PyPI - arcsecond - Versions diffs - 3.19.0__tar.gz → 3.20.0__tar.gz - Mend

@@ -1,6 +1,6 @@
 # === Arcsecond.local config. ===
 # *** DO NOT change any name or port number. ***
-# Version 6.3
+# Version 6.4
 services:
   # Database (PostgresQL)
@@ -8,12 +8,11 @@ services:
     image: postgres:16
     container_name: arcsecond-db
     restart: unless-stopped
-    # Bind to localhost only — the backend container reaches the DB over the
-    # internal Docker network (hostname `arcsecond-db`), and operators can
-    # still run `psql -h localhost` / `pg_dump` from the host. Anything on the
-    # LAN is firewalled out.
-    ports:
-      - "127.0.0.1:5432:5432"
+    # No host port. The backend reaches the DB over the internal Docker
+    # network (hostname `arcsecond-db`), and every CLI command that needs
+    # the DB (backups, restore, password rotation) goes through `docker exec`
+    # into this container. Publishing 5432 on the host bought nothing and
+    # failed the whole stack whenever another Postgres already held it.
     volumes:
       - arcsecond_postgres_data:/var/lib/postgresql/data
     env_file:
@@ -25,10 +24,8 @@ services:
     image: redis:7.4
     container_name: arcsecond-broker
     restart: unless-stopped
-    # Localhost-only as well — Redis with no auth on a LAN-exposed port is a
-    # well-known foot-gun. Backend reaches it over the Docker network.
-    ports:
-      - "127.0.0.1:6379:6379"
+    # No host port either: Redis with no auth must never be reachable from
+    # outside the stack, and the backend reaches it over the Docker network.
   # Arcsecond backend (REST APIs). Can be used for API calls and external pipelines, scripts etc.
   backend:

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: arcsecond
-Version: 3.19.0
+Version: 3.20.0
 Summary: CLI for arcsecond.io
 Project-URL: Homepage, https://github.com/arcsecond-io/cli
 Project-URL: Issues, https://github.com/arcsecond-io/cli/issues

@@ -16,9 +16,10 @@ from .utils import (
 ENV_FILENAME = ".env"
-# Stable across installs — operators connect with this username when running
-# manual psql / pg_dump commands. The actual security boundary is the password
-# (generated per-install) and the network exposure (localhost-only).
+# Stable across installs — it is the username every `docker exec ... psql`
+# in this package and in the docs uses. The actual security boundary is the
+# password (generated per-install) and the fact that the database container
+# publishes no host port at all.
 POSTGRES_USER = "arcsecond_docker"
 POSTGRES_DB = "arcsecond_docker"

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 [project]
 name = "arcsecond"
-version = "3.19.0"
+version = "3.20.0"
 authors = [
     { name = "Cedric Foellmi", email = "cedric@arcsecond.io" },
 ]

@@ -6,6 +6,7 @@ buckets is asserted on its own, because the old command printed detection and
 registration one after the other with no way to tell which was which.
 """
+from contextlib import nullcontext
 from unittest.mock import patch
 import pytest
@@ -139,8 +140,6 @@ def _unresolvable(monkeypatch, answering=()):
     """Make the machine's resolver fail, except for addresses in ``answering``."""
     import socket as socket_module
-    from contextlib import nullcontext
     def connect(endpoint, timeout=None):
         host, _ = endpoint
         if host in answering:

@@ -155,7 +155,7 @@ wheels = [
 [[package]]
 name = "arcsecond"
-version = "3.19.0"
+version = "3.20.0"
 source = { editable = "." }
 dependencies = [
     { name = "alpyca" },

arcsecond 3.19.0__tar.gz → 3.20.0__tar.gz

arcsecond 3.19.0tar.gz → 3.20.0tar.gz