v0.279.0: after_install (decision 45), known default logins on the page, Part D empty-backup alarm, night chain (R-705), R-706

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/stacks/after_install.go

@@ -0,0 +1,154 @@
+package stacks
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+	"time"
+)
+
+// ── after_install (v0.279.0, `09` §3 decision 45): no app is published with a login a stranger knows ──
+//
+// Some apps start with a known, shared admin password (claper seeds admin@claper.co / claper at every first
+// start — measured on 9202 2026-09-28, R-702). The box publishes every app on the household's domain. So
+// where the app's OWN CLI or API can change it, the template declares ONE command the box runs once, in the
+// app's own container, right after a FRESH install:
+//
+//	after_install:
+//	  service: claper
+//	  env: [ADMIN_PASSWORD]          # deploy values filled into the command; nothing else is
+//	  command: ["/app/bin/claper", "rpc", "... ${ADMIN_PASSWORD} ..."]
+//	  success: FELHOM_AFTER_INSTALL_OK   # the command's output must carry this, or it failed
+//
+// The value is a generated `type: password` field, so the household sees it on the app page as the first
+// password (the grafana/code-server pattern).
+//
+// ONLY after a fresh install (the deploy-done hook, ok=true). NEVER after a restore or "use my kept data":
+// there the login comes back with the data, and changing it would lock the household out (R-694). A failed
+// command is retried while the app boots, then recorded (`after_install` in app.yaml) and shown on the app
+// page; the app stays installed and running — never half-installed. The expanded command is never logged
+// (it carries the password); the log names the template.
+// Pinned by internal/stacks/after_install_test.go.
+
+// AfterInstallCommand is `.felhom.yml`'s `after_install:`.
+type AfterInstallCommand struct {
+	Service string   `yaml:"service" json:"service"`
+	User    string   `yaml:"user,omitempty" json:"user,omitempty"`
+	Env     []string `yaml:"env,omitempty" json:"env,omitempty"`
+	Command []string `yaml:"command" json:"command"`
+	Success string   `yaml:"success" json:"success"`
+}
+
+// AfterInstallRecord is app.yaml's `after_install:` — what the one-time command did.
+type AfterInstallRecord struct {
+	At     string `yaml:"at" json:"at"`
+	OK     bool   `yaml:"ok" json:"ok"`
+	Detail string `yaml:"detail,omitempty" json:"detail,omitempty"`
+}
+
+// afterInstallTries / afterInstallGap: the app may still be booting when the deploy reports done.
+var (
+	afterInstallTries = 6
+	afterInstallGap   = 20 * time.Second
+)
+
+// expandAfterInstall fills ${NAME} for the declared env names only, from the app's env. An undeclared or
+// empty name refuses — a command with a hole must never run (it could set an EMPTY password).
+func expandAfterInstall(cmd []string, allowed []string, env map[string]string) ([]string, error) {
+	ok := map[string]bool{}
+	for _, n := range allowed {
+		ok[n] = true
+	}
+	var missing []string
+	out := make([]string, len(cmd))
+	for i, a := range cmd {
+		out[i] = os.Expand(a, func(k string) string {
+			if !ok[k] || env[k] == "" {
+				missing = append(missing, k)
+				return ""
+			}
+			return env[k]
+		})
+	}
+	if len(missing) > 0 {
+		return nil, fmt.Errorf("after_install: %v not declared in env or has no value — not run", missing)
+	}
+	return out, nil
+}
+
+// RunAfterInstall runs the app's after_install once, after a FRESH install (main.go's deploy-done hook).
+// Returns (ran, error). Records the outcome in app.yaml either way.
+func (m *Manager) RunAfterInstall(name string, wait time.Duration) (bool, error) {
+	st, ok := m.GetStack(name)
+	if !ok {
+		return false, fmt.Errorf("stack %q not found", name)
+	}
+	ai := st.Meta.AfterInstall
+	if ai == nil || ai.Service == "" || len(ai.Command) == 0 || ai.Success == "" {
+		return false, nil
+	}
+	dir := filepath.Dir(st.ComposePath)
+	record := func(ok bool, detail string) {
+		rec := &AfterInstallRecord{At: m.now().UTC().Format(time.RFC3339), OK: ok, Detail: truncateStr(detail, 300)}
+		m.mutateAppConfig(name, dir, "after_install", func(cfg *AppConfig) bool { cfg.AfterInstall = rec; return true })
+	}
+	cfg := LoadAppConfigDecrypted(dir, m.encKey)
+	if cfg == nil {
+		record(false, "the app's settings could not be read")
+		return true, fmt.Errorf("after_install %s: app.yaml unreadable", name)
+	}
+	cmd, err := expandAfterInstall(ai.Command, ai.Env, cfg.Env)
+	if err != nil {
+		m.logger.Printf("[ERROR] [stacks] %s: %v", name, err)
+		record(false, err.Error())
+		return true, err
+	}
+	deadline := time.Now().Add(wait)
+	for {
+		_ = m.RefreshStatus()
+		if s, ok := m.GetStack(name); ok && (s.State == StateRunning || s.State == StateUnhealthy) {
+			break
+		}
+		if time.Now().After(deadline) {
+			record(false, "the app did not start in time")
+			return true, fmt.Errorf("after_install %s: the app did not start within %s — not run", name, wait)
+		}
+		time.Sleep(5 * time.Second)
+	}
+	return true, m.runAfterInstallNow(name, ai, cmd, record)
+}
+
+// runAfterInstallNow runs the expanded command (RunAfterInstall has waited for the app): retries while the
+// output lacks the success marker, then records the outcome.
+func (m *Manager) runAfterInstallNow(name string, ai *AfterInstallCommand, cmd []string, record func(ok bool, detail string)) error {
+	dir := ""
+	if st, ok := m.GetStack(name); ok {
+		dir = filepath.Dir(st.ComposePath)
+	}
+	args := []string{"exec", "-T"}
+	if ai.User != "" {
+		args = append(args, "-u", ai.User)
+	}
+	args = append(args, ai.Service)
+	args = append(args, cmd...)
+	var last string
+	for try := 1; try <= afterInstallTries; try++ {
+		t0 := time.Now()
+		out, err := m.afterLoadExec(dir, args...)
+		if err == nil && strings.Contains(out, ai.Success) {
+			m.logger.Printf("[INFO] [stacks] after_install %s: %s %v done in %s (try %d) — the app's known first login is replaced by its generated one",
+				name, ai.Service, ai.Command, time.Since(t0).Round(time.Millisecond), try)
+			record(true, "")
+			return nil
+		}
+		last = fmt.Sprintf("try %d: err=%v, no %q in the output", try, err, ai.Success)
+		m.logger.Printf("[WARN] [stacks] after_install %s: %s %v %s", name, ai.Service, ai.Command, last)
+		if try < afterInstallTries {
+			time.Sleep(afterInstallGap)
+		}
+	}
+	m.logger.Printf("[ERROR] [stacks] after_install %s FAILED after %d tries — the app runs with its KNOWN default login; the app page says so", name, afterInstallTries)
+	record(false, last)
+	return fmt.Errorf("after_install %s failed: %s", name, last)
+}