mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 02:54:26 +00:00
kevinveenbirkenbachandClaude Opus 5
a0cc3dbe40
default.env declares INFINITO_DOMAIN and everything is meant to derive from it.
Nothing checked that, so copies accumulated. A copy is a second source nobody
updates, and it fails in the least useful way: the code keeps running and
quietly talks about the wrong host. integration_mastodon is the worked example
-- it asserted the provisioned partner equalled a clearnet literal, so the spec
passed on a clearnet node and failed on an onion one while the product was
right in both.
tests/lint/repository/spot/test_no_hardcoded_primary_domain.py now fails on the
literal anywhere in tracked source. It reads the value it hunts for FROM
default.env, so the rule follows the SPOT instead of repeating it and would
otherwise be its own first violation.
Scope, and why each exclusion is not a loophole: default.env itself is the
source; .md is documentation; tests/ and scripts/tests/ hold fixtures that must
assert against a named host; inventories/ is where writing the real values is
the entire point; gitignored output carries the value because it correctly
derived it. Everything else is in.
Two real hardcodes are repaired rather than suppressed.
utils/domains/default_primary.py mirrors utils/roles/lifecycle.py -- one
function reading one key through parse_static_env -- and replaces the module
constant in utils/cleanup/nginx_vhosts.py and the argparse default in
cli/meta/domains/__main__.py. Both resolve to the same value as before.
Seven documentation sites become <primary-domain> placeholders instead of
carrying a nocheck: a Python docstring cannot host one without polluting the
docstring, and a placeholder does not rot when the default changes. The single
nocheck is scripts/system/tls/trust/wsl2.sh:61, where the marker is matched
verbatim against what an earlier run wrote into the Windows hosts file --
deriving it would orphan that block instead of replacing it.
Collateral, not intent: touching roles/sys-ctl-hlth-csp/files/script.py brought
it under the comment lint, which found five pre-existing narration comments.
Three deleted, `fn[:-5] # strip ".conf"` replaced by fn.removesuffix(".conf"),
and the root-user comment rewritten in the sanctioned Exception form. Its 33
tests stay green.
tests/lint/repository/test_no_hardcoded_container_name.py (05f425ea5) is the
same family for INFINITO_CONTAINER and could move into spot/ later; this change
leaves it where it is.
make test-lint: 326 passed. The rule found 18 sites before the cleanup and none
after.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
41 lines
1.4 KiB
Bash
Executable File
41 lines
1.4 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# nginx vhost purge for stacks (entity-keyed).
|
|
#
|
|
# Removes the per-domain vhost files belonging to every app under each
|
|
# given compose entity. Driven by the app-keyed orchestrator
|
|
# `purge/apps.sh` as a sibling of `db.sh`, `compose.sh`, `dir.sh` — a
|
|
# stack that drops out of a matrix-deploy round would otherwise leave
|
|
# stale vhosts behind and the next round's HTTPS probe would see HTTP
|
|
# 502 (nginx still serves the vhost but the container was pruned)
|
|
# instead of the expected TLS-error 000.
|
|
#
|
|
# All resolution and filesystem work lives in
|
|
# `utils.cleanup.nginx_vhosts` so the bash side stays a thin wrapper.
|
|
#
|
|
# Usage:
|
|
# ./purge/entity/nginx.sh <STACK1> [STACK2] [...]
|
|
#
|
|
# Env:
|
|
# NGINX_DIR Base nginx config dir inside the container.
|
|
# Default: /etc/nginx (matches svc-prx-openresty/meta/volumes.yml).
|
|
# DOMAIN DOMAIN_PRIMARY used to render Jinja in roles/<role>/meta/server.yml.
|
|
# Default: INFINITO_DOMAIN from default.env.
|
|
|
|
set -euo pipefail
|
|
|
|
if [[ "$#" -lt 1 ]]; then
|
|
echo "ERROR: No stack names provided." >&2
|
|
exit 2
|
|
fi
|
|
|
|
: "${INFINITO_SRC_DIR:?INFINITO_SRC_DIR must be set by the container environment}"
|
|
cd "${INFINITO_SRC_DIR}"
|
|
|
|
if [[ -f "scripts/meta/env/load.sh" ]]; then
|
|
# shellcheck source=scripts/meta/env/load.sh
|
|
source "scripts/meta/env/load.sh"
|
|
fi
|
|
python_bin="${PYTHON:-python3}"
|
|
|
|
exec "${python_bin}" -m utils.cleanup.nginx_vhosts "$@"
|