feat: cast — the Coolify executor, extracted from the infra state repo
Public tool, private state. cast holds no hostnames, no bindings, no
secrets: it joins a product repo's .infra/ manifest with a state directory
you point it at, and makes Coolify match.
Extracted from heavy-duty/infra, which was half tool and half state — the
inconsistency that made it impossible to say whether "infra" named a CLI
or a runbook. rig builds the boxes; cast fills them; infra is what they
are filled with.
Two changes were required to make it genuinely stateless and publishable:
- The implicit cwd contract (environments.yaml / secrets/ / .coolify.env
resolved against the working directory, silently reading the wrong file
from the wrong place) is now an explicit --state <dir> / $CAST_STATE.
- BANNED_IN_PROD — a hardcoded list of one product's ALLOW_* flags, the
only product knowledge in the executor — becomes the generic, operator-
owned environments.<env>.forbidden_var_patterns. The guard now lives in
private state, so a product-side change cannot lower its own guard, and
it is a pattern rather than a list, so it catches unforeseen siblings.
Age identities resolve as $CAST_AGE_KEY_FILE_<ENV> then
~/.config/cast/age-<env>.key — which is the entire attended-vs-unattended
apply mechanism, with no environment names known to the tool.
Instance identity (org names, the GitHub App name, founder domains) is out
of the fixtures and out of register-github-app.sh, which took APP_NAME and
ORG as arguments rather than baking them in.
69 tests green; bin/cast + curl installer mirror rig's shape.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-07-11 12:25:44 +00:00
|
|
|
import { describe, expect, it } from "vitest";
|
|
|
|
|
import { computeDiff, renderDiff } from "../src/diff.js";
|
|
|
|
|
|
|
|
|
|
const desiredApp = {
|
|
|
|
|
kind: "application" as const,
|
|
|
|
|
name: "core-api",
|
|
|
|
|
fields: { build_pack: "nixpacks", domains: ["https://api.example.com"] },
|
|
|
|
|
env: {
|
|
|
|
|
vars: {
|
|
|
|
|
PORT: { value: "3000", secret: false },
|
|
|
|
|
MAILGUN_KEY: { value: "mk-123", secret: true },
|
|
|
|
|
},
|
|
|
|
|
},
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
describe("computeDiff", () => {
|
|
|
|
|
it("plans a create when live is missing", () => {
|
|
|
|
|
const r = computeDiff([desiredApp], [], "full");
|
|
|
|
|
expect(r.changes).toHaveLength(1);
|
|
|
|
|
expect(r.changes[0].op).toBe("create");
|
|
|
|
|
expect(r.clean).toBe(false);
|
|
|
|
|
});
|
|
|
|
|
it("is clean when live matches", () => {
|
|
|
|
|
const r = computeDiff(
|
|
|
|
|
[desiredApp],
|
|
|
|
|
[
|
|
|
|
|
{
|
|
|
|
|
kind: "application",
|
|
|
|
|
name: "core-api",
|
|
|
|
|
uuid: "u1",
|
|
|
|
|
fields: { ...desiredApp.fields },
|
|
|
|
|
env: { PORT: "3000", MAILGUN_KEY: "mk-123" },
|
|
|
|
|
},
|
|
|
|
|
],
|
|
|
|
|
"full",
|
|
|
|
|
);
|
|
|
|
|
expect(r.clean).toBe(true);
|
|
|
|
|
});
|
|
|
|
|
it("marks build_pack drift as non-updatable", () => {
|
|
|
|
|
const r = computeDiff(
|
|
|
|
|
[desiredApp],
|
|
|
|
|
[
|
|
|
|
|
{
|
|
|
|
|
kind: "application",
|
|
|
|
|
name: "core-api",
|
|
|
|
|
uuid: "u1",
|
|
|
|
|
fields: { build_pack: "static", domains: desiredApp.fields.domains },
|
|
|
|
|
env: { PORT: "3000", MAILGUN_KEY: "mk-123" },
|
|
|
|
|
},
|
|
|
|
|
],
|
|
|
|
|
"full",
|
|
|
|
|
);
|
|
|
|
|
expect(r.changes[0].fieldDiffs).toEqual([
|
|
|
|
|
{
|
|
|
|
|
field: "build_pack",
|
|
|
|
|
desired: "nixpacks",
|
|
|
|
|
live: "static",
|
|
|
|
|
updatable: false,
|
|
|
|
|
},
|
|
|
|
|
]);
|
|
|
|
|
});
|
|
|
|
|
it("full mode diffs env; structural mode does not", () => {
|
|
|
|
|
const live = [
|
|
|
|
|
{
|
|
|
|
|
kind: "application" as const,
|
|
|
|
|
name: "core-api",
|
|
|
|
|
uuid: "u1",
|
|
|
|
|
fields: { ...desiredApp.fields },
|
|
|
|
|
env: { PORT: "3000", MAILGUN_KEY: "OLD", EXTRA: "x" },
|
|
|
|
|
},
|
|
|
|
|
];
|
|
|
|
|
const full = computeDiff([desiredApp], live, "full");
|
|
|
|
|
expect(full.changes[0].envDiffs).toEqual([
|
|
|
|
|
{ key: "MAILGUN_KEY", state: "change", secret: true },
|
|
|
|
|
{ key: "EXTRA", state: "remove-candidate", secret: false },
|
|
|
|
|
]);
|
|
|
|
|
expect(computeDiff([desiredApp], live, "structural").clean).toBe(true);
|
|
|
|
|
});
|
|
|
|
|
it("reports orphans, never plans deletion", () => {
|
|
|
|
|
const r = computeDiff(
|
|
|
|
|
[],
|
|
|
|
|
[{ kind: "service", name: "old-thing", uuid: "u9", fields: {} }],
|
|
|
|
|
"full",
|
|
|
|
|
);
|
|
|
|
|
expect(r.changes).toHaveLength(0);
|
|
|
|
|
expect(r.orphans).toEqual([
|
|
|
|
|
{ kind: "service", name: "old-thing", uuid: "u9" },
|
|
|
|
|
]);
|
|
|
|
|
expect(r.clean).toBe(false);
|
|
|
|
|
});
|
|
|
|
|
});
|
|
|
|
|
|
feat: place a resource on a destination — and a state file that can say which (#21)
A destination is the Docker network a resource is created on. cast never sent
one, so everything landed on the server's default — invisible and harmless while
each server hosts one project, and neither the moment a server hosts two.
The state file had nowhere to say otherwise, either. A destination is scoped
project × environment, and `environments.<env>` is scoped by environment alone:
a `destination:` key there would mean "one network shared by every project in
this environment", which is the isolation it is meant to provide, inverted.
So:
- `environments.<env>.projects.<repo>` — per-project state, keyed by repo, full
`<org>/<repo>` slug first with a bare-`<repo>` fallback, exactly like
`github_apps`. It carries `destination_uuid` and `smoke_target`.
- `smoke_target` moves there. It was state-file-scoped: it named ONE project's
app (`core`) from a key that could not tell two projects apart — or even prod's
app from staging's. The old key is still read (with a warning), so an unmigrated
state file keeps smoking, and `cast smoke` now takes an optional `<org>/<repo>`.
- `apply` sends `destination_uuid` on create, for applications, databases and
services alike — Coolify runs identical destination logic in all three.
The API turns out to be worse than the issue assumed, in a way that changes what
"diff should compare the destination" can honestly mean. Verified against
coollabsio/coolify v4.1.2 (routes/api.php + the three Api controllers), and
written up in reference/README.md:
- There is NO destinations API. Zero routes. A destination cannot be listed, read
or resolved by name — only a raw UUID from the UI identifies one, exactly as
with `s3_destination`. Hence `destination_uuid:` and not `destination:`.
- The field is WRITE-ONLY. Coolify takes `destination_uuid` on write and returns
`destination_id` (an integer PK) on read, with nothing mapping between them.
- On a server with >1 destination, a create that OMITS it is a hard 400. So cast
could not deploy onto a shared box at all — it did not silently misplace there,
it simply failed. On a single-destination server the uuid is ignored entirely
and never validated, so a wrong one is invisible until a second one exists.
A declared UUID therefore cannot be verified against the resource it was sent
for — by cast or by anything else. Diffing it as a field would compare a UUID to
an int and report drift that never clears, so it is reported rather than compared,
and the limit is stated out loud: every diff that declares a destination says it
did not verify it. Silence would make an unverified setting read as a verified
one, which is the failure shape #12/#14/#17/#18 are all about.
What IS comparable is the live side to itself. `diff` groups live resources by the
`destination_id` Coolify does report, and a project whose resources do not all
share one network is drift — non-clean, both sides named, and never repaired
(apply moves nothing between networks). That catches the thing actually worth
catching, including on a box whose destinations were made by hand.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-13 19:31:02 +00:00
|
|
|
// The destination can never be diffed the way a field is: Coolify 4.1.2 takes
|
|
|
|
|
// destination_uuid on write and returns destination_id on read, with nothing
|
|
|
|
|
// mapping between them. So it is REPORTED rather than compared — and the one
|
|
|
|
|
// thing that IS comparable (a project's live resources against each other)
|
|
|
|
|
// carries the check that matters.
|
|
|
|
|
//
|
|
|
|
|
// Placement is measured against the live side ALONE, so these fixtures pair each
|
|
|
|
|
// live resource with a matching desired one: otherwise every resource is an
|
|
|
|
|
// orphan, and `clean` would be false for reasons that have nothing to do with
|
|
|
|
|
// the destination.
|
|
|
|
|
const want = (name: string) => ({
|
|
|
|
|
kind: "application" as const,
|
|
|
|
|
name,
|
|
|
|
|
fields: {},
|
|
|
|
|
});
|
|
|
|
|
const got = (name: string, destinationId?: number) => ({
|
|
|
|
|
kind: "application" as const,
|
|
|
|
|
name,
|
|
|
|
|
uuid: `u-${name}`,
|
|
|
|
|
fields: {},
|
|
|
|
|
destinationId,
|
|
|
|
|
});
|
|
|
|
|
|
|
|
|
|
describe("computeDiff placement", () => {
|
|
|
|
|
it("is not split when every resource shares one destination", () => {
|
|
|
|
|
const r = computeDiff(
|
|
|
|
|
[want("a"), want("b")],
|
|
|
|
|
[got("a", 3), got("b", 3)],
|
|
|
|
|
"structural",
|
|
|
|
|
);
|
|
|
|
|
expect(r.placement.split).toBe(false);
|
|
|
|
|
expect(r.placement.groups).toEqual([
|
|
|
|
|
{ destinationId: 3, resources: ["application a", "application b"] },
|
|
|
|
|
]);
|
|
|
|
|
expect(r.clean).toBe(true);
|
|
|
|
|
});
|
|
|
|
|
|
|
|
|
|
// A project whose resources straddle two networks is a project whose
|
|
|
|
|
// isolation is broken — drift, not silence. Same disposition as an orphan:
|
|
|
|
|
// reported, counted, never repaired.
|
|
|
|
|
it("reports a split project as drift, and is not clean", () => {
|
|
|
|
|
const r = computeDiff(
|
|
|
|
|
[want("a"), want("b")],
|
|
|
|
|
[got("a", 3), got("b", 7)],
|
|
|
|
|
"structural",
|
|
|
|
|
);
|
|
|
|
|
expect(r.placement.split).toBe(true);
|
|
|
|
|
expect(r.placement.groups).toEqual([
|
|
|
|
|
{ destinationId: 3, resources: ["application a"] },
|
|
|
|
|
{ destinationId: 7, resources: ["application b"] },
|
|
|
|
|
]);
|
|
|
|
|
expect(r.clean).toBe(false);
|
|
|
|
|
// ...and apply is not offered a way to "fix" it.
|
|
|
|
|
expect(r.changes).toHaveLength(0);
|
|
|
|
|
});
|
|
|
|
|
|
|
|
|
|
// A resource Coolify reports no destination for is no evidence of a split.
|
|
|
|
|
it("ignores resources with no destination rather than grouping them", () => {
|
|
|
|
|
const r = computeDiff(
|
|
|
|
|
[want("a"), want("b")],
|
|
|
|
|
[got("a", 3), got("b")],
|
|
|
|
|
"structural",
|
|
|
|
|
);
|
|
|
|
|
expect(r.placement.split).toBe(false);
|
|
|
|
|
expect(r.placement.groups).toEqual([
|
|
|
|
|
{ destinationId: 3, resources: ["application a"] },
|
|
|
|
|
]);
|
|
|
|
|
expect(r.clean).toBe(true);
|
|
|
|
|
});
|
|
|
|
|
|
|
|
|
|
it("carries the declared destination through without comparing it", () => {
|
|
|
|
|
const r = computeDiff([want("a")], [got("a", 3)], "structural", {
|
|
|
|
|
declaredDestination: "dest-abc",
|
|
|
|
|
});
|
|
|
|
|
expect(r.placement.declared).toBe("dest-abc");
|
|
|
|
|
// Declaring one does not make the project dirty — there is nothing to
|
|
|
|
|
// compare it against, and a phantom "update" would never clear.
|
|
|
|
|
expect(r.clean).toBe(true);
|
|
|
|
|
expect(r.changes).toHaveLength(0);
|
|
|
|
|
});
|
|
|
|
|
});
|
|
|
|
|
|
|
|
|
|
describe("renderDiff placement", () => {
|
|
|
|
|
it("says out loud that a declared destination was NOT compared", () => {
|
|
|
|
|
const out = renderDiff(
|
|
|
|
|
computeDiff([want("a")], [got("a", 3)], "structural", {
|
|
|
|
|
declaredDestination: "dest-abc",
|
|
|
|
|
}),
|
|
|
|
|
);
|
|
|
|
|
expect(out).toContain("dest-abc");
|
|
|
|
|
expect(out).toMatch(/NOT compared/);
|
|
|
|
|
expect(out).toMatch(/placement: all resources on destination 3/);
|
|
|
|
|
});
|
|
|
|
|
|
|
|
|
|
// The whole reason placement is in the report at all: a destination that read
|
|
|
|
|
// back as absent rather than wrong is the failure shape #12/#14/#17/#18 are
|
|
|
|
|
// about. Silence is the bug — but so is noise on the happy path.
|
|
|
|
|
it("stays silent about placement when nothing is declared and nothing is split", () => {
|
|
|
|
|
const out = renderDiff(
|
|
|
|
|
computeDiff([want("a")], [got("a", 3)], "structural"),
|
|
|
|
|
);
|
|
|
|
|
expect(out).not.toMatch(/placement/);
|
|
|
|
|
expect(out).toContain("clean");
|
|
|
|
|
});
|
|
|
|
|
|
|
|
|
|
it("names every resource on each side of a split", () => {
|
|
|
|
|
const out = renderDiff(
|
|
|
|
|
computeDiff(
|
|
|
|
|
[want("core"), want("landing")],
|
|
|
|
|
[got("core", 3), got("landing", 7)],
|
|
|
|
|
"structural",
|
|
|
|
|
),
|
|
|
|
|
);
|
|
|
|
|
expect(out).toMatch(/split placement: these resources sit on 2 different/);
|
|
|
|
|
expect(out).toContain("destination 3: application core");
|
|
|
|
|
expect(out).toContain("destination 7: application landing");
|
|
|
|
|
expect(out).toMatch(/apply never moves a live resource between networks/);
|
|
|
|
|
expect(out).toMatch(/split placement$/m);
|
|
|
|
|
});
|
|
|
|
|
});
|
|
|
|
|
|
feat: cast — the Coolify executor, extracted from the infra state repo
Public tool, private state. cast holds no hostnames, no bindings, no
secrets: it joins a product repo's .infra/ manifest with a state directory
you point it at, and makes Coolify match.
Extracted from heavy-duty/infra, which was half tool and half state — the
inconsistency that made it impossible to say whether "infra" named a CLI
or a runbook. rig builds the boxes; cast fills them; infra is what they
are filled with.
Two changes were required to make it genuinely stateless and publishable:
- The implicit cwd contract (environments.yaml / secrets/ / .coolify.env
resolved against the working directory, silently reading the wrong file
from the wrong place) is now an explicit --state <dir> / $CAST_STATE.
- BANNED_IN_PROD — a hardcoded list of one product's ALLOW_* flags, the
only product knowledge in the executor — becomes the generic, operator-
owned environments.<env>.forbidden_var_patterns. The guard now lives in
private state, so a product-side change cannot lower its own guard, and
it is a pattern rather than a list, so it catches unforeseen siblings.
Age identities resolve as $CAST_AGE_KEY_FILE_<ENV> then
~/.config/cast/age-<env>.key — which is the entire attended-vs-unattended
apply mechanism, with no environment names known to the tool.
Instance identity (org names, the GitHub App name, founder domains) is out
of the fixtures and out of register-github-app.sh, which took APP_NAME and
ORG as arguments rather than baking them in.
69 tests green; bin/cast + curl installer mirror rig's shape.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-07-11 12:25:44 +00:00
|
|
|
describe("renderDiff", () => {
|
|
|
|
|
it("never prints secret values", () => {
|
|
|
|
|
const live = [
|
|
|
|
|
{
|
|
|
|
|
kind: "application" as const,
|
|
|
|
|
name: "core-api",
|
|
|
|
|
uuid: "u1",
|
|
|
|
|
fields: { ...desiredApp.fields },
|
|
|
|
|
env: { PORT: "3000", MAILGUN_KEY: "OLD-SECRET" },
|
|
|
|
|
},
|
|
|
|
|
];
|
|
|
|
|
const out = renderDiff(computeDiff([desiredApp], live, "full"));
|
|
|
|
|
expect(out).toContain("secret MAILGUN_KEY differs");
|
|
|
|
|
expect(out).not.toContain("mk-123");
|
|
|
|
|
expect(out).not.toContain("OLD-SECRET");
|
|
|
|
|
});
|
|
|
|
|
it("structural mode says env was not compared", () => {
|
|
|
|
|
const out = renderDiff(computeDiff([desiredApp], [], "structural"));
|
|
|
|
|
expect(out).toMatch(/env vars not compared \(structural mode/);
|
|
|
|
|
});
|
|
|
|
|
});
|