alexei.dolgolyov
7733e64b08
A dockerfile or static workload can opt in to reading its deploy config from a
.tinyforge.yml in its own repo. Tinyforge fetches the file, shows field-level
drift vs the live config, and an admin applies it with an explicit Sync. The
repo becomes the source of truth for the declared fields. Manual-sync only;
no auto-apply on deploy, no multi-workload reconcile, no create/delete in v1.
Scope is deliberately source-aware and source_config-resident: dockerfile
declares port/healthcheck/deploy_strategy, static declares deploy_strategy.
The file never carries repo coords or secrets (those stay in the encrypted
DB), which keeps credentials out of the repo.
Backend:
- internal/gitops: Spec/ParseSpec (KnownFields rejects unknown keys), a
source-aware ApplyPlan/BuildPlan, MergeAndValidate (omitted-field-preserving
deep merge + validate-the-merged-result-then-commit — never a partial
config), declared-only Drift with normalization, and Fetch with
ok/no_file/fetch_failed/invalid statuses and token-redacted messages.
- staticsite: DownloadFile added to GitProvider + Gitea/GitHub/GitLab impls,
reusing each provider's SSRF-safe client; 64 KiB cap; ErrFileNotFound.
- store: 4 additive gitops_* columns + setters (disjoint from UpdateWorkload
so the edit-form save and a sync never clobber each other).
- api: GET /workloads/{id}/gitops (status + raw + live drift + managed_fields),
PUT /gitops (admin, enable/path, traversal-safe), POST /gitops/sync (admin,
per-workload locked read->merge->validate->write, audited to event_log).
Frontend:
- GitOpsPanel.svelte: status pill, a purpose-built field-level drift view,
.tinyforge.yml preview, enable ToggleSwitch, Sync via ConfirmDialog; all five
statuses handled, admin affordances gated on the real viewer role.
- GitOps-managed badge (list + detail hero) and a read-only edit-form banner.
- api.ts fetchers + types; i18n apps.detail.gitops.* (en + ru parity).
Built phase-by-phase with an adversarial plan review (caught 5 design flaws
pre-implementation) and an independent review per phase (go / security / ts /
final) — all APPROVE, 0 CRITICAL/HIGH. docs/gitops.md documents the schema and
what's intentionally out of v1. Plan: plans/gitops/.
58 lines
2.1 KiB
Go
58 lines
2.1 KiB
Go
// Package gitops implements config-as-code for repo-backed workloads: a
|
|
// dockerfile/static workload can read a small .tinyforge.yml from its own repo
|
|
// that declares a subset of its deploy config. The package is deliberately
|
|
// decoupled from the store and source plugins — it takes a RepoRef (repo
|
|
// coords + a decrypted token) and a live source_config blob, and returns a
|
|
// validated merged config + a field-level drift report. It never writes to the
|
|
// database and never decides to deploy.
|
|
//
|
|
// v1 scope (see plans/gitops/PLAN.md): only source_config-resident fields are
|
|
// overlayable, and the set is source-aware (dockerfile: port/healthcheck/
|
|
// deploy_strategy; static: deploy_strategy). env/faces live in separate stores
|
|
// and are intentionally out of v1; the typed ApplyPlan reserves their slots.
|
|
package gitops
|
|
|
|
import (
|
|
"bytes"
|
|
"errors"
|
|
"fmt"
|
|
"io"
|
|
|
|
"gopkg.in/yaml.v3"
|
|
)
|
|
|
|
// Spec is the parsed shape of a .tinyforge.yml file (v1).
|
|
type Spec struct {
|
|
Version int `yaml:"version"`
|
|
Deploy DeploySpec `yaml:"deploy"`
|
|
}
|
|
|
|
// DeploySpec carries the overlayable deploy fields. Pointers so an omitted key
|
|
// is distinguishable from a zero value — only present (non-nil) fields are
|
|
// applied or drift-compared, so an absent key never clears live config.
|
|
type DeploySpec struct {
|
|
Port *int `yaml:"port"`
|
|
Healthcheck *string `yaml:"healthcheck"`
|
|
DeployStrategy *string `yaml:"deploy_strategy"`
|
|
}
|
|
|
|
// ParseSpec decodes a .tinyforge.yml body. Unknown keys are rejected
|
|
// (KnownFields) so a typo or an unsupported field — e.g. someone trying to
|
|
// declare env/faces in v1 — surfaces as an error instead of being silently
|
|
// dropped. Only version 1 is accepted.
|
|
func ParseSpec(data []byte) (Spec, error) {
|
|
var s Spec
|
|
dec := yaml.NewDecoder(bytes.NewReader(data))
|
|
dec.KnownFields(true)
|
|
if err := dec.Decode(&s); err != nil {
|
|
if errors.Is(err, io.EOF) {
|
|
return Spec{}, fmt.Errorf("gitops: empty .tinyforge.yml")
|
|
}
|
|
return Spec{}, fmt.Errorf("gitops: parse .tinyforge.yml: %w", err)
|
|
}
|
|
if s.Version != 1 {
|
|
return Spec{}, fmt.Errorf("gitops: unsupported version %d (want 1)", s.Version)
|
|
}
|
|
return s, nil
|
|
}
|