mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 19:01:54 +00:00
kevinveenbirkenbachandClaude Opus 5
905a5fb2d9
PASS 2 read the exact values PASS 1 wrote, so no deploy ever had to propagate a secret that moved. Every role that only writes a credential at creation time therefore stayed green without the update path being exercised once. Both orchestrators now call `inventory credentials reset` after the recover drill and before the async pass: compose through the container in the new .rotate module, swarm through the matrix orchestrator with --mirror, because its inventory keeps one host_vars copy per node. --backup keeps the pre-rotation file for the post-mortem, since after a rotation nothing records what PASS 1 deployed with. `administrator` stays exempt in both: its password is ansible_become_password, and rotating it would lock the deploy out of its own host. Expect roles that never re-apply a changed secret to fail PASS 2 from here on; that is the gate working. Both database engines already converge their root password on every run. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
21 lines
775 B
Python
21 lines
775 B
Python
"""SPOT for the ``deploy`` subcommand of the development stack helper.
|
|
|
|
Internal layout (one module per responsibility):
|
|
|
|
* :mod:`.run` — :func:`_run_deploy`, one deploy pass inside the container
|
|
* :mod:`.drill` — :func:`_maybe_recover_drill`, backup/recover verification
|
|
* :mod:`.purge` — :func:`_purge_app_entities`, inter-round entity cleanup
|
|
* :mod:`.rotate` — :func:`_rotate_credentials`, inter-pass credential rotation
|
|
* :mod:`.cli` — :func:`add_parser` + :func:`handler`, arg parsing and the
|
|
round/pass orchestration loop
|
|
|
|
Tests patch collaborators on the submodule that uses them
|
|
(e.g. ``deploy.cli._run_deploy``), not on this package.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
from .cli import add_parser, handler
|
|
|
|
__all__ = ["add_parser", "handler"]
|