Repository navigation
feat(writ): writ's templates end in .tmpl, and .template is left to other tools - #979
Merged
David-Noble-at-work merged 3 commits intoSep 29, 2026
Merged
Conversation
writ claims every file ending in .template, so personal's envsubst template for New-LocationConfig is rendered into a copy and the script never finds it (personal#237). Ruled 2026-09-29: writ's templates end in .tmpl, and .template is left to other tools. Claude-Session: https://claude.ai/code/session_01DuNfZFyfxBoD9pdaiDEMrY
…ther tools writ claimed every file ending in .template: it rendered the file as a Go template and deployed a copy without the suffix. .template is a generic word that other tools use for their own templates. personal's New-LocationConfig fills certificate-request.conf.template with envsubst, and writ rendered it into certificate-request.conf, so the script never found its file. Ruled 2026-09-29: writ's templates end in .tmpl, chezmoi's suffix for exactly this behavior, and .template is left to other tools, as the nginx image's envsubst leaves it. - The rule (tree.ProcessingPipeline) renders .tmpl and .tmpl.sops, and a .template file is linked like any other. pkg/sops finds a document's format past .tmpl. - The tests and the scenario fixture say .tmpl, and a new row pins that foo.template deploys as a link. No layer holds a writ template, so no layer file is renamed. - The writ guide's Templates section lists the data writ provides, and says variables come from writ.vars, in lower case, and, per the configuration spec, from the environment and the command line; writ reads only the file today (#975). Its Secrets section describes .sops, not the retired .age, with a table of where sops finds age keys on Linux, macOS and Windows and the variables that add keys. A dead link to the deleted secrets guide goes from the index and from getting-started, and "each file becomes a symlink" now names its exceptions. Found on the way and filed: #975 (template variables come only from the configuration file), #977 (a secret with no format before .sops deploys as a JSON wrapper, reproduced by running), #978 (the encryption design's key path is Linux's only). Resolves #974 Resolves David-Noble-at-work/personal#237 Claude-Session: https://claude.ai/code/session_01DuNfZFyfxBoD9pdaiDEMrY
…ture/974-writ-s-templates-end-in-tmpl
David-Noble-at-work
deleted the
feature/974-writ-s-templates-end-in-tmpl
branch
September 29, 2026 15:52
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Lane 11 of #949. Ruled 2026-09-29: "Let's do as you propose. .tmpl for writ templates."
.tmpl(and.tmpl.sops: decrypt, then render) and links a.templatefile untouched.pkg/sopsfinds a document's format past.tmpl.New-LocationConfigfillscertificate-request.conf.templatewithenvsubst; writ rendered it intocertificate-request.conf, so the script never found it. With this change it deploys as a link under its own name..tmplis chezmoi's suffix for writ's behavior; the nginx image'senvsubstover*.templateis the precedent for leaving.templateto other tools..templatein any layer..tmpl; a new row pinsfoo.template→ a link.writ.vars(lower case), from the environment and the command line per the configuration spec, from the file only today (writ's template variables come only from the configuration file: writ.vars is read as a whole map, which the environment never reaches, and no flag sets one #975). Secrets:.sops, not the retired.age, with a table of where sops finds age keys on Linux, macOS and Windows and the variables that add keys. The dead link to the deleted secrets guide is gone from the index and getting-started; "each file becomes a symlink" names its exceptions.docs/plans/feature/974-writ-s-templates-end-in-tmpl.md. It staysactive: its last box, converging DANOBLE-UD24-1 once the pre-release carries this change, can only close after the merge.Filed on the way: #975, #977 (reproduced by running), #978.
Resolves #974
Resolves David-Noble-at-work/personal#237
Test plan
gofmt -lempty;make test(104 packages) andmake test-racepassci.yamlgate step: build for every platform,go.modtidy,make regeneratewith no diff, guide frontmatter,vet-all,star lint go,lint-all,star lint shell, the PowerShell gate,make test-scenarioa.conf.tmpldeploys as a rendered copya.conf;b.conf.templatedeploys as a link, byte for byte; the host's configuration, layers and home untouchedNew-LocationConfigfills a requestTime
Computed by the algorithm of noblefactor-ops#188 at merge.