mystack-rig 1.0.0__py3-none-any.whl

cli/vpn.py

@@ -0,0 +1,323 @@
+"""
+WireGuard VPN Management Module for Remote Development Environments
+"""
+import os
+import subprocess
+import json
+import tempfile
+import time
+from typing import Optional, Dict, Any, List
+from dataclasses import dataclass, field
+
+
+@dataclass
+class WireGuardConfig:
+    """WireGuard configuration for a VPN tunnel"""
+    interface_name: str = "wg0"
+    private_key: str = ""
+    public_key: str = ""
+    allowed_ips: List[str] = field(default_factory=lambda: ["0.0.0.0/0", "::0/0"])
+    endpoint: str = ""
+    persistent_keepalive: int = 25
+    ip_address: str = ""
+    subnet_mask: str = "24"
+
+
+class VPNManager:
+    """Manages WireGuard VPN connections for remote development environments"""
+    
+    def __init__(self, config: Optional[Dict[str, Any]] = None):
+        self.config = config or {}
+        self.interface_name = self.config.get('interface_name', 'wg0')
+        self.vpn_configs: Dict[str, WireGuardConfig] = {}
+        self._config_paths: Dict[str, str] = {}
+        
+    def generate_wireguard_keys(self) -> Dict[str, str]:
+        """Generate WireGuard key pair"""
+        try:
+            # Generate private key
+            result = subprocess.run(
+                ['wg', 'genkey'],
+                capture_output=True,
+                text=True,
+                timeout=10
+            )
+            if result.returncode != 0:
+                raise RuntimeError(f"Failed to generate private key: {result.stderr}")
+            private_key = result.stdout.strip()
+            
+            # Generate public key from private key
+            result = subprocess.run(
+                ['wg', 'pubkey'],
+                input=private_key,
+                capture_output=True,
+                text=True,
+                timeout=10
+            )
+            if result.returncode != 0:
+                raise RuntimeError(f"Failed to generate public key: {result.stderr}")
+            public_key = result.stdout.strip()
+            
+            return {
+                'private_key': private_key,
+                'public_key': public_key
+            }
+        except FileNotFoundError:
+            raise RuntimeError("WireGuard tools not found. Please install wireguard-tools")
+    
+    def create_wireguard_config(self, name: str, config: Dict[str, Any]) -> WireGuardConfig:
+        """Create a WireGuard configuration from dict"""
+        wg_config = WireGuardConfig(
+            interface_name=config.get('interface_name', self.interface_name),
+            private_key=config.get('private_key', ''),
+            public_key=config.get('public_key', ''),
+            allowed_ips=config.get('allowed_ips', ['0.0.0.0/0', '::0/0']),
+            endpoint=config.get('endpoint', ''),
+            persistent_keepalive=config.get('persistent_keepalive', 25),
+            ip_address=config.get('ip_address', ''),
+            subnet_mask=config.get('subnet_mask', '24')
+        )
+        self.vpn_configs[name] = wg_config
+        return wg_config
+    
+    def generate_wireguard_conf(self, wg_config: WireGuardConfig) -> str:
+        """Generate wg.conf format content for a WireGuard interface"""
+        # Handle IP address that may already include subnet mask
+        ip_addr = wg_config.ip_address
+        if '/' in ip_addr:
+            # IP already has subnet mask, use it as-is
+            address = ip_addr
+        else:
+            # Add subnet mask
+            address = f"{ip_addr}/{wg_config.subnet_mask}"
+        
+        conf_lines = [
+            f"[Interface]",
+            f"PrivateKey = {wg_config.private_key}",
+            f"Address = {address}",
+            f"ListenPort = 51820",
+            "",
+            f"[Peer]",
+            f"PublicKey = {wg_config.public_key}",
+            f"AllowedIPs = {', '.join(wg_config.allowed_ips)}",
+            f"Endpoint = {wg_config.endpoint}",
+            f"PersistentKeepalive = {wg_config.persistent_keepalive}"
+        ]
+        return '\n'.join(conf_lines)
+
+    def _config_path(self, name: str) -> str:
+        """Path wg-quick will accept.
+
+        wg-quick refuses a config whose mode and parent directory are both
+        world-accessible, and reading a config from /tmp can fail outright.
+        Root writes under /etc/wireguard; other users get a private directory.
+        The filename is the interface name, which must stay within 15 characters.
+        """
+        if os.geteuid() == 0:
+            directory = "/etc/wireguard"
+        else:
+            directory = os.path.join(tempfile.gettempdir(), f"rig-wg-{os.getuid()}")
+        os.makedirs(directory, mode=0o700, exist_ok=True)
+        if directory != "/etc/wireguard":
+            os.chmod(directory, 0o700)
+        return os.path.join(directory, f"wg-{name}.conf")
+
+    def save_wireguard_config(self, name: str, wg_config: WireGuardConfig,
+                             path: Optional[str] = None) -> str:
+        """Save WireGuard configuration to a mode-0600 file"""
+        if path is None:
+            path = self._config_path(name)
+        else:
+            parent = os.path.dirname(path) or "."
+            os.makedirs(parent, mode=0o700, exist_ok=True)
+
+        conf_content = self.generate_wireguard_conf(wg_config)
+        # O_CREAT honors umask, and O_TRUNC keeps a previous mode, so chmod after.
+        fd = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
+        with os.fdopen(fd, 'w') as handle:
+            handle.write(conf_content)
+        os.chmod(path, 0o600)
+        self._config_paths[name] = path
+        return path
+    
+    def setup_vpn_tunnel(self, name: str, wg_config: WireGuardConfig) -> bool:
+        """Setup a WireGuard VPN tunnel using wg-quick"""
+        try:
+            # Generate config file
+            config_path = self.save_wireguard_config(name, wg_config)
+            
+            # Apply configuration using wg-quick
+            result = subprocess.run(
+                ['wg-quick', 'up', config_path],
+                capture_output=True,
+                text=True,
+                timeout=30
+            )
+            
+            if result.returncode == 0:
+                print(f"✓ VPN tunnel '{name}' established successfully")
+                return True
+            else:
+                print(f"✗ Failed to setup VPN tunnel '{name}' ({config_path}): {result.stderr}")
+                return False
+                
+        except FileNotFoundError:
+            print("Error: wg-quick not found. Please install wireguard-tools")
+            return False
+        except Exception as e:
+            print(f"Error setting up VPN tunnel '{name}': {e}")
+            return False
+    
+    def teardown_vpn_tunnel(self, name: str) -> bool:
+        """Tear down a WireGuard VPN tunnel"""
+        try:
+            config_path = self._config_paths.get(name) or self._config_path(name)
+
+            result = subprocess.run(
+                ['wg-quick', 'down', config_path],
+                capture_output=True,
+                text=True,
+                timeout=30
+            )
+            
+            if result.returncode == 0:
+                print(f"✓ VPN tunnel '{name}' torn down successfully")
+                return True
+            else:
+                print(f"✗ Failed to teardown VPN tunnel '{name}' ({config_path}): {result.stderr}")
+                return False
+                
+        except Exception as e:
+            print(f"Error tearing down VPN tunnel '{name}': {e}")
+            return False
+    
+    def check_vpn_status(self, name: str) -> Dict[str, Any]:
+        """Check status of a WireGuard VPN tunnel"""
+        try:
+            # Get interface status using wg command
+            result = subprocess.run(
+                ['wg', 'show', 'interfaces'],
+                capture_output=True,
+                text=True,
+                timeout=10
+            )
+            
+            if result.returncode == 0:
+                interfaces = result.stdout.strip().split('\n')
+                is_up = name in interfaces
+                
+                # Get detailed interface info
+                detail_result = subprocess.run(
+                    ['wg', 'show', name],
+                    capture_output=True,
+                    text=True,
+                    timeout=10
+                )
+                
+                return {
+                    'name': name,
+                    'up': is_up,
+                    'status': detail_result.stdout if is_up else 'not active',
+                    'error': detail_result.stderr if not is_up else None
+                }
+            else:
+                return {
+                    'name': name,
+                    'up': False,
+                    'status': 'unknown',
+                    'error': result.stderr
+                }
+                
+        except Exception as e:
+            return {
+                'name': name,
+                'up': False,
+                'status': 'error',
+                'error': str(e)
+            }
+    
+    def list_active_tunnels(self) -> List[str]:
+        """List all active WireGuard tunnels"""
+        try:
+            result = subprocess.run(
+                ['wg', 'show', 'interfaces'],
+                capture_output=True,
+                text=True,
+                timeout=10
+            )
+            
+            if result.returncode == 0:
+                return [iface.strip() for iface in result.stdout.strip().split('\n') if iface]
+            return []
+        except Exception:
+            return []
+    
+    def setup_vpn_with_credentials(self, name: str, endpoint: str, 
+                                   private_key: str, peer_public_key: str,
+                                   allowed_ips: Optional[List[str]] = None) -> bool:
+        """Setup VPN tunnel using provided credentials"""
+        # Generate key pair for local interface
+        keys = self.generate_wireguard_keys()
+        
+        # Create config
+        wg_config = WireGuardConfig(
+            interface_name=name,
+            private_key=keys['private_key'],
+            public_key=peer_public_key,
+            allowed_ips=allowed_ips or ["0.0.0.0/0", "::0/0"],
+            endpoint=endpoint,
+            ip_address="10.0.0.2/24"  # Default IP for dev tunnel
+        )
+        
+        return self.setup_vpn_tunnel(name, wg_config)
+
+
+def setup_remote_vpn_connection(vpn_config: Dict[str, Any]) -> bool:
+    """
+    Setup VPN connection to remote gateway for accessing dependent services
+    
+    This function creates a WireGuard tunnel to a remote VPN gateway that
+    provides access to development services that may be behind firewalls.
+    
+    Args:
+        vpn_config: Dictionary containing VPN configuration:
+            - endpoint: VPN gateway endpoint (host:port)
+            - private_key: Local WireGuard private key
+            - peer_public_key: Remote gateway's public key
+            - allowed_ips: IPs/ranges accessible through VPN
+            - interface_name: Name of the WireGuard interface
+    
+    Returns:
+        bool: True if VPN tunnel was established successfully
+    """
+    manager = VPNManager()
+    
+    try:
+        # Generate local keys if not provided
+        if not vpn_config.get('private_key') or not vpn_config.get('peer_public_key'):
+            keys = manager.generate_wireguard_keys()
+            vpn_config['private_key'] = keys['private_key']
+        
+        # Create and setup VPN config
+        wg_config = manager.create_wireguard_config(
+            vpn_config.get('interface_name', 'wg0'),
+            vpn_config
+        )
+        
+        return manager.setup_vpn_tunnel(vpn_config.get('interface_name', 'wg0'), wg_config)
+        
+    except Exception as e:
+        print(f"Error setting up VPN connection: {e}")
+        return False
+
+
+def get_vpn_status(interface_name: str = "wg0") -> Dict[str, Any]:
+    """Get status of VPN connection"""
+    manager = VPNManager()
+    return manager.check_vpn_status(interface_name)
+
+
+def teardown_vpn_connection(interface_name: str = "wg0") -> bool:
+    """Tear down VPN connection"""
+    manager = VPNManager()
+    return manager.teardown_vpn_tunnel(interface_name)

mystack_rig-1.0.0.dist-info/METADATA

@@ -0,0 +1,285 @@
+Metadata-Version: 2.4
+Name: mystack-rig
+Version: 1.0.0
+Summary: Ephemeral remotes with full local parity for coding agents
+Author: mystack-cloud
+License-Expression: MIT
+Project-URL: Homepage, https://github.com/mystack-cloud/rig
+Project-URL: Source, https://github.com/mystack-cloud/rig
+Project-URL: Issues, https://github.com/mystack-cloud/rig/issues
+Keywords: remote-development,coding-agents,hetzner
+Classifier: Programming Language :: Python :: 3
+Classifier: Operating System :: OS Independent
+Requires-Python: >=3.7
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: requests>=2.25.0
+Requires-Dist: ansible>=4.0.0
+Requires-Dist: boto3>=1.26.0
+Requires-Dist: PyYAML>=6.0
+Requires-Dist: cryptography>=41.0.0
+Requires-Dist: importlib-metadata>=4.0; python_version < "3.8"
+Dynamic: license-file
+
+[![Tests](https://github.com/mystack-cloud/rig/actions/workflows/tests.yml/badge.svg)](https://github.com/mystack-cloud/rig/actions/workflows/tests.yml)
+[![codecov](https://codecov.io/gh/mystack-cloud/rig/graph/badge.svg)](https://codecov.io/gh/mystack-cloud/rig)
+
+# rig
+
+Secure, fast, cost-efficient ephemeral remotes with full local parity—so coding agents and humans can develop and e2e-test for real.
+
+```bash
+pip install mystack-rig
+rig init
+rig create
+```
+
+The published project name is `mystack-rig` (the PyPI name `rig` belongs to another project). The command is still `rig`. From a checkout, `pip install .` installs the same command.
+
+## Architecture
+
+Run `rig` from your machine, CI/CD, or a control plane: it provisions cloud VMs you can create and dispose anytime, and you work on `/workspace` via agent TTY or editor. SSH/HTTPS reaches VMs through the firewall; HTTPS reaches the provider. The CLI stores env state in S3-compatible object storage.
+
+![rig architecture](docs/architecture.png)
+
+## Cloud providers
+
+| Provider | `host.provider` | Status |
+| --- | --- | --- |
+| [Hetzner Cloud](https://www.hetzner.com/cloud) | `hetzner` (default) | Supported (VMs, firewall, snapshots, S3-compatible object storage) |
+| [AWS](https://aws.amazon.com/) | `aws` | Coming next |
+| [GCP](https://cloud.google.com/) | `gcp` | Coming next |
+
+`rig create` reads `host.provider`. Omit it and the provider is Hetzner. `--provider` overrides the file. `aws` and `gcp` are accepted as names and refused until those clouds can provision.
+
+## Coding agents
+
+Chosen at `rig init` (`agent.enabled` in `rig.yml`, same multi-select as git projects: numbers, names, or `all`). Every selected agent is installed and configured on the VM. When more than one is selected, init asks which is the default for `rig attach` (`agent.default`). Pass `--agent` to open another one.
+
+| Agent | `agent.default` | API key |
+| --- | --- | --- |
+| [OpenCode](https://opencode.ai) | `opencode` (default) | Optional. One agent: `coding_agent_api_key`. Several agents: `opencode_api_key`. Enter skips and uses free Zen models |
+| [Claude Code](https://docs.anthropic.com/en/docs/claude-code) | `claude` | One agent: `coding_agent_api_key` (Anthropic). Several agents: `claude_api_key` |
+| [Cursor CLI](https://cursor.com/docs/cli/overview) | `cursor` | One agent: `coding_agent_api_key` (`CURSOR_API_KEY`). Several agents: `cursor_api_key` |
+
+Each selected agent is asked for its own key. Scaffolds land under `.rig/.opencode/`, `.rig/.claude/`, and `.rig/.cursor/` (plus shared `AGENTS.md`). Independent of `editor` (local IDE for `rig dev`).
+
+## IDEs
+
+`rig dev` opens the remote `/workspace`. Default is local editor + Remote-SSH; `--browser` uses code-server on the VM.
+
+| Mode | Clients |
+| --- | --- |
+| Remote-SSH (default) | VS Code (`code`), VS Code Insiders (`code-insiders`), Cursor (`cursor`), VSCodium (`codium`) |
+| Browser (`--browser`) | code-server (password: vaulted `vscode_browser_password`) |
+
+Chosen at `rig init` (`editor.enabled` in `rig.yml`, same multi-select as git projects: numbers, names, or `all`). When more than one is selected, init asks which is the default for `rig dev` (`editor.default`). Pass `--editor` to open another enabled one. These are local clients: nothing extra is installed on the VM, and each IDE downloads its own remote server the first time it connects. Browser login: `rig vars decrypt vscode_browser_password`.
+
+## Layout
+
+`rig init` writes commit-friendly files into the current directory (including a subdirectory of a git repo):
+
+```text
+rig.yml                 # workspace manifest (vm, agent, playbooks, repos)
+.gitignore              # adds .rig/collections, roles, inventory (via init)
+.rig/
+  provision.yml         # managed; create base environment (cached)
+  configure.yml         # user; image/service customizations (cached)
+  authorize.yml         # managed; inject credentials (never snapshotted)
+  materialize.yml       # user; populate /workspace after authorize
+  finalize.yml          # user; destruction hooks before managed destroy
+  destroy.yml           # managed; teardown system resources before VM delete
+  vars.yml              # Shared Ansible vars (vaulted with shared data key)
+  vars.<identity>.yml   # Personal secrets + master-key wraps (committed)
+  requirements.yml      # Galaxy collections/roles
+  local_roles/          # committed Ansible roles (searched first)
+  AGENTS.md             # agent instructions
+  .opencode/ | .claude/ | .cursor/  # agent config + MCP
+  inventory.yml         # generated at create/apply (gitignored)
+  collections/ roles/    # Galaxy installs (gitignored)
+```
+
+Put a committed role at `.rig/local_roles/<name>/` (`tasks/main.yml` and the usual role layout). `rig init` creates the directory. Galaxy roles install into `.rig/roles/` and stay gitignored. Ansible checks that directory before the configured path, so each committed role is linked there and wins over a Galaxy role of the same name. An older `.rig/galaxy_roles/` directory is moved into `roles` on the next init or apply.
+
+`rig.yml` defaults (edit to configure):
+
+```yaml
+host:
+  provider: hetzner        # hetzner (default) | aws | gcp
+  type: vm                 # kind of machine; vm is the default
+  server_type: cax11       # Hetzner server type
+  availability_zone: hel1
+  image: ubuntu-24.04
+firewall:
+  mode: dynamic_add   # open | static | dynamic_replace | dynamic_add
+  allowed_ips: []     # static allow-list; also merged into dynamic modes
+  ports: []           # extra inbound ports, e.g. [8080, "3000-3001", {port: 53, protocol: udp}]
+agent:
+  default: opencode       # default for `rig attach`; or claude | cursor
+  enabled: [opencode]     # agents installed on the VM
+editor:
+  default: code           # default for `rig dev`
+  enabled: [code]         # local IDEs `rig dev --editor` may open
+playbooks:
+  provision: .rig/provision.yml
+  configure: .rig/configure.yml
+  authorize: .rig/authorize.yml
+  materialize: .rig/materialize.yml
+  finalize: .rig/finalize.yml
+  destroy: .rig/destroy.yml
+```
+
+Firewall modes:
+
+| Mode | Behavior |
+| --- | --- |
+| `open` | SSH/ICMP from anywhere (`0.0.0.0/0`) |
+| `static` | Only `allowed_ips` (no client detection) |
+| `dynamic_replace` | Set allow-list to current CLI public IP (+ `allowed_ips`); drops previous IPs |
+| `dynamic_add` (default) | Keep existing allow-list entries; add current CLI public IP if missing |
+
+Attach / apply / dev / destroy refresh the firewall for dynamic modes when the client IP changes, and keep `ports` in sync.
+
+`firewall.ports` opens extra inbound listeners with the same source-IP policy as SSH (TCP by default; use `{port, protocol}` for UDP).
+
+Remote project files live under `/workspace` (not `/root`).
+
+## Lifecycle
+
+```text
+init  →  create  →  attach | dev | apply  →  destroy
+              ↓
+         snapshots (reuse on next create)
+
+create playbooks:
+  provision → configure → [snapshot] → authorize → materialize
+
+destroy playbooks:
+  finalize → destroy → (delete VM / firewall / key)
+```
+
+| Stage | File | Owner | Meaning |
+| --- | --- | --- | --- |
+| **provision** | `provision.yml` | managed | Create managed base environment |
+| **configure** | `configure.yml` | user | Apply user image/service customizations (cached) |
+| **authorize** | `authorize.yml` | managed | Inject credentials and establish access |
+| **materialize** | `materialize.yml` | user | Populate `/workspace` |
+| **finalize** | `finalize.yml` | user | Run user-defined destruction hooks |
+| **destroy** | `destroy.yml` | managed | Remove managed environment (before CLI deletes VM) |
+
+| Command | What happens |
+| --- | --- |
+| **init** | Scaffold `rig.yml` + `.rig/`. Collect Hetzner creds, repo PATs, agent choices and a key per agent. |
+| **create** | Boot VM (base/system snapshot). Run provision → configure → authorize → materialize. Snapshot after **configure** only. |
+| **apply** | Default: authorize → materialize. Flags: `--provision` / `--configure` / `--authorize` / `--materialize`. |
+| **attach** | SSH TTY into `opencode` / `claude` / Cursor `agent` on `/workspace`. `--agent` picks among installed agents. |
+| **dev** | Open VS Code/Cursor via Remote-SSH on `/workspace` (or `--browser` for code-server). |
+| **destroy** | Run finalize → destroy playbooks, then delete VM / firewall / SSH key. |
+
+Put secret-free installs in `configure.yml` (cached). Put clone/setup that needs credentials in `materialize.yml`.
+
+Last env name is remembered in `/tmp/.rig/last-env` (used when `name` is omitted).
+
+After you leave an agent TTY, rig captures the printed session / resume id (when the agent prints one) under `/tmp/.rig/sessions/<env>`. A later bare `rig attach` reopens that session (`--session` for OpenCode, `--resume` for Claude Code / Cursor). Pass `-c` / `--session` / `--resume` to override.
+
+### Snapshots
+
+| Boot source | Skips |
+| --- | --- |
+| `rig-{version}-{hash}` | provision + configure (`authorize` + `materialize` still run) |
+| base image | nothing |
+
+**System hash** = var map (`coding_agent_type`, `coding_agent_types`, `git_providers`, `code_server_*`, `workspace_root`) + `provision.yml` + `configure.yml`. Secrets and `authorize.yml` / `materialize.yml` are not included.
+
+Override with `--force-playbooks` / `--force-system` (force provision+configure) / `--force-workspace` (force materialize).
+
+`rig cache list|clear` — show snapshots (and for clear, confirm then delete):
+
+| Flags | Selection |
+| --- | --- |
+| (default) | unused system (+ legacy workspace) for current project |
+| `--system` | system only |
+| `--workspace` | legacy workspace snapshots (current project) |
+| `--all` | include current (not only unused) |
+| `--all --system` / `--all --workspace` | all of that kind, including current |
+
+`-y` skips the confirmation on clear.
+
+## CLI
+
+Global: `-v` playbook tasks and debug · `-vv`/`-vvv`/`-vvvv` ansible verbosity · `-q` warnings/errors only · `--version`. A failed task is shown without `-v`.
+
+| Command | Args | Notes |
+| --- | --- | --- |
+| `init` | | Interactive scaffold |
+| `create` | `[--name]` `[--provider]` `[--type]` `[--availability-zone]` `[--image]` `[--no-attach]` `[--force-playbooks\|--force-system\|--force-workspace]` | Host defaults from `rig.yml`. `--provider` defaults to `hetzner`. `--type` sets `host.server_type`. `host.type` defaults to `vm`. `--region` aliases `--availability-zone`. |
+| `apply` | `[name]` `[--provision\|--configure\|--authorize\|--materialize]` | Default: authorize then materialize |
+| `attach` | `[name]` `[-c\|--continue]` `[-s\|--session ID]` `[--resume [ID]]` `[--agent opencode\|claude\|cursor]` `[-- …agent args]` | Reopens last remembered session by default; `--agent` picks which installed agent |
+| `ssh` | `[name]` `[-- command]` | Shell on the VM in `/workspace`. A command after `--` runs instead of a login shell |
+| `dev` | `[name]` `[--path /workspace]` `[--browser]` `[--editor code\|cursor\|…]` | Remote-SSH by default; `--editor` opens another IDE from `editor.enabled`. Defaults to `editor.default` |
+| `list` | | Lists envs, or `No remote environments` |
+| `destroy` | `[name …]` | Runs finalize then destroy playbooks first; multi-name OK |
+| `cache` | `list\|clear` `[--system\|--workspace] [--all] [-y]` | List or clear; unused by default, `--all` includes current |
+| `vars encrypt` | `[--stdin-name VAR]` `[--personal]` | Vault into shared or identity vars (after master-key unlock) |
+| `vars decrypt` | `[VAR]` | Decrypt from shared or identity vars |
+| `vars list` | | List vaulted names (`shared` / `identity`) |
+| `vars export-shared-key` | | Print shared data key for teammate onboarding |
+
+## Ansible variables
+
+Playbooks load `.rig/vars.yml` then `.rig/vars.{identity}.yml` (personal wins), then runtime `rig_*` extras. Prefer `{{ rig_env_name }}` over hard-coding.
+
+| Variable | Meaning |
+| --- | --- |
+| `rig_env_name` | Env / VM name (`dev-…`) |
+| `rig_workspace_name` | `rig.yml` `name` |
+| `rig_vm_name` | VM name (usually same as env) |
+| `rig_cloud_provider` | Cloud provider (`host.provider`, default `hetzner`) |
+| `rig_vm_type` | Hetzner server type (`host.server_type`) |
+| `rig_availability_zone` | Hetzner location (`hel1`, …) |
+| `rig_vm_image` | Boot image or snapshot id |
+| `rig_vm_ip` | Public IPv4 |
+| `rig_vm_id` | Hetzner server id |
+| `rig_agent_type` | Default attach agent (`opencode`, `claude`, or `cursor`) |
+| `rig_agent_types` | Agents installed on the VM |
+| `rig_workspace_root` | `/workspace` |
+| `rig_version` | Installed `rig` package version |
+| `rig_boot_source` | `base` \| `system` \| `workspace` |
+| `rig_action` | `create` \| `apply` \| `destroy` |
+| `rig_project_dir` | Local project path |
+| `rig_ssh_key_name` / `rig_ssh_key_path` | Local key under `/tmp` |
+| `rig_firewall_name` | Firewall resource name |
+| `rig_repos` | `[{name, url, path}, …]` (no secrets) |
+| `rig_git_providers` | e.g. `github`, `gitlab` |
+
+Also available from vars files (defaults): `workspace_root`, `coding_agent_type`, `coding_agent_types`, `git.clone_repos`. On `rig init`, git PATs and each coding agent API key default to **personal** storage in `vars.{identity}.yml` (you are asked to confirm once); shared secrets such as `vscode_browser_password` live in `vars.yml`.
+
+`vscode_browser_password` is auto-generated (vaulted) for code-server browser login (`rig dev --browser`). Reveal with `rig vars decrypt vscode_browser_password` (also printed when opening browser mode).
+
+## Credentials
+
+| Source | Purpose |
+| --- | --- |
+| `~/.rig/config` | Hetzner token (+ optional S3) and `identity`. Profile via `RIG_PROFILE`. Env vars override. |
+| Personal master key | Prompted on init/unlock; **never stored**. Unwraps data keys from `vars.{identity}.yml`. |
+| `rig_identity_data_key` / `rig_shared_data_key` | Master-key wraps inside `vars.{identity}.yml` (committed). |
+| `/tmp/.rig/.personal-data-key` / `.shared-data-key` | Materialized Ansible vault passwords after unlock (tmpfs). |
+| `/tmp/<env>-key` | Per-env SSH private key (attach / apply / destroy finalizers). |
+
+`RIG_IDENTITY` overrides the configured identity. Teammates joining an existing workspace paste the shared data key once (`rig vars export-shared-key` from an unlocked machine).
+
+OpenCode without an API key uses free Zen models. With a key, config switches to the paid provider path. When several agents are selected, keys are `opencode_api_key`, `claude_api_key`, and `cursor_api_key` (`RIG_OPENCODE_API_KEY`, `RIG_ANTHROPIC_API_KEY`, `RIG_CURSOR_API_KEY`). A single agent still uses `coding_agent_api_key` (`RIG_CODING_AGENT_API_KEY`).
+
+## Tests
+
+```bash
+python -m pytest tests/ -m "not requires_credentials"
+```
+
+## Release
+
+Push a version tag to publish that version to PyPI. The package version is the tag without an optional leading `v` (`v0.2.0` publishes `0.2.0`). The workflow reads the GitHub Actions secret `PYPI_API_TOKEN` (a PyPI API token, including the `pypi-` prefix).
+
+## License
+
+MIT

mystack_rig-1.0.0.dist-info/RECORD

@@ -0,0 +1,22 @@
+cli/__init__.py,sha256=-ciwSOiwx1UsWSF9s5yCz9dnIulJIE3ZMLIDLsLQBbc,169
+cli/__main__.py,sha256=B0RRFlUUocxDC_pprm5E6wnbFM3bCAG3KVtRFv8q1zM,87
+cli/agents.py,sha256=-cZp1sXrW3b_Axw5zSiaCqq2YuxJGswQ1MI8CqxerH4,18754
+cli/config.py,sha256=MqA6SOJgK2JjArXdPSlQKHQI8pxRzKRVle6trCdrvGk,9559
+cli/encrypt.py,sha256=bKRtXS1_1zkoESKDSgvQEGvx67J5nn2Kap8DQ3ucIiM,39448
+cli/git.py,sha256=4LZ4jz9gmDaejK0z51uIS4KtiVGcNS5Y6QtoUC-1uRA,12371
+cli/last_env.py,sha256=nIaAulm46qQNkXGQ499zpdUkPgo-u-oCo8GlZOcFKmw,1766
+cli/last_session.py,sha256=6UMsdCsLeRn_lBY4eARtU-lb3kxxPaez5dZdyvex4H8,5775
+cli/log.py,sha256=BvXdmqWuyF5xZglMn5Jj4jArstBl4a7TxdUyRoRDMuc,3078
+cli/main.py,sha256=rIMBjbq5DcsCgwSwAFlyxj3EbB-9m6ENvnRMtvMs3_E,41014
+cli/remote_dev.py,sha256=51rHLXoSg-XyBpV-ul6pw2Rxb2ltpbDL-zi-d1JkZbs,209529
+cli/requirements.txt,sha256=B8FET7ZhGdph7K4ttgPJQ-qJJlkAU2xZGRy8pZ_FZDM,66
+cli/snapshots.py,sha256=EwHsJg6RpkJ_ZFgXOTnNkxZruAgB15sNxREBsv7Uhn4,22554
+cli/storage.py,sha256=YVtN7TxLRBXzXdJDO5LhlouR2sMf8xAo74leAaiYXWQ,15043
+cli/vault_keys.py,sha256=2ihw6Cs4EkEWsLms6r3rfhzU1axgOXxUMwvBUJIG9Vc,14629
+cli/vpn.py,sha256=uDYLIwApxchu0qDEI86_RWF2TF8gG-kZOK4aQXavyps,12065
+mystack_rig-1.0.0.dist-info/licenses/LICENSE,sha256=tElGVkkp8Hajzs6sTCoFB-CHyB-HI0Uef153x8gShyc,1070
+mystack_rig-1.0.0.dist-info/METADATA,sha256=6cq4DCBh0isMgq0z5Ly0xGwbAEpHcm-IC_Abx1lsOBo,15837
+mystack_rig-1.0.0.dist-info/WHEEL,sha256=mOdXR9C3wMVov7cSY8PY-XCzo3SmmWCHvGQr5csJoao,91
+mystack_rig-1.0.0.dist-info/entry_points.txt,sha256=7rKgUV61sb1aDDLrujIDlYEQ8qvMeu3EPUyTvtGSIDo,38
+mystack_rig-1.0.0.dist-info/top_level.txt,sha256=2ImG917oaVHlm0nP9oJE-Qrgs-fq_fGWgba2H1f8fpE,4
+mystack_rig-1.0.0.dist-info/RECORD,,

mystack_rig-1.0.0.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: setuptools (84.2.1)
+Root-Is-Purelib: true
+Tag: py3-none-any
+

mystack_rig-1.0.0.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+rig = cli.main:main

mystack_rig-1.0.0.dist-info/licenses/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 mystack-cloud
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

mystack_rig-1.0.0.dist-info/top_level.txt

@@ -0,0 +1 @@
+cli