set -euo pipefail

ROOT=$(cd "$(dirname "$0")/.." && pwd)

source "$ROOT/scripts/product.sh"

PROJECT=$PRODUCT

UNSEAL_VOLUME=${PROJECT}-openbao-local-unseal

HELPER_IMAGE=docker.io/library/alpine:3.24.2@sha256:d56c381f961d307a21b3ca004cf1e3910f106644aefb1f43e654c8a56c4fd395

NODE_IMAGE=docker.io/library/node:26.10.0-alpine@sha256:b341ca66519d9a1c25d4e41f254ffb6fe403fc0f9054c62b863f0660dcc1c199

OPENBAO_DIR=$ROOT/containers/openbao

YQ=docker.io/mikefarah/yq:4.54.1@sha256:2d6a23c682c574ae49320fdf2419441b6f10658588d44b6d8739d673b96903e5

PROFILES=(--profile local)

compose() { (cd "$ROOT" && podman-compose "${PROFILES[@]}" "$@"); }

if APP_COMMIT=$(git -C "$ROOT" rev-parse --short=12 HEAD 2>/dev/null); then

APP_COMMIT_TIME=$(git -C "$ROOT" log -1 --format=%cI)

if [[ -n $(git -C "$ROOT" status --porcelain --untracked-files=no) ]]; then APP_DIRTY=true; else APP_DIRTY=false; fi

export APP_COMMIT APP_COMMIT_TIME APP_DIRTY

APK_UPGRADE=$(date -u +%F)

export APK_UPGRADE

log() { printf '\033[1mstack:\033[0m %s %s\n' "$(date +%T)" "$*" >&2; }

die() { log "$*"; exit 1; }

agents() {

local f

for f in "$OPENBAO_DIR"/agents/*.hcl; do basename "$f" .hcl; done

}

AGENTS=$(agents | tr '\n' ' ')

source "$ROOT/scripts/openbao-lib.sh"

TEST_AGENTS=" test "

stack_agents() {

local svc

for svc in $(agents); do [[ $TEST_AGENTS == *" $svc "* ]] || echo "$svc"; done

}

app_services() {

compose config --services 2>/dev/null | grep -vxE 'certs|openbao|.*-agent'

}

remove_containers() { # <service>...

}

unseal_store() { # <file> ; content on stdin

}

unseal_read() { # <file>

}

init_or_unseal() {

}

generate_root() {

}

ensure_admin_token() {

}

wait_for_rendered() { # [<service>...]

}

ensure_sp_keypair() { # <service> <common name>

}

pem_body() { sed '/-----/d' | tr -d '\n'; }

e2e_actions() {

}

wait_healthy() { # <service> <seconds>

}

realm_json() {

sed -e "s/\${PRODUCT}/$PRODUCT/g" -e "s/\${PRODUCT_HTTPS_PORT}/$PRODUCT_HTTPS_PORT/g" \

"$ROOT/containers/idp/realm-feathers.json"

}

IDP_CERT_CHANGED=

configure_local_idp() {

}

wait_for_idp_cert() {

}

idp_setup() {

}

BREAKGLASS_EMAIL=breakglass@app.$LOCAL_DOMAIN

APP_ORIGIN=$(local_origin app)

ensure_breakglass() {

}

alert_setup() {

}

grafana_get() {

podman exec "$(ctr grafana)" sh -c 'printf "user = \"admin:%s\"\n" "$(cat /run/secrets/admin_password)" |

curl -sf -K - --cacert /trust/ca.crt --connect-to grafana:3000:127.0.0.1:3000 "https://grafana:3000$1"' sh "$1"

}

alert_mails() {

}

wait_alert_quiet() {

}

wait_alert_mail() {

}

errors_alert_check() {

}

breakglass_alert_check() {

}

seed_test_accounts() { # <database>

}

E2E_DATABASE=app_e2e

E2E_BREAKGLASS_EMAIL=breakglass@e2e.$LOCAL_DOMAIN

start_e2e_api() {

}

setup() {

}

fingerprint() { # <path>...

(cd "$ROOT" && find "$@" -type f -print0 | sort -z | xargs -0 sha256sum | sha256sum | cut -d' ' -f1)

}

TEST_AGENT_SOURCES=(compose.yaml containers/openbao scripts/openbao-lib.sh)

TEST_TEMPLATE_SOURCES=(apps/api/src/migrate.ts apps/api/src/migration-support.ts

apps/api/src/migrations apps/api/src/settings apps/api/src/mail)

ensure_test_agent() {

}

ensure_test_template() {

}

MCP_ID=0

MCP_REPLY=

mcp_start() { # <command>...

coproc MCP { "$@" 2>/dev/null; }

MCP_ID=0

mcp_request initialize '{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"stack.sh","version":"1"}}'

printf '%s\n' '{"jsonrpc":"2.0","method":"notifications/initialized"}' >&"${MCP[1]}"

}

mcp_request() { # <method> <params JSON>

}

mcp_tool() { # <tool> <arguments JSON>; fails when the tool reports an error

mcp_request tools/call "$(jq -cn --arg name "$1" --argjson arguments "$2" '{$name, $arguments}')"

[[ $(jq -r '.result.isError // false' <<<"$MCP_REPLY") == false ]]

}

mcp_stop() {

exec {MCP[1]}>&-

wait "$MCP_PID" 2>/dev/null || true

}

mcp_check() {

}

stack_down() {

podman stop "$(ctr alloy)" >/dev/null 2>&1 || true

compose --profile test --profile dev down

}

cmd=${1:-}

case $cmd in

up)

case ${2:-} in

--dev)

PROFILES+=(--profile dev)

export NGINX_WEB_UPSTREAM=web:5173

;;

"")

# Leaving dev mode: nginx serves the bundle again.

podman rm -f "$(ctr web)" >/dev/null 2>&1 || true

;;

*) die "usage: $0 up [--dev]" ;;

esac

command -v jq >/dev/null || die "jq is required"

# Dozzle reads container output through the rootless Podman API (ADR 0002).

[[ -S ${XDG_RUNTIME_DIR:-}/podman/podman.sock ]] ||

die "the Podman API socket is missing; run: systemctl --user enable --now podman.socket"

log "building images"

compose build

# podman-compose neither reruns a completed one-shot nor recreates a

# container whose image was rebuilt, so every container `up` manages is

# removed here and each service created anew below, exactly once. Not

# with --force-recreate: podman-compose then also recreates every

# service that depends on the one named, stopping them a batch at a

# time, each batch waiting out the stop timeout of a container that

# ignores its signal; an `up` recreated most services up to three times

# and spent minutes stopping them (measured 2026-10-06). Removing all of

# them up front stops each once, a dependency layer at a time. OpenBao is

# among them, and starts sealed, as it did when the certificates'

# dependents were recreated.

log "removing the previous containers"

# shellcheck disable=SC2046

remove_containers certs openbao $(stack_agents | sed 's/$/-agent/') $(app_services)

log "issuing certificates"

compose up -d --no-deps certs >/dev/null 2>&1

podman wait "$(ctr certs)" >/dev/null

[[ $(podman inspect -f '{{.State.ExitCode}}' "$(ctr certs)") == 0 ]] || die "certs failed; see: podman logs $(ctr certs)"

log "starting OpenBao and agents"

compose up -d --no-deps openbao >/dev/null 2>&1

# Agents read their configuration only at start, so they are recreated;

# setup issues fresh secret_ids anyway. (`podman restart` refuses: the

# dependency chain ends at the exited one-shot `certs`.)

# shellcheck disable=SC2046

compose up -d --no-deps $(stack_agents | sed 's/$/-agent/') >/dev/null 2>&1

setup

# The uptime check's target (ADR 0022): deployment configuration, here

# the local app's origin.

printf '%s\n' "# Written by scripts/stack.sh from product.env (ADR 0022, 0035)." \

"- targets: ['$APP_ORIGIN/api/ping']" >"$ROOT/containers/prometheus/targets/uptime.yml"

log "starting the stack"

# shellcheck disable=SC2046

compose up -d --no-deps $(app_services | grep -vxE 'migrate|api|worker|backup|netbox|netbox-worker|netbox-setup') >/dev/null 2>&1

# --no-deps drops depends_on conditions, so migrate waits here explicitly.

wait_healthy postgres 120

log "migrating the database"

compose up -d --no-deps migrate >/dev/null 2>&1

podman wait "$(ctr migrate)" >/dev/null

[[ $(podman inspect -f '{{.State.ExitCode}}' "$(ctr migrate)") == 0 ]] || die "migrate failed; see: podman logs $(ctr migrate)"

# The api and the worker refuse to start without their runtime settings

# (ADR 0025), which migrate has just seeded. On a first start the api

# also lacks the IdP's certificate until idp_setup below, which restarts

# it and waits for it, so only the worker is waited for here.

log "starting api, worker and backup"

compose up -d --no-deps api worker backup >/dev/null 2>&1

wait_healthy worker 60

# NetBox's migrations and seed (ADR 0031), then NetBox itself.

log "migrating and seeding NetBox"

compose up -d --no-deps netbox-setup >/dev/null 2>&1

podman wait "$(ctr netbox-setup)" >/dev/null

[[ $(podman inspect -f '{{.State.ExitCode}}' "$(ctr netbox-setup)") == 0 ]] || die "netbox-setup failed; see: podman logs $(ctr netbox-setup)"

log "starting NetBox"

compose up -d --no-deps netbox netbox-worker >/dev/null 2>&1

wait_healthy netbox 180

# The local target is ours to initialise (ADR 0017); a run never does.

podman exec -u backup "$(ctr backup)" node dist/backup.js init >/dev/null ||

die "initialising the backup target failed; see: podman logs $(ctr backup)"

log "configuring the local IdP"

idp_setup

ensure_breakglass

seed_test_accounts app

log "test accounts have their roles: ad01admn admin, op01oper operator, us01user and us02othr user"

# A leak report does not fail `up`; scripts/ci.sh fails on it.

"$ROOT/scripts/prune.sh" || true

;;

setup) setup ;;

idp) idp_setup ;;

ca)

podman run --rm --network none -v "${PROJECT}_trust:/t:ro" "$HELPER_IMAGE" cat /t/ca.crt

;;

test)

shift

log "building the api and test images"

compose --profile test build api test

ensure_test_agent

ensure_test_template

log "running Vitest"

compose --profile test run --rm -T test pnpm exec vitest run "$@"

;;

e2e)

shift

# The suite exercises the built bundle (ADR 0014); under --dev nginx

# proxies every origin, the e2e one included, to the Vite dev server.

[[ -z $(podman inspect -f '{{range .Config.Env}}{{println .}}{{end}}' "$(ctr nginx)" 2>/dev/null |

sed -n 's/^NGINX_WEB_UPSTREAM=//p') ]] ||

die "nginx serves the Vite dev server; run '$0 up' (without --dev) first"

log "building the e2e image"

compose --profile test build e2e

# api-e2e, worker-e2e, their database and their buckets' contents

# exist for the run only: the buckets are emptied before the run and

# after it.

trap 'podman exec "$(ctr api-e2e)" node dist/empty-bucket.js >/dev/null 2>&1 || true; podman rm -f "$(ctr api-e2e)" "$(ctr worker-e2e)" >/dev/null 2>&1 || true' EXIT

start_e2e_api

podman exec "$(ctr api-e2e)" node dist/empty-bucket.js >/dev/null || die "could not empty the e2e buckets"

log "running Playwright"

compose --profile test run --rm -T e2e pnpm exec playwright test "$@" 2>&1 | e2e_actions

;;

breakglass)

# The local app's break-glass login, for trying /break-glass by hand.

wait_for_openbao

init_or_unseal

password=$(kv_get stack breakglass_password)

bao token revoke -self >/dev/null

TOKEN=

[[ -n $password ]] || die "no local break-glass password; run '$0 up'"

printf '%s\n%s\n' "$BREAKGLASS_EMAIL" "$password"

;;

alerts)

# The two rules form separate alert groups, so both checks run at once.

alert_setup

log "logging errors in the worker and in with the break-glass account, then waiting for both alert mails"

errors_alert_check & errors=$!

breakglass_alert_check & breakglass=$!

failed=

wait "$errors" || failed=1

wait "$breakglass" || failed=1

[[ -z $failed ]] || die "an alert check failed; see above"

;;

mcp) mcp_check ;;

prune) "$ROOT/scripts/prune.sh" ;;

down) stack_down ;;

reset)

case ${2:-} in

"") keep=" ${PROJECT}_certs-ca " ;;

--ca) keep=" " ;;

# The local app's data survives: its database (with the test

# databases, which are rebuilt anyway) and the OpenBao values and

# unseal key its roles' passwords depend on. Everything else starts

# from nothing, as on a fresh runner. `scripts/ci.sh --cold` uses this.

# The objects go with the database that references them (ADR 0020).

--keep-data) keep=" ${PROJECT}_certs-ca ${PROJECT}_postgres-data ${PROJECT}_s3-data ${PROJECT}_openbao-data $UNSEAL_VOLUME " ;;

*) die "usage: $0 reset [--ca|--keep-data]" ;;

esac

stack_down

for volume in $(podman volume ls -q --filter "label=io.podman.compose.project=$PROJECT") $UNSEAL_VOLUME; do

[[ $keep == *" $volume "* ]] || podman volume rm -f "$volume" >/dev/null 2>&1 || true

done

case ${2:-} in

"") log "kept the local root CA; '$0 reset --ca' deletes it" ;;

--keep-data) log "kept the local root CA, the app's database, its objects and OpenBao; '$0 reset' deletes them" ;;

esac

;;

*) sed -n '2,49p' "$0"; exit 2 ;;