@@ -17,49 +17,111 @@ Pigsty `4.5.0`.
1717
1818## Native ` pig sty boot `
1919
20- - Bootstraps the controller end to end: repairs the Debian 12/13 locale when needed,
21- verifies Ansible and its Python dependencies, installs controller packages, repairs
22- localhost SSH on a best-effort basis, and can initialize a missing ` ~/pigsty ` tree.
23- - Supports online repositories, an explicit local package or HTTP(S) URL, a trusted
24- automatically discovered offline package, and an already prepared ` /www/pigsty `
25- repository.
26- - Backs up replaced repository definitions and restores them when package setup fails.
27- Explicit offline-input errors are hard failures, while optional final conveniences
28- are reported as warnings. JSON and YAML output expose the selected mode, repository
29- policy, rollback state, warnings, and recommended next commands.
20+ ` pig sty boot ` is now one native, failure-aware controller bootstrap transaction. It does not
21+ execute ` <PIGSTY_HOME>/bootstrap ` , and its HTTP download and archive extraction paths do not
22+ depend on ` curl ` , ` wget ` , ` tar ` , or ` gzip ` .
23+
24+ ### Privilege and readiness
25+
26+ - The command can be launched as an ordinary user. Pig resolves and downloads an explicit source
27+ before a single sudo re-exec; ` PIG_NO_SUDO=1 ` disables elevation and
28+ ` PIG_NON_INTERACTIVE=1 ` requests non-interactive sudo.
29+ - On Debian 12/13, locale preparation is attempted before and, when useful, after controller
30+ package installation.
31+ - Readiness is proven by executing ` ansible-playbook ` , discovering its Python interpreter, and
32+ checking ` yaml ` , ` jmespath ` , and either ` cryptography ` or ` OpenSSL ` . A present but unusable
33+ Ansible binary no longer produces a false success.
34+
35+ ### Repository sources and transactions
36+
37+ - Source selection covers a local archive, an HTTP(S) URL, a permission-checked automatic
38+ ` /tmp/pkg.tgz ` , an already committed ` /www/pigsty ` repository, and regional online
39+ repositories. A bad explicit source is a hard error and never silently becomes an online boot.
40+ - A completed ` /www/pigsty ` repository wins over a selected package. Pig can create the expected
41+ ` /www -> /data/nginx ` layout itself, uses restricted extraction for offline content, and enables
42+ only the strict ` pigsty-local ` repository in offline mode. Online setup installs the embedded
43+ Pigsty key and keeps repository signature checks enabled.
44+ - The default overwrite policy backs up repository definitions and restores them when repository
45+ or package setup fails. ` --keep ` selects an additive policy and can retry a failed online
46+ refresh against existing definitions.
47+ - The reported mode is explicit: ` ready ` , ` offline ` , ` online ` , or ` existing ` . An explicit,
48+ automatically discovered, or committed offline source is prepared even when Ansible is already
49+ usable.
50+
51+ ### Finishing checks and automation
52+
53+ - Pig probes controller helpers, repairs key-based SSH to ` 127.0.0.1 ` for the invoking admin user,
54+ and initializes a missing ` ~/pigsty ` from online or local content when possible.
55+ - Locale, helper, localhost-SSH, and Pigsty-tree finishing failures are warnings. Invalid explicit
56+ input, repository/package failures, unsupported installation paths, and unusable post-install
57+ Ansible remain hard failures.
58+ - JSON and YAML use the ` pig.sty.boot/v2 ` result contract, including the selected mode and package
59+ manager, repository policy and rollback state, source paths, locale, SSH and initialization
60+ status, changes, warnings, and the next ` conf ` , ` inventory ` , and ` deploy ` commands.
3061
3162## Native ` pig sty conf `
3263
33- - Generates Inventory from a safe template below ` <PIGSTY_HOME>/conf ` , supports both
34- ` pig sty conf MODE ` and ` --conf MODE ` , and can map up to ten ordered IPv4 addresses
35- plus the exact ` i.pigsty ` placeholder domain.
36- - Adds deterministic interactive and non-interactive IP selection, structural proxy,
37- region, PostgreSQL-version, and secret-generation mutations, followed by complete
38- Inventory validation.
39- - Refuses source/output aliasing through direct paths, symlinks, symlinked parents, or
40- hard links. A validated result is written atomically with mode ` 0600 ` ; structured
41- output reports generated secret identifiers but never their values.
64+ ` pig sty conf ` is now a complete native Inventory compiler. It does not execute ` ./configure ` or
65+ fall back to raw Shell behavior: Pig resolves one template, performs bounded structural changes,
66+ validates the full candidate, and only then commits the output.
67+
68+ ### Safe configuration pipeline
69+
70+ - The default template is ` conf/meta.yml ` ; a safe slash-separated relative mode may be supplied
71+ positionally or with ` --conf ` . Absolute paths, traversal, path escape, and source/output
72+ aliasing through direct paths, symlinks, symlinked parents, or hard links are rejected.
73+ - Source parsing and IP-collision checks happen before external preflight. Parse, mutation,
74+ preflight, or validation failure leaves the destination unchanged.
75+ - Pig performs native Inventory validation and, when available, a bounded ` ansible-inventory `
76+ parse. Successful output is atomically written with mode ` 0600 ` .
77+
78+ ### Structural Inventory changes
79+
80+ - Up to ten distinct ` --ip ` values map simultaneously to slots ` 10.10.10.10 ` through
81+ ` 10.10.10.19 ` ; unrelated VIPs remain intact. Without ` --ip ` , interface selection is explicit
82+ and deterministic in interactive, non-interactive, and closed-input execution.
83+ - ` --domain ` replaces only the exact ` i.pigsty ` token. Controllers with fewer than four CPUs are
84+ automatically switched from the ` oltp ` node and PostgreSQL tuning profiles to ` tiny ` .
85+ - Region changes update ` all.vars.region ` ; ` china ` activates Docker and pip mirrors already
86+ supplied by the template. ` --proxy ` materializes available proxy environment variables under
87+ ` all.vars.proxy_env ` .
88+ - Generic templates support PostgreSQL 14-18 and explicit 19 beta, including matching locale and
89+ beta repository selection. Version-pinned ` mssql ` , ` polar ` , and ` pgNN ` modes keep their
90+ effective template version and emit a warning.
91+ - ` --generate ` assigns one random 24-character value to each known credential identifier and
92+ updates active values and documented placeholders consistently. Result output lists generated
93+ identifiers but never secret values.
94+
95+ ### Preflight and result contract
96+
97+ - Unless ` --skip ` is selected, preflight covers the platform, package manager, controller
98+ resources, sudo/admin access, localhost SSH, and Ansible availability. Build templates under
99+ ` conf/build/ ` intentionally bypass IP mapping and admin preflight.
100+ - JSON and YAML use ` pig.sty.configure/v1 ` and report the template and output, selected and
101+ discarded addresses, requested and effective PostgreSQL versions, applied options, generated
102+ secret identifiers, and warnings.
42103
43104## Other Updates
44105
45- - EL8 and newer package operations consistently prefer DNF, local RPM requirements are
46- resolved by provider capability, fresh repository bootstraps restore the expected
47- ` /www -> /data/nginx ` layout, and self-update tolerates whitespace in the latest marker.
48- - The extension catalog, package versions, metadata, and availability matrices receive
49- their routine refresh while the published PostgreSQL-extension count remains ** 575** .
106+ - EL8 and newer package operations consistently prefer DNF, local RPM requirements are resolved
107+ by provider capability, fresh repository bootstraps restore the expected ` /www ` layout, and
108+ self-update tolerates whitespace in the latest marker.
109+ - The extension catalog, package versions, metadata, and availability matrices receive their
110+ routine refresh while the published PostgreSQL-extension count remains ** 575** .
50111- CI and release builds use Go ` 1.26.6 ` , pinned analysis tools and GoReleaser, dependency
51112 verification, workflow linting, vulnerability scanning, and a full release snapshot.
52113
53114## Compatibility Notes
54115
55116- ` pig sty boot ` no longer executes ` <PIGSTY_HOME>/bootstrap ` . Automation that relied on
56- shell-script side effects should consume the native command result instead .
117+ shell-script side effects should consume the native command and its structured result .
57118- ` pig sty conf --raw ` has been removed. Use the native workflow; ` --conf MODE ` remains
58119 available, with ` pig sty conf MODE ` as the equivalent positional form.
59- - ` pig sty conf --ip ` accepts up to ten comma-separated IPv4 addresses; ` --skip ` and
60- ` --ip ` remain mutually exclusive.
61- - EL8 and newer use DNF. The limited EL7 compatibility catalog retains its separate
62- legacy YUM path.
120+ - ` pig sty conf --ip ` accepts up to ten comma-separated IPv4 addresses; ` --skip ` and ` --ip `
121+ remain mutually exclusive. Uppercase ` -O ` chooses the Inventory file, while global lowercase
122+ ` -o ` chooses the command output format.
123+ - EL8 and newer use DNF. The limited EL7 compatibility catalog retains its separate legacy
124+ YUM path.
63125
64126## Checksums
65127
0 commit comments