deytenit/apex.ermnvldmr.com
1
0 Fork 0
Code Issues Pull Requests Actions Releases Wiki Activity
22 Commits 3 Branches 11 Tags
b41fc6097f29f3bd5c4a6daeac2e2e58d4e40721
Commit Graph
9 Commits
Author SHA1 Message Date
deytenit 334ca196e0 feat: add .apex-root-owned opt-out for root-owned tier compositions 
An empty .apex-root-owned marker in a composition dir makes tiers/useradd
skip its noroot user + .env UID injection, and tiers/chown force its tier
data (dir + children, recursively) to root:root instead of noroot-<proj>.
For services that run as root and reject non-root-owned data (e.g. seafile-mc).
 2026-07-06 10:39:04 +03:00
deytenit ce93f879e7 refactor: gate xray behind profile, expose loki via basicauth, move happ generator to daedalus 
- xray gets profiles: [xray] — daedalus/icarus opt in via COMPOSE_PROFILES,
  morpheus never runs it.
- loki is routed at /loki on the node FQDN behind basicauth
  (APEX_LOKI_BASIC_AUTH from node .env); /loki is loki's native API prefix
  so no strip-prefix needed.
- utils/generate-happ-subscriptions + source/ move to daedalus proprietaries;
  commons keeps only what every node shares (16 actions now).
 2026-07-05 12:16:51 +03:00
deytenit 1bc448961a fix: update sync/repository rebase target from trunk to main 2026-07-05 12:04:24 +03:00
deytenit c5b61a3294 fix: exclude commons/ from dclint --fix to prevent submodule dirtying 
In node repos the shared core compose lives inside the pinned commons
submodule; letting dclint rewrite it dirties the submodule, which makes
sync/repository abort the nightly capture-up. Harmless in the standalone
commons repo (no commons/ dir).
 2026-07-05 11:20:25 +03:00
deytenit 6aaef35780 fix: resolve 17 confirmed bash-parity drifts from port review 
Adversarial parity review of every ported action against its bash source
confirmed 17 real behavioral drifts (of 22 claimed); all fixed here:

- tiers/chown: defaults were compositions/apex/tierN (one level too deep);
  now the tier roots. shared/ base reset is non-recursive again.
- compose: --dry-run was swallowed by argparse.REMAINDER; now stripped.
- host.write_file: rendered files land 0644 (tempfile's 0600 made fresh
  systemd units/crowdsec configs owner-only).
- systemd.deploy_units: top-level non-hidden files only.
- ufw: missing docker/host config dir exits 66; missing /etc/ufw target
  aborts; empty rules dir warns; dotfile .rules excluded.
- sync/packages: Telegram error-trap parity and failed notify exits 1.
  Same notify-failure exit for backup/run and sync/repository.
  repository regains the node-dir guard.
- tiers/useradd: no more secret-bearing .env.bak per run.
- tiers/link: EOF on confirm prompt declines and continues.
- extract-traefik-certs: sudo mkdir inside the notify envelope.
- generate-happ-subscriptions: realpath parent-exists guards + docker check.
- configure/crowdsec: bouncer install goes through install_packages.
- lint-docker-compose: malformed/unreadable anchor-IP inputs are lint errors.
- core compose: APEX_RESTIC_REPOSITORY now ?error; RESTIC_COMPRESSION
  per-node via APEX_RESTIC_COMPRESSION (default auto).
- sys.service_exists line-anchored; tpl docstring corrected.
 2026-07-05 10:50:40 +03:00
deytenit ec54ab592f feat: port utils actions (extract-traefik-certs, generate-happ-subscriptions, lint-docker-compose) 2026-07-04 21:29:17 +03:00
deytenit b9c80b0212 feat: port tiers actions (link, chown, useradd) 2026-07-04 21:28:28 +03:00
deytenit f7fc0eb697 feat: port sync and backup/run actions 2026-07-04 21:27:39 +03:00
deytenit 05469332e8 feat: port configure actions (base, ufw, crowdsec, cron, systemd, routing) 2026-07-04 21:26:56 +03:00