ignition-stack 0.4.0__tar.gz → 0.5.0__tar.gz

{ignition_stack-0.4.0 → ignition_stack-0.5.0}/.gitignore

@@ -30,3 +30,6 @@ Thumbs.db
 .env
 .env.local
 *.env
+
+# Tool artifacts
+.playwright-mcp/

{ignition_stack-0.4.0 → ignition_stack-0.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ignition-stack
-Version: 0.4.0
+Version: 0.5.0
 Summary: CLI that generates ready-to-run Docker Compose stacks for Ignition 8.3 SCADA demos and SE engagements
 Author-email: Eric Knorr <etknorr@gmail.com>
 License: MIT

{ignition_stack-0.4.0 → ignition_stack-0.5.0}/builtin_modules.yaml

@@ -25,6 +25,15 @@
 # `identifier` is the fully-qualified module id used verbatim in
 # GATEWAY_MODULES_ENABLED. `slug` is the friendly kebab name a user puts in
 # `disable_builtins`. `name` is the gateway's display name (for wizard labels).
+#
+# `default_enabled` marks the curated "typical demo" set the interactive wizard
+# pre-checks (opt-in selection). It does NOT change the engine math or the
+# non-interactive profile path - profiles still enable every built-in. It only
+# seeds the wizard's checkbox so the common path is a lean gateway. The JDBC
+# drivers are all `default_enabled: false` on purpose: the wizard enables the
+# one matching the chosen database (see `jdbc_driver_for`), not a static one.
+# The smoke guard checks the module *set*, not this curation flag, so the
+# default-set invariants live in tests/test_disable_builtins.py instead.
 
 version: 1
 
@@ -36,87 +45,116 @@ modules:
   - slug: alarm-notification
     identifier: com.inductiveautomation.alarm-notification
     name: Alarm Notification
+    default_enabled: true
   - slug: allen-bradley-driver
     identifier: com.inductiveautomation.opcua.drivers.ablegacy
     name: Allen-Bradley Driver
+    default_enabled: false
   - slug: bacnet-driver
     identifier: com.inductiveautomation.opcua.drivers.bacnet
     name: BACnet Driver
+    default_enabled: false
   - slug: enterprise-administration
     identifier: com.inductiveautomation.eam
     name: Enterprise Administration
+    default_enabled: false
   - slug: event-streams
     identifier: com.inductiveautomation.eventstream
     name: Event Streams
+    default_enabled: false
   - slug: historian-core
     identifier: com.inductiveautomation.historian
     name: Historian Core
+    default_enabled: true
   - slug: kafka-connector
     identifier: com.inductiveautomation.connectors.kafka
     name: Kafka Connector
+    default_enabled: false
   - slug: legacy-dnp3-driver
     identifier: com.inductiveautomation.opcua.drivers.dnp3
     name: Legacy DNP3 Driver
+    default_enabled: false
   - slug: logix-driver
     identifier: com.inductiveautomation.opcua.drivers.logix
     name: Logix Driver
+    default_enabled: false
   - slug: mariadb-jdbc-driver
     identifier: com.inductiveautomation.jdbc.mariadb
     name: MariaDB JDBC Driver
+    default_enabled: false
   - slug: micro800-driver
     identifier: com.inductiveautomation.opcua.drivers.micro800
     name: Micro800 Driver
+    default_enabled: false
   - slug: mitsubishi-driver
     identifier: com.inductiveautomation.opcua.drivers.mitsubishi
     name: Mitsubishi Driver
+    default_enabled: false
   - slug: modbus-driver
     identifier: com.inductiveautomation.opcua.drivers.modbus
     name: Modbus Driver
+    default_enabled: false
   - slug: mssql-jdbc-driver
     identifier: com.inductiveautomation.jdbc.mssql
     name: MSSQL JDBC Driver
+    default_enabled: false
   - slug: omron-driver
     identifier: com.inductiveautomation.opcua.drivers.omron
     name: Omron Driver
+    default_enabled: false
   - slug: opc-ua
     identifier: com.inductiveautomation.opcua
     name: OPC-UA
+    default_enabled: true
   - slug: perspective
     identifier: com.inductiveautomation.perspective
     name: Perspective
+    default_enabled: true
   - slug: postgresql-jdbc-driver
     identifier: com.inductiveautomation.jdbc.postgresql
     name: PostgreSQL JDBC Driver
+    default_enabled: false
   - slug: reporting
     identifier: com.inductiveautomation.reporting
     name: Reporting
+    default_enabled: true
   - slug: sfc
     identifier: com.inductiveautomation.sfc
     name: SFC
+    default_enabled: false
   - slug: siemens-drivers
     identifier: com.inductiveautomation.opcua.drivers.siemens
     name: Siemens Drivers
+    default_enabled: false
   - slug: siemens-enhanced-driver
     identifier: com.inductiveautomation.opcua.drivers.siemens-symbolic
     name: Siemens Enhanced Driver
+    default_enabled: false
   - slug: sms-notification
     identifier: com.inductiveautomation.sms-notification
     name: SMS Notification
+    default_enabled: false
   - slug: sql-bridge
     identifier: com.inductiveautomation.sqlbridge
     name: SQL Bridge
+    default_enabled: true
   - slug: sql-historian
     identifier: com.inductiveautomation.historian.sql
     name: SQL Historian
+    default_enabled: true
   - slug: symbol-factory
     identifier: com.inductiveautomation.symbol-factory
     name: Symbol Factory
+    default_enabled: false
   - slug: udp-and-tcp-drivers
     identifier: com.inductiveautomation.opcua.drivers.tcpudp
     name: UDP and TCP Drivers
+    default_enabled: false
   - slug: vision
     identifier: com.inductiveautomation.vision
     name: Vision
+    default_enabled: false
   - slug: webdev
     identifier: com.inductiveautomation.webdev
     name: WebDev
+    default_enabled: false

ignition_stack-0.5.0/ignition_stack/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.5.0"

{ignition_stack-0.4.0 → ignition_stack-0.5.0}/ignition_stack/catalog/builtins.py

@@ -52,6 +52,15 @@ class BuiltinModule(BaseModel):
         ),
     ]
     name: Annotated[str, Field(min_length=1, description="Gateway display name (wizard label).")]
+    default_enabled: Annotated[
+        bool,
+        Field(
+            default=False,
+            description=(
+                "Whether the wizard pre-checks this module in its opt-in selection. Curation only - it does not change the engine math or the non-interactive profile path."
+            ),
+        ),
+    ]
 
 
 class BuiltinCatalog(BaseModel):
@@ -80,6 +89,17 @@ class BuiltinCatalog(BaseModel):
         """Every known built-in slug."""
         return {m.slug for m in self.modules}
 
+    @property
+    def default_enabled_slugs(self) -> set[str]:
+        """Slugs the wizard pre-checks in its opt-in module selection.
+
+        Curation only: this seeds the wizard checkbox and never feeds the
+        engine math or the non-interactive profile path. The matching JDBC
+        driver is added on top by :func:`jdbc_driver_for`, so JDBC drivers are
+        deliberately absent here (they are database-driven, not statically on).
+        """
+        return {m.slug for m in self.modules if m.default_enabled}
+
     def identifiers_excluding(self, disabled_slugs: list[str]) -> list[str]:
         """FQ identifiers of every built-in whose slug is not in ``disabled_slugs``.
 
@@ -109,9 +129,7 @@ def load_builtin_catalog(path: Path | None = None) -> BuiltinCatalog:
     try:
         return BuiltinCatalog.model_validate(raw)
     except ValidationError as exc:
-        raise BuiltinCatalogLoadError(
-            f"{DEFAULT_BUILTIN_CATALOG_NAME} failed schema validation:\n{exc}"
-        ) from exc
+        raise BuiltinCatalogLoadError(f"{DEFAULT_BUILTIN_CATALOG_NAME} failed schema validation:\n{exc}") from exc
 
 
 @lru_cache(maxsize=1)
@@ -130,6 +148,29 @@ def builtin_slugs() -> frozenset[str]:
     return frozenset(default_builtin_catalog().slugs)
 
 
+# Which built-in JDBC driver the wizard enables for each database kind. The
+# catalog ships no MySQL-specific driver - Ignition connects to MySQL with the
+# wire-compatible MariaDB driver, so both map to it. Mongo (not a JDBC store)
+# and an absent database have no entry and resolve to None.
+_JDBC_DRIVER_FOR_DB: dict[str, str] = {
+    "postgres": "postgresql-jdbc-driver",
+    "mariadb": "mariadb-jdbc-driver",
+    "mysql": "mariadb-jdbc-driver",
+}
+
+
+def jdbc_driver_for(db_kind: str | None) -> str | None:
+    """The built-in JDBC driver slug the wizard enables for ``db_kind``.
+
+    Data-driven so the wizard stays declarative: postgres/mariadb map to their
+    own driver, mysql reuses the MariaDB driver, and mongo / no-database get
+    none. Returns ``None`` when no driver applies.
+    """
+    if db_kind is None:
+        return None
+    return _JDBC_DRIVER_FOR_DB.get(db_kind)
+
+
 def validate_disable_slugs(slugs: list[str]) -> None:
     """Raise ``ValueError`` if any slug is not a known built-in.
 
@@ -141,10 +182,7 @@ def validate_disable_slugs(slugs: list[str]) -> None:
     known = builtin_slugs()
     unknown = [s for s in slugs if s not in known]
     if unknown:
-        raise ValueError(
-            f"unknown built-in module slug(s): {', '.join(unknown)}. "
-            f"Valid slugs are: {', '.join(sorted(known))}"
-        )
+        raise ValueError(f"unknown built-in module slug(s): {', '.join(unknown)}. Valid slugs are: {', '.join(sorted(known))}")
 
 
 def _read_yaml_text(path: Path | None) -> str:
@@ -165,7 +203,5 @@ def _read_yaml_text(path: Path | None) -> str:
     repo_root = Path(__file__).resolve().parents[2]
     dev_path = repo_root / DEFAULT_BUILTIN_CATALOG_NAME
     if not dev_path.is_file():
-        raise BuiltinCatalogLoadError(
-            f"{DEFAULT_BUILTIN_CATALOG_NAME} not found in package data or at {dev_path}."
-        )
+        raise BuiltinCatalogLoadError(f"{DEFAULT_BUILTIN_CATALOG_NAME} not found in package data or at {dev_path}.")
     return dev_path.read_text(encoding="utf-8")

{ignition_stack-0.4.0 → ignition_stack-0.5.0}/ignition_stack/catalog/download.py

@@ -64,11 +64,7 @@ def download_entry(
     if entry.requires_manual_download:
         return _handle_manual(entry, target)
 
-    if (
-        target.exists()
-        and entry.sha256 != SHA256_UNPINNED
-        and sha256_of_file(target) == entry.sha256
-    ):
+    if target.exists() and entry.sha256 != SHA256_UNPINNED and sha256_of_file(target) == entry.sha256:
         return DownloadResult(
             entry.name,
             DownloadOutcome.SKIPPED_CACHED,
@@ -78,8 +74,7 @@ def download_entry(
 
     if offline:
         raise DownloadError(
-            f"{entry.name}: --offline set but artifact not in cache "
-            f"({target}). Pre-populate the cache or drop --offline.",
+            f"{entry.name}: --offline set but artifact not in cache " f"({target}). Pre-populate the cache or drop --offline.",
         )
 
     if entry.download_url is None:
@@ -94,8 +89,7 @@ def download_entry(
         if actual != entry.sha256:
             target.unlink(missing_ok=True)
             raise DownloadError(
-                f"{entry.name}: sha256 mismatch after download "
-                f"(expected {entry.sha256}, got {actual}). Cached file removed.",
+                f"{entry.name}: sha256 mismatch after download " f"(expected {entry.sha256}, got {actual}). Cached file removed.",
             )
 
     return DownloadResult(
@@ -121,11 +115,7 @@ def _handle_manual(entry: CatalogEntry, target: Path) -> DownloadResult:
             entry.name,
             DownloadOutcome.SKIPPED_MANUAL,
             None,
-            (
-                f"WARN: {entry.name} local_source_path missing ({source}). "
-                "Skipping: requires manual download. "
-                "See POST-SETUP.md for instructions."
-            ),
+            (f"WARN: {entry.name} local_source_path missing ({source}). " "Skipping: requires manual download. " "See POST-SETUP.md for instructions."),
         )
 
     shutil.copy2(source, target)

{ignition_stack-0.4.0 → ignition_stack-0.5.0}/ignition_stack/catalog/schema.py

@@ -65,35 +65,24 @@ class _EntryBase(BaseModel):
         str,
         Field(
             pattern=rf"^([0-9a-f]{{64}}|{SHA256_UNPINNED})$",
-            description=(
-                f"Lowercase hex sha256 of the artifact, or '{SHA256_UNPINNED}' "
-                "while a maintainer is mid-bump (rejected by `modules validate`)."
-            ),
+            description=(f"Lowercase hex sha256 of the artifact, or '{SHA256_UNPINNED}' " "while a maintainer is mid-bump (rejected by `modules validate`)."),
         ),
     ]
     install_path: Annotated[
         str,
         Field(
             min_length=1,
-            description=(
-                "Fully-qualified in-container destination path. The compose "
-                "layer mounts/copies the cached artifact here."
-            ),
+            description=("Fully-qualified in-container destination path. The compose " "layer mounts/copies the cached artifact here."),
         ),
     ]
     requires_license_env: str | None = Field(
         default=None,
-        description=(
-            "Name of an env var the user must set with their license key. "
-            "None for community-usable modules and unlicensed drivers."
-        ),
+        description=("Name of an env var the user must set with their license key. " "None for community-usable modules and unlicensed drivers."),
     )
     requires_manual_download: bool = Field(
         default=False,
         description=(
-            "True when the artifact has no public URL (e.g. EA-gated). "
-            "`modules download` skips these unless local_source_path is set "
-            "and points at an existing file."
+            "True when the artifact has no public URL (e.g. EA-gated). " "`modules download` skips these unless local_source_path is set " "and points at an existing file."
         ),
     )
     local_source_path: str | None = Field(
@@ -121,9 +110,7 @@ class ModuleEntry(_EntryBase):
             min_length=1,
             pattern=r"^[a-z0-9.]+$",
             description=(
-                "Fully-qualified module identifier (e.g. "
-                "'com.cirruslink.mqtt.engine.gateway'). Used verbatim in "
-                "ACCEPT_MODULE_LICENSES and ACCEPT_MODULE_CERTS. NOT a path."
+                "Fully-qualified module identifier (e.g. " "'com.cirruslink.mqtt.engine.gateway'). Used verbatim in " "ACCEPT_MODULE_LICENSES and ACCEPT_MODULE_CERTS. NOT a path."
             ),
         ),
     ]

{ignition_stack-0.4.0 → ignition_stack-0.5.0}/ignition_stack/cli.py

@@ -24,6 +24,7 @@ from ignition_stack.commands.modules import modules_app
 from ignition_stack.completion import (
     complete_disable_builtin,
     complete_edge_role,
+    complete_iiot_broker,
     complete_output_format,
     complete_profile,
     complete_redundant_role,
@@ -55,6 +56,13 @@ from ignition_stack.profiles import (
     get_profile,
     list_profiles,
 )
+from ignition_stack.profiles.carry import (
+    carry_registry,
+    database_carried_by_kind,
+    detect_iiot_broker,
+    is_default_representable,
+)
+from ignition_stack.services.loader import load_all_services
 from ignition_stack.services.resolver import resolve
 from ignition_stack.update_check import (
     check_for_update,
@@ -111,8 +119,7 @@ def _notify_update_available() -> None:
         return
     current, latest = result
     console.print(
-        f"[dim]update available[/dim] [yellow]{current}[/yellow] -> "
-        f"[green]{latest}[/green] · run: [cyan]{detect_upgrade_command()}[/cyan]",
+        f"[dim]update available[/dim] [yellow]{current}[/yellow] -> " f"[green]{latest}[/green] · run: [cyan]{detect_upgrade_command()}[/cyan]",
         highlight=False,
     )
 
@@ -153,18 +160,12 @@ def init(
     network_split: bool | None = typer.Option(
         None,
         "--network-split/--no-network-split",
-        help=(
-            "Force the frontend/backend network split on or off. Default follows "
-            "the profile (scaleout splits, hub-and-spoke does not)."
-        ),
+        help=("Force the frontend/backend network split on or off. Default follows " "the profile (scaleout splits, hub-and-spoke does not)."),
     ),
     reverse_proxy: str | None = typer.Option(
         None,
         "--reverse-proxy",
-        help=(
-            "Scaffold a reverse proxy of the given kind ('traefik'). Lays down a "
-            "README + POST-SETUP entry at --proxy-path. Omit for plain host-port mapping."
-        ),
+        help=("Scaffold a reverse proxy of the given kind ('traefik'). Lays down a " "README + POST-SETUP entry at --proxy-path. Omit for plain host-port mapping."),
         autocompletion=complete_reverse_proxy,
     ),
     proxy_path: str = typer.Option(
@@ -210,6 +211,26 @@ def init(
         ),
         autocompletion=complete_disable_builtin,
     ),
+    iiot: bool = typer.Option(
+        False,
+        "--iiot/--no-iiot",
+        help=(
+            "Overlay an MQTT/Sparkplug IIoT pipeline: add a broker and wire the "
+            "Cirrus Link Transmission/Engine modules across the gateways by role "
+            "(spokes/frontends transmit, hub/backend run Engine; a single gateway "
+            "runs both). Defaults the broker to 'chariot'."
+        ),
+    ),
+    iiot_broker: str | None = typer.Option(
+        None,
+        "--iiot-broker",
+        help=(
+            "MQTT broker slug the IIoT overlay wires to (implies --iiot). Must be "
+            "a catalog 'mqtt-broker' kind (e.g. 'chariot', 'emqx', 'hivemq'). "
+            "Defaults to 'chariot' when --iiot is given without this flag."
+        ),
+        autocompletion=complete_iiot_broker,
+    ),
     from_file: Path | None = typer.Option(  # noqa: B008 - Typer pattern
         None,
         "--from-file",
@@ -279,6 +300,8 @@ def init(
             proxy_path=proxy_path,
             redundant=redundant,
             disable_builtin=disable_builtin,
+            iiot=iiot,
+            iiot_broker=iiot_broker,
         )
 
     if dry_run:
@@ -300,19 +323,12 @@ def init(
     console.print("Next steps:")
     console.print(f"  cd {target}")
     console.print("  docker compose up -d")
-    console.print(
-        f"  open http://localhost:{config.gateways[0].http_port}  (admin / {config.admin_password})"
-    )
+    console.print(f"  open http://localhost:{config.gateways[0].http_port}  (admin / {config.admin_password})")
     console.print()
-    console.print(
-        f"  config recorded in {LIFECYCLE_DIR}/ - run `ignition-stack reset` to "
-        "regenerate or `switch-profile <name>` to reshape this stack."
-    )
+    console.print(f"  config recorded in {LIFECYCLE_DIR}/ - run `ignition-stack reset` to " "regenerate or `switch-profile <name>` to reshape this stack.")
 
 
-def _validate_init_flags(
-    *, profile: str | None, from_file: Path | None, dry_run: bool, fmt: str | None
-) -> None:
+def _validate_init_flags(*, profile: str | None, from_file: Path | None, dry_run: bool, fmt: str | None) -> None:
     """Enforce the mutual-exclusion + flag-applicability rules, or exit code 2.
 
     ``--from-file`` already fully specifies the topology, so combining it with
@@ -322,18 +338,13 @@ def _validate_init_flags(
     supported formats here so a bad ``--output-format`` fails before any build.
     """
     if from_file is not None and profile is not None:
-        console.print(
-            "[red]error[/red]: --from-file cannot be combined with --profile; a "
-            "config file already specifies the full topology."
-        )
+        console.print("[red]error[/red]: --from-file cannot be combined with --profile; a " "config file already specifies the full topology.")
         raise typer.Exit(code=2)
     if fmt is not None and not dry_run:
         console.print("[red]error[/red]: --output-format only applies with --dry-run.")
         raise typer.Exit(code=2)
     if fmt is not None and fmt not in {"yaml", "json"}:
-        console.print(
-            f"[red]error[/red]: unsupported --output-format '{fmt}'; use 'yaml' or 'json'."
-        )
+        console.print(f"[red]error[/red]: unsupported --output-format '{fmt}'; use 'yaml' or 'json'.")
         raise typer.Exit(code=2)
 
 
@@ -368,6 +379,8 @@ def _build_from_profile(
     proxy_path: str,
     redundant: str | None,
     disable_builtin: list[str],
+    iiot: bool,
+    iiot_broker: str | None,
 ) -> ProjectConfig:
     """Materialize a config from the named profile + CLI flags, or exit cleanly."""
     try:
@@ -377,6 +390,9 @@ def _build_from_profile(
         raise typer.Exit(code=2) from exc
 
     proxy = ReverseProxyConfig(kind=reverse_proxy, path=proxy_path) if reverse_proxy else None
+    # --iiot-broker implies --iiot, so naming a broker is enough to turn the
+    # overlay on; build_profile defaults the slug to 'chariot' when iiot is on
+    # without an explicit broker.
     options = ProfileOptions(
         spokes=spokes,
         frontends=frontends,
@@ -386,6 +402,8 @@ def _build_from_profile(
         reverse_proxy=proxy,
         redundant_role=redundant,
         disable_builtins=tuple(disable_builtin),
+        iiot=iiot or iiot_broker is not None,
+        iiot_broker=iiot_broker,
     )
     try:
         config = build_profile(profile, name, options)
@@ -474,9 +492,7 @@ def switch_profile(
     # 'gateway'), which the target profile may not have. Building its base
     # topology lets us check before build_profile's mark_redundant would reject
     # it - drop the intent with an advisory rather than failing the reshape.
-    if options.redundant_role is not None and not can_host_redundant_role(
-        get_profile(profile).build(current.name, options), options.redundant_role
-    ):
+    if options.redundant_role is not None and not can_host_redundant_role(get_profile(profile).build(current.name, options), options.redundant_role):
         console.print(
             f"[yellow]note[/yellow]: redundancy on '{options.redundant_role}' was not "
             f"carried to {profile} (no matching gateway); re-apply with --redundant "
@@ -492,6 +508,15 @@ def switch_profile(
         console.print(f"[red]error[/red]: {exc}")
         raise typer.Exit(code=2) from exc
 
+    # Re-graft the richer registry shapes ProfileOptions can't express (custom
+    # ids, per-instance overrides, partial attachment sets, a second database),
+    # re-mapping their attachments by role and dropping any that the new topology
+    # can't host - each with a printed advisory. Resolve first so the profile's
+    # legacy database is already lowered into per-gateway attachments; the carry's
+    # one-database-per-gateway guard then sees them and won't over-attach. The
+    # carry's output is resolved again by regenerate (resolve is idempotent).
+    new_config = carry_registry(resolve(new_config), current, console)
+
     files = regenerate(project_dir, new_config)
     console.print(f"[green]switched[/green] {current.profile or 'custom'} -> {profile}")
     console.print(f"  {len(files)} file(s) regenerated")
@@ -515,11 +540,7 @@ def _options_from_config(config: ProjectConfig) -> ProfileOptions:
     # by the resolver), so recover the role/name of whichever gateway is the
     # master and let the new profile re-expand the pair.
     redundant_role = next(
-        (
-            gw.role or gw.name
-            for gw in config.gateways
-            if gw.redundancy is not None and gw.redundancy.mode == "master"
-        ),
+        (gw.role or gw.name for gw in config.gateways if gw.redundancy is not None and gw.redundancy.mode == "master"),
         None,
     )
     # Disabled built-ins are applied stack-wide, so carry over the slugs disabled
@@ -528,16 +549,39 @@ def _options_from_config(config: ProjectConfig) -> ProfileOptions:
     # one node. The target profile re-applies it uniformly.
     disabled_sets = [set(gw.disable_builtins) for gw in config.gateways]
     disable_builtins = tuple(sorted(set.intersection(*disabled_sets))) if disabled_sets else ()
+    # A recorded config is resolved: its database + services live in the
+    # registry, not the legacy fields. Recover the profile inputs from the
+    # registry. The primary database rides database_kind (see below); the
+    # non-database instances that are default-representable ride `services`.
+    # IIoT intent is recovered from the attachment roles: a stack with any
+    # mqtt-transmission/mqtt-engine attachment was built with apply_iiot, so set
+    # iiot=True and the broker slug. build_profile re-runs the overlay in the new
+    # topology, re-mapping Transmission/Engine onto the new roles naturally; the
+    # broker instance is therefore excluded from `services` below to avoid a
+    # double-add. Anything richer than `services` can express (custom ids,
+    # per-instance overrides, partial/role-specific attachments, a second
+    # database) is carried after build_profile by carry_registry.
+    iiot_broker = detect_iiot_broker(config)
+    catalog = load_all_services()
+    representable = tuple(inst.service for inst in config.non_database_instances() if inst.service != iiot_broker and is_default_representable(inst, config, catalog))
+    # The primary database rides database_kind only when it has the clean
+    # canonical shape (id "db", default image/credentials, consumer on every
+    # non-Edge gateway). A custom primary database - or any second database - is
+    # left for carry_registry to re-graft, so database_kind stays None and the
+    # profile does not also lay down a colliding default DB.
+    carried_db = database_carried_by_kind(config, catalog)
     return ProfileOptions(
         spokes=spoke_count or 3,
         frontends=frontend_count or 1,
         edge_role=edge_roles[0] if edge_roles else "none",
         network_split=config.network_split,
         reverse_proxy=config.reverse_proxy,
-        database_kind=config.database.kind if config.database else None,
-        services=tuple(config.services),
+        database_kind=carried_db.service if carried_db is not None else None,
+        services=representable,
         redundant_role=redundant_role,
         disable_builtins=disable_builtins,
+        iiot=iiot_broker is not None,
+        iiot_broker=iiot_broker,
     )
 
 

{ignition_stack-0.4.0 → ignition_stack-0.5.0}/ignition_stack/commands/modules.py

@@ -100,8 +100,7 @@ def validate(
         raise typer.Exit(code=1)
 
     console.print(
-        f"[green]OK[/green]: {len(catalog.entries)} entries valid"
-        + (" (schema only)" if skip_network else " (schema + reachability)"),
+        f"[green]OK[/green]: {len(catalog.entries)} entries valid" + (" (schema only)" if skip_network else " (schema + reachability)"),
     )
 
 

{ignition_stack-0.4.0 → ignition_stack-0.5.0}/ignition_stack/completion.py

@@ -44,6 +44,22 @@ def complete_reverse_proxy(incomplete: str) -> list[str]:
     return [kind for kind in REVERSE_PROXY_VALUES if kind.startswith(incomplete)]
 
 
+def complete_iiot_broker(incomplete: str) -> list[tuple[str, str]]:
+    """MQTT broker slugs (with summary) the IIoT overlay can wire to.
+
+    Reads the bundled service catalog and offers only ``mqtt-broker`` kinds, the
+    slugs ``--iiot-broker`` accepts. Degrades to no suggestions on any error so a
+    TAB never breaks the shell line.
+    """
+    try:
+        from ignition_stack.services.loader import load_all_services
+
+        catalog = load_all_services()
+    except Exception:
+        return []
+    return [(slug, m.summary) for slug, m in sorted(catalog.items()) if m.kind == "mqtt-broker" and slug.startswith(incomplete)]
+
+
 # Roles `init --redundant` can pair. Only the singleton workhorse roles are
 # eligible (a scaleout 'backend', a hub-and-spoke 'hub', a standalone
 # 'gateway'); replicated 'frontend'/'spoke' tiers are rejected by the profile