feat: publish Tend v0.2 preview source

Publish the reviewed allowlisted snapshot whose exact binary completed maintenance deployment, rollback, and reactivation exercises for Gamertan and Sandwich Hime.

Private-Source-Commit: 4d7094c8b7c61991bfb67b11fc1558724c874eb2

Private-Source-Tree: 54a2f74804f7acddf3755d7d4da5b97f5fc28381

AI-Assistance: OpenAI Codex assisted implementation, testing, security review, and release verification.
Signed-off-by: Cole Speelman <crspeelman@gmail.com>

internal/config/config.go

@@ -9,13 +9,17 @@ import (
 	"fmt"
 	"io"
 	"net/netip"
+	"net/url"
 	"os"
 	"path/filepath"
 	"regexp"
 	"strings"
 )
 
-const SchemaVersion = 1
+const (
+	SchemaVersion  = 2
+	SharedLockFile = "/run/lock/tend-deploy.lock"
+)
 
 var (
 	namePattern    = regexp.MustCompile(`^[a-z][a-z0-9-]{1,62}$`)
@@ -33,8 +37,9 @@ type Config struct {
 }
 
 type Service struct {
-	Name        string `json:"name"`
-	AllowedHost string `json:"allowed_host"`
+	Name            string `json:"name"`
+	AllowedHost     string `json:"allowed_host"`
+	EnvironmentFile string `json:"environment_file"`
 }
 
 type Build struct {
@@ -47,16 +52,17 @@ type Build struct {
 }
 
 type Deployment struct {
-	Strategy             string     `json:"strategy"`
-	Root                 string     `json:"root"`
-	LockFile             string     `json:"lock_file"`
-	StateFile            string     `json:"state_file"`
-	HealthPath           string     `json:"health_path"`
-	ReadinessPath        string     `json:"readiness_path"`
-	CandidateTimeoutSecs int        `json:"candidate_timeout_seconds"`
-	Smoke                []Smoke    `json:"smoke"`
-	BlueGreen            *BlueGreen `json:"blue_green,omitempty"`
-	Singleton            *Singleton `json:"singleton,omitempty"`
+	Strategy             string        `json:"strategy"`
+	Root                 string        `json:"root"`
+	LockFile             string        `json:"lock_file"`
+	StateFile            string        `json:"state_file"`
+	HealthPath           string        `json:"health_path"`
+	ReadinessPath        string        `json:"readiness_path"`
+	CandidateTimeoutSecs int           `json:"candidate_timeout_seconds"`
+	Smoke                []Smoke       `json:"smoke"`
+	PublicSmoke          []PublicSmoke `json:"public_smoke"`
+	BlueGreen            *BlueGreen    `json:"blue_green,omitempty"`
+	Singleton            *Singleton    `json:"singleton,omitempty"`
 }
 
 type Smoke struct {
@@ -64,6 +70,11 @@ type Smoke struct {
 	Contains string `json:"contains"`
 }
 
+type PublicSmoke struct {
+	URL      string `json:"url"`
+	Contains string `json:"contains"`
+}
+
 type BlueGreen struct {
 	CaddyConfig          string `json:"caddy_config"`
 	CaddyHandler         string `json:"caddy_handler"`
@@ -80,13 +91,12 @@ type Slot struct {
 }
 
 type Singleton struct {
-	Unit             string            `json:"unit"`
-	Address          string            `json:"address"`
-	CandidateAddress string            `json:"candidate_address"`
-	ListenEnv        string            `json:"listen_env"`
-	Environment      map[string]string `json:"environment,omitempty"`
-	CurrentLink      string            `json:"current_link"`
-	PreviousLink     string            `json:"previous_link"`
+	Unit             string `json:"unit"`
+	Address          string `json:"address"`
+	CandidateAddress string `json:"candidate_address"`
+	ListenEnv        string `json:"listen_env"`
+	CurrentLink      string `json:"current_link"`
+	PreviousLink     string `json:"previous_link"`
 }
 
 func Load(path string) (Config, error) {
@@ -140,6 +150,12 @@ func (c Config) Validate() error {
 	if c.Service.AllowedHost == "" || strings.ContainsAny(c.Service.AllowedHost, "/\\\x00\r\n\t ") {
 		return errors.New("service.allowed_host is invalid")
 	}
+	if err := safeAbsolute("service.environment_file", c.Service.EnvironmentFile); err != nil {
+		return err
+	}
+	if !within("/etc/tend/environment", c.Service.EnvironmentFile) {
+		return errors.New("service.environment_file must be below /etc/tend/environment")
+	}
 	if !packagePattern.MatchString(c.Build.Package) || strings.Contains(c.Build.Package, "..") {
 		return errors.New("build.package must be a local package without traversal")
 	}
@@ -185,6 +201,15 @@ func (c Config) Validate() error {
 			return fmt.Errorf("deployment.smoke[%d] is invalid", i)
 		}
 	}
+	if len(d.PublicSmoke) == 0 || len(d.PublicSmoke) > 16 {
+		return errors.New("deployment.public_smoke must contain 1 to 16 checks")
+	}
+	for i, smoke := range d.PublicSmoke {
+		parsed, err := url.Parse(smoke.URL)
+		if err != nil || parsed.Scheme != "https" || parsed.Host == "" || parsed.User != nil || parsed.Fragment != "" || parsed.RawQuery != "" || parsed.Opaque != "" || smoke.Contains == "" || len(smoke.Contains) > 4096 || strings.ContainsRune(smoke.Contains, '\x00') {
+			return fmt.Errorf("deployment.public_smoke[%d] is invalid", i)
+		}
+	}
 	switch d.Strategy {
 	case "blue_green":
 		if d.BlueGreen == nil || d.Singleton != nil {
@@ -273,11 +298,6 @@ func validateSingleton(root string, s Singleton) error {
 	if s.CurrentLink == s.PreviousLink {
 		return errors.New("current and previous links must differ")
 	}
-	for key, value := range s.Environment {
-		if !regexp.MustCompile(`^[A-Z][A-Z0-9_]{0,63}$`).MatchString(key) || strings.ContainsAny(value, "\x00\r\n") {
-			return fmt.Errorf("singleton environment entry %q is invalid", key)
-		}
-	}
 	return nil
 }
 

internal/config/config_test.go

@@ -9,13 +9,14 @@ import (
 
 func validConfig() Config {
 	return Config{
-		SchemaVersion: 1,
-		Service:       Service{Name: "example-site", AllowedHost: "example.test"},
+		SchemaVersion: 2,
+		Service:       Service{Name: "example-site", AllowedHost: "example.test", EnvironmentFile: "/etc/tend/environment/example-site.env"},
 		Build:         Build{Package: "./cmd/site", Binary: "example-site", Branch: "main"},
 		Deployment: Deployment{
-			Strategy: "blue_green", Root: "/opt/example-site", LockFile: "/run/lock/example-site.lock",
+			Strategy: "blue_green", Root: "/opt/example-site", LockFile: SharedLockFile,
 			StateFile: "/opt/example-site/state.json", HealthPath: "/healthz", ReadinessPath: "/readyz",
 			CandidateTimeoutSecs: 30, Smoke: []Smoke{{Path: "/", Contains: "Example"}},
+			PublicSmoke: []PublicSmoke{{URL: "https://example.test/", Contains: "Example"}},
 			BlueGreen: &BlueGreen{
 				CaddyConfig: "/etc/caddy/Caddyfile", CaddyHandler: "/etc/caddy/example.caddy",
 				CaddyHandlerTemplate: "/etc/example/caddy.template",
@@ -35,12 +36,15 @@ func TestValidateAcceptsBlueGreen(t *testing.T) {
 
 func TestValidateRejectsHostileValues(t *testing.T) {
 	tests := map[string]func(*Config){
-		"unknown strategy": func(c *Config) { c.Deployment.Strategy = "shell" },
-		"nonloopback":      func(c *Config) { c.Deployment.BlueGreen.Blue.Address = "203.0.113.7:80" },
-		"root path":        func(c *Config) { c.Deployment.Root = "/" },
-		"traversal":        func(c *Config) { c.Build.Package = "./cmd/../secret" },
-		"shared slot":      func(c *Config) { c.Deployment.BlueGreen.Green.Link = c.Deployment.BlueGreen.Blue.Link },
-		"bad smoke":        func(c *Config) { c.Deployment.Smoke[0].Path = "https://attacker.test/" },
+		"unknown strategy":    func(c *Config) { c.Deployment.Strategy = "shell" },
+		"nonloopback":         func(c *Config) { c.Deployment.BlueGreen.Blue.Address = "203.0.113.7:80" },
+		"root path":           func(c *Config) { c.Deployment.Root = "/" },
+		"traversal":           func(c *Config) { c.Build.Package = "./cmd/../secret" },
+		"shared slot":         func(c *Config) { c.Deployment.BlueGreen.Green.Link = c.Deployment.BlueGreen.Blue.Link },
+		"bad smoke":           func(c *Config) { c.Deployment.Smoke[0].Path = "https://attacker.test/" },
+		"bad public smoke":    func(c *Config) { c.Deployment.PublicSmoke[0].URL = "http://example.test/" },
+		"public secret query": func(c *Config) { c.Deployment.PublicSmoke[0].URL = "https://example.test/?token=secret" },
+		"environment sibling": func(c *Config) { c.Service.EnvironmentFile = "/etc/tend/environment-old/example.env" },
 	}
 	for name, mutate := range tests {
 		t.Run(name, func(t *testing.T) {