From 8d5ed62d3044e5f9394b6999b0eda848b8c3b6e8 Mon Sep 17 00:00:00 2001
From: Donal McBreen <donal@37signals.com>
Date: Fri, 18 Apr 2025 14:10:00 +0100
Subject: [PATCH] Don't allow booleans for root proxy config

Setting it to a false or true doesn't affect the config so shouldn't be
allowed. true/false are for role level configurations.

Fixes: https://github.com/basecamp/kamal/issues/1120
---
 lib/kamal/configuration.rb                        |  2 +-
 test/cli/app_test.rb                              | 15 +++++++++++++++
 test/configuration/proxy_test.rb                  |  7 +++++++
 ...kers_only.yml => deploy_with_only_workers.yml} |  0
 4 files changed, 23 insertions(+), 1 deletion(-)
 rename test/fixtures/{deploy_workers_only.yml => deploy_with_only_workers.yml} (100%)

diff --git a/lib/kamal/configuration.rb b/lib/kamal/configuration.rb
index 5f0abde8..326e1f71 100644
--- a/lib/kamal/configuration.rb
+++ b/lib/kamal/configuration.rb
@@ -68,7 +68,7 @@ class Kamal::Configuration
     @env = Env.new(config: @raw_config.env || {}, secrets: secrets)
 
     @logging = Logging.new(logging_config: @raw_config.logging)
-    @proxy = Proxy.new(config: self, proxy_config: @raw_config.proxy || {})
+    @proxy = Proxy.new(config: self, proxy_config: @raw_config.key?(:proxy) ? @raw_config.proxy : {})
     @ssh = Ssh.new(config: self)
     @sshkit = Sshkit.new(config: self)
 
diff --git a/test/cli/app_test.rb b/test/cli/app_test.rb
index 2ed00182..76b299b6 100644
--- a/test/cli/app_test.rb
+++ b/test/cli/app_test.rb
@@ -192,6 +192,21 @@ class CliAppTest < CliTestCase
     Thread.report_on_exception = true
   end
 
+  test "boot with only workers" do
+    Object.any_instance.stubs(:sleep)
+
+    SSHKit::Backend::Abstract.any_instance.stubs(:capture_with_info).returns("123") # old version
+
+    SSHKit::Backend::Abstract.any_instance.expects(:capture_with_info)
+      .with(:docker, :container, :ls, "--all", "--filter", "name=^app-workers-latest$", "--quiet", "|", :xargs, :docker, :inspect, "--format", "'{{if .State.Health}}{{.State.Health.Status}}{{else}}{{.State.Status}}{{end}}'")
+      .returns("running").at_least_once # workers health check
+
+    run_command("boot", config: :with_only_workers, host: nil).tap do |output|
+      assert_match /First workers container is healthy on 1.1.1.\d, booting any other roles/, output
+      assert_no_match "kamal-proxy", output
+    end
+  end
+
   test "boot with error pages" do
     with_error_pages(directory: "public") do
       stub_running
diff --git a/test/configuration/proxy_test.rb b/test/configuration/proxy_test.rb
index 588e5a35..460d30cb 100644
--- a/test/configuration/proxy_test.rb
+++ b/test/configuration/proxy_test.rb
@@ -38,6 +38,13 @@ class ConfigurationProxyTest < ActiveSupport::TestCase
     assert_not config.proxy.ssl?
   end
 
+  test "false not allowed" do
+    @deploy[:proxy] = false
+    assert_raises(Kamal::ConfigurationError, "proxy: should be a hash") do
+      config.proxy
+    end
+  end
+
   private
     def config
       Kamal::Configuration.new(@deploy)
diff --git a/test/fixtures/deploy_workers_only.yml b/test/fixtures/deploy_with_only_workers.yml
similarity index 100%
rename from test/fixtures/deploy_workers_only.yml
rename to test/fixtures/deploy_with_only_workers.yml