Class: Dash::Cli::Proxy

Inherits:

Base

• Object
• Thor
• Base
• Dash::Cli::Proxy

Defined in:

lib/dash/cli/proxy.rb

Defined Under Namespace

Classes: Drift, LegacyRename, LoadbalancerClaim, LoadbalancerReboot, Reboot

Constant Summary

Constants inherited from Base

Base::AUTOMATIC_DEPLOY_LOCK_MESSAGE, Base::HOOK_MUTEX, Base::VERBOSITY

Instance Method Summary

• #boot ⇒ Object
• #boot_config(subcommand) ⇒ Object
• #cache(subcommand) ⇒ Object
• #details ⇒ Object
• #domains(subcommand, *args) ⇒ Object
• #export_certs(local_path) ⇒ Object
• #import_certs ⇒ Object
• #loadbalancer(status) ⇒ Object
• #logs ⇒ Object
• #reboot ⇒ Object
• #remove ⇒ Object
• #remove_container ⇒ Object
• #remove_image ⇒ Object
• #remove_proxy_directory ⇒ Object
• #restart ⇒ Object
• #start ⇒ Object
• #stop ⇒ Object
• #upgrade ⇒ Object

Methods inherited from Base

dynamic_command_class, exit_on_failure?, #initialize

Constructor Details

This class inherits a constructor from Dash::Cli::Base

Instance Method Details

#boot ⇒ Object

# File 'lib/dash/cli/proxy.rb', line 3

def boot
  modify(lock: true, server_lock: true) do
    on(DASH.hosts) do |host|
      execute *DASH.docker.create_network
    rescue SSHKit::Command::Failed => e
      raise unless e.message.include?("already exists")
    end

    # Skip proxy on loadbalancer host - the loadbalancer will handle it
    proxy_hosts = DASH.proxy_hosts
    if DASH.config.proxy.loadbalancer_on_proxy_host?
      proxy_hosts = proxy_hosts - [ DASH.config.proxy.effective_loadbalancer ]
    end

    drifted_hosts = Concurrent::Array.new
    stale_hosts = Concurrent::Array.new
    auto_reboot = DASH.config.proxy.reboot_on_deploy?

    on(proxy_hosts) do |host|
      execute *DASH.registry.login

      # Before anything reads the new container, volume or network: bring a
      # host still on pre-rename identity across. A no-op once it has been.
      Dash::Cli::Proxy::LegacyRename.new(host, self).run

      proxy = DASH.proxy(host)
      drift = Dash::Cli::Proxy::Drift.new(host, self)

      if drift.drifted? && auto_reboot
        # Leave the old proxy serving until its serial reboot slot below.
        drifted_hosts << host.to_s
      else
        stale_hosts << host.to_s if drift.drifted?

        version = capture_with_info(*proxy.version).strip.presence

        if version && Dash::Utils.older_version?(version, Dash::Configuration::Proxy::Run::MINIMUM_VERSION)
          raise "dash-proxy version #{version} is too old, run `dash proxy reboot` in order to update to at least #{Dash::Configuration::Proxy::Run::MINIMUM_VERSION}"
        end

        if (run_config = proxy.proxy_run_config)&.secrets?
          execute *proxy.ensure_proxy_directory
          upload! run_config.secrets_io, run_config.secrets_path, mode: "0600"
        else
          # A host keeps no secrets it no longer needs.
          execute *proxy.remove_proxy_secrets_file, raise_on_non_zero_exit: false
        end

        execute *proxy.ensure_apps_config_directory
        execute *proxy.start_holder_or_run if proxy.port_holder?
        execute *proxy.start_or_run(digest: drift.expected_digest)
      end
    end

    if stale_hosts.any?
      say "dash-proxy on #{stale_hosts.sort.join(", ")} is running with a configuration that no longer matches the deploy config. " \
          "Automatic reboot is disabled (proxy: reboot_on_deploy: false) - run `dash proxy reboot` to apply the new configuration.", :yellow
    end

    drifted_hosts.sort.each do |host|
      say "dash-proxy configuration changed, rebooting on #{host}...", :magenta
      run_hook "pre-proxy-reboot", hosts: host
      on(host) do |h|
        Dash::Cli::Proxy::Reboot.new(h, self).run
      end
      run_hook "post-proxy-reboot", hosts: host
    end

    if DASH.config.proxy.load_balancing?
      lb_drifted = Concurrent::Array.new
      lb_stale = Concurrent::Array.new

      on(DASH.config.proxy.effective_loadbalancer) do |host|
        info "Starting loadbalancer on #{host}..."
        execute *DASH.registry.login

        # Bring a pre-rename volume across before the container can be created
        # against an empty one. A no-op once it has been.
        execute *DASH.loadbalancer.copy_legacy_config_volume

        # The load balancer terminates TLS and owns the cache, so its host
        # needs the proxy secrets (acme credentials, cache store) just like
        # the proxy hosts do.
        if (lb_run = DASH.loadbalancer_config.run).secrets?
          execute *DASH.loadbalancer.ensure_proxy_directory
          upload! lb_run.secrets_io, lb_run.secrets_path, mode: "0600"
        else
          execute *DASH.loadbalancer.remove_proxy_secrets_file, raise_on_non_zero_exit: false
        end

        execute *DASH.loadbalancer.ensure_apps_config_directory

        # TLS terminates at the load balancer, so the TLS material the app
        # hosts get - custom certificates and the mTLS client CA - must
        # reach this host too; the LB container reads it through the same
        # apps-config mount the per-host proxies use.
        DASH.config.roles.select(&:running_proxy?).each do |role|
          Dash::Cli::App::SslCertificates.new(host, role, self).run
        end

        # The same drift detection the proxy hosts get: a loadbalancer booted
        # with a different config digest reboots below (or warns, when
        # automatic reboot is off) instead of serving a stale config forever.
        container_id = capture_with_info(*DASH.loadbalancer.container_id, raise_on_non_zero_exit: false).strip
        current_digest = capture_with_info(*DASH.loadbalancer.config_digest, raise_on_non_zero_exit: false).strip

        if container_id.present? && current_digest != DASH.loadbalancer_config.run_config_digest
          if auto_reboot
            # Leave the old loadbalancer serving until its reboot below.
            lb_drifted << host.to_s
          else
            lb_stale << host.to_s
            execute *DASH.loadbalancer.start_or_run
          end
        else
          Dash::Cli::Proxy::LoadbalancerClaim.new(host, self).claim_run_config
          execute *DASH.loadbalancer.start_or_run
        end
      end

      if lb_stale.any?
        say "The loadbalancer on #{lb_stale.sort.join(", ")} is running with a configuration that no longer matches the deploy config. " \
            "Automatic reboot is disabled (proxy: reboot_on_deploy: false) - run `dash proxy reboot` to apply the new configuration.", :yellow
      end

      lb_drifted.sort.each do |host|
        say "Loadbalancer configuration changed, rebooting on #{host}...", :magenta
        run_hook "pre-loadbalancer-reboot", hosts: host
        on(host) do |h|
          Dash::Cli::Proxy::LoadbalancerReboot.new(h, self).run
        end
        run_hook "post-loadbalancer-reboot", hosts: host
      end
    end
  end
end

#boot_config(subcommand) ⇒ Object

# File 'lib/dash/cli/proxy.rb', line 152

def boot_config(subcommand)
  say "The proxy boot_config command is deprecated - set the config in the deploy YAML at proxy/run instead", :yellow
  proxy_boot_config = DASH.config.proxy_boot

  case subcommand
  when "set"
    boot_options = [
      *(proxy_boot_config.publish_args(options[:http_port], options[:https_port], options[:publish_host_ip]) if options[:publish]),
      *(proxy_boot_config.logging_args(options[:log_max_size])),
      *("--expose=#{options[:metrics_port]}" if options[:metrics_port]),
      *options[:docker_options].map { |option| "--#{option}" }
    ]

    image = [
      options[:registry].presence,
      options[:repository].presence || proxy_boot_config.repository_name,
      proxy_boot_config.image_name
    ].compact.join("/")

    image_version = options[:image_version]

    run_command_options = { debug: options[:debug] || nil, "metrics-port": options[:metrics_port] }.compact
    run_command = "dash-proxy run #{Dash::Utils.optionize(run_command_options).join(" ")}" if run_command_options.any?

    on(DASH.proxy_hosts) do |host|
      proxy = DASH.proxy(host)
      execute(*proxy.ensure_proxy_directory)
      if boot_options != proxy_boot_config.default_boot_options
        upload! StringIO.new(boot_options.join(" ")), proxy_boot_config.options_file
      else
        execute *proxy.reset_boot_options, raise_on_non_zero_exit: false
      end

      if image != proxy_boot_config.image_default
        upload! StringIO.new(image), proxy_boot_config.image_file
      else
        execute *proxy.reset_image, raise_on_non_zero_exit: false
      end

      if image_version
        upload! StringIO.new(image_version), proxy_boot_config.image_version_file
      else
        execute *proxy.reset_image_version, raise_on_non_zero_exit: false
      end

      if run_command
        upload! StringIO.new(run_command), proxy_boot_config.run_command_file
      else
        execute *proxy.reset_run_command, raise_on_non_zero_exit: false
      end
    end
  when "get"

    on(DASH.proxy_hosts) do |host|
      puts "Host #{host}: #{capture_with_info(*DASH.proxy(host).boot_config)}"
    end
  when "reset"
    on(DASH.proxy_hosts) do |host|
      proxy = DASH.proxy(host)
      execute *proxy.reset_boot_options, raise_on_non_zero_exit: false
      execute *proxy.reset_image, raise_on_non_zero_exit: false
      execute *proxy.reset_image_version, raise_on_non_zero_exit: false
      execute *proxy.reset_run_command, raise_on_non_zero_exit: false
    end
  else
    raise ArgumentError, "Unknown boot_config subcommand #{subcommand}"
  end
end

#cache(subcommand) ⇒ Object

# File 'lib/dash/cli/proxy.rb', line 456

def cache(subcommand)
  count, json, path_prefix = options[:count], options[:json], options[:path_prefix]

  case subcommand
  when "stats"
    # The cache lives where its policy applies: at the loadbalancer when
    # load balancing (cache is edge-only in the layering contract),
    # otherwise on each proxy host.
    if DASH.config.proxy.load_balancing?
      on(DASH.config.proxy.effective_loadbalancer) do |host|
        puts_by_host host, capture_with_info(*DASH.loadbalancer.cache_stats(count: count, json: json)), type: "Loadbalancer"
      end
    else
      on(DASH.proxy_hosts) do |host|
        puts_by_host host, capture_with_info(*DASH.proxy(host).cache_stats(count: count, json: json)), type: "Proxy"
      end
    end
  when "purge"
    if DASH.config.proxy.load_balancing?
      # The loadbalancer registers one service under the bare service name.
      on(DASH.config.proxy.effective_loadbalancer) do |host|
        execute *DASH.auditor.record("Purged the response cache"), verbosity: :debug
        puts_by_host host, capture_with_info(*DASH.loadbalancer.cache_purge(DASH.config.service, path_prefix: path_prefix)), type: "Loadbalancer"
      end
    else
      # Each proxied role registered its own service, so purge walks them.
      on(DASH.proxy_hosts) do |host|
        execute *DASH.auditor.record("Purged the response cache"), verbosity: :debug

        DASH.roles_on(host).select(&:running_proxy?).each do |role|
          puts_by_host host, capture_with_info(*DASH.proxy(host).cache_purge(role.container_prefix, path_prefix: path_prefix)), type: "Proxy"
        end
      end
    end
  else
    puts "Unknown cache subcommand: #{subcommand}. Available: stats, purge"
  end
end

#details ⇒ Object

# File 'lib/dash/cli/proxy.rb', line 347

def details
  quiet = options[:quiet]
  on(DASH.proxy_hosts) { |host| puts_by_host host, capture_with_info(*DASH.proxy(host).info), type: "Proxy", quiet: quiet }

  if DASH.config.proxy.load_balancing?
    on(DASH.config.proxy.effective_loadbalancer) do |host|
      puts_by_host host, capture_with_info(*DASH.loadbalancer.info), type: "Loadbalancer"
    end
  end
end

#domains(subcommand, *args) ⇒ Object

# File 'lib/dash/cli/proxy.rb', line 508

def domains(subcommand, *args)
  case subcommand
  when "refresh", "list", "stats", "retry"
    # TLS terminates at the load balancer when load balancing, so the
    # dynamic domain set lives there rather than on the per-host proxies.
    if DASH.config.proxy.load_balancing?
      on(DASH.config.proxy.effective_loadbalancer) do |host|
        puts_by_host host, capture_with_info(*DASH.loadbalancer.domains(subcommand, *args)), type: "Loadbalancer"
      end
    else
      on(DASH.proxy_hosts) do |host|
        puts_by_host host, capture_with_info(*DASH.proxy(host).domains(subcommand, *args)), type: "Proxy"
      end
    end
  else
    puts "Unknown domains subcommand: #{subcommand}. Available: refresh, list, stats, retry"
  end
end

#export_certs(local_path) ⇒ Object

# File 'lib/dash/cli/proxy.rb', line 528

def export_certs(local_path)
  load_balancing = DASH.config.proxy.load_balancing?

  # Under the deploy lock: a concurrent deploy could boot or reboot the
  # proxy mid-export, and the offline read below would archive a torn store.
  modify(lock: true, server_lock: true) do
    on(cert_store_host) do |host|
      execute *DASH.auditor.record("Exported the proxy certificate store"), verbosity: :debug

      commands = load_balancing ? DASH.loadbalancer : DASH.proxy(host)
      execute *commands.ensure_apps_config_directory

      # Running: export through the container's RPC socket, under the proxy's
      # certificate write lock. Stopped: read the data directory offline with a
      # one-off container - which may first need the image.
      if capture_with_info(*commands.container_id(only_running: true), raise_on_non_zero_exit: false).strip.present?
        puts capture_with_info(*commands.export_certs)
      else
        execute *DASH.registry.login
        puts capture_with_info(*commands.export_certs_offline)
      end

      # The archive holds private keys; it must not outlive a failed download.
      begin
        download! commands.certs_archive_host_path, local_path
      ensure
        execute *commands.remove_certs_archive, raise_on_non_zero_exit: false
      end
    end
  end
end

#import_certs ⇒ Object

# File 'lib/dash/cli/proxy.rb', line 566

def import_certs
  validate_import_certs_options!
  source = options[:traefik_acme] || options[:archive]
  traefik_acme, resolver = options[:traefik_acme].present?, options[:resolver]
  force, verify = options[:force], options[:verify]
  load_balancing = DASH.config.proxy.load_balancing?

  modify(lock: true, server_lock: true) do
    on(cert_store_host) do |host|
      commands = load_balancing ? DASH.loadbalancer : DASH.proxy(host)

      # dash-proxy import runs offline against the data directory - importing
      # under a live proxy risks a torn store. --verify only reads the archive.
      unless verify
        if capture_with_info(*commands.container_id(only_running: true), raise_on_non_zero_exit: false).strip.present?
          raise "Cannot import certificates while the #{load_balancing ? "loadbalancer" : "proxy"} " \
            "is running on #{host} - stop it first " \
            "(dash proxy #{load_balancing ? "loadbalancer stop" : "stop"}), import, then start it again"
        end
      end

      execute *DASH.auditor.record("Imported certificates into the proxy certificate store"), verbosity: :debug
      execute *DASH.registry.login
      execute *commands.ensure_proxy_directory

      # upload! inside the ensure's reach: a failed or partial upload must
      # not leave certificate material behind on the host either.
      begin
        upload! source, commands.certs_import_host_path, mode: "0600"
        puts capture_with_info(*commands.import_certs(
          traefik_acme: traefik_acme, resolver: resolver, force: force, verify: verify))
      ensure
        execute *commands.remove_certs_import, raise_on_non_zero_exit: false
      end
    end
  end
end

#loadbalancer(status) ⇒ Object

# File 'lib/dash/cli/proxy.rb', line 399

def loadbalancer(status)
  case status
  when "info"
    if DASH.config.proxy.load_balancing?
      on(DASH.config.proxy.effective_loadbalancer) do |host|
        puts "Loadbalancer status on #{host}:"
        puts capture_with_info(*DASH.loadbalancer.info)
      end
    else
      puts "Load balancing is not configured"
    end
  when "start"
    if DASH.config.proxy.load_balancing?
      on(DASH.config.proxy.effective_loadbalancer) do |host|
        execute *DASH.registry.login
        execute *DASH.loadbalancer.start_or_run
      end
    else
      puts "Load balancing is not configured"
    end
  when "stop"
    if DASH.config.proxy.load_balancing?
      on(DASH.config.proxy.effective_loadbalancer) do |host|
        execute *DASH.loadbalancer.stop, raise_on_non_zero_exit: false
      end
    else
      puts "Load balancing is not configured"
    end
  when "logs"
    if DASH.config.proxy.load_balancing?
      on(DASH.config.proxy.effective_loadbalancer) do |host|
        puts_by_host host, capture(*DASH.loadbalancer.logs(timestamps: true)), type: "Loadbalancer"
      end
    else
      puts "Load balancing is not configured"
    end
  when "deploy"
    if DASH.config.proxy.load_balancing?
      targets = DASH.loadbalancer_config.target_hosts

      on(DASH.config.proxy.effective_loadbalancer) do |host|
        Dash::Cli::Proxy::LoadbalancerClaim.new(host, self).claim_service
        info "Deploying to loadbalancer on #{host} with targets: #{targets.join(', ')}"
        execute *DASH.loadbalancer.deploy(targets: targets)
      end
    else
      puts "Load balancing is not configured"
    end
  else
    puts "Unknown loadbalancer subcommand: #{status}. Available: info, start, stop, logs, deploy"
  end
end

#logs ⇒ Object

# File 'lib/dash/cli/proxy.rb', line 364

def logs
  grep = options[:grep]
  timestamps = !options[:skip_timestamps]

  if options[:follow]
    run_locally do
      proxy = DASH.proxy(DASH.primary_host)
      info "Following logs on #{DASH.primary_host}..."
      info proxy.follow_logs(host: DASH.primary_host, timestamps: timestamps, grep: grep)
      exec proxy.follow_logs(host: DASH.primary_host, timestamps: timestamps, grep: grep)
    end
  else
    since = options[:since]
    lines = options[:lines].presence || ((since || grep) ? nil : 100) # Default to 100 lines if since or grep isn't set

    on(DASH.proxy_hosts) do |host|
      puts_by_host host, capture(*DASH.proxy(host).logs(timestamps: timestamps, since: since, lines: lines, grep: grep)), type: "Proxy"
    end
  end
end

#reboot ⇒ Object

# File 'lib/dash/cli/proxy.rb', line 224

def reboot
  confirming "This will cause a brief outage on each host. Are you sure?" do
    modify(lock: true, server_lock: true) do
      # Skip proxy on loadbalancer host - it will be handled by loadbalancer reboot
      proxy_hosts = DASH.proxy_hosts
      if DASH.config.proxy.loadbalancer_on_proxy_host?
        proxy_hosts = proxy_hosts - [ DASH.config.proxy.effective_loadbalancer ]
      end

      host_groups = options[:rolling] ? proxy_hosts : [ proxy_hosts ]
      host_groups.each do |hosts|
        next if Array(hosts).empty?

        host_list = Array(hosts).join(",")
        run_hook "pre-proxy-reboot", hosts: host_list
        on(hosts) do |host|
          info "Rebooting dash-proxy on #{host}..."
          Dash::Cli::Proxy::Reboot.new(host, self).run
        end
        run_hook "post-proxy-reboot", hosts: host_list
      end

      if DASH.config.proxy.load_balancing?
        lb_host = DASH.config.proxy.effective_loadbalancer
        run_hook "pre-loadbalancer-reboot", hosts: lb_host

        on(lb_host) do |host|
          Dash::Cli::Proxy::LoadbalancerReboot.new(host, self).run
        end

        run_hook "post-loadbalancer-reboot", hosts: lb_host
      end
    end
  end
end

#remove ⇒ Object

# File 'lib/dash/cli/proxy.rb', line 387

def remove
  modify(lock: true, server_lock: true) do
    if removal_allowed?(options[:force])
      stop
      remove_container
      remove_image
      remove_proxy_directory
    end
  end
end

#remove_container ⇒ Object

# File 'lib/dash/cli/proxy.rb', line 605

def remove_container
  modify(lock: true, server_lock: true) do
    on(DASH.proxy_hosts) do
      execute *DASH.auditor.record("Removed proxy container"), verbosity: :debug
      execute *DASH.proxy(host).remove_container
    end

    if DASH.config.proxy.load_balancing?
      on(DASH.config.proxy.effective_loadbalancer) do
        execute *DASH.auditor.record("Removed loadbalancer container"), verbosity: :debug
        execute *DASH.loadbalancer.remove_container
      end
    end
  end
end

#remove_image ⇒ Object

# File 'lib/dash/cli/proxy.rb', line 622

def remove_image
  modify(lock: true, server_lock: true) do
    on(DASH.proxy_hosts) do
      execute *DASH.auditor.record("Removed proxy image"), verbosity: :debug
      execute *DASH.proxy(host).remove_image
    end

    if DASH.config.proxy.load_balancing?
      on(DASH.config.proxy.effective_loadbalancer) do
        execute *DASH.auditor.record("Removed loadbalancer image"), verbosity: :debug
        execute *DASH.loadbalancer.remove_image
      end
    end
  end
end

#remove_proxy_directory ⇒ Object

# File 'lib/dash/cli/proxy.rb', line 639

def remove_proxy_directory
  modify(lock: true, server_lock: true) do
    on(DASH.proxy_hosts) do
      execute *DASH.proxy(host).remove_proxy_directory, raise_on_non_zero_exit: false
    end

    # Otherwise the ownership registry outlives the load balancer and a later
    # boot would fail against an owner that no longer exists.
    if DASH.config.proxy.load_balancing?
      on(DASH.config.proxy.effective_loadbalancer) do
        execute *DASH.loadbalancer.remove_directory, raise_on_non_zero_exit: false
      end
    end
  end
end

#restart ⇒ Object

# File 'lib/dash/cli/proxy.rb', line 339

def restart
  modify(lock: true, server_lock: true) do
    stop
    start
  end
end

#start ⇒ Object

# File 'lib/dash/cli/proxy.rb', line 302

def start
  modify(lock: true, server_lock: true) do
    on(DASH.proxy_hosts) do |host|
      execute *DASH.auditor.record("Started proxy"), verbosity: :debug
      execute *DASH.proxy(host).start
    end

    if DASH.config.proxy.load_balancing?
      on(DASH.config.proxy.effective_loadbalancer) do
        execute *DASH.auditor.record("Started loadbalancer"), verbosity: :debug
        execute *DASH.loadbalancer.start, raise_on_non_zero_exit: false
      end
    end
  end
end

#stop ⇒ Object

# File 'lib/dash/cli/proxy.rb', line 319

def stop
  modify(lock: true, server_lock: true) do
    on(DASH.proxy_hosts) do |host|
      execute *DASH.auditor.record("Stopped proxy"), verbosity: :debug
      execute *DASH.proxy(host).stop, raise_on_non_zero_exit: false
    end

    # `docker container prune` only collects stopped containers, so leaving the
    # loadbalancer running would also leave `dash proxy remove` unable to
    # remove it.
    if DASH.config.proxy.load_balancing?
      on(DASH.config.proxy.effective_loadbalancer) do
        execute *DASH.auditor.record("Stopped loadbalancer"), verbosity: :debug
        execute *DASH.loadbalancer.stop, raise_on_non_zero_exit: false
      end
    end
  end
end

#upgrade ⇒ Object

# File 'lib/dash/cli/proxy.rb', line 263

def upgrade
  invoke_options = { "version" => DASH.config.latest_tag }.merge(options)

  confirming "This will cause a brief outage on each host. Are you sure?" do
    host_groups = options[:rolling] ? DASH.hosts : [ DASH.hosts ]
    host_groups.each do |hosts|
      host_list = Array(hosts).join(",")
      say "Upgrading proxy on #{host_list}...", :magenta
      run_hook "pre-proxy-reboot", hosts: host_list
      on(hosts) do |host|
        proxy = DASH.proxy(host)
        execute *DASH.auditor.record("Rebooted proxy"), verbosity: :debug
        execute *DASH.registry.login

        info "Stopping and removing Traefik on #{host}, if running..."
        execute *proxy.cleanup_traefik

        info "Stopping and removing dash-proxy on #{host}, if running..."
        execute *proxy.stop, raise_on_non_zero_exit: false
        execute *proxy.remove_container
        execute *proxy.remove_image
      end

      DASH.with_specific_hosts(hosts) do
        invoke "dash:cli:proxy:boot", [], invoke_options
        reset_invocation(Dash::Cli::Proxy)
        invoke "dash:cli:app:boot", [], invoke_options
        reset_invocation(Dash::Cli::App)
        invoke "dash:cli:prune:all", [], invoke_options
        reset_invocation(Dash::Cli::Prune)
      end

      run_hook "post-proxy-reboot", hosts: host_list
      say "Upgraded proxy on #{host_list}", :magenta
    end
  end
end