fe4cbbe36a
Python control-panel package driving the full provisioning flow from a site's site.yaml (docs/05): - provision: ZFS web dataset + ownership, per-site DB + least-priv user, generated .env encrypted to secrets.enc.yaml (SOPS/age), render the profile templates + persist site.yaml, per-customer chrooted SFTP account, docker compose up. - deprovision (gated: data destroyed only with --purge, after a final backup), backup (ZFS snapshot + mariadb-dump), restore (rollback + import), render (preview), list. Design: one command/file runner with a real --dry-run (prints every action, redacts secrets); idempotent steps; Config + Site validation mirroring docs/03; passwords never logged. Modules: cli, config, naming, context, render, runner, zfs, database, secrets, sftp, compose, provision, backup. Plus pyproject (heleosctl entry point), config.example.yaml, an example site, and a README. Tests: 22 pure-logic unit tests (naming, config validation, template render across all profiles + db on/off) — all passing. Full provision and deprovision verified end-to-end in --dry-run. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
39 lines
614 B
Text
39 lines
614 B
Text
# Secrets — never commit plaintext. Use SOPS/age (*.enc.yaml is allowed).
|
|
*.env
|
|
.env
|
|
.env.*
|
|
!.env.example
|
|
secrets/
|
|
*.key
|
|
*.pem
|
|
!*.pub
|
|
|
|
# SOPS-encrypted files ARE allowed to be committed:
|
|
!*.enc.*
|
|
!*.sops.*
|
|
|
|
# Rendered runtime state that should not be tracked
|
|
deployments/**/.state/
|
|
deployments/**/data/
|
|
|
|
# OS / editor cruft
|
|
.DS_Store
|
|
Thumbs.db
|
|
*.swp
|
|
.idea/
|
|
.vscode/
|
|
|
|
# Ansible
|
|
*.retry
|
|
platform-infra/ansible/inventory/hosts.yml
|
|
platform-infra/ansible/.ansible/
|
|
platform-infra/ansible/collections/
|
|
|
|
# Python (control-panel CLI)
|
|
__pycache__/
|
|
*.pyc
|
|
.venv/
|
|
venv/
|
|
*.egg-info/
|
|
.pytest_cache/
|
|
control-panel/config.yaml
|