Generalize host resolver discovery and self-update operator scripts #8

Merged

MHE merged 2 commits from improve-traefik-config into main

2026-10-31 17:05:13 +01:00

MHE commented

2026-10-31 17:03:39 +01:00

Owner

Summary

This PR replaces the single-key host DNS resolver setting with a list-based x-host-resolvers key, lets deployed run.sh and get-folder.sh update themselves from the repository, and makes run.sh report newer app compose and env files.

Changes

x-host-resolvers replaces x-host-dns-resolvers and x-host-gateway-url. It is a list of UPPERCASE env keys filled from one host resolver discovery. host or an empty value becomes the ip:53 list. http://host:port and https://host:port keep scheme and port and use the first resolver address (IPv6 bracketed). Concrete values are left unchanged.
Traefik lists DNSCHALLENGE_RESOLVERS and CROWDSEC_AGENT_LAPI_URL under x-host-resolvers. The default LAPI URL is now http://host:8080 instead of a CHANGE_ME placeholder. CERTRESOLVER defaults to desec, and the Authentik example host is shortened to auth.example.com.
Self-update for deployed scripts. Outside a git work tree, get-folder.sh and run.sh compare their installed blob and the branch-tip commit time against stamps in script-revs/. A newer tip with changed content replaces the file and re-executes the same command. Locally edited scripts are left in place; --force still replaces run.sh. Git work trees and local templates/ directories remain the source and are never replaced.
App file drift reporting. A deployed run.sh <AppDir> reports newer app compose and env files. --force backs them up to .run.conf/.backups/ (timestamps now include nanoseconds) and replaces them.
Sparse checkout also includes the app directory so its compose and env files can be compared.
Docs and rules (.openso/rules, .openso/memory, READMEs, .pi/skills/run-test) describe the new behaviour.

Why

One x-host-resolvers list avoids a separate key per resolver use case and lets the CrowdSec LAPI URL reuse the same discovery.
Deployed operator scripts previously went stale silently; self-update keeps them current without overwriting local edits.
Surfacing newer app compose and env files avoids running outdated configuration unknowingly.

Reviewer notes

Apps using x-host-dns-resolvers or x-host-gateway-url must migrate to x-host-resolvers.
--dry-run skips clone-based checks (script self-update and app file comparison).
Self-update uses exec to re-run the updated script; the lock is released before re-exec.

## Summary This PR replaces the single-key host DNS resolver setting with a list-based `x-host-resolvers` key, lets deployed `run.sh` and `get-folder.sh` update themselves from the repository, and makes `run.sh` report newer app compose and env files. ## Changes - **`x-host-resolvers` replaces `x-host-dns-resolvers` and `x-host-gateway-url`.** It is a list of UPPERCASE env keys filled from one host resolver discovery. `host` or an empty value becomes the `ip:53` list. `http://host:port` and `https://host:port` keep scheme and port and use the first resolver address (IPv6 bracketed). Concrete values are left unchanged. - **Traefik** lists `DNSCHALLENGE_RESOLVERS` and `CROWDSEC_AGENT_LAPI_URL` under `x-host-resolvers`. The default LAPI URL is now `http://host:8080` instead of a `CHANGE_ME` placeholder. `CERTRESOLVER` defaults to `desec`, and the Authentik example host is shortened to `auth.example.com`. - **Self-update for deployed scripts.** Outside a git work tree, `get-folder.sh` and `run.sh` compare their installed blob and the branch-tip commit time against stamps in `script-revs/`. A newer tip with changed content replaces the file and re-executes the same command. Locally edited scripts are left in place; `--force` still replaces `run.sh`. Git work trees and local `templates/` directories remain the source and are never replaced. - **App file drift reporting.** A deployed `run.sh <AppDir>` reports newer app compose and env files. `--force` backs them up to `.run.conf/.backups/` (timestamps now include nanoseconds) and replaces them. - **Sparse checkout** also includes the app directory so its compose and env files can be compared. - **Docs and rules** (`.openso/rules`, `.openso/memory`, READMEs, `.pi/skills/run-test`) describe the new behaviour. ## Why - One `x-host-resolvers` list avoids a separate key per resolver use case and lets the CrowdSec LAPI URL reuse the same discovery. - Deployed operator scripts previously went stale silently; self-update keeps them current without overwriting local edits. - Surfacing newer app compose and env files avoids running outdated configuration unknowingly. ## Reviewer notes - Apps using `x-host-dns-resolvers` or `x-host-gateway-url` must migrate to `x-host-resolvers`. - `--dry-run` skips clone-based checks (script self-update and app file comparison). - Self-update uses `exec` to re-run the updated script; the lock is released before re-exec.

MHE added 2 commits

2026-10-31 17:03:39 +01:00

Generalize host resolver discovery to x-host-resolvers list 1ac52070d7

Self-update get-folder.sh and run.sh from repository tip

ci / compose (pull_request) Successful in 13s

Details

ci / shellcheck (pull_request) Successful in 7s

Details

ci / conventions (pull_request) Successful in 2s

Details

ci / image (pull_request) Successful in 1s

Details