app

Documentation

Overview

Package app is komizo: the commands, and everything they do to a server.

It runs on YOUR machine. Every command opens an SSH connection itself; you do not run anything on the server by hand. The server-side work is a shell script embedded in this binary, printable with `komizo script`, so what runs as root on your box stays readable.

Index

• Constants
• Variables
• func Main(args []string) error
• func RunAdd(args []string) error
• func RunArtifact(args []string) error
• func RunEnrol(args []string) error
• func RunInit(args []string) error
• func RunList(args []string) error
• func RunLogin(args []string) error
• func RunLogout(args []string) error
• func RunLogs(args []string) error
• func RunOperator(args []string) error
• func RunPlatform(args []string) error
• func RunPreview(args []string) error
• func RunProxy(args []string) error
• func RunPublication(args []string) error
• func RunReconcile(args []string) error
• func RunRemove(args []string) error
• func RunReport(args []string) error
• func RunRestart(args []string) error
• func RunScript(args []string) error
• func RunSetSecret(args []string) error
• func RunStart(args []string) error
• func RunStop(args []string) error
• func RunUI(args []string) error
• func RunUnsetSecret(args []string) error
• func RunUpdate(args []string) error
• func RunWorkloadAcceptance(args []string) error
• func RunWorkspace(args []string) error
• func Usage()
• func UsageAdd(fs *flag.FlagSet)
• type Session

Constants

const BoxBin = "/usr/local/bin/komizo-box"

BoxBin is where init puts the agent.

const LogTailMax = 2000

LogTailMax mirrors the bound the box enforces, so an impossible request fails here rather than after a round trip. The box's is the one that is load- bearing; this one is a courtesy.

Variables

var ErrSilent = errors.New("")

ErrSilent means the failure has already been reported -- flag parsing prints its own message, and repeating it would be noise.

var Version = "dev"

Main is the whole command line: which subcommand, or an address, or nothing.

Here rather than in the root main.go so that main() is the one thing it should be -- a call and an exit code. Everything this dispatches to is in this package, and a dispatcher that lives apart from what it dispatches to is a file you have to open twice. Version is what this binary reports for `komizo version`. Set from main at startup, which is where the linker can reach it.

Functions

func Main

func Main(args []string) error

func RunAdd

func RunAdd(args []string) error

func RunArtifact

func RunArtifact(args []string) error

Only embedded release bytes may be exported; this never builds or downloads.

func RunEnrol

func RunEnrol(args []string) error

func RunInit

func RunInit(args []string) error

func RunList

func RunList(args []string) error

func RunLogin

func RunLogin(args []string) error

func RunLogout

func RunLogout(args []string) error

func RunLogs

func RunLogs(args []string) error

RunLogs prints what something has been saying.

A TAIL, bounded, and not a follow. app-only.md §5 says why the product side of this is deliberately small; the CLI side is small for a plainer reason, which is that anything else is `ssh` and `docker compose logs -f`, and komizo should not be a worse version of a thing that already works.

func RunOperator

func RunOperator(args []string) error

func RunPlatform

func RunPlatform(args []string) error

Preparation authenticates released bytes and emits a reviewable finite plan. Execution requires the operator's exact prepared manifest, not an implicit yes.

func RunPreview

func RunPreview(args []string) error

RunPreview handles `komizo preview up|down|resolve|ls|gc`.

func RunProxy

func RunProxy(args []string) error

func RunPublication

func RunPublication(args []string) error

RunPublication prepares tested image bytes without registry credentials.

func RunReconcile

func RunReconcile(args []string) error

func RunRemove

func RunRemove(args []string) error

runRemove is the non-interactive counterpart to the TUI's remove. It refuses to run without --yes, because unlike everything else here it deletes data.

func RunReport

func RunReport(args []string) error

func RunRestart

func RunRestart(args []string) error

RunRestart restarts the containers that are there, which is not the same as stop then start -- compose restarts what it has rather than reconciling against the compose file.

func RunScript

func RunScript(args []string) error

runScript prints one of the embedded server-side scripts.

func RunSetSecret

func RunSetSecret(args []string) error

RunSetSecret sends a bounded value over the operator's root connection to the typed host writer. CI uses the separately scoped release-secret command. Both routes share the same atomic writer; secret bytes never enter argv.

func RunStart

func RunStart(args []string) error

RunStart brings an app, a service, or the shared proxy up.

func RunStop

func RunStop(args []string) error

RunStop takes it down, deliberately.

Deliberate is the whole distinction: architecture.md §6 keeps STOPPED as durable state on the box precisely so a stopped app pages nobody, and so that a deploy while stopped pulls the image without starting it.

func RunUI

func RunUI(args []string) error

func RunUnsetSecret

func RunUnsetSecret(args []string) error

RunUnsetSecret takes secrets off a box: the counterpart set-secret never had.

set-secret writes a key and never deletes one, which is deliberate on the write side -- it is what lets CI rotate a credential without being able to read the ones already there. What it left missing was any way to take a value OFF a box. A key dropped from a workflow stayed in secrets.env indefinitely: referenced by nothing, rotated by nothing, and still readable by every container that reads the file. One portfolio had twelve of them on three servers, including a PocketBase admin password for a PocketBase removed months earlier, and clearing them meant hand-editing secrets.env over SSH -- the unaccountable write the secret store exists to prevent.

AN OPERATOR COMMAND, not a deploy one. It runs as root over the same connection `komizo remove` uses, and installs nothing on the box: there is no unset-secret-<app> beside set-secret-<app> and no doas rule for one. A pipeline able to delete a secret is a pipeline able to take an app down by deleting the one it needs to start, and no workflow has ever needed to.

--yes for the same reason `komizo remove` needs it: alone among the secret commands, this destroys a value. Overwriting a secret with set-secret can be undone by setting it again from GitHub; deleting one that was only ever on the box cannot be undone at all, which is why the box keeps a dated 0600 copy beside the original.

func RunUpdate

func RunUpdate(args []string) error

func RunWorkloadAcceptance

func RunWorkloadAcceptance(args []string) error

func RunWorkspace

func RunWorkspace(args []string) error

Workspace operations inspect disk space or remove an exact reviewed set of caller-owned generated files. They never prune shared caches or evidence.

func Usage

func Usage()

func UsageAdd

func UsageAdd(fs *flag.FlagSet)

Types

type Session

type Session struct {
	// API is the service this credential belongs to, without a trailing slash.
	// Stored beside the token because they are issued together: a token from
	// one service against another is not a login, it is a confusing 401.
	API string `json:"api"`
	// Token authenticates this person to that service. Long-lived, revocable
	// from the app, and useless for reaching any box.
	Token string `json:"token"`
}

Session is what login left behind.