cloudfall 0.2.0__py3-none-any.whl

cloudfall_engine/_bundled/ansible/roles/cloudfall_deploy/tasks/main.yml

@@ -0,0 +1,285 @@
+---
+- name: Validate deployment target and declaration
+  ansible.builtin.assert:
+    that:
+      - ansible_facts["distribution"] == "Debian"
+      - ansible_facts["service_mgr"] == "systemd"
+      - ansible_facts["architecture"] == "x86_64"
+      - cloudfall_deploy_component.service.manager == "systemd"
+      - cloudfall_deploy_component.runtime.type == "python"
+      - cloudfall_deploy_component.runtime.packageManager == "uv"
+      - cloudfall_deploy_release | length > 0
+      - cloudfall_deploy_artifact_sha256 | length == 64
+    fail_msg: >-
+      The first deploy slice supports Debian x86_64 hosts and Python
+      components managed by uv under systemd
+
+- name: Compute release paths
+  ansible.builtin.set_fact:
+    cloudfall_deploy_release_directory: >-
+      {{ cloudfall_deploy_component.install_root }}/releases/{{
+        cloudfall_deploy_release
+      }}
+    cloudfall_deploy_current_link: >-
+      {{ cloudfall_deploy_component.install_root }}/current
+    cloudfall_deploy_shared_directory: >-
+      {{ cloudfall_deploy_component.install_root }}/shared
+    cloudfall_deploy_staging_archive: >-
+      /tmp/cloudfall-{{ cloudfall_deploy_component.id }}-{{
+        cloudfall_deploy_release
+      }}.tar.gz
+
+- name: Check the installed uv version
+  ansible.builtin.command:
+    argv:
+      - /usr/local/bin/uv
+      - --version
+  register: cloudfall_deploy_uv_installed
+  changed_when: false
+  failed_when: false
+
+- name: Install the pinned uv release
+  when: >-
+    cloudfall_deploy_uv_installed.rc != 0
+    or cloudfall_deploy_uv_version not in cloudfall_deploy_uv_installed.stdout
+  block:
+    - name: Download the pinned uv archive
+      ansible.builtin.get_url:
+        url: "{{ cloudfall_deploy_uv_url }}"
+        dest: /tmp/cloudfall-uv.tar.gz
+        checksum: "sha256:{{ cloudfall_deploy_uv_sha256 }}"
+        mode: "0644"
+
+    - name: Unpack the uv archive
+      ansible.builtin.unarchive:
+        src: /tmp/cloudfall-uv.tar.gz
+        dest: /tmp
+        remote_src: true
+
+    - name: Install the uv binary
+      ansible.builtin.copy:
+        src: /tmp/uv-x86_64-unknown-linux-gnu/uv
+        dest: /usr/local/bin/uv
+        remote_src: true
+        owner: root
+        group: root
+        mode: "0755"
+
+- name: Create release and shared directories
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    owner: "{{ cloudfall_deploy_component.application_user }}"
+    group: "{{ cloudfall_deploy_component.application_user }}"
+    mode: "0755"
+  loop:
+    - "{{ cloudfall_deploy_component.install_root }}/releases"
+    - "{{ cloudfall_deploy_release_directory }}"
+    - "{{ cloudfall_deploy_shared_directory }}"
+    - "{{ cloudfall_deploy_shared_directory }}/env"
+    - "{{ cloudfall_deploy_shared_directory }}/uv"
+
+- name: Transfer the release artifact
+  ansible.builtin.copy:
+    src: "{{ cloudfall_deploy_artifact_archive }}"
+    dest: "{{ cloudfall_deploy_staging_archive }}"
+    owner: root
+    group: root
+    mode: "0644"
+
+- name: Verify the transferred artifact digest
+  ansible.builtin.stat:
+    path: "{{ cloudfall_deploy_staging_archive }}"
+    checksum_algorithm: sha256
+  register: cloudfall_deploy_staged
+
+- name: Refuse a release whose digest does not match its metadata
+  ansible.builtin.assert:
+    that:
+      - cloudfall_deploy_staged.stat.checksum
+        == cloudfall_deploy_artifact_sha256
+    fail_msg: >-
+      Transferred artifact digest does not match the declared
+      artifact metadata
+
+- name: Unpack the verified release
+  ansible.builtin.unarchive:
+    src: "{{ cloudfall_deploy_staging_archive }}"
+    dest: "{{ cloudfall_deploy_release_directory }}"
+    remote_src: true
+    owner: "{{ cloudfall_deploy_component.application_user }}"
+    group: "{{ cloudfall_deploy_component.application_user }}"
+
+- name: Remove the staged archive
+  ansible.builtin.file:
+    path: "{{ cloudfall_deploy_staging_archive }}"
+    state: absent
+
+- name: Install the component environment file
+  ansible.builtin.copy:
+    src: "{{ cloudfall_deploy_environment_file }}"
+    dest: >-
+      {{ cloudfall_deploy_shared_directory }}/env/{{
+        cloudfall_deploy_component.id
+      }}.env
+    owner: root
+    group: "{{ cloudfall_deploy_component.application_user }}"
+    mode: "0640"
+  when: cloudfall_deploy_environment_file | length > 0
+
+- name: Materialize locked dependencies for the release
+  ansible.builtin.command:
+    argv:
+      - /usr/local/bin/uv
+      - sync
+      - --frozen
+      - --no-dev
+    chdir: "{{ cloudfall_deploy_release_directory }}"
+  become: true
+  become_user: "{{ cloudfall_deploy_component.application_user }}"
+  environment:
+    HOME: "{{ cloudfall_deploy_shared_directory }}"
+    UV_CACHE_DIR: "{{ cloudfall_deploy_shared_directory }}/uv/cache"
+    UV_PYTHON_INSTALL_DIR: "{{ cloudfall_deploy_shared_directory }}/uv/python"
+  changed_when: true
+
+- name: Inspect the currently active release
+  ansible.builtin.stat:
+    path: "{{ cloudfall_deploy_current_link }}"
+    follow: false
+    get_checksum: false
+  register: cloudfall_deploy_current
+
+- name: Record the rollback candidate
+  ansible.builtin.set_fact:
+    cloudfall_deploy_previous_directory: >-
+      {{
+        cloudfall_deploy_current.stat.lnk_source
+        if cloudfall_deploy_current.stat.exists
+        and cloudfall_deploy_current.stat.islnk
+        else ""
+      }}
+
+- name: Install the managed service unit
+  ansible.builtin.template:
+    src: component.service.j2
+    dest: >-
+      /etc/systemd/system/{{ cloudfall_deploy_component.service.name }}.service
+    owner: root
+    group: root
+    mode: "0644"
+
+- name: Activate the release behind the health gate
+  block:
+    - name: Switch the current release symlink
+      ansible.builtin.file:
+        src: "{{ cloudfall_deploy_release_directory }}"
+        dest: "{{ cloudfall_deploy_current_link }}"
+        state: link
+        force: true
+        follow: false
+
+    - name: Restart the component service
+      ansible.builtin.systemd_service:
+        name: "{{ cloudfall_deploy_component.service.name }}.service"
+        enabled: true
+        state: restarted
+        daemon_reload: true
+
+    - name: Gate the release on its declared health check
+      ansible.builtin.uri:
+        url: >-
+          {{ cloudfall_deploy_component.healthCheck.scheme }}://127.0.0.1:{{
+            cloudfall_deploy_component.healthCheck.port
+          }}{{ cloudfall_deploy_component.healthCheck.path }}
+        status_code: >-
+          {{ cloudfall_deploy_component.healthCheck.expectedStatuses }}
+        timeout: "{{ cloudfall_deploy_component.healthCheck.timeoutSeconds }}"
+        return_content: false
+      register: cloudfall_deploy_health
+      retries: >-
+        {{ cloudfall_deploy_component.healthCheck.attempts | int - 1 }}
+      delay: 3
+      until: >-
+        cloudfall_deploy_health.status
+        in cloudfall_deploy_component.healthCheck.expectedStatuses
+      when: not ansible_check_mode
+  rescue:
+    - name: Restore the previous release symlink
+      ansible.builtin.file:
+        src: "{{ cloudfall_deploy_previous_directory }}"
+        dest: "{{ cloudfall_deploy_current_link }}"
+        state: link
+        force: true
+        follow: false
+      when: cloudfall_deploy_previous_directory | length > 0
+
+    - name: Restart the restored release
+      ansible.builtin.systemd_service:
+        name: "{{ cloudfall_deploy_component.service.name }}.service"
+        state: restarted
+        daemon_reload: true
+      when: cloudfall_deploy_previous_directory | length > 0
+
+    - name: Stop the failed first release
+      ansible.builtin.systemd_service:
+        name: "{{ cloudfall_deploy_component.service.name }}.service"
+        state: stopped
+      when: cloudfall_deploy_previous_directory | length == 0
+
+    - name: Fail the deployment after rolling back
+      ansible.builtin.fail:
+        msg: >-
+          Release {{ cloudfall_deploy_release }} failed its health check and
+          was {{
+            'rolled back to '
+            ~ (cloudfall_deploy_previous_directory | basename)
+            if cloudfall_deploy_previous_directory | length > 0
+            else 'stopped because no previous release exists'
+          }}
+
+- name: Ensure the controller receipt directory exists
+  ansible.builtin.file:
+    path: "{{ cloudfall_deploy_receipt_directory }}"
+    state: directory
+    mode: "0755"
+  delegate_to: localhost
+  become: false
+  when: cloudfall_deploy_receipt_directory | length > 0
+
+- name: Write the release receipt on the controller
+  ansible.builtin.copy:
+    content: >-
+      {{
+        {
+          'apiVersion': 'cloudfall/v1',
+          'kind': 'ReleaseReceipt',
+          'metadata': {
+            'id': cloudfall_deploy_component.id,
+            'description': 'Release receipt written by cloudfall_deploy',
+          },
+          'spec': {
+            'component': cloudfall_deploy_component.id,
+            'server': cloudfall_server_id,
+            'release': cloudfall_deploy_release,
+            'artifactSha256': cloudfall_deploy_artifact_sha256,
+            'deployedAt': ansible_facts['date_time']['iso8601'],
+            'previousRelease': (
+              (cloudfall_deploy_previous_directory | basename)
+              if cloudfall_deploy_previous_directory | length > 0
+              else none
+            ),
+            'healthCheckPassed': true,
+          },
+        } | to_nice_json
+      }}
+    dest: >-
+      {{ cloudfall_deploy_receipt_directory }}/{{
+        cloudfall_deploy_component.id
+      }}.json
+    mode: "0644"
+  delegate_to: localhost
+  become: false
+  when:
+    - not ansible_check_mode
+    - cloudfall_deploy_receipt_directory | length > 0

cloudfall_engine/_bundled/ansible/roles/cloudfall_deploy/tasks/restart.yml

@@ -0,0 +1,17 @@
+---
+- name: Validate restart target and declaration
+  ansible.builtin.assert:
+    that:
+      - ansible_facts["distribution"] == "Debian"
+      - ansible_facts["service_mgr"] == "systemd"
+      - cloudfall_deploy_component.service.manager == "systemd"
+    fail_msg: Restart requires a Debian systemd host
+
+- name: Restart the component service
+  ansible.builtin.systemd_service:
+    name: "{{ cloudfall_deploy_component.service.name }}.service"
+    state: restarted
+    daemon_reload: true
+
+- name: Require the restarted component to pass its health check
+  ansible.builtin.include_tasks: health_gate.yml

cloudfall_engine/_bundled/ansible/roles/cloudfall_deploy/tasks/rollback.yml

@@ -0,0 +1,52 @@
+---
+- name: Validate rollback target and declaration
+  ansible.builtin.assert:
+    that:
+      - ansible_facts["distribution"] == "Debian"
+      - ansible_facts["service_mgr"] == "systemd"
+      - cloudfall_deploy_component.service.manager == "systemd"
+      - cloudfall_deploy_release | length > 0
+    fail_msg: >-
+      Rollback requires a Debian systemd host and an explicit release id
+
+- name: Compute rollback paths
+  ansible.builtin.set_fact:
+    cloudfall_deploy_release_directory: >-
+      {{ cloudfall_deploy_component.install_root }}/releases/{{
+        cloudfall_deploy_release
+      }}
+    cloudfall_deploy_current_link: >-
+      {{ cloudfall_deploy_component.install_root }}/current
+
+- name: Inspect the rollback target release
+  ansible.builtin.stat:
+    path: "{{ cloudfall_deploy_release_directory }}"
+    get_checksum: false
+  register: cloudfall_deploy_rollback_target
+
+- name: Require the rollback target on the server
+  ansible.builtin.assert:
+    that:
+      - cloudfall_deploy_rollback_target.stat.exists
+      - cloudfall_deploy_rollback_target.stat.isdir
+    fail_msg: >-
+      Release {{ cloudfall_deploy_release }} does not exist under
+      {{ cloudfall_deploy_component.install_root }}/releases
+
+- name: Switch the current release symlink to the rollback target
+  ansible.builtin.file:
+    src: "{{ cloudfall_deploy_release_directory }}"
+    dest: "{{ cloudfall_deploy_current_link }}"
+    state: link
+    force: true
+    follow: false
+
+- name: Restart the component service
+  ansible.builtin.systemd_service:
+    name: "{{ cloudfall_deploy_component.service.name }}.service"
+    enabled: true
+    state: restarted
+    daemon_reload: true
+
+- name: Require the rolled-back release to pass its health check
+  ansible.builtin.include_tasks: health_gate.yml

cloudfall_engine/_bundled/ansible/roles/cloudfall_deploy/templates/component.service.j2

@@ -0,0 +1,24 @@
+# Managed by Cloudfall. Local changes will be overwritten.
+{% set command = cloudfall_deploy_component.service.command %}
+{% set executable = command[0]
+    if command[0].startswith('/')
+    else cloudfall_deploy_component.install_root ~ '/current/' ~ command[0] %}
+[Unit]
+Description=Cloudfall component {{ cloudfall_deploy_component.id }}
+After=network.target
+
+[Service]
+Type=exec
+User={{ cloudfall_deploy_component.application_user }}
+Group={{ cloudfall_deploy_component.application_user }}
+WorkingDirectory={{ cloudfall_deploy_component.install_root }}/current
+EnvironmentFile=-{{ cloudfall_deploy_component.install_root }}/shared/env/{{ cloudfall_deploy_component.id }}.env
+ExecStart={{ executable }}{% for argument in command[1:] %} "{{ argument }}"{% endfor %}
+
+Restart=on-failure
+RestartSec=2
+NoNewPrivileges=true
+PrivateTmp=true
+
+[Install]
+WantedBy=multi-user.target

cloudfall_engine/_bundled/ansible/roles/cloudfall_firewall/defaults/main.yml

@@ -0,0 +1,2 @@
+---
+cloudfall_firewall_configuration_path: /etc/nftables.conf

cloudfall_engine/_bundled/ansible/roles/cloudfall_firewall/handlers/main.yml

@@ -0,0 +1,5 @@
+---
+- name: Reload nftables
+  ansible.builtin.systemd_service:
+    name: nftables.service
+    state: reloaded

cloudfall_engine/_bundled/ansible/roles/cloudfall_firewall/meta/argument_specs.yml

@@ -0,0 +1,33 @@
+---
+argument_specs:
+  main:
+    short_description: Enforce the declared Cloudfall inbound firewall
+    options:
+      cloudfall_firewall_ruleset:
+        type: dict
+        required: true
+        options:
+          policy:
+            type: str
+            choices:
+              - default-deny
+            required: true
+          allowedInbound:
+            type: list
+            elements: dict
+            required: true
+            options:
+              port:
+                type: int
+                required: true
+              protocol:
+                type: str
+                choices:
+                  - tcp
+                  - udp
+                required: true
+              description:
+                type: str
+      cloudfall_firewall_configuration_path:
+        type: path
+        default: /etc/nftables.conf

cloudfall_engine/_bundled/ansible/roles/cloudfall_firewall/meta/main.yml

@@ -0,0 +1,13 @@
+---
+galaxy_info:
+  role_name: cloudfall_firewall
+  author: Cloudfall
+  description: Enforce a declared default-deny nftables inbound policy
+  license: AGPL-3.0-or-later
+  min_ansible_version: "2.21"
+  platforms:
+    - name: Debian
+      versions:
+        - bookworm
+        - trixie
+dependencies: []

cloudfall_engine/_bundled/ansible/roles/cloudfall_firewall/tasks/main.yml

@@ -0,0 +1,51 @@
+---
+- name: Validate firewall target and declared ruleset
+  ansible.builtin.assert:
+    that:
+      - ansible_facts["distribution"] == "Debian"
+      - ansible_facts["service_mgr"] == "systemd"
+      - cloudfall_firewall_ruleset.policy == "default-deny"
+      - cloudfall_firewall_ruleset.allowedInbound | length > 0
+    fail_msg: >-
+      Cloudfall firewall management requires Debian, systemd, and a declared
+      default-deny ruleset with at least one allowed inbound rule
+
+- name: Refuse a ruleset that would block the control connection
+  ansible.builtin.assert:
+    that:
+      - >-
+        ansible_port | default(22) | int in (
+          cloudfall_firewall_ruleset.allowedInbound
+          | selectattr('protocol', 'equalto', 'tcp')
+          | map(attribute='port')
+          | map('int')
+          | list
+        )
+    fail_msg: >-
+      Refusing to apply a firewall that does not allow the SSH control port
+
+- name: Install nftables
+  ansible.builtin.apt:
+    name: nftables
+    state: present
+    update_cache: true
+    cache_valid_time: 3600
+
+- name: Render the managed nftables configuration
+  ansible.builtin.template:
+    src: nftables.conf.j2
+    dest: "{{ cloudfall_firewall_configuration_path }}"
+    owner: root
+    group: root
+    mode: "0644"
+    validate: /usr/sbin/nft --check --file %s
+  notify: Reload nftables
+
+- name: Enable and start nftables
+  ansible.builtin.systemd_service:
+    name: nftables.service
+    enabled: true
+    state: started
+
+- name: Apply the validated nftables configuration
+  ansible.builtin.meta: flush_handlers

cloudfall_engine/_bundled/ansible/roles/cloudfall_firewall/templates/nftables.conf.j2

@@ -0,0 +1,31 @@
+#!/usr/sbin/nft -f
+# Managed by Cloudfall. Local changes will be overwritten.
+
+flush ruleset
+
+table inet cloudfall {
+    chain input {
+        type filter hook input priority 0; policy drop;
+
+        iif "lo" accept
+        ct state established,related accept
+        ct state invalid drop
+        ip protocol icmp accept
+        meta l4proto ipv6-icmp accept
+{% for rule in cloudfall_firewall_ruleset.allowedInbound %}
+{% if rule.description is defined %}
+        {{ rule.protocol }} dport {{ rule.port }} accept comment "{{ rule.description }}"
+{% else %}
+        {{ rule.protocol }} dport {{ rule.port }} accept
+{% endif %}
+{% endfor %}
+    }
+
+    chain forward {
+        type filter hook forward priority 0; policy drop;
+    }
+
+    chain output {
+        type filter hook output priority 0; policy accept;
+    }
+}

cloudfall_engine/_bundled/ansible/roles/cloudfall_inspect/defaults/main.yml

@@ -0,0 +1,6 @@
+---
+cloudfall_inspect_collector_version: "0.4.0"
+cloudfall_inspect_logging_backend: {}
+cloudfall_inspect_components: []
+cloudfall_inspect_server_type: {}
+cloudfall_inspect_server_id: ""

cloudfall_engine/_bundled/ansible/roles/cloudfall_inspect/meta/argument_specs.yml

@@ -0,0 +1,24 @@
+---
+argument_specs:
+  main:
+    short_description: Collect read-only Debian host evidence
+    options:
+      cloudfall_inspect_collector_version:
+        type: str
+        default: "0.2.0"
+      cloudfall_inspect_output_directory:
+        type: path
+        required: true
+      cloudfall_inspect_server_type:
+        type: dict
+        required: true
+      cloudfall_inspect_server_id:
+        type: str
+        required: true
+      cloudfall_inspect_logging_backend:
+        type: dict
+        default: {}
+      cloudfall_inspect_components:
+        type: list
+        elements: dict
+        default: []

cloudfall_engine/_bundled/ansible/roles/cloudfall_inspect/meta/main.yml

@@ -0,0 +1,13 @@
+---
+galaxy_info:
+  role_name: cloudfall_inspect
+  author: Cloudfall
+  description: Collect read-only Debian host evidence for Cloudfall audits
+  license: AGPL-3.0-or-later
+  min_ansible_version: "2.21"
+  platforms:
+    - name: Debian
+      versions:
+        - bookworm
+        - trixie
+dependencies: []