Describe an installation in a file, and converge to it

One file describes the whole installation: which machine runs what, under
which names. Each machine acts on its own part of it and prints the command
to run on the others, which nobody but their operator runs. Emit, never
execute -- no agent, no console-held credential, no machine reaching
another.

  inbuxa plan  -f topology.json     what would change here; changes nothing
  inbuxa apply -f topology.json     make this machine match it
  inbuxa export                     the file, from what is already here

plan diffs the file against what is installed rather than against what
happens to be running: a container stopped by hand is still installed, and
offering to install it again would be a lie about what is about to happen.
The state that makes that possible -- intent, which the machine itself
cannot tell you -- is /etc/inbuxa/install.json.

Front ends across machines, not a clustered mail server. Two machines each
running one is refused, and the refusal says why: a second node needs a
shared store and cluster configuration, which this does not set up. Two of
the same component on one machine is refused too -- two webmails need two
ports and two names, and the file says neither.

The shrink is the half worth proving, and it found the bug that mattered:
apply ran first boot every time, so the second one asked a configured server
for bootstrap credentials it had stopped accepting, and adding or removing a
front end could not work at all. An installed machine now converges instead:
the deployment is rewritten from the shapes asked for, --remove-orphans
takes away what the file no longer lists, data volumes are left alone, and
the secrets generated the first time are kept rather than rolled.

Two more found the same way:

- Certificates were turned on even where nothing holds port 80. On a machine
  with no proxy the order can only fail, and it stopped the install over it.
  It now says whose job they are instead.
- A converge that restarts the server reported "Done" while it was still
  coming back. It waits.

Twenty-eight checks, on Debian 13 and Fedora 43: install from a file, plan
the same file and be told there is nothing to do, remove the webmail and
watch it go while the mail stays, put it back.

internal/compose/compose.go

@@ -133,12 +133,21 @@ func Write(dir string, s *Stack) (Secrets, error) {
 		return sec, err
 	}
 
+	// Secrets are generated once and kept. Rewriting the deployment to add
+	// or remove a component must not roll the webmail's session key or the
+	// OAuth client secret the server was told: the point of converging is
+	// that everything not being changed stays as it was.
+	sec = readSecrets(filepath.Join(dir, ".env"))
 	var err error
-	if sec.AppSecret, err = secret(); err != nil {
-		return sec, err
+	if sec.AppSecret == "" {
+		if sec.AppSecret, err = secret(); err != nil {
+			return sec, err
+		}
 	}
-	if sec.WebmailOAuth, err = secret(); err != nil {
-		return sec, err
+	if sec.WebmailOAuth == "" {
+		if sec.WebmailOAuth, err = secret(); err != nil {
+			return sec, err
+		}
 	}
 
 	funcs := template.FuncMap{"join": strings.Join}
@@ -171,6 +180,29 @@ func Write(dir string, s *Stack) (Secrets, error) {
 	return sec, nil
 }
 
+// readSecrets recovers what a previous run generated, so a converge keeps
+// them. A missing or unreadable file means a first install, and new ones.
+func readSecrets(path string) Secrets {
+	var sec Secrets
+	b, err := os.ReadFile(path)
+	if err != nil {
+		return sec
+	}
+	for _, line := range strings.Split(string(b), "\n") {
+		k, v, ok := strings.Cut(strings.TrimSpace(line), "=")
+		if !ok {
+			continue
+		}
+		switch k {
+		case "APP_SECRET":
+			sec.AppSecret = v
+		case "WEBMAIL_CLIENT_SECRET":
+			sec.WebmailOAuth = v
+		}
+	}
+	return sec
+}
+
 func secret() (string, error) {
 	b := make([]byte, 32)
 	if _, err := rand.Read(b); err != nil {