Repository navigation
Add cloudfall domains apply (S-004-1, 3, 5..10) #117
Description
Builds part of spec S-004, docs/specs/004-domains-apply.md (feature issue #87): the acceptance criteria below. Each needs a test that names its id (test_s004_<k>_..., or a proves: S-004-1 comment line).
This is the cloudfall domains apply command.
- S-004-1: In a project with servers
aandband a Domain whoseproxy.serverisa,cloudfall domains apply <d> --yesrunsdomains.ymlwith onlyain its play recap, and no task frombaseline.yml,services.ymlor thecloudfall_firewallrole runs - S-004-3: Without
--yes,domains apply <d>exits 0 withstatus: "plan"andeffect: "would_update", runs noansible-playbook, and writes no receipt - S-004-5:
domains apply <d>in a project whose config fails validation exitsCONFIG_INVALIDbefore any engine step - S-004-6:
--issue-certificateon adns-onlyDomain with an alias that resolves to no address of the proxy server exitsPRECONDITIONwith context codedomains_dns_unverifiednaming that alias, with and without--yes, and runs noansible-playbook - S-004-7:
--issue-certificateon aproxiedDomain runs no DNS check and answersdnsCheck: "skipped-proxied" - S-004-8:
--issue-certificateon a Domain withtls.mode: disabledexitsPRECONDITIONbefore any engine step - S-004-9:
domains apply <d> --issue-certificate --yeson a freshdns-onlyDomain whose names resolve to the proxy server passescloudfall_domains_issue_certificates: truetodomains.yml, ends with/etc/letsencrypt/live/<primaryName>/fullchain.pempresent andcertbot.timerenabled and active, answersdnsCheck: "verified", and writes<deployments>/<d>.json - S-004-10: A second
domains apply <d> --issue-certificate --yesskips theIssue the declared certificatetask, and its receipt hasconfigurationSha256equal topreviousConfigurationSha256
Depends on #116
Activity
migrate, which converges every server #87shipmill-romamo commentedon Oct 27, 2026
Triage: implement, for the next release candidate.
The plan: build the criteria listed in the body, as
docs/specs/004-domains-apply.md(S-004, approved in #100) says, each with a test that names its id. A departure from a criterion goes back as a question, never a quiet change. Build issues start in order: this one starts once every issue on itsDepends onlines has closed. I'll link the PR here.shipmill-romamo commentedon Oct 27, 2026
PR #137 adds
cloudfall domains apply <d> [--issue-certificate] [--yes]: a plan without--yes, a run ofdomains.ymlon the proxy server only with it, the DNS check fordns-onlyDomains (domains_dns_unverified),skipped-proxiedfor proxied ones, and a refusal of--issue-certificateundertls.mode: disabled(domains_tls_disabled). I asked it to keepcloudfall migrate's dns-verify unchanged before it lands.Trade-off: a real Let's Encrypt issue (S-004-9) and the second run skipping the issue task on a live host (S-004-10) aren't exercised; tests run
domains.ymllocally with a stand-in role and an injected resolver.domains observeand the MCP tools stay with #118.Apply one Domain on its proxy server with cloudfall domains apply
shipmill-romamo commentedon Oct 27, 2026
Released in v0.8.0rc7 (pre-release). uv tool install --prerelease allow cloudfall==0.8.0rc7
A plain install gets it with the next stable release.
If you filed this: react 👍 on this comment once it works for you, or reply if it doesn't.