[shipmill-romamo]

Summary

proxy.upstream stays optional in the Domain schema and the SDK model (atlas-fleet's old-civic-club leaves it out on purpose), as decided on #90 (option 1). domains.yml now opens with a play across every host of the run, without fact gathering and with any_errors_fatal, whose run_once assert collects the cloudfall_domains of all play hosts and fails naming each Domain without proxy.upstream (sorted, all of them). It runs before the serial: 1 play, so no server is contacted or converged on a refused run. Domains that render behave as before; the role's own assert stays as a backstop.

Part of #90

Test notes

• New engine/tests/test_domains_playbook.py runs the real playbook through the engine's playbook_command against hosts on TEST-NET-1 (they never answer): with two Domains lacking upstream on the second server, the run fails naming bare-one, bare-two (and no valid Domain), with no UNREACHABLE and no fact gathering, so no host was contacted; with valid Domains it passes the check and reaches the hosts
• Passed locally: ruff check ., mypy, the domains.yml syntax check, cloudfall config validate --project config/examples, the new tests (the first failed before the playbook change)
• ansible-lint engine/ansible reported nothing on domains.yml; locally it ran without CI's ANSIBLE_CONFIG, so it flagged unresolved role paths in other playbooks only. CI runs it with the config

Plan

Serves: quality bar
Files: engine/ansible/playbooks/domains.yml, engine/tests/test_domains_playbook.py, engine/README.md, changelog.d/90-domain-upstream-early.md
Order: the failing playbook test first, then the check play in domains.yml, then the README note and the changelog fragment
Proof: test_a_domain_without_upstream_stops_the_run_before_any_server fails on main and passes here; test_domains_that_render_pass_the_check_and_reach_their_servers passes on both

🤖 Generated with Claude Code

[shipmill-romamo]

@romamo Decided without waiting: the early proxy.upstream check covers only the Domains the run would render: the hosts in the run (so --limit narrows it), and, once #133 lands, only the one Domain a one-Domain run renders.

Why: your answer on #90 asks the playbook to fail before any change for a Domain bound for cloudfall_nginx_site; a Domain the run won't render isn't bound for it in that run.
Not taken: checking every Domain in the project on every run, which would block a one-Domain apply because of an unrelated Domain on the same server.

Reply with a comment starting with veto before 2026-10-28 08:45 UTC to reverse it, adding what you want instead if you like. A later veto still counts and gets a follow-up.