---
title: "swift-deploy-rs"
description: "A Rust-native, fail-closed executor for a pinned Swift Ansible v3 bundle, with sealed plans, preflight checks, and independent safety grants."
---

> Documentation Index
> Fetch the complete documentation index at: https://docs.myswift.rs/llms.txt
> Use this file to discover all available pages before exploring further.

# swift-deploy-rs

`swift-deploy-rs` converts a supported, pinned Swift Ansible v3 bundle and
inventory into a deterministic plan, seals its inputs, and executes the
approved plan over OpenSSH. It does not run Python or `ansible-playbook` at
runtime. It is a bounded compatibility layer, not a general Ansible engine.

## Safety model

```text
bundle + inventory + playbook
  -> audit + validate
  -> deterministic JSON plan
  -> plan digest + bundle fingerprint + inventory fingerprint
  -> read-only preflight
  -> exact digest confirmation
  -> independent capability grants
  -> apply
```

Unknown modules or syntax, changed plan/bundle/inventory inputs, failed
preflight, missing capability grants, and host-key errors stop execution.
Password authentication is rejected unless explicitly allowed.

## Command workflow

```sh
cd swift-deploy-rs
cargo build --release --locked

./target/release/swift-deploy audit --bundle bundle
./target/release/swift-deploy validate \
  --inventory bundle/config_sample/swift_hosts
./target/release/swift-deploy plan \
  --bundle bundle \
  --inventory bundle/config_sample/swift_hosts \
  --playbook bundle/swift.yml \
  --output swift-plan.json
./target/release/swift-deploy preflight \
  --bundle bundle \
  --inventory bundle/config_sample/swift_hosts \
  --known-hosts /etc/swift-deploy/known_hosts
```

Review the plan and required capabilities. `apply` must receive its exact
digest via `--confirm-digest`. Grant only the capabilities it needs:
`--allow-disk-wipe`, `--allow-firewall`, `--allow-ssh-reconfigure`, and
`--allow-host-reconfigure` are separate switches.

## Supported scope

The bundle audit counts task files, executable leaf tasks, modules, parse
errors, and unsupported modules, then produces a stable fingerprint. The
documented historical scope is the pinned `swift_ansible_v3` bundle, not every
upstream branch or arbitrary third-party role. Run `swift-deploy modules` and
`swift-deploy audit` against the exact candidate bundle instead of relying on
an old count.

## Preflight

Preflight is remote but read-only. It checks the supported operating-system,
network/repository reachability, disk/mount conditions, SSH trust, and, for a
Rust-stack inventory, the controller-side payload. Passing preflight does not
authorize mutation.

## Control UI

```sh
./target/release/swift-deploy ui \
  --bind 127.0.0.1 --port 8788 \
  --bundle bundle \
  --inventory bundle/config_sample/swift_hosts \
  --playbook bundle/swift.yml \
  --auth-token-file /etc/swift-deploy/ui-token \
  --workspace-root /var/lib/swift-deploy/projects
```

Only `/healthz` is public. Plan, validation, preflight, apply, state, workspace,
and ring operations are token-protected. Keep the service on loopback or a
dedicated management plane. `swift-console` can proxy this UI without exposing
the token to the browser.

## Verification and rollback

Run `cargo fmt --all --check`, clippy, all-feature tests, and the bundle audit.
Before apply, preserve the prior binaries/configuration and a node-by-node
rollback plan. The deployer can enforce input identity and capability gates; it
cannot make an unsafe topology or unreviewed plan safe.

Source: https://docs.myswift.rs/swift-deploy-rs/index.mdx