feat: move apps to targets, support env_refs as a list

.github/actions/encrypt-env/README.md

@@ -32,12 +32,9 @@ permissions:
 asset: mainframe.sops.env
 keys:
  - mainframe
-apps:
- - traefik
- - rybbit
 env:
  APPS_DOMAIN: APPS_DOMAIN # output name: GitHub Secret/Variable name
  APPS_TIMEZONE: APPS_TIMEZONE
 ```
 
-The action renders `apps` as the comma-separated `APPS` dotenv value. For each name in `keys`, it loads `<keys-directory>/<name>.pub`. Secrets take precedence over Variables when both contain the same source key. Every source key must resolve or the action fails.
+For each name in `keys`, it loads `<keys-directory>/<name>.pub`. Secrets take precedence over Variables when both contain the same source key. Every source key must resolve or the action fails. The manifest has no `apps` field — app selection lives on the deploy target, not the vault; see the main README's "Vaults And Targets" section.

.github/actions/encrypt-env/scripts/render-env.py

@@ -12,7 +12,6 @@
 ENV_NAME_RE = re.compile(r"^[A-Z_][A-Z0-9_]*$")
 SOURCE_NAME_RE = re.compile(r"^[A-Z][A-Z0-9_]*(?:__[A-Z0-9_]+)*$")
 KEY_NAME_RE = re.compile(r"^[a-z0-9][a-z0-9-]*$")
-APP_NAME_RE = re.compile(r"^[a-z0-9]+(?:-[a-z0-9]+)*$")
 ASSET_RE = re.compile(r"^[A-Za-z0-9_.-]+\.sops\.env$")
 
 
@@ -58,31 +57,21 @@ def load_manifest(path):
  raise ManifestError(f"{path} is not valid YAML: {exc}") from exc
  if not isinstance(manifest, dict):
  raise ManifestError(f"{path} must contain a YAML mapping")
- unknown = sorted(set(manifest) - {"asset", "keys", "apps", "env"})
+ unknown = sorted(set(manifest) - {"asset", "keys", "env"})
  if unknown:
  raise ManifestError("manifest contains unknown keys: " + ", ".join(unknown))
  asset = manifest.get("asset")
  keys = manifest.get("keys")
- apps = manifest.get("apps")
  env = manifest.get("env")
  if not isinstance(asset, str) or not ASSET_RE.fullmatch(asset):
  raise ManifestError("asset must be named like server.sops.env")
  if not isinstance(keys, list) or not keys:
  raise ManifestError("keys must be a non-empty list")
- if not isinstance(apps, list) or not apps:
- raise ManifestError("apps must be a non-empty list")
  if not isinstance(env, dict) or not env:
  raise ManifestError("env must be a non-empty mapping")
  for key in keys:
  if not isinstance(key, str) or not KEY_NAME_RE.fullmatch(key):
  raise ManifestError(f"invalid key name: {key!r}")
- for app in apps:
- if not isinstance(app, str) or not APP_NAME_RE.fullmatch(app):
- raise ManifestError(f"invalid app name: {app!r}")
- if len(apps) != len(set(apps)):
- raise ManifestError("apps contains duplicate app names")
- if "APPS" in env:
- raise ManifestError("APPS must be configured through apps")
  for output_name, source_name in env.items():
  if not isinstance(output_name, str) or not ENV_NAME_RE.fullmatch(output_name):
  raise ManifestError(f"invalid output env name: {output_name!r}")
@@ -111,7 +100,7 @@ def resolve_value(source_name, secrets, variables):
 
 
 def render_env(manifest, secrets, variables):
- lines = [f"APPS={','.join(manifest['apps'])}"]
+ lines = []
  missing = []
  for output_name, source_name in manifest["env"].items():
  value = resolve_value(source_name, secrets, variables)

.github/actions/encrypt-env/tests/test_render_env.py

@@ -13,59 +13,33 @@
 
 class RenderEnvTest(unittest.TestCase):
  def test_render_prefers_secrets_over_variables(self):
- manifest = {"apps": ["traefik", "rybbit"], "env": {"DOMAIN": "DOMAIN", "TIMEZONE": "TIMEZONE"}}
+ manifest = {"env": {"DOMAIN": "DOMAIN", "TIMEZONE": "TIMEZONE"}}
  output = render_env.render_env(
  manifest,
  {"DOMAIN": "secret.example"},
  {"DOMAIN": "var.example", "TIMEZONE": "Europe/Berlin"},
  )
  self.assertIn("DOMAIN=secret.example\n", output)
  self.assertIn("TIMEZONE=Europe/Berlin\n", output)
- self.assertIn("APPS=traefik,rybbit\n", output)
 
  def test_quotes_shell_sensitive_values(self):
- output = render_env.render_env(
- {"apps": ["traefik"], "env": {"TOKEN": "TOKEN"}}, {"TOKEN": "hello world"}, {}
- )
+ output = render_env.render_env({"env": {"TOKEN": "TOKEN"}}, {"TOKEN": "hello world"}, {})
  self.assertIn("TOKEN='hello world'\n", output)
 
  def test_rejects_raw_env(self):
  with self.assertRaises(render_env.ManifestError):
  render_env.load_manifest(self.write_manifest("asset: test.sops.env\nraw_env: [APPS]\n"))
 
- def test_rejects_apps_in_env(self):
- manifest = (
- "asset: test.sops.env\n"
- "keys: [test]\n"
- "apps: [traefik]\n"
- "env:\n"
- " APPS: TEST_APPS\n"
- )
- with self.assertRaisesRegex(render_env.ManifestError, "must be configured through"):
- render_env.load_manifest(self.write_manifest(manifest))
-
- def test_rejects_duplicate_apps(self):
- manifest = (
- "asset: test.sops.env\n"
- "keys: [test]\n"
- "apps: [traefik, traefik]\n"
- "env:\n"
- " TOKEN: TOKEN\n"
- )
- with self.assertRaisesRegex(render_env.ManifestError, "duplicate app names"):
- render_env.load_manifest(self.write_manifest(manifest))
-
  def test_missing_source_fails(self):
  with self.assertRaises(render_env.ManifestError):
- render_env.render_env({"apps": ["traefik"], "env": {"TOKEN": "TOKEN"}}, {}, {})
+ render_env.render_env({"env": {"TOKEN": "TOKEN"}}, {}, {})
 
  def test_duplicate_yaml_keys_fail(self):
  with tempfile.TemporaryDirectory() as directory:
  path = Path(directory) / "manifest.yml"
  path.write_text(
  "asset: mainframe.sops.env\n"
  "keys: [master, server]\n"
- "apps: [traefik, rybbit]\n"
  "env:\n"
  " TOKEN: FIRST\n"
  " TOKEN: SECOND\n"
@@ -89,7 +63,6 @@ def test_main_writes_env_and_outputs(self):
  manifest_path.write_text(
  "asset: mainframe.sops.env\n"
  "keys: [master, server]\n"
- "apps: [traefik, rybbit]\n"
  "env:\n"
  " TOKEN: TOKEN\n"
  )
@@ -108,7 +81,6 @@ def test_main_writes_env_and_outputs(self):
  os.environ.update(old_env)
  self.assertEqual(result, 0)
  self.assertIn("TOKEN=secret\n", env_path.read_text())
- self.assertIn("APPS=traefik,rybbit\n", env_path.read_text())
  self.assertIn("asset=mainframe.sops.env\n", outputs_path.read_text())
  self.assertIn("keys=master,server\n", outputs_path.read_text())
 

.github/workflows/deploy-shared.yml

@@ -10,14 +10,18 @@ on:
  description: Full release ref of the Flightdeck bundle to deploy, in owner/repo@tag format.
  type: string
  required: true
- env-ref:
- description: Release ref for the encrypted env package, in owner/repo@tag:asset format.
+ env-refs:
+ description: JSON array of release refs for encrypted env packages to decrypt and merge, in owner/repo@tag[:asset] format.
  type: string
  required: true
  app-refs:
  description: JSON array of release refs for app bundles to merge into the release, in owner/repo@tag[:asset] format.
  type: string
  required: true
+ apps:
+ description: JSON array of app names to run on this target, rendered into the deployed env as APPS.
+ type: string
+ required: true
  path:
  description: Base path on the target host for releases, shared files, and the current symlink.
  type: string
@@ -74,15 +78,18 @@ jobs:
  shell: bash
  env:
  APP_REF: ${{ inputs.app-ref }}
-ENV_REF: ${{ inputs.env-ref }}
+ENV_REFS: ${{ inputs.env-refs }}
  APP_REFS: ${{ inputs.app-refs }}
+ APPS: ${{ inputs.apps }}
  HOSTS: ${{ inputs.hosts }}
  DEPLOY_PATH: ${{ inputs.path }}
  KEEP_RELEASES: ${{ inputs.keep-releases }}
  SOPS_KEY_FILE: ${{ inputs.sops-age-key-file }}
  run: |
  hosts_json="$(jq -ce 'if type == "array" and length > 0 and all(.[]; type == "string" and test("^[a-z_][a-z0-9_-]*@[A-Za-z0-9]([A-Za-z0-9.-]*[A-Za-z0-9])?$")) then . else error("hosts must be a non-empty user@host string array") end' <<< "$HOSTS")"
+ env_refs_json="$(jq -ce 'if type == "array" and length > 0 and all(.[]; type == "string" and length > 0) then . else error("env-refs must be a non-empty string array") end' <<< "$ENV_REFS")"
  app_refs_json="$(jq -ce 'if type == "array" and length > 0 and all(.[]; type == "string" and length > 0) then . else error("app-refs must be a non-empty string array") end' <<< "$APP_REFS")"
+ apps_json="$(jq -ce 'if type == "array" and length > 0 and all(.[]; type == "string" and length > 0) then . else error("apps must be a non-empty string array") end' <<< "$APPS")"
  jq -ce '
  reduce .[] as $destination ({all: {hosts: {}}};
  ($destination | capture("^(?<user>[^@]+)@(?<host>.+)$")) as $ssh |
@@ -91,12 +98,13 @@ jobs:
  ' <<< "$hosts_json" > "$RUNNER_TEMP/flightdeck-inventory.json"
  json="$(jq -n \
  --arg app_ref "$APP_REF" \
- --arg env_ref "$ENV_REF" \
+ --argjson env_refs "$env_refs_json" \
  --argjson app_refs "$app_refs_json" \
+ --argjson apps "$apps_json" \
  --arg path "$DEPLOY_PATH" \
  --argjson keep_releases "$KEEP_RELEASES" \
  --arg sops_key_file "$SOPS_KEY_FILE" \
- '{flightdeck_app_ref: $app_ref, flightdeck_env_ref: $env_ref, flightdeck_app_refs: $app_refs, flightdeck_path: $path, flightdeck_keep_releases: $keep_releases, flightdeck_sops_age_key_file: $sops_key_file}')"
+ '{flightdeck_app_ref: $app_ref, flightdeck_env_refs: $env_refs, flightdeck_app_refs: $app_refs, flightdeck_apps: $apps, flightdeck_path: $path, flightdeck_keep_releases: $keep_releases, flightdeck_sops_age_key_file: $sops_key_file}')"
  echo "json=$json" >> "$GITHUB_OUTPUT"
  echo "inventory=$RUNNER_TEMP/flightdeck-inventory.json" >> "$GITHUB_OUTPUT"
  - name: Run playbook

.github/workflows/deploy.yml

@@ -28,8 +28,9 @@ jobs:
  with:
  hosts: ${{ toJson(matrix.hosts) }}
  app-ref: ${{ matrix.flightdeck_ref }}
- env-ref: ${{ matrix.env_ref }}
+ env-refs: ${{ toJson(matrix.env_refs) }}
  app-refs: ${{ toJson(matrix.app_refs) }}
+ apps: ${{ toJson(matrix.apps) }}
  path: ${{ matrix.path || '~/flightdeck' }}
  keep-releases: ${{ matrix.keep_releases || 5 }}
  sops-age-key-file: ${{ matrix.sops_age_key_file || '~/.config/sops/age/keys.txt' }}

.github/workflows/release.yml

@@ -98,8 +98,9 @@ jobs:
  with:
  hosts: ${{ toJson(matrix.hosts) }}
  app-ref: ${{ matrix.flightdeck_ref }}
- env-ref: ${{ matrix.env_ref }}
+ env-refs: ${{ toJson(matrix.env_refs) }}
  app-refs: ${{ toJson(matrix.app_refs) }}
+ apps: ${{ toJson(matrix.apps) }}
  path: ${{ matrix.path || '~/flightdeck' }}
  keep-releases: ${{ matrix.keep_releases || 5 }}
  sops-age-key-file: ${{ matrix.sops_age_key_file || '~/.config/sops/age/keys.txt' }}

AGENTS.md

@@ -408,12 +408,14 @@ GitHub Actions workflow (`.github/workflows/release-please.yml`) manages release
 
 Deployment helpers live in this repository:
 
-- `ansible/deploy.yml` pulls `flightdeck_app_ref` (the machinery bundle), merges every ref in `flightdeck_app_refs` (the app bundles, at least one required — flightdeck's own `apps/` catalog is just another entry, not implicit), pulls the server-specific encrypted env package from `flightdeck_env_ref`, decrypts `.sops.env` on the server, switches a timestamped release, and runs `./deploy.sh`
-- `.github/actions/encrypt-env/` is a local composite action for rendering `vaults/` manifests from GitHub Secrets/Variables, encrypting them for age recipients, and publishing `.sops.env` as a GitHub Release asset
+- `ansible/deploy.yml` pulls `flightdeck_app_ref` (the machinery bundle), merges every ref in `flightdeck_app_refs` (the app bundles, at least one required — flightdeck's own `apps/` catalog is just another entry, not implicit), decrypts and merges every ref in `flightdeck_env_refs` (at least one required) into the server's `.env`, switches a timestamped release, and runs `./deploy.sh`
+- `.github/actions/encrypt-env/` is a local composite action for rendering `vaults/` manifests from GitHub Secrets/Variables, encrypting them for age recipients, and publishing `.sops.env` as a GitHub Release asset — vault manifests hold only env/secrets, not app selection
 - `.github/workflows/deploy-shared.yml` is a reusable workflow consumer repos call to run `ansible/deploy.yml` from GitHub Actions over an optional Tailscale connection, without holding any deploy secrets in this repository
 
 App bundles listed in `flightdeck_app_refs` are release assets referenced as short refs like `<owner>/<repo>@latest` or `<owner>/<repo>@v1.2.3`, resolving to a default asset name of `flightdeck-apps.zip` unless the ref specifies an explicit `:asset-name` suffix. `@latest` is resolved by the deploy playbook through GitHub's latest release API. Every bundle must contain an `apps/` directory; app names may not conflict across bundles.
 
+Env packages listed in `flightdeck_env_refs` are release refs the same shape as app bundles, defaulting to a `$tag.sops.env`-named asset. The playbook decrypts each with the server-local SOPS age key, then merges them alongside a synthesized `APPS` line (built from `flightdeck_apps`, the target's own desired app set) — failing loud on any key collision across sources, `APPS` included. `apps` moved off the vault schema onto the target for exactly this reason: multiple vaults can be merged without having to reconcile per-vault `apps` lists.
+
 Private release assets are supported by passing `FLIGHTDECK_GITHUB_TOKEN` as a secret environment variable to `ansible/deploy.yml`. Store it as a secret in whatever system runs the playbook (e.g. a GitHub Actions secret when using `deploy-shared.yml`), not in plain configuration. When the token is present, the playbook exports it as `GH_TOKEN` for `gh release download`.
 
 ## Notable App Configurations

.github/actions/encrypt-env/README.md

@@ -32,12 +32,9 @@ permissions:
 asset: mainframe.sops.env
 keys:
  - mainframe
-apps:
- - traefik
- - rybbit
 env:
  APPS_DOMAIN: APPS_DOMAIN # output name: GitHub Secret/Variable name
  APPS_TIMEZONE: APPS_TIMEZONE
 ```
 
-The action renders `apps` as the comma-separated `APPS` dotenv value. For each name in `keys`, it loads `<keys-directory>/<name>.pub`. Secrets take precedence over Variables when both contain the same source key. Every source key must resolve or the action fails.
+For each name in `keys`, it loads `<keys-directory>/<name>.pub`. Secrets take precedence over Variables when both contain the same source key. Every source key must resolve or the action fails. The manifest has no `apps` field — app selection lives on the deploy target, not the vault; see the main README's "Vaults And Targets" section.

.github/actions/encrypt-env/scripts/render-env.py

@@ -12,7 +12,6 @@
 ENV_NAME_RE = re.compile(r"^[A-Z_][A-Z0-9_]*$")
 SOURCE_NAME_RE = re.compile(r"^[A-Z][A-Z0-9_]*(?:__[A-Z0-9_]+)*$")
 KEY_NAME_RE = re.compile(r"^[a-z0-9][a-z0-9-]*$")
-APP_NAME_RE = re.compile(r"^[a-z0-9]+(?:-[a-z0-9]+)*$")
 ASSET_RE = re.compile(r"^[A-Za-z0-9_.-]+\.sops\.env$")
 
 
@@ -58,31 +57,21 @@ def load_manifest(path):
  raise ManifestError(f"{path} is not valid YAML: {exc}") from exc
  if not isinstance(manifest, dict):
  raise ManifestError(f"{path} must contain a YAML mapping")
- unknown = sorted(set(manifest) - {"asset", "keys", "apps", "env"})
+ unknown = sorted(set(manifest) - {"asset", "keys", "env"})
  if unknown:
  raise ManifestError("manifest contains unknown keys: " + ", ".join(unknown))
  asset = manifest.get("asset")
  keys = manifest.get("keys")
- apps = manifest.get("apps")
  env = manifest.get("env")
  if not isinstance(asset, str) or not ASSET_RE.fullmatch(asset):
  raise ManifestError("asset must be named like server.sops.env")
  if not isinstance(keys, list) or not keys:
  raise ManifestError("keys must be a non-empty list")
- if not isinstance(apps, list) or not apps:
- raise ManifestError("apps must be a non-empty list")
  if not isinstance(env, dict) or not env:
  raise ManifestError("env must be a non-empty mapping")
  for key in keys:
  if not isinstance(key, str) or not KEY_NAME_RE.fullmatch(key):
  raise ManifestError(f"invalid key name: {key!r}")
- for app in apps:
- if not isinstance(app, str) or not APP_NAME_RE.fullmatch(app):
- raise ManifestError(f"invalid app name: {app!r}")
- if len(apps) != len(set(apps)):
- raise ManifestError("apps contains duplicate app names")
- if "APPS" in env:
- raise ManifestError("APPS must be configured through apps")
  for output_name, source_name in env.items():
  if not isinstance(output_name, str) or not ENV_NAME_RE.fullmatch(output_name):
  raise ManifestError(f"invalid output env name: {output_name!r}")
@@ -111,7 +100,7 @@ def resolve_value(source_name, secrets, variables):
 
 
 def render_env(manifest, secrets, variables):
- lines = [f"APPS={','.join(manifest['apps'])}"]
+ lines = []
  missing = []
  for output_name, source_name in manifest["env"].items():
  value = resolve_value(source_name, secrets, variables)

.github/actions/encrypt-env/tests/test_render_env.py

@@ -13,59 +13,33 @@
 
 class RenderEnvTest(unittest.TestCase):
  def test_render_prefers_secrets_over_variables(self):
- manifest = {"apps": ["traefik", "rybbit"], "env": {"DOMAIN": "DOMAIN", "TIMEZONE": "TIMEZONE"}}
+ manifest = {"env": {"DOMAIN": "DOMAIN", "TIMEZONE": "TIMEZONE"}}
  output = render_env.render_env(
  manifest,
  {"DOMAIN": "secret.example"},
  {"DOMAIN": "var.example", "TIMEZONE": "Europe/Berlin"},
  )
  self.assertIn("DOMAIN=secret.example\n", output)
  self.assertIn("TIMEZONE=Europe/Berlin\n", output)
- self.assertIn("APPS=traefik,rybbit\n", output)
 
  def test_quotes_shell_sensitive_values(self):
- output = render_env.render_env(
- {"apps": ["traefik"], "env": {"TOKEN": "TOKEN"}}, {"TOKEN": "hello world"}, {}
- )
+ output = render_env.render_env({"env": {"TOKEN": "TOKEN"}}, {"TOKEN": "hello world"}, {})
  self.assertIn("TOKEN='hello world'\n", output)
 
  def test_rejects_raw_env(self):
  with self.assertRaises(render_env.ManifestError):
  render_env.load_manifest(self.write_manifest("asset: test.sops.env\nraw_env: [APPS]\n"))
 
- def test_rejects_apps_in_env(self):
- manifest = (
- "asset: test.sops.env\n"
- "keys: [test]\n"
- "apps: [traefik]\n"
- "env:\n"
- " APPS: TEST_APPS\n"
- )
- with self.assertRaisesRegex(render_env.ManifestError, "must be configured through"):
- render_env.load_manifest(self.write_manifest(manifest))
-
- def test_rejects_duplicate_apps(self):
- manifest = (
- "asset: test.sops.env\n"
- "keys: [test]\n"
- "apps: [traefik, traefik]\n"
- "env:\n"
- " TOKEN: TOKEN\n"
- )
- with self.assertRaisesRegex(render_env.ManifestError, "duplicate app names"):
- render_env.load_manifest(self.write_manifest(manifest))
-
  def test_missing_source_fails(self):
  with self.assertRaises(render_env.ManifestError):
- render_env.render_env({"apps": ["traefik"], "env": {"TOKEN": "TOKEN"}}, {}, {})
+ render_env.render_env({"env": {"TOKEN": "TOKEN"}}, {}, {})
 
  def test_duplicate_yaml_keys_fail(self):
  with tempfile.TemporaryDirectory() as directory:
  path = Path(directory) / "manifest.yml"
  path.write_text(
  "asset: mainframe.sops.env\n"
  "keys: [master, server]\n"
- "apps: [traefik, rybbit]\n"
  "env:\n"
  " TOKEN: FIRST\n"
  " TOKEN: SECOND\n"
@@ -89,7 +63,6 @@ def test_main_writes_env_and_outputs(self):
  manifest_path.write_text(
  "asset: mainframe.sops.env\n"
  "keys: [master, server]\n"
- "apps: [traefik, rybbit]\n"
  "env:\n"
  " TOKEN: TOKEN\n"
  )
@@ -108,7 +81,6 @@ def test_main_writes_env_and_outputs(self):
  os.environ.update(old_env)
  self.assertEqual(result, 0)
  self.assertIn("TOKEN=secret\n", env_path.read_text())
- self.assertIn("APPS=traefik,rybbit\n", env_path.read_text())
  self.assertIn("asset=mainframe.sops.env\n", outputs_path.read_text())
  self.assertIn("keys=master,server\n", outputs_path.read_text())
 

.github/workflows/deploy-shared.yml

@@ -10,14 +10,18 @@ on:
  description: Full release ref of the Flightdeck bundle to deploy, in owner/repo@tag format.
  type: string
  required: true
- env-ref:
- description: Release ref for the encrypted env package, in owner/repo@tag:asset format.
+ env-refs:
+ description: JSON array of release refs for encrypted env packages to decrypt and merge, in owner/repo@tag[:asset] format.
  type: string
  required: true
  app-refs:
  description: JSON array of release refs for app bundles to merge into the release, in owner/repo@tag[:asset] format.
  type: string
  required: true
+ apps:
+ description: JSON array of app names to run on this target, rendered into the deployed env as APPS.
+ type: string
+ required: true
  path:
  description: Base path on the target host for releases, shared files, and the current symlink.
  type: string
@@ -74,15 +78,18 @@ jobs:
  shell: bash
  env:
  APP_REF: ${{ inputs.app-ref }}
-ENV_REF: ${{ inputs.env-ref }}
+ENV_REFS: ${{ inputs.env-refs }}
  APP_REFS: ${{ inputs.app-refs }}
+ APPS: ${{ inputs.apps }}
  HOSTS: ${{ inputs.hosts }}
  DEPLOY_PATH: ${{ inputs.path }}
  KEEP_RELEASES: ${{ inputs.keep-releases }}
  SOPS_KEY_FILE: ${{ inputs.sops-age-key-file }}
  run: |
  hosts_json="$(jq -ce 'if type == "array" and length > 0 and all(.[]; type == "string" and test("^[a-z_][a-z0-9_-]*@[A-Za-z0-9]([A-Za-z0-9.-]*[A-Za-z0-9])?$")) then . else error("hosts must be a non-empty user@host string array") end' <<< "$HOSTS")"
+ env_refs_json="$(jq -ce 'if type == "array" and length > 0 and all(.[]; type == "string" and length > 0) then . else error("env-refs must be a non-empty string array") end' <<< "$ENV_REFS")"
  app_refs_json="$(jq -ce 'if type == "array" and length > 0 and all(.[]; type == "string" and length > 0) then . else error("app-refs must be a non-empty string array") end' <<< "$APP_REFS")"
+ apps_json="$(jq -ce 'if type == "array" and length > 0 and all(.[]; type == "string" and length > 0) then . else error("apps must be a non-empty string array") end' <<< "$APPS")"
  jq -ce '
  reduce .[] as $destination ({all: {hosts: {}}};
  ($destination | capture("^(?<user>[^@]+)@(?<host>.+)$")) as $ssh |
@@ -91,12 +98,13 @@ jobs:
  ' <<< "$hosts_json" > "$RUNNER_TEMP/flightdeck-inventory.json"
  json="$(jq -n \
  --arg app_ref "$APP_REF" \
- --arg env_ref "$ENV_REF" \
+ --argjson env_refs "$env_refs_json" \
  --argjson app_refs "$app_refs_json" \
+ --argjson apps "$apps_json" \
  --arg path "$DEPLOY_PATH" \
  --argjson keep_releases "$KEEP_RELEASES" \
  --arg sops_key_file "$SOPS_KEY_FILE" \
- '{flightdeck_app_ref: $app_ref, flightdeck_env_ref: $env_ref, flightdeck_app_refs: $app_refs, flightdeck_path: $path, flightdeck_keep_releases: $keep_releases, flightdeck_sops_age_key_file: $sops_key_file}')"
+ '{flightdeck_app_ref: $app_ref, flightdeck_env_refs: $env_refs, flightdeck_app_refs: $app_refs, flightdeck_apps: $apps, flightdeck_path: $path, flightdeck_keep_releases: $keep_releases, flightdeck_sops_age_key_file: $sops_key_file}')"
  echo "json=$json" >> "$GITHUB_OUTPUT"
  echo "inventory=$RUNNER_TEMP/flightdeck-inventory.json" >> "$GITHUB_OUTPUT"
  - name: Run playbook

.github/workflows/deploy.yml

@@ -28,8 +28,9 @@ jobs:
  with:
  hosts: ${{ toJson(matrix.hosts) }}
  app-ref: ${{ matrix.flightdeck_ref }}
- env-ref: ${{ matrix.env_ref }}
+ env-refs: ${{ toJson(matrix.env_refs) }}
  app-refs: ${{ toJson(matrix.app_refs) }}
+ apps: ${{ toJson(matrix.apps) }}
  path: ${{ matrix.path || '~/flightdeck' }}
  keep-releases: ${{ matrix.keep_releases || 5 }}
  sops-age-key-file: ${{ matrix.sops_age_key_file || '~/.config/sops/age/keys.txt' }}

.github/workflows/release.yml

@@ -98,8 +98,9 @@ jobs:
  with:
  hosts: ${{ toJson(matrix.hosts) }}
  app-ref: ${{ matrix.flightdeck_ref }}
- env-ref: ${{ matrix.env_ref }}
+ env-refs: ${{ toJson(matrix.env_refs) }}
  app-refs: ${{ toJson(matrix.app_refs) }}
+ apps: ${{ toJson(matrix.apps) }}
  path: ${{ matrix.path || '~/flightdeck' }}
  keep-releases: ${{ matrix.keep_releases || 5 }}
  sops-age-key-file: ${{ matrix.sops_age_key_file || '~/.config/sops/age/keys.txt' }}

AGENTS.md

@@ -408,12 +408,14 @@ GitHub Actions workflow (`.github/workflows/release-please.yml`) manages release
 
 Deployment helpers live in this repository:
 
-- `ansible/deploy.yml` pulls `flightdeck_app_ref` (the machinery bundle), merges every ref in `flightdeck_app_refs` (the app bundles, at least one required — flightdeck's own `apps/` catalog is just another entry, not implicit), pulls the server-specific encrypted env package from `flightdeck_env_ref`, decrypts `.sops.env` on the server, switches a timestamped release, and runs `./deploy.sh`
-- `.github/actions/encrypt-env/` is a local composite action for rendering `vaults/` manifests from GitHub Secrets/Variables, encrypting them for age recipients, and publishing `.sops.env` as a GitHub Release asset
+- `ansible/deploy.yml` pulls `flightdeck_app_ref` (the machinery bundle), merges every ref in `flightdeck_app_refs` (the app bundles, at least one required — flightdeck's own `apps/` catalog is just another entry, not implicit), decrypts and merges every ref in `flightdeck_env_refs` (at least one required) into the server's `.env`, switches a timestamped release, and runs `./deploy.sh`
+- `.github/actions/encrypt-env/` is a local composite action for rendering `vaults/` manifests from GitHub Secrets/Variables, encrypting them for age recipients, and publishing `.sops.env` as a GitHub Release asset — vault manifests hold only env/secrets, not app selection
 - `.github/workflows/deploy-shared.yml` is a reusable workflow consumer repos call to run `ansible/deploy.yml` from GitHub Actions over an optional Tailscale connection, without holding any deploy secrets in this repository
 
 App bundles listed in `flightdeck_app_refs` are release assets referenced as short refs like `<owner>/<repo>@latest` or `<owner>/<repo>@v1.2.3`, resolving to a default asset name of `flightdeck-apps.zip` unless the ref specifies an explicit `:asset-name` suffix. `@latest` is resolved by the deploy playbook through GitHub's latest release API. Every bundle must contain an `apps/` directory; app names may not conflict across bundles.
 
+Env packages listed in `flightdeck_env_refs` are release refs the same shape as app bundles, defaulting to a `$tag.sops.env`-named asset. The playbook decrypts each with the server-local SOPS age key, then merges them alongside a synthesized `APPS` line (built from `flightdeck_apps`, the target's own desired app set) — failing loud on any key collision across sources, `APPS` included. `apps` moved off the vault schema onto the target for exactly this reason: multiple vaults can be merged without having to reconcile per-vault `apps` lists.
+
 Private release assets are supported by passing `FLIGHTDECK_GITHUB_TOKEN` as a secret environment variable to `ansible/deploy.yml`. Store it as a secret in whatever system runs the playbook (e.g. a GitHub Actions secret when using `deploy-shared.yml`), not in plain configuration. When the token is present, the playbook exports it as `GH_TOKEN` for `gh release download`.
 
 ## Notable App Configurations

.github/actions/encrypt-env/README.md

@@ -32,12 +32,9 @@ permissions:
 asset: mainframe.sops.env
 keys:
  - mainframe
-apps:
- - traefik
- - rybbit
 env:
  APPS_DOMAIN: APPS_DOMAIN # output name: GitHub Secret/Variable name
  APPS_TIMEZONE: APPS_TIMEZONE
 ```
 
-The action renders `apps` as the comma-separated `APPS` dotenv value. For each name in `keys`, it loads `<keys-directory>/<name>.pub`. Secrets take precedence over Variables when both contain the same source key. Every source key must resolve or the action fails.
+For each name in `keys`, it loads `<keys-directory>/<name>.pub`. Secrets take precedence over Variables when both contain the same source key. Every source key must resolve or the action fails. The manifest has no `apps` field — app selection lives on the deploy target, not the vault; see the main README's "Vaults And Targets" section.

.github/actions/encrypt-env/scripts/render-env.py

@@ -12,7 +12,6 @@
 ENV_NAME_RE = re.compile(r"^[A-Z_][A-Z0-9_]*$")
 SOURCE_NAME_RE = re.compile(r"^[A-Z][A-Z0-9_]*(?:__[A-Z0-9_]+)*$")
 KEY_NAME_RE = re.compile(r"^[a-z0-9][a-z0-9-]*$")
-APP_NAME_RE = re.compile(r"^[a-z0-9]+(?:-[a-z0-9]+)*$")
 ASSET_RE = re.compile(r"^[A-Za-z0-9_.-]+\.sops\.env$")
 
 
@@ -58,31 +57,21 @@ def load_manifest(path):
  raise ManifestError(f"{path} is not valid YAML: {exc}") from exc
  if not isinstance(manifest, dict):
  raise ManifestError(f"{path} must contain a YAML mapping")
- unknown = sorted(set(manifest) - {"asset", "keys", "apps", "env"})
+ unknown = sorted(set(manifest) - {"asset", "keys", "env"})
  if unknown:
  raise ManifestError("manifest contains unknown keys: " + ", ".join(unknown))
  asset = manifest.get("asset")
  keys = manifest.get("keys")
- apps = manifest.get("apps")
  env = manifest.get("env")
  if not isinstance(asset, str) or not ASSET_RE.fullmatch(asset):
  raise ManifestError("asset must be named like server.sops.env")
  if not isinstance(keys, list) or not keys:
  raise ManifestError("keys must be a non-empty list")
- if not isinstance(apps, list) or not apps:
- raise ManifestError("apps must be a non-empty list")
  if not isinstance(env, dict) or not env:
  raise ManifestError("env must be a non-empty mapping")
  for key in keys:
  if not isinstance(key, str) or not KEY_NAME_RE.fullmatch(key):
  raise ManifestError(f"invalid key name: {key!r}")
- for app in apps:
- if not isinstance(app, str) or not APP_NAME_RE.fullmatch(app):
- raise ManifestError(f"invalid app name: {app!r}")
- if len(apps) != len(set(apps)):
- raise ManifestError("apps contains duplicate app names")
- if "APPS" in env:
- raise ManifestError("APPS must be configured through apps")
  for output_name, source_name in env.items():
  if not isinstance(output_name, str) or not ENV_NAME_RE.fullmatch(output_name):
  raise ManifestError(f"invalid output env name: {output_name!r}")
@@ -111,7 +100,7 @@ def resolve_value(source_name, secrets, variables):
 
 
 def render_env(manifest, secrets, variables):
- lines = [f"APPS={','.join(manifest['apps'])}"]
+ lines = []
  missing = []
  for output_name, source_name in manifest["env"].items():
  value = resolve_value(source_name, secrets, variables)

.github/actions/encrypt-env/tests/test_render_env.py

@@ -13,59 +13,33 @@
 
 class RenderEnvTest(unittest.TestCase):
  def test_render_prefers_secrets_over_variables(self):
- manifest = {"apps": ["traefik", "rybbit"], "env": {"DOMAIN": "DOMAIN", "TIMEZONE": "TIMEZONE"}}
+ manifest = {"env": {"DOMAIN": "DOMAIN", "TIMEZONE": "TIMEZONE"}}
  output = render_env.render_env(
  manifest,
  {"DOMAIN": "secret.example"},
  {"DOMAIN": "var.example", "TIMEZONE": "Europe/Berlin"},
  )
  self.assertIn("DOMAIN=secret.example\n", output)
  self.assertIn("TIMEZONE=Europe/Berlin\n", output)
- self.assertIn("APPS=traefik,rybbit\n", output)
 
  def test_quotes_shell_sensitive_values(self):
- output = render_env.render_env(
- {"apps": ["traefik"], "env": {"TOKEN": "TOKEN"}}, {"TOKEN": "hello world"}, {}
- )
+ output = render_env.render_env({"env": {"TOKEN": "TOKEN"}}, {"TOKEN": "hello world"}, {})
  self.assertIn("TOKEN='hello world'\n", output)
 
  def test_rejects_raw_env(self):
  with self.assertRaises(render_env.ManifestError):
  render_env.load_manifest(self.write_manifest("asset: test.sops.env\nraw_env: [APPS]\n"))
 
- def test_rejects_apps_in_env(self):
- manifest = (
- "asset: test.sops.env\n"
- "keys: [test]\n"
- "apps: [traefik]\n"
- "env:\n"
- " APPS: TEST_APPS\n"
- )
- with self.assertRaisesRegex(render_env.ManifestError, "must be configured through"):
- render_env.load_manifest(self.write_manifest(manifest))
-
- def test_rejects_duplicate_apps(self):
- manifest = (
- "asset: test.sops.env\n"
- "keys: [test]\n"
- "apps: [traefik, traefik]\n"
- "env:\n"
- " TOKEN: TOKEN\n"
- )
- with self.assertRaisesRegex(render_env.ManifestError, "duplicate app names"):
- render_env.load_manifest(self.write_manifest(manifest))
-
  def test_missing_source_fails(self):
  with self.assertRaises(render_env.ManifestError):
- render_env.render_env({"apps": ["traefik"], "env": {"TOKEN": "TOKEN"}}, {}, {})
+ render_env.render_env({"env": {"TOKEN": "TOKEN"}}, {}, {})
 
  def test_duplicate_yaml_keys_fail(self):
  with tempfile.TemporaryDirectory() as directory:
  path = Path(directory) / "manifest.yml"
  path.write_text(
  "asset: mainframe.sops.env\n"
  "keys: [master, server]\n"
- "apps: [traefik, rybbit]\n"
  "env:\n"
  " TOKEN: FIRST\n"
  " TOKEN: SECOND\n"
@@ -89,7 +63,6 @@ def test_main_writes_env_and_outputs(self):
  manifest_path.write_text(
  "asset: mainframe.sops.env\n"
  "keys: [master, server]\n"
- "apps: [traefik, rybbit]\n"
  "env:\n"
  " TOKEN: TOKEN\n"
  )
@@ -108,7 +81,6 @@ def test_main_writes_env_and_outputs(self):
  os.environ.update(old_env)
  self.assertEqual(result, 0)
  self.assertIn("TOKEN=secret\n", env_path.read_text())
- self.assertIn("APPS=traefik,rybbit\n", env_path.read_text())
  self.assertIn("asset=mainframe.sops.env\n", outputs_path.read_text())
  self.assertIn("keys=master,server\n", outputs_path.read_text())
 

.github/workflows/deploy-shared.yml

@@ -10,14 +10,18 @@ on:
  description: Full release ref of the Flightdeck bundle to deploy, in owner/repo@tag format.
  type: string
  required: true
- env-ref:
- description: Release ref for the encrypted env package, in owner/repo@tag:asset format.
+ env-refs:
+ description: JSON array of release refs for encrypted env packages to decrypt and merge, in owner/repo@tag[:asset] format.
  type: string
  required: true
  app-refs:
  description: JSON array of release refs for app bundles to merge into the release, in owner/repo@tag[:asset] format.
  type: string
  required: true
+ apps:
+ description: JSON array of app names to run on this target, rendered into the deployed env as APPS.
+ type: string
+ required: true
  path:
  description: Base path on the target host for releases, shared files, and the current symlink.
  type: string
@@ -74,15 +78,18 @@ jobs:
  shell: bash
  env:
  APP_REF: ${{ inputs.app-ref }}
-ENV_REF: ${{ inputs.env-ref }}
+ENV_REFS: ${{ inputs.env-refs }}
  APP_REFS: ${{ inputs.app-refs }}
+ APPS: ${{ inputs.apps }}
  HOSTS: ${{ inputs.hosts }}
  DEPLOY_PATH: ${{ inputs.path }}
  KEEP_RELEASES: ${{ inputs.keep-releases }}
  SOPS_KEY_FILE: ${{ inputs.sops-age-key-file }}
  run: |
  hosts_json="$(jq -ce 'if type == "array" and length > 0 and all(.[]; type == "string" and test("^[a-z_][a-z0-9_-]*@[A-Za-z0-9]([A-Za-z0-9.-]*[A-Za-z0-9])?$")) then . else error("hosts must be a non-empty user@host string array") end' <<< "$HOSTS")"
+ env_refs_json="$(jq -ce 'if type == "array" and length > 0 and all(.[]; type == "string" and length > 0) then . else error("env-refs must be a non-empty string array") end' <<< "$ENV_REFS")"
  app_refs_json="$(jq -ce 'if type == "array" and length > 0 and all(.[]; type == "string" and length > 0) then . else error("app-refs must be a non-empty string array") end' <<< "$APP_REFS")"
+ apps_json="$(jq -ce 'if type == "array" and length > 0 and all(.[]; type == "string" and length > 0) then . else error("apps must be a non-empty string array") end' <<< "$APPS")"
  jq -ce '
  reduce .[] as $destination ({all: {hosts: {}}};
  ($destination | capture("^(?<user>[^@]+)@(?<host>.+)$")) as $ssh |
@@ -91,12 +98,13 @@ jobs:
  ' <<< "$hosts_json" > "$RUNNER_TEMP/flightdeck-inventory.json"
  json="$(jq -n \
  --arg app_ref "$APP_REF" \
- --arg env_ref "$ENV_REF" \
+ --argjson env_refs "$env_refs_json" \
  --argjson app_refs "$app_refs_json" \
+ --argjson apps "$apps_json" \
  --arg path "$DEPLOY_PATH" \
  --argjson keep_releases "$KEEP_RELEASES" \
  --arg sops_key_file "$SOPS_KEY_FILE" \
- '{flightdeck_app_ref: $app_ref, flightdeck_env_ref: $env_ref, flightdeck_app_refs: $app_refs, flightdeck_path: $path, flightdeck_keep_releases: $keep_releases, flightdeck_sops_age_key_file: $sops_key_file}')"
+ '{flightdeck_app_ref: $app_ref, flightdeck_env_refs: $env_refs, flightdeck_app_refs: $app_refs, flightdeck_apps: $apps, flightdeck_path: $path, flightdeck_keep_releases: $keep_releases, flightdeck_sops_age_key_file: $sops_key_file}')"
  echo "json=$json" >> "$GITHUB_OUTPUT"
  echo "inventory=$RUNNER_TEMP/flightdeck-inventory.json" >> "$GITHUB_OUTPUT"
  - name: Run playbook

.github/workflows/deploy.yml

@@ -28,8 +28,9 @@ jobs:
  with:
  hosts: ${{ toJson(matrix.hosts) }}
  app-ref: ${{ matrix.flightdeck_ref }}
- env-ref: ${{ matrix.env_ref }}
+ env-refs: ${{ toJson(matrix.env_refs) }}
  app-refs: ${{ toJson(matrix.app_refs) }}
+ apps: ${{ toJson(matrix.apps) }}
  path: ${{ matrix.path || '~/flightdeck' }}
  keep-releases: ${{ matrix.keep_releases || 5 }}
  sops-age-key-file: ${{ matrix.sops_age_key_file || '~/.config/sops/age/keys.txt' }}

.github/workflows/release.yml

@@ -98,8 +98,9 @@ jobs:
  with:
  hosts: ${{ toJson(matrix.hosts) }}
  app-ref: ${{ matrix.flightdeck_ref }}
- env-ref: ${{ matrix.env_ref }}
+ env-refs: ${{ toJson(matrix.env_refs) }}
  app-refs: ${{ toJson(matrix.app_refs) }}
+ apps: ${{ toJson(matrix.apps) }}
  path: ${{ matrix.path || '~/flightdeck' }}
  keep-releases: ${{ matrix.keep_releases || 5 }}
  sops-age-key-file: ${{ matrix.sops_age_key_file || '~/.config/sops/age/keys.txt' }}

AGENTS.md

@@ -408,12 +408,14 @@ GitHub Actions workflow (`.github/workflows/release-please.yml`) manages release
 
 Deployment helpers live in this repository:
 
-- `ansible/deploy.yml` pulls `flightdeck_app_ref` (the machinery bundle), merges every ref in `flightdeck_app_refs` (the app bundles, at least one required — flightdeck's own `apps/` catalog is just another entry, not implicit), pulls the server-specific encrypted env package from `flightdeck_env_ref`, decrypts `.sops.env` on the server, switches a timestamped release, and runs `./deploy.sh`
-- `.github/actions/encrypt-env/` is a local composite action for rendering `vaults/` manifests from GitHub Secrets/Variables, encrypting them for age recipients, and publishing `.sops.env` as a GitHub Release asset
+- `ansible/deploy.yml` pulls `flightdeck_app_ref` (the machinery bundle), merges every ref in `flightdeck_app_refs` (the app bundles, at least one required — flightdeck's own `apps/` catalog is just another entry, not implicit), decrypts and merges every ref in `flightdeck_env_refs` (at least one required) into the server's `.env`, switches a timestamped release, and runs `./deploy.sh`
+- `.github/actions/encrypt-env/` is a local composite action for rendering `vaults/` manifests from GitHub Secrets/Variables, encrypting them for age recipients, and publishing `.sops.env` as a GitHub Release asset — vault manifests hold only env/secrets, not app selection
 - `.github/workflows/deploy-shared.yml` is a reusable workflow consumer repos call to run `ansible/deploy.yml` from GitHub Actions over an optional Tailscale connection, without holding any deploy secrets in this repository
 
 App bundles listed in `flightdeck_app_refs` are release assets referenced as short refs like `<owner>/<repo>@latest` or `<owner>/<repo>@v1.2.3`, resolving to a default asset name of `flightdeck-apps.zip` unless the ref specifies an explicit `:asset-name` suffix. `@latest` is resolved by the deploy playbook through GitHub's latest release API. Every bundle must contain an `apps/` directory; app names may not conflict across bundles.
 
+Env packages listed in `flightdeck_env_refs` are release refs the same shape as app bundles, defaulting to a `$tag.sops.env`-named asset. The playbook decrypts each with the server-local SOPS age key, then merges them alongside a synthesized `APPS` line (built from `flightdeck_apps`, the target's own desired app set) — failing loud on any key collision across sources, `APPS` included. `apps` moved off the vault schema onto the target for exactly this reason: multiple vaults can be merged without having to reconcile per-vault `apps` lists.
+
 Private release assets are supported by passing `FLIGHTDECK_GITHUB_TOKEN` as a secret environment variable to `ansible/deploy.yml`. Store it as a secret in whatever system runs the playbook (e.g. a GitHub Actions secret when using `deploy-shared.yml`), not in plain configuration. When the token is present, the playbook exports it as `GH_TOKEN` for `gh release download`.
 
 ## Notable App Configurations

.github/actions/encrypt-env/README.md

@@ -32,12 +32,9 @@ permissions:
 asset: mainframe.sops.env
 keys:
  - mainframe
-apps:
- - traefik
- - rybbit
 env:
  APPS_DOMAIN: APPS_DOMAIN # output name: GitHub Secret/Variable name
  APPS_TIMEZONE: APPS_TIMEZONE
 ```
 
-The action renders `apps` as the comma-separated `APPS` dotenv value. For each name in `keys`, it loads `<keys-directory>/<name>.pub`. Secrets take precedence over Variables when both contain the same source key. Every source key must resolve or the action fails.
+For each name in `keys`, it loads `<keys-directory>/<name>.pub`. Secrets take precedence over Variables when both contain the same source key. Every source key must resolve or the action fails. The manifest has no `apps` field — app selection lives on the deploy target, not the vault; see the main README's "Vaults And Targets" section.

.github/actions/encrypt-env/scripts/render-env.py

@@ -12,7 +12,6 @@
 ENV_NAME_RE = re.compile(r"^[A-Z_][A-Z0-9_]*$")
 SOURCE_NAME_RE = re.compile(r"^[A-Z][A-Z0-9_]*(?:__[A-Z0-9_]+)*$")
 KEY_NAME_RE = re.compile(r"^[a-z0-9][a-z0-9-]*$")
-APP_NAME_RE = re.compile(r"^[a-z0-9]+(?:-[a-z0-9]+)*$")
 ASSET_RE = re.compile(r"^[A-Za-z0-9_.-]+\.sops\.env$")
 
 
@@ -58,31 +57,21 @@ def load_manifest(path):
  raise ManifestError(f"{path} is not valid YAML: {exc}") from exc
  if not isinstance(manifest, dict):
  raise ManifestError(f"{path} must contain a YAML mapping")
- unknown = sorted(set(manifest) - {"asset", "keys", "apps", "env"})
+ unknown = sorted(set(manifest) - {"asset", "keys", "env"})
  if unknown:
  raise ManifestError("manifest contains unknown keys: " + ", ".join(unknown))
  asset = manifest.get("asset")
  keys = manifest.get("keys")
- apps = manifest.get("apps")
  env = manifest.get("env")
  if not isinstance(asset, str) or not ASSET_RE.fullmatch(asset):
  raise ManifestError("asset must be named like server.sops.env")
  if not isinstance(keys, list) or not keys:
  raise ManifestError("keys must be a non-empty list")
- if not isinstance(apps, list) or not apps:
- raise ManifestError("apps must be a non-empty list")
  if not isinstance(env, dict) or not env:
  raise ManifestError("env must be a non-empty mapping")
  for key in keys:
  if not isinstance(key, str) or not KEY_NAME_RE.fullmatch(key):
  raise ManifestError(f"invalid key name: {key!r}")
- for app in apps:
- if not isinstance(app, str) or not APP_NAME_RE.fullmatch(app):
- raise ManifestError(f"invalid app name: {app!r}")
- if len(apps) != len(set(apps)):
- raise ManifestError("apps contains duplicate app names")
- if "APPS" in env:
- raise ManifestError("APPS must be configured through apps")
  for output_name, source_name in env.items():
  if not isinstance(output_name, str) or not ENV_NAME_RE.fullmatch(output_name):
  raise ManifestError(f"invalid output env name: {output_name!r}")
@@ -111,7 +100,7 @@ def resolve_value(source_name, secrets, variables):
 
 
 def render_env(manifest, secrets, variables):
- lines = [f"APPS={','.join(manifest['apps'])}"]
+ lines = []
  missing = []
  for output_name, source_name in manifest["env"].items():
  value = resolve_value(source_name, secrets, variables)

.github/actions/encrypt-env/tests/test_render_env.py

@@ -13,59 +13,33 @@
 
 class RenderEnvTest(unittest.TestCase):
  def test_render_prefers_secrets_over_variables(self):
- manifest = {"apps": ["traefik", "rybbit"], "env": {"DOMAIN": "DOMAIN", "TIMEZONE": "TIMEZONE"}}
+ manifest = {"env": {"DOMAIN": "DOMAIN", "TIMEZONE": "TIMEZONE"}}
  output = render_env.render_env(
  manifest,
  {"DOMAIN": "secret.example"},
  {"DOMAIN": "var.example", "TIMEZONE": "Europe/Berlin"},
  )
  self.assertIn("DOMAIN=secret.example\n", output)
  self.assertIn("TIMEZONE=Europe/Berlin\n", output)
- self.assertIn("APPS=traefik,rybbit\n", output)
 
  def test_quotes_shell_sensitive_values(self):
- output = render_env.render_env(
- {"apps": ["traefik"], "env": {"TOKEN": "TOKEN"}}, {"TOKEN": "hello world"}, {}
- )
+ output = render_env.render_env({"env": {"TOKEN": "TOKEN"}}, {"TOKEN": "hello world"}, {})
  self.assertIn("TOKEN='hello world'\n", output)
 
  def test_rejects_raw_env(self):
  with self.assertRaises(render_env.ManifestError):
  render_env.load_manifest(self.write_manifest("asset: test.sops.env\nraw_env: [APPS]\n"))
 
- def test_rejects_apps_in_env(self):
- manifest = (
- "asset: test.sops.env\n"
- "keys: [test]\n"
- "apps: [traefik]\n"
- "env:\n"
- " APPS: TEST_APPS\n"
- )
- with self.assertRaisesRegex(render_env.ManifestError, "must be configured through"):
- render_env.load_manifest(self.write_manifest(manifest))
-
- def test_rejects_duplicate_apps(self):
- manifest = (
- "asset: test.sops.env\n"
- "keys: [test]\n"
- "apps: [traefik, traefik]\n"
- "env:\n"
- " TOKEN: TOKEN\n"
- )
- with self.assertRaisesRegex(render_env.ManifestError, "duplicate app names"):
- render_env.load_manifest(self.write_manifest(manifest))
-
  def test_missing_source_fails(self):
  with self.assertRaises(render_env.ManifestError):
- render_env.render_env({"apps": ["traefik"], "env": {"TOKEN": "TOKEN"}}, {}, {})
+ render_env.render_env({"env": {"TOKEN": "TOKEN"}}, {}, {})
 
  def test_duplicate_yaml_keys_fail(self):
  with tempfile.TemporaryDirectory() as directory:
  path = Path(directory) / "manifest.yml"
  path.write_text(
  "asset: mainframe.sops.env\n"
  "keys: [master, server]\n"
- "apps: [traefik, rybbit]\n"
  "env:\n"
  " TOKEN: FIRST\n"
  " TOKEN: SECOND\n"
@@ -89,7 +63,6 @@ def test_main_writes_env_and_outputs(self):
  manifest_path.write_text(
  "asset: mainframe.sops.env\n"
  "keys: [master, server]\n"
- "apps: [traefik, rybbit]\n"
  "env:\n"
  " TOKEN: TOKEN\n"
  )
@@ -108,7 +81,6 @@ def test_main_writes_env_and_outputs(self):
  os.environ.update(old_env)
  self.assertEqual(result, 0)
  self.assertIn("TOKEN=secret\n", env_path.read_text())
- self.assertIn("APPS=traefik,rybbit\n", env_path.read_text())
  self.assertIn("asset=mainframe.sops.env\n", outputs_path.read_text())
  self.assertIn("keys=master,server\n", outputs_path.read_text())
 

.github/workflows/deploy-shared.yml

@@ -10,14 +10,18 @@ on:
  description: Full release ref of the Flightdeck bundle to deploy, in owner/repo@tag format.
  type: string
  required: true
- env-ref:
- description: Release ref for the encrypted env package, in owner/repo@tag:asset format.
+ env-refs:
+ description: JSON array of release refs for encrypted env packages to decrypt and merge, in owner/repo@tag[:asset] format.
  type: string
  required: true
  app-refs:
  description: JSON array of release refs for app bundles to merge into the release, in owner/repo@tag[:asset] format.
  type: string
  required: true
+ apps:
+ description: JSON array of app names to run on this target, rendered into the deployed env as APPS.
+ type: string
+ required: true
  path:
  description: Base path on the target host for releases, shared files, and the current symlink.
  type: string
@@ -74,15 +78,18 @@ jobs:
  shell: bash
  env:
  APP_REF: ${{ inputs.app-ref }}
-ENV_REF: ${{ inputs.env-ref }}
+ENV_REFS: ${{ inputs.env-refs }}
  APP_REFS: ${{ inputs.app-refs }}
+ APPS: ${{ inputs.apps }}
  HOSTS: ${{ inputs.hosts }}
  DEPLOY_PATH: ${{ inputs.path }}
  KEEP_RELEASES: ${{ inputs.keep-releases }}
  SOPS_KEY_FILE: ${{ inputs.sops-age-key-file }}
  run: |
  hosts_json="$(jq -ce 'if type == "array" and length > 0 and all(.[]; type == "string" and test("^[a-z_][a-z0-9_-]*@[A-Za-z0-9]([A-Za-z0-9.-]*[A-Za-z0-9])?$")) then . else error("hosts must be a non-empty user@host string array") end' <<< "$HOSTS")"
+ env_refs_json="$(jq -ce 'if type == "array" and length > 0 and all(.[]; type == "string" and length > 0) then . else error("env-refs must be a non-empty string array") end' <<< "$ENV_REFS")"
  app_refs_json="$(jq -ce 'if type == "array" and length > 0 and all(.[]; type == "string" and length > 0) then . else error("app-refs must be a non-empty string array") end' <<< "$APP_REFS")"
+ apps_json="$(jq -ce 'if type == "array" and length > 0 and all(.[]; type == "string" and length > 0) then . else error("apps must be a non-empty string array") end' <<< "$APPS")"
  jq -ce '
  reduce .[] as $destination ({all: {hosts: {}}};
  ($destination | capture("^(?<user>[^@]+)@(?<host>.+)$")) as $ssh |
@@ -91,12 +98,13 @@ jobs:
  ' <<< "$hosts_json" > "$RUNNER_TEMP/flightdeck-inventory.json"
  json="$(jq -n \
  --arg app_ref "$APP_REF" \
- --arg env_ref "$ENV_REF" \
+ --argjson env_refs "$env_refs_json" \
  --argjson app_refs "$app_refs_json" \
+ --argjson apps "$apps_json" \
  --arg path "$DEPLOY_PATH" \
  --argjson keep_releases "$KEEP_RELEASES" \
  --arg sops_key_file "$SOPS_KEY_FILE" \
- '{flightdeck_app_ref: $app_ref, flightdeck_env_ref: $env_ref, flightdeck_app_refs: $app_refs, flightdeck_path: $path, flightdeck_keep_releases: $keep_releases, flightdeck_sops_age_key_file: $sops_key_file}')"
+ '{flightdeck_app_ref: $app_ref, flightdeck_env_refs: $env_refs, flightdeck_app_refs: $app_refs, flightdeck_apps: $apps, flightdeck_path: $path, flightdeck_keep_releases: $keep_releases, flightdeck_sops_age_key_file: $sops_key_file}')"
  echo "json=$json" >> "$GITHUB_OUTPUT"
  echo "inventory=$RUNNER_TEMP/flightdeck-inventory.json" >> "$GITHUB_OUTPUT"
  - name: Run playbook

.github/workflows/deploy.yml

@@ -28,8 +28,9 @@ jobs:
  with:
  hosts: ${{ toJson(matrix.hosts) }}
  app-ref: ${{ matrix.flightdeck_ref }}
- env-ref: ${{ matrix.env_ref }}
+ env-refs: ${{ toJson(matrix.env_refs) }}
  app-refs: ${{ toJson(matrix.app_refs) }}
+ apps: ${{ toJson(matrix.apps) }}
  path: ${{ matrix.path || '~/flightdeck' }}
  keep-releases: ${{ matrix.keep_releases || 5 }}
  sops-age-key-file: ${{ matrix.sops_age_key_file || '~/.config/sops/age/keys.txt' }}

.github/workflows/release.yml

@@ -98,8 +98,9 @@ jobs:
  with:
  hosts: ${{ toJson(matrix.hosts) }}
  app-ref: ${{ matrix.flightdeck_ref }}
- env-ref: ${{ matrix.env_ref }}
+ env-refs: ${{ toJson(matrix.env_refs) }}
  app-refs: ${{ toJson(matrix.app_refs) }}
+ apps: ${{ toJson(matrix.apps) }}
  path: ${{ matrix.path || '~/flightdeck' }}
  keep-releases: ${{ matrix.keep_releases || 5 }}
  sops-age-key-file: ${{ matrix.sops_age_key_file || '~/.config/sops/age/keys.txt' }}

AGENTS.md

@@ -408,12 +408,14 @@ GitHub Actions workflow (`.github/workflows/release-please.yml`) manages release
 
 Deployment helpers live in this repository:
 
-- `ansible/deploy.yml` pulls `flightdeck_app_ref` (the machinery bundle), merges every ref in `flightdeck_app_refs` (the app bundles, at least one required — flightdeck's own `apps/` catalog is just another entry, not implicit), pulls the server-specific encrypted env package from `flightdeck_env_ref`, decrypts `.sops.env` on the server, switches a timestamped release, and runs `./deploy.sh`
-- `.github/actions/encrypt-env/` is a local composite action for rendering `vaults/` manifests from GitHub Secrets/Variables, encrypting them for age recipients, and publishing `.sops.env` as a GitHub Release asset
+- `ansible/deploy.yml` pulls `flightdeck_app_ref` (the machinery bundle), merges every ref in `flightdeck_app_refs` (the app bundles, at least one required — flightdeck's own `apps/` catalog is just another entry, not implicit), decrypts and merges every ref in `flightdeck_env_refs` (at least one required) into the server's `.env`, switches a timestamped release, and runs `./deploy.sh`
+- `.github/actions/encrypt-env/` is a local composite action for rendering `vaults/` manifests from GitHub Secrets/Variables, encrypting them for age recipients, and publishing `.sops.env` as a GitHub Release asset — vault manifests hold only env/secrets, not app selection
 - `.github/workflows/deploy-shared.yml` is a reusable workflow consumer repos call to run `ansible/deploy.yml` from GitHub Actions over an optional Tailscale connection, without holding any deploy secrets in this repository
 
 App bundles listed in `flightdeck_app_refs` are release assets referenced as short refs like `<owner>/<repo>@latest` or `<owner>/<repo>@v1.2.3`, resolving to a default asset name of `flightdeck-apps.zip` unless the ref specifies an explicit `:asset-name` suffix. `@latest` is resolved by the deploy playbook through GitHub's latest release API. Every bundle must contain an `apps/` directory; app names may not conflict across bundles.
 
+Env packages listed in `flightdeck_env_refs` are release refs the same shape as app bundles, defaulting to a `$tag.sops.env`-named asset. The playbook decrypts each with the server-local SOPS age key, then merges them alongside a synthesized `APPS` line (built from `flightdeck_apps`, the target's own desired app set) — failing loud on any key collision across sources, `APPS` included. `apps` moved off the vault schema onto the target for exactly this reason: multiple vaults can be merged without having to reconcile per-vault `apps` lists.
+
 Private release assets are supported by passing `FLIGHTDECK_GITHUB_TOKEN` as a secret environment variable to `ansible/deploy.yml`. Store it as a secret in whatever system runs the playbook (e.g. a GitHub Actions secret when using `deploy-shared.yml`), not in plain configuration. When the token is present, the playbook exports it as `GH_TOKEN` for `gh release download`.
 
 ## Notable App Configurations

.github/actions/encrypt-env/README.md

@@ -32,12 +32,9 @@ permissions:
 asset: mainframe.sops.env
 keys:
  - mainframe
-apps:
- - traefik
- - rybbit
 env:
  APPS_DOMAIN: APPS_DOMAIN # output name: GitHub Secret/Variable name
  APPS_TIMEZONE: APPS_TIMEZONE
 ```
 
-The action renders `apps` as the comma-separated `APPS` dotenv value. For each name in `keys`, it loads `<keys-directory>/<name>.pub`. Secrets take precedence over Variables when both contain the same source key. Every source key must resolve or the action fails.
+For each name in `keys`, it loads `<keys-directory>/<name>.pub`. Secrets take precedence over Variables when both contain the same source key. Every source key must resolve or the action fails. The manifest has no `apps` field — app selection lives on the deploy target, not the vault; see the main README's "Vaults And Targets" section.

.github/actions/encrypt-env/scripts/render-env.py

@@ -12,7 +12,6 @@
 ENV_NAME_RE = re.compile(r"^[A-Z_][A-Z0-9_]*$")
 SOURCE_NAME_RE = re.compile(r"^[A-Z][A-Z0-9_]*(?:__[A-Z0-9_]+)*$")
 KEY_NAME_RE = re.compile(r"^[a-z0-9][a-z0-9-]*$")
-APP_NAME_RE = re.compile(r"^[a-z0-9]+(?:-[a-z0-9]+)*$")
 ASSET_RE = re.compile(r"^[A-Za-z0-9_.-]+\.sops\.env$")
 
 
@@ -58,31 +57,21 @@ def load_manifest(path):
  raise ManifestError(f"{path} is not valid YAML: {exc}") from exc
  if not isinstance(manifest, dict):
  raise ManifestError(f"{path} must contain a YAML mapping")
- unknown = sorted(set(manifest) - {"asset", "keys", "apps", "env"})
+ unknown = sorted(set(manifest) - {"asset", "keys", "env"})
  if unknown:
  raise ManifestError("manifest contains unknown keys: " + ", ".join(unknown))
  asset = manifest.get("asset")
  keys = manifest.get("keys")
- apps = manifest.get("apps")
  env = manifest.get("env")
  if not isinstance(asset, str) or not ASSET_RE.fullmatch(asset):
  raise ManifestError("asset must be named like server.sops.env")
  if not isinstance(keys, list) or not keys:
  raise ManifestError("keys must be a non-empty list")
- if not isinstance(apps, list) or not apps:
- raise ManifestError("apps must be a non-empty list")
  if not isinstance(env, dict) or not env:
  raise ManifestError("env must be a non-empty mapping")
  for key in keys:
  if not isinstance(key, str) or not KEY_NAME_RE.fullmatch(key):
  raise ManifestError(f"invalid key name: {key!r}")
- for app in apps:
- if not isinstance(app, str) or not APP_NAME_RE.fullmatch(app):
- raise ManifestError(f"invalid app name: {app!r}")
- if len(apps) != len(set(apps)):
- raise ManifestError("apps contains duplicate app names")
- if "APPS" in env:
- raise ManifestError("APPS must be configured through apps")
  for output_name, source_name in env.items():
  if not isinstance(output_name, str) or not ENV_NAME_RE.fullmatch(output_name):
  raise ManifestError(f"invalid output env name: {output_name!r}")
@@ -111,7 +100,7 @@ def resolve_value(source_name, secrets, variables):
 
 
 def render_env(manifest, secrets, variables):
- lines = [f"APPS={','.join(manifest['apps'])}"]
+ lines = []
  missing = []
  for output_name, source_name in manifest["env"].items():
  value = resolve_value(source_name, secrets, variables)

.github/actions/encrypt-env/tests/test_render_env.py

@@ -13,59 +13,33 @@
 
 class RenderEnvTest(unittest.TestCase):
  def test_render_prefers_secrets_over_variables(self):
- manifest = {"apps": ["traefik", "rybbit"], "env": {"DOMAIN": "DOMAIN", "TIMEZONE": "TIMEZONE"}}
+ manifest = {"env": {"DOMAIN": "DOMAIN", "TIMEZONE": "TIMEZONE"}}
  output = render_env.render_env(
  manifest,
  {"DOMAIN": "secret.example"},
  {"DOMAIN": "var.example", "TIMEZONE": "Europe/Berlin"},
  )
  self.assertIn("DOMAIN=secret.example\n", output)
  self.assertIn("TIMEZONE=Europe/Berlin\n", output)
- self.assertIn("APPS=traefik,rybbit\n", output)
 
  def test_quotes_shell_sensitive_values(self):
- output = render_env.render_env(
- {"apps": ["traefik"], "env": {"TOKEN": "TOKEN"}}, {"TOKEN": "hello world"}, {}
- )
+ output = render_env.render_env({"env": {"TOKEN": "TOKEN"}}, {"TOKEN": "hello world"}, {})
  self.assertIn("TOKEN='hello world'\n", output)
 
  def test_rejects_raw_env(self):
  with self.assertRaises(render_env.ManifestError):
  render_env.load_manifest(self.write_manifest("asset: test.sops.env\nraw_env: [APPS]\n"))
 
- def test_rejects_apps_in_env(self):
- manifest = (
- "asset: test.sops.env\n"
- "keys: [test]\n"
- "apps: [traefik]\n"
- "env:\n"
- " APPS: TEST_APPS\n"
- )
- with self.assertRaisesRegex(render_env.ManifestError, "must be configured through"):
- render_env.load_manifest(self.write_manifest(manifest))
-
- def test_rejects_duplicate_apps(self):
- manifest = (
- "asset: test.sops.env\n"
- "keys: [test]\n"
- "apps: [traefik, traefik]\n"
- "env:\n"
- " TOKEN: TOKEN\n"
- )
- with self.assertRaisesRegex(render_env.ManifestError, "duplicate app names"):
- render_env.load_manifest(self.write_manifest(manifest))
-
  def test_missing_source_fails(self):
  with self.assertRaises(render_env.ManifestError):
- render_env.render_env({"apps": ["traefik"], "env": {"TOKEN": "TOKEN"}}, {}, {})
+ render_env.render_env({"env": {"TOKEN": "TOKEN"}}, {}, {})
 
  def test_duplicate_yaml_keys_fail(self):
  with tempfile.TemporaryDirectory() as directory:
  path = Path(directory) / "manifest.yml"
  path.write_text(
  "asset: mainframe.sops.env\n"
  "keys: [master, server]\n"
- "apps: [traefik, rybbit]\n"
  "env:\n"
  " TOKEN: FIRST\n"
  " TOKEN: SECOND\n"
@@ -89,7 +63,6 @@ def test_main_writes_env_and_outputs(self):
  manifest_path.write_text(
  "asset: mainframe.sops.env\n"
  "keys: [master, server]\n"
- "apps: [traefik, rybbit]\n"
  "env:\n"
  " TOKEN: TOKEN\n"
  )
@@ -108,7 +81,6 @@ def test_main_writes_env_and_outputs(self):
  os.environ.update(old_env)
  self.assertEqual(result, 0)
  self.assertIn("TOKEN=secret\n", env_path.read_text())
- self.assertIn("APPS=traefik,rybbit\n", env_path.read_text())
  self.assertIn("asset=mainframe.sops.env\n", outputs_path.read_text())
  self.assertIn("keys=master,server\n", outputs_path.read_text())
 

.github/workflows/deploy-shared.yml

@@ -10,14 +10,18 @@ on:
  description: Full release ref of the Flightdeck bundle to deploy, in owner/repo@tag format.
  type: string
  required: true
- env-ref:
- description: Release ref for the encrypted env package, in owner/repo@tag:asset format.
+ env-refs:
+ description: JSON array of release refs for encrypted env packages to decrypt and merge, in owner/repo@tag[:asset] format.
  type: string
  required: true
  app-refs:
  description: JSON array of release refs for app bundles to merge into the release, in owner/repo@tag[:asset] format.
  type: string
  required: true
+ apps:
+ description: JSON array of app names to run on this target, rendered into the deployed env as APPS.
+ type: string
+ required: true
  path:
  description: Base path on the target host for releases, shared files, and the current symlink.
  type: string
@@ -74,15 +78,18 @@ jobs:
  shell: bash
  env:
  APP_REF: ${{ inputs.app-ref }}
-ENV_REF: ${{ inputs.env-ref }}
+ENV_REFS: ${{ inputs.env-refs }}
  APP_REFS: ${{ inputs.app-refs }}
+ APPS: ${{ inputs.apps }}
  HOSTS: ${{ inputs.hosts }}
  DEPLOY_PATH: ${{ inputs.path }}
  KEEP_RELEASES: ${{ inputs.keep-releases }}
  SOPS_KEY_FILE: ${{ inputs.sops-age-key-file }}
  run: |
  hosts_json="$(jq -ce 'if type == "array" and length > 0 and all(.[]; type == "string" and test("^[a-z_][a-z0-9_-]*@[A-Za-z0-9]([A-Za-z0-9.-]*[A-Za-z0-9])?$")) then . else error("hosts must be a non-empty user@host string array") end' <<< "$HOSTS")"
+ env_refs_json="$(jq -ce 'if type == "array" and length > 0 and all(.[]; type == "string" and length > 0) then . else error("env-refs must be a non-empty string array") end' <<< "$ENV_REFS")"
  app_refs_json="$(jq -ce 'if type == "array" and length > 0 and all(.[]; type == "string" and length > 0) then . else error("app-refs must be a non-empty string array") end' <<< "$APP_REFS")"
+ apps_json="$(jq -ce 'if type == "array" and length > 0 and all(.[]; type == "string" and length > 0) then . else error("apps must be a non-empty string array") end' <<< "$APPS")"
  jq -ce '
  reduce .[] as $destination ({all: {hosts: {}}};
  ($destination | capture("^(?<user>[^@]+)@(?<host>.+)$")) as $ssh |
@@ -91,12 +98,13 @@ jobs:
  ' <<< "$hosts_json" > "$RUNNER_TEMP/flightdeck-inventory.json"
  json="$(jq -n \
  --arg app_ref "$APP_REF" \
- --arg env_ref "$ENV_REF" \
+ --argjson env_refs "$env_refs_json" \
  --argjson app_refs "$app_refs_json" \
+ --argjson apps "$apps_json" \
  --arg path "$DEPLOY_PATH" \
  --argjson keep_releases "$KEEP_RELEASES" \
  --arg sops_key_file "$SOPS_KEY_FILE" \
- '{flightdeck_app_ref: $app_ref, flightdeck_env_ref: $env_ref, flightdeck_app_refs: $app_refs, flightdeck_path: $path, flightdeck_keep_releases: $keep_releases, flightdeck_sops_age_key_file: $sops_key_file}')"
+ '{flightdeck_app_ref: $app_ref, flightdeck_env_refs: $env_refs, flightdeck_app_refs: $app_refs, flightdeck_apps: $apps, flightdeck_path: $path, flightdeck_keep_releases: $keep_releases, flightdeck_sops_age_key_file: $sops_key_file}')"
  echo "json=$json" >> "$GITHUB_OUTPUT"
  echo "inventory=$RUNNER_TEMP/flightdeck-inventory.json" >> "$GITHUB_OUTPUT"
  - name: Run playbook

.github/workflows/deploy.yml

@@ -28,8 +28,9 @@ jobs:
  with:
  hosts: ${{ toJson(matrix.hosts) }}
  app-ref: ${{ matrix.flightdeck_ref }}
- env-ref: ${{ matrix.env_ref }}
+ env-refs: ${{ toJson(matrix.env_refs) }}
  app-refs: ${{ toJson(matrix.app_refs) }}
+ apps: ${{ toJson(matrix.apps) }}
  path: ${{ matrix.path || '~/flightdeck' }}
  keep-releases: ${{ matrix.keep_releases || 5 }}
  sops-age-key-file: ${{ matrix.sops_age_key_file || '~/.config/sops/age/keys.txt' }}

.github/workflows/release.yml

@@ -98,8 +98,9 @@ jobs:
  with:
  hosts: ${{ toJson(matrix.hosts) }}
  app-ref: ${{ matrix.flightdeck_ref }}
- env-ref: ${{ matrix.env_ref }}
+ env-refs: ${{ toJson(matrix.env_refs) }}
  app-refs: ${{ toJson(matrix.app_refs) }}
+ apps: ${{ toJson(matrix.apps) }}
  path: ${{ matrix.path || '~/flightdeck' }}
  keep-releases: ${{ matrix.keep_releases || 5 }}
  sops-age-key-file: ${{ matrix.sops_age_key_file || '~/.config/sops/age/keys.txt' }}

AGENTS.md

@@ -408,12 +408,14 @@ GitHub Actions workflow (`.github/workflows/release-please.yml`) manages release
 
 Deployment helpers live in this repository:
 
-- `ansible/deploy.yml` pulls `flightdeck_app_ref` (the machinery bundle), merges every ref in `flightdeck_app_refs` (the app bundles, at least one required — flightdeck's own `apps/` catalog is just another entry, not implicit), pulls the server-specific encrypted env package from `flightdeck_env_ref`, decrypts `.sops.env` on the server, switches a timestamped release, and runs `./deploy.sh`
-- `.github/actions/encrypt-env/` is a local composite action for rendering `vaults/` manifests from GitHub Secrets/Variables, encrypting them for age recipients, and publishing `.sops.env` as a GitHub Release asset
+- `ansible/deploy.yml` pulls `flightdeck_app_ref` (the machinery bundle), merges every ref in `flightdeck_app_refs` (the app bundles, at least one required — flightdeck's own `apps/` catalog is just another entry, not implicit), decrypts and merges every ref in `flightdeck_env_refs` (at least one required) into the server's `.env`, switches a timestamped release, and runs `./deploy.sh`
+- `.github/actions/encrypt-env/` is a local composite action for rendering `vaults/` manifests from GitHub Secrets/Variables, encrypting them for age recipients, and publishing `.sops.env` as a GitHub Release asset — vault manifests hold only env/secrets, not app selection
 - `.github/workflows/deploy-shared.yml` is a reusable workflow consumer repos call to run `ansible/deploy.yml` from GitHub Actions over an optional Tailscale connection, without holding any deploy secrets in this repository
 
 App bundles listed in `flightdeck_app_refs` are release assets referenced as short refs like `<owner>/<repo>@latest` or `<owner>/<repo>@v1.2.3`, resolving to a default asset name of `flightdeck-apps.zip` unless the ref specifies an explicit `:asset-name` suffix. `@latest` is resolved by the deploy playbook through GitHub's latest release API. Every bundle must contain an `apps/` directory; app names may not conflict across bundles.
 
+Env packages listed in `flightdeck_env_refs` are release refs the same shape as app bundles, defaulting to a `$tag.sops.env`-named asset. The playbook decrypts each with the server-local SOPS age key, then merges them alongside a synthesized `APPS` line (built from `flightdeck_apps`, the target's own desired app set) — failing loud on any key collision across sources, `APPS` included. `apps` moved off the vault schema onto the target for exactly this reason: multiple vaults can be merged without having to reconcile per-vault `apps` lists.
+
 Private release assets are supported by passing `FLIGHTDECK_GITHUB_TOKEN` as a secret environment variable to `ansible/deploy.yml`. Store it as a secret in whatever system runs the playbook (e.g. a GitHub Actions secret when using `deploy-shared.yml`), not in plain configuration. When the token is present, the playbook exports it as `GH_TOKEN` for `gh release download`.
 
 ## Notable App Configurations

.github/actions/encrypt-env/README.md

@@ -32,12 +32,9 @@ permissions:
 asset: mainframe.sops.env
 keys:
  - mainframe
-apps:
- - traefik
- - rybbit
 env:
  APPS_DOMAIN: APPS_DOMAIN # output name: GitHub Secret/Variable name
  APPS_TIMEZONE: APPS_TIMEZONE
 ```
 
-The action renders `apps` as the comma-separated `APPS` dotenv value. For each name in `keys`, it loads `<keys-directory>/<name>.pub`. Secrets take precedence over Variables when both contain the same source key. Every source key must resolve or the action fails.
+For each name in `keys`, it loads `<keys-directory>/<name>.pub`. Secrets take precedence over Variables when both contain the same source key. Every source key must resolve or the action fails. The manifest has no `apps` field — app selection lives on the deploy target, not the vault; see the main README's "Vaults And Targets" section.

.github/actions/encrypt-env/scripts/render-env.py

@@ -12,7 +12,6 @@
 ENV_NAME_RE = re.compile(r"^[A-Z_][A-Z0-9_]*$")
 SOURCE_NAME_RE = re.compile(r"^[A-Z][A-Z0-9_]*(?:__[A-Z0-9_]+)*$")
 KEY_NAME_RE = re.compile(r"^[a-z0-9][a-z0-9-]*$")
-APP_NAME_RE = re.compile(r"^[a-z0-9]+(?:-[a-z0-9]+)*$")
 ASSET_RE = re.compile(r"^[A-Za-z0-9_.-]+\.sops\.env$")
 
 
@@ -58,31 +57,21 @@ def load_manifest(path):
  raise ManifestError(f"{path} is not valid YAML: {exc}") from exc
  if not isinstance(manifest, dict):
  raise ManifestError(f"{path} must contain a YAML mapping")
- unknown = sorted(set(manifest) - {"asset", "keys", "apps", "env"})
+ unknown = sorted(set(manifest) - {"asset", "keys", "env"})
  if unknown:
  raise ManifestError("manifest contains unknown keys: " + ", ".join(unknown))
  asset = manifest.get("asset")
  keys = manifest.get("keys")
- apps = manifest.get("apps")
  env = manifest.get("env")
  if not isinstance(asset, str) or not ASSET_RE.fullmatch(asset):
  raise ManifestError("asset must be named like server.sops.env")
  if not isinstance(keys, list) or not keys:
  raise ManifestError("keys must be a non-empty list")
- if not isinstance(apps, list) or not apps:
- raise ManifestError("apps must be a non-empty list")
  if not isinstance(env, dict) or not env:
  raise ManifestError("env must be a non-empty mapping")
  for key in keys:
  if not isinstance(key, str) or not KEY_NAME_RE.fullmatch(key):
  raise ManifestError(f"invalid key name: {key!r}")
- for app in apps:
- if not isinstance(app, str) or not APP_NAME_RE.fullmatch(app):
- raise ManifestError(f"invalid app name: {app!r}")
- if len(apps) != len(set(apps)):
- raise ManifestError("apps contains duplicate app names")
- if "APPS" in env:
- raise ManifestError("APPS must be configured through apps")
  for output_name, source_name in env.items():
  if not isinstance(output_name, str) or not ENV_NAME_RE.fullmatch(output_name):
  raise ManifestError(f"invalid output env name: {output_name!r}")
@@ -111,7 +100,7 @@ def resolve_value(source_name, secrets, variables):
 
 
 def render_env(manifest, secrets, variables):
- lines = [f"APPS={','.join(manifest['apps'])}"]
+ lines = []
  missing = []
  for output_name, source_name in manifest["env"].items():
  value = resolve_value(source_name, secrets, variables)

.github/actions/encrypt-env/tests/test_render_env.py

@@ -13,59 +13,33 @@
 
 class RenderEnvTest(unittest.TestCase):
  def test_render_prefers_secrets_over_variables(self):
- manifest = {"apps": ["traefik", "rybbit"], "env": {"DOMAIN": "DOMAIN", "TIMEZONE": "TIMEZONE"}}
+ manifest = {"env": {"DOMAIN": "DOMAIN", "TIMEZONE": "TIMEZONE"}}
  output = render_env.render_env(
  manifest,
  {"DOMAIN": "secret.example"},
  {"DOMAIN": "var.example", "TIMEZONE": "Europe/Berlin"},
  )
  self.assertIn("DOMAIN=secret.example\n", output)
  self.assertIn("TIMEZONE=Europe/Berlin\n", output)
- self.assertIn("APPS=traefik,rybbit\n", output)
 
  def test_quotes_shell_sensitive_values(self):
- output = render_env.render_env(
- {"apps": ["traefik"], "env": {"TOKEN": "TOKEN"}}, {"TOKEN": "hello world"}, {}
- )
+ output = render_env.render_env({"env": {"TOKEN": "TOKEN"}}, {"TOKEN": "hello world"}, {})
  self.assertIn("TOKEN='hello world'\n", output)
 
  def test_rejects_raw_env(self):
  with self.assertRaises(render_env.ManifestError):
  render_env.load_manifest(self.write_manifest("asset: test.sops.env\nraw_env: [APPS]\n"))
 
- def test_rejects_apps_in_env(self):
- manifest = (
- "asset: test.sops.env\n"
- "keys: [test]\n"
- "apps: [traefik]\n"
- "env:\n"
- " APPS: TEST_APPS\n"
- )
- with self.assertRaisesRegex(render_env.ManifestError, "must be configured through"):
- render_env.load_manifest(self.write_manifest(manifest))
-
- def test_rejects_duplicate_apps(self):
- manifest = (
- "asset: test.sops.env\n"
- "keys: [test]\n"
- "apps: [traefik, traefik]\n"
- "env:\n"
- " TOKEN: TOKEN\n"
- )
- with self.assertRaisesRegex(render_env.ManifestError, "duplicate app names"):
- render_env.load_manifest(self.write_manifest(manifest))
-
  def test_missing_source_fails(self):
  with self.assertRaises(render_env.ManifestError):
- render_env.render_env({"apps": ["traefik"], "env": {"TOKEN": "TOKEN"}}, {}, {})
+ render_env.render_env({"env": {"TOKEN": "TOKEN"}}, {}, {})
 
  def test_duplicate_yaml_keys_fail(self):
  with tempfile.TemporaryDirectory() as directory:
  path = Path(directory) / "manifest.yml"
  path.write_text(
  "asset: mainframe.sops.env\n"
  "keys: [master, server]\n"
- "apps: [traefik, rybbit]\n"
  "env:\n"
  " TOKEN: FIRST\n"
  " TOKEN: SECOND\n"
@@ -89,7 +63,6 @@ def test_main_writes_env_and_outputs(self):
  manifest_path.write_text(
  "asset: mainframe.sops.env\n"
  "keys: [master, server]\n"
- "apps: [traefik, rybbit]\n"
  "env:\n"
  " TOKEN: TOKEN\n"
  )
@@ -108,7 +81,6 @@ def test_main_writes_env_and_outputs(self):
  os.environ.update(old_env)
  self.assertEqual(result, 0)
  self.assertIn("TOKEN=secret\n", env_path.read_text())
- self.assertIn("APPS=traefik,rybbit\n", env_path.read_text())
  self.assertIn("asset=mainframe.sops.env\n", outputs_path.read_text())
  self.assertIn("keys=master,server\n", outputs_path.read_text())
 

.github/workflows/deploy-shared.yml

@@ -10,14 +10,18 @@ on:
  description: Full release ref of the Flightdeck bundle to deploy, in owner/repo@tag format.
  type: string
  required: true
- env-ref:
- description: Release ref for the encrypted env package, in owner/repo@tag:asset format.
+ env-refs:
+ description: JSON array of release refs for encrypted env packages to decrypt and merge, in owner/repo@tag[:asset] format.
  type: string
  required: true
  app-refs:
  description: JSON array of release refs for app bundles to merge into the release, in owner/repo@tag[:asset] format.
  type: string
  required: true
+ apps:
+ description: JSON array of app names to run on this target, rendered into the deployed env as APPS.
+ type: string
+ required: true
  path:
  description: Base path on the target host for releases, shared files, and the current symlink.
  type: string
@@ -74,15 +78,18 @@ jobs:
  shell: bash
  env:
  APP_REF: ${{ inputs.app-ref }}
-ENV_REF: ${{ inputs.env-ref }}
+ENV_REFS: ${{ inputs.env-refs }}
  APP_REFS: ${{ inputs.app-refs }}
+ APPS: ${{ inputs.apps }}
  HOSTS: ${{ inputs.hosts }}
  DEPLOY_PATH: ${{ inputs.path }}
  KEEP_RELEASES: ${{ inputs.keep-releases }}
  SOPS_KEY_FILE: ${{ inputs.sops-age-key-file }}
  run: |
  hosts_json="$(jq -ce 'if type == "array" and length > 0 and all(.[]; type == "string" and test("^[a-z_][a-z0-9_-]*@[A-Za-z0-9]([A-Za-z0-9.-]*[A-Za-z0-9])?$")) then . else error("hosts must be a non-empty user@host string array") end' <<< "$HOSTS")"
+ env_refs_json="$(jq -ce 'if type == "array" and length > 0 and all(.[]; type == "string" and length > 0) then . else error("env-refs must be a non-empty string array") end' <<< "$ENV_REFS")"
  app_refs_json="$(jq -ce 'if type == "array" and length > 0 and all(.[]; type == "string" and length > 0) then . else error("app-refs must be a non-empty string array") end' <<< "$APP_REFS")"
+ apps_json="$(jq -ce 'if type == "array" and length > 0 and all(.[]; type == "string" and length > 0) then . else error("apps must be a non-empty string array") end' <<< "$APPS")"
  jq -ce '
  reduce .[] as $destination ({all: {hosts: {}}};
  ($destination | capture("^(?<user>[^@]+)@(?<host>.+)$")) as $ssh |
@@ -91,12 +98,13 @@ jobs:
  ' <<< "$hosts_json" > "$RUNNER_TEMP/flightdeck-inventory.json"
  json="$(jq -n \
  --arg app_ref "$APP_REF" \
- --arg env_ref "$ENV_REF" \
+ --argjson env_refs "$env_refs_json" \
  --argjson app_refs "$app_refs_json" \
+ --argjson apps "$apps_json" \
  --arg path "$DEPLOY_PATH" \
  --argjson keep_releases "$KEEP_RELEASES" \
  --arg sops_key_file "$SOPS_KEY_FILE" \
- '{flightdeck_app_ref: $app_ref, flightdeck_env_ref: $env_ref, flightdeck_app_refs: $app_refs, flightdeck_path: $path, flightdeck_keep_releases: $keep_releases, flightdeck_sops_age_key_file: $sops_key_file}')"
+ '{flightdeck_app_ref: $app_ref, flightdeck_env_refs: $env_refs, flightdeck_app_refs: $app_refs, flightdeck_apps: $apps, flightdeck_path: $path, flightdeck_keep_releases: $keep_releases, flightdeck_sops_age_key_file: $sops_key_file}')"
  echo "json=$json" >> "$GITHUB_OUTPUT"
  echo "inventory=$RUNNER_TEMP/flightdeck-inventory.json" >> "$GITHUB_OUTPUT"
  - name: Run playbook

.github/workflows/deploy.yml

@@ -28,8 +28,9 @@ jobs:
  with:
  hosts: ${{ toJson(matrix.hosts) }}
  app-ref: ${{ matrix.flightdeck_ref }}
- env-ref: ${{ matrix.env_ref }}
+ env-refs: ${{ toJson(matrix.env_refs) }}
  app-refs: ${{ toJson(matrix.app_refs) }}
+ apps: ${{ toJson(matrix.apps) }}
  path: ${{ matrix.path || '~/flightdeck' }}
  keep-releases: ${{ matrix.keep_releases || 5 }}
  sops-age-key-file: ${{ matrix.sops_age_key_file || '~/.config/sops/age/keys.txt' }}

.github/workflows/release.yml

@@ -98,8 +98,9 @@ jobs:
  with:
  hosts: ${{ toJson(matrix.hosts) }}
  app-ref: ${{ matrix.flightdeck_ref }}
- env-ref: ${{ matrix.env_ref }}
+ env-refs: ${{ toJson(matrix.env_refs) }}
  app-refs: ${{ toJson(matrix.app_refs) }}
+ apps: ${{ toJson(matrix.apps) }}
  path: ${{ matrix.path || '~/flightdeck' }}
  keep-releases: ${{ matrix.keep_releases || 5 }}
  sops-age-key-file: ${{ matrix.sops_age_key_file || '~/.config/sops/age/keys.txt' }}

AGENTS.md

@@ -408,12 +408,14 @@ GitHub Actions workflow (`.github/workflows/release-please.yml`) manages release
 
 Deployment helpers live in this repository:
 
-- `ansible/deploy.yml` pulls `flightdeck_app_ref` (the machinery bundle), merges every ref in `flightdeck_app_refs` (the app bundles, at least one required — flightdeck's own `apps/` catalog is just another entry, not implicit), pulls the server-specific encrypted env package from `flightdeck_env_ref`, decrypts `.sops.env` on the server, switches a timestamped release, and runs `./deploy.sh`
-- `.github/actions/encrypt-env/` is a local composite action for rendering `vaults/` manifests from GitHub Secrets/Variables, encrypting them for age recipients, and publishing `.sops.env` as a GitHub Release asset
+- `ansible/deploy.yml` pulls `flightdeck_app_ref` (the machinery bundle), merges every ref in `flightdeck_app_refs` (the app bundles, at least one required — flightdeck's own `apps/` catalog is just another entry, not implicit), decrypts and merges every ref in `flightdeck_env_refs` (at least one required) into the server's `.env`, switches a timestamped release, and runs `./deploy.sh`
+- `.github/actions/encrypt-env/` is a local composite action for rendering `vaults/` manifests from GitHub Secrets/Variables, encrypting them for age recipients, and publishing `.sops.env` as a GitHub Release asset — vault manifests hold only env/secrets, not app selection
 - `.github/workflows/deploy-shared.yml` is a reusable workflow consumer repos call to run `ansible/deploy.yml` from GitHub Actions over an optional Tailscale connection, without holding any deploy secrets in this repository
 
 App bundles listed in `flightdeck_app_refs` are release assets referenced as short refs like `<owner>/<repo>@latest` or `<owner>/<repo>@v1.2.3`, resolving to a default asset name of `flightdeck-apps.zip` unless the ref specifies an explicit `:asset-name` suffix. `@latest` is resolved by the deploy playbook through GitHub's latest release API. Every bundle must contain an `apps/` directory; app names may not conflict across bundles.
 
+Env packages listed in `flightdeck_env_refs` are release refs the same shape as app bundles, defaulting to a `$tag.sops.env`-named asset. The playbook decrypts each with the server-local SOPS age key, then merges them alongside a synthesized `APPS` line (built from `flightdeck_apps`, the target's own desired app set) — failing loud on any key collision across sources, `APPS` included. `apps` moved off the vault schema onto the target for exactly this reason: multiple vaults can be merged without having to reconcile per-vault `apps` lists.
+
 Private release assets are supported by passing `FLIGHTDECK_GITHUB_TOKEN` as a secret environment variable to `ansible/deploy.yml`. Store it as a secret in whatever system runs the playbook (e.g. a GitHub Actions secret when using `deploy-shared.yml`), not in plain configuration. When the token is present, the playbook exports it as `GH_TOKEN` for `gh release download`.
 
 ## Notable App Configurations

.github/actions/encrypt-env/README.md

@@ -32,12 +32,9 @@ permissions:
 asset: mainframe.sops.env
 keys:
  - mainframe
-apps:
- - traefik
- - rybbit
 env:
  APPS_DOMAIN: APPS_DOMAIN # output name: GitHub Secret/Variable name
  APPS_TIMEZONE: APPS_TIMEZONE
 ```
 
-The action renders `apps` as the comma-separated `APPS` dotenv value. For each name in `keys`, it loads `<keys-directory>/<name>.pub`. Secrets take precedence over Variables when both contain the same source key. Every source key must resolve or the action fails.
+For each name in `keys`, it loads `<keys-directory>/<name>.pub`. Secrets take precedence over Variables when both contain the same source key. Every source key must resolve or the action fails. The manifest has no `apps` field — app selection lives on the deploy target, not the vault; see the main README's "Vaults And Targets" section.

.github/actions/encrypt-env/scripts/render-env.py

@@ -12,7 +12,6 @@
 ENV_NAME_RE = re.compile(r"^[A-Z_][A-Z0-9_]*$")
 SOURCE_NAME_RE = re.compile(r"^[A-Z][A-Z0-9_]*(?:__[A-Z0-9_]+)*$")
 KEY_NAME_RE = re.compile(r"^[a-z0-9][a-z0-9-]*$")
-APP_NAME_RE = re.compile(r"^[a-z0-9]+(?:-[a-z0-9]+)*$")
 ASSET_RE = re.compile(r"^[A-Za-z0-9_.-]+\.sops\.env$")
 
 
@@ -58,31 +57,21 @@ def load_manifest(path):
  raise ManifestError(f"{path} is not valid YAML: {exc}") from exc
  if not isinstance(manifest, dict):
  raise ManifestError(f"{path} must contain a YAML mapping")
- unknown = sorted(set(manifest) - {"asset", "keys", "apps", "env"})
+ unknown = sorted(set(manifest) - {"asset", "keys", "env"})
  if unknown:
  raise ManifestError("manifest contains unknown keys: " + ", ".join(unknown))
  asset = manifest.get("asset")
  keys = manifest.get("keys")
- apps = manifest.get("apps")
  env = manifest.get("env")
  if not isinstance(asset, str) or not ASSET_RE.fullmatch(asset):
  raise ManifestError("asset must be named like server.sops.env")
  if not isinstance(keys, list) or not keys:
  raise ManifestError("keys must be a non-empty list")
- if not isinstance(apps, list) or not apps:
- raise ManifestError("apps must be a non-empty list")
  if not isinstance(env, dict) or not env:
  raise ManifestError("env must be a non-empty mapping")
  for key in keys:
  if not isinstance(key, str) or not KEY_NAME_RE.fullmatch(key):
  raise ManifestError(f"invalid key name: {key!r}")
- for app in apps:
- if not isinstance(app, str) or not APP_NAME_RE.fullmatch(app):
- raise ManifestError(f"invalid app name: {app!r}")
- if len(apps) != len(set(apps)):
- raise ManifestError("apps contains duplicate app names")
- if "APPS" in env:
- raise ManifestError("APPS must be configured through apps")
  for output_name, source_name in env.items():
  if not isinstance(output_name, str) or not ENV_NAME_RE.fullmatch(output_name):
  raise ManifestError(f"invalid output env name: {output_name!r}")
@@ -111,7 +100,7 @@ def resolve_value(source_name, secrets, variables):
 
 
 def render_env(manifest, secrets, variables):
- lines = [f"APPS={','.join(manifest['apps'])}"]
+ lines = []
  missing = []
  for output_name, source_name in manifest["env"].items():
  value = resolve_value(source_name, secrets, variables)

.github/actions/encrypt-env/tests/test_render_env.py

@@ -13,59 +13,33 @@
 
 class RenderEnvTest(unittest.TestCase):
  def test_render_prefers_secrets_over_variables(self):
- manifest = {"apps": ["traefik", "rybbit"], "env": {"DOMAIN": "DOMAIN", "TIMEZONE": "TIMEZONE"}}
+ manifest = {"env": {"DOMAIN": "DOMAIN", "TIMEZONE": "TIMEZONE"}}
  output = render_env.render_env(
  manifest,
  {"DOMAIN": "secret.example"},
  {"DOMAIN": "var.example", "TIMEZONE": "Europe/Berlin"},
  )
  self.assertIn("DOMAIN=secret.example\n", output)
  self.assertIn("TIMEZONE=Europe/Berlin\n", output)
- self.assertIn("APPS=traefik,rybbit\n", output)
 
  def test_quotes_shell_sensitive_values(self):
- output = render_env.render_env(
- {"apps": ["traefik"], "env": {"TOKEN": "TOKEN"}}, {"TOKEN": "hello world"}, {}
- )
+ output = render_env.render_env({"env": {"TOKEN": "TOKEN"}}, {"TOKEN": "hello world"}, {})
  self.assertIn("TOKEN='hello world'\n", output)
 
  def test_rejects_raw_env(self):
  with self.assertRaises(render_env.ManifestError):
  render_env.load_manifest(self.write_manifest("asset: test.sops.env\nraw_env: [APPS]\n"))
 
- def test_rejects_apps_in_env(self):
- manifest = (
- "asset: test.sops.env\n"
- "keys: [test]\n"
- "apps: [traefik]\n"
- "env:\n"
- " APPS: TEST_APPS\n"
- )
- with self.assertRaisesRegex(render_env.ManifestError, "must be configured through"):
- render_env.load_manifest(self.write_manifest(manifest))
-
- def test_rejects_duplicate_apps(self):
- manifest = (
- "asset: test.sops.env\n"
- "keys: [test]\n"
- "apps: [traefik, traefik]\n"
- "env:\n"
- " TOKEN: TOKEN\n"
- )
- with self.assertRaisesRegex(render_env.ManifestError, "duplicate app names"):
- render_env.load_manifest(self.write_manifest(manifest))
-
  def test_missing_source_fails(self):
  with self.assertRaises(render_env.ManifestError):
- render_env.render_env({"apps": ["traefik"], "env": {"TOKEN": "TOKEN"}}, {}, {})
+ render_env.render_env({"env": {"TOKEN": "TOKEN"}}, {}, {})
 
  def test_duplicate_yaml_keys_fail(self):
  with tempfile.TemporaryDirectory() as directory:
  path = Path(directory) / "manifest.yml"
  path.write_text(
  "asset: mainframe.sops.env\n"
  "keys: [master, server]\n"
- "apps: [traefik, rybbit]\n"
  "env:\n"
  " TOKEN: FIRST\n"
  " TOKEN: SECOND\n"
@@ -89,7 +63,6 @@ def test_main_writes_env_and_outputs(self):
  manifest_path.write_text(
  "asset: mainframe.sops.env\n"
  "keys: [master, server]\n"
- "apps: [traefik, rybbit]\n"
  "env:\n"
  " TOKEN: TOKEN\n"
  )
@@ -108,7 +81,6 @@ def test_main_writes_env_and_outputs(self):
  os.environ.update(old_env)
  self.assertEqual(result, 0)
  self.assertIn("TOKEN=secret\n", env_path.read_text())
- self.assertIn("APPS=traefik,rybbit\n", env_path.read_text())
  self.assertIn("asset=mainframe.sops.env\n", outputs_path.read_text())
  self.assertIn("keys=master,server\n", outputs_path.read_text())
 

.github/workflows/deploy-shared.yml

@@ -10,14 +10,18 @@ on:
  description: Full release ref of the Flightdeck bundle to deploy, in owner/repo@tag format.
  type: string
  required: true
- env-ref:
- description: Release ref for the encrypted env package, in owner/repo@tag:asset format.
+ env-refs:
+ description: JSON array of release refs for encrypted env packages to decrypt and merge, in owner/repo@tag[:asset] format.
  type: string
  required: true
  app-refs:
  description: JSON array of release refs for app bundles to merge into the release, in owner/repo@tag[:asset] format.
  type: string
  required: true
+ apps:
+ description: JSON array of app names to run on this target, rendered into the deployed env as APPS.
+ type: string
+ required: true
  path:
  description: Base path on the target host for releases, shared files, and the current symlink.
  type: string
@@ -74,15 +78,18 @@ jobs:
  shell: bash
  env:
  APP_REF: ${{ inputs.app-ref }}
-ENV_REF: ${{ inputs.env-ref }}
+ENV_REFS: ${{ inputs.env-refs }}
  APP_REFS: ${{ inputs.app-refs }}
+ APPS: ${{ inputs.apps }}
  HOSTS: ${{ inputs.hosts }}
  DEPLOY_PATH: ${{ inputs.path }}
  KEEP_RELEASES: ${{ inputs.keep-releases }}
  SOPS_KEY_FILE: ${{ inputs.sops-age-key-file }}
  run: |
  hosts_json="$(jq -ce 'if type == "array" and length > 0 and all(.[]; type == "string" and test("^[a-z_][a-z0-9_-]*@[A-Za-z0-9]([A-Za-z0-9.-]*[A-Za-z0-9])?$")) then . else error("hosts must be a non-empty user@host string array") end' <<< "$HOSTS")"
+ env_refs_json="$(jq -ce 'if type == "array" and length > 0 and all(.[]; type == "string" and length > 0) then . else error("env-refs must be a non-empty string array") end' <<< "$ENV_REFS")"
  app_refs_json="$(jq -ce 'if type == "array" and length > 0 and all(.[]; type == "string" and length > 0) then . else error("app-refs must be a non-empty string array") end' <<< "$APP_REFS")"
+ apps_json="$(jq -ce 'if type == "array" and length > 0 and all(.[]; type == "string" and length > 0) then . else error("apps must be a non-empty string array") end' <<< "$APPS")"
  jq -ce '
  reduce .[] as $destination ({all: {hosts: {}}};
  ($destination | capture("^(?<user>[^@]+)@(?<host>.+)$")) as $ssh |
@@ -91,12 +98,13 @@ jobs:
  ' <<< "$hosts_json" > "$RUNNER_TEMP/flightdeck-inventory.json"
  json="$(jq -n \
  --arg app_ref "$APP_REF" \
- --arg env_ref "$ENV_REF" \
+ --argjson env_refs "$env_refs_json" \
  --argjson app_refs "$app_refs_json" \
+ --argjson apps "$apps_json" \
  --arg path "$DEPLOY_PATH" \
  --argjson keep_releases "$KEEP_RELEASES" \
  --arg sops_key_file "$SOPS_KEY_FILE" \
- '{flightdeck_app_ref: $app_ref, flightdeck_env_ref: $env_ref, flightdeck_app_refs: $app_refs, flightdeck_path: $path, flightdeck_keep_releases: $keep_releases, flightdeck_sops_age_key_file: $sops_key_file}')"
+ '{flightdeck_app_ref: $app_ref, flightdeck_env_refs: $env_refs, flightdeck_app_refs: $app_refs, flightdeck_apps: $apps, flightdeck_path: $path, flightdeck_keep_releases: $keep_releases, flightdeck_sops_age_key_file: $sops_key_file}')"
  echo "json=$json" >> "$GITHUB_OUTPUT"
  echo "inventory=$RUNNER_TEMP/flightdeck-inventory.json" >> "$GITHUB_OUTPUT"
  - name: Run playbook

.github/workflows/deploy.yml

@@ -28,8 +28,9 @@ jobs:
  with:
  hosts: ${{ toJson(matrix.hosts) }}
  app-ref: ${{ matrix.flightdeck_ref }}
- env-ref: ${{ matrix.env_ref }}
+ env-refs: ${{ toJson(matrix.env_refs) }}
  app-refs: ${{ toJson(matrix.app_refs) }}
+ apps: ${{ toJson(matrix.apps) }}
  path: ${{ matrix.path || '~/flightdeck' }}
  keep-releases: ${{ matrix.keep_releases || 5 }}
  sops-age-key-file: ${{ matrix.sops_age_key_file || '~/.config/sops/age/keys.txt' }}

.github/workflows/release.yml

@@ -98,8 +98,9 @@ jobs:
  with:
  hosts: ${{ toJson(matrix.hosts) }}
  app-ref: ${{ matrix.flightdeck_ref }}
- env-ref: ${{ matrix.env_ref }}
+ env-refs: ${{ toJson(matrix.env_refs) }}
  app-refs: ${{ toJson(matrix.app_refs) }}
+ apps: ${{ toJson(matrix.apps) }}
  path: ${{ matrix.path || '~/flightdeck' }}
  keep-releases: ${{ matrix.keep_releases || 5 }}
  sops-age-key-file: ${{ matrix.sops_age_key_file || '~/.config/sops/age/keys.txt' }}

AGENTS.md

@@ -408,12 +408,14 @@ GitHub Actions workflow (`.github/workflows/release-please.yml`) manages release
 
 Deployment helpers live in this repository:
 
-- `ansible/deploy.yml` pulls `flightdeck_app_ref` (the machinery bundle), merges every ref in `flightdeck_app_refs` (the app bundles, at least one required — flightdeck's own `apps/` catalog is just another entry, not implicit), pulls the server-specific encrypted env package from `flightdeck_env_ref`, decrypts `.sops.env` on the server, switches a timestamped release, and runs `./deploy.sh`
-- `.github/actions/encrypt-env/` is a local composite action for rendering `vaults/` manifests from GitHub Secrets/Variables, encrypting them for age recipients, and publishing `.sops.env` as a GitHub Release asset
+- `ansible/deploy.yml` pulls `flightdeck_app_ref` (the machinery bundle), merges every ref in `flightdeck_app_refs` (the app bundles, at least one required — flightdeck's own `apps/` catalog is just another entry, not implicit), decrypts and merges every ref in `flightdeck_env_refs` (at least one required) into the server's `.env`, switches a timestamped release, and runs `./deploy.sh`
+- `.github/actions/encrypt-env/` is a local composite action for rendering `vaults/` manifests from GitHub Secrets/Variables, encrypting them for age recipients, and publishing `.sops.env` as a GitHub Release asset — vault manifests hold only env/secrets, not app selection
 - `.github/workflows/deploy-shared.yml` is a reusable workflow consumer repos call to run `ansible/deploy.yml` from GitHub Actions over an optional Tailscale connection, without holding any deploy secrets in this repository
 
 App bundles listed in `flightdeck_app_refs` are release assets referenced as short refs like `<owner>/<repo>@latest` or `<owner>/<repo>@v1.2.3`, resolving to a default asset name of `flightdeck-apps.zip` unless the ref specifies an explicit `:asset-name` suffix. `@latest` is resolved by the deploy playbook through GitHub's latest release API. Every bundle must contain an `apps/` directory; app names may not conflict across bundles.
 
+Env packages listed in `flightdeck_env_refs` are release refs the same shape as app bundles, defaulting to a `$tag.sops.env`-named asset. The playbook decrypts each with the server-local SOPS age key, then merges them alongside a synthesized `APPS` line (built from `flightdeck_apps`, the target's own desired app set) — failing loud on any key collision across sources, `APPS` included. `apps` moved off the vault schema onto the target for exactly this reason: multiple vaults can be merged without having to reconcile per-vault `apps` lists.
+
 Private release assets are supported by passing `FLIGHTDECK_GITHUB_TOKEN` as a secret environment variable to `ansible/deploy.yml`. Store it as a secret in whatever system runs the playbook (e.g. a GitHub Actions secret when using `deploy-shared.yml`), not in plain configuration. When the token is present, the playbook exports it as `GH_TOKEN` for `gh release download`.
 
 ## Notable App Configurations

.github/actions/encrypt-env/README.md

@@ -32,12 +32,9 @@ permissions:
 asset: mainframe.sops.env
 keys:
  - mainframe
-apps:
- - traefik
- - rybbit
 env:
  APPS_DOMAIN: APPS_DOMAIN # output name: GitHub Secret/Variable name
  APPS_TIMEZONE: APPS_TIMEZONE
 ```
 
-The action renders `apps` as the comma-separated `APPS` dotenv value. For each name in `keys`, it loads `<keys-directory>/<name>.pub`. Secrets take precedence over Variables when both contain the same source key. Every source key must resolve or the action fails.
+For each name in `keys`, it loads `<keys-directory>/<name>.pub`. Secrets take precedence over Variables when both contain the same source key. Every source key must resolve or the action fails. The manifest has no `apps` field — app selection lives on the deploy target, not the vault; see the main README's "Vaults And Targets" section.

.github/actions/encrypt-env/scripts/render-env.py

@@ -12,7 +12,6 @@
 ENV_NAME_RE = re.compile(r"^[A-Z_][A-Z0-9_]*$")
 SOURCE_NAME_RE = re.compile(r"^[A-Z][A-Z0-9_]*(?:__[A-Z0-9_]+)*$")
 KEY_NAME_RE = re.compile(r"^[a-z0-9][a-z0-9-]*$")
-APP_NAME_RE = re.compile(r"^[a-z0-9]+(?:-[a-z0-9]+)*$")
 ASSET_RE = re.compile(r"^[A-Za-z0-9_.-]+\.sops\.env$")
 
 
@@ -58,31 +57,21 @@ def load_manifest(path):
  raise ManifestError(f"{path} is not valid YAML: {exc}") from exc
  if not isinstance(manifest, dict):
  raise ManifestError(f"{path} must contain a YAML mapping")
- unknown = sorted(set(manifest) - {"asset", "keys", "apps", "env"})
+ unknown = sorted(set(manifest) - {"asset", "keys", "env"})
  if unknown:
  raise ManifestError("manifest contains unknown keys: " + ", ".join(unknown))
  asset = manifest.get("asset")
  keys = manifest.get("keys")
- apps = manifest.get("apps")
  env = manifest.get("env")
  if not isinstance(asset, str) or not ASSET_RE.fullmatch(asset):
  raise ManifestError("asset must be named like server.sops.env")
  if not isinstance(keys, list) or not keys:
  raise ManifestError("keys must be a non-empty list")
- if not isinstance(apps, list) or not apps:
- raise ManifestError("apps must be a non-empty list")
  if not isinstance(env, dict) or not env:
  raise ManifestError("env must be a non-empty mapping")
  for key in keys:
  if not isinstance(key, str) or not KEY_NAME_RE.fullmatch(key):
  raise ManifestError(f"invalid key name: {key!r}")
- for app in apps:
- if not isinstance(app, str) or not APP_NAME_RE.fullmatch(app):
- raise ManifestError(f"invalid app name: {app!r}")
- if len(apps) != len(set(apps)):
- raise ManifestError("apps contains duplicate app names")
- if "APPS" in env:
- raise ManifestError("APPS must be configured through apps")
  for output_name, source_name in env.items():
  if not isinstance(output_name, str) or not ENV_NAME_RE.fullmatch(output_name):
  raise ManifestError(f"invalid output env name: {output_name!r}")
@@ -111,7 +100,7 @@ def resolve_value(source_name, secrets, variables):
 
 
 def render_env(manifest, secrets, variables):
- lines = [f"APPS={','.join(manifest['apps'])}"]
+ lines = []
  missing = []
  for output_name, source_name in manifest["env"].items():
  value = resolve_value(source_name, secrets, variables)

.github/actions/encrypt-env/tests/test_render_env.py

@@ -13,59 +13,33 @@
 
 class RenderEnvTest(unittest.TestCase):
  def test_render_prefers_secrets_over_variables(self):
- manifest = {"apps": ["traefik", "rybbit"], "env": {"DOMAIN": "DOMAIN", "TIMEZONE": "TIMEZONE"}}
+ manifest = {"env": {"DOMAIN": "DOMAIN", "TIMEZONE": "TIMEZONE"}}
  output = render_env.render_env(
  manifest,
  {"DOMAIN": "secret.example"},
  {"DOMAIN": "var.example", "TIMEZONE": "Europe/Berlin"},
  )
  self.assertIn("DOMAIN=secret.example\n", output)
  self.assertIn("TIMEZONE=Europe/Berlin\n", output)
- self.assertIn("APPS=traefik,rybbit\n", output)
 
  def test_quotes_shell_sensitive_values(self):
- output = render_env.render_env(
- {"apps": ["traefik"], "env": {"TOKEN": "TOKEN"}}, {"TOKEN": "hello world"}, {}
- )
+ output = render_env.render_env({"env": {"TOKEN": "TOKEN"}}, {"TOKEN": "hello world"}, {})
  self.assertIn("TOKEN='hello world'\n", output)
 
  def test_rejects_raw_env(self):
  with self.assertRaises(render_env.ManifestError):
  render_env.load_manifest(self.write_manifest("asset: test.sops.env\nraw_env: [APPS]\n"))
 
- def test_rejects_apps_in_env(self):
- manifest = (
- "asset: test.sops.env\n"
- "keys: [test]\n"
- "apps: [traefik]\n"
- "env:\n"
- " APPS: TEST_APPS\n"
- )
- with self.assertRaisesRegex(render_env.ManifestError, "must be configured through"):
- render_env.load_manifest(self.write_manifest(manifest))
-
- def test_rejects_duplicate_apps(self):
- manifest = (
- "asset: test.sops.env\n"
- "keys: [test]\n"
- "apps: [traefik, traefik]\n"
- "env:\n"
- " TOKEN: TOKEN\n"
- )
- with self.assertRaisesRegex(render_env.ManifestError, "duplicate app names"):
- render_env.load_manifest(self.write_manifest(manifest))
-
  def test_missing_source_fails(self):
  with self.assertRaises(render_env.ManifestError):
- render_env.render_env({"apps": ["traefik"], "env": {"TOKEN": "TOKEN"}}, {}, {})
+ render_env.render_env({"env": {"TOKEN": "TOKEN"}}, {}, {})
 
  def test_duplicate_yaml_keys_fail(self):
  with tempfile.TemporaryDirectory() as directory:
  path = Path(directory) / "manifest.yml"
  path.write_text(
  "asset: mainframe.sops.env\n"
  "keys: [master, server]\n"
- "apps: [traefik, rybbit]\n"
  "env:\n"
  " TOKEN: FIRST\n"
  " TOKEN: SECOND\n"
@@ -89,7 +63,6 @@ def test_main_writes_env_and_outputs(self):
  manifest_path.write_text(
  "asset: mainframe.sops.env\n"
  "keys: [master, server]\n"
- "apps: [traefik, rybbit]\n"
  "env:\n"
  " TOKEN: TOKEN\n"
  )
@@ -108,7 +81,6 @@ def test_main_writes_env_and_outputs(self):
  os.environ.update(old_env)
  self.assertEqual(result, 0)
  self.assertIn("TOKEN=secret\n", env_path.read_text())
- self.assertIn("APPS=traefik,rybbit\n", env_path.read_text())
  self.assertIn("asset=mainframe.sops.env\n", outputs_path.read_text())
  self.assertIn("keys=master,server\n", outputs_path.read_text())
 

.github/workflows/deploy-shared.yml

@@ -10,14 +10,18 @@ on:
  description: Full release ref of the Flightdeck bundle to deploy, in owner/repo@tag format.
  type: string
  required: true
- env-ref:
- description: Release ref for the encrypted env package, in owner/repo@tag:asset format.
+ env-refs:
+ description: JSON array of release refs for encrypted env packages to decrypt and merge, in owner/repo@tag[:asset] format.
  type: string
  required: true
  app-refs:
  description: JSON array of release refs for app bundles to merge into the release, in owner/repo@tag[:asset] format.
  type: string
  required: true
+ apps:
+ description: JSON array of app names to run on this target, rendered into the deployed env as APPS.
+ type: string
+ required: true
  path:
  description: Base path on the target host for releases, shared files, and the current symlink.
  type: string
@@ -74,15 +78,18 @@ jobs:
  shell: bash
  env:
  APP_REF: ${{ inputs.app-ref }}
-ENV_REF: ${{ inputs.env-ref }}
+ENV_REFS: ${{ inputs.env-refs }}
  APP_REFS: ${{ inputs.app-refs }}
+ APPS: ${{ inputs.apps }}
  HOSTS: ${{ inputs.hosts }}
  DEPLOY_PATH: ${{ inputs.path }}
  KEEP_RELEASES: ${{ inputs.keep-releases }}
  SOPS_KEY_FILE: ${{ inputs.sops-age-key-file }}
  run: |
  hosts_json="$(jq -ce 'if type == "array" and length > 0 and all(.[]; type == "string" and test("^[a-z_][a-z0-9_-]*@[A-Za-z0-9]([A-Za-z0-9.-]*[A-Za-z0-9])?$")) then . else error("hosts must be a non-empty user@host string array") end' <<< "$HOSTS")"
+ env_refs_json="$(jq -ce 'if type == "array" and length > 0 and all(.[]; type == "string" and length > 0) then . else error("env-refs must be a non-empty string array") end' <<< "$ENV_REFS")"
  app_refs_json="$(jq -ce 'if type == "array" and length > 0 and all(.[]; type == "string" and length > 0) then . else error("app-refs must be a non-empty string array") end' <<< "$APP_REFS")"
+ apps_json="$(jq -ce 'if type == "array" and length > 0 and all(.[]; type == "string" and length > 0) then . else error("apps must be a non-empty string array") end' <<< "$APPS")"
  jq -ce '
  reduce .[] as $destination ({all: {hosts: {}}};
  ($destination | capture("^(?<user>[^@]+)@(?<host>.+)$")) as $ssh |
@@ -91,12 +98,13 @@ jobs:
  ' <<< "$hosts_json" > "$RUNNER_TEMP/flightdeck-inventory.json"
  json="$(jq -n \
  --arg app_ref "$APP_REF" \
- --arg env_ref "$ENV_REF" \
+ --argjson env_refs "$env_refs_json" \
  --argjson app_refs "$app_refs_json" \
+ --argjson apps "$apps_json" \
  --arg path "$DEPLOY_PATH" \
  --argjson keep_releases "$KEEP_RELEASES" \
  --arg sops_key_file "$SOPS_KEY_FILE" \
- '{flightdeck_app_ref: $app_ref, flightdeck_env_ref: $env_ref, flightdeck_app_refs: $app_refs, flightdeck_path: $path, flightdeck_keep_releases: $keep_releases, flightdeck_sops_age_key_file: $sops_key_file}')"
+ '{flightdeck_app_ref: $app_ref, flightdeck_env_refs: $env_refs, flightdeck_app_refs: $app_refs, flightdeck_apps: $apps, flightdeck_path: $path, flightdeck_keep_releases: $keep_releases, flightdeck_sops_age_key_file: $sops_key_file}')"
  echo "json=$json" >> "$GITHUB_OUTPUT"
  echo "inventory=$RUNNER_TEMP/flightdeck-inventory.json" >> "$GITHUB_OUTPUT"
  - name: Run playbook

.github/workflows/deploy.yml

@@ -28,8 +28,9 @@ jobs:
  with:
  hosts: ${{ toJson(matrix.hosts) }}
  app-ref: ${{ matrix.flightdeck_ref }}
- env-ref: ${{ matrix.env_ref }}
+ env-refs: ${{ toJson(matrix.env_refs) }}
  app-refs: ${{ toJson(matrix.app_refs) }}
+ apps: ${{ toJson(matrix.apps) }}
  path: ${{ matrix.path || '~/flightdeck' }}
  keep-releases: ${{ matrix.keep_releases || 5 }}
  sops-age-key-file: ${{ matrix.sops_age_key_file || '~/.config/sops/age/keys.txt' }}

.github/workflows/release.yml

@@ -98,8 +98,9 @@ jobs:
  with:
  hosts: ${{ toJson(matrix.hosts) }}
  app-ref: ${{ matrix.flightdeck_ref }}
- env-ref: ${{ matrix.env_ref }}
+ env-refs: ${{ toJson(matrix.env_refs) }}
  app-refs: ${{ toJson(matrix.app_refs) }}
+ apps: ${{ toJson(matrix.apps) }}
  path: ${{ matrix.path || '~/flightdeck' }}
  keep-releases: ${{ matrix.keep_releases || 5 }}
  sops-age-key-file: ${{ matrix.sops_age_key_file || '~/.config/sops/age/keys.txt' }}

AGENTS.md

@@ -408,12 +408,14 @@ GitHub Actions workflow (`.github/workflows/release-please.yml`) manages release
 
 Deployment helpers live in this repository:
 
-- `ansible/deploy.yml` pulls `flightdeck_app_ref` (the machinery bundle), merges every ref in `flightdeck_app_refs` (the app bundles, at least one required — flightdeck's own `apps/` catalog is just another entry, not implicit), pulls the server-specific encrypted env package from `flightdeck_env_ref`, decrypts `.sops.env` on the server, switches a timestamped release, and runs `./deploy.sh`
-- `.github/actions/encrypt-env/` is a local composite action for rendering `vaults/` manifests from GitHub Secrets/Variables, encrypting them for age recipients, and publishing `.sops.env` as a GitHub Release asset
+- `ansible/deploy.yml` pulls `flightdeck_app_ref` (the machinery bundle), merges every ref in `flightdeck_app_refs` (the app bundles, at least one required — flightdeck's own `apps/` catalog is just another entry, not implicit), decrypts and merges every ref in `flightdeck_env_refs` (at least one required) into the server's `.env`, switches a timestamped release, and runs `./deploy.sh`
+- `.github/actions/encrypt-env/` is a local composite action for rendering `vaults/` manifests from GitHub Secrets/Variables, encrypting them for age recipients, and publishing `.sops.env` as a GitHub Release asset — vault manifests hold only env/secrets, not app selection
 - `.github/workflows/deploy-shared.yml` is a reusable workflow consumer repos call to run `ansible/deploy.yml` from GitHub Actions over an optional Tailscale connection, without holding any deploy secrets in this repository
 
 App bundles listed in `flightdeck_app_refs` are release assets referenced as short refs like `<owner>/<repo>@latest` or `<owner>/<repo>@v1.2.3`, resolving to a default asset name of `flightdeck-apps.zip` unless the ref specifies an explicit `:asset-name` suffix. `@latest` is resolved by the deploy playbook through GitHub's latest release API. Every bundle must contain an `apps/` directory; app names may not conflict across bundles.
 
+Env packages listed in `flightdeck_env_refs` are release refs the same shape as app bundles, defaulting to a `$tag.sops.env`-named asset. The playbook decrypts each with the server-local SOPS age key, then merges them alongside a synthesized `APPS` line (built from `flightdeck_apps`, the target's own desired app set) — failing loud on any key collision across sources, `APPS` included. `apps` moved off the vault schema onto the target for exactly this reason: multiple vaults can be merged without having to reconcile per-vault `apps` lists.
+
 Private release assets are supported by passing `FLIGHTDECK_GITHUB_TOKEN` as a secret environment variable to `ansible/deploy.yml`. Store it as a secret in whatever system runs the playbook (e.g. a GitHub Actions secret when using `deploy-shared.yml`), not in plain configuration. When the token is present, the playbook exports it as `GH_TOKEN` for `gh release download`.
 
 ## Notable App Configurations