arcsecond 4.3.3__tar.gz → 4.4.1__tar.gz

{arcsecond-4.3.3 → arcsecond-4.4.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: arcsecond
-Version: 4.3.3
+Version: 4.4.1
 Summary: CLI for arcsecond.io
 Project-URL: Homepage, https://github.com/arcsecond-io/cli
 Project-URL: Issues, https://github.com/arcsecond-io/cli/issues

{arcsecond-4.3.3 → arcsecond-4.4.1}/arcsecond/cli.py

@@ -12,8 +12,8 @@ from arcsecond.cloud import (
 from arcsecond.docgen import docs
 from arcsecond.hosting import (
     backups,
-    check_cmd,
     db,
+    doctor_cmd,
     logs,
     restart,
     setup,
@@ -75,7 +75,9 @@ main.add_command(logs)
 main.add_command(update)
 
 # Is it reachable from the rest of the observatory, and if not, why not.
-main.add_command(check_cmd)
+main.add_command(doctor_cmd)
+# Its name until 4.4, kept so that scripts and habits go on working.
+main.add_command(doctor_cmd, name="check")
 
 # The access token Arcsecond gave the observatory, once per machine.
 main.add_command(token_group)

{arcsecond-4.3.3 → arcsecond-4.4.1}/arcsecond/docgen.py

@@ -78,7 +78,9 @@ def _visible_commands(
     commands = []
     for name in group.list_commands(ctx):
         command = group.get_command(ctx, name)
-        if command is not None and not command.hidden:
+        # A command mounted a second time under another name is an alias
+        # (`check` for `doctor`): it works, and has no page of its own.
+        if command is not None and not command.hidden and command.name == name:
             commands.append((name, command))
     return commands
 
@@ -339,3 +341,60 @@ def docs_compose(out, check):
         )
     written = write(files, Path(out))
     click.echo(f"Wrote {len(written)} files to {out}")
+
+
+@docs.command(
+    name="network",
+    help="Write the one-page network sheet, and the firewall request, from the network manifest.",
+)
+@click.option(
+    "--out",
+    "out",
+    type=click.Path(file_okay=False),
+    default=None,
+    help="Folder for the documentation page (index.md).",
+)
+@click.option(
+    "--static",
+    "static",
+    type=click.Path(file_okay=False),
+    default=None,
+    help="Folder for the printable page and the plain-text firewall request, served as they are.",
+)
+@click.option(
+    "--check",
+    "check",
+    is_flag=True,
+    help="Compare against the folders instead of writing; exit 1 if either is out of date.",
+)
+def docs_network(out, static, check):
+    from arcsecond.hosting import network
+    from arcsecond.hosting.network import sheet
+
+    if not out or not static:
+        raise click.UsageError(
+            "Give both --out FOLDER (the page) and --static FOLDER (the files to print and paste)."
+        )
+    manifest = network.load()
+    targets = (
+        (sheet.generate_page(manifest), Path(out)),
+        (sheet.generate_static(manifest), Path(static)),
+    )
+    if check:
+        changed = [
+            f"{folder}/{name}"
+            for files, folder in targets
+            for name in differences(files, folder)
+        ]
+        if changed:
+            click.echo("The network sheet is out of date:")
+            for name in changed:
+                click.echo(f"  {name}")
+            click.echo(
+                f"\nRegenerate it:  arcsecond docs network --out {out} --static {static}"
+            )
+            raise SystemExit(1)
+        click.echo("The network sheet is up to date.")
+        return
+    written = sum(len(write(files, folder)) for files, folder in targets)
+    click.echo(f"Wrote {written} files to {out} and {static}")

{arcsecond-4.3.3 → arcsecond-4.4.1}/arcsecond/hosting/__init__.py

@@ -1,9 +1,9 @@
 from .backups import backups
+from .database import db
 
-# check_cmd, not check: `check` is also this package's module of that name,
+# doctor_cmd, not doctor: `doctor` is also this package's module of that name,
 # and re-exporting the command under it would shadow the module for tests.
-from .check import check_cmd
-from .database import db
+from .doctor import doctor_cmd
 from .lifecycle import logs, restart, start, status, stop, update
 from .local import setup
 from .token import token_group
@@ -11,7 +11,7 @@ from .token import token_group
 # Re-exported: the command groups `arcsecond.cli` mounts.
 __all__ = [
     "backups",
-    "check_cmd",
+    "doctor_cmd",
     "db",
     "setup",
     "token_group",

{arcsecond-4.3.3 → arcsecond-4.4.1}/arcsecond/hosting/composedoc.py

@@ -241,6 +241,12 @@ ENV_KEYS: Dict[str, tuple] = {
         "Comma-separated origins, scheme included, to trust besides private-network addresses — a public domain, "
         "a Tailscale name. Not needed for a LAN address.",
     ),
+    "SKY_BRIGHTNESS_GEOTIFF_PATH": (
+        SETUP,
+        "Where the backend finds the sky-brightness map kept on this machine (a path under `/data`). "
+        "Empty: the map is looked up on statics.arcsecond.io instead. Change the answer with "
+        "`arcsecond setup --with-sky-map` or `--without-sky-map`.",
+    ),
     "LIVE_IMAGE_PROXY_URL": (
         BACKEND,
         "Where the backend reaches the live-image proxy for cameras. Default http://host.docker.internal:8765; "

{arcsecond-4.3.3 → arcsecond-4.4.1}/arcsecond/hosting/docker/docker-compose.yml

@@ -1,6 +1,6 @@
 # === Arcsecond.local config. ===
 # *** DO NOT change any name or port number. ***
-# Version 7.3
+# Version 7.4
 
 services:
   # Database (PostgresQL)
@@ -33,8 +33,12 @@ services:
     container_name: arcsecond-api
     restart: unless-stopped
     entrypoint: /home/app/entrypoint-server.sh
+    # This machine only. Browsers and other computers go through the webapp's
+    # port, which serves the very same API under /api/; 8800 is for the
+    # `arcsecond` command and scripts run on this computer. Published on every
+    # interface, it was a second, unneeded door onto the network.
     ports:
-      - "8800:8800"
+      - "127.0.0.1:8800:8800"
     depends_on:
       - db
       - broker
@@ -138,7 +142,8 @@ services:
     image: ghcr.io/arcsecond-io/arcsecond-service-platesolver-astrometry:latest
     container_name: arcsecond-platesolver
     restart: unless-stopped
-    ports: [ "8900:8900" ]
+    # No host port. Only the backend calls the solver, over the internal Docker
+    # network; it has no authentication and nothing outside the stack needs it.
 
   # Arcsecond webapp. Served on 5555 only: a self-hosted install is
   # organisation-based and therefore always a portal, so the second port that
@@ -172,8 +177,9 @@ services:
 
   # >>> arcsecond:alerts
   # Arcsecond transient-alerts consumer (optional).
-  # Long-lived Kafka client for NASA GCN. Outbound TLS to kafka.gcn.nasa.gov
-  # and auth.gcn.nasa.gov only — nothing listens. Requires GCN_CONSUMER_CLIENT_ID /
+  # Long-lived Kafka client for NASA GCN. Outbound TLS only — nothing listens:
+  # auth.gcn.nasa.gov on 443, then kafka, kafka1, kafka2 and
+  # kafka3.gcn.nasa.gov on 9092. Requires GCN_CONSUMER_CLIENT_ID /
   # GCN_CONSUMER_CLIENT_SECRET in .env; idles harmlessly when they are absent.
   # Single instance only — do not scale it.
   alerts:

arcsecond-4.3.3/arcsecond/hosting/check.py → arcsecond-4.4.1/arcsecond/hosting/doctor.py

@@ -1,4 +1,4 @@
-"""`arcsecond check`: is this installation reachable, and if not, why not.
+"""`arcsecond doctor`: is this installation reachable, and if not, why not.
 
 The failure this exists for is invisible from where the operator sits: the
 page does not load from the laptop, and nothing anywhere says why. The
@@ -16,18 +16,32 @@ the rules, not from probing, and says so.
 prints it otherwise. It never changes the network profile: that changes what
 every other program on the machine is exposed to, and is the operator's call.
 `--json` is for pasting into a support conversation.
+
+It also looks outward. Every destination the network manifest declares
+(`network/manifest.toml`) is probed from this machine — name, connection,
+encrypted handshake, certificate, and the clock against one reference — and
+each failure comes with the sentence to send to whoever runs the firewall.
+The probes carry nothing about the observatory. `--report` writes the whole
+result to a dated file for an administrator's ticket, with the local
+network's addresses left out unless `--show-local` asks for them.
+
+Exit code: 0 when everything required works, 1 when only an optional
+destination is out of reach, 2 when something required fails.
 """
 
 import ctypes
 import json
 import os
 import re
+import shutil
 import socket
 import subprocess
 import sys
 import urllib.error
 import urllib.request
 from dataclasses import asdict, dataclass, field
+from datetime import datetime
+from pathlib import Path
 from typing import List, Optional
 
 import click
@@ -240,6 +254,21 @@ class Host:
         except (urllib.error.URLError, OSError, ValueError):
             return None
 
+    def free_bytes(self, path: str) -> Optional[int]:
+        try:
+            return shutil.disk_usage(path).free
+        except OSError:
+            return None
+
+    def host_name(self) -> str:
+        return socket.gethostname()
+
+    def outbound_findings(self) -> List["Finding"]:
+        from . import network
+        from .network import outbound
+
+        return outbound.check_destinations(network.load())
+
     def is_admin(self) -> bool:
         if self.platform != "win32":
             return os.geteuid() == 0 if hasattr(os, "geteuid") else False
@@ -439,6 +468,31 @@ def check_ports(host: Host, expect_listening: bool) -> List[Finding]:
                     data={"bound": []},
                 )
             )
+        elif port == stack.API_PORT and all(bound_to_loopback(h) for h in hosts):
+            # Where the packaged compose file puts it since 7.4: the API port
+            # is for this machine, and the network reaches the same API
+            # through the web interface's port, under /api/.
+            findings.append(
+                Finding(
+                    f"ports.{port}",
+                    f"Port {port} ({name})",
+                    OK,
+                    f"bound to {', '.join(hosts)} — this machine only, as intended",
+                    data={"bound": hosts},
+                )
+            )
+        elif port == stack.API_PORT and any(bound_everywhere(h) for h in hosts):
+            findings.append(
+                Finding(
+                    f"ports.{port}",
+                    f"Port {port} ({name})",
+                    WARN,
+                    "listening on every interface — the network does not need it: "
+                    f"other computers reach the API through port {stack.WEB_PORT}, under /api/",
+                    fix="`arcsecond update` restores the packaged mapping, which keeps this port to this machine",
+                    data={"bound": hosts},
+                )
+            )
         elif any(bound_everywhere(h) for h in hosts):
             findings.append(
                 Finding(
@@ -619,6 +673,93 @@ def check_proxy() -> List[Finding]:
     return findings
 
 
+DISK_WARN_GB = 20
+DISK_FAIL_GB = 2
+
+
+def check_disk(install, host: "Host") -> Finding:
+    """Images fill a disk quietly, and a full one stops the database."""
+    shared = install.read_env("SHARED_DATA_PATH")
+    if not shared:
+        return Finding("disk", "Disk space", SKIP, "no SHARED_DATA_PATH in .env")
+    free = host.free_bytes(shared)
+    if free is None:
+        return Finding("disk", "Disk space", SKIP, "the data folder does not exist yet")
+    gigabytes = free / 1e9
+    detail = f"{gigabytes:.0f} GB free where the data is kept"
+    if gigabytes < DISK_FAIL_GB:
+        return Finding(
+            "disk",
+            "Disk space",
+            FAIL,
+            detail,
+            fix="Free some space, or move the data folder to a larger disk.",
+        )
+    if gigabytes < DISK_WARN_GB:
+        return Finding("disk", "Disk space", WARN, detail)
+    return Finding("disk", "Disk space", OK, detail)
+
+
+def check_privileges(install, host: "Host") -> Finding:
+    """What the containers are allowed to do on this machine: the question a
+    security review asks first."""
+    try:
+        names = [
+            row.get("Name") for row in stack.services_status(install) if row.get("Name")
+        ]
+    except ArcsecondError:
+        names = []
+    if not names:
+        return Finding(
+            "privileges", "Container privileges", SKIP, "no container to inspect"
+        )
+    result = host.run(
+        [
+            "docker",
+            "inspect",
+            "--format",
+            "{{.Name}}|{{.HostConfig.Privileged}}|{{json .HostConfig.CapAdd}}|{{.HostConfig.NetworkMode}}|{{.Config.User}}",
+            *names,
+        ]
+    )
+    if result is None or result.returncode != 0:
+        return Finding(
+            "privileges",
+            "Container privileges",
+            SKIP,
+            "could not inspect the containers",
+        )
+    rows = [
+        line.split("|") for line in result.stdout.splitlines() if line.count("|") == 4
+    ]
+    privileged = [r[0].lstrip("/") for r in rows if r[1] == "true"]
+    capabilities = [r[0].lstrip("/") for r in rows if r[2] not in ("null", "[]")]
+    on_host_network = [r[0].lstrip("/") for r in rows if r[3] == "host"]
+    as_root = [r[0].lstrip("/") for r in rows if r[4] in ("", "0", "root")]
+    data = {
+        "privileged": privileged,
+        "added_capabilities": capabilities,
+        "host_network": on_host_network,
+        "run_as_root_inside": as_root,
+    }
+    worries = privileged + capabilities + on_host_network
+    if worries:
+        return Finding(
+            "privileges",
+            "Container privileges",
+            WARN,
+            f"{', '.join(sorted(set(worries)))} run with more than the packaged configuration grants",
+            fix="`arcsecond update` restores the packaged configuration",
+            data=data,
+        )
+    detail = f"{len(rows)} containers: none privileged, none on the machine's own network, no added capability"
+    if as_root:
+        data["note"] = (
+            f"{len(as_root)} of them run as root inside their container: {', '.join(as_root)}."
+        )
+    return Finding("privileges", "Container privileges", OK, detail, data=data)
+
+
 def check_api_pointer() -> Finding:
     current = ArcsecondConfig.current_api_name()
     if current == LOCAL_API_NAME:
@@ -645,7 +786,9 @@ def check_api_pointer() -> Finding:
     )
 
 
-def run_checks(install, host: Host, fix: bool = False) -> List[Finding]:
+def run_checks(
+    install, host: Host, fix: bool = False, outbound: bool = False
+) -> List[Finding]:
     findings: List[Finding] = []
     docker = check_docker(host)
     findings.append(docker)
@@ -671,9 +814,45 @@ def run_checks(install, host: Host, fix: bool = False) -> List[Finding]:
 
     findings += check_proxy()
     findings.append(check_api_pointer())
+    findings.append(check_disk(install, host))
+    if docker.status == OK:
+        findings.append(check_privileges(install, host))
+    if outbound:
+        findings += host.outbound_findings()
     return findings
 
 
+def exit_code(findings: List[Finding]) -> int:
+    """0: everything required works. 1: only an optional outside destination
+    is out of reach. 2: something required fails."""
+    if any(f.status == FAIL for f in findings):
+        return 2
+    if any(
+        f.key.startswith("net.") and f.data.get("reachable") is False for f in findings
+    ):
+        return 1
+    return 0
+
+
+_PRIVATE_ADDRESS = re.compile(
+    r"\b(?:10\.\d{1,3}|192\.168|172\.(?:1[6-9]|2\d|3[01])|169\.254)\.\d{1,3}\.\d{1,3}\b"
+)
+
+
+def redact_local(text: str, host_name: Optional[str] = None) -> str:
+    """The same text without what identifies the local network: its private
+    addresses and this machine's name. A report leaves the observatory; what
+    its network looks like inside is not the recipient's business."""
+    text = _PRIVATE_ADDRESS.sub("<local address>", text)
+    if host_name:
+        for name in {host_name, host_name.split(".")[0]}:
+            if len(name) > 2:
+                text = re.sub(
+                    re.escape(name), "<this machine>", text, flags=re.IGNORECASE
+                )
+    return text
+
+
 # ---------------------------------------------------------------------------
 # The command
 # ---------------------------------------------------------------------------
@@ -686,38 +865,108 @@ MARKS = {
 }
 
 
-def print_findings(findings: List[Finding], install) -> None:
-    click.echo(f"Installation: {install.path}\n")
+PROMISE = "This check sends nothing about your observatory: it only tests what can be reached."
+
+SECTIONS = (
+    ("This machine", lambda f: not f.key.startswith("net.")),
+    ("Outside destinations", lambda f: f.key.startswith("net.")),
+)
+
+
+def _finding_lines(f: Finding, width: int) -> List[str]:
+    """One finding: its line, then its remedy and its note when it has them."""
+    entry = f"  [{f.data['manifest']}]" if f.data.get("manifest") else ""
+    lines = [
+        f"  {MARKS[f.status]} {f.label.ljust(width)}  {f.detail}{click.style(entry, dim=True)}"
+    ]
+    if f.fix and f.status in (WARN, FAIL):
+        lines += [f"    {' ' * width}  → {line}" for line in f.fix.splitlines()]
+    note = f.data.get("note")
+    if note and f.status != SKIP:
+        lines.append(click.style(f"    {' ' * width}  {note}", dim=True))
+    return lines
+
+
+def render_findings(findings: List[Finding], install) -> str:
+    """The report as text, the same on screen and in a file."""
+    out = [PROMISE, "", f"Installation: {install.path}"]
     width = max(len(f.label) for f in findings)
-    for f in findings:
-        click.echo(f"  {MARKS[f.status]} {f.label.ljust(width)}  {f.detail}")
-        if f.fix and f.status in (WARN, FAIL):
-            for line in f.fix.splitlines():
-                click.echo(f"    {' ' * width}  → {line}")
-        note = f.data.get("note")
-        if note and f.status != SKIP:
-            click.echo(click.style(f"    {' ' * width}  {note}", dim=True))
+    for title, belongs in SECTIONS:
+        section = [f for f in findings if belongs(f)]
+        if not section:
+            continue
+        out += ["", f"{title}:"]
+        for f in section:
+            out += _finding_lines(f, width)
     fails = sum(1 for f in findings if f.status == FAIL)
     warns = sum(1 for f in findings if f.status == WARN)
-    click.echo("")
+    out.append("")
     if fails:
-        click.echo(
+        out.append(
             click.style(f"{fails} problem(s), {warns} warning(s).", fg="red", bold=True)
         )
     elif warns:
-        click.echo(click.style(f"No problem, {warns} warning(s).", fg="yellow"))
+        out.append(click.style(f"No problem, {warns} warning(s).", fg="yellow"))
     else:
-        click.echo(click.style("Everything checks out.", fg="green", bold=True))
+        out.append(click.style("Everything checks out.", fg="green", bold=True))
+
+    from .network import outbound
+
+    lost = outbound.unavailable(findings)
+    if lost:
+        out += [
+            "",
+            "With the destinations that could not be reached, this installation does without:",
+        ]
+        out += [f"  - {line}" for line in dict.fromkeys(lost)]
     lan = next((f for f in findings if f.key == "lan.host"), None)
     if lan and lan.data.get("lan_ipv4"):
-        click.echo(
-            f"\nFrom another computer on this network:  http://{lan.data['lan_ipv4']}:{stack.WEB_PORT}"
-        )
+        out += [
+            "",
+            f"From another computer on this network:  http://{lan.data['lan_ipv4']}:{stack.WEB_PORT}",
+        ]
+    return "\n".join(out)
+
+
+def print_findings(findings: List[Finding], install) -> None:
+    click.echo(render_findings(findings, install))
+
+
+def _payload(findings: List[Finding], install, host: "Host") -> dict:
+    return {
+        "installation": str(install.path),
+        "platform": host.platform,
+        "cli": _cli_version(),
+        "checked_at": datetime.now().astimezone().isoformat(timespec="seconds"),
+        "exit_code": exit_code(findings),
+        "findings": [asdict(f) for f in findings],
+    }
+
+
+def write_report(
+    findings: List[Finding], install, host: "Host", folder: Path, show_local: bool
+) -> Path:
+    """One dated text file an administrator can attach to a ticket: the
+    readable report, then the same content as JSON."""
+    text = click.unstyle(render_findings(findings, install))
+    body = json.dumps(_payload(findings, install, host), indent=2)
+    stamp = f"{datetime.now().astimezone():%Y-%m-%d %H:%M %Z}"
+    content = (
+        f"Arcsecond.local doctor report, {stamp}\n\n{text}\n\n"
+        f"--- machine-readable ---\n{body}\n"
+    )
+    if not show_local:
+        content = redact_local(content, host.host_name())
+        content = content.replace(str(install.path), "<installation folder>")
+    folder.mkdir(parents=True, exist_ok=True)
+    path = folder / f"arcsecond-doctor-{datetime.now():%Y%m%d-%H%M}.txt"
+    path.write_text(content, encoding="utf-8")
+    return path
 
 
 @click.command(
-    name="check",
-    short_help="Check that the installation works, and is reachable from other computers.",
+    name="doctor",
+    short_help="Check that the installation works, is reachable, and can reach what it needs.",
 )
 @dir_option
 @click.option(
@@ -732,30 +981,58 @@ def print_findings(findings: List[Finding], install) -> None:
     help="Apply the remedies this command can apply itself (the Windows firewall rule, "
     "from an Administrator shell). The network profile is never changed.",
 )
+@click.option(
+    "--local-only",
+    is_flag=True,
+    help="Skip the outside destinations: test this machine and nothing beyond it.",
+)
+@click.option(
+    "--report",
+    "report",
+    type=click.Path(file_okay=False, path_type=Path),
+    default=None,
+    is_flag=False,
+    flag_value=Path("."),
+    help="Also write the result to a dated file, in this folder (default: the current one), "
+    "to attach to a ticket. Local addresses and this machine's name are left out.",
+)
+@click.option(
+    "--show-local",
+    is_flag=True,
+    help="With --report: keep the local network's addresses and this machine's name in the file.",
+)
 @basic_options
-def check_cmd(directory, as_json, fix):
+def doctor_cmd(directory, as_json, fix, local_only, report, show_local):
     """Run every check an installation can run on itself: Docker, the
-    configuration files, the containers, the ports and what they are bound
-    to, the address other computers use, and on Windows the network profile
-    and the firewall rule. Each problem comes with its remedy.
+    configuration files, the containers and what they are allowed to do, the
+    ports and what they are bound to, the address other computers use, disk
+    space, and on Windows the network profile and the firewall rule.
+
+    Then look outward: every destination Arcsecond.local may contact is
+    tested from this machine (name, connection, encryption, certificate),
+    and this machine's clock is compared with a reference. Nothing about your
+    observatory is sent. Each problem comes with its remedy, or with the
+    sentence to send to whoever runs your network.
 
-    Exit code 1 when something fails, 0 otherwise — so it can gate a script.
+    Exit code 0 when everything required works, 1 when only an optional
+    outside destination is out of reach, 2 when something required fails.
+
+    `arcsecond check` is this same command, under its former name.
     """
     install = stack.resolve_install_dir(directory)
     host = Host()
-    findings = run_checks(install, host, fix=fix)
+    findings = run_checks(install, host, fix=fix, outbound=not local_only)
     if as_json:
-        payload = {
-            "installation": str(install.path),
-            "platform": host.platform,
-            "cli": _cli_version(),
-            "findings": [asdict(f) for f in findings],
-        }
-        click.echo(json.dumps(payload, indent=2))
+        click.echo(json.dumps(_payload(findings, install, host), indent=2))
     else:
         print_findings(findings, install)
-    if any(f.status == FAIL for f in findings):
-        raise SystemExit(1)
+    if report is not None:
+        path = write_report(findings, install, host, report, show_local)
+        if not as_json:
+            click.echo(f"\nReport written to {path}")
+    code = exit_code(findings)
+    if code:
+        raise SystemExit(code)
 
 
 def _cli_version() -> str:

{arcsecond-4.3.3 → arcsecond-4.4.1}/arcsecond/hosting/lifecycle.py

@@ -298,8 +298,10 @@ def logs(directory, service, follow, tail):
 @dir_option
 @basic_options
 def update(directory):
-    """Bring the installation up to date: refresh docker-compose.yml from this
-    CLI, download the latest images, and restart what changed.
+    """Bring the installation up to date: rewrite docker-compose.yml from this
+    CLI, add what .env lacks, download the latest images, and restart what
+    changed. A docker-compose.yml that differed is kept aside as a backup;
+    local changes belong in docker-compose.override.yml, which is left alone.
 
     Update the CLI itself first, so that the compose file it writes is the
     newest one:  pip install --upgrade arcsecond
@@ -309,13 +311,16 @@ def update(directory):
 
     click.echo(f"Updating Arcsecond.local in {install.path} ...\n")
     click.echo("Refreshing the configuration files:")
-    enabled, removed, to_record = _resolve_optional_services(install.env_path, {})
+    enabled, to_record = _resolve_optional_services(
+        install.env_path, {}, compose_path=install.compose_path
+    )
     write_env_file(directory=install.path)
     for name, answer in to_record:
         _record_optional_service_decision(install.env_path, name, answer)
-    write_docker_compose_file(
-        enabled_services=enabled, removed_services=removed, directory=install.path
-    )
+    write_docker_compose_file(enabled_services=enabled, directory=install.path)
+    # Installations set up before 4.0 never recorded where they are; from now
+    # on the other commands find this one from any folder.
+    stack.remember_install_dir(install.path)
 
     click.echo("\nDownloading the latest images:")
     _streamed(install, "docker compose pull", "pull")