Phase 13 verification surfaced gofmt-formatting drift in 6 files
across the bundle's new code:
- internal/api/handler/metrics.go (struct field alignment)
- internal/connector/target/k8ssecret/validate_only_test.go (alignment)
- internal/connector/target/nginx/nginx.go (alignment)
- internal/connector/target/postfix/postfix.go (alignment)
- internal/connector/target/ssh/validate_only_test.go (alignment)
- internal/service/deploy_counters.go (alignment)
Pure mechanical gofmt -w fixes; no behavior changes. CI's
make verify gate (which runs `go fmt ./...`) didn't catch these
because go fmt is more lenient than gofmt -l, but golangci-lint
v2.11.4 + the explicit gofmt step in Phase 13 verification did.
Phase 13 full-matrix verification all green:
- gofmt -l: empty across all bundle-touched files
- go vet ./internal/deploy/... ./internal/connector/target/... ./internal/service/ ./internal/api/handler/ ./cmd/agent/: clean
- golangci-lint v2.11.4 (the version CI runs): 0 issues
- go test -race -count=1 across deploy + nginx + apache + haproxy + agent + service: all green
- INTEGRATION=1 go test -tags integration -run Deploy ./deploy/test/...: 4/4 e2e tests green
Phase 14 next: release prep — Active Focus update, release notes,
Reddit-beat draft, final tag handoff to operator.
Phase 7 of the deploy-hardening I master bundle. Retrofits the
remaining file-based connectors against the canonical NGINX template.
Per-connector quirks codified:
- Postfix/Dovecot: full retrofit with PreCommit (postfix check /
doveconf -n) + PostCommit (postfix reload / doveadm reload) +
post-deploy TLS verify. Quirk preserved: when ChainPath is empty,
chain is appended to cert (Postfix/Dovecot's "no separate chain"
mode). Per-distro user defaults: postfix, dovecot, _postfix.
Default key mode 0600. ValidateOnly real impl returns sentinel
when no ValidateCommand.
- Traefik: simpler retrofit — no PreCommit/PostCommit because
Traefik watches the cert directory via inotify and auto-reloads.
Atomic-write via deploy.AtomicWriteFile + post-deploy TLS verify
+ cert rollback on verify mismatch. Default key mode 0600.
ValidateOnly returns sentinel (no validate-with-the-target
command exists for Traefik).
- Caddy: retrofitted both modes. File mode replaces os.WriteFile
with deploy.AtomicWriteFile (preserves the file watcher's auto-
reload). API mode unchanged (POST /load already atomic at the
Caddy admin server). ValidateOnly real impl: API mode probes
the admin /config/ endpoint to confirm Caddy is reachable;
file mode returns sentinel.
- Envoy: file mode atomic-write via deploy.AtomicWriteFile.
Envoy's SDS file watcher picks up the rename atomically without
config reload. ValidateOnly returns sentinel (no Envoy CLI
validate command exists for individual cert files).
Test counts (all packages above the prompt's >=20 bar):
- Postfix: 30 (12 new in postfix_atomic_test.go + 18 pre-existing)
- Traefik: 22 (12 new in traefik_atomic_test.go + 10 pre-existing)
- Caddy: 22 (10 new in caddy_atomic_test.go + 12 pre-existing)
- Envoy: 21 (5 new in envoy_atomic_test.go + 16 pre-existing)
Coverage: each connector at the prompt's >=80% target. golangci-lint
v2.11.4 clean across all 4 connector packages.
Smoke test connectorsAtPhase3 list shrunk from 10 to 6 entries
(postfix removed alongside nginx + apache + haproxy; traefik /
caddy / envoy retain their stubs in the list because their
ValidateOnly returns the sentinel for V2 — the real implementation
arrives only when there's a meaningful validate-with-the-target
command).
Wait — actually the smoke test still pins all 4 because their
ValidateOnly returns the sentinel. Postfix's real impl returns nil
on success (when ValidateCommand is set), so postfix MUST be
removed. Caddy's API mode is real-impl. Traefik + Envoy still
return sentinel always — they stay in the smoke list.
Phase 8 next: F5 + IIS — explicit post-deploy TLS verify +
on-failure rollback. Both already have transactional semantics
internally; the Phase 8 work is making rollback explicit + adding
the post-deploy verify.
Dual-mode TLS connector for mail servers — single package with mode
field selecting Postfix or Dovecot defaults. File-based cert/key
deployment with correct permissions (cert 0644, key 0600), optional
chain append, shell injection prevention, and configurable
reload/validate commands. 18 tests covering config validation,
deployment, and security. GUI wizard fields and OpenAPI enum updated.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
shankar0123