ignition-stack 0.1.0__tar.gz → 0.2.0__tar.gz

{ignition_stack-0.1.0 → ignition_stack-0.2.0}/.gitignore

@@ -30,8 +30,3 @@ Thumbs.db
 .env
 .env.local
 *.env
-
-# Phase-1 POC artifacts (transient container outputs)
-scripts/seeding-poc/runs/
-scripts/seeding-poc/.modl-cache/
-# Screenshots ARE committed - they're the matrix's evidence.

ignition_stack-0.2.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 Eric Knorr
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

{ignition_stack-0.1.0 → ignition_stack-0.2.0}/PKG-INFO

@@ -1,12 +1,14 @@
 Metadata-Version: 2.4
 Name: ignition-stack
-Version: 0.1.0
+Version: 0.2.0
 Summary: CLI that generates ready-to-run Docker Compose stacks for Ignition 8.3 SCADA demos and SE engagements
-Author-email: Ethan Knorr <eknorr@inductiveautomation.com>
-License: Apache-2.0
+Author-email: Eric Knorr <etknorr@gmail.com>
+License: MIT
+License-File: LICENSE
 Keywords: compose,docker,ignition,sales-engineering,scada
 Classifier: Development Status :: 2 - Pre-Alpha
 Classifier: Environment :: Console
+Classifier: License :: OSI Approved :: MIT License
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Topic :: System :: Installation/Setup
@@ -23,9 +25,6 @@ Requires-Dist: typer>=0.12
 Provides-Extra: dev
 Requires-Dist: pytest>=8.3; extra == 'dev'
 Requires-Dist: ruff>=0.7; extra == 'dev'
-Provides-Extra: poc
-Requires-Dist: httpx>=0.27; extra == 'poc'
-Requires-Dist: playwright>=1.49; extra == 'poc'
 Description-Content-Type: text/markdown
 
 # ignition-stack

ignition_stack-0.2.0/ignition_stack/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.2.0"

{ignition_stack-0.1.0 → ignition_stack-0.2.0}/ignition_stack/cli.py

@@ -13,6 +13,7 @@ interactive wizard when no profile is named.
 from __future__ import annotations
 
 import subprocess
+from dataclasses import replace
 from pathlib import Path
 
 import typer
@@ -20,9 +21,21 @@ from rich.console import Console
 
 from ignition_stack import __version__
 from ignition_stack.commands.modules import modules_app
-from ignition_stack.completion import complete_edge_role, complete_profile
+from ignition_stack.completion import (
+    complete_edge_role,
+    complete_output_format,
+    complete_profile,
+    complete_redundant_role,
+    complete_reverse_proxy,
+)
 from ignition_stack.compose import write_project
-from ignition_stack.config import ProjectConfig
+from ignition_stack.config import (
+    ConfigIOError,
+    ProjectConfig,
+    ReverseProxyConfig,
+    dump_config,
+    load_config,
+)
 from ignition_stack.lifecycle import (
     LIFECYCLE_DIR,
     RECORD_NAME,
@@ -37,9 +50,11 @@ from ignition_stack.profiles import (
     ProfileError,
     ProfileOptions,
     build_profile,
+    can_host_redundant_role,
     get_profile,
     list_profiles,
 )
+from ignition_stack.services.resolver import resolve
 from ignition_stack.wizard import run_wizard
 
 app = typer.Typer(
@@ -102,6 +117,34 @@ def init(
         help="Spoke gateway count for the hub-and-spoke profile (ignored otherwise).",
         min=0,
     ),
+    frontends: int = typer.Option(
+        1,
+        "--frontends",
+        help="Frontend gateway count for the scaleout profile (ignored otherwise).",
+        min=1,
+    ),
+    network_split: bool | None = typer.Option(
+        None,
+        "--network-split/--no-network-split",
+        help=(
+            "Force the frontend/backend network split on or off. Default follows "
+            "the profile (scaleout splits, hub-and-spoke does not)."
+        ),
+    ),
+    reverse_proxy: str | None = typer.Option(
+        None,
+        "--reverse-proxy",
+        help=(
+            "Scaffold a reverse proxy of the given kind ('traefik'). Lays down a "
+            "README + POST-SETUP entry at --proxy-path. Omit for plain host-port mapping."
+        ),
+        autocompletion=complete_reverse_proxy,
+    ),
+    proxy_path: str = typer.Option(
+        "reverse-proxy",
+        "--proxy-path",
+        help="Relative directory the reverse-proxy scaffold lives in (with --reverse-proxy).",
+    ),
     force: bool = typer.Option(
         False,
         "--force",
@@ -111,23 +154,49 @@ def init(
         None,
         "--edge-role",
         help=(
-            "Gateway role that runs the Ignition Edge edition. Scaleout defaults "
-            "to 'frontend'; hub-and-spoke defaults its spokes to Edge. Pass 'none' "
-            "to disable the profile's edge default; pass a role name ('hub', "
-            "'gateway', ...) to opt that specific role in."
+            "Gateway role that runs the Ignition Edge edition. Scaleout runs all "
+            "gateways standard by default; hub-and-spoke defaults its spokes to "
+            "Edge. Pass 'none' to disable the profile's edge default; pass a role "
+            "name ('frontend', 'hub', 'gateway', ...) to opt that specific role in."
         ),
         autocompletion=complete_edge_role,
     ),
-    keep_cli: bool = typer.Option(
+    redundant: str | None = typer.Option(
+        None,
+        "--redundant",
+        help=(
+            "Make a single gateway role redundant, expanding it into a master + "
+            "backup pair (e.g. 'backend' for scaleout, 'hub' for hub-and-spoke, "
+            "'gateway' for standalone). Frontends and spokes are replicated, not "
+            "paired, and are rejected."
+        ),
+        autocompletion=complete_redundant_role,
+    ),
+    from_file: Path | None = typer.Option(  # noqa: B008 - Typer pattern
+        None,
+        "--from-file",
+        "-f",
+        help=(
+            "Build from a saved config file (YAML or JSON, as dumped by "
+            "--dry-run) instead of a profile or the wizard. Mutually exclusive "
+            "with --profile. The project name argument overrides the file's name."
+        ),
+    ),
+    dry_run: bool = typer.Option(
         False,
-        "--keep-cli",
+        "--dry-run",
         help=(
-            "SE-demo mode: keep the lifecycle primitives in .ignition-stack/ so "
-            "`ignition-stack reset` / `switch-profile` can regenerate the project. "
-            "The default (one-shot) leaves a self-contained project with no CLI "
-            "primitives behind."
+            "Resolve the config and print it (see --output-format) without "
+            "writing any files. The dump is the full build input; redirect it to "
+            "a file, edit it, and rebuild with --from-file."
         ),
     ),
+    output_format: str | None = typer.Option(
+        None,
+        "--output-format",
+        help="Format for the --dry-run dump: 'yaml' (default) or 'json'.",
+        autocompletion=complete_output_format,
+    ),
     output_dir: Path | None = typer.Option(  # noqa: B008 - Typer pattern
         None,
         "--output-dir",
@@ -137,11 +206,15 @@ def init(
 ) -> None:
     """Generate a new Ignition stack at ``<output-dir>/<name>``.
 
-    With ``--profile``, runs non-interactively from the named profile and its
-    flags. Without ``--profile``, walks the interactive wizard.
+    With ``--from-file``, builds from a saved config file. With ``--profile``,
+    runs non-interactively from the named profile and its flags. With neither,
+    walks the interactive wizard. ``--dry-run`` resolves the config and prints
+    it instead of writing anything.
     """
     target = ((output_dir or Path.cwd()) / name).resolve()
 
+    _validate_init_flags(profile=profile, from_file=from_file, dry_run=dry_run, fmt=output_format)
+
     # Name validation runs before either the wizard or the profile build so
     # invalid names fail fast with a clear exit code (2), instead of bubbling
     # through the wizard's first prompt or the profile's deep model_validate.
@@ -151,19 +224,38 @@ def init(
         console.print(f"[red]error[/red]: invalid project name: {exc}")
         raise typer.Exit(code=2) from exc
 
-    if profile is None:
+    if from_file is not None:
+        config = _load_from_file(from_file, name)
+    elif profile is None:
         config = _run_wizard_or_exit(name)
     else:
-        config = _build_from_profile(name, profile, spokes, force, edge_role)
+        config = _build_from_profile(
+            name,
+            profile,
+            spokes=spokes,
+            frontends=frontends,
+            force=force,
+            edge_role=edge_role,
+            network_split=network_split,
+            reverse_proxy=reverse_proxy,
+            proxy_path=proxy_path,
+            redundant=redundant,
+        )
+
+    if dry_run:
+        # Dump the resolved config (the writer resolves too, so this is exactly
+        # what would be built) and write nothing. `end=""`/`markup=False` keep
+        # the output verbatim and parseable - no rich markup, no extra newline.
+        console.print(dump_config(resolve(config), output_format or "yaml"), end="", markup=False)
+        raise typer.Exit()
 
     try:
-        files = write_project(config, target, keep_cli=keep_cli)
+        files = write_project(config, target)
     except FileExistsError as exc:
         console.print(f"[red]error[/red]: {exc}")
         raise typer.Exit(code=1) from exc
 
-    mode = "SE-demo" if keep_cli else "one-shot"
-    console.print(f"[green]created[/green] {target} ([cyan]{mode}[/cyan])")
+    console.print(f"[green]created[/green] {target}")
     console.print(f"  {len(files)} file(s) written")
     console.print()
     console.print("Next steps:")
@@ -172,16 +264,70 @@ def init(
     console.print(
         f"  open http://localhost:{config.gateways[0].http_port}  (admin / {config.admin_password})"
     )
-    if keep_cli:
-        console.print()
+    console.print()
+    console.print(
+        f"  config recorded in {LIFECYCLE_DIR}/ - run `ignition-stack reset` to "
+        "regenerate or `switch-profile <name>` to reshape this stack."
+    )
+
+
+def _validate_init_flags(
+    *, profile: str | None, from_file: Path | None, dry_run: bool, fmt: str | None
+) -> None:
+    """Enforce the mutual-exclusion + flag-applicability rules, or exit code 2.
+
+    ``--from-file`` already fully specifies the topology, so combining it with
+    ``--profile`` is ambiguous and rejected. ``--output-format`` only shapes the
+    ``--dry-run`` dump, so passing it without ``--dry-run`` is a usage error
+    rather than a silent no-op. The value itself is validated against the two
+    supported formats here so a bad ``--output-format`` fails before any build.
+    """
+    if from_file is not None and profile is not None:
         console.print(
-            f"  primitives kept in {LIFECYCLE_DIR}/ - run `ignition-stack reset` to "
-            "regenerate or `switch-profile <name>` to reshape this stack."
+            "[red]error[/red]: --from-file cannot be combined with --profile; a "
+            "config file already specifies the full topology."
         )
+        raise typer.Exit(code=2)
+    if fmt is not None and not dry_run:
+        console.print("[red]error[/red]: --output-format only applies with --dry-run.")
+        raise typer.Exit(code=2)
+    if fmt is not None and fmt not in {"yaml", "json"}:
+        console.print(
+            f"[red]error[/red]: unsupported --output-format '{fmt}'; use 'yaml' or 'json'."
+        )
+        raise typer.Exit(code=2)
+
+
+def _load_from_file(from_file: Path, name: str) -> ProjectConfig:
+    """Load a config file, override its name with the CLI argument, or exit cleanly.
+
+    The project-name argument wins over the file's ``name`` so the same dumped
+    config can be rebuilt under a new name; everything else comes from the file.
+    A parse or validation failure surfaces as a readable error (exit code 2),
+    never a traceback.
+    """
+    try:
+        config = load_config(from_file)
+    except ConfigIOError as exc:
+        console.print(f"[red]error[/red]: {exc}")
+        raise typer.Exit(code=2) from exc
+    if config.name != name:
+        config = config.model_copy(update={"name": name})
+    return config
 
 
 def _build_from_profile(
-    name: str, profile: str, spokes: int, force: bool, edge_role: str | None
+    name: str,
+    profile: str,
+    *,
+    spokes: int,
+    frontends: int,
+    force: bool,
+    edge_role: str | None,
+    network_split: bool | None,
+    reverse_proxy: str | None,
+    proxy_path: str,
+    redundant: str | None,
 ) -> ProjectConfig:
     """Materialize a config from the named profile + CLI flags, or exit cleanly."""
     try:
@@ -190,7 +336,16 @@ def _build_from_profile(
         console.print(f"[red]error[/red]: {exc}")
         raise typer.Exit(code=2) from exc
 
-    options = ProfileOptions(spokes=spokes, force=force, edge_role=edge_role)
+    proxy = ReverseProxyConfig(kind=reverse_proxy, path=proxy_path) if reverse_proxy else None
+    options = ProfileOptions(
+        spokes=spokes,
+        frontends=frontends,
+        force=force,
+        edge_role=edge_role,
+        network_split=network_split,
+        reverse_proxy=proxy,
+        redundant_role=redundant,
+    )
     try:
         config = build_profile(profile, name, options)
     except ProfileError as exc:
@@ -220,14 +375,14 @@ def reset(
         Path("."),
         "--project-dir",
         "-C",
-        help="The generated SE-demo project to reset. Defaults to the current directory.",
+        help="The generated project to reset. Defaults to the current directory.",
     ),
 ) -> None:
-    """Regenerate an SE-demo project from its recorded config.
+    """Regenerate a project from its recorded config.
 
     Reads ``.ignition-stack/config.json``, clears the generated tree (keeping the
-    record and the modules cache), and re-runs generation. Only works on SE-demo
-    projects (``init --keep-cli``); a one-shot project has no record to reset from.
+    record and the modules cache), and re-runs generation. Works on any project
+    generated by this CLI; a directory without a record can't be reset.
     """
     project_dir = project_dir.resolve()
     try:
@@ -252,10 +407,10 @@ def switch_profile(
         Path("."),
         "--project-dir",
         "-C",
-        help="The generated SE-demo project to reshape. Defaults to the current directory.",
+        help="The generated project to reshape. Defaults to the current directory.",
     ),
 ) -> None:
-    """Reshape an SE-demo project under a different architecture profile.
+    """Reshape a project under a different architecture profile.
 
     Carries the recorded database, services, reverse-proxy, and edge intent over
     to the new profile, then regenerates in place and re-records the result.
@@ -274,6 +429,19 @@ def switch_profile(
         raise typer.Exit(code=2) from exc
 
     options = _options_from_config(current)
+    # Redundancy is pinned to a profile-specific role (e.g. standalone's
+    # 'gateway'), which the target profile may not have. Building its base
+    # topology lets us check before build_profile's mark_redundant would reject
+    # it - drop the intent with an advisory rather than failing the reshape.
+    if options.redundant_role is not None and not can_host_redundant_role(
+        get_profile(profile).build(current.name, options), options.redundant_role
+    ):
+        console.print(
+            f"[yellow]note[/yellow]: redundancy on '{options.redundant_role}' was not "
+            f"carried to {profile} (no matching gateway); re-apply with --redundant "
+            "if the new topology has a role to pair"
+        )
+        options = replace(options, redundant_role=None)
     try:
         new_config = build_profile(profile, current.name, options)
     except ProfileError as exc:
@@ -293,16 +461,33 @@ def _options_from_config(config: ProjectConfig) -> ProfileOptions:
 
     Edge intent is recovered from whichever gateway runs the Edge edition (or
     'none' to keep the new profile from re-introducing its edge default); the
-    spoke count from the number of spoke-role gateways.
+    spoke count from the number of spoke-role gateways, the frontend count from
+    the number of frontend-role gateways, and the network split is carried over
+    verbatim so a reshape preserves the user's topology choice.
     """
     edge_roles = [gw.role or gw.name for gw in config.gateways if gw.ignition_edition == "edge"]
     spoke_count = sum(1 for gw in config.gateways if (gw.role or "") == "spoke")
+    frontend_count = sum(1 for gw in config.gateways if (gw.role or "") == "frontend")
+    # Redundancy intent is carried by the master node (the backup is re-derived
+    # by the resolver), so recover the role/name of whichever gateway is the
+    # master and let the new profile re-expand the pair.
+    redundant_role = next(
+        (
+            gw.role or gw.name
+            for gw in config.gateways
+            if gw.redundancy is not None and gw.redundancy.mode == "master"
+        ),
+        None,
+    )
     return ProfileOptions(
         spokes=spoke_count or 3,
+        frontends=frontend_count or 1,
         edge_role=edge_roles[0] if edge_roles else "none",
+        network_split=config.network_split,
         reverse_proxy=config.reverse_proxy,
         database_kind=config.database.kind if config.database else None,
         services=tuple(config.services),
+        redundant_role=redundant_role,
     )
 
 

{ignition_stack-0.1.0 → ignition_stack-0.2.0}/ignition_stack/completion.py

@@ -33,6 +33,39 @@ def complete_edge_role(incomplete: str) -> list[str]:
     return [role for role in EDGE_ROLE_VALUES if role.startswith(incomplete)]
 
 
+# Reverse-proxy kinds the CLI can scaffold. Mirrors ReverseProxyConfig.kind
+# (only Traefik exists today); kept here as the completion vocabulary since
+# the Literal lives in the pydantic model, not a runtime registry.
+REVERSE_PROXY_VALUES = ("traefik",)
+
+
+def complete_reverse_proxy(incomplete: str) -> list[str]:
+    """Reverse-proxy kind names matching the typed prefix."""
+    return [kind for kind in REVERSE_PROXY_VALUES if kind.startswith(incomplete)]
+
+
+# Roles `init --redundant` can pair. Only the singleton workhorse roles are
+# eligible (a scaleout 'backend', a hub-and-spoke 'hub', a standalone
+# 'gateway'); replicated 'frontend'/'spoke' tiers are rejected by the profile
+# builder, so they are intentionally absent here.
+REDUNDANT_ROLE_VALUES = ("backend", "hub", "gateway")
+
+
+def complete_redundant_role(incomplete: str) -> list[str]:
+    """Redundancy-eligible role names matching the typed prefix."""
+    return [role for role in REDUNDANT_ROLE_VALUES if role.startswith(incomplete)]
+
+
+# Serialization formats `init --dry-run --output-format` accepts. Mirrors the
+# `Format` literal in config/io.py; kept here as the completion vocabulary.
+OUTPUT_FORMAT_VALUES = ("yaml", "json")
+
+
+def complete_output_format(incomplete: str) -> list[str]:
+    """Config dump format names matching the typed prefix."""
+    return [fmt for fmt in OUTPUT_FORMAT_VALUES if fmt.startswith(incomplete)]
+
+
 def complete_module_name(incomplete: str) -> list[str]:
     """Catalog entry slugs from the bundled catalog matching the typed prefix."""
     try:

{ignition_stack-0.1.0 → ignition_stack-0.2.0}/ignition_stack/compose/engine.py

@@ -261,6 +261,16 @@ def _ignition_context(
     # override when this gateway differs - keeps Phase 2's environment
     # block as the bare anchor reference.
     edition_override = gw.ignition_edition if gw.ignition_edition != "standard" else None
+
+    # Redundancy wiring (Phase 4, per the verified Phase-3 spike):
+    #  - Any node in a pair opens its incoming Gateway Network policy
+    #    (Unrestricted + no-SSL) so the plain redundancy link auto-approves.
+    #  - The backup additionally points a generic outgoing GAN connection at
+    #    the master (HOST/PORT/ENABLESSL - all three, not just HOST, or it
+    #    defaults to SSL:8060 and faults) and must NOT be renamed via -n: it
+    #    adopts the master's system name on first sync.
+    is_redundant = gw.redundancy is not None
+    is_backup = is_redundant and gw.redundancy.mode == "backup"
     return {
         "service_name": ctx["service_name"],
         "bootstrap_service_name": ctx["bootstrap_service_name"],
@@ -272,6 +282,10 @@ def _ignition_context(
         "module_identifiers": ctx["module_identifiers"],
         "database_service": config.database.name if config.database else None,
         "networks": ctx["networks"],
+        "redundant": is_redundant,
+        "rename": not is_backup,
+        "gan_peer_host": gw.redundancy.peer if is_backup else None,
+        "gan_port": gw.redundancy.gan_port if is_backup else None,
     }
 
 
@@ -332,12 +346,7 @@ def _wrap_description(description: str) -> list[str]:
 def _describe(config: ProjectConfig) -> str:
     """Human-readable header comment summarizing the stack."""
     n = len(config.gateways)
-    if (
-        n == 1
-        and config.database
-        and config.database.kind == "postgres"
-        and not config.services
-    ):
+    if n == 1 and config.database and config.database.kind == "postgres" and not config.services:
         return (
             "Walking skeleton: one Ignition 8.3 gateway, one Postgres, "
             "env-driven commissioning so first boot needs no UI."
@@ -393,5 +402,3 @@ def _round_trip(raw: str) -> str:
     out = io.StringIO()
     yaml.dump(parsed, out)
     return out.getvalue()
-
-

{ignition_stack-0.1.0 → ignition_stack-0.2.0}/ignition_stack/compose/templates/services/ignition.yaml.j2

@@ -21,9 +21,23 @@
 {%- if module_identifiers %}
     ACCEPT_MODULE_LICENSES: "{{ module_identifiers }}"
     ACCEPT_MODULE_CERTS: "{{ module_identifiers }}"
+{%- endif %}
+{%- if redundant %}
+    GATEWAY_NETWORK_ENABLED: "true"
+    GATEWAY_NETWORK_ALLOWINCOMING: "true"
+    GATEWAY_NETWORK_SECURITYPOLICY: "Unrestricted"
+    GATEWAY_NETWORK_REQUIRESSL: "false"
+    GATEWAY_NETWORK_REQUIRETWOWAYAUTH: "false"
+{%- endif %}
+{%- if gan_peer_host %}
+    GATEWAY_NETWORK_0_HOST: "{{ gan_peer_host }}"
+    GATEWAY_NETWORK_0_PORT: "{{ gan_port }}"
+    GATEWAY_NETWORK_0_ENABLESSL: "false"
 {%- endif %}
   command: >
+{%- if rename %}
     -n {{ gateway_name_ref }}
+{%- endif %}
     -m {{ memory_mb }}
     --
     -Dignition.config.mode=dev

{ignition_stack-0.1.0 → ignition_stack-0.2.0}/ignition_stack/compose/writer.py

@@ -24,6 +24,8 @@ from importlib import resources
 from importlib.resources.abc import Traversable
 from pathlib import Path
 
+from jinja2 import Environment, PackageLoader, StrictUndefined
+
 from ignition_stack.catalog.loader import CatalogLoadError, load_catalog
 from ignition_stack.catalog.schema import Catalog
 from ignition_stack.compose.engine import render_compose
@@ -41,7 +43,6 @@ def write_project(
     config: ProjectConfig,
     target_dir: Path,
     *,
-    keep_cli: bool = False,
     overwrite: bool = False,
 ) -> list[Path]:
     """Generate the project tree at ``target_dir``.
@@ -50,9 +51,10 @@ def write_project(
     :func:`ignition_stack.services.resolver.resolve`) so the compose output and
     the on-disk seeds agree on the same fully-expanded stack.
 
-    ``keep_cli`` turns on SE-demo mode: the resolved config is recorded under
-    ``.ignition-stack/`` so ``reset`` / ``switch-profile`` can regenerate the
-    project in place. The default (one-shot) leaves no such primitive behind.
+    Every project records its resolved config under ``.ignition-stack/`` so
+    ``reset`` / ``switch-profile`` can regenerate or reshape it in place; the
+    same artifact can be dumped with ``init --dry-run`` and rebuilt with
+    ``init -f``.
 
     ``overwrite`` lets ``reset`` / ``switch-profile`` write into a directory
     that still holds the preserved ``.ignition-stack/`` record; normal ``init``
@@ -76,6 +78,7 @@ def write_project(
     written.extend(_copy_static_tree(config, target_dir))
     written.extend(_copy_service_seeds(config, target_dir))
     written.extend(_overlay_gateway_resources(config, target_dir))
+    written.extend(_write_redundancy_seeds(config, target_dir))
     _ensure_modules_cache_dir(config, target_dir)
     written.append(_write_compose(config, target_dir))
     written.append(_write_env(config, target_dir))
@@ -88,9 +91,7 @@ def write_project(
     if dropin_file is not None:
         written.append(dropin_file)
     written.append(_write_post_setup(config, target_dir))
-
-    if keep_cli:
-        written.append(write_record(config, target_dir))
+    written.append(write_record(config, target_dir))
 
     return written
 
@@ -138,6 +139,48 @@ def _overlay_gateway_resources(config: ProjectConfig, target_dir: Path) -> list[
     return written
 
 
+def _write_redundancy_seeds(config: ProjectConfig, target_dir: Path) -> list[Path]:
+    """Drop a per-node ``redundancy.xml`` into each redundant gateway's tree.
+
+    Per the Phase-3 spike, nothing sets the redundancy *role* via env var, so a
+    pre-seeded ``data/redundancy.xml`` is what makes a node a master or backup.
+    The file lands at ``services/<gateway>/redundancy.xml`` (the gateway's
+    template-source root); the bootstrap copies it to the data-volume root on
+    first boot. Master and backup differ only in ``noderole`` and ``gan.host``;
+    the backup points its host at the master's service name. Generated stacks
+    use the plain (non-SSL) link on port 8088, which auto-approves without the
+    certificate handshake the SSL path (8060) would force.
+    """
+    env = _redundancy_jinja_env()
+    template = env.get_template("redundancy.xml.j2")
+    written: list[Path] = []
+    for gw in config.gateways:
+        red = gw.redundancy
+        if red is None or not red.seed_redundancy_xml:
+            continue
+        is_master = red.mode == "master"
+        rendered = template.render(
+            noderole="Master" if is_master else "Backup",
+            # The master listens; the backup connects to the master's service
+            # name. An empty host on the master matches the verified seed file.
+            gan_host="" if is_master else red.peer,
+            gan_port=red.gan_port,
+            enable_ssl="true" if red.gan_port == 8060 else "false",
+        )
+        rel = f"services/{gw.name}/redundancy.xml"
+        written.append(_write_static(target_dir, rel, rendered.encode(), False))
+    return written
+
+
+def _redundancy_jinja_env() -> Environment:
+    return Environment(
+        loader=PackageLoader("ignition_stack.templates", "redundancy"),
+        undefined=StrictUndefined,
+        keep_trailing_newline=True,
+        autoescape=False,
+    )
+
+
 def _seed_sources(config: ProjectConfig) -> list[tuple[object, str]]:
     """(service-catalog dir, on-disk destination name) for the DB + each service.
 
@@ -378,7 +421,7 @@ logs:  ## Follow logs for every service.
 wipe:  ## Remove ONLY this project's containers, networks, and volumes.
 \t$(COMPOSE) -p $(PROJECT) down -v --remove-orphans
 
-reset:  ## Regenerate this project from its recorded SE-demo config.
+reset:  ## Regenerate this project from its recorded config.
 \tignition-stack reset
 """