Safe-apply: confirm-or-revert (try / safe-restart equivalent) #11

New Issue

2026-07-26T17:02:00+10:00

benvin commented

2026-07-26 17:02:00 +10:00

Problem. There is no rollback command. Shorewall's safe-restart/try
(apply, wait N seconds for operator confirmation, auto-revert on timeout) is
the feature that stops you locking yourself out of a remote box.
stopped_rules exists in the schema but a timed confirm-or-revert doesn't
appear in the CLI surface.

Proposal.

tomswall try [--timeout 60s]: snapshot live ruleset, differential apply,
wait for tomswall confirm; on timeout or dropped session, restore snapshot.
Same primitive exposed to agent mode: on pulling a new generation, apply,
verify the API is still reachable through the new ruleset, and auto-revert
- report status: reverted if it isn't. That check catches the worst
  control-plane failure mode — a pushed rule that severs the device from the
  API, which today would strand the device on the bad config forever.

Acceptance. Applying a rule that drops the SSH/API path auto-reverts within
the timeout with no console access.

**Problem.** There is no rollback command. Shorewall's `safe-restart`/`try` (apply, wait N seconds for operator confirmation, auto-revert on timeout) is the feature that stops you locking yourself out of a remote box. `stopped_rules` exists in the schema but a timed confirm-or-revert doesn't appear in the CLI surface. **Proposal.** - `tomswall try [--timeout 60s]`: snapshot live ruleset, differential apply, wait for `tomswall confirm`; on timeout or dropped session, restore snapshot. - Same primitive exposed to agent mode: on pulling a new generation, apply, verify the API is still reachable *through the new ruleset*, and auto-revert + report `status: reverted` if it isn't. That check catches the worst control-plane failure mode — a pushed rule that severs the device from the API, which today would strand the device on the bad config forever. **Acceptance.** Applying a rule that drops the SSH/API path auto-reverts within the timeout with no console access.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/tomswall#11

Safe-apply: confirm-or-revert (try / safe-restart equivalent) #11

Safe-apply: confirm-or-revert (`try` / `safe-restart` equivalent) #11