Per destination latest image tag

We tag the deployed image with the latest image tag when deploying. But if we are deploying multiple destinations to the same host they'll conflict with each other.
Merge pull request #502 from latyshev/main
2024-03-27 09:43:21 +00:00 · 2024-03-26 13:58:26 +00:00 · 2024-03-26 11:01:59 +00:00 · 2024-03-26 08:10:36 +00:00 · 2024-03-26 09:29:34 +03:00 · 2024-03-25 22:48:23 +04:00
75 changed files with 696 additions and 427 deletions
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -5,6 +5,21 @@ on:
      - main
  pull_request:
 jobs:
+  rubocop:
+    name: RuboCop
+    runs-on: ubuntu-latest
+    env:
+      BUNDLE_ONLY: rubocop
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+      - name: Setup Ruby and install gems
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: 3.3.0
+          bundler-cache: true
+      - name: Run Rubocop
+        run: bundle exec rubocop --parallel
  tests:
    strategy:
      matrix:
--- a/.rubocop.yml
+++ b/.rubocop.yml
@@ -0,0 +1,2 @@
+inherit_gem:
+  rubocop-rails-omakase: rubocop.yml
--- a/6
+++ b/6
@@ -1,4 +1,8 @@
-source 'https://rubygems.org'
+source "https://rubygems.org"
 git_source(:github) { |repo| "https://github.com/#{repo}.git" }

 gemspec
+
+group :rubocop do
+  gem "rubocop-rails-omakase", require: false
+end
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -42,6 +42,7 @@ GEM
      minitest (>= 5.1)
      mutex_m
      tzinfo (~> 2.0)
+    ast (2.4.2)
    base64 (0.2.0)
    bcrypt_pbkdf (1.1.0)
    bigdecimal (3.1.5)
@@ -63,6 +64,8 @@ GEM
    irb (1.11.0)
      rdoc
      reline (>= 0.3.8)
+    json (2.7.1)
+    language_server-protocol (3.17.0.3)
    loofah (2.22.0)
      crass (~> 1.0.2)
      nokogiri (>= 1.12.0)
@@ -79,6 +82,10 @@ GEM
      racc (~> 1.4)
    nokogiri (1.16.0-x86_64-linux)
      racc (~> 1.4)
+    parallel (1.24.0)
+    parser (3.3.0.5)
+      ast (~> 2.4.1)
+      racc
    psych (5.1.2)
      stringio
    racc (1.7.3)
@@ -105,11 +112,44 @@ GEM
      rake (>= 12.2)
      thor (~> 1.0, >= 1.2.2)
      zeitwerk (~> 2.6)
+    rainbow (3.1.1)
    rake (13.1.0)
    rdoc (6.6.2)
      psych (>= 4.0.0)
+    regexp_parser (2.9.0)
    reline (0.4.2)
      io-console (~> 0.5)
+    rexml (3.2.6)
+    rubocop (1.62.1)
+      json (~> 2.3)
+      language_server-protocol (>= 3.17.0)
+      parallel (~> 1.10)
+      parser (>= 3.3.0.2)
+      rainbow (>= 2.2.2, < 4.0)
+      regexp_parser (>= 1.8, < 3.0)
+      rexml (>= 3.2.5, < 4.0)
+      rubocop-ast (>= 1.31.1, < 2.0)
+      ruby-progressbar (~> 1.7)
+      unicode-display_width (>= 2.4.0, < 3.0)
+    rubocop-ast (1.31.2)
+      parser (>= 3.3.0.4)
+    rubocop-minitest (0.35.0)
+      rubocop (>= 1.61, < 2.0)
+      rubocop-ast (>= 1.31.1, < 2.0)
+    rubocop-performance (1.20.2)
+      rubocop (>= 1.48.1, < 2.0)
+      rubocop-ast (>= 1.30.0, < 2.0)
+    rubocop-rails (2.24.0)
+      activesupport (>= 4.2.0)
+      rack (>= 1.1)
+      rubocop (>= 1.33.0, < 2.0)
+      rubocop-ast (>= 1.31.1, < 2.0)
+    rubocop-rails-omakase (1.0.0)
+      rubocop
+      rubocop-minitest
+      rubocop-performance
+      rubocop-rails
+    ruby-progressbar (1.13.0)
    ruby2_keywords (0.0.5)
    sshkit (1.21.7)
      mutex_m
@@ -119,6 +159,7 @@ GEM
    thor (1.3.0)
    tzinfo (2.0.6)
      concurrent-ruby (~> 1.0)
+    unicode-display_width (2.5.0)
    webrick (1.8.1)
    zeitwerk (2.6.12)

@@ -132,6 +173,7 @@ DEPENDENCIES
  kamal!
  mocha
  railties
+  rubocop-rails-omakase

 BUNDLED WITH
   2.4.3
--- a/lib/kamal/cli/accessory.rb
+++ b/lib/kamal/cli/accessory.rb
@@ -177,7 +177,7 @@ class Kamal::Cli::Accessory < Kamal::Cli::Base
      if name == "all"
        KAMAL.accessory_names.each { |accessory_name| remove(accessory_name) }
      else
-        if options[:confirmed] || ask("This will remove all containers, images and data directories for #{name}. Are you sure?", limited_to: %w( y N ), default: "N") == "y"
+        confirming "This will remove all containers, images and data directories for #{name}. Are you sure?" do
          with_accessory(name) do
            stop(name)
            remove_container(name)
@@ -226,7 +226,8 @@ class Kamal::Cli::Accessory < Kamal::Cli::Base

  private
    def with_accessory(name)
-      if accessory = KAMAL.accessory(name)
+      if KAMAL.config.accessory(name)
+        accessory = KAMAL.accessory(name)
        yield accessory, accessory_hosts(accessory)
      else
        error_on_missing_accessory(name)
--- a/lib/kamal/cli/app.rb
+++ b/lib/kamal/cli/app.rb
@@ -7,56 +7,19 @@ class Kamal::Cli::App < Kamal::Cli::Base
        using_version(version_or_latest) do |version|
          say "Start container with version #{version} using a #{KAMAL.config.readiness_delay}s readiness delay (or reboot if already running)...", :magenta

+          # Assets are prepared in a separate step to ensure they are on all hosts before booting
          on(KAMAL.hosts) do
            execute *KAMAL.auditor.record("Tagging #{KAMAL.config.absolute_image} as the latest image"), verbosity: :debug
            execute *KAMAL.app.tag_current_image_as_latest

            KAMAL.roles_on(host).each do |role|
-              app = KAMAL.app(role: role)
-
-              if role.assets?
-                execute *app.extract_assets
-                old_version = capture_with_info(*app.current_running_version, raise_on_non_zero_exit: false).strip
-                execute *app.sync_asset_volumes(old_version: old_version)
-              end
+              Kamal::Cli::App::PrepareAssets.new(host, role, self).run
            end
          end

          on(KAMAL.hosts, **KAMAL.boot_strategy) do |host|
            KAMAL.roles_on(host).each do |role|
-              app = KAMAL.app(role: role)
-              auditor = KAMAL.auditor(role: role)
-
-              if capture_with_info(*app.container_id_for_version(version), raise_on_non_zero_exit: false).present?
-                tmp_version = "#{version}_replaced_#{SecureRandom.hex(8)}"
-                info "Renaming container #{version} to #{tmp_version} as already deployed on #{host}"
-                execute *auditor.record("Renaming container #{version} to #{tmp_version}"), verbosity: :debug
-                execute *app.rename_container(version: version, new_version: tmp_version)
-              end
-
-              old_version = capture_with_info(*app.current_running_version, raise_on_non_zero_exit: false).strip
-
-              execute *app.tie_cord(role.cord_host_file) if role.uses_cord?
-
-              execute *auditor.record("Booted app version #{version}"), verbosity: :debug
-
-              execute *app.run(hostname: "#{host}-#{SecureRandom.hex(6)}")
-
-              Kamal::Cli::Healthcheck::Poller.wait_for_healthy(pause_after_ready: true) { capture_with_info(*app.status(version: version)) }
-
-              if old_version.present?
-                if role.uses_cord?
-                  cord = capture_with_info(*app.cord(version: old_version), raise_on_non_zero_exit: false).strip
-                  if cord.present?
-                    execute *app.cut_cord(cord)
-                    Kamal::Cli::Healthcheck::Poller.wait_for_unhealthy(pause_after_ready: true) { capture_with_info(*app.status(version: old_version)) }
-                  end
-                end
-
-                execute *app.stop(version: old_version), raise_on_non_zero_exit: false
-
-                execute *app.clean_up_assets if role.assets?
-              end
+              Kamal::Cli::App::Boot.new(host, role, version, self).run
            end
          end
        end
@@ -207,7 +170,7 @@ class Kamal::Cli::App < Kamal::Cli::Base
      run_locally do
        info "Following logs on #{KAMAL.primary_host}..."

-        KAMAL.specific_roles ||= ["web"]
+        KAMAL.specific_roles ||= [ "web" ]
        role = KAMAL.roles_on(KAMAL.primary_host).first

        info KAMAL.app(role: role).follow_logs(host: KAMAL.primary_host, lines: lines, grep: grep)
--- a/lib/kamal/cli/app/boot.rb
+++ b/lib/kamal/cli/app/boot.rb
@@ -0,0 +1,67 @@
+class Kamal::Cli::App::Boot
+  attr_reader :host, :role, :version, :sshkit
+  delegate :execute, :capture_with_info, :info, to: :sshkit
+  delegate :uses_cord?, :assets?, to: :role
+
+  def initialize(host, role, version, sshkit)
+    @host = host
+    @role = role
+    @version = version
+    @sshkit = sshkit
+  end
+
+  def run
+    old_version = old_version_renamed_if_clashing
+
+    start_new_version
+
+    if old_version
+      stop_old_version(old_version)
+    end
+  end
+
+  private
+    def app
+      @app ||= KAMAL.app(role: role)
+    end
+
+    def auditor
+      @auditor = KAMAL.auditor(role: role)
+    end
+
+    def audit(message)
+      execute *auditor.record(message), verbosity: :debug
+    end
+
+    def old_version_renamed_if_clashing
+      if capture_with_info(*app.container_id_for_version(version), raise_on_non_zero_exit: false).present?
+        renamed_version = "#{version}_replaced_#{SecureRandom.hex(8)}"
+        info "Renaming container #{version} to #{renamed_version} as already deployed on #{host}"
+        audit("Renaming container #{version} to #{renamed_version}")
+        execute *app.rename_container(version: version, new_version: renamed_version)
+      end
+
+      capture_with_info(*app.current_running_version, raise_on_non_zero_exit: false).strip.presence
+    end
+
+    def start_new_version
+      audit "Booted app version #{version}"
+      execute *app.tie_cord(role.cord_host_file) if uses_cord?
+      execute *app.run(hostname: "#{host}-#{SecureRandom.hex(6)}")
+      Kamal::Cli::Healthcheck::Poller.wait_for_healthy(pause_after_ready: true) { capture_with_info(*app.status(version: version)) }
+    end
+
+    def stop_old_version(version)
+      if uses_cord?
+        cord = capture_with_info(*app.cord(version: version), raise_on_non_zero_exit: false).strip
+        if cord.present?
+          execute *app.cut_cord(cord)
+          Kamal::Cli::Healthcheck::Poller.wait_for_unhealthy(pause_after_ready: true) { capture_with_info(*app.status(version: version)) }
+        end
+      end
+
+      execute *app.stop(version: version), raise_on_non_zero_exit: false
+
+      execute *app.clean_up_assets if assets?
+    end
+end
--- a/lib/kamal/cli/app/prepare_assets.rb
+++ b/lib/kamal/cli/app/prepare_assets.rb
@@ -0,0 +1,24 @@
+class Kamal::Cli::App::PrepareAssets
+  attr_reader :host, :role, :sshkit
+  delegate :execute, :capture_with_info, :info, to: :sshkit
+  delegate :assets?, to: :role
+
+  def initialize(host, role, sshkit)
+    @host = host
+    @role = role
+    @sshkit = sshkit
+  end
+
+  def run
+    if assets?
+      execute *app.extract_assets
+      old_version = capture_with_info(*app.current_running_version, raise_on_non_zero_exit: false).strip
+      execute *app.sync_asset_volumes(old_version: old_version)
+    end
+  end
+
+  private
+    def app
+      @app ||= KAMAL.app(role: role)
+    end
+end
--- a/lib/kamal/cli/base.rb
+++ b/lib/kamal/cli/base.rb
@@ -73,7 +73,7 @@ module Kamal::Cli
      def print_runtime
        started_at = Time.now
        yield
-        return Time.now - started_at
+        Time.now - started_at
      ensure
        runtime = Time.now - started_at
        puts "  Finished all in #{sprintf("%.1f seconds", runtime)}"
@@ -103,6 +103,16 @@ module Kamal::Cli
        release_lock
      end

+      def confirming(question)
+        return yield if options[:confirmed]
+
+        if ask(question, limited_to: %w[ y N ], default: "N") == "y"
+          yield
+        else
+          say "Aborted", :red
+        end
+      end
+
      def acquire_lock
        raise_if_locked do
          say "Acquiring the deploy lock...", :magenta
@@ -181,5 +191,5 @@ module Kamal::Cli
          execute(*KAMAL.server.ensure_run_directory)
        end
      end
-    end
+  end
 end
--- a/lib/kamal/cli/env.rb
+++ b/lib/kamal/cli/env.rb
@@ -9,20 +9,20 @@ class Kamal::Cli::Env < Kamal::Cli::Base

        KAMAL.roles_on(host).each do |role|
          execute *KAMAL.app(role: role).make_env_directory
-          upload! StringIO.new(role.env_file), role.host_env_file_path, mode: 400
+          upload! role.env.secrets_io, role.env.secrets_file, mode: 400
        end
      end

      on(KAMAL.traefik_hosts) do
        execute *KAMAL.traefik.make_env_directory
-        upload! StringIO.new(KAMAL.traefik.env_file), KAMAL.traefik.host_env_file_path, mode: 400
+        upload! KAMAL.traefik.env.secrets_io, KAMAL.traefik.env.secrets_file, mode: 400
      end

      on(KAMAL.accessory_hosts) do
        KAMAL.accessories_on(host).each do |accessory|
          accessory_config = KAMAL.config.accessory(accessory)
          execute *KAMAL.accessory(accessory).make_env_directory
-          upload! StringIO.new(accessory_config.env_file), accessory_config.host_env_file_path, mode: 400
+          upload! accessory_config.env.secrets_io, accessory_config.env.secrets_file, mode: 400
        end
      end
    end
--- a/lib/kamal/cli/main.rb
+++ b/lib/kamal/cli/main.rb
@@ -197,7 +197,7 @@ class Kamal::Cli::Main < Kamal::Cli::Base
  option :confirmed, aliases: "-y", type: :boolean, default: false, desc: "Proceed without confirmation question"
  def remove
    mutating do
-      if options[:confirmed] || ask("This will remove all containers and images. Are you sure?", limited_to: %w( y N ), default: "N") == "y"
+      confirming "This will remove all containers and images. Are you sure?" do
        invoke "kamal:cli:traefik:remove", [], options.without(:confirmed)
        invoke "kamal:cli:app:remove", [], options.without(:confirmed)
        invoke "kamal:cli:accessory:remove", [ "all" ], options
--- a/lib/kamal/cli/traefik.rb
+++ b/lib/kamal/cli/traefik.rb
@@ -11,20 +11,23 @@ class Kamal::Cli::Traefik < Kamal::Cli::Base

  desc "reboot", "Reboot Traefik on servers (stop container, remove container, start new container)"
  option :rolling, type: :boolean, default: false, desc: "Reboot traefik on hosts in sequence, rather than in parallel"
+  option :confirmed, aliases: "-y", type: :boolean, default: false, desc: "Proceed without confirmation question"
  def reboot
-    mutating do
-      host_groups = options[:rolling] ? KAMAL.traefik_hosts : [KAMAL.traefik_hosts]
-      host_groups.each do |hosts|
-        host_list = Array(hosts).join(",")
-        run_hook "pre-traefik-reboot", hosts: host_list
-        on(hosts) do
-          execute *KAMAL.auditor.record("Rebooted traefik"), verbosity: :debug
-          execute *KAMAL.registry.login
-          execute *KAMAL.traefik.stop, raise_on_non_zero_exit: false
-          execute *KAMAL.traefik.remove_container
-          execute *KAMAL.traefik.run
+    confirming "This will cause a brief outage on each host. Are you sure?" do
+      mutating do
+        host_groups = options[:rolling] ? KAMAL.traefik_hosts : [ KAMAL.traefik_hosts ]
+        host_groups.each do |hosts|
+          host_list = Array(hosts).join(",")
+          run_hook "pre-traefik-reboot", hosts: host_list
+          on(hosts) do
+            execute *KAMAL.auditor.record("Rebooted traefik"), verbosity: :debug
+            execute *KAMAL.registry.login
+            execute *KAMAL.traefik.stop, raise_on_non_zero_exit: false
+            execute *KAMAL.traefik.remove_container
+            execute *KAMAL.traefik.run
+          end
+          run_hook "post-traefik-reboot", hosts: host_list
        end
-        run_hook "post-traefik-reboot", hosts: host_list
      end
    end
  end
--- a/lib/kamal/commands/accessory.rb
+++ b/lib/kamal/commands/accessory.rb
@@ -99,11 +99,11 @@ class Kamal::Commands::Accessory < Kamal::Commands::Base
  end

  def make_env_directory
-    make_directory accessory_config.host_env_directory
+    make_directory accessory_config.env.secrets_directory
  end

  def remove_env_file
-    [:rm, "-f", accessory_config.host_env_file_path]
+    [ :rm, "-f", accessory_config.env.secrets_file ]
  end

  private
--- a/lib/kamal/commands/app.rb
+++ b/lib/kamal/commands/app.rb
@@ -15,7 +15,7 @@ class Kamal::Commands::App < Kamal::Commands::Base
      "--detach",
      "--restart unless-stopped",
      "--name", container_name,
-      *(["--hostname", hostname] if hostname),
+      *([ "--hostname", hostname ] if hostname),
      "-e", "KAMAL_CONTAINER_NAME=\"#{container_name}\"",
      "-e", "KAMAL_VERSION=\"#{config.version}\"",
      *role.env_args,
@@ -68,11 +68,11 @@ class Kamal::Commands::App < Kamal::Commands::Base


  def make_env_directory
-    make_directory role.host_env_directory
+    make_directory role.env.secrets_directory
  end

  def remove_env_file
-    [ :rm, "-f", role.host_env_file_path ]
+    [ :rm, "-f", role.env.secrets_file ]
  end


@@ -85,10 +85,6 @@ class Kamal::Commands::App < Kamal::Commands::Base
      argumentize "--filter", filters(statuses: statuses)
    end

-    def service_role_dest
-      [ config.service, role, config.destination ].compact.join("-")
-    end
-
    def filters(statuses: nil)
      [ "label=service=#{config.service}" ].tap do |filters|
        filters << "label=destination=#{config.destination}" if config.destination
--- a/lib/kamal/commands/app/assets.rb
+++ b/lib/kamal/commands/app/assets.rb
@@ -4,7 +4,7 @@ module Kamal::Commands::App::Assets

    combine \
      make_directory(role.asset_extracted_path),
-      [*docker(:stop, "-t 1", asset_container, "2> /dev/null"), "|| true"],
+      [ *docker(:stop, "-t 1", asset_container, "2> /dev/null"), "|| true" ],
      docker(:run, "--name", asset_container, "--detach", "--rm", config.latest_image, "sleep 1000000"),
      docker(:cp, "-L", "#{asset_container}:#{role.asset_path}/.", role.asset_extracted_path),
      docker(:stop, "-t 1", asset_container),
@@ -17,7 +17,7 @@ module Kamal::Commands::App::Assets
      old_extracted_path, old_volume_path = role.asset_extracted_path(old_version), role.asset_volume(old_version).host_path
    end

-    commands = [make_directory(new_volume_path), copy_contents(new_extracted_path, new_volume_path)]
+    commands = [ make_directory(new_volume_path), copy_contents(new_extracted_path, new_volume_path) ]

    if old_version.present?
      commands << copy_contents(new_extracted_path, old_volume_path, continue_on_error: true)
@@ -46,6 +46,6 @@ module Kamal::Commands::App::Assets
    end

    def copy_contents(source, destination, continue_on_error: false)
-      [ :cp, "-rnT", "#{source}", destination, *("|| true" if continue_on_error)]
+      [ :cp, "-rnT", "#{source}", destination, *("|| true" if continue_on_error) ]
    end
 end
--- a/lib/kamal/commands/app/cord.rb
+++ b/lib/kamal/commands/app/cord.rb
@@ -2,7 +2,7 @@ module Kamal::Commands::App::Cord
  def cord(version:)
    pipe \
      docker(:inspect, "-f '{{ range .Mounts }}{{printf \"%s %s\\n\" .Source .Destination}}{{ end }}'", container_name(version)),
-      [:awk, "'$2 == \"#{role.cord_volume.container_path}\" {print $1}'"]
+      [ :awk, "'$2 == \"#{role.cord_volume.container_path}\" {print $1}'" ]
  end

  def tie_cord(cord)
@@ -17,6 +17,6 @@ module Kamal::Commands::App::Cord
    def create_empty_file(file)
      chain \
        make_directory_for(file),
-        [:touch, file]
+        [ :touch, file ]
    end
 end
--- a/lib/kamal/commands/builder/base.rb
+++ b/lib/kamal/commands/builder/base.rb
@@ -25,7 +25,7 @@ class Kamal::Commands::Builder::Base < Kamal::Commands::Base
    pipe \
      docker(:inspect, "-f", "'{{ .Config.Labels.service }}'", config.absolute_image),
      any(
-        [:grep, "-x", config.service],
+        [ :grep, "-x", config.service ],
        "(echo \"Image #{config.absolute_image} is missing the 'service' label\" && exit 1)"
      )
  end
@@ -38,8 +38,8 @@ class Kamal::Commands::Builder::Base < Kamal::Commands::Base

    def build_cache
      if cache_to && cache_from
-        ["--cache-to", cache_to,
-          "--cache-from", cache_from]
+        [ "--cache-to", cache_to,
+          "--cache-from", cache_from ]
      end
    end

--- a/lib/kamal/commands/healthcheck.rb
+++ b/lib/kamal/commands/healthcheck.rb
@@ -1,5 +1,4 @@
 class Kamal::Commands::Healthcheck < Kamal::Commands::Base
-
  def run
    primary = config.role(config.primary_role)

--- a/lib/kamal/commands/lock.rb
+++ b/lib/kamal/commands/lock.rb
@@ -5,14 +5,14 @@ require "base64"
 class Kamal::Commands::Lock < Kamal::Commands::Base
  def acquire(message, version)
    combine \
-      [:mkdir, lock_dir],
+      [ :mkdir, lock_dir ],
      write_lock_details(message, version)
  end

  def release
    combine \
-      [:rm, lock_details_file],
-      [:rm, "-r", lock_dir]
+      [ :rm, lock_details_file ],
+      [ :rm, "-r", lock_dir ]
  end

  def status
@@ -24,19 +24,19 @@ class Kamal::Commands::Lock < Kamal::Commands::Base
  private
    def write_lock_details(message, version)
      write \
-        [:echo, "\"#{Base64.encode64(lock_details(message, version))}\""],
+        [ :echo, "\"#{Base64.encode64(lock_details(message, version))}\"" ],
        lock_details_file
    end

    def read_lock_details
      pipe \
-        [:cat, lock_details_file],
-        [:base64, "-d"]
+        [ :cat, lock_details_file ],
+        [ :base64, "-d" ]
    end

    def stat_lock_dir
      write \
-        [:stat, lock_dir],
+        [ :stat, lock_dir ],
        "/dev/null"
    end

@@ -45,7 +45,7 @@ class Kamal::Commands::Lock < Kamal::Commands::Base
    end

    def lock_details_file
-      [lock_dir, :details].join("/")
+      [ lock_dir, :details ].join("/")
    end

    def lock_details(message, version)
--- a/lib/kamal/commands/prune.rb
+++ b/lib/kamal/commands/prune.rb
@@ -26,7 +26,7 @@ class Kamal::Commands::Prune < Kamal::Commands::Base

  private
    def stopped_containers_filters
-      [ "created", "exited", "dead" ].flat_map { |status| ["--filter", "status=#{status}"] }
+      [ "created", "exited", "dead" ].flat_map { |status| [ "--filter", "status=#{status}" ] }
    end

    def active_image_list
@@ -43,4 +43,4 @@ class Kamal::Commands::Prune < Kamal::Commands::Base
    def healthcheck_service_filter
      [ "--filter", "label=service=#{config.healthcheck_service}" ]
    end
-  end
+end
--- a/lib/kamal/commands/server.rb
+++ b/lib/kamal/commands/server.rb
@@ -1,5 +1,5 @@
 class Kamal::Commands::Server < Kamal::Commands::Base
  def ensure_run_directory
-    [:mkdir, "-p", config.run_directory]
+    [ :mkdir, "-p", config.run_directory ]
  end
 end
--- a/lib/kamal/commands/traefik.rb
+++ b/lib/kamal/commands/traefik.rb
@@ -4,7 +4,7 @@ class Kamal::Commands::Traefik < Kamal::Commands::Base
  DEFAULT_IMAGE = "traefik:v2.10"
  CONTAINER_PORT = 80
  DEFAULT_ARGS = {
-    'log.level' => 'DEBUG'
+    "log.level" => "DEBUG"
  }
  DEFAULT_LABELS = {
    # These ensure we serve a 502 rather than a 404 if no containers are available
@@ -71,20 +71,18 @@ class Kamal::Commands::Traefik < Kamal::Commands::Base
    "#{host_port}:#{CONTAINER_PORT}"
  end

-  def env_file
-    Kamal::EnvFile.new(config.traefik.fetch("env", {}))
-  end
-
-  def host_env_file_path
-    File.join host_env_directory, "traefik.env"
+  def env
+    Kamal::Configuration::Env.from_config \
+      config: config.traefik.fetch("env", {}),
+      secrets_file: File.join(config.host_env_directory, "traefik", "traefik.env")
  end

  def make_env_directory
-    make_directory(host_env_directory)
+    make_directory(env.secrets_directory)
  end

  def remove_env_file
-    [:rm, "-f", host_env_file_path]
+    [ :rm, "-f", env.secrets_file ]
  end

  private
@@ -97,11 +95,7 @@ class Kamal::Commands::Traefik < Kamal::Commands::Base
    end

    def env_args
-      argumentize "--env-file", host_env_file_path
-    end
-
-    def host_env_directory
-      File.join config.host_env_directory, "traefik"
+      env.args
    end

    def labels
--- a/lib/kamal/configuration.rb
+++ b/lib/kamal/configuration.rb
@@ -6,7 +6,7 @@ require "erb"
 require "net/ssh/proxy/jump"

 class Kamal::Configuration
-  delegate :service, :image, :servers, :env, :labels, :registry, :stop_wait_time, :hooks_path, :logging, to: :raw_config, allow_nil: true
+  delegate :service, :image, :servers, :labels, :registry, :stop_wait_time, :hooks_path, :logging, to: :raw_config, allow_nil: true
  delegate :argumentize, :optionize, to: Kamal::Utils

  attr_reader :destination, :raw_config
@@ -128,7 +128,7 @@ class Kamal::Configuration
  end

  def latest_image
-    "#{repository}:latest"
+    "#{repository}:#{[ "latest", *destination ].join("-")}"
  end

  def service_with_version
@@ -216,12 +216,17 @@ class Kamal::Configuration
    raw_config.hooks_path || ".kamal/hooks"
  end

+  def asset_path
+    raw_config.asset_path
+  end
+
+
  def host_env_directory
    "#{run_directory}/env"
  end

-  def asset_path
-    raw_config.asset_path
+  def env
+    raw_config.env || {}
  end


--- a/lib/kamal/configuration/accessory.rb
+++ b/lib/kamal/configuration/accessory.rb
@@ -16,7 +16,7 @@ class Kamal::Configuration::Accessory
  end

  def hosts
-    if (specifics.keys & ["host", "hosts", "roles"]).size != 1
+    if (specifics.keys & [ "host", "hosts", "roles" ]).size != 1
      raise ArgumentError, "Specify one of `host`, `hosts` or `roles` for accessory `#{name}`"
    end

@@ -42,23 +42,13 @@ class Kamal::Configuration::Accessory
  end

  def env
-    specifics["env"] || {}
-  end
-
-  def env_file
-    Kamal::EnvFile.new(env)
-  end
-
-  def host_env_directory
-    File.join config.host_env_directory, "accessories"
-  end
-
-  def host_env_file_path
-    File.join host_env_directory, "#{service_name}.env"
+    Kamal::Configuration::Env.from_config \
+      config: specifics.fetch("env", {}),
+      secrets_file: File.join(config.host_env_directory, "accessories", "#{service_name}.env")
  end

  def env_args
-    argumentize "--env-file", host_env_file_path
+    env.args
  end

  def files
@@ -111,10 +101,10 @@ class Kamal::Configuration::Accessory
    end

    def with_clear_env_loaded
-      (env["clear"] || env).each { |k, v| ENV[k] = v }
+      env.clear.each { |k, v| ENV[k] = v }
      yield
    ensure
-      (env["clear"] || env).each { |k, v| ENV.delete(k) }
+      env.clear.each { |k, v| ENV.delete(k) }
    end

    def read_dynamic_file(local_file)
@@ -159,7 +149,7 @@ class Kamal::Configuration::Accessory
      if specifics.key?("host")
        host = specifics["host"]
        if host
-          [host]
+          [ host ]
        else
          raise ArgumentError, "Missing host for accessory `#{name}`"
        end
--- a/lib/kamal/configuration/boot.rb
+++ b/lib/kamal/configuration/boot.rb
@@ -8,7 +8,7 @@ class Kamal::Configuration::Boot
    limit = @options["limit"]

    if limit.to_s.end_with?("%")
-      [@host_count * limit.to_i / 100, 1].max
+      [ @host_count * limit.to_i / 100, 1 ].max
    else
      limit
    end
--- a/lib/kamal/configuration/builder.rb
+++ b/lib/kamal/configuration/builder.rb
@@ -88,7 +88,7 @@ class Kamal::Configuration::Builder
  private
    def valid?
      if @options["cache"] && @options["cache"]["type"]
-        raise ArgumentError, "Invalid cache type: #{@options["cache"]["type"]}" unless ["gha", "registry"].include?(@options["cache"]["type"])
+        raise ArgumentError, "Invalid cache type: #{@options["cache"]["type"]}" unless [ "gha", "registry" ].include?(@options["cache"]["type"])
      end
    end

@@ -109,7 +109,7 @@ class Kamal::Configuration::Builder
    end

    def cache_to_config_for_gha
-      [ "type=gha", @options["cache"]&.fetch("options", nil)].compact.join(",")
+      [ "type=gha", @options["cache"]&.fetch("options", nil) ].compact.join(",")
    end

    def cache_to_config_for_registry
--- a/lib/kamal/configuration/env.rb
+++ b/lib/kamal/configuration/env.rb
@@ -0,0 +1,40 @@
+class Kamal::Configuration::Env
+  attr_reader :secrets_keys, :clear, :secrets_file
+  delegate :argumentize, to: Kamal::Utils
+
+  def self.from_config(config:, secrets_file: nil)
+    secrets_keys = config.fetch("secret", [])
+    clear = config.fetch("clear", config.key?("secret") ? {} : config)
+
+    new clear: clear, secrets_keys: secrets_keys, secrets_file: secrets_file
+  end
+
+  def initialize(clear:, secrets_keys:, secrets_file:)
+    @clear = clear
+    @secrets_keys = secrets_keys
+    @secrets_file = secrets_file
+  end
+
+  def args
+    [ "--env-file", secrets_file, *argumentize("--env", clear) ]
+  end
+
+  def secrets_io
+    StringIO.new(Kamal::EnvFile.new(secrets).to_s)
+  end
+
+  def secrets
+    @secrets ||= secrets_keys.to_h { |key| [ key, ENV.fetch(key) ] }
+  end
+
+  def secrets_directory
+    File.dirname(secrets_file)
+  end
+
+  def merge(other)
+    self.class.new \
+      clear: @clear.merge(other.clear),
+      secrets_keys: @secrets_keys | other.secrets_keys,
+      secrets_file: secrets_file
+  end
+end
--- a/lib/kamal/configuration/role.rb
+++ b/lib/kamal/configuration/role.rb
@@ -51,27 +51,11 @@ class Kamal::Configuration::Role


  def env
-    if config.env && config.env["secret"]
-      merged_env_with_secrets
-    else
-      merged_env
-    end
-  end
-
-  def env_file
-    Kamal::EnvFile.new(env)
-  end
-
-  def host_env_directory
-    File.join config.host_env_directory, "roles"
-  end
-
-  def host_env_file_path
-    File.join host_env_directory, "#{[config.service, name, config.destination].compact.join("-")}.env"
+    @env ||= base_env.merge(specialized_env)
  end

  def env_args
-    argumentize "--env-file", host_env_file_path
+    env.args
  end

  def asset_volume_args
@@ -123,13 +107,13 @@ class Kamal::Configuration::Role
  end

  def cord_host_directory
-    File.join config.run_directory_as_docker_volume, "cords", [container_prefix, config.run_id].join("-")
+    File.join config.run_directory_as_docker_volume, "cords", [ container_prefix, config.run_id ].join("-")
  end

  def cord_volume
    if (cord = health_check_options["cord"])
      @cord_volume ||= Kamal::Configuration::Volume.new \
-        host_path: File.join(config.run_directory, "cords", [container_prefix, config.run_id].join("-")),
+        host_path: File.join(config.run_directory, "cords", [ container_prefix, config.run_id ].join("-")),
        container_path: cord
    end
  end
@@ -217,7 +201,7 @@ class Kamal::Configuration::Role
    end

    def traefik_service
-      [ config.service, name, config.destination ].compact.join("-")
+      container_prefix
    end

    def custom_labels
@@ -229,31 +213,21 @@ class Kamal::Configuration::Role

    def specializations
      if config.servers.is_a?(Array) || config.servers[name].is_a?(Array)
-        { }
+        {}
      else
        config.servers[name].except("hosts")
      end
    end

    def specialized_env
-      specializations["env"] || {}
-    end
-
-    def merged_env
-      config.env&.merge(specialized_env) || {}
+      Kamal::Configuration::Env.from_config config: specializations.fetch("env", {})
    end

    # Secrets are stored in an array, which won't merge by default, so have to do it by hand.
-    def merged_env_with_secrets
-      merged_env.tap do |new_env|
-        new_env["secret"] = Array(config.env["secret"]) + Array(specialized_env["secret"])
-
-        # If there's no secret/clear split, everything is clear
-        clear_app_env  = config.env["secret"] ? Array(config.env["clear"]) : Array(config.env["clear"] || config.env)
-        clear_role_env = specialized_env["secret"] ? Array(specialized_env["clear"]) : Array(specialized_env["clear"] || specialized_env)
-
-        new_env["clear"] = clear_app_env.to_h.merge(clear_role_env.to_h)
-      end
+    def base_env
+      Kamal::Configuration::Env.from_config \
+        config: config.env,
+        secrets_file: File.join(config.host_env_directory, "roles", "#{container_prefix}.env")
    end

    def http_health_check(port:, path:)
--- a/lib/kamal/env_file.rb
+++ b/lib/kamal/env_file.rb
@@ -3,21 +3,11 @@ class Kamal::EnvFile
  def initialize(env)
    @env = env
  end
-  
+
  def to_s
    env_file = StringIO.new.tap do |contents|
-      if (secrets = @env["secret"]).present?
-        @env.fetch("secret", @env)&.each do |key|
-          contents << docker_env_file_line(key, ENV.fetch(key))
-        end
-
-        @env["clear"]&.each do |key, value|
-          contents << docker_env_file_line(key, value)
-        end
-      else
-        @env.fetch("clear", @env)&.each do |key, value|
-          contents << docker_env_file_line(key, value)
-        end
+      @env.each do |key, value|
+        contents << docker_env_file_line(key, value)
      end
    end.string

@@ -26,10 +16,10 @@ class Kamal::EnvFile
  end

  alias to_str to_s
-  
+
  private
    def docker_env_file_line(key, value)
-      "#{key.to_s}=#{escape_docker_env_file_value(value)}\n"
+      "#{key}=#{escape_docker_env_file_value(value)}\n"
    end

    # Escape a value to make it safe to dump in a docker file.
--- a/lib/kamal/utils.rb
+++ b/lib/kamal/utils.rb
@@ -9,7 +9,7 @@ module Kamal::Utils
      if value.present?
        attr = "#{key}=#{escape_shell_value(value)}"
        attr = self.sensitive(attr, redaction: "#{key}=[REDACTED]") if sensitive
-        [ argument, attr]
+        [ argument, attr ]
      else
        [ argument, key ]
      end
@@ -29,7 +29,7 @@ module Kamal::Utils

  # Flattens a one-to-many structure into an array of two-element arrays each containing a key-value pair
  def flatten_args(args)
-    args.flat_map { |key, value| value.try(:map) { |entry| [key, entry] } || [ [ key, value ] ] }
+    args.flat_map { |key, value| value.try(:map) { |entry| [ key, entry ] } || [ [ key, value ] ] }
  end

  # Marks sensitive values for redaction in logs and human-visible output.
@@ -66,7 +66,7 @@ module Kamal::Utils
    Array(filters).select do |filter|
      matches += Array(items).select do |item|
        # Only allow * for a wildcard
-        pattern = Regexp.escape(filter).gsub('\*', '.*')
+        pattern = Regexp.escape(filter).gsub('\*', ".*")
        # items are roles or hosts
        (item.respond_to?(:name) ? item.name : item).match(/^#{pattern}$/)
      end
--- a/test/cli/accessory_test.rb
+++ b/test/cli/accessory_test.rb
@@ -7,7 +7,7 @@ class CliAccessoryTest < CliTestCase

    run_command("boot", "mysql").tap do |output|
      assert_match /docker login.*on 1.1.1.3/, output
-      assert_match "docker run --name app-mysql --detach --restart unless-stopped --log-opt max-size=\"10m\" --publish 3306:3306 --env-file .kamal/env/accessories/app-mysql.env --volume $PWD/app-mysql/etc/mysql/my.cnf:/etc/mysql/my.cnf --volume $PWD/app-mysql/data:/var/lib/mysql --label service=\"app-mysql\" mysql:5.7 on 1.1.1.3", output
+      assert_match "docker run --name app-mysql --detach --restart unless-stopped --log-opt max-size=\"10m\" --publish 3306:3306 --env-file .kamal/env/accessories/app-mysql.env --env MYSQL_ROOT_HOST=\"%\" --volume $PWD/app-mysql/etc/mysql/my.cnf:/etc/mysql/my.cnf --volume $PWD/app-mysql/data:/var/lib/mysql --label service=\"app-mysql\" mysql:5.7 on 1.1.1.3", output
    end
  end

@@ -21,7 +21,7 @@ class CliAccessoryTest < CliTestCase
      assert_match /docker login.*on 1.1.1.3/, output
      assert_match /docker login.*on 1.1.1.1/, output
      assert_match /docker login.*on 1.1.1.2/, output
-      assert_match "docker run --name app-mysql --detach --restart unless-stopped --log-opt max-size=\"10m\" --publish 3306:3306 --env-file .kamal/env/accessories/app-mysql.env --volume $PWD/app-mysql/etc/mysql/my.cnf:/etc/mysql/my.cnf --volume $PWD/app-mysql/data:/var/lib/mysql --label service=\"app-mysql\" mysql:5.7 on 1.1.1.3", output
+      assert_match "docker run --name app-mysql --detach --restart unless-stopped --log-opt max-size=\"10m\" --publish 3306:3306 --env-file .kamal/env/accessories/app-mysql.env --env MYSQL_ROOT_HOST=\"%\" --volume $PWD/app-mysql/etc/mysql/my.cnf:/etc/mysql/my.cnf --volume $PWD/app-mysql/data:/var/lib/mysql --label service=\"app-mysql\" mysql:5.7 on 1.1.1.3", output
      assert_match "docker run --name app-redis --detach --restart unless-stopped --log-opt max-size=\"10m\" --publish 6379:6379 --env-file .kamal/env/accessories/app-redis.env --volume $PWD/app-redis/data:/data --label service=\"app-redis\" redis:latest on 1.1.1.1", output
      assert_match "docker run --name app-redis --detach --restart unless-stopped --log-opt max-size=\"10m\" --publish 6379:6379 --env-file .kamal/env/accessories/app-redis.env --volume $PWD/app-redis/data:/data --label service=\"app-redis\" redis:latest on 1.1.1.2", output
    end
@@ -79,6 +79,10 @@ class CliAccessoryTest < CliTestCase
    assert_match "docker ps --filter label=service=app-mysql", run_command("details", "mysql")
  end

+  test "details with non-existent accessory" do
+    assert_equal "No accessory by the name of 'hello' (options: mysql and redis)", stderred { run_command("details", "hello") }
+  end
+
  test "details with all" do
    run_command("details", "all").tap do |output|
      assert_match "docker ps --filter label=service=app-mysql", output
@@ -154,9 +158,9 @@ class CliAccessoryTest < CliTestCase

    run_command("boot", "redis", "--hosts", "1.1.1.1").tap do |output|
      assert_match /docker login.*on 1.1.1.1/, output
-      refute_match /docker login.*on 1.1.1.2/, output
+      assert_no_match /docker login.*on 1.1.1.2/, output
      assert_match "docker run --name app-redis --detach --restart unless-stopped --log-opt max-size=\"10m\" --publish 6379:6379 --env-file .kamal/env/accessories/app-redis.env --volume $PWD/app-redis/data:/data --label service=\"app-redis\" redis:latest on 1.1.1.1", output
-      refute_match "docker run --name app-redis --detach --restart unless-stopped --log-opt max-size=\"10m\" --publish 6379:6379 --env-file .kamal/env/accessories/app-redis.env --volume $PWD/app-redis/data:/data --label service=\"app-redis\" redis:latest on 1.1.1.2", output
+      assert_no_match "docker run --name app-redis --detach --restart unless-stopped --log-opt max-size=\"10m\" --publish 6379:6379 --env-file .kamal/env/accessories/app-redis.env --volume $PWD/app-redis/data:/data --label service=\"app-redis\" redis:latest on 1.1.1.2", output
    end
  end

@@ -166,14 +170,14 @@ class CliAccessoryTest < CliTestCase

    run_command("boot", "redis", "--hosts", "1.1.1.1,1.1.1.3").tap do |output|
      assert_match /docker login.*on 1.1.1.1/, output
-      refute_match /docker login.*on 1.1.1.3/, output
+      assert_no_match /docker login.*on 1.1.1.3/, output
      assert_match "docker run --name app-redis --detach --restart unless-stopped --log-opt max-size=\"10m\" --publish 6379:6379 --env-file .kamal/env/accessories/app-redis.env --volume $PWD/app-redis/data:/data --label service=\"app-redis\" redis:latest on 1.1.1.1", output
-      refute_match "docker run --name app-redis --detach --restart unless-stopped --log-opt max-size=\"10m\" --publish 6379:6379 --env-file .kamal/env/accessories/app-redis.env --volume $PWD/app-redis/data:/data --label service=\"app-redis\" redis:latest on 1.1.1.3", output
+      assert_no_match "docker run --name app-redis --detach --restart unless-stopped --log-opt max-size=\"10m\" --publish 6379:6379 --env-file .kamal/env/accessories/app-redis.env --volume $PWD/app-redis/data:/data --label service=\"app-redis\" redis:latest on 1.1.1.3", output
    end
  end

  private
    def run_command(*command)
-      stdouted { Kamal::Cli::Accessory.start([*command, "-c", "test/fixtures/deploy_with_accessories.yml"]) }
+      stdouted { Kamal::Cli::Accessory.start([ *command, "-c", "test/fixtures/deploy_with_accessories.yml" ]) }
    end
 end
--- a/test/cli/app_test.rb
+++ b/test/cli/app_test.rb
@@ -27,7 +27,7 @@ class CliAppTest < CliTestCase
      .returns("123") # old version

    SSHKit::Backend::Abstract.any_instance.expects(:capture_with_info)
-      .with(:docker, :inspect, "-f '{{ range .Mounts }}{{printf \"%s %s\\n\" .Source .Destination}}{{ end }}'", "app-web-123", "|", :awk, "'$2 == \"/tmp/kamal-cord\" {print $1}'", :raise_on_non_zero_exit => false)
+      .with(:docker, :inspect, "-f '{{ range .Mounts }}{{printf \"%s %s\\n\" .Source .Destination}}{{ end }}'", "app-web-123", "|", :awk, "'$2 == \"/tmp/kamal-cord\" {print $1}'", raise_on_non_zero_exit: false)
      .returns("cordfile") # old version

    SSHKit::Backend::Abstract.any_instance.expects(:capture_with_info)
@@ -57,7 +57,7 @@ class CliAppTest < CliTestCase
  test "boot errors leave lock in place" do
    Kamal::Cli::App.any_instance.expects(:using_version).raises(RuntimeError)

-    assert !KAMAL.holding_lock?
+    assert_not KAMAL.holding_lock?
    assert_raises(RuntimeError) do
      stderred { run_command("boot") }
    end
@@ -79,7 +79,7 @@ class CliAppTest < CliTestCase
      .returns("123").twice # old version

    SSHKit::Backend::Abstract.any_instance.expects(:capture_with_info)
-      .with(:docker, :inspect, "-f '{{ range .Mounts }}{{printf \"%s %s\\n\" .Source .Destination}}{{ end }}'", "app-web-123", "|", :awk, "'$2 == \"/tmp/kamal-cord\" {print $1}'", :raise_on_non_zero_exit => false)
+      .with(:docker, :inspect, "-f '{{ range .Mounts }}{{printf \"%s %s\\n\" .Source .Destination}}{{ end }}'", "app-web-123", "|", :awk, "'$2 == \"/tmp/kamal-cord\" {print $1}'", raise_on_non_zero_exit: false)
      .returns("") # old version

    run_command("boot", config: :with_assets).tap do |output|
@@ -223,14 +223,14 @@ class CliAppTest < CliTestCase


  test "version through main" do
-    stdouted { Kamal::Cli::Main.start(["app", "version", "-c", "test/fixtures/deploy_with_accessories.yml", "--hosts", "1.1.1.1"]) }.tap do |output|
+    stdouted { Kamal::Cli::Main.start([ "app", "version", "-c", "test/fixtures/deploy_with_accessories.yml", "--hosts", "1.1.1.1" ]) }.tap do |output|
      assert_match "docker ps --filter label=service=app --filter label=role=web --filter status=running --filter status=restarting --latest --format \"{{.Names}}\" | while read line; do echo ${line#app-web-}; done", output
    end
  end

  private
    def run_command(*command, config: :with_accessories)
-      stdouted { Kamal::Cli::App.start([*command, "-c", "test/fixtures/deploy_#{config}.yml", "--hosts", "1.1.1.1"]) }
+      stdouted { Kamal::Cli::App.start([ *command, "-c", "test/fixtures/deploy_#{config}.yml", "--hosts", "1.1.1.1" ]) }
    end

    def stub_running
--- a/test/cli/build_test.rb
+++ b/test/cli/build_test.rb
@@ -25,7 +25,7 @@ class CliBuildTest < CliTestCase
      .with(:docker, "--version", "&&", :docker, :buildx, "version")

    SSHKit::Backend::Abstract.any_instance.stubs(:execute)
-      .with { |*args| args[0..1] == [:docker, :buildx] }
+      .with { |*args| args[0..1] == [ :docker, :buildx ] }
      .raises(SSHKit::Command::Failed.new("no builder"))
      .then
      .returns(true)
@@ -50,7 +50,7 @@ class CliBuildTest < CliTestCase

    assert_raises(Kamal::Cli::HookError) { run_command("push") }

-    assert @executions.none? { |args| args[0..2] == [:docker, :buildx, :build] }
+    assert @executions.none? { |args| args[0..2] == [ :docker, :buildx, :build ] }
  end

  test "pull" do
@@ -105,13 +105,13 @@ class CliBuildTest < CliTestCase

  private
    def run_command(*command, fixture: :with_accessories)
-      stdouted { Kamal::Cli::Build.start([*command, "-c", "test/fixtures/deploy_#{fixture}.yml"]) }
+      stdouted { Kamal::Cli::Build.start([ *command, "-c", "test/fixtures/deploy_#{fixture}.yml" ]) }
    end

    def stub_dependency_checks
      SSHKit::Backend::Abstract.any_instance.stubs(:execute)
        .with(:docker, "--version", "&&", :docker, :buildx, "version")
      SSHKit::Backend::Abstract.any_instance.stubs(:execute)
-        .with { |*args| args[0..1] == [:docker, :buildx] }
+        .with { |*args| args[0..1] == [ :docker, :buildx ] }
    end
 end
--- a/test/cli/cli_test_case.rb
+++ b/test/cli/cli_test_case.rb
@@ -21,7 +21,7 @@ class CliTestCase < ActiveSupport::TestCase
      Kamal::Commands::Hook.any_instance.stubs(:hook_exists?).returns(true)

      SSHKit::Backend::Abstract.any_instance.stubs(:execute)
-        .with { |*args| @executions << args; args != [".kamal/hooks/#{hook}"] }
+        .with { |*args| @executions << args; args != [ ".kamal/hooks/#{hook}" ] }
      SSHKit::Backend::Abstract.any_instance.stubs(:execute)
        .with { |*args| args.first == ".kamal/hooks/#{hook}" }
        .raises(SSHKit::Command::Failed.new("failed"))
--- a/test/cli/env_test.rb
+++ b/test/cli/env_test.rb
@@ -13,7 +13,6 @@ class CliEnvTest < CliTestCase
      assert_match ".kamal/env/roles/app-workers.env", output
      assert_match ".kamal/env/traefik/traefik.env", output
      assert_match ".kamal/env/accessories/app-redis.env", output
-
    end
  end

@@ -33,6 +32,6 @@ class CliEnvTest < CliTestCase

  private
    def run_command(*command)
-      stdouted { Kamal::Cli::Env.start([*command, "-c", "test/fixtures/deploy_with_accessories.yml"]) }
+      stdouted { Kamal::Cli::Env.start([ *command, "-c", "test/fixtures/deploy_with_accessories.yml" ]) }
    end
 end
--- a/test/cli/healthcheck_test.rb
+++ b/test/cli/healthcheck_test.rb
@@ -64,10 +64,10 @@ class CliHealthcheckTest < CliTestCase
    end
    assert_match "container not ready (unhealthy)", exception.message
  end
-  
+
  test "raises an exception if primary does not have traefik" do
    SSHKit::Backend::Abstract.any_instance.expects(:execute).never
-    
+
    exception = assert_raises do
      run_command("perform", config_file: "test/fixtures/deploy_workers_only.yml")
    end
@@ -77,6 +77,6 @@ class CliHealthcheckTest < CliTestCase

  private
    def run_command(*command, config_file: "test/fixtures/deploy_with_accessories.yml")
-      stdouted { Kamal::Cli::Healthcheck.start([*command, "-c", config_file]) } 
+      stdouted { Kamal::Cli::Healthcheck.start([ *command, "-c", config_file ]) }
    end
 end
--- a/test/cli/lock_test.rb
+++ b/test/cli/lock_test.rb
@@ -15,6 +15,6 @@ class CliLockTest < CliTestCase

  private
    def run_command(*command)
-      stdouted { Kamal::Cli::Lock.start([*command, "-v", "-c", "test/fixtures/deploy_with_accessories.yml"]) }
+      stdouted { Kamal::Cli::Lock.start([ *command, "-v", "-c", "test/fixtures/deploy_with_accessories.yml" ]) }
    end
 end
--- a/test/cli/main_test.rb
+++ b/test/cli/main_test.rb
@@ -3,7 +3,7 @@ require_relative "cli_test_case"
 class CliMainTest < CliTestCase
  test "setup" do
    invoke_options = { "config_file" => "test/fixtures/deploy_simple.yml", "version" => "999", "skip_hooks" => false }
-    
+
    Kamal::Cli::Main.any_instance.expects(:invoke).with("kamal:cli:server:bootstrap", [], invoke_options)
    Kamal::Cli::Main.any_instance.expects(:invoke).with("kamal:cli:env:push", [], invoke_options)
    Kamal::Cli::Main.any_instance.expects(:invoke).with("kamal:cli:accessory:boot", [ "all" ], invoke_options)
@@ -102,7 +102,7 @@ class CliMainTest < CliTestCase
      .with { |*args| args == [ :mkdir, "-p", ".kamal" ] }

    SSHKit::Backend::Abstract.any_instance.stubs(:execute)
-      .with { |*arg| arg[0..1] == [:mkdir, ".kamal/lock-app"] }
+      .with { |*arg| arg[0..1] == [ :mkdir, ".kamal/lock-app" ] }
      .raises(RuntimeError, "mkdir: cannot create directory ‘kamal_lock-app’: File exists")

    SSHKit::Backend::Abstract.any_instance.expects(:capture_with_debug)
@@ -120,7 +120,7 @@ class CliMainTest < CliTestCase
      .with { |*args| args == [ :mkdir, "-p", ".kamal" ] }

    SSHKit::Backend::Abstract.any_instance.stubs(:execute)
-      .with { |*arg| arg[0..1] == [:mkdir, ".kamal/lock-app"] }
+      .with { |*arg| arg[0..1] == [ :mkdir, ".kamal/lock-app" ] }
      .raises(SocketError, "getaddrinfo: nodename nor servname provided, or not known")

    assert_raises(SSHKit::Runner::ExecuteError) do
@@ -135,11 +135,11 @@ class CliMainTest < CliTestCase
      .with("kamal:cli:registry:login", [], invoke_options)
      .raises(RuntimeError)

-    assert !KAMAL.holding_lock?
+    assert_not KAMAL.holding_lock?
    assert_raises(RuntimeError) do
      stderred { run_command("deploy") }
    end
-    assert !KAMAL.holding_lock?
+    assert_not KAMAL.holding_lock?
  end

  test "deploy with skipped hooks" do
@@ -154,15 +154,15 @@ class CliMainTest < CliTestCase
    Kamal::Cli::Main.any_instance.expects(:invoke).with("kamal:cli:prune:all", [], invoke_options)

    run_command("deploy", "--skip_hooks") do
-      refute_match /Running the post-deploy hook.../, output
+      assert_no_match /Running the post-deploy hook.../, output
    end
  end
-  
+
  test "deploy without healthcheck if primary host doesn't have traefik" do
    invoke_options = { "config_file" => "test/fixtures/deploy_workers_only.yml", "version" => "999", "skip_hooks" => false }

    Kamal::Cli::Main.any_instance.expects(:invoke).with("kamal:cli:healthcheck:perform", [], invoke_options).never
-    
+
    Kamal::Cli::Main.any_instance.expects(:invoke).with("kamal:cli:registry:login", [], invoke_options)
    Kamal::Cli::Main.any_instance.expects(:invoke).with("kamal:cli:build:deliver", [], invoke_options)
    Kamal::Cli::Main.any_instance.expects(:invoke).with("kamal:cli:traefik:boot", [], invoke_options)
@@ -252,7 +252,7 @@ class CliMainTest < CliTestCase
    end

    SSHKit::Backend::Abstract.any_instance.expects(:capture_with_info)
-      .with(:docker, :inspect, "-f '{{ range .Mounts }}{{printf \"%s %s\\n\" .Source .Destination}}{{ end }}'", "app-web-version-to-rollback", "|", :awk, "'$2 == \"/tmp/kamal-cord\" {print $1}'", :raise_on_non_zero_exit => false)
+      .with(:docker, :inspect, "-f '{{ range .Mounts }}{{printf \"%s %s\\n\" .Source .Destination}}{{ end }}'", "app-web-version-to-rollback", "|", :awk, "'$2 == \"/tmp/kamal-cord\" {print $1}'", raise_on_non_zero_exit: false)
      .returns("corddirectory").at_least_once # health check

    SSHKit::Backend::Abstract.any_instance.expects(:capture_with_info)
@@ -311,8 +311,8 @@ class CliMainTest < CliTestCase
    run_command("config", config_file: "deploy_simple").tap do |output|
      config = YAML.load(output)

-      assert_equal ["web"], config[:roles]
-      assert_equal ["1.1.1.1", "1.1.1.2"], config[:hosts]
+      assert_equal [ "web" ], config[:roles]
+      assert_equal [ "1.1.1.1", "1.1.1.2" ], config[:hosts]
      assert_equal "999", config[:version]
      assert_equal "dhh/app", config[:repository]
      assert_equal "dhh/app:999", config[:absolute_image]
@@ -324,8 +324,8 @@ class CliMainTest < CliTestCase
    run_command("config", config_file: "deploy_with_roles").tap do |output|
      config = YAML.load(output)

-      assert_equal ["web", "workers"], config[:roles]
-      assert_equal ["1.1.1.1", "1.1.1.2", "1.1.1.3", "1.1.1.4"], config[:hosts]
+      assert_equal [ "web", "workers" ], config[:roles]
+      assert_equal [ "1.1.1.1", "1.1.1.2", "1.1.1.3", "1.1.1.4" ], config[:hosts]
      assert_equal "999", config[:version]
      assert_equal "registry.digitalocean.com/dhh/app", config[:repository]
      assert_equal "registry.digitalocean.com/dhh/app:999", config[:absolute_image]
@@ -337,8 +337,8 @@ class CliMainTest < CliTestCase
    run_command("config", config_file: "deploy_primary_web_role_override").tap do |output|
      config = YAML.load(output)

-      assert_equal ["web_chicago", "web_tokyo"], config[:roles]
-      assert_equal ["1.1.1.1", "1.1.1.2", "1.1.1.3", "1.1.1.4"], config[:hosts]
+      assert_equal [ "web_chicago", "web_tokyo" ], config[:roles]
+      assert_equal [ "1.1.1.1", "1.1.1.2", "1.1.1.3", "1.1.1.4" ], config[:hosts]
      assert_equal "1.1.1.3", config[:primary_host]
    end
  end
@@ -347,8 +347,8 @@ class CliMainTest < CliTestCase
    run_command("config", "-d", "world", config_file: "deploy_for_dest").tap do |output|
      config = YAML.load(output)

-      assert_equal ["web"], config[:roles]
-      assert_equal ["1.1.1.1", "1.1.1.2"], config[:hosts]
+      assert_equal [ "web" ], config[:roles]
+      assert_equal [ "1.1.1.1", "1.1.1.2" ], config[:hosts]
      assert_equal "999", config[:version]
      assert_equal "registry.digitalocean.com/dhh/app", config[:repository]
      assert_equal "registry.digitalocean.com/dhh/app:999", config[:absolute_image]
@@ -360,8 +360,8 @@ class CliMainTest < CliTestCase
    run_command("config", config_file: "deploy_with_aliases").tap do |output|
      config = YAML.load(output)

-      assert_equal ["web", "web_tokyo", "workers", "workers_tokyo"], config[:roles]
-      assert_equal ["1.1.1.1", "1.1.1.2", "1.1.1.3", "1.1.1.4"], config[:hosts]
+      assert_equal [ "web", "web_tokyo", "workers", "workers_tokyo" ], config[:roles]
+      assert_equal [ "1.1.1.1", "1.1.1.2", "1.1.1.3", "1.1.1.4" ], config[:hosts]
      assert_equal "999", config[:version]
      assert_equal "registry.digitalocean.com/dhh/app", config[:repository]
      assert_equal "registry.digitalocean.com/dhh/app:999", config[:absolute_image]
@@ -487,6 +487,6 @@ class CliMainTest < CliTestCase

  private
    def run_command(*command, config_file: "deploy_simple")
-      stdouted { Kamal::Cli::Main.start([*command, "-c", "test/fixtures/#{config_file}.yml"]) }
+      stdouted { Kamal::Cli::Main.start([ *command, "-c", "test/fixtures/#{config_file}.yml" ]) }
    end
 end
--- a/test/cli/prune_test.rb
+++ b/test/cli/prune_test.rb
@@ -33,6 +33,6 @@ class CliPruneTest < CliTestCase

  private
    def run_command(*command)
-      stdouted { Kamal::Cli::Prune.start([*command, "-c", "test/fixtures/deploy_with_accessories.yml"]) }
+      stdouted { Kamal::Cli::Prune.start([ *command, "-c", "test/fixtures/deploy_with_accessories.yml" ]) }
    end
 end
--- a/test/cli/registry_test.rb
+++ b/test/cli/registry_test.rb
@@ -16,6 +16,6 @@ class CliRegistryTest < CliTestCase

  private
    def run_command(*command)
-      stdouted { Kamal::Cli::Registry.start([*command, "-c", "test/fixtures/deploy_with_accessories.yml"]) }
+      stdouted { Kamal::Cli::Registry.start([ *command, "-c", "test/fixtures/deploy_with_accessories.yml" ]) }
    end
 end
--- a/test/cli/server_test.rb
+++ b/test/cli/server_test.rb
@@ -36,6 +36,6 @@ class CliServerTest < CliTestCase

  private
    def run_command(*command)
-      stdouted { Kamal::Cli::Server.start([*command, "-c", "test/fixtures/deploy_with_accessories.yml"]) }
+      stdouted { Kamal::Cli::Server.start([ *command, "-c", "test/fixtures/deploy_with_accessories.yml" ]) }
    end
 end
--- a/test/cli/traefik_test.rb
+++ b/test/cli/traefik_test.rb
@@ -11,7 +11,7 @@ class CliTraefikTest < CliTestCase
  test "reboot" do
    Kamal::Commands::Registry.any_instance.expects(:login).twice

-    run_command("reboot").tap do |output|
+    run_command("reboot", "-y").tap do |output|
      assert_match "docker container stop traefik", output
      assert_match "docker container prune --force --filter label=org.opencontainers.image.title=Traefik", output
      assert_match "docker run --name traefik --detach --restart unless-stopped --publish 80:80 --volume /var/run/docker.sock:/var/run/docker.sock --env-file .kamal/env/traefik/traefik.env --log-opt max-size=\"10m\" --label traefik.http.routers.catchall.entryPoints=\"http\" --label traefik.http.routers.catchall.rule=\"PathPrefix(\\`/\\`)\" --label traefik.http.routers.catchall.service=\"unavailable\" --label traefik.http.routers.catchall.priority=\"1\" --label traefik.http.services.unavailable.loadbalancer.server.port=\"0\" #{Kamal::Commands::Traefik::DEFAULT_IMAGE} --providers.docker --log.level=\"DEBUG\"", output
@@ -21,7 +21,7 @@ class CliTraefikTest < CliTestCase
  test "reboot --rolling" do
    Object.any_instance.stubs(:sleep)

-    run_command("reboot", "--rolling").tap do |output|
+    run_command("reboot", "--rolling", "-y").tap do |output|
      assert_match "Running docker container prune --force --filter label=org.opencontainers.image.title=Traefik on 1.1.1.1", output
    end
  end
@@ -91,6 +91,6 @@ class CliTraefikTest < CliTestCase

  private
    def run_command(*command)
-      stdouted { Kamal::Cli::Traefik.start([*command, "-c", "test/fixtures/deploy_with_accessories.yml"]) }
+      stdouted { Kamal::Cli::Traefik.start([ *command, "-c", "test/fixtures/deploy_with_accessories.yml" ]) }
    end
 end
--- a/test/commands/accessory_test.rb
+++ b/test/commands/accessory_test.rb
@@ -50,11 +50,11 @@ class CommandsAccessoryTest < ActiveSupport::TestCase

  test "run" do
    assert_equal \
-      "docker run --name app-mysql --detach --restart unless-stopped --log-opt max-size=\"10m\" --publish 3306:3306 --env-file .kamal/env/accessories/app-mysql.env --label service=\"app-mysql\" private.registry/mysql:8.0",
+      "docker run --name app-mysql --detach --restart unless-stopped --log-opt max-size=\"10m\" --publish 3306:3306 --env-file .kamal/env/accessories/app-mysql.env --env MYSQL_ROOT_HOST=\"%\" --label service=\"app-mysql\" private.registry/mysql:8.0",
      new_command(:mysql).run.join(" ")

    assert_equal \
-      "docker run --name app-redis --detach --restart unless-stopped --log-opt max-size=\"10m\" --publish 6379:6379 --env-file .kamal/env/accessories/app-redis.env --volume /var/lib/redis:/data --label service=\"app-redis\" --label cache=\"true\" redis:latest",
+      "docker run --name app-redis --detach --restart unless-stopped --log-opt max-size=\"10m\" --publish 6379:6379 --env-file .kamal/env/accessories/app-redis.env --env SOMETHING=\"else\" --volume /var/lib/redis:/data --label service=\"app-redis\" --label cache=\"true\" redis:latest",
      new_command(:redis).run.join(" ")

    assert_equal \
@@ -91,7 +91,7 @@ class CommandsAccessoryTest < ActiveSupport::TestCase

  test "execute in new container" do
    assert_equal \
-      "docker run --rm --env-file .kamal/env/accessories/app-mysql.env private.registry/mysql:8.0 mysql -u root",
+      "docker run --rm --env-file .kamal/env/accessories/app-mysql.env --env MYSQL_ROOT_HOST=\"%\" private.registry/mysql:8.0 mysql -u root",
      new_command(:mysql).execute_in_new_container("mysql", "-u", "root").join(" ")
  end

@@ -103,14 +103,14 @@ class CommandsAccessoryTest < ActiveSupport::TestCase

  test "execute in new container over ssh" do
    new_command(:mysql).stub(:run_over_ssh, ->(cmd) { cmd.join(" ") }) do
-      assert_match %r|docker run -it --rm --env-file .kamal/env/accessories/app-mysql.env private.registry/mysql:8.0 mysql -u root|,
+      assert_match %r{docker run -it --rm --env-file .kamal/env/accessories/app-mysql.env --env MYSQL_ROOT_HOST=\"%\" private.registry/mysql:8.0 mysql -u root},
        new_command(:mysql).execute_in_new_container_over_ssh("mysql", "-u", "root")
    end
  end

  test "execute in existing container over ssh" do
    new_command(:mysql).stub(:run_over_ssh, ->(cmd) { cmd.join(" ") }) do
-      assert_match %r|docker exec -it app-mysql mysql -u root|,
+      assert_match %r{docker exec -it app-mysql mysql -u root},
        new_command(:mysql).execute_in_existing_container_over_ssh("mysql", "-u", "root")
    end
  end
--- a/test/commands/app_test.rb
+++ b/test/commands/app_test.rb
@@ -25,7 +25,7 @@ class CommandsAppTest < ActiveSupport::TestCase
  end

  test "run with volumes" do
-    @config[:volumes] = ["/local/path:/container/path" ]
+    @config[:volumes] = [ "/local/path:/container/path" ]

    assert_equal \
      "docker run --detach --restart unless-stopped --name app-web-999 -e KAMAL_CONTAINER_NAME=\"app-web-999\" -e KAMAL_VERSION=\"999\" --env-file .kamal/env/roles/app-web.env --health-cmd \"(curl -f http://localhost:3000/up || exit 1) && (stat /tmp/kamal-cord/cord > /dev/null || exit 1)\" --health-interval \"1s\" --volume $(pwd)/.kamal/cords/app-web-12345678901234567890123456789012:/tmp/kamal-cord --log-opt max-size=\"10m\" --volume /local/path:/container/path --label service=\"app\" --label role=\"web\" --label traefik.http.services.app-web.loadbalancer.server.scheme=\"http\" --label traefik.http.routers.app-web.rule=\"PathPrefix(\\`/\\`)\" --label traefik.http.routers.app-web.priority=\"2\" --label traefik.http.middlewares.app-web-retry.retry.attempts=\"5\" --label traefik.http.middlewares.app-web-retry.retry.initialinterval=\"500ms\" --label traefik.http.routers.app-web.middlewares=\"app-web-retry@docker\" dhh/app:999",
@@ -191,18 +191,18 @@ class CommandsAppTest < ActiveSupport::TestCase
  end

  test "execute in new container over ssh" do
-    assert_match %r|docker run -it --rm --env-file .kamal/env/roles/app-web.env dhh/app:999 bin/rails c|,
+    assert_match %r{docker run -it --rm --env-file .kamal/env/roles/app-web.env dhh/app:999 bin/rails c},
      new_command.execute_in_new_container_over_ssh("bin/rails", "c", host: "app-1")
  end

  test "execute in new container with custom options over ssh" do
    @config[:servers] = { "web" => { "hosts" => [ "1.1.1.1" ], "options" => { "mount" => "somewhere", "cap-add" => true } } }
-    assert_match %r|docker run -it --rm --env-file .kamal/env/roles/app-web.env --mount \"somewhere\" --cap-add dhh/app:999 bin/rails c|,
+    assert_match %r{docker run -it --rm --env-file .kamal/env/roles/app-web.env --mount \"somewhere\" --cap-add dhh/app:999 bin/rails c},
      new_command.execute_in_new_container_over_ssh("bin/rails", "c", host: "app-1")
  end

  test "execute in existing container over ssh" do
-    assert_match %r|docker exec -it app-web-999 bin/rails c|,
+    assert_match %r{docker exec -it app-web-999 bin/rails c},
      new_command.execute_in_existing_container_over_ssh("bin/rails", "c", host: "app-1")
  end

@@ -387,7 +387,7 @@ class CommandsAppTest < ActiveSupport::TestCase
      :mkdir, "-p", ".kamal/assets/volumes/app-web-999", ";",
      :cp, "-rnT", ".kamal/assets/extracted/app-web-999", ".kamal/assets/volumes/app-web-999", ";",
      :cp, "-rnT", ".kamal/assets/extracted/app-web-999", ".kamal/assets/volumes/app-web-998", "|| true", ";",
-      :cp, "-rnT", ".kamal/assets/extracted/app-web-998", ".kamal/assets/volumes/app-web-999", "|| true",
+      :cp, "-rnT", ".kamal/assets/extracted/app-web-998", ".kamal/assets/volumes/app-web-999", "|| true"
    ], new_command(asset_path: "/public/assets").sync_asset_volumes(old_version: 998)
  end

--- a/test/commands/builder_test.rb
+++ b/test/commands/builder_test.rb
@@ -6,7 +6,7 @@ class CommandsBuilderTest < ActiveSupport::TestCase
  end

  test "target multiarch by default" do
-    builder = new_builder_command(builder: { "cache" => { "type" => "gha" }})
+    builder = new_builder_command(builder: { "cache" => { "type" => "gha" } })
    assert_equal "multiarch", builder.name
    assert_equal \
      "docker buildx build --push --platform linux/amd64,linux/arm64 --builder kamal-app-multiarch -t dhh/app:123 -t dhh/app:latest --cache-to type=gha --cache-from type=gha --label service=\"app\" --file Dockerfile .",
@@ -22,7 +22,7 @@ class CommandsBuilderTest < ActiveSupport::TestCase
  end

  test "target native cached when multiarch is off and cache is set" do
-    builder = new_builder_command(builder: { "multiarch" => false, "cache" => { "type" => "gha" }})
+    builder = new_builder_command(builder: { "multiarch" => false, "cache" => { "type" => "gha" } })
    assert_equal "native/cached", builder.name
    assert_equal \
      "docker buildx build --push -t dhh/app:123 -t dhh/app:latest --cache-to type=gha --cache-from type=gha --label service=\"app\" --file Dockerfile .",
@@ -30,7 +30,7 @@ class CommandsBuilderTest < ActiveSupport::TestCase
  end

  test "target multiarch remote when local and remote is set" do
-    builder = new_builder_command(builder: { "local" => { }, "remote" => { }, "cache" => { "type" => "gha" } })
+    builder = new_builder_command(builder: { "local" => {}, "remote" => {}, "cache" => { "type" => "gha" } })
    assert_equal "multiarch/remote", builder.name
    assert_equal \
      "docker buildx build --push --platform linux/amd64,linux/arm64 --builder kamal-app-multiarch-remote -t dhh/app:123 -t dhh/app:latest --cache-to type=gha --cache-from type=gha --label service=\"app\" --file Dockerfile .",
@@ -61,7 +61,7 @@ class CommandsBuilderTest < ActiveSupport::TestCase
  end

  test "build secrets" do
-    builder = new_builder_command(builder: { "secrets" => ["token_a", "token_b"] })
+    builder = new_builder_command(builder: { "secrets" => [ "token_a", "token_b" ] })
    assert_equal \
      "-t dhh/app:123 -t dhh/app:latest --label service=\"app\" --secret id=\"token_a\" --secret id=\"token_b\" --file Dockerfile",
      builder.target.build_options.join(" ")
@@ -112,7 +112,7 @@ class CommandsBuilderTest < ActiveSupport::TestCase
  end

  test "build with ssh agent socket" do
-    builder = new_builder_command(builder: { "ssh" => 'default=$SSH_AUTH_SOCK' })
+    builder = new_builder_command(builder: { "ssh" => "default=$SSH_AUTH_SOCK" })

    assert_equal \
      "-t dhh/app:123 -t dhh/app:latest --label service=\"app\" --file Dockerfile --ssh default=$SSH_AUTH_SOCK",
--- a/test/commands/traefik_test.rb
+++ b/test/commands/traefik_test.rb
@@ -37,7 +37,7 @@ class CommandsTraefikTest < ActiveSupport::TestCase
      "docker run --name traefik --detach --restart unless-stopped --publish 80:80 --volume /var/run/docker.sock:/var/run/docker.sock --env-file .kamal/env/traefik/traefik.env --log-opt max-size=\"10m\" --label traefik.http.routers.catchall.entryPoints=\"http\" --label traefik.http.routers.catchall.rule=\"PathPrefix(\\`/\\`)\" --label traefik.http.routers.catchall.service=\"unavailable\" --label traefik.http.routers.catchall.priority=\"1\" --label traefik.http.services.unavailable.loadbalancer.server.port=\"0\" #{@image} --providers.docker --log.level=\"DEBUG\" --accesslog.format=\"json\" --api.insecure --metrics.prometheus.buckets=\"0.1,0.3,1.2,5.0\"",
      new_command.run.join(" ")

-    @config[:traefik]["options"] = {"publish" => %w[9000:9000 9001:9001]}
+    @config[:traefik]["options"] = { "publish" => %w[9000:9000 9001:9001] }
    assert_equal \
      "docker run --name traefik --detach --restart unless-stopped --publish 80:80 --volume /var/run/docker.sock:/var/run/docker.sock --env-file .kamal/env/traefik/traefik.env --log-opt max-size=\"10m\" --label traefik.http.routers.catchall.entryPoints=\"http\" --label traefik.http.routers.catchall.rule=\"PathPrefix(\\`/\\`)\" --label traefik.http.routers.catchall.service=\"unavailable\" --label traefik.http.routers.catchall.priority=\"1\" --label traefik.http.services.unavailable.loadbalancer.server.port=\"0\" --publish \"9000:9000\" --publish \"9001:9001\" #{@image} --providers.docker --log.level=\"DEBUG\" --accesslog.format=\"json\" --api.insecure --metrics.prometheus.buckets=\"0.1,0.3,1.2,5.0\"",
      new_command.run.join(" ")
@@ -48,7 +48,7 @@ class CommandsTraefikTest < ActiveSupport::TestCase
      "docker run --name traefik --detach --restart unless-stopped --publish 80:80 --volume /var/run/docker.sock:/var/run/docker.sock --env-file .kamal/env/traefik/traefik.env --log-opt max-size=\"10m\" --label traefik.http.routers.catchall.entryPoints=\"http\" --label traefik.http.routers.catchall.rule=\"PathPrefix(\\`/\\`)\" --label traefik.http.routers.catchall.service=\"unavailable\" --label traefik.http.routers.catchall.priority=\"1\" --label traefik.http.services.unavailable.loadbalancer.server.port=\"0\" #{@image} --providers.docker --log.level=\"DEBUG\" --accesslog.format=\"json\" --api.insecure --metrics.prometheus.buckets=\"0.1,0.3,1.2,5.0\"",
      new_command.run.join(" ")

-    @config[:traefik]["options"] = {"volume" => %w[./letsencrypt/acme.json:/letsencrypt/acme.json] }
+    @config[:traefik]["options"] = { "volume" => %w[./letsencrypt/acme.json:/letsencrypt/acme.json] }
    assert_equal \
      "docker run --name traefik --detach --restart unless-stopped --publish 80:80 --volume /var/run/docker.sock:/var/run/docker.sock --env-file .kamal/env/traefik/traefik.env --log-opt max-size=\"10m\" --label traefik.http.routers.catchall.entryPoints=\"http\" --label traefik.http.routers.catchall.rule=\"PathPrefix(\\`/\\`)\" --label traefik.http.routers.catchall.service=\"unavailable\" --label traefik.http.routers.catchall.priority=\"1\" --label traefik.http.services.unavailable.loadbalancer.server.port=\"0\" --volume \"./letsencrypt/acme.json:/letsencrypt/acme.json\" #{@image} --providers.docker --log.level=\"DEBUG\" --accesslog.format=\"json\" --api.insecure --metrics.prometheus.buckets=\"0.1,0.3,1.2,5.0\"",
      new_command.run.join(" ")
@@ -59,7 +59,7 @@ class CommandsTraefikTest < ActiveSupport::TestCase
      "docker run --name traefik --detach --restart unless-stopped --publish 80:80 --volume /var/run/docker.sock:/var/run/docker.sock --env-file .kamal/env/traefik/traefik.env --log-opt max-size=\"10m\" --label traefik.http.routers.catchall.entryPoints=\"http\" --label traefik.http.routers.catchall.rule=\"PathPrefix(\\`/\\`)\" --label traefik.http.routers.catchall.service=\"unavailable\" --label traefik.http.routers.catchall.priority=\"1\" --label traefik.http.services.unavailable.loadbalancer.server.port=\"0\" #{@image} --providers.docker --log.level=\"DEBUG\" --accesslog.format=\"json\" --api.insecure --metrics.prometheus.buckets=\"0.1,0.3,1.2,5.0\"",
      new_command.run.join(" ")

-    @config[:traefik]["options"] = {"volume" => %w[./letsencrypt/acme.json:/letsencrypt/acme.json], "publish" => %w[8080:8080], "memory" => "512m"}
+    @config[:traefik]["options"] = { "volume" => %w[./letsencrypt/acme.json:/letsencrypt/acme.json], "publish" => %w[8080:8080], "memory" => "512m" }
    assert_equal \
      "docker run --name traefik --detach --restart unless-stopped --publish 80:80 --volume /var/run/docker.sock:/var/run/docker.sock --env-file .kamal/env/traefik/traefik.env --log-opt max-size=\"10m\" --label traefik.http.routers.catchall.entryPoints=\"http\" --label traefik.http.routers.catchall.rule=\"PathPrefix(\\`/\\`)\" --label traefik.http.routers.catchall.service=\"unavailable\" --label traefik.http.routers.catchall.priority=\"1\" --label traefik.http.services.unavailable.loadbalancer.server.port=\"0\" --volume \"./letsencrypt/acme.json:/letsencrypt/acme.json\" --publish \"8080:8080\" --memory \"512m\" #{@image} --providers.docker --log.level=\"DEBUG\" --accesslog.format=\"json\" --api.insecure --metrics.prometheus.buckets=\"0.1,0.3,1.2,5.0\"",
      new_command.run.join(" ")
@@ -138,7 +138,7 @@ class CommandsTraefikTest < ActiveSupport::TestCase
  test "traefik logs since 2h" do
    assert_equal \
      "docker logs traefik  --since 2h --timestamps 2>&1",
-      new_command.logs(since: '2h').join(" ")
+      new_command.logs(since: "2h").join(" ")
  end

  test "traefik logs last 10 lines" do
@@ -150,7 +150,7 @@ class CommandsTraefikTest < ActiveSupport::TestCase
  test "traefik logs with grep hello!" do
    assert_equal \
      "docker logs traefik --timestamps 2>&1 | grep 'hello!'",
-      new_command.logs(grep: 'hello!').join(" ")
+      new_command.logs(grep: "hello!").join(" ")
  end

  test "traefik remove container" do
@@ -174,17 +174,13 @@ class CommandsTraefikTest < ActiveSupport::TestCase
  test "traefik follow logs with grep hello!" do
    assert_equal \
      "ssh -t root@1.1.1.1 -p 22 'docker logs traefik --timestamps --tail 10 --follow 2>&1 | grep \"hello!\"'",
-      new_command.follow_logs(host: @config[:servers].first, grep: 'hello!')
+      new_command.follow_logs(host: @config[:servers].first, grep: "hello!")
  end

-  test "env_file" do
+  test "secrets io" do
    @config[:traefik]["env"] = { "secret" => %w[EXAMPLE_API_KEY] }

-    assert_equal "EXAMPLE_API_KEY=456\n", new_command.env_file.to_s
-  end
-
-  test "host_env_file_path" do
-    assert_equal ".kamal/env/traefik/traefik.env", new_command.host_env_file_path
+    assert_equal "EXAMPLE_API_KEY=456\n", new_command.env.secrets_io.string
  end

  test "make_env_directory" do
--- a/test/configuration/accessory_test.rb
+++ b/test/configuration/accessory_test.rb
@@ -20,7 +20,7 @@ class ConfigurationAccessoryTest < ActiveSupport::TestCase
            },
            "secret" => [
              "MYSQL_ROOT_PASSWORD"
-            ],
+            ]
          },
          "files" => [
            "config/mysql/my.cnf:/etc/mysql/my.cnf",
@@ -82,9 +82,9 @@ class ConfigurationAccessoryTest < ActiveSupport::TestCase
  end

  test "host" do
-    assert_equal ["1.1.1.5"], @config.accessory(:mysql).hosts
-    assert_equal ["1.1.1.6", "1.1.1.7"], @config.accessory(:redis).hosts
-    assert_equal ["1.1.1.1", "1.1.1.2"], @config.accessory(:monitoring).hosts
+    assert_equal [ "1.1.1.5" ], @config.accessory(:mysql).hosts
+    assert_equal [ "1.1.1.6", "1.1.1.7" ], @config.accessory(:redis).hosts
+    assert_equal [ "1.1.1.1", "1.1.1.2" ], @config.accessory(:monitoring).hosts
  end

  test "missing host" do
@@ -108,39 +108,35 @@ class ConfigurationAccessoryTest < ActiveSupport::TestCase
  end

  test "label args" do
-    assert_equal ["--label", "service=\"app-mysql\""], @config.accessory(:mysql).label_args
-    assert_equal ["--label", "service=\"app-redis\"", "--label", "cache=\"true\""], @config.accessory(:redis).label_args
+    assert_equal [ "--label", "service=\"app-mysql\"" ], @config.accessory(:mysql).label_args
+    assert_equal [ "--label", "service=\"app-redis\"", "--label", "cache=\"true\"" ], @config.accessory(:redis).label_args
  end

  test "env args" do
-    assert_equal ["--env-file", ".kamal/env/accessories/app-mysql.env"], @config.accessory(:mysql).env_args
-    assert_equal ["--env-file", ".kamal/env/accessories/app-redis.env"], @config.accessory(:redis).env_args
+    assert_equal [ "--env-file", ".kamal/env/accessories/app-mysql.env", "--env", "MYSQL_ROOT_HOST=\"%\"" ], @config.accessory(:mysql).env_args
+    assert_equal [ "--env-file", ".kamal/env/accessories/app-redis.env", "--env", "SOMETHING=\"else\"" ], @config.accessory(:redis).env_args
  end

-  test "env file with secret" do
+  test "env with secrets" do
    ENV["MYSQL_ROOT_PASSWORD"] = "secret123"

-    expected = <<~ENV
+    expected_secrets_file = <<~ENV
      MYSQL_ROOT_PASSWORD=secret123
-      MYSQL_ROOT_HOST=%
    ENV

-    assert_equal expected, @config.accessory(:mysql).env_file.to_s
+    assert_equal expected_secrets_file, @config.accessory(:mysql).env.secrets_io.string
+    assert_equal [ "--env-file", ".kamal/env/accessories/app-mysql.env", "--env", "MYSQL_ROOT_HOST=\"%\"" ], @config.accessory(:mysql).env_args
  ensure
    ENV["MYSQL_ROOT_PASSWORD"] = nil
  end

-  test "host_env_directory" do
-    assert_equal ".kamal/env/accessories", @config.accessory(:mysql).host_env_directory
-  end
-
-  test "host_env_file_path" do
-    assert_equal ".kamal/env/accessories/app-mysql.env", @config.accessory(:mysql).host_env_file_path
+  test "env secrets path" do
+    assert_equal ".kamal/env/accessories/app-mysql.env", @config.accessory(:mysql).env.secrets_file
  end

  test "volume args" do
-    assert_equal ["--volume", "$PWD/app-mysql/etc/mysql/my.cnf:/etc/mysql/my.cnf", "--volume", "$PWD/app-mysql/docker-entrypoint-initdb.d/structure.sql:/docker-entrypoint-initdb.d/structure.sql", "--volume", "$PWD/app-mysql/data:/var/lib/mysql"], @config.accessory(:mysql).volume_args
-    assert_equal ["--volume", "/var/lib/redis:/data"], @config.accessory(:redis).volume_args
+    assert_equal [ "--volume", "$PWD/app-mysql/etc/mysql/my.cnf:/etc/mysql/my.cnf", "--volume", "$PWD/app-mysql/docker-entrypoint-initdb.d/structure.sql:/docker-entrypoint-initdb.d/structure.sql", "--volume", "$PWD/app-mysql/data:/var/lib/mysql" ], @config.accessory(:mysql).volume_args
+    assert_equal [ "--volume", "/var/lib/redis:/data" ], @config.accessory(:redis).volume_args
  end

  test "dynamic file expansion" do
@@ -153,15 +149,15 @@ class ConfigurationAccessoryTest < ActiveSupport::TestCase

  test "directory with a relative path" do
    @deploy[:accessories]["mysql"]["directories"] = [ "data:/var/lib/mysql" ]
-    assert_equal({"$PWD/app-mysql/data"=>"/var/lib/mysql"}, @config.accessory(:mysql).directories)
+    assert_equal({ "$PWD/app-mysql/data"=>"/var/lib/mysql" }, @config.accessory(:mysql).directories)
  end

  test "directory with an absolute path" do
    @deploy[:accessories]["mysql"]["directories"] = [ "/var/data/mysql:/var/lib/mysql" ]
-    assert_equal({"/var/data/mysql"=>"/var/lib/mysql"}, @config.accessory(:mysql).directories)
+    assert_equal({ "/var/data/mysql"=>"/var/lib/mysql" }, @config.accessory(:mysql).directories)
  end

  test "options" do
-    assert_equal ["--cpus", "\"4\"", "--memory", "\"2GB\""], @config.accessory(:redis).option_args
+    assert_equal [ "--cpus", "\"4\"", "--memory", "\"2GB\"" ], @config.accessory(:redis).option_args
  end
 end
--- a/test/configuration/builder_test.rb
+++ b/test/configuration/builder_test.rb
@@ -124,9 +124,9 @@ class ConfigurationBuilderTest < ActiveSupport::TestCase
  end

  test "setting secrets" do
-    @deploy_with_builder_option[:builder] = { "secrets" => ["GITHUB_TOKEN"] }
+    @deploy_with_builder_option[:builder] = { "secrets" => [ "GITHUB_TOKEN" ] }

-    assert_equal ["GITHUB_TOKEN"], @config_with_builder_option.builder.secrets
+    assert_equal [ "GITHUB_TOKEN" ], @config_with_builder_option.builder.secrets
  end

  test "dockerfile" do
@@ -154,8 +154,8 @@ class ConfigurationBuilderTest < ActiveSupport::TestCase
  end

  test "setting ssh params" do
-    @deploy_with_builder_option[:builder] = { "ssh" => 'default=$SSH_AUTH_SOCK' }
+    @deploy_with_builder_option[:builder] = { "ssh" => "default=$SSH_AUTH_SOCK" }

-    assert_equal 'default=$SSH_AUTH_SOCK', @config_with_builder_option.builder.ssh
+    assert_equal "default=$SSH_AUTH_SOCK", @config_with_builder_option.builder.ssh
  end
 end
--- a/test/configuration/env_test.rb
+++ b/test/configuration/env_test.rb
@@ -0,0 +1,74 @@
+require "test_helper"
+
+class ConfigurationEnvTest < ActiveSupport::TestCase
+  require "test_helper"
+
+  test "simple" do
+    assert_config \
+      config: { "foo" => "bar", "baz" => "haz" },
+      clear: { "foo" => "bar", "baz" => "haz" },
+      secrets: {}
+  end
+
+  test "clear" do
+    assert_config \
+      config: { "clear" => { "foo" => "bar", "baz" => "haz" } },
+      clear: { "foo" => "bar", "baz" => "haz" },
+      secrets: {}
+  end
+
+  test "secret" do
+    ENV["PASSWORD"] = "hello"
+    env = Kamal::Configuration::Env.from_config config: { "secret" => [ "PASSWORD" ] }
+
+    assert_config \
+      config: { "secret" => [ "PASSWORD" ] },
+      clear: {},
+      secrets: { "PASSWORD" => "hello" }
+  ensure
+    ENV.delete "PASSWORD"
+  end
+
+  test "missing secret" do
+    env = {
+      "secret" => [ "PASSWORD" ]
+    }
+
+    assert_raises(KeyError) { Kamal::Configuration::Env.from_config(config: { "secret" => [ "PASSWORD" ] }).secrets }
+  end
+
+  test "secret and clear" do
+    ENV["PASSWORD"] = "hello"
+    config = {
+      "secret" => [ "PASSWORD" ],
+      "clear" => {
+        "foo" => "bar",
+        "baz" => "haz"
+      }
+    }
+
+    assert_config \
+      config: config,
+      clear: { "foo" => "bar", "baz" => "haz" },
+      secrets: { "PASSWORD" => "hello" }
+  ensure
+    ENV.delete "PASSWORD"
+  end
+
+  test "stringIO conversion" do
+    env = {
+      "foo" => "bar",
+      "baz" => "haz"
+    }
+
+    assert_equal "foo=bar\nbaz=haz\n", \
+      StringIO.new(Kamal::EnvFile.new(env)).read
+  end
+
+  private
+    def assert_config(config:, clear:, secrets:)
+      env = Kamal::Configuration::Env.from_config config: config
+      assert_equal clear, env.clear
+      assert_equal secrets, env.secrets
+    end
+end
--- a/test/configuration/role_test.rb
+++ b/test/configuration/role_test.rb
@@ -70,14 +70,10 @@ class ConfigurationRoleTest < ActiveSupport::TestCase
  end

  test "env overwritten by role" do
-    assert_equal "redis://a/b", @config_with_roles.role(:workers).env["REDIS_URL"]
+    assert_equal "redis://a/b", @config_with_roles.role(:workers).env.clear["REDIS_URL"]

-    expected_env = <<~ENV
-      REDIS_URL=redis://a/b
-      WEB_CONCURRENCY=4
-    ENV
-
-    assert_equal expected_env, @config_with_roles.role(:workers).env_file.to_s
+    assert_equal "\n", @config_with_roles.role(:workers).env.secrets_io.string
+    assert_equal [ "--env-file", ".kamal/env/roles/app-workers.env", "--env", "REDIS_URL=\"redis://a/b\"", "--env", "WEB_CONCURRENCY=\"4\"" ], @config_with_roles.role(:workers).env_args
  end

  test "container name" do
@@ -90,7 +86,7 @@ class ConfigurationRoleTest < ActiveSupport::TestCase
  end

  test "env args" do
-    assert_equal ["--env-file", ".kamal/env/roles/app-workers.env"], @config_with_roles.role(:workers).env_args
+    assert_equal [ "--env-file", ".kamal/env/roles/app-workers.env", "--env", "REDIS_URL=\"redis://a/b\"", "--env", "WEB_CONCURRENCY=\"4\"" ], @config_with_roles.role(:workers).env_args
  end

  test "env secret overwritten by role" do
@@ -116,14 +112,13 @@ class ConfigurationRoleTest < ActiveSupport::TestCase
    ENV["REDIS_PASSWORD"] = "secret456"
    ENV["DB_PASSWORD"] = "secret&\"123"

-    expected = <<~ENV
+    expected_secrets_file = <<~ENV
      REDIS_PASSWORD=secret456
      DB_PASSWORD=secret&\"123
-      REDIS_URL=redis://a/b
-      WEB_CONCURRENCY=4
    ENV

-    assert_equal expected, @config_with_roles.role(:workers).env_file.to_s
+    assert_equal expected_secrets_file, @config_with_roles.role(:workers).env.secrets_io.string
+    assert_equal [ "--env-file", ".kamal/env/roles/app-workers.env", "--env", "REDIS_URL=\"redis://a/b\"", "--env", "WEB_CONCURRENCY=\"4\"" ], @config_with_roles.role(:workers).env_args
  ensure
    ENV["REDIS_PASSWORD"] = nil
    ENV["DB_PASSWORD"] = nil
@@ -142,13 +137,12 @@ class ConfigurationRoleTest < ActiveSupport::TestCase

    ENV["DB_PASSWORD"] = "secret123"

-    expected = <<~ENV
+    expected_secrets_file = <<~ENV
      DB_PASSWORD=secret123
-      REDIS_URL=redis://a/b
-      WEB_CONCURRENCY=4
    ENV

-    assert_equal expected, @config_with_roles.role(:workers).env_file.to_s
+    assert_equal expected_secrets_file, @config_with_roles.role(:workers).env.secrets_io.string
+    assert_equal [ "--env-file", ".kamal/env/roles/app-workers.env", "--env", "REDIS_URL=\"redis://a/b\"", "--env", "WEB_CONCURRENCY=\"4\"" ], @config_with_roles.role(:workers).env_args
  ensure
    ENV["DB_PASSWORD"] = nil
  end
@@ -165,13 +159,12 @@ class ConfigurationRoleTest < ActiveSupport::TestCase

    ENV["REDIS_PASSWORD"] = "secret456"

-    expected = <<~ENV
+    expected_secrets_file = <<~ENV
      REDIS_PASSWORD=secret456
-      REDIS_URL=redis://a/b
-      WEB_CONCURRENCY=4
    ENV

-    assert_equal expected, @config_with_roles.role(:workers).env_file.to_s
+    assert_equal expected_secrets_file, @config_with_roles.role(:workers).env.secrets_io.string
+    assert_equal [ "--env-file", ".kamal/env/roles/app-workers.env", "--env", "REDIS_URL=\"redis://a/b\"", "--env", "WEB_CONCURRENCY=\"4\"" ], @config_with_roles.role(:workers).env_args
  ensure
    ENV["REDIS_PASSWORD"] = nil
  end
@@ -188,33 +181,29 @@ class ConfigurationRoleTest < ActiveSupport::TestCase

    @deploy_with_roles[:servers]["workers"]["env"] = {
      "clear" => {
-        "REDIS_URL" => "redis://c/d",
-      },
+        "REDIS_URL" => "redis://c/d"
+      }
    }

    ENV["REDIS_PASSWORD"] = "secret456"

-    expected = <<~ENV
+    expected_secrets_file = <<~ENV
      REDIS_PASSWORD=secret456
-      REDIS_URL=redis://c/d
    ENV

-    assert_equal expected, @config_with_roles.role(:workers).env_file.to_s
+    assert_equal expected_secrets_file, @config_with_roles.role(:workers).env.secrets_io.string
+    assert_equal [ "--env-file", ".kamal/env/roles/app-workers.env", "--env", "REDIS_URL=\"redis://c/d\"" ], @config_with_roles.role(:workers).env_args
  ensure
    ENV["REDIS_PASSWORD"] = nil
  end

-  test "host_env_directory" do
-    assert_equal ".kamal/env/roles", @config_with_roles.role(:workers).host_env_directory
-  end
-
-  test "host_env_file_path" do
-    assert_equal ".kamal/env/roles/app-workers.env", @config_with_roles.role(:workers).host_env_file_path
+  test "env secrets_file" do
+    assert_equal ".kamal/env/roles/app-workers.env", @config_with_roles.role(:workers).env.secrets_file
  end

  test "uses cord" do
    assert @config_with_roles.role(:web).uses_cord?
-    assert !@config_with_roles.role(:workers).uses_cord?
+    assert_not @config_with_roles.role(:workers).uses_cord?
  end

  test "cord host file" do
@@ -238,28 +227,28 @@ class ConfigurationRoleTest < ActiveSupport::TestCase
    assert_nil @config_with_roles.role(:workers).asset_volume_args
    assert_nil @config_with_roles.role(:web).asset_path
    assert_nil @config_with_roles.role(:workers).asset_path
-    assert !@config_with_roles.role(:web).assets?
-    assert !@config_with_roles.role(:workers).assets?
+    assert_not @config_with_roles.role(:web).assets?
+    assert_not @config_with_roles.role(:workers).assets?

    config_with_assets = Kamal::Configuration.new(@deploy_with_roles.dup.tap { |c|
      c[:asset_path] = "foo"
    })
    assert_equal "foo", config_with_assets.role(:web).asset_path
    assert_equal "foo", config_with_assets.role(:workers).asset_path
-    assert_equal ["--volume", "$(pwd)/.kamal/assets/volumes/app-web-12345:foo"], config_with_assets.role(:web).asset_volume_args
+    assert_equal [ "--volume", "$(pwd)/.kamal/assets/volumes/app-web-12345:foo" ], config_with_assets.role(:web).asset_volume_args
    assert_nil config_with_assets.role(:workers).asset_volume_args
    assert config_with_assets.role(:web).assets?
-    assert !config_with_assets.role(:workers).assets?
+    assert_not config_with_assets.role(:workers).assets?

    config_with_assets = Kamal::Configuration.new(@deploy_with_roles.dup.tap { |c|
      c[:servers]["web"] = { "hosts" => [ "1.1.1.1", "1.1.1.2" ], "asset_path" => "bar" }
    })
    assert_equal "bar", config_with_assets.role(:web).asset_path
    assert_nil config_with_assets.role(:workers).asset_path
-    assert_equal ["--volume", "$(pwd)/.kamal/assets/volumes/app-web-12345:bar"], config_with_assets.role(:web).asset_volume_args
+    assert_equal [ "--volume", "$(pwd)/.kamal/assets/volumes/app-web-12345:bar" ], config_with_assets.role(:web).asset_volume_args
    assert_nil config_with_assets.role(:workers).asset_volume_args
    assert config_with_assets.role(:web).assets?
-    assert !config_with_assets.role(:workers).assets?
+    assert_not config_with_assets.role(:workers).assets?

  ensure
    ENV.delete("VERSION")
--- a/test/configuration/ssh_test.rb
+++ b/test/configuration/ssh_test.rb
@@ -7,7 +7,7 @@ class ConfigurationSshTest < ActiveSupport::TestCase
      registry: { "username" => "dhh", "password" => "secret" },
      env: { "REDIS_URL" => "redis://x/y" },
      servers: [ "1.1.1.1", "1.1.1.2" ],
-      volumes: ["/local/path:/container/path"]
+      volumes: [ "/local/path:/container/path" ]
    }

    @config = Kamal::Configuration.new(@deploy)
--- a/test/configuration/sshkit_test.rb
+++ b/test/configuration/sshkit_test.rb
@@ -7,7 +7,7 @@ class ConfigurationSshkitTest < ActiveSupport::TestCase
      registry: { "username" => "dhh", "password" => "secret" },
      env: { "REDIS_URL" => "redis://x/y" },
      servers: [ "1.1.1.1", "1.1.1.2" ],
-      volumes: ["/local/path:/container/path"]
+      volumes: [ "/local/path:/container/path" ]
    }

    @config = Kamal::Configuration.new(@deploy)
--- a/test/configuration/volume_test.rb
+++ b/test/configuration/volume_test.rb
@@ -3,11 +3,11 @@ require "test_helper"
 class ConfigurationVolumeTest < ActiveSupport::TestCase
  test "docker args absolute" do
    volume = Kamal::Configuration::Volume.new(host_path: "/root/foo/bar", container_path: "/assets")
-    assert_equal ["--volume", "/root/foo/bar:/assets"], volume.docker_args
+    assert_equal [ "--volume", "/root/foo/bar:/assets" ], volume.docker_args
  end

  test "docker args relative" do
    volume = Kamal::Configuration::Volume.new(host_path: "foo/bar", container_path: "/assets")
-    assert_equal ["--volume", "$(pwd)/foo/bar:/assets"], volume.docker_args
+    assert_equal [ "--volume", "$(pwd)/foo/bar:/assets" ], volume.docker_args
  end
 end
--- a/test/configuration_test.rb
+++ b/test/configuration_test.rb
@@ -10,7 +10,7 @@ class ConfigurationTest < ActiveSupport::TestCase
      registry: { "username" => "dhh", "password" => "secret" },
      env: { "REDIS_URL" => "redis://x/y" },
      servers: [ "1.1.1.1", "1.1.1.2" ],
-      volumes: ["/local/path:/container/path"]
+      volumes: [ "/local/path:/container/path" ]
    }

    @config = Kamal::Configuration.new(@deploy)
@@ -64,7 +64,7 @@ class ConfigurationTest < ActiveSupport::TestCase
  end

  test "all hosts" do
-    assert_equal [ "1.1.1.1", "1.1.1.2"], @config.all_hosts
+    assert_equal [ "1.1.1.1", "1.1.1.2" ], @config.all_hosts
    assert_equal [ "1.1.1.1", "1.1.1.2", "1.1.1.3" ], @config_with_roles.all_hosts
  end

@@ -86,7 +86,7 @@ class ConfigurationTest < ActiveSupport::TestCase
    ENV.delete("VERSION")

    Kamal::Git.expects(:used?).returns(nil)
-    error = assert_raises(RuntimeError) { @config.version}
+    error = assert_raises(RuntimeError) { @config.version }
    assert_match /no git repository found/, error.message
  end

@@ -130,6 +130,16 @@ class ConfigurationTest < ActiveSupport::TestCase
    assert_equal "ghcr.io/dhh/app:missing", config.absolute_image
  end

+  test "latest image" do
+    assert_equal "dhh/app:latest", @config.latest_image
+  end
+
+  test "latest image with destination" do
+    dest_config_file = Pathname.new(File.expand_path("fixtures/deploy_for_dest.yml", __dir__))
+    config = Kamal::Configuration.create_from config_file: dest_config_file, destination: "world"
+    assert_equal "registry.digitalocean.com/dhh/app:latest-world", config.latest_image
+  end
+
  test "service with version" do
    assert_equal "app-missing", @config.service_with_version
  end
@@ -186,21 +196,21 @@ class ConfigurationTest < ActiveSupport::TestCase
  end

  test "volume_args" do
-    assert_equal ["--volume", "/local/path:/container/path"], @config.volume_args
+    assert_equal [ "--volume", "/local/path:/container/path" ], @config.volume_args
  end

  test "logging args default" do
-    assert_equal ["--log-opt", "max-size=\"10m\""], @config.logging_args
+    assert_equal [ "--log-opt", "max-size=\"10m\"" ], @config.logging_args
  end

  test "logging args with configured options" do
    config = Kamal::Configuration.new(@deploy.tap { |c| c.merge!(logging: { "options" => { "max-size" => "100m", "max-file" => 5 } }) })
-    assert_equal ["--log-opt", "max-size=\"100m\"", "--log-opt", "max-file=\"5\""], @config.logging_args
+    assert_equal [ "--log-opt", "max-size=\"100m\"", "--log-opt", "max-file=\"5\"" ], @config.logging_args
  end

  test "logging args with configured driver and options" do
    config = Kamal::Configuration.new(@deploy.tap { |c| c.merge!(logging: { "driver" => "local", "options" => { "max-size" => "100m", "max-file" => 5 } }) })
-    assert_equal ["--log-driver", "\"local\"", "--log-opt", "max-size=\"100m\"", "--log-opt", "max-file=\"5\""], @config.logging_args
+    assert_equal [ "--log-driver", "\"local\"", "--log-opt", "max-size=\"100m\"", "--log-opt", "max-file=\"5\"" ], @config.logging_args
  end

  test "erb evaluation of yml config" do
@@ -240,19 +250,19 @@ class ConfigurationTest < ActiveSupport::TestCase

  test "to_h" do
    expected_config = \
-      { :roles=>["web"],
-        :hosts=>["1.1.1.1", "1.1.1.2"],
-        :primary_host=>"1.1.1.1",
-        :version=>"missing",
-        :repository=>"dhh/app",
-        :absolute_image=>"dhh/app:missing",
-        :service_with_version=>"app-missing",
-        :ssh_options=>{ :user=>"root", port: 22, log_level: :fatal, keepalive: true, keepalive_interval: 30 },
-        :sshkit=>{},
-        :volume_args=>["--volume", "/local/path:/container/path"],
-        :builder=>{},
-        :logging=>["--log-opt", "max-size=\"10m\""],
-        :healthcheck=>{ "path"=>"/up", "port"=>3000, "max_attempts" => 7, "exposed_port" => 3999, "cord" => "/tmp/kamal-cord", "log_lines" => 50 }}
+      { roles: [ "web" ],
+        hosts: [ "1.1.1.1", "1.1.1.2" ],
+        primary_host: "1.1.1.1",
+        version: "missing",
+        repository: "dhh/app",
+        absolute_image: "dhh/app:missing",
+        service_with_version: "app-missing",
+        ssh_options: { user: "root", port: 22, log_level: :fatal, keepalive: true, keepalive_interval: 30 },
+        sshkit: {},
+        volume_args: [ "--volume", "/local/path:/container/path" ],
+        builder: {},
+        logging: [ "--log-opt", "max-size=\"10m\"" ],
+        healthcheck: { "path"=>"/up", "port"=>3000, "max_attempts" => 7, "exposed_port" => 3999, "cord" => "/tmp/kamal-cord", "log_lines" => 50 } }

    assert_equal expected_config, @config.to_h
  end
@@ -304,7 +314,7 @@ class ConfigurationTest < ActiveSupport::TestCase

    config = Kamal::Configuration.new(@deploy_with_roles.deep_merge({
      servers: { "alternate_web" => { "hosts" => [ "1.1.1.4", "1.1.1.5" ] } },
-      primary_role: "alternate_web" } ))
+      primary_role: "alternate_web" }))


    assert_equal "alternate_web", config.primary_role.name
--- a/test/env_file_test.rb
+++ b/test/env_file_test.rb
@@ -1,7 +1,7 @@
 require "test_helper"

 class EnvFileTest < ActiveSupport::TestCase
-  test "env file simple" do
+  test "to_s" do
    env = {
      "foo" => "bar",
      "baz" => "haz"
@@ -11,80 +11,27 @@ class EnvFileTest < ActiveSupport::TestCase
      Kamal::EnvFile.new(env).to_s
  end

-  test "env file clear" do
-    env = {
-      "clear" => {
-        "foo" => "bar",
-        "baz" => "haz"
-      }
-    }
-
-    assert_equal "foo=bar\nbaz=haz\n", \
-      Kamal::EnvFile.new(env).to_s
-  end
-
-  test "env file empty" do
+  test "to_s empty" do
    assert_equal "\n", Kamal::EnvFile.new({}).to_s
  end

-  test "env file secret" do
-    ENV["PASSWORD"] = "hello"
+  test "to_s escaped newline" do
    env = {
-      "secret" => [ "PASSWORD" ]
+      "foo" => "hello\\nthere"
    }

-    assert_equal "PASSWORD=hello\n", \
+    assert_equal "foo=hello\\\\nthere\n", \
      Kamal::EnvFile.new(env).to_s
  ensure
    ENV.delete "PASSWORD"
  end

-  test "env file secret escaped newline" do
-    ENV["PASSWORD"] = "hello\\nthere"
+  test "to_s newline" do
    env = {
-      "secret" => [ "PASSWORD" ]
+      "foo" => "hello\nthere"
    }

-    assert_equal "PASSWORD=hello\\\\nthere\n", \
-      Kamal::EnvFile.new(env).to_s
-  ensure
-    ENV.delete "PASSWORD"
-  end
-
-  test "env file secret newline" do
-    ENV["PASSWORD"] = "hello\nthere"
-    env = {
-      "secret" => [ "PASSWORD" ]
-    }
-
-    assert_equal "PASSWORD=hello\\nthere\n", \
-      Kamal::EnvFile.new(env).to_s
-  ensure
-    ENV.delete "PASSWORD"
-  end
-
-  test "env file missing secret" do
-    env = {
-      "secret" => [ "PASSWORD" ]
-    }
-
-    assert_raises(KeyError) { Kamal::EnvFile.new(env).to_s }
-
-  ensure
-    ENV.delete "PASSWORD"
-  end
-
-  test "env file secret and clear" do
-    ENV["PASSWORD"] = "hello"
-    env = {
-      "secret" => [ "PASSWORD" ],
-      "clear" => {
-        "foo" => "bar",
-        "baz" => "haz"
-      }
-    }
-
-    assert_equal "PASSWORD=hello\nfoo=bar\nbaz=haz\n", \
+    assert_equal "foo=hello\\nthere\n", \
      Kamal::EnvFile.new(env).to_s
  ensure
    ENV.delete "PASSWORD"
--- a/test/integration/accessory_test.rb
+++ b/test/integration/accessory_test.rb
@@ -31,7 +31,7 @@ class AccessoryTest < IntegrationTest
    end

    def assert_accessory_not_running(name)
-      refute_match /registry:4443\/busybox:1.36.0   "sh -c 'echo \\"Start/, accessory_details(name)
+      assert_no_match /registry:4443\/busybox:1.36.0   "sh -c 'echo \\"Start/, accessory_details(name)
    end

    def accessory_details(name)
--- a/test/integration/docker-compose.yml
+++ b/test/integration/docker-compose.yml
@@ -50,8 +50,19 @@ services:
    volumes:
      - shared:/shared

+  vm3:
+    privileged: true
+    build:
+      context: docker/vm
+    volumes:
+      - shared:/shared
+
  load_balancer:
    build:
      context: docker/load_balancer
    ports:
      - "12345:80"
+    depends_on:
+      - vm1
+      - vm2
+      - vm3
--- a/test/integration/docker/deployer/Dockerfile
+++ b/test/integration/docker/deployer/Dockerfile
@@ -1,6 +1,6 @@
 FROM ruby:3.2

-WORKDIR /app
+WORKDIR /

 ENV VERBOSE=true

@@ -17,7 +17,8 @@ RUN echo \
 RUN apt-get update --fix-missing && apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

 COPY *.sh .
-COPY app/ .
+COPY app/ app/
+COPY app_with_roles/ app_with_roles/

 RUN rm -rf /root/.ssh
 RUN ln -s /shared/ssh /root/.ssh
@@ -25,7 +26,8 @@ RUN mkdir -p /etc/docker/certs.d/registry:4443 && ln -s /shared/certs/domain.crt

 RUN git config --global user.email "deployer@example.com"
 RUN git config --global user.name "Deployer"
-RUN git init && echo ".env" >> .gitignore && git add . && git commit -am "Initial version"
+RUN cd app && git init && echo ".env" >> .gitignore && git add . && git commit -am "Initial version"
+RUN cd app_with_roles && git init && echo ".env" >> .gitignore && git add . && git commit -am "Initial version"

 HEALTHCHECK --interval=1s CMD pgrep sleep

--- a/test/integration/docker/deployer/app/config/deploy.yml
+++ b/test/integration/docker/deployer/app/config/deploy.yml
@@ -5,7 +5,8 @@ servers:
  - vm2
 env:
  clear:
-    CLEAR_TOKEN: '4321'
+    CLEAR_TOKEN: 4321
+    HOST_TOKEN: "${HOST_TOKEN}"
  secret:
    - SECRET_TOKEN
 asset_path: /usr/share/nginx/html/versions
--- a/test/integration/docker/deployer/app_with_roles/.env.erb
+++ b/test/integration/docker/deployer/app_with_roles/.env.erb
@@ -0,0 +1 @@
+SECRET_TOKEN=1234
--- a/test/integration/docker/deployer/app_with_roles/.kamal/hooks/docker-setup
+++ b/test/integration/docker/deployer/app_with_roles/.kamal/hooks/docker-setup
@@ -0,0 +1,3 @@
+#!/bin/sh
+echo "Docker set up!"
+mkdir -p /tmp/${TEST_ID} && touch /tmp/${TEST_ID}/docker-setup
--- a/test/integration/docker/deployer/app_with_roles/.kamal/hooks/post-deploy
+++ b/test/integration/docker/deployer/app_with_roles/.kamal/hooks/post-deploy
@@ -0,0 +1,3 @@
+#!/bin/sh
+echo "Deployed!"
+mkdir -p /tmp/${TEST_ID} && touch /tmp/${TEST_ID}/post-deploy
--- a/test/integration/docker/deployer/app_with_roles/.kamal/hooks/post-traefik-reboot
+++ b/test/integration/docker/deployer/app_with_roles/.kamal/hooks/post-traefik-reboot
@@ -0,0 +1,3 @@
+#!/bin/sh
+echo "Rebooted Traefik on ${KAMAL_HOSTS}"
+mkdir -p /tmp/${TEST_ID} && touch /tmp/${TEST_ID}/post-traefik-reboot
--- a/test/integration/docker/deployer/app_with_roles/.kamal/hooks/pre-build
+++ b/test/integration/docker/deployer/app_with_roles/.kamal/hooks/pre-build
@@ -0,0 +1,3 @@
+#!/bin/sh
+echo "About to build and push..."
+mkdir -p /tmp/${TEST_ID} && touch /tmp/${TEST_ID}/pre-build
--- a/test/integration/docker/deployer/app_with_roles/.kamal/hooks/pre-connect
+++ b/test/integration/docker/deployer/app_with_roles/.kamal/hooks/pre-connect
@@ -0,0 +1,8 @@
+#!/bin/sh
+
+echo "About to lock..."
+if [ "$KAMAL_HOSTS" != "vm1,vm2,vm3" ]; then
+  echo "Expected hosts to be 'vm1,vm2,vm3', got $KAMAL_HOSTS"
+  exit 1
+fi
+mkdir -p /tmp/${TEST_ID} && touch /tmp/${TEST_ID}/pre-connect
--- a/test/integration/docker/deployer/app_with_roles/.kamal/hooks/pre-deploy
+++ b/test/integration/docker/deployer/app_with_roles/.kamal/hooks/pre-deploy
@@ -0,0 +1,3 @@
+#!/bin/sh
+echo "Deployed!"
+mkdir -p /tmp/${TEST_ID} && touch /tmp/${TEST_ID}/pre-deploy
--- a/test/integration/docker/deployer/app_with_roles/.kamal/hooks/pre-traefik-reboot
+++ b/test/integration/docker/deployer/app_with_roles/.kamal/hooks/pre-traefik-reboot
@@ -0,0 +1,3 @@
+#!/bin/sh
+echo "Rebooting Traefik on ${KAMAL_HOSTS}..."
+mkdir -p /tmp/${TEST_ID} && touch /tmp/${TEST_ID}/pre-traefik-reboot
--- a/test/integration/docker/deployer/app_with_roles/Dockerfile
+++ b/test/integration/docker/deployer/app_with_roles/Dockerfile
@@ -0,0 +1,9 @@
+FROM registry:4443/nginx:1-alpine-slim
+
+COPY default.conf /etc/nginx/conf.d/default.conf
+
+ARG COMMIT_SHA
+RUN echo $COMMIT_SHA > /usr/share/nginx/html/version
+RUN mkdir -p /usr/share/nginx/html/versions && echo "version" > /usr/share/nginx/html/versions/$COMMIT_SHA
+RUN mkdir -p /usr/share/nginx/html/versions && echo "hidden" > /usr/share/nginx/html/versions/.hidden
+
--- a/test/integration/docker/deployer/app_with_roles/config/deploy.yml
+++ b/test/integration/docker/deployer/app_with_roles/config/deploy.yml
@@ -0,0 +1,37 @@
+service: app
+image: app
+servers:
+  web:
+    hosts:
+      - vm1
+      - vm2
+  workers:
+    hosts:
+      - vm3
+    cmd: sleep infinity
+
+asset_path: /usr/share/nginx/html/versions
+
+registry:
+  server: registry:4443
+  username: root
+  password: root
+builder:
+  multiarch: false
+  args:
+    COMMIT_SHA: <%= `git rev-parse HEAD` %>
+healthcheck:
+  cmd: wget -qO- http://localhost > /dev/null || exit 1
+traefik:
+  args:
+    accesslog: true
+    accesslog.format: json
+  image: registry:4443/traefik:v2.10
+accessories:
+  busybox:
+    service: custom-busybox
+    image: registry:4443/busybox:1.36.0
+    cmd: sh -c 'echo "Starting busybox..."; trap exit term; while true; do sleep 1; done'
+    roles:
+      - web
+stop_wait_time: 1
--- a/test/integration/docker/deployer/app_with_roles/default.conf
+++ b/test/integration/docker/deployer/app_with_roles/default.conf
@@ -0,0 +1,17 @@
+server {
+    listen       80;
+    listen  [::]:80;
+    server_name  localhost;
+
+    location / {
+        root   /usr/share/nginx/html;
+        index  index.html index.htm;
+    }
+
+    # redirect server error pages to the static page /50x.html
+    #
+    error_page   500 502 503 504  /50x.html;
+    location = /50x.html {
+        root   /usr/share/nginx/html;
+    }
+}
--- a/test/integration/docker/deployer/update_app_rev.sh
+++ b/test/integration/docker/deployer/update_app_rev.sh
@@ -1,3 +1,3 @@
 #!/bin/bash

-git commit -am 'Update rev' --amend
+cd $1 && git commit -am 'Update rev' --amend
--- a/test/integration/docker/vm/Dockerfile
+++ b/test/integration/docker/vm/Dockerfile
@@ -7,6 +7,8 @@ RUN apt-get update --fix-missing && apt-get -y install openssh-client openssh-se
 RUN mkdir /root/.ssh && ln -s /shared/ssh/id_rsa.pub /root/.ssh/authorized_keys
 RUN mkdir -p /etc/docker/certs.d/registry:4443 && ln -s /shared/certs/domain.crt /etc/docker/certs.d/registry:4443/ca.crt

+RUN echo "HOST_TOKEN=abcd" >> /etc/environment
+
 COPY boot.sh .

 HEALTHCHECK --interval=1s CMD pgrep dockerd
--- a/test/integration/integration_test.rb
+++ b/test/integration/integration_test.rb
@@ -7,11 +7,12 @@ class IntegrationTest < ActiveSupport::TestCase
    docker_compose "up --build -d"
    wait_for_healthy
    setup_deployer
+    @app = "app"
  end

  teardown do
    unless passed?
-      [:deployer, :vm1, :vm2, :shared, :load_balancer, :registry].each do |container|
+      [ :deployer, :vm1, :vm2, :shared, :load_balancer, :registry ].each do |container|
        puts
        puts "Logs for #{container}:"
        docker_compose :logs, container
@@ -34,8 +35,9 @@ class IntegrationTest < ActiveSupport::TestCase
      result
    end

-    def deployer_exec(*commands, **options)
-      docker_compose("exec deployer #{commands.join(" ")}", **options)
+    def deployer_exec(*commands, workdir: nil, **options)
+      workdir ||= "/#{@app}"
+      docker_compose("exec --workdir #{workdir} deployer #{commands.join(" ")}", **options)
    end

    def kamal(*commands, **options)
@@ -72,7 +74,7 @@ class IntegrationTest < ActiveSupport::TestCase
    end

    def update_app_rev
-      deployer_exec "./update_app_rev.sh"
+      deployer_exec "./update_app_rev.sh #{@app}", workdir: "/"
      latest_app_version
    end

@@ -115,7 +117,7 @@ class IntegrationTest < ActiveSupport::TestCase
    end

    def setup_deployer
-      deployer_exec("./setup.sh") unless $DEPLOYER_SETUP
+      deployer_exec("./setup.sh", workdir: "/") unless $DEPLOYER_SETUP
      $DEPLOYER_SETUP = true
    end

--- a/test/integration/main_test.rb
+++ b/test/integration/main_test.rb
@@ -4,7 +4,7 @@ class MainTest < IntegrationTest
  test "envify, deploy, redeploy, rollback, details and audit" do
    kamal :envify
    assert_local_env_file "SECRET_TOKEN=1234"
-    assert_remote_env_file "SECRET_TOKEN=1234\nCLEAR_TOKEN=4321"
+    assert_remote_env_file "SECRET_TOKEN=1234"
    remove_local_env_file

    first_version = latest_app_version
@@ -14,6 +14,9 @@ class MainTest < IntegrationTest
    kamal :deploy
    assert_app_is_up version: first_version
    assert_hooks_ran "pre-connect", "pre-build", "pre-deploy", "post-deploy"
+    assert_env :CLEAR_TOKEN, "4321", version: first_version
+    assert_env :HOST_TOKEN, "abcd", version: first_version
+    assert_env :SECRET_TOKEN, "1234", version: first_version

    second_version = update_app_rev

@@ -42,6 +45,22 @@ class MainTest < IntegrationTest
    assert_no_remote_env_file
  end

+  test "app with roles" do
+    @app = "app_with_roles"
+
+    kamal :envify
+
+    version = latest_app_version
+
+    assert_app_is_down
+
+    kamal :deploy
+
+    assert_app_is_up version: version
+    assert_hooks_ran "pre-connect", "pre-build", "pre-deploy", "post-deploy"
+    assert_container_running host: :vm3, name: "app-workers-#{version}"
+  end
+
  test "config" do
    config = YAML.load(kamal(:config, capture: true))
    version = latest_app_version
@@ -78,6 +97,10 @@ class MainTest < IntegrationTest
      assert_equal contents, deployer_exec("cat .env", capture: true)
    end

+    def assert_env(key, value, version:)
+      assert_equal "#{key}=#{value}", docker_compose("exec vm1 docker exec app-web-#{version} env | grep #{key}", capture: true)
+    end
+
    def remove_local_env_file
      deployer_exec("rm .env")
    end
@@ -115,4 +138,8 @@ class MainTest < IntegrationTest
      assert vm1_image_ids.any?
      assert vm1_container_ids.any?
    end
+
+    def assert_container_running(host:, name:)
+      assert docker_compose("exec #{host} docker ps --filter=name=#{name} -q", capture: true).strip.present?
+    end
 end
--- a/test/integration/traefik_test.rb
+++ b/test/integration/traefik_test.rb
@@ -7,13 +7,13 @@ class TraefikTest < IntegrationTest
    kamal :traefik, :boot
    assert_traefik_running

-    output = kamal :traefik, :reboot, capture: true
+    output = kamal :traefik, :reboot, "-y", capture: true
    assert_traefik_running
    assert_hooks_ran "pre-traefik-reboot", "post-traefik-reboot"
    assert_match /Rebooting Traefik on vm1,vm2.../, output
    assert_match /Rebooted Traefik on vm1,vm2/, output

-    output = kamal :traefik, :reboot, :"--rolling", capture: true
+    output = kamal :traefik, :reboot, :"--rolling", "-y", capture: true
    assert_traefik_running
    assert_hooks_ran "pre-traefik-reboot", "post-traefik-reboot"
    assert_match /Rebooting Traefik on vm1.../, output
@@ -56,7 +56,7 @@ class TraefikTest < IntegrationTest
    end

    def assert_traefik_not_running
-      refute_match /traefik:v2.10   "\/entrypoint.sh/, traefik_details
+      assert_no_match /traefik:v2.10   "\/entrypoint.sh/, traefik_details
    end

    def traefik_details
Author	SHA1	Message	Date
Donal McBreen	c884f2316d	Per destination latest image tag We tag the deployed image with the latest image tag when deploying. But if we are deploying multiple destinations to the same host they'll conflict with each other.	2024-03-27 09:43:21 +00:00
Donal McBreen	786454f2ee	Merge pull request #502 from latyshev/main Fix accessory name checking that is passing to command `kamal accessory`	2024-03-26 13:58:26 +00:00
Donal McBreen	827e18480d	Merge pull request #732 from basecamp/always-send-clear-env Always send the clear env to the container	2024-03-26 11:01:59 +00:00
Donal McBreen	9f9c9ccbde	Merge pull request #742 from igor-alexandrov/remove_service_role_dest Removed unused method from Kamal::Commands::App	2024-03-26 08:10:36 +00:00
Evgeny Latyshev	981d391d4d	Fix accessory name check in `with_accessory`	2024-03-26 09:29:34 +03:00
Igor Alexandrov	900041001a	Removed unused method	2024-03-25 22:48:23 +04:00
Donal McBreen	5481fbb973	Test that we pull in env host variables Now that clear env variables specified on the command line we can check that values specified as `${VAR}` are pulled in from the host.	2024-03-25 12:26:37 +00:00
Donal McBreen	49afdbb09a	Always send the clear env to the container Secret and clear env variables have different lifecycles. The clear ones are part of the repo, so it makes sense to always deploy them with the rest of the repo. The secret ones are external so we can't be sure that they are up to date, therefore they require an explicit push via `envify` or `env push`. We'll keep the env file, but now it just contains secrets. The clear values are passed directly to `docker run`.	2024-03-25 11:42:27 +00:00
Donal McBreen	5f58575b62	Merge pull request #730 from igor-alexandrov/confirming_dialogs Added -y option to kamal traefik reboot command	2024-03-22 15:14:44 +00:00
Igor Alexandrov	3d26fa8ddd	Updated confirmation text for the traefik reboot command	2024-03-22 14:27:18 +04:00
Donal McBreen	ea9f8b488d	Merge pull request #735 from basecamp/extract-app-boot-steps Extract app boot steps	2024-03-22 09:35:04 +00:00
Donal McBreen	83472af32c	Merge pull request #734 from basecamp/rubocop-rails-omakase Switch to rubocop-rails-omakase rubocop rules	2024-03-22 09:33:25 +00:00
Donal McBreen	e99e1955b8	Extract app boot steps The Kamal::Cli::App#boot has a lot to do, so extract the steps to make things clearer.	2024-03-22 09:21:52 +00:00
Donal McBreen	30e0c44396	Switch to rubocop-rails-omakase rubocop rules No code changes required	2024-03-21 13:47:20 +00:00
Donal McBreen	20d6e5365e	Merge pull request #733 from basecamp/integration-test-roles Integration test roles	2024-03-21 13:43:33 +00:00
Donal McBreen	72ace2bf0b	Add an integration test for roles Add an app with roles to the integration tests. We'll deploy two web containers and one worker. The worker just sleeps, so we are testing that the container has booted.	2024-03-21 13:30:53 +00:00
Donal McBreen	ba40d026d0	Make integration test app to deploy configurable	2024-03-21 12:09:59 +00:00
Igor Alexandrov	0f13600ba3	Fixed Traefik integration test	2024-03-21 09:25:07 +04:00
Igor Alexandrov	bbf952952d	Added -y option to kamal traefik reboot command	2024-03-20 22:00:13 +04:00
Donal McBreen	474b76cf47	Merge pull request #701 from basecamp/rubocop Add Rubocop	2024-03-20 10:59:35 +00:00
Donal McBreen	3ecfb3744f	Add Rubocop - Pull in the 37signals house style - Autofix violations - Add to CI	2024-03-20 10:23:02 +00:00