unoverse 0.1.99 → 0.1.101

package/operator/infra/aws/main.tf

@@ -242,10 +242,22 @@ data "aws_ami" "ubuntu" {
   }
 }
 
+# The key pair, from the operator's own public key. AWS accepts an imported key, so nothing
+# has to pre-exist in the account and no private key is ever downloaded or stored.
+resource "aws_key_pair" "operator" {
+  count      = var.operator_public_key != "" ? 1 : 0
+  key_name   = "${var.name}-operator"
+  public_key = var.operator_public_key
+}
+
+locals {
+  key_name = var.operator_public_key != "" ? aws_key_pair.operator[0].key_name : var.ssh_key_name
+}
+
 resource "aws_instance" "app" {
   ami                    = data.aws_ami.ubuntu.id
   instance_type          = local.s.instance
-  key_name               = var.ssh_key_name
+  key_name               = local.key_name
   vpc_security_group_ids = [aws_security_group.app.id]
 
   root_block_device {

package/operator/infra/aws/variables.tf

@@ -102,3 +102,13 @@ variable "marketplace_url" {
   type        = string
   default     = ""
 }
+
+# YOUR public key, uploaded as this universe's EC2 key pair. Deploying means ssh-ing from
+# the machine that runs `unoverse deploy`, so the key that must work is the one that machine
+# holds — not whichever pair happens to exist in the account. Empty falls back to
+# ssh_key_name, for an operator with no local key.
+variable "operator_public_key" {
+  description = "An ssh public key (the contents of ~/.ssh/id_ed25519.pub). Empty = use ssh_key_name instead."
+  type        = string
+  default     = ""
+}

package/operator/lib/check.sh

@@ -1,4 +1,56 @@
 #!/usr/bin/env bash
+
+# Resources this universe is BILLED FOR that terraform does not know it owns.
+#   _cloud_orphans <ground> <universe-name>
+# Echoes nothing when everything is tracked, "unknown" when the provider could not be
+# reached (never a failure — an offline laptop is not an orphaned resource), or one line
+# per untracked resource.
+#
+# It works because every resource is labelled with the universe it belongs to: AWS through
+# default_tags (Universe=<name>), DigitalOcean through project membership. Without that
+# label there is no question to ask, which is why the Canvas load balancer landing in the
+# wrong DO project was worth fixing rather than tidying.
+_cloud_orphans() {
+  local g="$1" uname_="$2" dir="$ROOT/infra/$1"
+  [ -n "$uname_" ] || { echo unknown; return 0; }
+
+  local state
+  state=$(terraform -chdir="$dir" show -json 2>/dev/null) || { echo unknown; return 0; }
+  [ -n "$state" ] || { echo unknown; return 0; }
+
+  local live
+  if [ "$g" = "aws" ]; then
+    command -v aws >/dev/null 2>&1 || { echo unknown; return 0; }
+    live=$(aws resourcegroupstaggingapi get-resources \
+             --tag-filters "Key=Universe,Values=$uname_" \
+             --query 'ResourceTagMappingList[].ResourceARN' --output text 2>/dev/null | tr '\t' '\n')
+  else
+    [ -n "${DIGITALOCEAN_TOKEN:-}" ] || { echo unknown; return 0; }
+    local pid
+    pid=$(doctl projects list --format ID,Name --no-header 2>/dev/null | awk -v n="$uname_" '$2==n{print $1}')
+    [ -n "$pid" ] || { echo unknown; return 0; }
+    live=$(doctl projects resources list "$pid" --format URN --no-header 2>/dev/null)
+  fi
+  [ -n "$live" ] || { echo ""; return 0; }
+
+  printf '%s' "$state" | node -e '
+    let s=""; process.stdin.on("data",d=>s+=d).on("end",()=>{
+      const live=(process.argv[1]||"").split("\n").map(x=>x.trim()).filter(Boolean);
+      let ids=new Set();
+      try {
+        const st=JSON.parse(s);
+        const walk=(m)=>{ (m.resources||[]).forEach(r=>{ if(!r.values) return;
+          ["id","arn","urn"].forEach(k=>r.values[k]&&ids.add(String(r.values[k]))); });
+          (m.child_modules||[]).forEach(walk); };
+        if (st.values && st.values.root_module) walk(st.values.root_module);
+      } catch { process.exit(0); }          // unreadable state is not an orphan claim
+      const known=[...ids];
+      const orphans=live.filter(a=>!ids.has(a) && !known.some(i=>i && a.includes(i)));
+      orphans.forEach(o=>console.log(o));
+    });
+  ' "$live"
+}
+
 # unoverse check
 
 cmd_check() {
@@ -86,6 +138,36 @@ cmd_check() {
     fail "Canvas ${DIM}http://localhost:3001 → $canvas_code${NC}"
   fi
 
+  # 6. NOTHING BILLING THAT TERRAFORM HAS LOST SIGHT OF.
+  #
+  # Terraform records what it creates as it creates it, so an interrupted apply does not
+  # duplicate anything — the next run continues from state. Two cases break that, and both
+  # cost money silently: a crash between the API call and the state write, and a lost or
+  # deleted state file, which orphans everything at once and makes it invisible to destroy.
+  #
+  # This is answerable because every resource is labelled with the universe it belongs to:
+  # AWS through default_tags, DigitalOcean through project membership. Ask the provider
+  # what it thinks is ours, ask terraform what it knows it made, and compare. A number on
+  # the health check is the difference between trusting that and verifying it.
+  local _g
+  for _g in aws digitalocean; do
+    [ -f "$ROOT/infra/$_g/terraform.tfvars" ] || continue
+    [ -d "$ROOT/infra/$_g/.terraform" ] || continue
+    total=$((total + 1))
+    local uname_ orphans
+    uname_=$(grep -E '^name[[:space:]]*=' "$ROOT/infra/$_g/terraform.tfvars" 2>/dev/null | sed -E 's/.*"([^"]+)".*/\1/')
+    orphans=$(_cloud_orphans "$_g" "$uname_")
+    case "$orphans" in
+      "") ok "Cloud resources ${DIM}($_g — every resource is tracked)${NC}"; pass=$((pass + 1)) ;;
+      unknown) ok "Cloud resources ${DIM}($_g — could not reach the provider, skipped)${NC}"; pass=$((pass + 1)) ;;
+      *)
+        fail "Cloud resources ${DIM}($_g — billing but NOT tracked by terraform)${NC}"
+        echo "$orphans" | while read -r o; do [ -n "$o" ] && echo -e "      ${DIM}$o${NC}"; done
+        info "  These will not be removed by ${BOLD}unoverse destroy $_g${NC}. Delete them in the console"
+        ;;
+    esac
+  done
+
   # Summary
   echo ""
   if [ "$pass" -eq "$total" ]; then

package/operator/lib/deploy.sh

@@ -540,9 +540,8 @@ _ground_apply() {
 }
 
 cmd_deploy() {
-  # A LEADING GROUND NAME IS NOT A SUBCOMMAND. `unoverse deploy aws` names the cloud;
-  # `unoverse deploy init` names the step; `unoverse deploy aws init` does both. Take the
-  # ground off the front when it is there, and leave everything else exactly as it was.
+  # A LEADING GROUND NAME IS NOT A SUBCOMMAND. `unoverse deploy aws` names the cloud. Take
+  # it off the front when it is there, and leave everything else exactly as it was.
   local GROUND_ARG=""
   case "${1:-}" in
     do|digitalocean|aws|amazon) GROUND_ARG="$1"; shift ;;
@@ -700,9 +699,8 @@ EOF
   # A FIRST DEPLOY TO A NEW SERVER IS A PROVISION, NOT AN IMAGE PULL. Bare `deploy` meant
   # only "pull the latest images and restart", which on a freshly built droplet fails on
   # "Destination directory /opt/gravity does not exist" — /opt/gravity being the directory
-  # install.yml creates. The remedy was to know that `unoverse deploy init` exists, which
-  # is exactly the kind of knowledge this CLI is supposed to remove: deploy owns the whole
-  # journey, so it asks the server what it is and picks the right playbook itself.
+  # install.yml creates. Deploy owns the whole journey, so it asks the server what it is and
+  # picks the right playbook itself rather than expecting anyone to know a second command.
   # THE MARKER IS "SETUP FINISHED", NOT "A DIRECTORY EXISTS". Testing for /opt/gravity
   # looked right and was not: install.yml creates that directory as its seventh task, so a
   # first-time setup that then FAILED at the database step still left it behind. The next
@@ -714,7 +712,7 @@ EOF
          "$deploy_user@$deploy_host" 'test -f /opt/gravity/.setup-complete' >/dev/null 2>&1; then
       echo ""
       info "This server's setup has not finished. Running it ${DIM}(install, database, verify)${NC}"
-      subcommand="init"
+      subcommand="first-time"
     fi
   fi
 
@@ -732,10 +730,10 @@ EOF
         -e "universe_root=$ROOT" \
         -e "env_file=$env_prod"
       ;;
-    init|full)
-      # FIRST-TIME setup, END TO END: install → db → verify. One command after
-      # `terraform apply`. Hardening is a deliberate follow-up choice, never a
-      # default (POCs get verified first; harden when you decide to keep it).
+    first-time)
+      # INTERNAL, never typed. Deploy reaches this by finding no .setup-complete stamp on
+      # the server: install → database → verify, end to end. Hardening stays a deliberate
+      # follow-up (POCs get verified first; harden when you decide to keep the box).
       info "First-time setup: install → database → verify"
       echo ""
       info "[1/3] Provisioning (Docker, services, mounts)..."
@@ -743,7 +741,7 @@ EOF
         -i "$tmp_inventory" \
         "$ansible_dir/playbooks/install.yml" \
         -e "universe_root=$ROOT" \
-        -e "env_file=$env_prod" || { rm -f "$tmp_inventory"; fail "install failed — fix and re-run: unoverse deploy init"; exit 1; }
+        -e "env_file=$env_prod" || { rm -f "$tmp_inventory"; fail "install failed. Fix the error above, then: unoverse deploy $cloud"; exit 1; }
       echo ""
       info "[2/3] Database setup..."
       ansible-playbook \
@@ -751,14 +749,14 @@ EOF
         "$ansible_dir/playbooks/db-setup.yml" \
         -e "universe_root=$ROOT" \
         -e "pg_admin_url=$pg_admin_url" \
-        -e "env_file=$env_prod" || { rm -f "$tmp_inventory"; fail "db setup failed — fix and re-run: unoverse deploy db"; exit 1; }
+        -e "env_file=$env_prod" || { rm -f "$tmp_inventory"; fail "database setup failed. Fix the error above, then: unoverse deploy $cloud"; exit 1; }
       echo ""
       info "[3/3] Verifying..."
       ansible-playbook \
         -i "$tmp_inventory" \
         "$ansible_dir/playbooks/test-connectivity.yml" \
         -e "universe_root=$ROOT" \
-        -e "env_file=$env_prod" || { rm -f "$tmp_inventory"; fail "verification failed — inspect and re-run: unoverse deploy test"; exit 1; }
+        -e "env_file=$env_prod" || { rm -f "$tmp_inventory"; fail "verification failed. Look at the output above, then: unoverse deploy $cloud"; exit 1; }
       # Only now. Every step passed, so the next deploy can safely be an image push.
       ssh -o BatchMode=yes -o StrictHostKeyChecking=accept-new -o ConnectTimeout=15 \
         "$deploy_user@$deploy_host" 'touch /opt/gravity/.setup-complete' >/dev/null 2>&1

package/operator/lib/ground.sh

@@ -239,9 +239,28 @@ _ground_aws() {
   region=$(aws configure get region 2>/dev/null)
   [ -n "$region" ] && ok "region: $region" || { region="us-east-1"; info "no default region configured. Using us-east-1"; }
 
+  # A KEY PAIR YOU CANNOT USE IS NOT A KEY PAIR. This took the FIRST key pair in the region,
+  # which on a real account is whatever was created years ago in the console — its private
+  # half is not on this laptop, so terraform applied happily and Ansible then died on
+  # "Permission denied (publickey)" after eleven minutes of RDS provisioning.
+  #
+  # The operator's own key is the one that works, because deploying IS ssh-ing from here.
+  # Upload it under the universe's name and use that: AWS lets terraform import a public
+  # key, so nothing has to pre-exist and nothing has to be downloaded. Fall back to the
+  # account's existing pairs only when this machine has no key at all.
+  local pubkey=""
+  for pubkey in "$HOME/.ssh/id_ed25519.pub" "$HOME/.ssh/id_rsa.pub" ""; do
+    [ -n "$pubkey" ] && [ -f "$pubkey" ] && break
+  done
+
   keys=$(aws ec2 describe-key-pairs --query 'KeyPairs[].KeyName' --output text 2>/dev/null | tr '\t' '\n')
   first_key=$(echo "$keys" | head -1)
-  if [ -n "$first_key" ]; then
+  if [ -n "$pubkey" ]; then
+    first_key=""                       # terraform creates the pair from operator_public_key
+    ok "SSH key: your own ${DIM}($(basename "$pubkey") — uploaded as ${GROUND_NAME:-this universe}-operator)${NC}"
+  elif [ -n "$first_key" ]; then
+    warn "no SSH key on this machine — using the account's ${BOLD}$first_key${NC}"
+    warn "the deploy will fail unless you hold its private half"
     ok "EC2 key pair: $first_key"
   else
     warn "no EC2 key pairs in $region. Create one first (aws ec2 create-key-pair)"
@@ -268,7 +287,8 @@ _ground_aws() {
 region       = "$region"
 name         = "$GROUND_NAME"
 admin_cidr   = "${ip:-FILL_ME}${ip:+/32}"       # YOUR IP — the only SSH source
-ssh_key_name = "${first_key:-FILL_ME}"  # must already exist in the region
+ssh_key_name = "${first_key}"  # empty = terraform uploads operator_public_key below
+operator_public_key = "$( [ -n "$pubkey" ] && cat "$pubkey" )"   # your key: the deploy ssh-es from this machine
 admin_email  = "FILL_ME"                # initial admin (Cognito user, all roles; invite emailed)
 size         = "small"                  # small (POC) | medium | large
 # Domain is OPTIONAL — empty brings the universe up on the ALB's DNS name over

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unoverse",
-  "version": "0.1.99",
+  "version": "0.1.101",
   "description": "The Unoverse front door — create a Studio project, a universe, or a client app, and launch Studio.",
   "license": "SEE LICENSE IN README.md",
   "type": "module",