nullforge 0.1.0__py3-none-any.whl

nullforge/templates/scripts/telemt-synfix.sh

@@ -0,0 +1,89 @@
+#!/usr/bin/env bash
+#
+# MEKO-style SYN rate-limiting fix for the telemt MTProto port.
+# https://github.com/Mekotofeuka/MTPROTO_FIX_By_MEKO
+#
+# Non-iOS clients are throttled per source IP (default 54 SYN/minute, burst 1);
+# excess connection attempts get a TCP reset so dead sockets are reaped in
+# minutes. Small low-TTL SYNs (the iOS fingerprint) bypass limit for fast reconnects.
+# Under-limit and iOS traffic RETURN to the normal INPUT path, so this coexists
+# with UFW/firewalld (the port must still be  allowed there).
+# Best-effort: failures are logged, never fatal to startup.
+#
+
+set -uo pipefail
+
+cmd=${1:?up|down}
+PORT=${2:-443}
+RATE=${3:-54/minute}
+BURST=${4:-1}
+IOS_TTL=${5:-65}
+
+CHAIN="MTPR_SYNFIX"
+HL_NAME="mtpr${PORT}"
+
+log() { logger -t telemt-synfix -- "$*"; }
+
+up_family() {
+  # $1 = iptables|ip6tables ; remaining args = iOS-bypass match (may be empty)
+  local ipt=$1
+  shift
+
+  "$ipt" -N "$CHAIN" 2>/dev/null || "$ipt" -F "$CHAIN" || return 1
+
+  if [ "$#" -gt 0 ]; then
+    "$ipt" -A "$CHAIN" -p tcp --dport "$PORT" --syn "$@" -j RETURN || return 1
+  fi
+
+  "$ipt" -A "$CHAIN" -p tcp --dport "$PORT" --syn \
+    -m hashlimit \
+    --hashlimit-name "$HL_NAME" \
+    --hashlimit-mode srcip \
+    --hashlimit-upto "$RATE" \
+    --hashlimit-burst "$BURST" \
+    --hashlimit-htable-expire 60000 \
+    --hashlimit-htable-size 32768 \
+    -j RETURN || return 1
+
+  "$ipt" -A "$CHAIN" -p tcp --dport "$PORT" --syn -j REJECT --reject-with tcp-reset || return 1
+
+  # Ensure exactly one jump from INPUT, evaluated before other allow rules.
+  while "$ipt" -D INPUT -p tcp --dport "$PORT" --syn -j "$CHAIN" 2>/dev/null; do :; done
+  "$ipt" -I INPUT 1 -p tcp --dport "$PORT" --syn -j "$CHAIN" || return 1
+}
+
+down_family() {
+  local ipt=$1
+  while "$ipt" -D INPUT -p tcp --dport "$PORT" --syn -j "$CHAIN" 2>/dev/null; do :; done
+  "$ipt" -F "$CHAIN" 2>/dev/null || true
+  "$ipt" -X "$CHAIN" 2>/dev/null || true
+}
+
+case "$cmd" in
+  up)
+    if up_family iptables -m length --length 64 -m ttl --ttl-lt "$IOS_TTL"; then
+      log "up: ipv4 chain=$CHAIN port=$PORT rate=$RATE burst=$BURST ios_ttl<$IOS_TTL"
+    else
+      log "up: ipv4 synfix not applied (missing iptables modules?)"
+    fi
+
+    if command -v ip6tables >/dev/null 2>&1; then
+      if up_family ip6tables -m hl --hl-lt "$IOS_TTL"; then
+        log "up: ipv6 chain=$CHAIN port=$PORT rate=$RATE burst=$BURST"
+      else
+        log "up: ipv6 synfix not applied"
+      fi
+    fi
+    ;;
+  down)
+    down_family iptables
+    command -v ip6tables >/dev/null 2>&1 && down_family ip6tables
+    log "down: chain=$CHAIN port=$PORT cleaned"
+    ;;
+  *)
+    echo "usage: $0 {up|down} [port] [rate] [burst] [ios_ttl]" >&2
+    exit 1
+    ;;
+esac
+
+exit 0

nullforge/templates/scripts/teleproxy-warp.sh

@@ -0,0 +1,127 @@
+#!/usr/bin/env bash
+#
+# Per-uid policy routing that steers a service user's Telegram-bound traffic
+# through the Cloudflare WARP interface, leaving all other egress untouched.
+#
+# Usage: teleproxy-warp.sh {up|down} [svc_user] [iface] [table] [tid] [prio]
+#
+# Routing is scoped to the service uid and to Telegram's published CIDRs, so the
+# proxy reaches Telegram over WARP while clients still connect to it directly.
+# IPv4 fails closed for the service user when WARP has no v4 address; IPv6 is
+# optional and skipped entirely when absent.
+#
+
+set -euo pipefail
+
+cmd=${1:?up|down}
+SVC_USER=${2:-telemt}         # daemon's systemd User=
+IFACE=${3:-warp}              # WARP interface (usque -n <iface>)
+TABLE=${4:-tpwarp}            # dedicated routing table, separate from WARP's own
+TID=${5:-124}
+PRIO=${6:-11900}              # rule priority (below the WARP policy band, above main)
+WAIT_SECS=15
+
+CIDR_URLS=(
+  "https://core.telegram.org/resources/cidr.txt"
+)
+
+# Embedded fallback (core.telegram.org/resources/cidr.txt, verified 2026-05)
+FB_V4="91.108.56.0/22 91.108.4.0/22 91.108.8.0/22 91.108.16.0/22 91.108.12.0/22 149.154.160.0/20 91.105.192.0/23 91.108.20.0/22 185.76.151.0/24"
+FB_V6="2001:b28:f23d::/48 2001:b28:f23f::/48 2001:67c:4e8::/48 2001:b28:f23c::/48 2a0a:f280::/32"
+
+V4=""
+V6=""
+
+log() { logger -t telemt-warp -- "$*"; }
+
+ensure_table() {
+  grep -qE "^[[:space:]]*$TID[[:space:]]+$TABLE$" /etc/iproute2/rt_tables \
+    || echo "$TID $TABLE" >> /etc/iproute2/rt_tables
+}
+
+get_warp6() { ip -6 -o addr show dev "$IFACE" scope global 2>/dev/null | awk '{print $4}' | head -n1 | cut -d/ -f1; }
+get_warp4() { ip -4 -o addr show dev "$IFACE" scope global 2>/dev/null | awk '{print $4}' | head -n1 | cut -d/ -f1; }
+
+wait_for_warp6() {
+  local i=0 a
+  while [ $i -lt "$WAIT_SECS" ]; do
+    a=$(get_warp6 || true); [ -n "$a" ] && { echo "$a"; return 0; }
+    sleep 1; i=$((i+1))
+  done
+  return 1
+}
+
+fetch_cidrs() {   # tries all CIDR_URLS; merges + deduplicates; falls back to embedded list
+  local raw url new_v4 new_v6
+  for url in "${CIDR_URLS[@]}"; do
+    raw=$(curl --interface "$IFACE" --connect-timeout 3 --max-time 8 -fsSL "$url" 2>/dev/null || true)
+    if [ -n "$raw" ]; then
+      new_v4=$(echo "$raw" | tr ' ' '\n' | grep -E '^[0-9]+\.' | tr '\n' ' ' || true)
+      new_v6=$(echo "$raw" | tr ' ' '\n' | grep -E ':'          | tr '\n' ' ' || true)
+      V4=$(printf '%s %s' "$V4" "$new_v4" | tr ' ' '\n' | sort -u | awk 'NF' | tr '\n' ' ')
+      V6=$(printf '%s %s' "$V6" "$new_v6" | tr ' ' '\n' | sort -u | awk 'NF' | tr '\n' ' ')
+      log "fetched CIDRs from $url"
+    else
+      log "cidr fetch failed from $url (expected on a filtered uplink); skipping"
+    fi
+  done
+  [ -n "${V4:-}" ] || V4="$FB_V4"
+  [ -n "${V6:-}" ] || V6="$FB_V6"
+}
+
+del_rules() {
+  while ip    rule del pref "$PRIO" 2>/dev/null; do :; done
+  while ip -6 rule del pref "$PRIO" 2>/dev/null; do :; done
+}
+
+case "$cmd" in
+  up)
+    UID_N=$(id -u "$SVC_USER" 2>/dev/null) && [ -n "$UID_N" ] || { log "user $SVC_USER not found"; exit 1; }
+    ensure_table
+
+    # IPv6 is optional: non-fatal if absent; routes/rules skipped entirely when missing.
+    WARP6=$(wait_for_warp6 || true)
+    [ -n "$WARP6" ] || log "no IPv6 on $IFACE after ${WAIT_SECS}s; IPv6 routing skipped"
+
+    del_rules
+    ip -6 route flush table "$TABLE" 2>/dev/null || true
+    ip -4 route flush table "$TABLE" 2>/dev/null || true
+
+    if [ -n "$WARP6" ]; then
+      ip -6 route replace default     dev "$IFACE" src "$WARP6" metric 100  table "$TABLE"
+      ip -6 route replace unreachable default                   metric 1024 table "$TABLE"
+    fi
+
+    WARP4=$(get_warp4 || true)
+    if [ -n "$WARP4" ]; then
+      ip -4 route replace default     dev "$IFACE" src "$WARP4" metric 100  table "$TABLE"
+      log "IPv4 egress via WARP src=$WARP4"
+    else
+      log "no IPv4 on $IFACE; IPv4-to-Telegram from $SVC_USER fails closed"
+    fi
+    ip -4 route replace unreachable default metric 1024 table "$TABLE"
+
+    fetch_cidrs
+    for p in $V4; do
+      ip    rule add pref "$PRIO" to "$p" uidrange "${UID_N}-${UID_N}" lookup "$TABLE" || log "v4 rule add failed for $p"
+    done
+    if [ -n "$WARP6" ]; then
+      for p in $V6; do
+        ip -6 rule add pref "$PRIO" to "$p" uidrange "${UID_N}-${UID_N}" lookup "$TABLE" || log "v6 rule add failed for $p"
+      done
+    fi
+
+    v6_count=0; [ -n "$WARP6" ] && v6_count=$(echo $V6 | wc -w) || true
+    log "up: uid=$UID_N v6src=${WARP6:-none} table=$TABLE pref=$PRIO ($(echo $V4 | wc -w)v4 ${v6_count}v6)"
+    ;;
+  down)
+    del_rules
+    ip -6 route flush table "$TABLE" 2>/dev/null || true
+    ip -4 route flush table "$TABLE" 2>/dev/null || true
+    log "down: table=$TABLE pref=$PRIO cleaned"
+    ;;
+  *)
+    echo "usage: $0 {up|down} [svc_user] [iface] [table] [tid] [prio]" >&2
+    exit 1
+    ;;
+esac

nullforge/templates/scripts/warp-v6-policy.sh

@@ -0,0 +1,118 @@
+#!/usr/bin/env bash
+#
+# IPv6 policy routing for Cloudflare WARP (usque nativetun).
+#
+
+set -euo pipefail
+
+cmd=${1:?up|down}
+IFACE=${2:-warp}
+CFG=${3:-/etc/usque/config.json}
+
+# If omitted, values are derived from IFACE.
+EXPLICIT_TID=${4:-}
+EXPLICIT_PRIO=${5:-}
+
+# This lets multiple independent warp interfacescoexist
+_slot() {
+  printf '%s' "$1" | cksum | awk '{print $1 % 100}'
+}
+
+SLOT=$(_slot "$IFACE")
+
+if [ -n "$EXPLICIT_TID" ]; then
+  TID=$EXPLICIT_TID
+else
+  TID=$((200 + SLOT))  # 200-299: safe custom table ID range
+fi
+
+# Unique table name per interface
+TABLE="warp_$(printf '%s' "$IFACE" | tr -c '[:alnum:]_.-' '_')"
+
+if [ -n "$EXPLICIT_PRIO" ]; then
+  PRIO=$EXPLICIT_PRIO
+else
+  PRIO=$((20000 + SLOT * 10))  # 20000-20990
+fi
+
+PRIO_OIF=$((PRIO + 5))
+WAIT_SECS=8
+
+log(){ logger -t warp-policy -- "$*"; }
+
+get_warp6(){
+  ip -6 -o addr show dev "$IFACE" scope global 2>/dev/null \
+    | awk '{print $4}' | head -n1 | cut -d/ -f1
+}
+
+get_ep6(){
+  jq -r '.endpoint_v6 // empty' "$CFG" 2>/dev/null || true
+}
+
+ensure_table(){
+  grep -qE "^[[:space:]]*$TID[[:space:]]+$TABLE$" /etc/iproute2/rt_tables \
+    || echo "$TID $TABLE" >> /etc/iproute2/rt_tables
+}
+
+wait_for_warp6(){
+  local i=0
+  while [ $i -lt "$WAIT_SECS" ]; do
+    local a
+    a=$(get_warp6 || true)
+    if [ -n "$a" ]; then echo "$a"; return 0; fi
+    sleep 1; i=$((i+1))
+  done
+  return 1
+}
+
+case "$cmd" in
+  up)
+    ensure_table
+
+    if ! WARP6=$(wait_for_warp6); then
+      log "No IPv6 on $IFACE after ${WAIT_SECS}s; leaving without rules"
+      exit 0
+    fi
+
+    EP6=$(get_ep6)
+    if [ -n "$EP6" ]; then
+      # Ensure the WARP endpoint remains reachable outside the tunnel while
+      # our default-via-warp is installed. Only possible if host has IPv6.
+      route_info=$(ip -6 route get "${EP6}" 2>/dev/null || true)
+      GW6=$(echo "$route_info" | awk '{for(i=1;i<NF;i++) if($i=="via"){print $(i+1); exit}}')
+      DEV=$(echo "$route_info" | awk '{for(i=1;i<NF;i++) if($i=="dev"){print $(i+1); exit}}')
+      if [ -n "${GW6}" ] && [ -n "${DEV}" ]; then
+        ip -6 route replace "${EP6}/128" via "$GW6" dev "$DEV" onlink
+      fi
+    fi
+
+    ip -6 route replace default dev "$IFACE" table "$TABLE"
+
+    ip -6 rule del pref "$PRIO" 2>/dev/null || true
+    ip -6 rule add pref "$PRIO" from "${WARP6}/128" lookup "$TABLE"
+    ip -6 rule del pref "$PRIO_OIF" 2>/dev/null || true
+    ip -6 rule add pref "$PRIO_OIF" oif "$IFACE" lookup "$TABLE"
+
+    log "IPv6 policy up: src=${WARP6}/128 pref=$PRIO, oif=$IFACE pref=$PRIO_OIF table=$TABLE"
+    ;;
+
+  down)
+    ip -6 rule del pref "$PRIO" 2>/dev/null || true
+    ip -6 rule del pref "$PRIO_OIF" 2>/dev/null || true
+
+    EP6=$(get_ep6 || true)
+    if [ -n "${EP6:-}" ]; then
+      ip -6 route del "${EP6}/128" 2>/dev/null || true
+    fi
+
+    ip -6 route flush table "$TABLE" 2>/dev/null || true
+
+    log "IPv6 policy down: table=$TABLE prefs=$PRIO,$PRIO_OIF cleaned"
+    ;;
+
+  *)
+    echo "usage: $0 {up|down} [iface] [config] [tid] [prio]" >&2
+    echo "  tid/prio: optional explicit table id and rule priority base (advanced)" >&2
+    exit 1
+    ;;
+esac

nullforge/templates/scripts/zt-tunnel-warp.sh

@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+cmd=${1:?up|down}
+IFACE=${2:-warp}
+
+log(){ logger -t zt-tunnel-warp -- "$*"; }
+
+CIDRS="198.41.200.0/24 104.16.0.0/12"
+
+case "$cmd" in
+  up)
+    for cidr in $CIDRS; do
+      ip route replace "$cidr" dev "$IFACE"
+      log "Added route for $cidr via $IFACE"
+    done
+    ;;
+  down)
+    for cidr in $CIDRS; do
+      ip route del "$cidr" dev "$IFACE" 2>/dev/null || true
+      log "Removed route for $cidr via $IFACE"
+    done
+    ;;
+  *)
+    log "Invalid command: $cmd"
+    exit 1
+esac

nullforge/templates/systemd/blocky.service.j2

@@ -0,0 +1,19 @@
+[Unit]
+Description=Blocky DNS proxy
+Wants=network-online.target nss-lookup.target
+After=dns-internal.service
+Before=nss-lookup.target
+
+[Service]
+User=blocky
+Group=blocky
+Type=simple
+ExecStart=/usr/bin/blocky --config {{ CONFIG_PATH }}
+AmbientCapabilities=CAP_NET_BIND_SERVICE
+StandardOutput=journal
+StandardError=journal
+Restart=on-failure
+RestartSec=5s
+
+[Install]
+WantedBy=multi-user.target

nullforge/templates/systemd/cloudflare-tunnel.service.j2

@@ -0,0 +1,27 @@
+[Unit]
+Description=Cloudflare Zero Trust Tunnel
+Wants=network-online.target
+After=network-online.target{% if ROUTE_THROUGH_WARP %} {{ WARP_SERVICE }}.service{% endif %}
+
+{% if ROUTE_THROUGH_WARP %}
+Requires={{ WARP_SERVICE }}.service
+{% endif %}
+
+[Service]
+User=cloudflare
+Group=cloudflare
+Type=simple
+
+ExecStart=/usr/bin/cloudflared --config {{ CONFIG_PATH }} tunnel run
+{% if ROUTE_THROUGH_WARP %}
+ExecStartPost={{ WORKDIR }}/zt-tunnel-warp.sh up {{ WARP_IFACE }}
+ExecStopPost={{ WORKDIR }}/zt-tunnel-warp.sh down {{ WARP_IFACE }}
+{% endif %}
+AmbientCapabilities=CAP_NET_ADMIN
+StandardOutput=journal
+StandardError=journal
+Restart=on-failure
+RestartSec=5s
+
+[Install]
+WantedBy=multi-user.target

nullforge/templates/systemd/cloudflare-warp.service.j2

@@ -0,0 +1,21 @@
+[Unit]
+Description=Cloudflare Warp Tunnel (Masque)
+Wants=network-online.target
+After=network-online.target
+
+[Service]
+User=cloudflare
+Group=cloudflare
+Type=simple
+
+ExecStart=/usr/local/bin/usque nativetun -m {{ MTU }} -c {{ CONFIG_PATH }} -n {{ INET_NAME }} {% if USE_OUTBOUND_IPV6 %}--ipv6{% endif %}
+ExecStartPost={{ WORKDIR }}/warp-v6-policy.sh up {{ INET_NAME }} {{ CONFIG_PATH }}
+ExecStopPost={{ WORKDIR }}/warp-v6-policy.sh down {{ INET_NAME }} {{ CONFIG_PATH }}
+AmbientCapabilities=CAP_NET_ADMIN
+StandardOutput=journal
+StandardError=journal
+Restart=on-failure
+RestartSec=5s
+
+[Install]
+WantedBy=multi-user.target

nullforge/templates/systemd/dns-internal.service.j2

@@ -0,0 +1,15 @@
+[Unit]
+Description=Setup dns-internal dummy interface for blocky
+Before=blocky.service
+After=network.target
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStart=/bin/sh -c 'ip link show dns-internal >/dev/null 2>&1 || ip link add dns-internal type dummy'
+ExecStart=/bin/sh -c 'ip addr show dev dns-internal | grep -q "{{ LISTEN_ADDRESS }}" || ip addr add {{ LISTEN_CIDR }} dev dns-internal'
+ExecStart=/sbin/ip link set dns-internal up
+ExecStop=/sbin/ip link del dns-internal
+
+[Install]
+WantedBy=multi-user.target

nullforge/templates/systemd/telemt.service.j2

@@ -0,0 +1,36 @@
+[Unit]
+Description=Telemt MTProto proxy
+Wants=network-online.target
+After=network-online.target{% if WARP_ENABLED %} {{ WARP_SERVICE }}.service{% endif %}
+
+{% if WARP_ENABLED %}
+Requires={{ WARP_SERVICE }}.service
+BindsTo={{ WARP_SERVICE }}.service
+{% endif %}
+
+[Service]
+Type=simple
+User={{ USER }}
+Group={{ GROUP }}
+ExecStart={{ BINARY_PATH }} {{ CONFIG_PATH }}
+{% if WARP_ENABLED %}
+ExecStartPre=+{{ TELEPROXY_SCRIPT }} up {{ USER }} {{ WARP_IFACE }}
+{% endif %}
+{% if SYNFIX_ENABLED %}
+ExecStartPre=+{{ SYNFIX_SCRIPT }} up {{ PORT }}
+ExecStopPost=+{{ SYNFIX_SCRIPT }} down {{ PORT }}
+{% endif %}
+{% if WARP_ENABLED %}
+ExecStopPost=+{{ TELEPROXY_SCRIPT }} down {{ USER }} {{ WARP_IFACE }}
+{% endif %}
+Restart=on-failure
+RestartSec=5s
+LimitNOFILE=65536
+AmbientCapabilities=CAP_NET_BIND_SERVICE
+CapabilityBoundingSet=CAP_NET_BIND_SERVICE
+NoNewPrivileges=true
+StandardOutput=journal
+StandardError=journal
+
+[Install]
+WantedBy=multi-user.target

nullforge/templates/telemt/telemt.toml.j2

@@ -0,0 +1,49 @@
+# Managed by NullForge. Local edits are overwritten on redeploy.
+
+[general]
+fast_mode = {{ FAST_MODE | lower }}
+use_middle_proxy = {{ USE_MIDDLE_PROXY | lower }}
+log_level = "silent"
+
+[general.modes]
+classic = {{ MODE_CLASSIC | lower }}
+secure = {{ MODE_SECURE | lower }}
+tls = {{ MODE_TLS | lower }}
+
+[server]
+max_connections = {{ MAX_CONNECTIONS }}
+port = {{ PORT }}
+
+[server.api]
+enabled = {{ API_ENABLED | lower }}
+
+[network]
+ipv6 = {{ IPV6 | lower }}
+prefer = {{ PREFER }}
+
+[timeouts]
+client_handshake = {{ CLIENT_HANDSHAKE }}
+
+[censorship]
+tls_domain = "{{ TLS_DOMAIN }}"
+{% if UNKNOWN_SNI_ACTION %}
+unknown_sni_action = "{{ UNKNOWN_SNI_ACTION }}"
+{% else %}
+#unknown_sni_action = "mask"
+{% endif %}
+
+[access.users]
+{% for name, secret in USERS.items() %}
+{{ name }} = "{{ secret }}"
+{% endfor %}
+
+[[upstreams]]
+type = "direct"
+{% if ROUTE_VIA_WARP %}
+# Egress is steered through WARP by teleproxy-warp.sh (per-uid policy routing),
+# so the upstream stays "direct" instead of binding to the "{{ WARP_IFACE }}" interface.
+{% else %}
+#interface = "{{ WARP_IFACE }}"
+{% endif %}
+weight = 10
+enabled = true

nullforge/templates/tor/torrc.j2

@@ -0,0 +1,5 @@
+SocksPort {{ SOCKS_PORT }}
+AutomapHostsOnResolve 1
+DnsPort {{ DNS_PORT }}
+SocksPolicy accept 127.0.0.1
+SocksPolicy reject *

nullforge-0.1.0.dist-info/METADATA

@@ -0,0 +1,39 @@
+Metadata-Version: 2.4
+Name: nullforge
+Version: 0.1.0
+Summary: Forge the server's baseline from null
+Author-email: wlix13 <github@wlix13.dev>
+Maintainer-email: wlix13 <github@wlix13.dev>
+License-File: LICENSE
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Programming Language :: Python :: 3.13
+Requires-Python: <3.14,>=3.13
+Requires-Dist: click
+Requires-Dist: pydantic
+Requires-Dist: pyinfra
+Requires-Dist: rich-click
+Description-Content-Type: text/markdown
+
+# NullForge
+
+Forge the server's baseline from null — an infrastructure-as-code framework built on [pyinfra](https://pyinfra.com), themed around a blacksmith's forge: **inventories** define hosts, **molds** shape the configuration, **runes** are idempotent operation sets, the **foundry** casts them onto targets, and the **smithy** holds cross-distro helpers.
+
+> [!WARNING]
+> **NullForge is in active development.** Until the `v1.0.0` release, the mold schemas, runes and deploy behaviour may change at any time — breaking changes can land in **any** release, including patch versions. Pin an exact version (e.g. `nullforge==0.1.0`) and check the [release notes](https://github.com/wlix13/NullForge/releases) before upgrading.
+
+## Install
+
+```bash
+uv sync
+```
+
+## Deploy
+
+```bash
+# Cast the full baseline (all enabled features from the inventory)
+uv run pyinfra nullforge/inventories/example.py nullforge/foundry/full_cast.py
+```
+
+## Contributing
+
+See [CONTRIBUTING.md](.github/CONTRIBUTING.md) for the full setup, commit conventions and pull request flow.