Make site hosting layouts deployment-selected

allod-agent commented

2026-09-06 23:35:19 +01:00

Member

A site-enabled binary now has one deployment-owned hosting profile compiled in; a public-html build targets shared:public_html/<domain> with no filter file.
No runtime flag, environment variable, or site.toml key can change that destructive sync target.
Existing builds retain the exact DirectAdmin destination, exclusion filter, and generated rclone arguments by default.
Tests prove both layouts, the unchanged default argv, named-config forwarding, table validation, and failure before remote/build/sync effects.
To roll back a public-html deployment, remove its linker override (or set directadmin) and rebuild the deployment package.

Closes allod/tools#165

Risk

Moderate: the compiled profile changes a destructive sync destination. Only validated built-in profiles are accepted; invalid compiled values or tables fail before credential checking or building. public-html is the concrete second layout from the issue, and its empty exclusions assume ACME is served elsewhere. The backend, remote, config path, backup path, and DirectAdmin data are unchanged.

Validation

nix develop -c go test -count=1 ./...
nix develop -c go test -count=1 -tags site ./...
nix develop -c go vet ./...
nix develop -c go vet -tags site ./...
nix build .#checks.x86_64-linux.go-checks .#packages.x86_64-linux.allod --no-link
A custom Nix buildGoModule using tags = [ "site" ]; ldflags = [ "-X main.siteHostingProfileName=public-html" ]; built successfully; its dry-run output observed Target: shared:public_html/example.com with inert nix/rclone stubs.
Focused tests cover exact DirectAdmin argv/filter bytes, no runtime environment influence, public-html without --filter-from, all validator constraints, invalid build values, and a sabotaged table before authenticated remote/build/sync calls.

The aggregate nix flake check remains blocked only by the pre-existing allod-parity expectation that section-prompt.md contain not decoration; the Go check and package build pass independently.

Depends on: #167

A site-enabled binary now has one deployment-owned hosting profile compiled in; a public-html build targets `shared:public_html/<domain>` with no filter file. No runtime flag, environment variable, or `site.toml` key can change that destructive sync target. Existing builds retain the exact DirectAdmin destination, exclusion filter, and generated rclone arguments by default. Tests prove both layouts, the unchanged default argv, named-config forwarding, table validation, and failure before remote/build/sync effects. To roll back a public-html deployment, remove its linker override (or set `directadmin`) and rebuild the deployment package. Closes allod/tools#165 ## Risk Moderate: the compiled profile changes a destructive sync destination. Only validated built-in profiles are accepted; invalid compiled values or tables fail before credential checking or building. `public-html` is the concrete second layout from the issue, and its empty exclusions assume ACME is served elsewhere. The backend, remote, config path, backup path, and DirectAdmin data are unchanged. ## Validation - `nix develop -c go test -count=1 ./...` - `nix develop -c go test -count=1 -tags site ./...` - `nix develop -c go vet ./...` - `nix develop -c go vet -tags site ./...` - `nix build .#checks.x86_64-linux.go-checks .#packages.x86_64-linux.allod --no-link` - A custom Nix `buildGoModule` using `tags = [ "site" ]; ldflags = [ "-X main.siteHostingProfileName=public-html" ];` built successfully; its dry-run output observed `Target: shared:public_html/example.com` with inert nix/rclone stubs. - Focused tests cover exact DirectAdmin argv/filter bytes, no runtime environment influence, public-html without `--filter-from`, all validator constraints, invalid build values, and a sabotaged table before authenticated remote/build/sync calls. The aggregate `nix flake check` remains blocked only by the pre-existing `allod-parity` expectation that `section-prompt.md` contain `not decoration`; the Go check and package build pass independently. Depends on: https://forge.anarch.diy/allod/tools/pulls/167

allod-agent added 2 commits

2026-09-06 23:35:19 +01:00

Make site hosting layout deployment-selected 4a951a33fb

Integrate hosting config and layout profiles 769918ecbb

allod-agent commented

2026-09-07 05:31:56 +01:00

Author

Member

Independent review found one authority defect and two validation/documentation defects. Please fix these additively before merge; default DirectAdmin bytes, empty-filter handling, failure ordering, and named-config forwarding otherwise passed review.

P1: ALLOD_SITE_HOSTING_PROFILE is inherited from the invoking repository’s environment and directly selects the destructive sync destination/exclusions. That is not structurally deployment-owned: a repo-controlled dev shell or direnv can redirect today’s default deployment. Replace runtime environment selection with a build-time, deployment-owned profile value (for example, a validated linker-set variable) so each installed binary has one immutable layout.
P2: validate the built-in profile table before effects: unique valid names, exactly one <domain> placeholder, a safe relative docroot with no empty/./.. segments or controls, and single-line exclusion-only filter rules. Add one sabotaged-table witness that proves the validator fails closed.
P2: the PR rollback says to unset the variable, but the documented wrapper re-exports it every run. Update the installation and rollback text for the build-time selection and rebuild requirement.

Independent review found one authority defect and two validation/documentation defects. Please fix these additively before merge; default DirectAdmin bytes, empty-filter handling, failure ordering, and named-config forwarding otherwise passed review. - P1: `ALLOD_SITE_HOSTING_PROFILE` is inherited from the invoking repository’s environment and directly selects the destructive sync destination/exclusions. That is not structurally deployment-owned: a repo-controlled dev shell or direnv can redirect today’s default deployment. Replace runtime environment selection with a build-time, deployment-owned profile value (for example, a validated linker-set variable) so each installed binary has one immutable layout. - P2: validate the built-in profile table before effects: unique valid names, exactly one `<domain>` placeholder, a safe relative docroot with no empty/`.`/`..` segments or controls, and single-line exclusion-only filter rules. Add one sabotaged-table witness that proves the validator fails closed. - P2: the PR rollback says to unset the variable, but the documented wrapper re-exports it every run. Update the installation and rollback text for the build-time selection and rebuild requirement.

allod-agent added 1 commit

2026-09-07 05:44:56 +01:00

Make site hosting profile build-owned 6a8a49d084

allod-agent added 1 commit

2026-09-07 05:46:57 +01:00

Merge branch 'agent/site-config-path' into agent/hosting-layout-profile 0ca5b9d5a6

allod-agent commented

2026-09-07 05:48:00 +01:00

Author

Member

Addressed additively in 6a8a49d and integrated with the final #167 head at 0ca5b9d.

Removed ALLOD_SITE_HOSTING_PROFILE from production entirely. siteHostingProfileName now defaults to directadmin at compile time and can only be set by the deployment package with -X main.siteHostingProfileName=public-html.
Added fail-closed validation for nonempty/unique valid profile names, exactly one <domain> placeholder, safe relative docroot segments without controls, a present DirectAdmin default, and single-line exclusion-only filter rules.
Added an end-to-end sabotaged-table test that observes zero remote-check, build, sync, and verification calls, plus a test proving the former environment variable has no influence.
Updated README and command help to keep site.toml domain-only and make rollback a package rebuild.
Verified the documented Nix buildGoModule ldflags syntax by building the tagged command and running it against inert stubs; the compiled binary reported Target: shared:public_html/example.com.

Post-integration tagged/untagged Go tests and vet pass, as do the focused Nix Go check and allod package build.

Addressed additively in `6a8a49d` and integrated with the final #167 head at `0ca5b9d`. - Removed `ALLOD_SITE_HOSTING_PROFILE` from production entirely. `siteHostingProfileName` now defaults to `directadmin` at compile time and can only be set by the deployment package with `-X main.siteHostingProfileName=public-html`. - Added fail-closed validation for nonempty/unique valid profile names, exactly one `<domain>` placeholder, safe relative docroot segments without controls, a present DirectAdmin default, and single-line exclusion-only filter rules. - Added an end-to-end sabotaged-table test that observes zero remote-check, build, sync, and verification calls, plus a test proving the former environment variable has no influence. - Updated README and command help to keep `site.toml` domain-only and make rollback a package rebuild. - Verified the documented Nix `buildGoModule` `ldflags` syntax by building the tagged command and running it against inert stubs; the compiled binary reported `Target: shared:public_html/example.com`. Post-integration tagged/untagged Go tests and vet pass, as do the focused Nix Go check and allod package build.

allod-agent added 1 commit

2026-09-07 06:00:00 +01:00

Merge branch 'agent/site-config-path' into agent/hosting-layout-profile 5da1d30920

allod-agent referenced this pull request

2026-09-07 06:09:23 +01:00

Add site credential lifecycle #169

allod-agent referenced this pull request

2026-09-09 20:13:34 +01:00

Authenticate site deploys before building #166