render_staging.py

#!/usr/bin/env python3
"""Render staging artifacts from registry/repos.yaml.

ADR-210 — Single source of truth: platform/registry/repos.yaml.
All generated files start with a "DO NOT EDIT" header.

Usage:
    python scripts/render_staging.py <repo-name>            # render to stdout-summary
    python scripts/render_staging.py <repo-name> --write    # write files
    python scripts/render_staging.py --verify <repo-name>   # exit 1 on drift

Outputs (relative to repo root):
    docker-compose.staging.yml
    .env.staging.example
    deploy/staging/nginx-vhost.conf       (for staging-platform)

Pre-commit + R7-check call this with --verify.
"""
from __future__ import annotations

import argparse
import difflib
import sys
from pathlib import Path

import yaml

PLATFORM_ROOT = Path(__file__).resolve().parents[1]
REGISTRY_PATH = PLATFORM_ROOT / "registry" / "repos.yaml"
GITHUB_ROOT = PLATFORM_ROOT.parent  # ~/github
HEADER = (
    "# GENERATED by platform/scripts/render_staging.py — DO NOT EDIT\n"
    "# SSoT: platform/registry/repos.yaml\n"
    "# Re-render: make render-staging REPO={repo}\n"
    "# ADR-210 — Local/Staging/Prod Architecture\n"
    "# Repo-specific extras → docker-compose.staging.override.yml (NOT generated)\n"
)
STAGING_PORT_MIN = 19000
STAGING_PORT_MAX = 19999


def load_registry() -> dict:
    with REGISTRY_PATH.open() as f:
        return yaml.safe_load(f)


def find_repo(registry: dict, repo_name: str) -> dict | None:
    for domain in registry.get("domains", []):
        for system in domain.get("systems", []):
            if system.get("name") == repo_name or system.get("repo") == repo_name:
                return system
    return None


def assert_port_range(repo: dict, repo_name: str) -> None:
    """R4: staging port ∈ [19000..19999], dedicated range, collision-free."""
    staging_port = repo.get("staging", {}).get("port")
    if staging_port is None:
        raise ValueError(f"{repo_name}: missing staging.port")
    if not (STAGING_PORT_MIN <= staging_port <= STAGING_PORT_MAX):
        raise ValueError(
            f"{repo_name}: R4 violation — staging.port={staging_port} "
            f"not in [{STAGING_PORT_MIN}..{STAGING_PORT_MAX}]"
        )


def render_compose(repo_name: str, repo: dict) -> str:
    s = repo["staging"]
    underscore = repo_name.replace("-", "_")
    db_name = f"{underscore}_staging"
    yml = f"""{HEADER.format(repo=repo_name)}
services:
  {repo_name}-staging-db:
    image: postgres:16-alpine
    container_name: {underscore}_staging_db
    restart: unless-stopped
    env_file: .env.staging
    volumes:
      - {underscore}_staging_pgdata:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U {underscore} -d {db_name}"]
      interval: 5s
      timeout: 3s
      retries: 30
    networks: [{underscore}_staging_network]

  {repo_name}-staging-redis:
    image: redis:7-alpine
    container_name: {underscore}_staging_redis
    restart: unless-stopped
    command: ["redis-server", "--maxmemory", "48mb", "--maxmemory-policy", "allkeys-lru", "--save", "", "--appendonly", "no"]
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 5s
      timeout: 3s
      retries: 30
    networks: [{underscore}_staging_network]

  {repo_name}-staging-web:
    image: {s['image']}
    container_name: {s['web_container']}
    restart: unless-stopped
    env_file: .env.staging
    depends_on:
      {repo_name}-staging-db: {{condition: service_healthy}}
      {repo_name}-staging-redis: {{condition: service_healthy}}
    ports:
      - "127.0.0.1:{s['port']}:8000"
    healthcheck:
      test: ["CMD-SHELL", "python -c \\"import urllib.request; urllib.request.urlopen('http://127.0.0.1:8000/livez/')\\""]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 60s
    networks: [{underscore}_staging_network]

  {repo_name}-staging-worker:
    image: {s['image']}
    container_name: {underscore}_staging_worker
    restart: unless-stopped
    env_file: .env.staging
    depends_on:
      {repo_name}-staging-db: {{condition: service_healthy}}
      {repo_name}-staging-redis: {{condition: service_healthy}}
    command: ["celery", "-A", "config", "worker", "-l", "info"]
    networks: [{underscore}_staging_network]

volumes:
  {underscore}_staging_pgdata:

networks:
  {underscore}_staging_network:
    driver: bridge
"""
    return yml


def render_env_template(repo_name: str, repo: dict) -> str:
    s = repo["staging"]
    o = repo.get("oidc", {})
    primary_host = s["hostnames"][0]
    underscore = repo_name.replace("-", "_")
    return f"""{HEADER.format(repo=repo_name)}
# --- Django ---
DJANGO_SETTINGS_MODULE={s.get('django_settings_module', 'config.settings')}
DEBUG=False
SECRET_KEY=__REPLACE_ME__
ALLOWED_HOSTS={','.join(s['hostnames'])}
CSRF_TRUSTED_ORIGINS={','.join(f'https://{h}' for h in s['hostnames'])}

# --- Database (covers both DATABASE_URL-style and DB_*-style consumers) ---
POSTGRES_DB={underscore}_staging
POSTGRES_USER={underscore}
POSTGRES_PASSWORD=__REPLACE_ME__
DATABASE_URL=postgres://{underscore}:__REPLACE_ME__@{repo_name}-staging-db:5432/{underscore}_staging
DB_HOST={repo_name}-staging-db
DB_PORT=5432
DB_NAME={underscore}_staging
DB_USER={underscore}
DB_PASSWORD=__REPLACE_ME__

# --- Redis / Celery ---
REDIS_URL=redis://{repo_name}-staging-redis:6379/0
CELERY_BROKER_URL=redis://{repo_name}-staging-redis:6379/1
CELERY_RESULT_BACKEND=redis://{repo_name}-staging-redis:6379/2

# --- Authentik OIDC (ADR-142, ADR-210) ---
OIDC_ENABLED=True
OIDC_RP_CLIENT_ID=__FROM_AUTHENTIK__
OIDC_RP_CLIENT_SECRET=__FROM_AUTHENTIK__
OIDC_APP_SLUG={o.get('staging_app_slug', f'{repo_name}-staging')}

# --- App ---
PUBLIC_URL=https://{primary_host}
"""


def render_nginx_vhost(repo_name: str, repo: dict) -> str:
    s = repo["staging"]
    primary = s["hostnames"][0]   # cert path follows actual primary hostname (R1)
    server_names = " ".join(s["hostnames"])
    return f"""{HEADER.format(repo=repo_name)}
# Hostnames: {', '.join(s['hostnames'])}

server {{
    listen 80;
    listen [::]:80;
    server_name {server_names};
    return 301 https://$host$request_uri;
}}

server {{
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name {server_names};

    # TLS: single *.iil.pet wildcard cert (acme.sh + Cloudflare DNS-01)
    # Renewal: ~/.acme.sh/acme.sh auto-cron on staging-platform
    ssl_certificate     /etc/letsencrypt/wildcard.iil.pet/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/wildcard.iil.pet/privkey.pem;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers off;

    client_max_body_size 50M;

    location / {{
        proxy_pass         http://127.0.0.1:{s['port']};
        proxy_set_header   Host              $host;
        proxy_set_header   X-Real-IP         $remote_addr;
        proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Proto $scheme;
        proxy_redirect     off;
    }}

    location = /livez/ {{
        proxy_pass http://127.0.0.1:{s['port']}/livez/;
        access_log off;
    }}
}}
"""


ARTIFACTS = {
    "docker-compose.staging.yml": render_compose,
    ".env.staging.example": render_env_template,
    "deploy/staging/nginx-vhost.conf": render_nginx_vhost,
}


def render_all(repo_name: str, repo: dict) -> dict[Path, str]:
    repo_root = GITHUB_ROOT / repo_name
    return {
        repo_root / rel: fn(repo_name, repo)
        for rel, fn in ARTIFACTS.items()
    }


def cmd_render(repo_name: str, write: bool) -> int:
    registry = load_registry()
    repo = find_repo(registry, repo_name)
    if repo is None:
        print(f"ERROR: repo '{repo_name}' not found in registry", file=sys.stderr)
        return 2
    if "staging" not in repo:
        print(f"ERROR: repo '{repo_name}' has no staging block in registry", file=sys.stderr)
        return 2
    assert_port_range(repo, repo_name)
    artifacts = render_all(repo_name, repo)
    for path, content in artifacts.items():
        if write:
            path.parent.mkdir(parents=True, exist_ok=True)
            path.write_text(content)
            print(f"WROTE  {path}")
        else:
            print(f"WOULD WRITE  {path} ({len(content)} bytes)")
    if not write:
        print("\n(dry-run — pass --write to actually write files)")
    return 0


def cmd_verify(repo_name: str) -> int:
    """R7: existing files must be byte-identical to renderer output."""
    registry = load_registry()
    repo = find_repo(registry, repo_name)
    if repo is None or "staging" not in repo:
        return 0  # no staging block → no drift possible
    assert_port_range(repo, repo_name)
    drift = False
    for path, content in render_all(repo_name, repo).items():
        if not path.exists():
            print(f"DRIFT  {path}: missing (run --write)")
            drift = True
            continue
        actual = path.read_text()
        if actual != content:
            drift = True
            print(f"DRIFT  {path}:")
            for line in difflib.unified_diff(
                actual.splitlines(),
                content.splitlines(),
                fromfile="on-disk",
                tofile="rendered",
                lineterm="",
            ):
                print(f"  {line}")
    return 1 if drift else 0


def main() -> int:
    parser = argparse.ArgumentParser(description=__doc__)
    parser.add_argument("repo", help="repo name as in registry/repos.yaml")
    parser.add_argument("--write", action="store_true", help="write files (default: dry-run)")
    parser.add_argument("--verify", action="store_true", help="exit 1 on drift")
    args = parser.parse_args()
    if args.verify:
        return cmd_verify(args.repo)
    return cmd_render(args.repo, args.write)


if __name__ == "__main__":
    sys.exit(main())