splent-cli 1.37.0__tar.gz → 1.38.0__tar.gz

{splent_cli-1.37.0/src/splent_cli.egg-info → splent_cli-1.38.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: splent_cli
-Version: 1.37.0
+Version: 1.38.0
 Summary: SPLENT-CLI is a CLI to be able to work on your development more easily.
 Author-email: DiversoLab <diversolab@us.es>
 License-Expression: LGPL-3.0-or-later

{splent_cli-1.37.0 → splent_cli-1.38.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "splent_cli"
-version = "1.37.0"
+version = "1.38.0"
 description = "SPLENT-CLI is a CLI to be able to work on your development more easily."
 readme = "README.md"
 requires-python = ">=3.13"

{splent_cli-1.37.0 → splent_cli-1.38.0}/src/splent_cli/commands/feature/feature_release.py

@@ -2008,6 +2008,14 @@ def create_versioned_snapshot(namespace, feature_name, version, workspace, repo=
     is_flag=True,
     help="If PyPI's new-project limit is spent, wait for it however long it takes.",
 )
+@click.option(
+    "--neutral",
+    is_flag=True,
+    help="Gate on the tests in a neutral app (the framework, the feature, the "
+    "releases of what it requires, the default configuration), and run them in "
+    "the active product as a check that does not block. Automatic when the "
+    "product does not declare the feature.",
+)
 def feature_release(
     feature_ref,
     version,
@@ -2020,6 +2028,7 @@ def feature_release(
     no_github,
     allow_unfinished,
     wait,
+    neutral,
 ):
     no_forge = release.no_forge_requested(no_forge, no_github)
     workspace = str(context.workspace())
@@ -2056,6 +2065,7 @@ def feature_release(
             skip_checks=skip_checks,
             attach=attach,
             workspace=workspace,
+            neutral=neutral,
         )
         return
 
@@ -2154,6 +2164,7 @@ def feature_release(
         pre_commit_hook=_pre_commit,
         post_pypi_hook=_post_pypi,
         wait=wait,
+        neutral=neutral,
     )
 
     attach_cmd = f"splent feature:attach {feature_ref} {tag}"
@@ -2282,6 +2293,7 @@ def _dry_run(
     skip_checks,
     attach,
     workspace,
+    neutral=False,
 ):
     """feature:release --dry-run. Changes nothing, exits 1 if a real run would stop."""
     from splent_cli.services import release_dry_run
@@ -2350,6 +2362,7 @@ def _dry_run(
         workspace=workspace,
         product=product,
         attach=attach,
+        neutral=neutral,
     )
     if rehearsal.blockers:
         raise SystemExit(1)

{splent_cli-1.37.0 → splent_cli-1.38.0}/src/splent_cli/commands/feature/feature_test.py

@@ -2,6 +2,7 @@ import os
 import re
 import shlex
 import subprocess
+import tempfile
 from pathlib import Path
 import click
 from dotenv import dotenv_values
@@ -14,7 +15,7 @@ from splent_cli.utils.feature_utils import (
     get_normalize_feature_name_in_splent_format,
     parse_feature_entry,
 )
-from splent_cli.services import context, web_container
+from splent_cli.services import context, neutral_app, web_container
 
 
 # Test levels in execution order (default = first three)
@@ -229,7 +230,7 @@ def _database_name(db_url) -> str:
         return ""
 
 
-def _validate_testing_environment():
+def _refuse_production() -> None:
     if _is_prod_active():
         click.secho(
             "❌ Cannot run tests in production.\n"
@@ -241,6 +242,10 @@ def _validate_testing_environment():
         )
         raise SystemExit(1)
 
+
+def _validate_testing_environment():
+    _refuse_production()
+
     try:
         env = get_current_app_config_value("TESTING")
         db_url = get_current_app_config_value("SQLALCHEMY_DATABASE_URI")
@@ -561,6 +566,161 @@ def with_import_path(dirs: list[str], env: dict) -> str:
     return os.pathsep.join([*dirs, *(p for p in existing if p and p not in dirs)])
 
 
+# ── The neutral app ───────────────────────────────────────────────────
+
+
+def declaring_product(feature_ref: str) -> str | None:
+    """The active product when it declares the feature FEATURE_REF names.
+
+    None when it does not: its tests then run in the neutral app, since the
+    product's app does not load the feature.
+    """
+    product = context.require_app()
+    name = get_normalize_feature_name_in_splent_format(_pkg_name(feature_ref))
+    declared = any(_pkg_name(ref) == name for ref in get_features_from_pyproject())
+    return product if declared else None
+
+
+def _neutral_refusal(text: str) -> None:
+    click.secho(f"❌ {text}", fg="red")
+    raise SystemExit(1)
+
+
+def _feature_under_test(feature_ref: str, workspace: Path) -> neutral_app.Member:
+    """The copy of FEATURE_REF whose tests the neutral app runs.
+
+    Its working copy at the workspace root, or the release FEATURE_REF names
+    (``recaptcha@v0.2.2``), from the cache.
+    """
+    from splent_cli.utils.feature_resolution import resolve_feature_ref
+
+    found = resolve_feature_ref(feature_ref, workspace)
+    name = get_normalize_feature_name_in_splent_format(_pkg_name(feature_ref))
+    if found is None:
+        _neutral_refusal(
+            f"There is no copy of {name} in the workspace to test: no working\n"
+            f"   copy at its root and no release in .splent_cache.\n"
+            f"   Clone one first, for example with\n"
+            f"     splent feature:clone splent-io/{name}"
+        )
+    root, namespace, name = found
+    version = root.name.partition("@")[2] or None
+    return neutral_app.Member(namespace, name, version, root, "under test")
+
+
+def _tests_dir(member: neutral_app.Member) -> Path | None:
+    found = _collect_test_paths([(member.name, member.root)])
+    return found[0][1] if found else None
+
+
+def _neutral_working_copies(with_refs, workspace: Path) -> list[tuple[str, Path]]:
+    """The working copies --with names, for the neutral app.
+
+    Unlike in the product's app, a feature need not be declared anywhere:
+    the neutral app loads it from its working copy, in place of its release
+    when the feature under test requires it, and in addition otherwise.
+    """
+    copies: list[tuple[str, Path]] = []
+    for ref in with_refs:
+        name = get_normalize_feature_name_in_splent_format(_pkg_name(ref))
+        path = editable_feature_dir(workspace, name)
+        if path is None:
+            short = name.removeprefix("splent_feature_")
+            _neutral_refusal(
+                f"--with {ref}, but {name} has no working copy at the workspace root.\n"
+                f"   Run 'splent feature:unlock {short}' to make one."
+            )
+        if all(existing != name for existing, _ in copies):
+            copies.append((name, Path(path)))
+    return copies
+
+
+def neutral_plan(feature_ref: str, with_refs=()) -> list[neutral_app.Member]:
+    """The features of the neutral app for FEATURE_REF's tests, printed.
+
+    Every release is fetched into the cache here, so the run in the
+    product's container finds them all.
+    """
+    workspace = context.workspace()
+    product = context.require_app()
+    feature = _feature_under_test(feature_ref, workspace)
+    if declaring_product(feature_ref) is None:
+        click.secho(
+            f"  {feature.name} is not declared in {product}, so its tests run "
+            "in a neutral app.",
+            fg="yellow",
+        )
+    copies = _neutral_working_copies(with_refs, workspace)
+    try:
+        members = neutral_app.plan(
+            workspace, feature, _tests_dir(feature), copies, say=click.echo
+        )
+    except neutral_app.NeutralAppError as e:
+        _neutral_refusal(f"The neutral app cannot be put together: {e}")
+    click.echo(
+        "  Neutral app: the framework, these features and their default "
+        f"configuration.\n  Nothing of {product} reaches it but its test database."
+    )
+    for line in neutral_app.describe(members):
+        click.echo(line)
+    return members
+
+
+def _run_neutral(
+    feature_ref, member_entries, with_refs, levels, keyword, verbose
+) -> None:
+    """Run FEATURE_REF's tests in the neutral app, in this container."""
+    if "e2e" in levels:
+        _neutral_refusal(
+            "End-to-end tests drive the product's running server, and the\n"
+            "   neutral app is never served. Run them in a product that declares\n"
+            "   the feature, without --neutral."
+        )
+    workspace = context.workspace()
+    try:
+        members = (
+            neutral_app.parse_members(workspace, member_entries)
+            if member_entries
+            else neutral_plan(feature_ref, with_refs)
+        )
+    except neutral_app.NeutralAppError as e:
+        _neutral_refusal(str(e))
+    name = get_normalize_feature_name_in_splent_format(_pkg_name(feature_ref))
+    feature = next((m for m in members if m.name == name), None)
+    if feature is None:
+        _neutral_refusal(f"The neutral app given does not hold {name}.")
+
+    _refuse_production()
+    problem = neutral_app.database_problem(dict(os.environ))
+    if problem:
+        _neutral_refusal(problem)
+    missing = neutral_app.missing_distributions(members)
+    if missing:
+        product = context.require_app()
+        _neutral_refusal(
+            f"The neutral app needs packages that {product}'s image does not\n"
+            "   have at the version asked for:\n"
+            + "\n".join(f"     {line}" for line in missing)
+            + "\n   Install them in the container, or run the tests in a product\n"
+            "   that declares the feature."
+        )
+
+    test_paths = _collect_test_paths([(feature.name, feature.root)])
+    if not test_paths:
+        click.secho("⚠️  No test directories found.", fg="yellow")
+        return
+
+    click.secho(
+        f"\n🧪 Running tests for {feature_ref} in a neutral app "
+        f"[{', '.join(levels)}]...",
+        fg="cyan",
+    )
+    with tempfile.TemporaryDirectory(prefix="splent-neutral-") as tmp:
+        neutral_app.write_app(Path(tmp), members)
+        env = neutral_app.environment(Path(tmp), members)
+        _run_pytest(test_paths, levels, keyword, verbose, environment=env)
+
+
 def _resolve_levels(unit, integration, functional, e2e, load) -> tuple[str, ...]:
     """Determine which test levels to run based on CLI flags."""
     explicit = []
@@ -583,7 +743,14 @@ def _run_pytest(
     keyword: str | None,
     verbose: bool,
     extra_sources: list[tuple[str, Path]] = (),
+    environment: dict | None = None,
 ):
+    """Run each feature's tests, level by level, and exit 1 if any failed.
+
+    ENVIRONMENT, when given, is the whole environment of every run (the
+    neutral app's). Otherwise each run gets this process's, with the import
+    path and the feature sources of the active product.
+    """
     passed = failed = skipped = 0
     for pkg, test_dir, src_dir in test_paths:
         click.secho(f"\n  ▶  {pkg}", fg="cyan", bold=True)
@@ -596,7 +763,7 @@ def _run_pytest(
         sources = [(pkg, Path(src_dir).parent)] + [
             (name, Path(root)) for name, root in extra_sources if name != pkg
         ]
-        import_path = feature_src_dirs(sources)
+        import_path = feature_src_dirs(sources) if environment is None else []
 
         for level in levels:
             level_dir = test_dir / level
@@ -613,11 +780,14 @@ def _run_pytest(
                 click.secho(note, fg="yellow")
                 continue
 
-            env = os.environ.copy()
-            env["PYTHONPATH"] = with_import_path(import_path, env)
-            env["SPLENT_FEATURE_SOURCES"] = ",".join(
-                f"{name}={root}" for name, root in sources
-            )
+            if environment is not None:
+                env = dict(environment)
+            else:
+                env = os.environ.copy()
+                env["PYTHONPATH"] = with_import_path(import_path, env)
+                env["SPLENT_FEATURE_SOURCES"] = ",".join(
+                    f"{name}={root}" for name, root in sources
+                )
 
             cmd = [
                 "pytest",
@@ -710,6 +880,17 @@ def _run_pytest(
     help="Load FEATURE from its working copy at the workspace root too, instead "
     "of the version the product pins. Repeatable.",
 )
+@click.option(
+    "--neutral",
+    is_flag=True,
+    help="Run the tests in a neutral app instead of the product's: the "
+    "framework, the feature, the releases of what it requires and the "
+    "default configuration. Automatic for a feature the product does not "
+    "declare.",
+)
+# The neutral app as the CLI container resolved it, for the run in the
+# product's container, which then fetches nothing.
+@click.option("--neutral-member", "neutral_members", multiple=True, hidden=True)
 def feature_test(
     feature_ref,
     keyword,
@@ -720,6 +901,8 @@ def feature_test(
     e2e,
     load,
     with_features,
+    neutral,
+    neutral_members,
 ):
     """
     Run the test suite for features declared in the active product.
@@ -736,12 +919,22 @@ def feature_test(
         splent feature:test auth --functional  # functional tests for auth
         splent feature:test -k test_login -v   # keyword filter, verbose
         splent feature:test profile --with auth  # profile's tests, auth's working copy
+        splent feature:test recaptcha          # not in the product: a neutral app
+        splent feature:test theme --neutral    # in the product, tested without it
 
     \b
     The app under test loads the feature whose tests run from the copy those
     tests come from. --with does the same for other features the tests
     cross into, so changes made to two features together are tested
     together.
+
+    A feature the product does not declare is tested in a neutral app, and
+    --neutral chooses it for one the product declares. The neutral app is a
+    new product holding the framework, the feature, the newest releases of
+    what it requires and of what its tests import, and their default
+    configuration. Nothing of the product's templates, config.py or .env
+    reaches it, only its test database. --with puts a working copy in place
+    of a release there.
     """
     levels_flags = (
         ("unit", unit),
@@ -750,12 +943,33 @@ def feature_test(
         ("e2e", e2e),
         ("load", load),
     )
+    neutral = neutral or bool(neutral_members)
+    if neutral and not feature_ref:
+        raise click.UsageError(
+            "--neutral builds the app for one feature. Name it: "
+            "splent feature:test <feature> --neutral"
+        )
     if not _is_product_container():
-        _delegate_to_web_container(
-            _passthrough_args(
-                feature_ref, keyword, verbose, levels_flags, with_features
-            )
+        argv = _passthrough_args(
+            feature_ref, keyword, verbose, levels_flags, with_features
         )
+        if feature_ref and (neutral or declaring_product(feature_ref) is None):
+            members = neutral_plan(feature_ref, with_features)
+            argv.append("--neutral")
+            for member in members:
+                argv += ["--neutral-member", member.entry]
+        _delegate_to_web_container(argv)
+
+    if feature_ref and (neutral or declaring_product(feature_ref) is None):
+        _run_neutral(
+            feature_ref,
+            neutral_members,
+            with_features,
+            _resolve_levels(unit, integration, functional, e2e, load),
+            keyword,
+            verbose,
+        )
+        return
 
     # Look the feature up first: an undeclared one is refused before the
     # guard builds an app that could not load it anyway.

{splent_cli-1.37.0 → splent_cli-1.38.0}/src/splent_cli/commands/product/product_build.py

@@ -98,10 +98,13 @@ OPTIONAL_DEPLOY_SETTINGS: tuple[tuple[str, str, tuple[str, ...]], ...] = (
         "SPLENT_TRUSTED_PROXIES",
         "1",
         (
-            "Reverse proxies in front of the app. 1 behind the usual TLS front,",
-            "one more for each proxy inside the stack (the nginx feature), 0 when",
-            "nothing is in front. Unset means 0, so behind a proxy every caller",
-            "shares the proxy's address and X-Forwarded-Proto is ignored.",
+            "Reverse proxies whose X-Forwarded headers reach the app. 1 behind",
+            "the usual TLS front, and 1 with the nginx feature too, at the edge",
+            "or behind that front, since nginx is the only hop the app talks to",
+            "and forwards one value of each header. One more only for a proxy",
+            "that adds its own value to them. 0 when nothing is in front. Unset",
+            "means 0, so behind a proxy every caller shares the proxy's address",
+            "and X-Forwarded-Proto is ignored.",
         ),
     ),
     (

{splent_cli-1.37.0 → splent_cli-1.38.0}/src/splent_cli/commands/product/product_create.py

@@ -309,6 +309,37 @@ def make_product(name, spl_name, spl_doi, features_file, force):
     )
 
 
+def app_package_files(name: str) -> tuple[dict[str, str], dict[str, str]]:
+    """The product's own package, src/<name>/, as ``(rendered, copied)``.
+
+    Each maps a path inside the product to its template. product:create
+    writes them, and so does the neutral app feature:test runs a feature
+    in, which is a product created with that feature and nothing else
+    (services/neutral_app.py).
+    """
+    rendered = {
+        f"src/{name}/__init__.py": "product/product_init.py.j2",
+        f"src/{name}/config.py": "product/product_config.py.j2",
+        f"src/{name}/errors.py": "product/product_errors.py.j2",
+        f"src/{name}/logging.py": "product/product_logging.py.j2",
+    }
+    copied = {
+        f"src/{name}/static/css/app.css": "product/product_app.css",
+        f"src/{name}/static/css/dropzone.css": "product/product_dropzone.css",
+        f"src/{name}/static/css/own.css": "product/product_own.css",
+        f"src/{name}/static/favicon.svg": "product/product_favicon.svg",
+        f"src/{name}/static/js/app.js": "product/product_app.js",
+        # 400/401 are the framework fallback's lookups; 404/500 come from
+        # the theme (errors/404.html, errors/500.html) so they wear the skin.
+        # There is no 403.html. Without one the framework draws the 403
+        # inside base_template.html, so the account keeps its sidebar.
+        f"src/{name}/templates/400.html": "product/product_400.html",
+        f"src/{name}/templates/401.html": "product/product_401.html",
+        f"src/{name}/templates/base_template.html": "product/product_base_template.html",
+    }
+    return rendered, copied
+
+
 def _write_product(env, name, base_path, template_ctx):
     """Render the product tree into base_path, which does not exist yet."""
     for subdir in [
@@ -353,26 +384,9 @@ def _write_product(env, name, base_path, template_ctx):
         "package.json": "product/product_package.json.j2",
         "pyproject.toml": "product/product_pyproject.toml.j2",
         "README.md": "product/product_README.md.j2",
-        f"src/{name}/__init__.py": "product/product_init.py.j2",
-        f"src/{name}/config.py": "product/product_config.py.j2",
-        f"src/{name}/errors.py": "product/product_errors.py.j2",
-        f"src/{name}/logging.py": "product/product_logging.py.j2",
-    }
-
-    raw_files = {
-        f"src/{name}/static/css/app.css": "product/product_app.css",
-        f"src/{name}/static/css/dropzone.css": "product/product_dropzone.css",
-        f"src/{name}/static/css/own.css": "product/product_own.css",
-        f"src/{name}/static/favicon.svg": "product/product_favicon.svg",
-        f"src/{name}/static/js/app.js": "product/product_app.js",
-        # 400/401 are the framework fallback's lookups; 404/500 come from
-        # the theme (errors/404.html, errors/500.html) so they wear the skin.
-        # There is no 403.html. Without one the framework draws the 403
-        # inside base_template.html, so the account keeps its sidebar.
-        f"src/{name}/templates/400.html": "product/product_400.html",
-        f"src/{name}/templates/401.html": "product/product_401.html",
-        f"src/{name}/templates/base_template.html": "product/product_base_template.html",
     }
+    package_templates, raw_files = app_package_files(name)
+    jinja_templates.update(package_templates)
 
     for rel_path, tpl in jinja_templates.items():
         abs_path = os.path.join(base_path, rel_path)

{splent_cli-1.37.0 → splent_cli-1.38.0}/src/splent_cli/commands/product/product_deploy.py

@@ -417,6 +417,95 @@ def compose_environment(
     return env
 
 
+# ── SPLENT_TRUSTED_PROXIES ──────────────────────────────────────────────
+
+NGINX_FEATURE = "splent_feature_nginx"
+#: The first nginx release that forwards one value of each X-Forwarded
+#: header, after deciding with realip whether to believe a TLS front.
+NGINX_ONE_VALUE = (1, 4, 0)
+
+
+def nginx_version(product_path: str) -> str | None:
+    """The version of the nginx feature the product deploys.
+
+    ``""`` when it declares nginx without a version, None when it does not
+    declare it, for production, at all.
+    """
+    from splent_cli.utils.feature_utils import (
+        load_product_features,
+        parse_feature_entry,
+    )
+
+    try:
+        entries = load_product_features(product_path, "prod")
+    except Exception:  # noqa: BLE001 - only the advice depends on it
+        return None
+    for entry in entries:
+        _, name, version = parse_feature_entry(entry)
+        if name == NGINX_FEATURE:
+            return version or ""
+    return None
+
+
+def _release(version: str) -> tuple[int, ...] | None:
+    m = re.match(r"v?(\d+)\.(\d+)\.(\d+)", version or "")
+    return tuple(int(g) for g in m.groups()) if m else None
+
+
+def trusted_proxies_advice(env_vars: dict, nginx: str | None) -> list[str]:
+    """What to tell the operator about SPLENT_TRUSTED_PROXIES, line by line.
+
+    Empty when the value looks right. The number counts the proxies whose
+    X-Forwarded values reach the app, one value per proxy, and the app
+    ignores the headers when it finds fewer values than that.
+
+    NGINX is the version of the nginx feature the product deploys (see
+    :func:`nginx_version`). That feature is the only hop the app talks to,
+    whether it is the edge or sits behind a TLS front: it decides with
+    NGINX_TRUSTED_PROXY_CIDRS whether to believe the front and forwards one
+    value of each header, so the right number with it is 1. 2, which the
+    CLI used to suggest for nginx behind a TLS front, made the app ignore
+    the headers: http:// links, cookies without Secure, no HSTS.
+    """
+    raw = (env_vars.get("SPLENT_TRUSTED_PROXIES") or "").strip()
+    if not raw:
+        if nginx is not None:
+            return [
+                "SPLENT_TRUSTED_PROXIES is not set in deploy/.env, so the app "
+                "believes no X-Forwarded header.",
+                "The product runs the nginx feature, the only hop the app talks "
+                "to, so set it to 1, whether nginx is the edge or sits behind a "
+                "TLS front.",
+            ]
+        return [
+            "SPLENT_TRUSTED_PROXIES is not set in deploy/.env, so the app "
+            "believes no X-Forwarded header.",
+            "Behind a reverse proxy set it to the number of proxies in front "
+            "(1 behind the usual TLS front). Set it to 0 when nothing is in "
+            "front.",
+        ]
+    try:
+        hops = int(raw)
+    except ValueError:
+        return []
+    if nginx is None or hops <= 1:
+        return []
+    lines = [
+        f"SPLENT_TRUSTED_PROXIES is {hops} in deploy/.env, and the app talks to "
+        "nginx alone, which forwards one value of each X-Forwarded header.",
+        f"The app looks for {hops}, finds one and ignores them all: http:// "
+        "links, cookies without Secure, no HSTS. Set it to 1.",
+    ]
+    release = _release(nginx)
+    if release is not None and release < NGINX_ONE_VALUE:
+        lines.append(
+            f"splent_feature_nginx {nginx} adds the TLS front to X-Forwarded-For "
+            "as well, so behind one the app takes the front for the client. "
+            "Upgrade it to v1.4.0 or later."
+        )
+    return lines
+
+
 def _compose_cmd(product: str, product_path: str, env_path: str, *args) -> list:
     """``docker compose`` aimed at the deploy bundle, as a host would run it."""
     return [
@@ -645,16 +734,11 @@ def product_deploy(down, ci, image):
     # this setting the app takes the proxy for the caller: one address for
     # every client and plain http in every link it builds. A deployment that
     # predates the template line (or deleted it) is told once per deploy;
-    # an explicit 0 says nothing is in front and silences it.
-    proxies_unset = "SPLENT_TRUSTED_PROXIES" not in env_vars
-    if proxies_unset:
-        click.secho(
-            "  SPLENT_TRUSTED_PROXIES is not set in deploy/.env, so the app "
-            "believes no X-Forwarded header.\n"
-            "  Behind a reverse proxy set it to the number of proxies (1 behind "
-            "the usual TLS front). Set it to 0 when nothing is in front.",
-            fg="yellow",
-        )
+    # an explicit 0 says nothing is in front and silences it. With the nginx
+    # feature a number above 1 is as bad, and said too.
+    proxy_advice = trusted_proxies_advice(env_vars, nginx_version(product_path))
+    if proxy_advice:
+        click.secho("\n".join(f"  {line}" for line in proxy_advice), fg="yellow")
 
     # ---------------------------------------------------------
     # Warn about write directories no volume preserves
@@ -897,14 +981,11 @@ def product_deploy(down, ci, image):
     # compose output. Never set automatically, because a deployment that
     # publishes the app port beyond the host would then let any client forge
     # X-Forwarded-For.
-    if proxies_unset:
+    if proxy_advice:
         click.echo()
         click.secho(
-            "  SPLENT_TRUSTED_PROXIES is not set in deploy/.env, so the "
-            "app believes no X-Forwarded header.\n"
-            "  Uncomment '# SPLENT_TRUSTED_PROXIES=1' there (2 with the nginx "
-            "feature behind the TLS front, 0 when nothing is in front) and run "
-            "product:deploy again.",
+            "\n".join(f"  {line}" for line in proxy_advice)
+            + "\n  Change it in deploy/.env and run product:deploy again.",
             fg="yellow",
         )