cloudfall 0.8.0rc13__tar.gz → 0.8.0rc15__tar.gz

{cloudfall-0.8.0rc13 → cloudfall-0.8.0rc15}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: cloudfall
-Version: 0.8.0rc13
+Version: 0.8.0rc15
 Summary: The operator's record for self-hosted servers run by an AI agent: Ansible executes, Cloudfall gates, verifies and keeps the receipts
 Project-URL: Homepage, https://cloudfall.dev
 Project-URL: Repository, https://github.com/cloudfall-dev/cloudfall
@@ -252,14 +252,19 @@ and drift audit to the live dashboard, is in
 ```console
 uv run cloudfall import render render.yaml --application acme --server h1
 uv run cloudfall migrate --build web=main          # show the plan
-uv run cloudfall migrate --build web=main --yes    # run it
+uv run cloudfall migrate --build web=main --yes    # run it; pauses at deploy:web
+uv run cloudfall release approve web --release <release-id>   # a person, at a terminal
+uv run cloudfall migrate --yes                     # resume: deploy, routes, TLS
 ```
 
 The importer never guesses silently: `IMPORT-REPORT.md` records what was not
 imported, every assumption and every step required before cutover. The
 migration runs baseline, services, builds, health-gated deploys, routes, a
 DNS-verification pause, TLS and a final evidence pass, and resumes exactly
-where it stopped. Databases move with `cloudfall data copy`, which verifies
+where it stopped. An imported application declares `approval: manual`, so
+the run pauses before its deploy until a person approves the built release
+with `cloudfall release approve`; the resumed run deploys that release
+without building again. Databases move with `cloudfall data copy`, which verifies
 per-table row counts and writes a receipt. See the
 [Render migration guide](docs/render-migration-guide.md) and the
 [Neon migration guide](docs/neon-migration-guide.md).

{cloudfall-0.8.0rc13 → cloudfall-0.8.0rc15}/README.md

@@ -224,14 +224,19 @@ and drift audit to the live dashboard, is in
 ```console
 uv run cloudfall import render render.yaml --application acme --server h1
 uv run cloudfall migrate --build web=main          # show the plan
-uv run cloudfall migrate --build web=main --yes    # run it
+uv run cloudfall migrate --build web=main --yes    # run it; pauses at deploy:web
+uv run cloudfall release approve web --release <release-id>   # a person, at a terminal
+uv run cloudfall migrate --yes                     # resume: deploy, routes, TLS
 ```
 
 The importer never guesses silently: `IMPORT-REPORT.md` records what was not
 imported, every assumption and every step required before cutover. The
 migration runs baseline, services, builds, health-gated deploys, routes, a
 DNS-verification pause, TLS and a final evidence pass, and resumes exactly
-where it stopped. Databases move with `cloudfall data copy`, which verifies
+where it stopped. An imported application declares `approval: manual`, so
+the run pauses before its deploy until a person approves the built release
+with `cloudfall release approve`; the resumed run deploys that release
+without building again. Databases move with `cloudfall data copy`, which verifies
 per-table row counts and writes a receipt. See the
 [Render migration guide](docs/render-migration-guide.md) and the
 [Neon migration guide](docs/neon-migration-guide.md).

cloudfall-0.8.0rc15/changelog.d/106-enforce-manual-approval.md

@@ -0,0 +1,3 @@
+### Breaking
+
+- `deploy --yes` and `migrate --yes` on an application that declares `approval: manual` now need a person's approval of the release: without a `cloudfall release approve` record that counts (the same archive SHA-256, exactly the component's declared servers, not expired), `deploy --yes` exits 4 `PRECONDITION` with `deployment_approval_missing` before any playbook runs, naming the `release approve` command, and lists each record that doesn't count with `digest_mismatch`, `servers_changed` or `expired`. This hits every project that declares `manual` and deploys today, the example `crm.yaml` and every Render import included. Two ways out: keep `manual` and approve each release first (build it, run `cloudfall release approve` at a terminal, commit the record under `decisions/releases/` when CI deploys, then deploy), or switch the application to `approval: automatic` when another gate, such as GitHub's required reviewers, is the real one. The `deploy` plan and result gain `approval` (`policy`, and for `manual` the `status`, the counting record's `path`, `approver` and `expires_at` or `approved_at`, the records that don't count and the `command` to run), `deploy` gains `--approvals` (default `decisions/releases`) and the `RECORD_INVALID` exit for an approvals file that isn't a valid `ReleaseApproval`, and `cloudfall mcp serve` binds the approvals folder (its own `--approvals`) so a `deploy` call can't name its own; an `automatic` application's deploy never reads the folder (#163)

{cloudfall-0.8.0rc13 → cloudfall-0.8.0rc15}/changelog.d/160-release-approve.md

@@ -1,3 +1,3 @@
 ### Added
 
-- `cloudfall release approve <component> --release <release>` records a person's approval of one built release as a `ReleaseApproval` (new `release-approval.schema.json`) under `decisions/releases/`: the application, component, release, archive SHA-256, git commit, servers, approver, `approvedAt`, `expiresAt` (`--valid-for` hours, 1 to 168, default 24) and `via: terminal`. It verifies the artifact first, refuses a component of an `automatic` application with `release_approval_not_required`, and writes the record only once a person typed the release id at a terminal; `--yes` never answers it, and it is no MCP tool. It deploys nothing, and `deploy` does not read the record yet (#160)
+- `cloudfall release approve <component> --release <release>` records a person's approval of one built release as a `ReleaseApproval` (new `release-approval.schema.json`) under `decisions/releases/`: the application, component, release, archive SHA-256, git commit, servers, approver, `approvedAt`, `expiresAt` (`--valid-for` hours, 1 to 168, default 24) and `via: terminal`. It verifies the artifact first, refuses a component of an `automatic` application with `release_approval_not_required`, and writes the record only once a person typed the release id at a terminal; `--yes` never answers it, and it is no MCP tool. It deploys nothing (#160)

cloudfall-0.8.0rc15/changelog.d/165-migrate-approval-pause.md

@@ -0,0 +1,3 @@
+### Changed
+
+- `migrate --yes` checks a `deploy:<component>` step's approval as `deploy --yes` does: for an application that declares `approval: manual` and no approval that counts, it pauses at that step with `PARTIAL_FAILURE`, `context.code: deployment_approval_missing`, the built `release` and the `cloudfall release approve` `command`, and once a person approved it, `migrate --yes` resumes there with the release the completed `build:<component>` step recorded, without building again and without needing `--build` again. The deploy step's detail gains `approval` (the record it went on), `migrate` gains `--approvals` (default `decisions/releases`, bound by `cloudfall mcp serve`) and the `RECORD_INVALID` exit for an approvals file that isn't a valid `ReleaseApproval`. `rollback` needs no approval: its plan gains `approval`, `{"policy": "manual", "required": false, "reason": ...}` for a `manual` application and `{"policy": "automatic"}` otherwise (#165)

cloudfall-0.8.0rc15/changelog.d/174-no-templating-config-values.md

@@ -0,0 +1,3 @@
+### Security
+
+- A declared config value is never run as an Ansible template: `cloudfall-engine inventory render` and the overlay `cloudfall observe` writes mark every string unsafe (`{"__ansible_unsafe": ...}`), so a value holding `{{ ... }}` reaches the unit file, the release command and the health check as written. Before, a `service.command`, `healthCheck.command` or `release.command` argument such as `{{ lookup('pipe', '...') }}` ran on the management host during `cloudfall health` or `cloudfall deploy`, and an honest one such as `docker inspect --format {{.State.Health.Status}} app` failed with a template syntax error. A declared value that relied on Ansible evaluating `{{ ... }}` is now literal, and the rendered inventory's strings read as `{"__ansible_unsafe": "..."}` in its JSON and in `ansible-inventory --list` (#174)

cloudfall-0.8.0rc15/changelog.d/181-catalog-inputs-as-data.md

@@ -0,0 +1,3 @@
+### Security
+
+- A catalog operation's inputs are never run as an Ansible template: `cloudfall operations propose`, `cloudfall decisions approve` and `cloudfall agent investigate` hand them to the team's playbook in `--extra-vars` with every string marked unsafe (`{"__ansible_unsafe": ...}`), so an input holding `{{ ... }}` reaches the playbook as written, and integers and booleans keep their types. Before, an input such as `{{ lookup('pipe', '...') }}` ran on the management host with the operator's rights when the playbook started, and an honest input holding `{{` failed with a template syntax error. A team playbook that relied on an input being evaluated as Jinja now gets the literal text. The decision record's `inputs` are unchanged, and recordings made before this change replay as before (#181)

{cloudfall-0.8.0rc13 → cloudfall-0.8.0rc15}/docs/ci-deploy-guide.md

@@ -325,25 +325,92 @@ naming `production` still waits for its reviewers.
 
 ## Approval: who presses the button
 
-Every `Application` declares `spec.approval: manual` or `automatic`.
-Cloudfall validates the field and writes it into the rendered inventory, but
-no command acts on it today: `cloudfall deploy --yes` deploys an application
-marked `manual` exactly as it deploys one marked `automatic`. The only gate
-inside `deploy` is `--yes`, and a workflow that passes `--yes` has approved
-its own deploy.
-
-So in CI, the approval comes from GitHub, not from Cloudfall:
-
-- Give every environment that holds an application marked `manual` required
-  reviewers, and turn on "Prevent self-review", so the person who pushed the
-  change cannot approve its deploy
-- The job waits before its first step until a reviewer approves, so it never
-  sees the SSH key or the age key of that environment without approval
-- Leave `staging` without reviewers if its applications are `automatic`
-
-Read `approval: manual` as your declaration that such a gate must exist; the
-environment's reviewers are what enforce it. The approval itself lands in
-GitHub's deployment history, not in Cloudfall's record.
+Every `Application` declares `spec.approval: manual` or `automatic`, and
+`cloudfall deploy` enforces it:
+
+- `automatic`: `deploy --yes` deploys, as the workflow above does. Keep
+  staging's applications `automatic` and its one job stays as it is
+- `manual`: `deploy --yes` deploys a release only when a person approved
+  that release with `cloudfall release approve`. Without an approval that
+  counts it exits 4 `PRECONDITION` with `deployment_approval_missing`, before
+  any playbook runs, and names the command to run. `deploy` without `--yes`
+  shows the approval in its plan: `approval.status` is `approved` or
+  `missing`
+
+An approval is a record under `decisions/releases/` in the project. It names
+the archive's SHA-256, the component's servers and when it expires (24 hours
+by default, `--valid-for` up to a week). It counts only while the archive
+being deployed has that digest, the component is declared on exactly those
+servers, and it has not expired. A failed health gate does not use it up, so
+the same release can be retried until it expires.
+
+A person approves at a terminal by typing the release id back; no flag, and
+no CI job, answers that prompt. So a production deploy of a `manual`
+application is two jobs with a person between them, and approval needs the
+exact archive the deploy ships:
+
+1. A build job builds the release and uploads `tmp/artifacts/<component>/`
+   as a workflow artifact
+2. The person downloads that artifact into `tmp/artifacts/<component>/` of
+   their checkout and approves it:
+
+   ```sh
+   gh run download <run-id> --name cloudfall-artifact-crm-backend --dir tmp/artifacts/crm-backend
+   uv run cloudfall release approve crm-backend --release 20260101T000000Z-abcdef0
+   git add decisions/releases
+   git commit -m "Approve crm-backend 20260101T000000Z-abcdef0"
+   git push
+   ```
+
+3. They dispatch the deploy job with the build's run id and the release. It
+   checks out the commit holding the record, downloads the same artifact and
+   deploys it:
+
+```yaml
+  build:
+    runs-on: ubuntu-24.04
+    steps:
+      # checkout, uv, uv sync --locked, as in the workflow above
+      - name: Build the artifact
+        id: build
+        run: |
+          uv run cloudfall-engine artifact build "$COMPONENT" --ref "$REF" --format json > "$RUNNER_TEMP/build.json"
+          echo "release=$(jq -r '.data.release' "$RUNNER_TEMP/build.json")" >> "$GITHUB_OUTPUT"
+      - uses: actions/upload-artifact@v7
+        with:
+          name: cloudfall-artifact-${{ env.COMPONENT }}
+          path: tmp/artifacts/${{ env.COMPONENT }}/
+```
+
+```yaml
+  deploy:
+    runs-on: ubuntu-24.04
+    environment: production
+    steps:
+      # checkout, uv, sops, the SSH and age keys, secrets render, as above
+      - uses: actions/download-artifact@v7
+        with:
+          name: cloudfall-artifact-${{ env.COMPONENT }}
+          path: tmp/artifacts/${{ env.COMPONENT }}/
+          run-id: ${{ inputs.build_run_id }}
+          github-token: ${{ github.token }}
+      - name: Deploy the approved release
+        run: uv run cloudfall deploy "$COMPONENT" --release "$RELEASE" --env-file "tmp/env/$COMPONENT.env" --yes
+```
+
+The deploy job reads the record from its checkout, so dispatch it on the
+commit that holds the approval. A rebuilt release has a new archive, and
+its old approval no longer counts.
+
+GitHub's required reviewers remain a useful outer gate: give the
+`production` environment reviewers and turn on "Prevent self-review", and
+the deploy job never sees that environment's SSH key or age key until a
+reviewer lets it start. Their approval lands in GitHub's deployment
+history; the `release approve` record is the one in Cloudfall's.
+
+When the reviewers are the real gate and nobody will run `release approve`,
+switch the application to `approval: automatic`, so the project no longer
+claims a gate Cloudfall does not hold.
 
 ## Keeping the receipts
 

cloudfall-0.8.0rc15/docs/decisions/2026-11-02-isolation-without-containers.md

@@ -0,0 +1,155 @@
+# Decision: isolation without containers or self-run VMs
+
+Date: 2026-11-02. Status: decided, revisit on the triggers listed below.
+
+## Question
+
+How does Cloudfall keep components, runners and environments apart, and does
+that need containers or virtual machines it runs itself?
+
+## Decision
+
+No containers and no hypervisor of Cloudfall's own. Isolation has two
+boundaries:
+
+- **Inside a server**, the boundary is the systemd sandbox of each unit, a
+  database role per component, and cgroup limits. This is required on every
+  server
+- **Between trust levels**, the stronger boundary is a separate server: its
+  own kernel. A VPS counts as a server; its hypervisor belongs to the
+  provider, not to Cloudfall. This is recommended, not required
+
+A team may run everything on one server, several independent projects
+included, when it accepts the shared-kernel risk. The acceptance is declared
+in the plan, never implied: Cloudfall warns about a placement that puts two
+trust levels on one server unless the plan declares it.
+
+A separate Unix user per component is necessary but is not a boundary on its
+own.
+
+## Why a Unix user is not enough
+
+A user keeps files and signals apart. It does not stop:
+
+- a local privilege escalation in the shared kernel, which reaches every
+  component on the host
+- a database, cache or queue on localhost that trusts every local user, or
+  that components share one account of
+- membership in the `docker` group or a broad sudo rule, either of which is
+  root
+- a runner that executes code from a pull request or a compromised
+  dependency, which gets every key the runner holds; the keys, not the uid,
+  set the blast radius
+- reading other processes' command lines in `/proc`, world-readable home
+  directories, and one component exhausting memory, disk or processes for
+  the rest
+
+## Why not containers
+
+Docker and Podman isolate with the same kernel mechanisms systemd exposes
+directly: namespaces, cgroups, seccomp and capabilities. A container shares
+the kernel exactly as a sandboxed unit does, so it adds no boundary. What it
+adds is packaging (images, independent library versions) and a runtime to
+operate. Cloudfall's base is Debian and systemd
+([`2026-09-14-no-nixos-base.md`](2026-09-14-no-nixos-base.md)), container
+orchestration is a non-goal ([`../product.md`](../product.md), N-1), and the
+exit test is that any Linux admin can take over a server with Debian
+knowledge.
+
+## Why not self-run VMs
+
+A hypervisor on Cloudfall's hosts (Proxmox, KVM, Firecracker) is a second
+infrastructure layer to provision, patch, back up and explain to whoever
+takes over. A separate small server gives the same kernel boundary for a
+few euros a month and fits the model Cloudfall already manages.
+
+## The target model
+
+The first four parts are required on every server, one server or many. The
+last is a recommendation.
+
+**Each unit is sandboxed by systemd.** The component unit gets, by default:
+
+- its own user (or `DynamicUser=`), `NoNewPrivileges=` and an empty
+  `CapabilityBoundingSet=`
+- `ProtectSystem=strict`, `ProtectHome=`, `PrivateTmp=`, `PrivateDevices=`,
+  writes only to `ReadWritePaths=` and `StateDirectory=`
+- `ProtectProc=invisible`, `SystemCallFilter=@system-service`,
+  `RestrictNamespaces=`, `RestrictAddressFamilies=`
+- `IPAddressAllow=` and `IPAddressDeny=` where the component's peers are
+  known
+- `MemoryMax=`, `CPUQuota=`, `TasksMax=` from the component's declared
+  envelope ([`../fleet-goals.md`](../fleet-goals.md), goal 8)
+- secrets through `LoadCredentialEncrypted=` rather than `EnvironmentFile=`,
+  so a value is readable by that unit only and never sits in the process
+  environment
+
+`systemd-analyze security` scores a unit; a score threshold can become a
+deploy gate.
+
+**Shared services authenticate per component.** Each component gets its own
+PostgreSQL role, preferably through `peer` authentication over the Unix
+socket, so the unit's user is the role and no password exists. A service
+without authentication is never shared between components of different
+owners.
+
+**Runners are ephemeral and sandboxed.** A runner executes untrusted code.
+It runs one job per transient unit started with `systemd-run` under the same
+sandbox and `DynamicUser=`, its state removed after the job, and its network
+open only for the dependency step. On a server that also runs production
+components, the runner's unit is also denied the production components'
+directories and network peers (`InaccessiblePaths=`, `IPAddressDeny=`) and
+holds no production keys. This is the most exposed point of a one-server
+placement.
+
+**Access is scoped by environment.** A runner holds the SSH and age keys of
+one environment ([`../ci-deploy-guide.md`](../ci-deploy-guide.md)). Deploys
+log in as a dedicated user with sudo limited to the commands a deploy runs,
+not as root.
+
+**Separate servers separate trust levels (recommended).** Where the budget
+allows, these do not share a kernel:
+
+- production and staging
+- build and CI, and production; production servers then receive built
+  artifacts only
+- components of different customers or owners
+
+A team can only accept risk for its own projects. Placing components of
+different owners on one server puts the risk on owners who did not accept
+it, so Cloudfall keeps a separate, stronger warning for it. Cloudfall cannot
+verify ownership, so this stays a warning, not a refusal.
+
+## Where Cloudfall is today
+
+- Each component already runs as its own application user with
+  `NoNewPrivileges=true` and `PrivateTmp=true`
+  (`engine/ansible/roles/cloudfall_deploy/templates/component.service.j2`);
+  the rest of the sandbox is missing
+- SSH keys are scoped by environment, but the baseline installs them into
+  root's `authorized_keys`, so a runner's key is root on every server of its
+  environment
+- Secrets reach units through `EnvironmentFile=`
+- Resource envelopes are not declared or enforced yet
+
+## Triggers to revisit
+
+- **A customer needs untrusted code from several tenants on one server**,
+  where a separate server per tenant does not pay; then a stronger sandbox
+  (gVisor, microVMs) is the question, not containers
+- **A required workload ships only as a container image** with no reasonable
+  Debian install path
+- **systemd sandboxing proves insufficient** for a concrete attack that a
+  container runtime would have stopped
+
+## Consequences
+
+- The component unit template gains the sandbox directives above as
+  defaults, with per-component opt-outs that are declared, not silent
+- No container runtime, image build or registry appears in Cloudfall's
+  engine or docs as the way to isolate components
+- One server is a supported placement, not a degraded one; the required
+  parts above carry the whole isolation there
+- A plan that puts two trust levels on one server declares it as an
+  accepted risk; Cloudfall warns when it is undeclared, and warns again,
+  more strongly, when the trust levels belong to different owners

{cloudfall-0.8.0rc13 → cloudfall-0.8.0rc15}/docs/decisions.md

@@ -75,3 +75,11 @@ entry that supersedes it, never by editing an old one.
 - Why: psql substitutes a variable into the statement text, so ALTER ROLE ... PASSWORD with the plaintext puts the password in the server's log under log_statement ddl or all, or on a failing statement; PostgreSQL stores a pre-hashed verifier as it is
 - Applies to: engine/ansible/roles/cloudfall_postgresql/tasks/owner_password.yml, sdk/src/cloudfall/secrets.py, engine/src/cloudfall_engine/cli.py
 - Enforced by: a regression test that the staged file holds a verifier and never the password
+
+## D-10: Components are isolated by the systemd sandbox, and separate servers are recommended, not required
+
+- Decided: 2026-11-02, by the maintainer; reasoning in docs/decisions/2026-11-02-isolation-without-containers.md
+- Rule: On every server, components are kept apart by each unit's systemd sandbox (own user, ProtectSystem, ProtectHome, PrivateTmp, ProtectProc, SystemCallFilter, capability and address-family limits, cgroup limits), a database role per component, secrets through systemd credentials, keys scoped by environment and a non-root deploy user; runners are ephemeral sandboxed units, denied production directories, network peers and keys when they share a server with production; separate servers for different trust levels (production and staging, build or CI and production, different owners) are recommended, and a team may place everything on one server, several independent projects included, by declaring the accepted risk in the plan; Cloudfall warns about an undeclared placement of two trust levels on one server, and warns more strongly when they belong to different owners; Cloudfall adds no container runtime and no hypervisor of its own
+- Why: A Unix user alone keeps only files and signals apart; containers use the same kernel mechanisms systemd exposes and add no boundary, only a runtime to operate; a separate kernel is the one stronger boundary and comes from a separate server, but requiring it would rule out the one-server teams Cloudfall serves, and a team can accept that risk for its own projects, not for other owners
+- Applies to: engine/ansible/roles/cloudfall_deploy/templates/component.service.j2, engine/ansible/roles/cloudfall_access, server placement in plans, runner and CI setup
+- Enforced by: review

{cloudfall-0.8.0rc13 → cloudfall-0.8.0rc15}/docs/operator-guide.md

@@ -192,8 +192,11 @@ proposals it executed and which it withheld, with reasons.
 Approval is not a tool. A person approves a proposal by running
 `cloudfall operator approve` from a shell, as in
 [Reviewing and approving](#reviewing-and-approving); an agent that could
-call it would run and verify the change it proposed itself. The watch
-loop is not a tool either: it runs until stopped, as the service above.
+call it would run and verify the change it proposed itself. The same holds
+for `cloudfall release approve`: the `deploy` tool deploys a release of an
+application that declares `approval: manual` only once a person approved
+it at a terminal, and no tool writes that approval. The watch loop is not a
+tool either: it runs until stopped, as the service above.
 
 The agent is the brain here and the operator is the record. The agent can
 read the proposals, relay the diagnosis and recommend one; a person

{cloudfall-0.8.0rc13 → cloudfall-0.8.0rc15}/docs/render-migration-guide.md

@@ -127,6 +127,8 @@ and validation rejects them if they do.
 ```console
 uv run cloudfall migrate --build acme-api=main
 uv run cloudfall migrate --build acme-api=main --yes
+uv run cloudfall release approve acme-api --release <release-id>
+uv run cloudfall migrate --yes
 ```
 
 Without `--yes` the command shows the plan. With it, the plan executes step
@@ -134,7 +136,19 @@ by step: server baseline and firewall, infrastructure services, artifact
 builds, health-gated deployments, HTTP routes, a DNS-verification pause at
 the cutover moment, TLS issuance, and a final evidence pass requiring a
 compliant audit and healthy routes. Progress persists after every step, so
-a failure or the DNS pause resumes exactly where it stopped.
+a failure or a pause resumes exactly where it stopped.
+
+The importer writes `approval: manual` for every application, so the run
+pauses at `deploy:acme-api` (exit 3, `PARTIAL_FAILURE`, with
+`context.code: deployment_approval_missing`) once the release is built. The
+answer names the built release and the exact `cloudfall release approve`
+command. A person runs it at a terminal: it shows the git commit, the archive
+SHA-256 and the servers, and records the approval under
+`decisions/releases/` once the release id is typed back. `migrate --yes` then
+resumes at the deploy step with the release the build step recorded,
+without building again. When another gate, such as GitHub's required
+reviewers, is the real one, switch the application to `approval: automatic`
+and the run deploys without stopping.
 
 ## Step 6: migrate the data
 

{cloudfall-0.8.0rc13 → cloudfall-0.8.0rc15}/docs/specs/008-enforce-manual-approval.md

@@ -1,6 +1,6 @@
 # S-008: Enforce manual approval
 
-status: approved
+status: built
 serves: G-2
 
 ## Problem
@@ -186,3 +186,22 @@ Touches `sdk/src/cloudfall/app.py` (`deploy`, `rollback`, `migrate`, new `releas
 - cloudfall-dev/cloudfall#165: S-008-13, S-008-14
 
 ## Verification
+
+Every criterion ran through the CLI (or `cloudfall mcp serve`'s tool call) against a copy of the example project, with an engine whose playbooks stand in for the real ones: they run `ansible-playbook` on localhost and leave a marker and a release receipt, so no host was contacted. The S-008-14 artifact was built for real by `cloudfall-engine artifact build` from a local git repository. The terminal attestation ran with a stream that reports itself a terminal; no person typed at a real one, and no deploy reached a real server.
+
+- S-008-1: `test_s008_1_a_manual_application_without_approval_is_refused`, exit 4 `PRECONDITION` with `deployment_approval_missing`, the message named `crm`, `crm-backend`, the release and the command, `context.command` was the exact `release approve` command, and no marker, inventory or receipt was written
+- S-008-2: `test_s008_2_a_person_approves_a_release_by_typing_its_id` and `test_s008_2_the_record_id_is_an_approval_time_and_16_hex`, exit 0 and one file under `decisions/releases/` that validated against `release-approval.schema.json` with every named field, `expiresAt` 24 hours after `approvedAt` and `via: terminal`
+- S-008-3: `test_s008_3_an_approved_release_deploys_and_names_its_approval`, the deploy playbook ran and the result's `approval` carried the record's `path`, `approver` and `approved_at`
+- S-008-4: `test_s008_4_off_a_terminal_nothing_is_approved` and `test_s008_4_a_mistyped_release_id_approves_nothing`, exit 4 `PERSON_REQUIRED` and `ATTESTATION_MISMATCH` with and without `--yes`, and the approvals folder stayed empty
+- S-008-5: `test_s008_5_the_deploy_tool_refuses_an_unapproved_manual_release` and `test_s008_5_the_project_instructions_name_release_approve`, no `release_approve` tool was listed and the `deploy` tool with `yes: true` returned `PRECONDITION` with `deployment_approval_missing`
+- S-008-6: `test_s008_6_a_record_for_another_archive_does_not_count`, `test_s008_6_a_record_for_other_servers_does_not_count`, `test_s008_6_an_expired_record_does_not_count` and `test_s008_6_the_servers_are_compared_as_a_set`, each refusal listed the record with `digest_mismatch`, `servers_changed` or `expired`, and servers in another order still counted
+- S-008-7: `test_s008_7_a_record_for_another_release_or_component_does_not_count`, refused with `deployment_approval_missing` and neither record listed
+- S-008-8: `test_s008_8_the_plan_shows_the_approval_before_and_after_it_is_given` and `test_s008_8_the_latest_counting_approval_is_shown`, exit 0 with no playbook run, `status: missing` with `command` before the approval and `status: approved` with `path`, `approver` and `expires_at` after it, the latest of two counting records shown
+- S-008-9: `test_s008_9_an_automatic_application_needs_no_record`, plan and `--yes` both exit 0 with `approval: {"policy": "automatic"}` beside an approvals file that isn't JSON, and the deploy ran
+- S-008-10: `test_s008_10_a_broken_record_stops_a_manual_deploy` and `test_s008_10_deploy_declares_record_invalid`, exit 86 `RECORD_INVALID` naming the file for invalid JSON, a schema mismatch and a non-object, plan and `--yes` alike, and `deploy --schema` declares the exit
+- S-008-11: `test_s008_11_an_automatic_application_needs_no_approval`, `test_s008_11_a_missing_artifact_is_refused_before_asking` and `test_s008_11_a_tampered_artifact_is_refused_before_asking`, `PRECONDITION` with `release_approval_not_required`, `lifecycle_artifact_missing` and `lifecycle_artifact_digest_mismatch`, no prompt and no file
+- S-008-12: `test_s008_12_a_validity_out_of_range_is_a_usage_error` and `test_s008_12_a_validity_of_two_hours_expires_two_hours_later`, `--valid-for 0` and `169` were usage errors naming `--valid-for`, and `2` wrote `expiresAt` two hours after `approvedAt`
+- S-008-13: `test_s008_13_rollback_needs_no_approval`, for a `manual` application the plan showed `approval` with `policy: manual`, `required: false` and a reason, and `rollback --yes` ran the rollback playbook with no approvals folder at all; an `automatic` application's plan showed `{"policy": "automatic"}`
+- S-008-14: `test_s008_14_migrate_pauses_for_an_approval_and_resumes_without_a_rebuild`, `migrate --build crm-backend=main --yes` exited 3 `PARTIAL_FAILURE` at `deploy:crm-backend` with `deployment_approval_missing`, the release the completed build step recorded and the `release approve` command, no deploy playbook ran; after `release approve`, with the source repository deleted so a second build could not succeed, `migrate --yes` completed `deploy:crm-backend` with that release and the record as its `approval`, and the artifacts folder held the same files. `test_s008_14_a_broken_approval_record_stops_the_deploy_step` (exit 86 `RECORD_INVALID`) and `test_s008_14_an_automatic_application_migrates_without_a_record` cover the step's other answers
+- S-008-15: `test_s008_15_a_failed_health_gate_keeps_the_approval_for_a_retry`, the failed deploy exited `ENGINE_STEP_FAILED`, the record's bytes were unchanged and the retry deployed on the same record
+- S-008-16: `test_s008_16_the_changelog_and_ci_guide_say_deploy_enforces_manual`, the fragment's `### Breaking` entry names `deploy --yes`, `migrate --yes`, `approval: manual`, `cloudfall release approve` and `approval: automatic`, and the CI guide names `cloudfall release approve` and no longer says no command acts on `approval`

{cloudfall-0.8.0rc13 → cloudfall-0.8.0rc15}/engine/src/cloudfall_engine/cli.py

@@ -17,6 +17,7 @@ from importlib.metadata import version
 from pathlib import Path
 from typing import TYPE_CHECKING, Self, cast
 
+from cloudfall.ansible_data import as_ansible_data, unmarked
 from cloudfall.commands import snake_case_keys
 from cloudfall.domain import (
     ARTIFACT_CLONE_TIMEOUT_SECONDS,
@@ -223,8 +224,14 @@ class RenderedInventory:
     ],
 )
 def render(args: RenderArgs, _ctx: Ctx, project: Project) -> RenderedInventory:
-    """Render the inventory, and write it when ``--output`` names a file."""
-    rendered = render_ansible_inventory(project.inventory)
+    """Render the inventory, and write it when ``--output`` names a file.
+
+    Every declared string is marked unsafe, so Ansible never templates it.
+    """
+    rendered = cast(
+        "dict[str, object]",
+        as_ansible_data(render_ansible_inventory(project.inventory)),
+    )
     if args.output is None:
         return RenderedInventory(rendered)
     output = project.path(args.output)
@@ -595,8 +602,12 @@ def _rendered_owned_databases(
     if not inventory_file.is_file():
         return ()
     try:
+        # The rendered strings are marked unsafe for Ansible (#174).
         document = cast(
-            "object", json.loads(inventory_file.read_text(encoding="utf-8"))
+            "object",
+            json.loads(
+                inventory_file.read_text(encoding="utf-8"), object_hook=unmarked
+            ),
         )
     except (UnicodeDecodeError, json.JSONDecodeError):
         return ()

cloudfall-0.8.0rc15/engine/tests/golden/examples/ansible-inventory.json

@@ -0,0 +1 @@
+{"all": {"children": {"cloudfall_applications": {"children": {"application_crm": {"hosts": {"h1": {}, "h2": {}}}}}, "cloudfall_components": {"children": {"component_crm_backend": {"hosts": {"h1": {}, "h2": {}}}}}, "cloudfall_domain_origins": {"hosts": {"h1": {}}}, "cloudfall_environments": {"children": {"environment_production": {"hosts": {"h1": {}, "h2": {}}}}}, "cloudfall_logging_backends": {"hosts": {"h1": {}}}, "cloudfall_logging_collectors": {"hosts": {"h1": {}, "h2": {}}}, "cloudfall_release_servers": {"hosts": {}}, "cloudfall_servers": {"hosts": {"h1": {"ansible_host": {"__ansible_unsafe": "h1.example.internal"}, "ansible_port": 22, "ansible_user": {"__ansible_unsafe": "cloudfall"}, "cloudfall_alert_rules": [{"environment": {"__ansible_unsafe": "production"}, "expr": {"__ansible_unsafe": "pg_up{service=\"postgresql-main\"} == 0"}, "for": {"__ansible_unsafe": "1m"}, "id": {"__ansible_unsafe": "postgresql-down"}, "severity": {"__ansible_unsafe": "critical"}, "summary": {"__ansible_unsafe": "PostgreSQL postgresql-main is not answering its exporter"}}], "cloudfall_applications": [{"approval": {"__ansible_unsafe": "manual"}, "id": {"__ansible_unsafe": "crm"}, "user": {"__ansible_unsafe": "crm"}}], "cloudfall_components": [{"application": {"__ansible_unsafe": "crm"}, "application_user": {"__ansible_unsafe": "crm"}, "healthCheck": {"attempts": 5, "expectedStatuses": [200], "path": {"__ansible_unsafe": "/health"}, "port": 8100, "scheme": {"__ansible_unsafe": "http"}, "timeoutSeconds": 5, "type": {"__ansible_unsafe": "http"}}, "id": {"__ansible_unsafe": "crm-backend"}, "install_root": {"__ansible_unsafe": "/srv/apps/crm/backend"}, "repository": {"url": {"__ansible_unsafe": "https://github.com/example/crm-backend.git"}}, "retainUntilCleanup": true, "runtime": {"packageManager": {"__ansible_unsafe": "uv"}, "type": {"__ansible_unsafe": "python"}, "version": {"__ansible_unsafe": "3.14"}}, "service": {"command": [{"__ansible_unsafe": ".venv/bin/uvicorn"}, {"__ansible_unsafe": "crm.asgi:application"}, {"__ansible_unsafe": "--host"}, {"__ansible_unsafe": "127.0.0.1"}, {"__ansible_unsafe": "--port"}, {"__ansible_unsafe": "8100"}], "manager": {"__ansible_unsafe": "systemd"}, "name": {"__ansible_unsafe": "crm-backend"}}}], "cloudfall_domains": [], "cloudfall_environment": {"__ansible_unsafe": "production"}, "cloudfall_firewall": {"allowedInbound": [{"description": {"__ansible_unsafe": "ssh"}, "port": 22, "protocol": {"__ansible_unsafe": "tcp"}}, {"description": {"__ansible_unsafe": "http"}, "port": 80, "protocol": {"__ansible_unsafe": "tcp"}}, {"description": {"__ansible_unsafe": "https"}, "port": 443, "protocol": {"__ansible_unsafe": "tcp"}}], "policy": {"__ansible_unsafe": "default-deny"}}, "cloudfall_hostname": {"__ansible_unsafe": "h1.example.internal"}, "cloudfall_labels": {"region": {"__ansible_unsafe": "eu-central"}, "workload": {"__ansible_unsafe": "application"}}, "cloudfall_lifecycle": {"__ansible_unsafe": "active"}, "cloudfall_logging_backend": {"alerting": {"alertmanager": {"listenAddress": {"__ansible_unsafe": "127.0.0.1"}, "port": 9093}, "receivers": [{"id": {"__ansible_unsafe": "operations-webhook"}, "webhook": {"url": {"__ansible_unsafe": "https://hooks.example.internal/cloudfall"}}}, {"email": {"authPasswordFile": {"__ansible_unsafe": "/etc/cloudfall/logging/smtp-password"}, "authUsername": {"__ansible_unsafe": "alerts@example.internal"}, "from": {"__ansible_unsafe": "alerts@example.internal"}, "smarthost": {"__ansible_unsafe": "smtp.example.internal:587"}, "to": {"__ansible_unsafe": "oncall@example.internal"}}, "id": {"__ansible_unsafe": "operations-email"}}]}, "backend": {"listenAddress": {"__ansible_unsafe": "127.0.0.1"}, "port": 3100, "retentionHours": 720, "server": {"__ansible_unsafe": "h1"}, "storage": {"path": {"__ansible_unsafe": "/var/lib/loki-cloudfall"}, "type": {"__ansible_unsafe": "filesystem"}}}, "collectors": {"clientTls": {"caPath": {"__ansible_unsafe": "/etc/cloudfall/logging/ca.crt"}, "certificatePath": {"__ansible_unsafe": "/etc/cloudfall/logging/client.crt"}, "keyPath": {"__ansible_unsafe": "/etc/cloudfall/logging/client.key"}}, "files": [{"application": {"__ansible_unsafe": "crm"}, "component": {"__ansible_unsafe": "crm-backend"}, "id": {"__ansible_unsafe": "crm-backend"}, "path": {"__ansible_unsafe": "/var/log/crm/backend/*.log"}, "servers": [{"__ansible_unsafe": "h1"}, {"__ansible_unsafe": "h2"}]}], "journal": {"enabled": true, "maxAgeHours": 24}, "servers": [{"__ansible_unsafe": "h1"}, {"__ansible_unsafe": "h2"}]}, "environment": {"__ansible_unsafe": "production"}, "gateway": {"listenAddress": {"__ansible_unsafe": "0.0.0.0"}, "port": 3101, "serverName": {"__ansible_unsafe": "logs.example.internal"}, "tls": {"certificatePath": {"__ansible_unsafe": "/etc/cloudfall/logging/server.crt"}, "clientCaPath": {"__ansible_unsafe": "/etc/cloudfall/logging/client-ca.crt"}, "keyPath": {"__ansible_unsafe": "/etc/cloudfall/logging/server.key"}}}, "grafana": {"adminPasswordPath": {"__ansible_unsafe": "/etc/cloudfall/logging/grafana-admin-password"}, "listenAddress": {"__ansible_unsafe": "127.0.0.1"}, "port": 3000}, "id": {"__ansible_unsafe": "operations"}, "metrics": {"backend": {"listenAddress": {"__ansible_unsafe": "127.0.0.1"}, "port": 9090, "retentionHours": 360, "storagePath": {"__ansible_unsafe": "/var/lib/prometheus-cloudfall"}}, "collection": {"intervalSeconds": 60}}, "migration": {"mode": {"__ansible_unsafe": "parallel"}, "preserveLegacyAgents": true}, "software": {"alloyPackageVersion": {"__ansible_unsafe": "1.17.1-1"}, "grafanaPackageVersion": {"__ansible_unsafe": "13.1.0"}, "lokiPackageVersion": {"__ansible_unsafe": "3.7.2"}}}, "cloudfall_logging_collector": {"alerting": {"alertmanager": {"listenAddress": {"__ansible_unsafe": "127.0.0.1"}, "port": 9093}, "receivers": [{"id": {"__ansible_unsafe": "operations-webhook"}, "webhook": {"url": {"__ansible_unsafe": "https://hooks.example.internal/cloudfall"}}}, {"email": {"authPasswordFile": {"__ansible_unsafe": "/etc/cloudfall/logging/smtp-password"}, "authUsername": {"__ansible_unsafe": "alerts@example.internal"}, "from": {"__ansible_unsafe": "alerts@example.internal"}, "smarthost": {"__ansible_unsafe": "smtp.example.internal:587"}, "to": {"__ansible_unsafe": "oncall@example.internal"}}, "id": {"__ansible_unsafe": "operations-email"}}]}, "backend": {"listenAddress": {"__ansible_unsafe": "127.0.0.1"}, "port": 3100, "retentionHours": 720, "server": {"__ansible_unsafe": "h1"}, "storage": {"path": {"__ansible_unsafe": "/var/lib/loki-cloudfall"}, "type": {"__ansible_unsafe": "filesystem"}}}, "collectors": {"clientTls": {"caPath": {"__ansible_unsafe": "/etc/cloudfall/logging/ca.crt"}, "certificatePath": {"__ansible_unsafe": "/etc/cloudfall/logging/client.crt"}, "keyPath": {"__ansible_unsafe": "/etc/cloudfall/logging/client.key"}}, "files": [{"application": {"__ansible_unsafe": "crm"}, "component": {"__ansible_unsafe": "crm-backend"}, "id": {"__ansible_unsafe": "crm-backend"}, "path": {"__ansible_unsafe": "/var/log/crm/backend/*.log"}, "servers": [{"__ansible_unsafe": "h1"}, {"__ansible_unsafe": "h2"}]}], "journal": {"enabled": true, "maxAgeHours": 24}, "servers": [{"__ansible_unsafe": "h1"}, {"__ansible_unsafe": "h2"}]}, "environment": {"__ansible_unsafe": "production"}, "gateway": {"listenAddress": {"__ansible_unsafe": "0.0.0.0"}, "port": 3101, "serverName": {"__ansible_unsafe": "logs.example.internal"}, "tls": {"certificatePath": {"__ansible_unsafe": "/etc/cloudfall/logging/server.crt"}, "clientCaPath": {"__ansible_unsafe": "/etc/cloudfall/logging/client-ca.crt"}, "keyPath": {"__ansible_unsafe": "/etc/cloudfall/logging/server.key"}}}, "grafana": {"adminPasswordPath": {"__ansible_unsafe": "/etc/cloudfall/logging/grafana-admin-password"}, "listenAddress": {"__ansible_unsafe": "127.0.0.1"}, "port": 3000}, "id": {"__ansible_unsafe": "operations"}, "metrics": {"backend": {"listenAddress": {"__ansible_unsafe": "127.0.0.1"}, "port": 9090, "retentionHours": 360, "storagePath": {"__ansible_unsafe": "/var/lib/prometheus-cloudfall"}}, "collection": {"intervalSeconds": 60}}, "migration": {"mode": {"__ansible_unsafe": "parallel"}, "preserveLegacyAgents": true}, "software": {"alloyPackageVersion": {"__ansible_unsafe": "1.17.1-1"}, "grafanaPackageVersion": {"__ansible_unsafe": "13.1.0"}, "lokiPackageVersion": {"__ansible_unsafe": "3.7.2"}}}, "cloudfall_origin_domains": [{"aliases": [{"__ansible_unsafe": "www.crm.example.test"}], "edge": {"mode": {"__ansible_unsafe": "dns-only"}, "provider": {"__ansible_unsafe": "cloudflare"}}, "healthCheck": {"expectedStatuses": [200], "path": {"__ansible_unsafe": "/health"}, "scheme": {"__ansible_unsafe": "https"}, "timeoutSeconds": 5}, "id": {"__ansible_unsafe": "crm-site"}, "origin": {"configurationPath": {"__ansible_unsafe": "/etc/nginx/sites-available/crm-origin.conf"}, "port": 8100, "scheme": {"__ansible_unsafe": "http"}, "server": {"__ansible_unsafe": "h1"}, "serverName": {"__ansible_unsafe": "crm.example.test"}, "service": {"__ansible_unsafe": "nginx.service"}}, "primaryName": {"__ansible_unsafe": "crm.example.test"}, "proxy": {"configurationPath": {"__ansible_unsafe": "/etc/nginx/sites-available/crm.example.test.conf"}, "server": {"__ansible_unsafe": "h2"}, "service": {"__ansible_unsafe": "nginx.service"}, "upstream": {"address": {"__ansible_unsafe": "127.0.0.1"}, "port": 8100}}, "tls": {"mode": {"__ansible_unsafe": "required"}}}], "cloudfall_server_id": {"__ansible_unsafe": "h1"}, "cloudfall_server_type": {"configuration": {"files": [{"capture": {"__ansible_unsafe": "hash"}, "group": {"__ansible_unsafe": "root"}, "mode": {"__ansible_unsafe": "0644"}, "owner": {"__ansible_unsafe": "root"}, "path": {"__ansible_unsafe": "/etc/ssh/sshd_config"}}]}, "firewall": {"allowedInbound": [{"description": {"__ansible_unsafe": "http"}, "port": 80, "protocol": {"__ansible_unsafe": "tcp"}}, {"description": {"__ansible_unsafe": "https"}, "port": 443, "protocol": {"__ansible_unsafe": "tcp"}}], "policy": {"__ansible_unsafe": "default-deny"}}, "id": {"__ansible_unsafe": "debian-application"}, "os": {"distribution": {"__ansible_unsafe": "Debian"}, "serviceManager": {"__ansible_unsafe": "systemd"}, "versions": [{"__ansible_unsafe": "12"}, {"__ansible_unsafe": "13"}]}, "packages": {"forbidden": [{"__ansible_unsafe": "telnetd"}], "required": [{"name": {"__ansible_unsafe": "acl"}}, {"name": {"__ansible_unsafe": "ca-certificates"}}, {"name": {"__ansible_unsafe": "curl"}}, {"name": {"__ansible_unsafe": "git"}}, {"name": {"__ansible_unsafe": "rsync"}}, {"name": {"__ansible_unsafe": "unzip"}}]}, "services": {"required": [{"name": {"__ansible_unsafe": "ssh.service"}, "state": {"__ansible_unsafe": "running"}, "status": {"__ansible_unsafe": "enabled"}}, {"name": {"__ansible_unsafe": "apt-daily.timer"}, "state": {"__ansible_unsafe": "running"}, "status": {"__ansible_unsafe": "enabled"}}]}, "storage": {"mounts": [{"filesystem": {"__ansible_unsafe": "ext4"}, "minimumBytes": 850000000000, "path": {"__ansible_unsafe": "/"}}], "softwareRaid": {"level": {"__ansible_unsafe": "raid1"}, "minimumActiveDevices": 2, "minimumUsableBytes": 900000000000}}}, "cloudfall_services": [{"backup": {"directory": {"__ansible_unsafe": "/var/backups/cloudfall/postgresql-main"}, "onCalendar": {"__ansible_unsafe": "*-*-* 02:00:00 UTC"}, "restoreCheckOnCalendar": {"__ansible_unsafe": "*-*-* 05:00:00 UTC"}, "retentionDays": 14}, "bind": {"address": {"__ansible_unsafe": "127.0.0.1"}, "port": 5432}, "environment": {"__ansible_unsafe": "production"}, "id": {"__ansible_unsafe": "postgresql-main"}, "metrics": {"enabled": true}, "postgresql": {"databases": [{"application": {"__ansible_unsafe": "crm"}, "name": {"__ansible_unsafe": "crm"}, "owner": {"__ansible_unsafe": "crm"}}], "majorVersion": {"__ansible_unsafe": "17"}}, "server": {"__ansible_unsafe": "h1"}, "serviceKind": {"__ansible_unsafe": "postgresql"}}, {"backup": {"directory": {"__ansible_unsafe": "/var/backups/cloudfall/redis-cache"}, "onCalendar": {"__ansible_unsafe": "*-*-* 03:00:00 UTC"}, "restoreCheckOnCalendar": {"__ansible_unsafe": "*-*-* 05:30:00 UTC"}, "retentionDays": 7}, "bind": {"address": {"__ansible_unsafe": "127.0.0.1"}, "port": 6379}, "environment": {"__ansible_unsafe": "production"}, "id": {"__ansible_unsafe": "redis-cache"}, "metrics": {"enabled": true}, "redis": {"appendOnly": true, "maxmemoryMb": 256}, "server": {"__ansible_unsafe": "h1"}, "serviceKind": {"__ansible_unsafe": "redis"}}], "cloudfall_ssh_public_keys": [{"algorithm": {"__ansible_unsafe": "ssh-rsa"}, "environment": {"__ansible_unsafe": "production"}, "id": {"__ansible_unsafe": "example-admin"}, "lifecycle": {"__ansible_unsafe": "active"}, "owner": {"__ansible_unsafe": "example-admin"}, "publicKey": {"__ansible_unsafe": "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCqmOqPPapyG6hL5FlR/KOK2ENEvi/2qlhoRtrgK7JfafHXb1i4WJwf5FMGrPE4DBRfDQDwokABdvUPITZOymFMgiGMmFKGnp0xq+/B0wTTOtdnr8GC3sCmSRwuFDrroVWwfjIqyC/wlpoPXpSvyc1VKBuXOe/gLv1tTzDH3Jc+3fUYaUCj+uIVO65n0N2ajNg9ibBsCjiUp9CrWEoprqxR4lz3TaiPuRtMxWQlQ2NKPSTdUZWqg9KVXm3TS8xgf4Ox2dFwedVMcucC8UBBAwetgylXNZMv1yAMYD3QDokLi0AC+XnNR+UhtFXr9Y3VveQfH4YKnv0Fhr2opCyN99Lr example"}}]}, "h2": {"ansible_host": {"__ansible_unsafe": "h2.example.internal"}, "ansible_port": 22, "ansible_user": {"__ansible_unsafe": "cloudfall"}, "cloudfall_applications": [{"approval": {"__ansible_unsafe": "manual"}, "id": {"__ansible_unsafe": "crm"}, "user": {"__ansible_unsafe": "crm"}}], "cloudfall_components": [{"application": {"__ansible_unsafe": "crm"}, "application_user": {"__ansible_unsafe": "crm"}, "healthCheck": {"attempts": 5, "expectedStatuses": [200], "path": {"__ansible_unsafe": "/health"}, "port": 8100, "scheme": {"__ansible_unsafe": "http"}, "timeoutSeconds": 5, "type": {"__ansible_unsafe": "http"}}, "id": {"__ansible_unsafe": "crm-backend"}, "install_root": {"__ansible_unsafe": "/srv/apps/crm/backend"}, "repository": {"url": {"__ansible_unsafe": "https://github.com/example/crm-backend.git"}}, "retainUntilCleanup": true, "runtime": {"packageManager": {"__ansible_unsafe": "uv"}, "type": {"__ansible_unsafe": "python"}, "version": {"__ansible_unsafe": "3.14"}}, "service": {"command": [{"__ansible_unsafe": ".venv/bin/uvicorn"}, {"__ansible_unsafe": "crm.asgi:application"}, {"__ansible_unsafe": "--host"}, {"__ansible_unsafe": "127.0.0.1"}, {"__ansible_unsafe": "--port"}, {"__ansible_unsafe": "8100"}], "manager": {"__ansible_unsafe": "systemd"}, "name": {"__ansible_unsafe": "crm-backend"}}}], "cloudfall_domains": [{"aliases": [{"__ansible_unsafe": "www.crm.example.test"}], "edge": {"mode": {"__ansible_unsafe": "dns-only"}, "provider": {"__ansible_unsafe": "cloudflare"}}, "healthCheck": {"expectedStatuses": [200], "path": {"__ansible_unsafe": "/health"}, "scheme": {"__ansible_unsafe": "https"}, "timeoutSeconds": 5}, "id": {"__ansible_unsafe": "crm-site"}, "origin": {"configurationPath": {"__ansible_unsafe": "/etc/nginx/sites-available/crm-origin.conf"}, "port": 8100, "scheme": {"__ansible_unsafe": "http"}, "server": {"__ansible_unsafe": "h1"}, "serverName": {"__ansible_unsafe": "crm.example.test"}, "service": {"__ansible_unsafe": "nginx.service"}}, "primaryName": {"__ansible_unsafe": "crm.example.test"}, "proxy": {"configurationPath": {"__ansible_unsafe": "/etc/nginx/sites-available/crm.example.test.conf"}, "server": {"__ansible_unsafe": "h2"}, "service": {"__ansible_unsafe": "nginx.service"}, "upstream": {"address": {"__ansible_unsafe": "127.0.0.1"}, "port": 8100}}, "tls": {"mode": {"__ansible_unsafe": "required"}}}], "cloudfall_environment": {"__ansible_unsafe": "production"}, "cloudfall_firewall": {"allowedInbound": [{"description": {"__ansible_unsafe": "ssh"}, "port": 22, "protocol": {"__ansible_unsafe": "tcp"}}, {"description": {"__ansible_unsafe": "http"}, "port": 80, "protocol": {"__ansible_unsafe": "tcp"}}, {"description": {"__ansible_unsafe": "https"}, "port": 443, "protocol": {"__ansible_unsafe": "tcp"}}], "policy": {"__ansible_unsafe": "default-deny"}}, "cloudfall_hostname": {"__ansible_unsafe": "h2.example.internal"}, "cloudfall_labels": {"region": {"__ansible_unsafe": "eu-central"}, "workload": {"__ansible_unsafe": "application"}}, "cloudfall_lifecycle": {"__ansible_unsafe": "active"}, "cloudfall_logging_collector": {"alerting": {"alertmanager": {"listenAddress": {"__ansible_unsafe": "127.0.0.1"}, "port": 9093}, "receivers": [{"id": {"__ansible_unsafe": "operations-webhook"}, "webhook": {"url": {"__ansible_unsafe": "https://hooks.example.internal/cloudfall"}}}, {"email": {"authPasswordFile": {"__ansible_unsafe": "/etc/cloudfall/logging/smtp-password"}, "authUsername": {"__ansible_unsafe": "alerts@example.internal"}, "from": {"__ansible_unsafe": "alerts@example.internal"}, "smarthost": {"__ansible_unsafe": "smtp.example.internal:587"}, "to": {"__ansible_unsafe": "oncall@example.internal"}}, "id": {"__ansible_unsafe": "operations-email"}}]}, "backend": {"listenAddress": {"__ansible_unsafe": "127.0.0.1"}, "port": 3100, "retentionHours": 720, "server": {"__ansible_unsafe": "h1"}, "storage": {"path": {"__ansible_unsafe": "/var/lib/loki-cloudfall"}, "type": {"__ansible_unsafe": "filesystem"}}}, "collectors": {"clientTls": {"caPath": {"__ansible_unsafe": "/etc/cloudfall/logging/ca.crt"}, "certificatePath": {"__ansible_unsafe": "/etc/cloudfall/logging/client.crt"}, "keyPath": {"__ansible_unsafe": "/etc/cloudfall/logging/client.key"}}, "files": [{"application": {"__ansible_unsafe": "crm"}, "component": {"__ansible_unsafe": "crm-backend"}, "id": {"__ansible_unsafe": "crm-backend"}, "path": {"__ansible_unsafe": "/var/log/crm/backend/*.log"}, "servers": [{"__ansible_unsafe": "h1"}, {"__ansible_unsafe": "h2"}]}], "journal": {"enabled": true, "maxAgeHours": 24}, "servers": [{"__ansible_unsafe": "h1"}, {"__ansible_unsafe": "h2"}]}, "environment": {"__ansible_unsafe": "production"}, "gateway": {"listenAddress": {"__ansible_unsafe": "0.0.0.0"}, "port": 3101, "serverName": {"__ansible_unsafe": "logs.example.internal"}, "tls": {"certificatePath": {"__ansible_unsafe": "/etc/cloudfall/logging/server.crt"}, "clientCaPath": {"__ansible_unsafe": "/etc/cloudfall/logging/client-ca.crt"}, "keyPath": {"__ansible_unsafe": "/etc/cloudfall/logging/server.key"}}}, "grafana": {"adminPasswordPath": {"__ansible_unsafe": "/etc/cloudfall/logging/grafana-admin-password"}, "listenAddress": {"__ansible_unsafe": "127.0.0.1"}, "port": 3000}, "id": {"__ansible_unsafe": "operations"}, "metrics": {"backend": {"listenAddress": {"__ansible_unsafe": "127.0.0.1"}, "port": 9090, "retentionHours": 360, "storagePath": {"__ansible_unsafe": "/var/lib/prometheus-cloudfall"}}, "collection": {"intervalSeconds": 60}}, "migration": {"mode": {"__ansible_unsafe": "parallel"}, "preserveLegacyAgents": true}, "software": {"alloyPackageVersion": {"__ansible_unsafe": "1.17.1-1"}, "grafanaPackageVersion": {"__ansible_unsafe": "13.1.0"}, "lokiPackageVersion": {"__ansible_unsafe": "3.7.2"}}}, "cloudfall_origin_domains": [], "cloudfall_server_id": {"__ansible_unsafe": "h2"}, "cloudfall_server_type": {"configuration": {"files": [{"capture": {"__ansible_unsafe": "hash"}, "group": {"__ansible_unsafe": "root"}, "mode": {"__ansible_unsafe": "0644"}, "owner": {"__ansible_unsafe": "root"}, "path": {"__ansible_unsafe": "/etc/ssh/sshd_config"}}]}, "firewall": {"allowedInbound": [{"description": {"__ansible_unsafe": "http"}, "port": 80, "protocol": {"__ansible_unsafe": "tcp"}}, {"description": {"__ansible_unsafe": "https"}, "port": 443, "protocol": {"__ansible_unsafe": "tcp"}}], "policy": {"__ansible_unsafe": "default-deny"}}, "id": {"__ansible_unsafe": "debian-application"}, "os": {"distribution": {"__ansible_unsafe": "Debian"}, "serviceManager": {"__ansible_unsafe": "systemd"}, "versions": [{"__ansible_unsafe": "12"}, {"__ansible_unsafe": "13"}]}, "packages": {"forbidden": [{"__ansible_unsafe": "telnetd"}], "required": [{"name": {"__ansible_unsafe": "acl"}}, {"name": {"__ansible_unsafe": "ca-certificates"}}, {"name": {"__ansible_unsafe": "curl"}}, {"name": {"__ansible_unsafe": "git"}}, {"name": {"__ansible_unsafe": "rsync"}}, {"name": {"__ansible_unsafe": "unzip"}}]}, "services": {"required": [{"name": {"__ansible_unsafe": "ssh.service"}, "state": {"__ansible_unsafe": "running"}, "status": {"__ansible_unsafe": "enabled"}}, {"name": {"__ansible_unsafe": "apt-daily.timer"}, "state": {"__ansible_unsafe": "running"}, "status": {"__ansible_unsafe": "enabled"}}]}, "storage": {"mounts": [{"filesystem": {"__ansible_unsafe": "ext4"}, "minimumBytes": 850000000000, "path": {"__ansible_unsafe": "/"}}], "softwareRaid": {"level": {"__ansible_unsafe": "raid1"}, "minimumActiveDevices": 2, "minimumUsableBytes": 900000000000}}}, "cloudfall_services": [], "cloudfall_ssh_public_keys": [{"algorithm": {"__ansible_unsafe": "ssh-rsa"}, "environment": {"__ansible_unsafe": "production"}, "id": {"__ansible_unsafe": "example-admin"}, "lifecycle": {"__ansible_unsafe": "active"}, "owner": {"__ansible_unsafe": "example-admin"}, "publicKey": {"__ansible_unsafe": "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCqmOqPPapyG6hL5FlR/KOK2ENEvi/2qlhoRtrgK7JfafHXb1i4WJwf5FMGrPE4DBRfDQDwokABdvUPITZOymFMgiGMmFKGnp0xq+/B0wTTOtdnr8GC3sCmSRwuFDrroVWwfjIqyC/wlpoPXpSvyc1VKBuXOe/gLv1tTzDH3Jc+3fUYaUCj+uIVO65n0N2ajNg9ibBsCjiUp9CrWEoprqxR4lz3TaiPuRtMxWQlQ2NKPSTdUZWqg9KVXm3TS8xgf4Ox2dFwedVMcucC8UBBAwetgylXNZMv1yAMYD3QDokLi0AC+XnNR+UhtFXr9Y3VveQfH4YKnv0Fhr2opCyN99Lr example"}}]}}}, "ungrouped": {"hosts": {}}}}}

{cloudfall-0.8.0rc13 → cloudfall-0.8.0rc15}/engine/tests/test_ansible_inventory.py

@@ -359,10 +359,10 @@ def test_engine_cli_emits_ansible_json(
     assert document["ok"] is True
     assert document["data"]["output"] is None
     inventory = document["data"]["inventory"]
-    assert (
-        inventory["all"]["children"]["cloudfall_servers"]["hosts"]["h1"]["ansible_user"]
-        == "cloudfall"
-    )
+    h1 = inventory["all"]["children"]["cloudfall_servers"]["hosts"]["h1"]
+    # Declared strings are marked unsafe so Ansible never templates them (#174).
+    assert h1["ansible_user"] == {"__ansible_unsafe": "cloudfall"}
+    assert h1["ansible_port"] == 22
     assert (
         "component_crm_backend"
         in inventory["all"]["children"]["cloudfall_components"]["children"]

{cloudfall-0.8.0rc13 → cloudfall-0.8.0rc15}/engine/tests/test_examples_render_unchanged.py

@@ -11,6 +11,7 @@ import json
 from pathlib import Path
 from typing import TYPE_CHECKING, cast
 
+from cloudfall.ansible_data import unmarked
 from cloudfall_engine.cli import main
 from jinja2 import Environment, FileSystemLoader, StrictUndefined
 
@@ -58,7 +59,11 @@ def render_examples(output: Path) -> dict[str, str]:
     assert exit_code == 0
     inventory_text = inventory_path.read_text(encoding="utf-8")
     rendered = {"ansible-inventory.json": inventory_text}
-    document = cast("dict[str, dict[str, object]]", json.loads(inventory_text))
+    # Read the values back as Ansible's loader does: an unsafe string is text.
+    document = cast(
+        "dict[str, dict[str, object]]",
+        json.loads(inventory_text, object_hook=unmarked),
+    )
     servers = cast(
         "dict[str, dict[str, dict[str, dict[str, object]]]]",
         document["all"]["children"],