Pass --chaos status to abra.sh --local commands #571

New Issue

3wordchant · 2025-06-07T14:00:03Z

3wordchant commented

2025-06-07 14:00:03 +00:00

For e.g. the commands in Mastodon's abra.sh for generating secrets, invocations of abra fail during a --chaos run, even with the flags seemingly in the right place:

➜ abra app cmd --chaos  --local mastodon.EXAMPLE.COM secrets && abra app cmd --chaos --local mastodon.EXAMPLE.COM secrets_activerecord 
Generating secrets for a new Mastodon deployment...

FATA mastodon (/home/USER/.abra/recipes/mastodon) has locally unstaged changes?
FATA exit status 1

An alternative could be to unconditionally pass --chaos in invocations of abra in abra.sh scripts, which might be less work¹, but would be slightly inconsistent with abra's "bail on any forbidden-chaos state" behaviour.

Setting e.g. an ABRA_IS_CHAOS environment variable when loading the local abra.sh file would allow shell functions to conditionally insert --chaos depending on whether it was specified on the abra app cmd --local command-line.

¹12 recipes seem to have abra.sh scripts which call abra:

rg -g '**/abra.sh' 'abra app' -l | wc -l
gotosocial/abra.sh
nextcloud/abra.sh
matrix-synapse/abra.sh
mastodon/abra.sh
outline/abra.sh
xwiki/abra.sh
authentik/abra.sh
funkwhale/abra.sh
zammad/abra.sh
peertube/abra.sh
vaultwarden/abra.sh
hometown/abra.sh

For e.g. the [commands in Mastodon's `abra.sh` for generating secrets](https://git.coopcloud.tech/coop-cloud/mastodon/src/branch/main/abra.sh#L74-L154), invocations of `abra` fail during a `--chaos` run, even with the flags seemingly in the right place: ``` ➜ abra app cmd --chaos --local mastodon.EXAMPLE.COM secrets && abra app cmd --chaos --local mastodon.EXAMPLE.COM secrets_activerecord Generating secrets for a new Mastodon deployment... FATA mastodon (/home/USER/.abra/recipes/mastodon) has locally unstaged changes? FATA exit status 1 ``` An alternative could be to unconditionally pass `--chaos` in invocations of `abra` in `abra.sh` scripts, which might be less work¹, but would be slightly inconsistent with `abra`'s "bail on any forbidden-chaos state" behaviour. Setting e.g. an `ABRA_IS_CHAOS` environment variable when loading the local `abra.sh` file would allow shell functions to conditionally insert `--chaos` depending on whether it was specified on the `abra app cmd --local` command-line. ¹12 recipes seem to have `abra.sh` scripts which call `abra`: ``` rg -g '**/abra.sh' 'abra app' -l | wc -l gotosocial/abra.sh nextcloud/abra.sh matrix-synapse/abra.sh mastodon/abra.sh outline/abra.sh xwiki/abra.sh authentik/abra.sh funkwhale/abra.sh zammad/abra.sh peertube/abra.sh vaultwarden/abra.sh hometown/abra.sh ```

👀 1

3wordchant added the

enhancement

label 2025-06-07 14:00:03 +00:00

p4u1 commented

2025-07-04 06:31:28 +00:00

This seems like a valid use case and using an env var for like a good solution
I would prefer ABRA_CHAOS instead of ABRS_IS_CHAOS

This seems like a valid use case and using an env var for like a good solution I would prefer `ABRA_CHAOS` instead of `ABRS_IS_CHAOS`

👍 2

decentral1se referenced this issue from coop-cloud/rauthy

2025-09-19 21:15:50 +00:00

feat: support secret rotation and https redirection #7