Implements the one-shot goal from the greenfield audit: tear down fully
and/or deploy cleanly on a pristine WSL instance with nothing but the
interactive script.
- './deploy.sh teardown': leave-it-down removal across ALL compose
profiles (core/test/auth/evpn-test/scale-out -- the old reset missed the
last two), networks, named volumes, rendered gobgpd.confs. Data wipe is
opt-in (--wipe-data, guarded on native hosts) and preserves backups/
unless --purge-backups; --purge-images reclaims images. Prints the
Windows-side cleanup (wsl-portproxy.ps1 -Remove, new switch).
- fresh-host preflight: verifies the docker DAEMON (not just the client),
offers to install docker-ce from the official repo (--install-prereqs
for unattended), and handles the classic pristine-WSL trap: systemd off
-> writes /etc/wsl.conf [boot] systemd=true and stops with exact
restart instructions instead of dying cryptically.
- sudo authenticates ONCE up front (no more password prompt buried
mid-provision); --reset now covers all profiles and preserves backups/
- guided flow: banner, Step N/6 headers, context lines explaining
HOST_IP-vs-router-facing before the address prompts, router-facing IP
validated as a dotted quad (a failed Windows-LAN autodetect can no
longer write a <WINDOWS_LAN_IP> placeholder into .env), stage
completions print green checkmarks, loud abort note on the plan
confirm, post-deploy Verify + teardown hints.
- shared helpers moved to scripts/deploy-lib.sh; setup.sh sources it too
(duplicate get_env/set_env/ask/confirm definitions deleted), keeping
setup.sh as a standalone provisioning primitive.
Verified live on this host: teardown left zero obmp containers and
removed rendered configs; unattended redeploy brought the stack back.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
5b5593b6cc