ignition-stack 0.2.0__tar.gz → 0.3.0__tar.gz

{ignition_stack-0.2.0 → ignition_stack-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ignition-stack
-Version: 0.2.0
+Version: 0.3.0
 Summary: CLI that generates ready-to-run Docker Compose stacks for Ignition 8.3 SCADA demos and SE engagements
 Author-email: Eric Knorr <etknorr@gmail.com>
 License: MIT

ignition_stack-0.3.0/builtin_modules.yaml

@@ -0,0 +1,122 @@
+# Catalog of the built-in IA modules that ship inside the Ignition gateway
+# image. Used to translate a gateway's `disable_builtins` slugs into the
+# GATEWAY_MODULES_ENABLED whitelist the engine emits (enabled = all built-ins
+# minus the disabled ones, plus any third-party module identifiers).
+#
+# Why this file exists:
+#   GATEWAY_MODULES_ENABLED is a strict WHITELIST, not a blocklist - anything
+#   not listed is quarantined at boot (verified live on 8.3.6). So "disable
+#   Vision" can only be expressed as "enable every built-in except Vision".
+#   That inversion needs the COMPLETE built-in set; an incomplete list would
+#   silently quarantine the modules we forgot to enumerate. This file is that
+#   complete set, and tests/test_builtin_catalog.py (marked `smoke`) re-derives
+#   it from the live image so a stale list fails CI loudly instead of dropping
+#   modules silently.
+#
+# Provenance (how to regenerate when bumping the Ignition image):
+#   1. Boot the pinned image with no whitelist so every built-in loads:
+#        docker run --rm -e ACCEPT_IGNITION_EULA=Y -e GATEWAY_ADMIN_PASSWORD=x \
+#          inductiveautomation/ignition:<tag>
+#   2. Read the loaded set from the gateway log lines:
+#        Starting up module '<identifier>' ... module-name=<name>
+#   3. Update `ignition_version` and the `modules` list below to match.
+#   The smoke guard test automates this comparison.
+#
+# `identifier` is the fully-qualified module id used verbatim in
+# GATEWAY_MODULES_ENABLED. `slug` is the friendly kebab name a user puts in
+# `disable_builtins`. `name` is the gateway's display name (for wizard labels).
+
+version: 1
+
+# The exact Ignition image tag this built-in set was captured from. The guard
+# test only asserts a match when the running image reports this version.
+ignition_version: "8.3.6"
+
+modules:
+  - slug: alarm-notification
+    identifier: com.inductiveautomation.alarm-notification
+    name: Alarm Notification
+  - slug: allen-bradley-driver
+    identifier: com.inductiveautomation.opcua.drivers.ablegacy
+    name: Allen-Bradley Driver
+  - slug: bacnet-driver
+    identifier: com.inductiveautomation.opcua.drivers.bacnet
+    name: BACnet Driver
+  - slug: enterprise-administration
+    identifier: com.inductiveautomation.eam
+    name: Enterprise Administration
+  - slug: event-streams
+    identifier: com.inductiveautomation.eventstream
+    name: Event Streams
+  - slug: historian-core
+    identifier: com.inductiveautomation.historian
+    name: Historian Core
+  - slug: kafka-connector
+    identifier: com.inductiveautomation.connectors.kafka
+    name: Kafka Connector
+  - slug: legacy-dnp3-driver
+    identifier: com.inductiveautomation.opcua.drivers.dnp3
+    name: Legacy DNP3 Driver
+  - slug: logix-driver
+    identifier: com.inductiveautomation.opcua.drivers.logix
+    name: Logix Driver
+  - slug: mariadb-jdbc-driver
+    identifier: com.inductiveautomation.jdbc.mariadb
+    name: MariaDB JDBC Driver
+  - slug: micro800-driver
+    identifier: com.inductiveautomation.opcua.drivers.micro800
+    name: Micro800 Driver
+  - slug: mitsubishi-driver
+    identifier: com.inductiveautomation.opcua.drivers.mitsubishi
+    name: Mitsubishi Driver
+  - slug: modbus-driver
+    identifier: com.inductiveautomation.opcua.drivers.modbus
+    name: Modbus Driver
+  - slug: mssql-jdbc-driver
+    identifier: com.inductiveautomation.jdbc.mssql
+    name: MSSQL JDBC Driver
+  - slug: omron-driver
+    identifier: com.inductiveautomation.opcua.drivers.omron
+    name: Omron Driver
+  - slug: opc-ua
+    identifier: com.inductiveautomation.opcua
+    name: OPC-UA
+  - slug: perspective
+    identifier: com.inductiveautomation.perspective
+    name: Perspective
+  - slug: postgresql-jdbc-driver
+    identifier: com.inductiveautomation.jdbc.postgresql
+    name: PostgreSQL JDBC Driver
+  - slug: reporting
+    identifier: com.inductiveautomation.reporting
+    name: Reporting
+  - slug: sfc
+    identifier: com.inductiveautomation.sfc
+    name: SFC
+  - slug: siemens-drivers
+    identifier: com.inductiveautomation.opcua.drivers.siemens
+    name: Siemens Drivers
+  - slug: siemens-enhanced-driver
+    identifier: com.inductiveautomation.opcua.drivers.siemens-symbolic
+    name: Siemens Enhanced Driver
+  - slug: sms-notification
+    identifier: com.inductiveautomation.sms-notification
+    name: SMS Notification
+  - slug: sql-bridge
+    identifier: com.inductiveautomation.sqlbridge
+    name: SQL Bridge
+  - slug: sql-historian
+    identifier: com.inductiveautomation.historian.sql
+    name: SQL Historian
+  - slug: symbol-factory
+    identifier: com.inductiveautomation.symbol-factory
+    name: Symbol Factory
+  - slug: udp-and-tcp-drivers
+    identifier: com.inductiveautomation.opcua.drivers.tcpudp
+    name: UDP and TCP Drivers
+  - slug: vision
+    identifier: com.inductiveautomation.vision
+    name: Vision
+  - slug: webdev
+    identifier: com.inductiveautomation.webdev
+    name: WebDev

ignition_stack-0.3.0/ignition_stack/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.3.0"

ignition_stack-0.3.0/ignition_stack/catalog/builtins.py

@@ -0,0 +1,171 @@
+"""Load and query the built-in IA module catalog (``builtin_modules.yaml``).
+
+The third-party catalog (``modules.yaml`` + ``catalog/schema.py``) covers
+modules the CLI *adds*. This module covers the modules that *already ship*
+inside the gateway image, which the engine needs in order to translate a
+gateway's ``disable_builtins`` slugs into a ``GATEWAY_MODULES_ENABLED``
+whitelist.
+
+The whitelist is strict: anything not listed is quarantined at boot. So
+"disable Vision" is expressed as "enable every built-in except Vision",
+which requires the *complete* built-in set - hence a pinned data file plus a
+smoke guard test that re-derives it from the live image.
+"""
+
+from __future__ import annotations
+
+from functools import lru_cache
+from importlib import resources
+from pathlib import Path
+from typing import Annotated
+
+import yaml
+from pydantic import BaseModel, ConfigDict, Field, ValidationError, field_validator
+
+
+class BuiltinCatalogLoadError(Exception):
+    """Raised when builtin_modules.yaml cannot be read or fails validation."""
+
+
+DEFAULT_BUILTIN_CATALOG_NAME = "builtin_modules.yaml"
+
+
+class BuiltinModule(BaseModel):
+    """One built-in IA module that ships inside the gateway image."""
+
+    model_config = ConfigDict(extra="forbid", frozen=True)
+
+    slug: Annotated[
+        str,
+        Field(
+            min_length=1,
+            pattern=r"^[a-z0-9][a-z0-9-]*$",
+            description="Friendly kebab name a user puts in `disable_builtins`.",
+        ),
+    ]
+    identifier: Annotated[
+        str,
+        Field(
+            min_length=1,
+            pattern=r"^[a-z0-9.-]+$",
+            description="Fully-qualified module id, used verbatim in GATEWAY_MODULES_ENABLED.",
+        ),
+    ]
+    name: Annotated[str, Field(min_length=1, description="Gateway display name (wizard label).")]
+
+
+class BuiltinCatalog(BaseModel):
+    """Top-level shape of builtin_modules.yaml."""
+
+    model_config = ConfigDict(extra="forbid", frozen=True)
+
+    version: Annotated[int, Field(ge=1)]
+    ignition_version: Annotated[
+        str,
+        Field(min_length=1, description="Image tag this built-in set was captured from."),
+    ]
+    modules: Annotated[list[BuiltinModule], Field(min_length=1)]
+
+    @field_validator("modules")
+    @classmethod
+    def _slugs_unique(cls, modules: list[BuiltinModule]) -> list[BuiltinModule]:
+        slugs = [m.slug for m in modules]
+        dupes = sorted({s for s in slugs if slugs.count(s) > 1})
+        if dupes:
+            raise ValueError(f"duplicate built-in slugs: {', '.join(dupes)}")
+        return modules
+
+    @property
+    def slugs(self) -> set[str]:
+        """Every known built-in slug."""
+        return {m.slug for m in self.modules}
+
+    def identifiers_excluding(self, disabled_slugs: list[str]) -> list[str]:
+        """FQ identifiers of every built-in whose slug is not in ``disabled_slugs``.
+
+        Order follows the catalog (already alphabetical by slug) so generated
+        whitelists are deterministic and golden-stable.
+        """
+        disabled = set(disabled_slugs)
+        return [m.identifier for m in self.modules if m.slug not in disabled]
+
+
+def load_builtin_catalog(path: Path | None = None) -> BuiltinCatalog:
+    """Load and validate the built-in catalog.
+
+    With ``path=None`` the catalog shipped with the installed package is used;
+    a path overrides it (test fixtures). Mirrors ``catalog.loader.load_catalog``.
+    """
+    yaml_text = _read_yaml_text(path)
+    name = DEFAULT_BUILTIN_CATALOG_NAME
+    try:
+        raw = yaml.safe_load(yaml_text)
+    except yaml.YAMLError as exc:
+        raise BuiltinCatalogLoadError(f"{name} is not valid YAML: {exc}") from exc
+
+    if not isinstance(raw, dict):
+        raise BuiltinCatalogLoadError(f"{name} top-level must be a mapping.")
+
+    try:
+        return BuiltinCatalog.model_validate(raw)
+    except ValidationError as exc:
+        raise BuiltinCatalogLoadError(
+            f"{DEFAULT_BUILTIN_CATALOG_NAME} failed schema validation:\n{exc}"
+        ) from exc
+
+
+@lru_cache(maxsize=1)
+def default_builtin_catalog() -> BuiltinCatalog:
+    """The built-in catalog shipped with the package, loaded once and cached.
+
+    The data file is immutable package data, so both config validation and the
+    compose engine can share a single memoized read rather than re-parsing YAML
+    on every gateway.
+    """
+    return load_builtin_catalog()
+
+
+def builtin_slugs() -> frozenset[str]:
+    """Slugs of the shipped built-in catalog, for cheap ``disable_builtins`` validation."""
+    return frozenset(default_builtin_catalog().slugs)
+
+
+def validate_disable_slugs(slugs: list[str]) -> None:
+    """Raise ``ValueError`` if any slug is not a known built-in.
+
+    Shared by ``GatewayConfig`` field validation (construction-time) and
+    ``profiles.apply_disable_builtins`` (post-construction mutation, which
+    pydantic does not re-validate), so the wizard/CLI path is guarded too. A
+    typo would otherwise be a silent no-op - the slug just isn't disabled.
+    """
+    known = builtin_slugs()
+    unknown = [s for s in slugs if s not in known]
+    if unknown:
+        raise ValueError(
+            f"unknown built-in module slug(s): {', '.join(unknown)}. "
+            f"Valid slugs are: {', '.join(sorted(known))}"
+        )
+
+
+def _read_yaml_text(path: Path | None) -> str:
+    if path is not None:
+        if not path.is_file():
+            raise BuiltinCatalogLoadError(f"Built-in catalog not found at {path}.")
+        return path.read_text(encoding="utf-8")
+
+    # Installed wheels: force-included as ignition_stack/builtin_modules.yaml.
+    # Editable dev installs: it lives at the repo root next to pyproject.toml.
+    try:
+        bundled = resources.files("ignition_stack").joinpath(DEFAULT_BUILTIN_CATALOG_NAME)
+        if bundled.is_file():
+            return bundled.read_text(encoding="utf-8")
+    except (FileNotFoundError, OSError, ModuleNotFoundError):
+        pass
+
+    repo_root = Path(__file__).resolve().parents[2]
+    dev_path = repo_root / DEFAULT_BUILTIN_CATALOG_NAME
+    if not dev_path.is_file():
+        raise BuiltinCatalogLoadError(
+            f"{DEFAULT_BUILTIN_CATALOG_NAME} not found in package data or at {dev_path}."
+        )
+    return dev_path.read_text(encoding="utf-8")

{ignition_stack-0.2.0 → ignition_stack-0.3.0}/ignition_stack/cli.py

@@ -22,6 +22,7 @@ from rich.console import Console
 from ignition_stack import __version__
 from ignition_stack.commands.modules import modules_app
 from ignition_stack.completion import (
+    complete_disable_builtin,
     complete_edge_role,
     complete_output_format,
     complete_profile,
@@ -172,6 +173,17 @@ def init(
         ),
         autocompletion=complete_redundant_role,
     ),
+    disable_builtin: list[str] = typer.Option(  # noqa: B008 - Typer pattern
+        [],
+        "--disable-builtin",
+        help=(
+            "Built-in IA module to turn off on every gateway (repeatable), e.g. "
+            "--disable-builtin vision --disable-builtin sfc. Emits a "
+            "GATEWAY_MODULES_ENABLED whitelist of everything else. Slugs "
+            "tab-complete; an unknown slug is rejected with the full valid list."
+        ),
+        autocompletion=complete_disable_builtin,
+    ),
     from_file: Path | None = typer.Option(  # noqa: B008 - Typer pattern
         None,
         "--from-file",
@@ -240,6 +252,7 @@ def init(
             reverse_proxy=reverse_proxy,
             proxy_path=proxy_path,
             redundant=redundant,
+            disable_builtin=disable_builtin,
         )
 
     if dry_run:
@@ -328,6 +341,7 @@ def _build_from_profile(
     reverse_proxy: str | None,
     proxy_path: str,
     redundant: str | None,
+    disable_builtin: list[str],
 ) -> ProjectConfig:
     """Materialize a config from the named profile + CLI flags, or exit cleanly."""
     try:
@@ -345,6 +359,7 @@ def _build_from_profile(
         network_split=network_split,
         reverse_proxy=proxy,
         redundant_role=redundant,
+        disable_builtins=tuple(disable_builtin),
     )
     try:
         config = build_profile(profile, name, options)
@@ -463,7 +478,9 @@ def _options_from_config(config: ProjectConfig) -> ProfileOptions:
     'none' to keep the new profile from re-introducing its edge default); the
     spoke count from the number of spoke-role gateways, the frontend count from
     the number of frontend-role gateways, and the network split is carried over
-    verbatim so a reshape preserves the user's topology choice.
+    verbatim so a reshape preserves the user's topology choice. Disabled
+    built-in modules are carried over too (see below) so a reshape doesn't
+    silently re-enable Vision/SFC/etc.
     """
     edge_roles = [gw.role or gw.name for gw in config.gateways if gw.ignition_edition == "edge"]
     spoke_count = sum(1 for gw in config.gateways if (gw.role or "") == "spoke")
@@ -479,6 +496,12 @@ def _options_from_config(config: ProjectConfig) -> ProfileOptions:
         ),
         None,
     )
+    # Disabled built-ins are applied stack-wide, so carry over the slugs disabled
+    # on EVERY gateway (the intersection) - that is the stack-wide intent, and it
+    # won't over-disable a module that a hand-authored config turned off on only
+    # one node. The target profile re-applies it uniformly.
+    disabled_sets = [set(gw.disable_builtins) for gw in config.gateways]
+    disable_builtins = tuple(sorted(set.intersection(*disabled_sets))) if disabled_sets else ()
     return ProfileOptions(
         spokes=spoke_count or 3,
         frontends=frontend_count or 1,
@@ -488,6 +511,7 @@ def _options_from_config(config: ProjectConfig) -> ProfileOptions:
         database_kind=config.database.kind if config.database else None,
         services=tuple(config.services),
         redundant_role=redundant_role,
+        disable_builtins=disable_builtins,
     )
 
 

{ignition_stack-0.2.0 → ignition_stack-0.3.0}/ignition_stack/completion.py

@@ -77,3 +77,18 @@ def complete_module_name(incomplete: str) -> list[str]:
         # catalog must degrade to "no suggestions", never break the shell line.
         return []
     return [entry.name for entry in entries if entry.name.startswith(incomplete)]
+
+
+def complete_disable_builtin(incomplete: str) -> list[tuple[str, str]]:
+    """Built-in module slugs (with display name) matching the typed prefix.
+
+    Reads the bundled built-in catalog; degrades to no suggestions on any error
+    so a TAB never breaks the shell line.
+    """
+    try:
+        from ignition_stack.catalog.builtins import default_builtin_catalog
+
+        modules = default_builtin_catalog().modules
+    except Exception:
+        return []
+    return [(m.slug, m.name) for m in modules if m.slug.startswith(incomplete)]

{ignition_stack-0.2.0 → ignition_stack-0.3.0}/ignition_stack/compose/engine.py

@@ -39,6 +39,7 @@ from typing import TYPE_CHECKING
 from jinja2 import Environment, PackageLoader, StrictUndefined
 from ruamel.yaml import YAML
 
+from ignition_stack.catalog.builtins import default_builtin_catalog
 from ignition_stack.services.loader import load_all_services, load_service
 
 if TYPE_CHECKING:
@@ -280,6 +281,11 @@ def _ignition_context(
         "memory_mb": gw.memory_mb,
         "edition_override": edition_override,
         "module_identifiers": ctx["module_identifiers"],
+        # disable_active drives template emission (not the value's truthiness) so
+        # that disabling EVERY built-in emits an empty whitelist - which quarantines
+        # all, matching intent - instead of omitting the var and re-enabling all.
+        "disable_active": bool(gw.disable_builtins),
+        "modules_enabled": _modules_enabled_for(gw, ctx["module_identifiers"]),  # type: ignore[arg-type]
         "database_service": config.database.name if config.database else None,
         "networks": ctx["networks"],
         "redundant": is_redundant,
@@ -314,6 +320,29 @@ def _module_identifiers_for(gw: GatewayConfig, catalog: Catalog | None) -> str:
     return ",".join(identifiers)
 
 
+def _modules_enabled_for(gw: GatewayConfig, module_identifiers: str) -> str:
+    """The GATEWAY_MODULES_ENABLED whitelist VALUE for this gateway.
+
+    GATEWAY_MODULES_ENABLED is a strict whitelist: if set, every built-in not
+    listed is quarantined at boot. The template emits the var based on
+    ``disable_active`` (whether any built-in was disabled), not on this value's
+    truthiness - so disabling every built-in yields an empty string here and an
+    empty whitelist downstream (quarantines all), rather than silently omitting
+    the var and re-enabling everything.
+
+    When something is disabled the whitelist must be complete: every built-in the
+    user did not disable, PLUS any third-party modules we added
+    (``module_identifiers``) - or those added modules would be quarantined too.
+    Returns '' when nothing is disabled (the var is omitted in that case).
+    """
+    if not gw.disable_builtins:
+        return ""
+    enabled = default_builtin_catalog().identifiers_excluding(gw.disable_builtins)
+    added = [ident for ident in module_identifiers.split(",") if ident]
+    enabled.extend(ident for ident in added if ident not in enabled)
+    return ",".join(enabled)
+
+
 def _is_module(entry: ModuleEntry | object) -> bool:
     return getattr(entry, "kind", None) == "module"
 

{ignition_stack-0.2.0 → ignition_stack-0.3.0}/ignition_stack/compose/templates/services/ignition.yaml.j2

@@ -22,6 +22,9 @@
     ACCEPT_MODULE_LICENSES: "{{ module_identifiers }}"
     ACCEPT_MODULE_CERTS: "{{ module_identifiers }}"
 {%- endif %}
+{%- if disable_active %}
+    GATEWAY_MODULES_ENABLED: "{{ modules_enabled }}"
+{%- endif %}
 {%- if redundant %}
     GATEWAY_NETWORK_ENABLED: "true"
     GATEWAY_NETWORK_ALLOWINCOMING: "true"

{ignition_stack-0.2.0 → ignition_stack-0.3.0}/ignition_stack/config/schema.py

@@ -124,8 +124,22 @@ class GatewayConfig(BaseModel):
             "Module catalog entry names (slugs) to attach to this gateway. "
             "The compose engine wires each cached .modl into the gateway "
             "volume AND enumerates it in ACCEPT_MODULE_LICENSES + "
-            "ACCEPT_MODULE_CERTS per the resolved q-module-install finding "
-            "(GATEWAY_MODULES_ENABLED is omitted - it quarantines built-ins)."
+            "ACCEPT_MODULE_CERTS per the resolved q-module-install finding. "
+            "These added identifiers are also folded into the "
+            "GATEWAY_MODULES_ENABLED whitelist when disable_builtins is set, "
+            "so disabling a built-in never quarantines an added module."
+        ),
+    )
+    disable_builtins: list[str] = Field(
+        default_factory=list,
+        description=(
+            "Slugs of built-in IA modules to turn off on this gateway, e.g. "
+            "['vision', 'sfc']. Because the gateway's GATEWAY_MODULES_ENABLED "
+            "env var is a strict whitelist (anything unlisted is quarantined), "
+            "the engine inverts this into 'enable every built-in except these, "
+            "plus any added modules'. Empty (default) emits no whitelist and "
+            "leaves all built-ins on - the historical behavior. Slugs are "
+            "validated against builtin_modules.yaml; an unknown slug raises."
         ),
     )
     redundancy: RedundancyConfig | None = Field(
@@ -155,6 +169,19 @@ class GatewayConfig(BaseModel):
             raise ValueError("ignition_edition must be 'standard' or 'edge'")
         return v
 
+    @field_validator("disable_builtins")
+    @classmethod
+    def _validate_disable_builtins(cls, v: list[str]) -> list[str]:
+        # Reject unknown slugs loudly: a typo here would otherwise be a silent
+        # no-op (the slug isn't in the catalog, so nothing gets disabled),
+        # which is exactly the surprise the whitelist inversion must avoid.
+        # Imported locally to keep the config schema free of a load-time catalog
+        # dependency (and dodge any import-order coupling).
+        from ignition_stack.catalog.builtins import validate_disable_slugs
+
+        validate_disable_slugs(v)
+        return v
+
     @property
     def env_prefix(self) -> str:
         """Uppercase prefix for this gateway's per-gateway env-var keys.

{ignition_stack-0.2.0 → ignition_stack-0.3.0}/ignition_stack/profiles/base.py

@@ -86,6 +86,14 @@ class ProfileOptions:
     workhorse role (scaleout 'backend', hub-and-spoke 'hub', standalone
     'gateway'); replicated tiers ('frontend', 'spoke') are rejected."""
 
+    disable_builtins: tuple[str, ...] = ()
+    """Built-in module slugs to turn off on every gateway in the stack.
+
+    Empty (default) leaves all built-ins on. Applied uniformly by
+    ``build_profile`` - the demo intent is "drop Vision/SFC everywhere", and
+    per-gateway disabling stays a declarative-config-only feature. Slugs are
+    validated against builtin_modules.yaml by ``GatewayConfig``."""
+
 
 class Profile(Protocol):
     """A factory that turns ``ProfileOptions`` into a ``ProjectConfig``."""
@@ -200,4 +208,29 @@ def build_profile(slug: str, name: str, options: ProfileOptions) -> ProjectConfi
     means one eligibility rule serves every profile and the wizard alike.
     """
     config = get_profile(slug).build(name, options)
-    return mark_redundant(config, options.redundant_role)
+    config = mark_redundant(config, options.redundant_role)
+    return apply_disable_builtins(config, options.disable_builtins)
+
+
+def apply_disable_builtins(
+    config: ProjectConfig, disable_builtins: tuple[str, ...]
+) -> ProjectConfig:
+    """Stamp ``disable_builtins`` onto every gateway in ``config``.
+
+    Applied centrally (like :func:`mark_redundant`) so one rule serves every
+    profile and the wizard. Uniform across gateways: the demo intent is to drop
+    a module everywhere, and a redundant pair must agree on its module set. The
+    resolver later copies the list onto any expanded backup node.
+    """
+    if not disable_builtins:
+        return config
+    # pydantic does not re-validate on attribute assignment, so validate here -
+    # this is the wizard/CLI choke point (the declarative path is checked at
+    # construction). Raises ValueError on an unknown slug; the CLI maps that to
+    # exit code 2.
+    from ignition_stack.catalog.builtins import validate_disable_slugs
+
+    validate_disable_slugs(list(disable_builtins))
+    for gw in config.gateways:
+        gw.disable_builtins = list(disable_builtins)
+    return config

{ignition_stack-0.2.0 → ignition_stack-0.3.0}/ignition_stack/services/resolver.py

@@ -111,6 +111,7 @@ def _expand_redundancy(config: ProjectConfig) -> None:
                 memory_mb=master.memory_mb,
                 http_port=next_port,
                 modules=list(master.modules),
+                disable_builtins=list(master.disable_builtins),
                 redundancy=RedundancyConfig(
                     mode="backup",
                     peer=master.name,

{ignition_stack-0.2.0 → ignition_stack-0.3.0}/ignition_stack/wizard.py

@@ -25,8 +25,11 @@ Step order:
 6. **Redundancy** - for profiles with a single workhorse role (standalone
    gateway, scaleout backend, hub-and-spoke hub), whether to add a backup
    node and form a master/backup pair. Defaults off.
-7. **Reverse proxy** - existing/install-Traefik/skip.
-8. **Summary + confirm**.
+7. **Disable built-ins** - opt-in multi-select to turn off built-in IA
+   modules (Vision, SFC, ...) stack-wide via GATEWAY_MODULES_ENABLED.
+   Gated behind a confirm; defaults to keeping everything.
+8. **Reverse proxy** - existing/install-Traefik/skip.
+9. **Summary + confirm**.
 
 Per-gateway env-var overrides (``memory_mb`` etc.) are deferred to Phase 7
 when the lifecycle/reset commands need them; the gateway model already
@@ -117,6 +120,10 @@ class Prompter(Protocol):
     def integer(self, message: str, default: int, minimum: int = 0) -> int:
         """Integer prompt; validates ``>= minimum`` and returns the parsed value."""
 
+    def checkbox(self, message: str, choices: Sequence[tuple[str, str]]) -> list[str]:
+        """Multi-select prompt. ``choices`` is ``(value, label)`` pairs; returns
+        the list of chosen ``value``\\ s (possibly empty - nothing toggled)."""
+
 
 @dataclass
 class WizardOutcome:
@@ -162,6 +169,7 @@ def walk(name: str, prompter: Prompter) -> WizardOutcome:
     edge_role = _ask_edge_role(prompter, profile_slug)
     network_split = _ask_network_split(prompter, profile_slug)
     redundant_role = _ask_redundancy(prompter, profile_slug)
+    disable_builtins = _ask_disable_builtins(prompter)
     reverse_proxy = _ask_reverse_proxy(prompter)
 
     options = ProfileOptions(
@@ -173,6 +181,7 @@ def walk(name: str, prompter: Prompter) -> WizardOutcome:
         reverse_proxy=reverse_proxy,
         database_kind=db_kind,
         redundant_role=redundant_role,
+        disable_builtins=disable_builtins,
     )
 
     # Hub-and-spoke advisory: ask the user inside the wizard rather than
@@ -255,6 +264,28 @@ def _ask_redundancy(prompter: Prompter, profile_slug: str) -> str | None:
     return role if make else None
 
 
+def _ask_disable_builtins(prompter: Prompter) -> tuple[str, ...]:
+    """Optionally pick built-in modules to turn off across the stack.
+
+    Gated behind a confirm so the common path (keep everything) is one
+    keystroke and nobody is forced to scroll a 29-item checklist. Saying yes
+    opens a multi-select of every built-in (alphabetical by display name);
+    whatever is toggled becomes the stack-wide ``disable_builtins``.
+    """
+    if not prompter.confirm(
+        "Disable any built-in gateway modules (e.g. Vision, SFC)?", default=False
+    ):
+        return ()
+    from ignition_stack.catalog.builtins import default_builtin_catalog
+
+    catalog = default_builtin_catalog()
+    choices = [(m.slug, m.name) for m in sorted(catalog.modules, key=lambda m: m.name.lower())]
+    chosen = prompter.checkbox(
+        "Select modules to DISABLE (space toggles, enter confirms):", choices
+    )
+    return tuple(chosen)
+
+
 def _ask_database(prompter: Prompter) -> str | None:
     raw = prompter.select("Database?", _DB_CHOICES, default="postgres")
     return None if raw == "none" else raw
@@ -355,6 +386,8 @@ def _summarize(config: ProjectConfig, profile_slug: str, options: ProfileOptions
         f"network split: {'on' if config.network_split else 'off'}",
         "redundancy   : "
         + (f"{options.redundant_role} (master + backup)" if options.redundant_role else "none"),
+        "disabled mods: "
+        + (", ".join(options.disable_builtins) if options.disable_builtins else "(none - all on)"),
         "reverse proxy: "
         + (
             f"install Traefik at './{config.reverse_proxy.path}'"
@@ -429,3 +462,11 @@ class QuestionaryPrompter:
 
         answer = questionary.text(message, default=str(default), validate=_validate).unsafe_ask()
         return int(answer)
+
+    def checkbox(self, message: str, choices: Sequence[tuple[str, str]]) -> list[str]:
+        import questionary
+
+        q_choices = [questionary.Choice(title=label, value=value) for value, label in choices]
+        answer = questionary.checkbox(message, choices=q_choices).unsafe_ask()
+        # Questionary returns None on Ctrl-C and a list otherwise; normalize.
+        return [str(a) for a in (answer or [])]

{ignition_stack-0.2.0 → ignition_stack-0.3.0}/pyproject.toml

@@ -54,9 +54,10 @@ packages = ["ignition_stack"]
 
 [tool.hatch.build.targets.wheel.force-include]
 "modules.yaml" = "ignition_stack/modules.yaml"
+"builtin_modules.yaml" = "ignition_stack/builtin_modules.yaml"
 
 [tool.hatch.build.targets.sdist]
-include = ["ignition_stack", "tests", "README.md", "pyproject.toml", "modules.yaml"]
+include = ["ignition_stack", "tests", "README.md", "pyproject.toml", "modules.yaml", "builtin_modules.yaml"]
 
 [tool.ruff]
 line-length = 100