to run, and printing it under a change list read as the bill for that change:
+  // a one-line firewall update appeared to cost $135. Say which number this is.
   if (monthly) {
+    out.push(`  ${dim("Running total for the whole universe, not the cost of this change:")}`);
     out.push(`  ${bold("Roughly")} ${bold(`$${monthly}/month`)} ${dim("at your provider's current prices, billed by them, not by unoverse")}`);
     out.push("");
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unoverse",
-  "version": "0.1.88",
+  "version": "0.1.90",
   "description": "The Unoverse front door — create a Studio project, a universe, or a client app, and launch Studio.",
   "license": "SEE LICENSE IN README.md",
   "type": "module",