fix: [nomad-step-5] S5.5 — wire --with edge,staging,chat + vault-runner + full deploy ordering (#992)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

bin/disinto

@@ -82,7 +82,7 @@ Init options:
   --ci-id <n>          Woodpecker CI repo ID (default: 0 = no CI)
   --forge-url <url>    Forge base URL (default: http://localhost:3000)
   --backend <value>    Orchestration backend: docker (default) | nomad
-  --with <services>    (nomad) Deploy services: forgejo,woodpecker,agents[,...] (S1.3, S3.4, S4.2)
+  --with <services>    (nomad) Deploy services: forgejo,woodpecker,agents,staging,chat,edge[,...] (S1.3, S3.4, S4.2, S5.2, S5.5)
   --empty              (nomad) Bring up cluster only, no jobs (S0.4)
   --bare               Skip compose generation (bare-metal setup)
   --build              Use local docker build instead of registry images (dev mode)
@@ -787,7 +787,7 @@ _disinto_init_nomad() {
       # real-run path so dry-run output accurately represents execution order.
       # Build ordered deploy list: only include services present in with_services
       local DEPLOY_ORDER=""
-      for ordered_svc in forgejo woodpecker-server woodpecker-agent agents staging chat; do
+      for ordered_svc in forgejo woodpecker-server woodpecker-agent agents staging chat edge; do
         if echo ",$with_services," | grep -q ",$ordered_svc,"; then
           DEPLOY_ORDER="${DEPLOY_ORDER:+${DEPLOY_ORDER} }${ordered_svc}"
         fi
@@ -824,8 +824,19 @@ _disinto_init_nomad() {
       echo "[deploy] dry-run complete"
     fi
 
-    # Build custom images dry-run (if agents or chat services are included)
-    if echo ",$with_services," | grep -qE ",(agents|chat),"; then
+    # Dry-run vault-runner (unconditionally, not gated by --with)
+    echo ""
+    echo "── Vault-runner dry-run ───────────────────────────────────"
+    local vault_runner_path="${FACTORY_ROOT}/nomad/jobs/vault-runner.hcl"
+    if [ -f "$vault_runner_path" ]; then
+      echo "[deploy] vault-runner: [dry-run] nomad job validate ${vault_runner_path}"
+      echo "[deploy] vault-runner: [dry-run] nomad job run -detach ${vault_runner_path}"
+    else
+      echo "[deploy] vault-runner: jobspec not found, skipping"
+    fi
+
+    # Build custom images dry-run (if agents, chat, or edge services are included)
+    if echo ",$with_services," | grep -qE ",(agents|chat|edge),"; then
       echo ""
       echo "── Build images dry-run ──────────────────────────────"
       if echo ",$with_services," | grep -q ",agents,"; then
@@ -834,6 +845,9 @@ _disinto_init_nomad() {
       if echo ",$with_services," | grep -q ",chat,"; then
         echo "[build] [dry-run] docker build -t disinto/chat:local -f ${FACTORY_ROOT}/docker/chat/Dockerfile ${FACTORY_ROOT}"
       fi
+      if echo ",$with_services," | grep -q ",edge,"; then
+        echo "[build] [dry-run] docker build -t disinto/edge:local -f ${FACTORY_ROOT}/docker/edge/Dockerfile ${FACTORY_ROOT}"
+      fi
     fi
     exit 0
   fi
@@ -922,10 +936,10 @@ _disinto_init_nomad() {
     echo "[import] no --import-env/--import-sops — skipping; set them or seed kv/disinto/* manually before deploying secret-dependent services"
   fi
 
-  # Build custom images required by Nomad jobs (S4.2, S5.2) — before deploy.
+  # Build custom images required by Nomad jobs (S4.2, S5.2, S5.5) — before deploy.
   # Single-node factory dev box: no multi-node pull needed, no registry auth.
   # Can upgrade to approach B (registry push/pull) later if multi-node.
-  if echo ",$with_services," | grep -qE ",(agents|chat),"; then
+  if echo ",$with_services," | grep -qE ",(agents|chat|edge),"; then
     echo ""
     echo "── Building custom images ─────────────────────────────"
     if echo ",$with_services," | grep -q ",agents,"; then
@@ -938,6 +952,11 @@ _disinto_init_nomad() {
       echo "── Building $tag ─────────────────────────────"
       docker build -t "$tag" -f "${FACTORY_ROOT}/docker/chat/Dockerfile" "${FACTORY_ROOT}" 2>&1 | tail -5
     fi
+    if echo ",$with_services," | grep -q ",edge,"; then
+      local tag="disinto/edge:local"
+      echo "── Building $tag ─────────────────────────────"
+      docker build -t "$tag" -f "${FACTORY_ROOT}/docker/edge/Dockerfile" "${FACTORY_ROOT}" 2>&1 | tail -5
+    fi
   fi
 
   # Interleaved seed/deploy per service (S2.6, #928, #948).
@@ -948,9 +967,9 @@ _disinto_init_nomad() {
   if [ -n "$with_services" ]; then
     local vault_addr="${VAULT_ADDR:-http://127.0.0.1:8200}"
 
-    # Build ordered deploy list (S3.4, S4.2, S5.2): forgejo → woodpecker-server → woodpecker-agent → agents → staging → chat
+    # Build ordered deploy list (S3.4, S4.2, S5.2, S5.5): forgejo → woodpecker-server → woodpecker-agent → agents → staging → chat → edge
     local DEPLOY_ORDER=""
-    for ordered_svc in forgejo woodpecker-server woodpecker-agent agents staging chat; do
+    for ordered_svc in forgejo woodpecker-server woodpecker-agent agents staging chat edge; do
       if echo ",$with_services," | grep -q ",$ordered_svc,"; then
         DEPLOY_ORDER="${DEPLOY_ORDER:+${DEPLOY_ORDER} }${ordered_svc}"
       fi
@@ -1001,6 +1020,27 @@ _disinto_init_nomad() {
       fi
     done
 
+    # Run vault-runner (unconditionally, not gated by --with) — infrastructure job
+    # vault-runner is always present since it's needed for vault action dispatch
+    echo ""
+    echo "── Running vault-runner ────────────────────────────────────"
+    local vault_runner_path="${FACTORY_ROOT}/nomad/jobs/vault-runner.hcl"
+    if [ -f "$vault_runner_path" ]; then
+      echo "[deploy] vault-runner: running Nomad job (infrastructure)"
+      local -a vault_runner_cmd=("$deploy_sh" "vault-runner")
+      if [ "$(id -u)" -eq 0 ]; then
+        "${vault_runner_cmd[@]}" || exit $?
+      else
+        if ! command -v sudo >/dev/null 2>&1; then
+          echo "Error: deploy.sh must run as root and sudo is not installed" >&2
+          exit 1
+        fi
+        sudo -n -- "${vault_runner_cmd[@]}" || exit $?
+      fi
+    else
+      echo "[deploy] vault-runner: jobspec not found, skipping"
+    fi
+
     # Print final summary
     echo ""
     echo "── Summary ────────────────────────────────────────────"
@@ -1157,14 +1197,25 @@ disinto_init() {
       fi
     fi
 
+    # Auto-include all dependencies when edge is requested (S5.5)
+    if echo ",$with_services," | grep -q ",edge,"; then
+      # Edge depends on all backend services
+      for dep in forgejo woodpecker-server woodpecker-agent agents staging chat; do
+        if ! echo ",$with_services," | grep -q ",${dep},"; then
+          echo "Note: --with edge implies --with ${dep} (edge depends on all backend services)"
+          with_services="${with_services},${dep}"
+        fi
+      done
+    fi
+
     # Validate all service names are known
     local IFS=','
     for _svc in $with_services; do
       _svc=$(echo "$_svc" | xargs)
       case "$_svc" in
-        forgejo|woodpecker-server|woodpecker-agent|agents|staging|chat) ;;
+        forgejo|woodpecker-server|woodpecker-agent|agents|staging|chat|edge) ;;
         *)
-          echo "Error: unknown service '${_svc}' — known: forgejo, woodpecker-server, woodpecker-agent, agents, staging, chat" >&2
+          echo "Error: unknown service '${_svc}' — known: forgejo, woodpecker-server, woodpecker-agent, agents, staging, chat, edge" >&2
           exit 1
           ;;
       esac