swift-deploy-rs | Peregrine

A Rust-native, fail-closed executor for a pinned Swift Ansible v3 bundle, with sealed plans, preflight checks, and independent safety grants.

swift-deploy-rs converts a supported, pinned Swift Ansible v3 bundle and inventory into a deterministic plan, seals its inputs, and executes the approved plan over OpenSSH. It does not run Python or ansible-playbook at runtime. It is a bounded compatibility layer, not a general Ansible engine.

Safety model

bundle + inventory + playbook
  -> audit + validate
  -> deterministic JSON plan
  -> plan digest + bundle fingerprint + inventory fingerprint
  -> read-only preflight
  -> exact digest confirmation
  -> independent capability grants
  -> apply

Unknown modules or syntax, changed plan/bundle/inventory inputs, failed preflight, missing capability grants, and host-key errors stop execution. Password authentication is rejected unless explicitly allowed.

Command workflow

cd swift-deploy-rs
cargo build --release --locked

./target/release/swift-deploy audit --bundle bundle
./target/release/swift-deploy validate \
  --inventory bundle/config_sample/swift_hosts
./target/release/swift-deploy plan \
  --bundle bundle \
  --inventory bundle/config_sample/swift_hosts \
  --playbook bundle/swift.yml \
  --output swift-plan.json
./target/release/swift-deploy preflight \
  --bundle bundle \
  --inventory bundle/config_sample/swift_hosts \
  --known-hosts /etc/swift-deploy/known_hosts

Review the plan and required capabilities. apply must receive its exact digest via --confirm-digest. Grant only the capabilities it needs: --allow-disk-wipe, --allow-firewall, --allow-ssh-reconfigure, and --allow-host-reconfigure are separate switches.

Supported scope

The bundle audit counts task files, executable leaf tasks, modules, parse errors, and unsupported modules, then produces a stable fingerprint. The documented historical scope is the pinned swift_ansible_v3 bundle, not every upstream branch or arbitrary third-party role. Run swift-deploy modules and swift-deploy audit against the exact candidate bundle instead of relying on an old count.

Preflight

Preflight is remote but read-only. It checks the supported operating-system, network/repository reachability, disk/mount conditions, SSH trust, and, for a Rust-stack inventory, the controller-side payload. Passing preflight does not authorize mutation.

Control UI

./target/release/swift-deploy ui \
  --bind 127.0.0.1 --port 8788 \
  --bundle bundle \
  --inventory bundle/config_sample/swift_hosts \
  --playbook bundle/swift.yml \
  --auth-token-file /etc/swift-deploy/ui-token \
  --workspace-root /var/lib/swift-deploy/projects

Only /healthz is public. Plan, validation, preflight, apply, state, workspace, and ring operations are token-protected. Keep the service on loopback or a dedicated management plane. swift-console can proxy this UI without exposing the token to the browser.

Verification and rollback

Run cargo fmt --all --check, clippy, all-feature tests, and the bundle audit. Before apply, preserve the prior binaries/configuration and a node-by-node rollback plan. The deployer can enforce input identity and capability gates; it cannot make an unsafe topology or unreviewed plan safe.