generate-caddy-shortcuts reads tailnet.shortcut, which no repository declares any more #1414

New issue

Open

opened 2026-08-29 13:08:25 +00:00 by coilyco-ops · 0 comments

coilyco-ops commented

2026-08-29 13:08:25 +00:00

Owner

Found while measuring #1329's ward.yaml surface, and separate from that issue's question.

infrastructure/scripts/generate-caddy-shortcuts.py walks every repo the caller can see on Forgejo, fetches each default branch's ward.yaml, and writes one Caddy site snippet per declared tailnet.shortcut. It also deletes snippets whose owning repo no longer declares one.

Swept all 16 repositories carrying .ward/ward.yaml on this host. Their complete key sets:

15 repos   catalog                                  (3 of those also security)
 1 repo    agent, catalog                           (agentic-os)
 1 repo    capabilities, catalog, name, security    (galaxy-gen)

No tailnet key anywhere. So the generator reads a key nobody sets.

Why that is worth naming

It is not merely a no-op. The script deletes stale snippets, so a generator finding zero declarations is indistinguishable from a generator working correctly against zero shortcuts. If any Caddy snippet is still serving traffic and was written when repos did declare tailnet, the next run removes it and the removal reads as intended cleanup.

I did not run it and did not check what caddy/sites currently holds, so whether anything is actually at risk is unverified. The declaration side is measured and is zero.

What it probably needs

Either the tailnet declarations were dropped in a migration and the generator should go with them, or they were meant to survive and the migration lost them. Reading which happened is cheaper than guessing: the coily -> ward rename and agentic-os-kai#439 are both named in the script's own docstring as in-flight migrations, so the answer is likely in one of those.

Surveyed read-only. No edits to the infrastructure checkout.

Found while measuring #1329's ward.yaml surface, and separate from that issue's question. infrastructure/scripts/generate-caddy-shortcuts.py walks every repo the caller can see on Forgejo, fetches each default branch's ward.yaml, and writes one Caddy site snippet per declared tailnet.shortcut. It also deletes snippets whose owning repo no longer declares one. Swept all 16 repositories carrying .ward/ward.yaml on this host. Their complete key sets: 15 repos catalog (3 of those also security) 1 repo agent, catalog (agentic-os) 1 repo capabilities, catalog, name, security (galaxy-gen) No tailnet key anywhere. So the generator reads a key nobody sets. ## Why that is worth naming It is not merely a no-op. The script deletes stale snippets, so a generator finding zero declarations is indistinguishable from a generator working correctly against zero shortcuts. If any Caddy snippet is still serving traffic and was written when repos did declare tailnet, the next run removes it and the removal reads as intended cleanup. I did not run it and did not check what caddy/sites currently holds, so whether anything is actually at risk is unverified. The declaration side is measured and is zero. ## What it probably needs Either the tailnet declarations were dropped in a migration and the generator should go with them, or they were meant to survive and the migration lost them. Reading which happened is cheaper than guessing: the coily -> ward rename and agentic-os-kai#439 are both named in the script's own docstring as in-flight migrations, so the answer is likely in one of those. Surveyed read-only. No edits to the infrastructure checkout.

coilyco-ops added the

autonomy

headless

priority

labels

2026-08-29 13:08:25 +00:00

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

coilyco-flight-deck/agentic-os#1414

No description provided.

Rows
Columns