Add support for running jobs from a stack (#975)

Part of https://plan.wireit.in/deepstack/browse/VUL-265/

Reviewed-on: #975
Co-authored-by: Prathamesh Musale <prathamesh.musale0@gmail.com>
Co-committed-by: Prathamesh Musale <prathamesh.musale0@gmail.com>

.gitea/workflows/fixturenet-laconicd-test.yml

@@ -39,7 +39,7 @@ jobs:
       - name: "Print Python version"
         run: python3 --version
       - name: "Install shiv"
-        run: pip install shiv
+        run: pip install shiv==1.0.6
       - name: "Generate build version file"
         run: ./scripts/create_build_tag_file.sh
       - name: "Build local shiv package"

.gitea/workflows/publish.yml

@@ -35,7 +35,7 @@ jobs:
       - name: "Print Python version"
         run: python3 --version
       - name: "Install shiv"
-        run: pip install shiv
+        run: pip install shiv==1.0.6
       - name: "Build local shiv package"
         id: build
         run: |

.gitea/workflows/test-container-registry.yml

@@ -33,7 +33,7 @@ jobs:
       - name: "Print Python version"
         run: python3 --version
       - name: "Install shiv"
-        run: pip install shiv
+        run: pip install shiv==1.0.6
       - name: "Generate build version file"
         run: ./scripts/create_build_tag_file.sh
       - name: "Build local shiv package"

.gitea/workflows/test-database.yml

@@ -33,7 +33,7 @@ jobs:
       - name: "Print Python version"
         run: python3 --version
       - name: "Install shiv"
-        run: pip install shiv
+        run: pip install shiv==1.0.6
       - name: "Generate build version file"
         run: ./scripts/create_build_tag_file.sh
       - name: "Build local shiv package"

.gitea/workflows/test-deploy.yml

@@ -33,7 +33,7 @@ jobs:
       - name: "Print Python version"
         run: python3 --version
       - name: "Install shiv"
-        run: pip install shiv
+        run: pip install shiv==1.0.6
       - name: "Generate build version file"
         run: ./scripts/create_build_tag_file.sh
       - name: "Build local shiv package"

.gitea/workflows/test-external-stack.yml

@@ -33,7 +33,7 @@ jobs:
       - name: "Print Python version"
         run: python3 --version
       - name: "Install shiv"
-        run: pip install shiv
+        run: pip install shiv==1.0.6
       - name: "Generate build version file"
         run: ./scripts/create_build_tag_file.sh
       - name: "Build local shiv package"

.gitea/workflows/test-k8s-deploy.yml

@@ -35,7 +35,7 @@ jobs:
       - name: "Print Python version"
         run: python3 --version
       - name: "Install shiv"
-        run: pip install shiv
+        run: pip install shiv==1.0.6
       - name: "Generate build version file"
         run: ./scripts/create_build_tag_file.sh
       - name: "Build local shiv package"

.gitea/workflows/test-k8s-deployment-control.yml

@@ -35,7 +35,7 @@ jobs:
       - name: "Print Python version"
         run: python3 --version
       - name: "Install shiv"
-        run: pip install shiv
+        run: pip install shiv==1.0.6
       - name: "Generate build version file"
         run: ./scripts/create_build_tag_file.sh
       - name: "Build local shiv package"

.gitea/workflows/test-webapp.yml

@@ -32,7 +32,7 @@ jobs:
       - name: "Print Python version"
         run: python3 --version
       - name: "Install shiv"
-        run: pip install shiv
+        run: pip install shiv==1.0.6
       - name: "Generate build version file"
         run: ./scripts/create_build_tag_file.sh
       - name: "Build local shiv package"

.gitea/workflows/test.yml

@@ -33,7 +33,7 @@ jobs:
       - name: "Print Python version"
         run: python3 --version
       - name: "Install shiv"
-        run: pip install shiv
+        run: pip install shiv==1.0.6
       - name: "Generate build version file"
         run: ./scripts/create_build_tag_file.sh
       - name: "Build local shiv package"

docs/helm-chart-generation.md

@@ -0,0 +1,113 @@
+# Helm Chart Generation
+
+Generate Kubernetes Helm charts from stack compose files using Kompose.
+
+## Prerequisites
+
+Install Kompose:
+
+```bash
+# Linux
+curl -L https://github.com/kubernetes/kompose/releases/download/v1.34.0/kompose-linux-amd64 -o kompose
+chmod +x kompose
+sudo mv kompose /usr/local/bin/
+
+# macOS
+brew install kompose
+
+# Verify
+kompose version
+```
+
+## Usage
+
+### 1. Create spec file
+
+```bash
+laconic-so --stack <stack-name> deploy --deploy-to k8s init \
+  --kube-config ~/.kube/config \
+  --output spec.yml
+```
+
+### 2. Generate Helm chart
+
+```bash
+laconic-so --stack <stack-name> deploy create \
+  --spec-file spec.yml \
+  --deployment-dir my-deployment \
+  --helm-chart
+```
+
+### 3. Deploy to Kubernetes
+
+```bash
+helm install my-release my-deployment/chart
+kubectl get pods -n zenith
+```
+
+## Output Structure
+
+```bash
+my-deployment/
+├── spec.yml              # Reference
+├── stack.yml             # Reference
+└── chart/                # Helm chart
+  ├── Chart.yaml
+  ├── README.md
+  └── templates/
+    └── *.yaml
+```
+
+## Example
+
+```bash
+# Generate chart for stage1-zenithd
+laconic-so --stack stage1-zenithd deploy --deploy-to k8s init \
+  --kube-config ~/.kube/config \
+  --output stage1-spec.yml
+
+laconic-so --stack stage1-zenithd deploy create \
+  --spec-file stage1-spec.yml \
+  --deployment-dir stage1-deployment \
+  --helm-chart
+
+# Deploy
+helm install stage1-zenithd stage1-deployment/chart
+```
+
+## Production Deployment (TODO)
+
+### Local Development
+
+```bash
+# Access services using port-forward
+kubectl port-forward service/zenithd 26657:26657
+kubectl port-forward service/nginx-api-proxy 1317:80
+kubectl port-forward service/cosmos-explorer 4173:4173
+```
+
+### Production Access Options
+
+- Option 1: Ingress + cert-manager (Recommended)
+  - Install ingress-nginx + cert-manager
+  - Point DNS to cluster LoadBalancer IP
+  - Auto-provisions Let's Encrypt TLS certs
+  - Access: `https://api.zenith.example.com`
+- Option 2: Cloud LoadBalancer
+  - Use cloud provider's LoadBalancer service type
+  - Point DNS to assigned external IP
+  - Manual TLS cert management
+- Option 3: Bare Metal (MetalLB + Ingress)
+  - MetalLB provides LoadBalancer IPs from local network
+  - Same Ingress setup as cloud
+- Option 4: NodePort + External Proxy
+  - Expose services on 30000-32767 range
+  - External nginx/Caddy proxies 80/443 → NodePort
+  - Manual cert management
+
+### Changes Needed
+
+- Add Ingress template to charts
+- Add TLS configuration to values.yaml
+- Document cert-manager setup
+- Add production deployment guide

stack_orchestrator/data/container-build/cerc-nextjs-base/scripts/build-app.sh

@@ -26,8 +26,14 @@ fi
 SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
 WORK_DIR="${1:-/app}"
 
+if [ -f "${WORK_DIR}/build-webapp.sh" ]; then
+  echo "Building webapp with ${WORK_DIR}/build-webapp.sh ..."
 cd "${WORK_DIR}" || exit 1
 
+  ./build-webapp.sh || exit 1
+  exit 0
+fi
+
 if [ -f "next.config.mjs" ]; then
   NEXT_CONFIG_JS="next.config.mjs"
   IMPORT_OR_REQUIRE="import"

stack_orchestrator/data/container-build/cerc-nextjs-base/scripts/start-serving-app.sh

@@ -30,36 +30,44 @@ fi
 CERC_WEBAPP_FILES_DIR="${CERC_WEBAPP_FILES_DIR:-/app}"
 cd "$CERC_WEBAPP_FILES_DIR"
 
-"$SCRIPT_DIR/apply-runtime-env.sh" "`pwd`" .next .next-r
-mv .next .next.old
-mv .next-r/.next .
+if [ -f "./run-webapp.sh" ]; then
+  echo "Running webapp with run-webapp.sh ..."
+  cd "${WORK_DIR}" || exit 1
+  ./run-webapp.sh &
+  tpid=$!
+  wait $tpid
+else 
+  "$SCRIPT_DIR/apply-runtime-env.sh" "`pwd`" .next .next-r
+  mv .next .next.old
+  mv .next-r/.next .
 
-if [ "$CERC_NEXTJS_SKIP_GENERATE" != "true" ]; then
-  jq -e '.scripts.cerc_generate' package.json >/dev/null
-  if [ $? -eq 0 ]; then
-    npm run cerc_generate > gen.out 2>&1 &
-    tail -f gen.out &
-    tpid=$!
+  if [ "$CERC_NEXTJS_SKIP_GENERATE" != "true" ]; then
+    jq -e '.scripts.cerc_generate' package.json >/dev/null
+    if [ $? -eq 0 ]; then
+      npm run cerc_generate > gen.out 2>&1 &
+      tail -f gen.out &
+      tpid=$!
 
-    count=0
-    generate_done="false"
-    while [ $count -lt $CERC_MAX_GENERATE_TIME ] && [ "$generate_done" == "false" ]; do
-      sleep 1
-      count=$((count + 1))
-      grep 'rendered as static' gen.out > /dev/null
-      if [ $? -eq 0 ]; then
-        generate_done="true"
+      count=0
+      generate_done="false"
+      while [ $count -lt $CERC_MAX_GENERATE_TIME ] && [ "$generate_done" == "false" ]; do
+        sleep 1
+        count=$((count + 1))
+        grep 'rendered as static' gen.out > /dev/null
+        if [ $? -eq 0 ]; then
+          generate_done="true"
+        fi
+      done
+
+      if [ $generate_done != "true" ]; then
+        echo "ERROR: 'npm run cerc_generate' not successful within CERC_MAX_GENERATE_TIME" 1>&2
+        exit 1
       fi
-    done
 
-    if [ $generate_done != "true" ]; then
-      echo "ERROR: 'npm run cerc_generate' not successful within CERC_MAX_GENERATE_TIME" 1>&2
-      exit 1
+      kill $tpid $(ps -ef | grep node | grep next | grep generate | awk '{print $2}') 2>/dev/null
+      tpid=""
     fi
-
-    kill $tpid $(ps -ef | grep node | grep next | grep generate | awk '{print $2}') 2>/dev/null
-    tpid=""
   fi
-fi
 
-$CERC_BUILD_TOOL start . -- -p ${CERC_LISTEN_PORT:-80}
+  $CERC_BUILD_TOOL start . -- -p ${CERC_LISTEN_PORT:-80}
+fi

stack_orchestrator/data/stacks/package-registry/README.md

@@ -27,3 +27,25 @@ The Package Registry Stack supports a build environment that requires a package
   ```
 
 * The local gitea registry can now be accessed at <http://localhost:3000> (the username and password can be taken from the deployment logs)
+
+* Configure the hostname `gitea.local`:
+
+  Update `/etc/hosts`:
+
+  ```bash
+  sudo nano /etc/hosts
+
+  # Add the following line
+  127.0.0.1       gitea.local
+  ```
+
+  Check resolution:
+
+  ```bash
+  ping gitea.local
+
+  PING gitea.local (127.0.0.1) 56(84) bytes of data.
+  64 bytes from localhost (127.0.0.1): icmp_seq=1 ttl=64 time=0.147 ms
+  64 bytes from localhost (127.0.0.1): icmp_seq=2 ttl=64 time=0.033 ms
+  ...
+  ```

stack_orchestrator/deploy/compose/deploy_docker.py

@@ -94,6 +94,40 @@ class DockerDeployer(Deployer):
             except DockerException as e:
                 raise DeployerException(e)
 
+    def run_job(self, job_name: str, release_name: str = None):
+        # release_name is ignored for Docker deployments (only used for K8s/Helm)
+        if not opts.o.dry_run:
+            try:
+                # Find job compose file in compose-jobs directory
+                # The deployment should have compose-jobs/docker-compose-<job_name>.yml
+                if not self.docker.compose_files:
+                    raise DeployerException("No compose files configured")
+
+                # Deployment directory is parent of compose directory
+                compose_dir = Path(self.docker.compose_files[0]).parent
+                deployment_dir = compose_dir.parent
+                job_compose_file = deployment_dir / "compose-jobs" / f"docker-compose-{job_name}.yml"
+
+                if not job_compose_file.exists():
+                    raise DeployerException(f"Job compose file not found: {job_compose_file}")
+
+                if opts.o.verbose:
+                    print(f"Running job from: {job_compose_file}")
+
+                # Create a DockerClient for the job compose file with same project name and env file
+                # This allows the job to access volumes from the main deployment
+                job_docker = DockerClient(
+                    compose_files=[job_compose_file],
+                    compose_project_name=self.docker.compose_project_name,
+                    compose_env_file=self.docker.compose_env_file
+                )
+
+                # Run the job with --rm flag to remove container after completion
+                return job_docker.compose.run(service=job_name, remove=True, tty=True)
+
+            except DockerException as e:
+                raise DeployerException(e)
+
 
 class DockerDeployerConfigGenerator(DeployerConfigGenerator):
 

stack_orchestrator/deploy/deploy.py

@@ -84,7 +84,22 @@ def create_deploy_context(
     # Extract the cluster name from the deployment, if we have one
     if deployment_context and cluster is None:
         cluster = deployment_context.get_cluster_id()
-    cluster_context = _make_cluster_context(global_context, stack, include, exclude, cluster, env_file)
+
+    # Check if this is a helm chart deployment (has chart/ but no compose/)
+    # TODO: Add a new deployment type for helm chart deployments
+    # To avoid relying on chart existence in such cases
+    is_helm_chart_deployment = False
+    if deployment_context:
+        chart_dir = deployment_context.deployment_dir / "chart"
+        compose_dir = deployment_context.deployment_dir / "compose"
+        is_helm_chart_deployment = chart_dir.exists() and not compose_dir.exists()
+
+    # For helm chart deployments, skip compose file loading
+    if is_helm_chart_deployment:
+        cluster_context = ClusterContext(global_context, cluster, [], [], [], None, env_file)
+    else:
+        cluster_context = _make_cluster_context(global_context, stack, include, exclude, cluster, env_file)
+
     deployer = getDeployer(deploy_to, deployment_context, compose_files=cluster_context.compose_files,
                            compose_project_name=cluster_context.cluster,
                            compose_env_file=cluster_context.env_file)
@@ -188,6 +203,17 @@ def logs_operation(ctx, tail: int, follow: bool, extra_args: str):
         print(stream_content.decode("utf-8"), end="")
 
 
+def run_job_operation(ctx, job_name: str, helm_release: str = None):
+    global_context = ctx.parent.parent.obj
+    if not global_context.dry_run:
+        print(f"Running job: {job_name}")
+        try:
+            ctx.obj.deployer.run_job(job_name, helm_release)
+        except Exception as e:
+            print(f"Error running job {job_name}: {e}")
+            sys.exit(1)
+
+
 @command.command()
 @click.argument('extra_args', nargs=-1)  # help: command: up <service1> <service2>
 @click.pass_context

stack_orchestrator/deploy/deployer.py

@@ -55,6 +55,10 @@ class Deployer(ABC):
     def run(self, image: str, command=None, user=None, volumes=None, entrypoint=None, env={}, ports=[], detach=False):
         pass
 
+    @abstractmethod
+    def run_job(self, job_name: str, release_name: str = None):
+        pass
+
 
 class DeployerException(Exception):
     def __init__(self, *args: object) -> None:

stack_orchestrator/deploy/deployment.py

@@ -167,3 +167,14 @@ def status(ctx):
 def update(ctx):
     ctx.obj = make_deploy_context(ctx)
     update_operation(ctx)
+
+
+@command.command()
+@click.argument('job_name')
+@click.option('--helm-release', help='Helm release name (only for k8s helm chart deployments, defaults to chart name)')
+@click.pass_context
+def run_job(ctx, job_name, helm_release):
+    '''run a one-time job from the stack'''
+    from stack_orchestrator.deploy.deploy import run_job_operation
+    ctx.obj = make_deploy_context(ctx)
+    run_job_operation(ctx, job_name, helm_release)

stack_orchestrator/deploy/deployment_context.py

@@ -56,9 +56,8 @@ class DeploymentContext:
         self.stack.init_from_file(self.get_stack_file())
         deployment_file_path = self.get_deployment_file()
         if deployment_file_path.exists():
-            with deployment_file_path:
-                obj = get_yaml().load(open(deployment_file_path, "r"))
-                self.id = obj[constants.cluster_id_key]
+            obj = get_yaml().load(open(deployment_file_path, "r"))
+            self.id = obj[constants.cluster_id_key]
         # Handle the case of a legacy deployment with no file
         # Code below is intended to match the output from _make_default_cluster_name()
         # TODO: remove when we no longer need to support legacy deployments

stack_orchestrator/deploy/deployment_create.py

@@ -27,7 +27,7 @@ from stack_orchestrator.opts import opts
 from stack_orchestrator.util import (get_stack_path, get_parsed_deployment_spec, get_parsed_stack_config,
                                      global_options, get_yaml, get_pod_list, get_pod_file_path, pod_has_scripts,
                                      get_pod_script_paths, get_plugin_code_paths, error_exit, env_var_map_from_file,
-                                     resolve_config_dir)
+                                     resolve_config_dir, get_job_list, get_job_file_path)
 from stack_orchestrator.deploy.spec import Spec
 from stack_orchestrator.deploy.deploy_types import LaconicStackSetupCommand
 from stack_orchestrator.deploy.deployer_factory import getDeployerConfigGenerator
@@ -443,22 +443,24 @@ def _check_volume_definitions(spec):
 @click.command()
 @click.option("--spec-file", required=True, help="Spec file to use to create this deployment")
 @click.option("--deployment-dir", help="Create deployment files in this directory")
+@click.option("--helm-chart", is_flag=True, default=False, help="Generate Helm chart instead of deploying (k8s only)")
 # TODO: Hack
 @click.option("--network-dir", help="Network configuration supplied in this directory")
 @click.option("--initial-peers", help="Initial set of persistent peers")
 @click.pass_context
-def create(ctx, spec_file, deployment_dir, network_dir, initial_peers):
+def create(ctx, spec_file, deployment_dir, helm_chart, network_dir, initial_peers):
     deployment_command_context = ctx.obj
-    return create_operation(deployment_command_context, spec_file, deployment_dir, network_dir, initial_peers)
+    return create_operation(deployment_command_context, spec_file, deployment_dir, helm_chart, network_dir, initial_peers)
 
 
 # The init command's implementation is in a separate function so that we can
 # call it from other commands, bypassing the click decoration stuff
-def create_operation(deployment_command_context, spec_file, deployment_dir, network_dir, initial_peers):
+def create_operation(deployment_command_context, spec_file, deployment_dir, helm_chart, network_dir, initial_peers):
     parsed_spec = Spec(os.path.abspath(spec_file), get_parsed_deployment_spec(spec_file))
     _check_volume_definitions(parsed_spec)
     stack_name = parsed_spec["stack"]
     deployment_type = parsed_spec[constants.deploy_to_key]
+
     stack_file = get_stack_path(stack_name).joinpath(constants.stack_file_name)
     parsed_stack = get_parsed_stack_config(stack_name)
     if opts.o.debug:
@@ -473,7 +475,17 @@ def create_operation(deployment_command_context, spec_file, deployment_dir, netw
     # Copy spec file and the stack file into the deployment dir
     copyfile(spec_file, deployment_dir_path.joinpath(constants.spec_file_name))
     copyfile(stack_file, deployment_dir_path.joinpath(constants.stack_file_name))
+
+    # Create deployment.yml with cluster-id
     _create_deployment_file(deployment_dir_path)
+
+    # Branch to Helm chart generation flow if --helm-chart flag is set
+    if deployment_type == "k8s" and helm_chart:
+        from stack_orchestrator.deploy.k8s.helm.chart_generator import generate_helm_chart
+        generate_helm_chart(stack_name, spec_file, deployment_dir_path)
+        return  # Exit early for helm chart generation
+
+    # Existing deployment flow continues unchanged
     # Copy any config varibles from the spec file into an env file suitable for compose
     _write_config_file(spec_file, deployment_dir_path.joinpath(constants.config_file_name))
     # Copy any k8s config file into the deployment dir
@@ -531,6 +543,21 @@ def create_operation(deployment_command_context, spec_file, deployment_dir, netw
                     if os.path.exists(destination_config_dir) and not os.listdir(destination_config_dir):
                         copytree(source_config_dir, destination_config_dir, dirs_exist_ok=True)
 
+    # Copy the job files into the deployment dir (for Docker deployments)
+    jobs = get_job_list(parsed_stack)
+    if jobs and not parsed_spec.is_kubernetes_deployment():
+        destination_compose_jobs_dir = deployment_dir_path.joinpath("compose-jobs")
+        os.mkdir(destination_compose_jobs_dir)
+        for job in jobs:
+            job_file_path = get_job_file_path(stack_name, parsed_stack, job)
+            if job_file_path and job_file_path.exists():
+                parsed_job_file = yaml.load(open(job_file_path, "r"))
+                _fixup_pod_file(parsed_job_file, parsed_spec, destination_compose_dir)
+                with open(destination_compose_jobs_dir.joinpath("docker-compose-%s.yml" % job), "w") as output_file:
+                    yaml.dump(parsed_job_file, output_file)
+                if opts.o.debug:
+                    print(f"Copied job compose file: {job}")
+
     # Delegate to the stack's Python code
     # The deploy create command doesn't require a --stack argument so we need to insert the
     # stack member here.

stack_orchestrator/deploy/k8s/deploy_k8s.py

@@ -510,6 +510,26 @@ class K8sDeployer(Deployer):
         # We need to figure out how to do this -- check why we're being called first
         pass
 
+    def run_job(self, job_name: str, helm_release: str = None):
+        if not opts.o.dry_run:
+            from stack_orchestrator.deploy.k8s.helm.job_runner import run_helm_job
+
+            # Check if this is a helm-based deployment
+            chart_dir = self.deployment_dir / "chart"
+            if not chart_dir.exists():
+                # TODO: Implement job support for compose-based K8s deployments
+                raise Exception(f"Job support is only available for helm-based deployments. Chart directory not found: {chart_dir}")
+
+            # Run the job using the helm job runner
+            run_helm_job(
+                chart_dir=chart_dir,
+                job_name=job_name,
+                release=helm_release,
+                namespace=self.k8s_namespace,
+                timeout=600,
+                verbose=opts.o.verbose
+            )
+
     def is_kind(self):
         return self.type == "k8s-kind"
 

stack_orchestrator/deploy/k8s/helm/__init__.py

@@ -0,0 +1,14 @@
+# Copyright © 2025 Vulcanize
+
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http:#www.gnu.org/licenses/>.

stack_orchestrator/deploy/k8s/helm/chart_generator.py

@@ -0,0 +1,320 @@
+# Copyright © 2025 Vulcanize
+
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http:#www.gnu.org/licenses/>.
+
+from pathlib import Path
+
+from stack_orchestrator import constants
+from stack_orchestrator.opts import opts
+from stack_orchestrator.util import (
+    get_parsed_stack_config,
+    get_pod_list,
+    get_pod_file_path,
+    get_job_list,
+    get_job_file_path,
+    error_exit
+)
+from stack_orchestrator.deploy.k8s.helm.kompose_wrapper import (
+    check_kompose_available,
+    get_kompose_version,
+    convert_to_helm_chart
+)
+from stack_orchestrator.util import get_yaml
+
+
+def _wrap_job_templates_with_conditionals(chart_dir: Path, jobs: list) -> None:
+    """
+    Wrap job templates with conditional checks so they are not created by default.
+    Jobs will only be created when explicitly enabled via --set jobs.<name>.enabled=true
+    """
+    templates_dir = chart_dir / "templates"
+    if not templates_dir.exists():
+        return
+
+    for job_name in jobs:
+        # Find job template file (kompose generates <service-name>-job.yaml)
+        job_template_file = templates_dir / f"{job_name}-job.yaml"
+
+        if not job_template_file.exists():
+            if opts.o.debug:
+                print(f"Warning: Job template not found: {job_template_file}")
+            continue
+
+        # Read the template content
+        content = job_template_file.read_text()
+
+        # Wrap with conditional (default false)
+        # Use 'index' function to handle job names with dashes
+        # Provide default dict for .Values.jobs to handle case where it doesn't exist
+        condition = (
+            f"{{{{- if (index (.Values.jobs | default dict) "
+            f'"{job_name}" | default dict).enabled | default false }}}}'
+        )
+        wrapped_content = f"""{condition}
+{content}{{{{- end }}}}
+"""
+
+        # Write back
+        job_template_file.write_text(wrapped_content)
+
+        if opts.o.debug:
+            print(f"Wrapped job template with conditional: {job_template_file.name}")
+
+
+def _post_process_chart(chart_dir: Path, chart_name: str, jobs: list) -> None:
+    """
+    Post-process Kompose-generated chart to fix common issues.
+
+    Fixes:
+    1. Chart.yaml name, description and keywords
+    2. Add conditional wrappers to job templates (default: disabled)
+
+    TODO:
+    - Add defaultMode: 0755 to ConfigMap volumes containing scripts (.sh files)
+    """
+    yaml = get_yaml()
+
+    # Fix Chart.yaml
+    chart_yaml_path = chart_dir / "Chart.yaml"
+    if chart_yaml_path.exists():
+        chart_yaml = yaml.load(open(chart_yaml_path, "r"))
+
+        # Fix name
+        chart_yaml["name"] = chart_name
+
+        # Fix description
+        chart_yaml["description"] = f"Generated Helm chart for {chart_name} stack"
+
+        # Fix keywords
+        if "keywords" in chart_yaml and isinstance(chart_yaml["keywords"], list):
+            chart_yaml["keywords"] = [chart_name]
+
+        with open(chart_yaml_path, "w") as f:
+            yaml.dump(chart_yaml, f)
+
+    # Process job templates: wrap with conditionals (default disabled)
+    if jobs:
+        _wrap_job_templates_with_conditionals(chart_dir, jobs)
+
+
+def generate_helm_chart(stack_path: str, spec_file: str, deployment_dir_path: Path) -> None:
+    """
+    Generate a self-sufficient Helm chart from stack compose files using Kompose.
+
+    Args:
+        stack_path: Path to the stack directory
+        spec_file: Path to the deployment spec file
+        deployment_dir_path: Deployment directory path (already created with deployment.yml)
+
+    Output structure:
+        deployment-dir/
+        ├── deployment.yml  # Contains cluster-id
+        ├── spec.yml        # Reference
+        ├── stack.yml       # Reference
+        └── chart/          # Self-sufficient Helm chart
+            ├── Chart.yaml
+            ├── README.md
+            └── templates/
+                └── *.yaml
+
+    TODO: Enhancements:
+    - Convert Deployments to StatefulSets for stateful services (zenithd, postgres)
+    - Add _helpers.tpl with common label/selector functions
+    - Enhance Chart.yaml with proper metadata (version, description, etc.)
+    """
+
+    parsed_stack = get_parsed_stack_config(stack_path)
+    stack_name = parsed_stack.get("name", stack_path)
+
+    # 1. Check Kompose availability
+    if not check_kompose_available():
+        error_exit("kompose not found in PATH.\n")
+
+    # 2. Read cluster-id from deployment.yml
+    deployment_file = deployment_dir_path / constants.deployment_file_name
+    if not deployment_file.exists():
+        error_exit(f"Deployment file not found: {deployment_file}")
+
+    yaml = get_yaml()
+    deployment_config = yaml.load(open(deployment_file, "r"))
+    cluster_id = deployment_config.get(constants.cluster_id_key)
+    if not cluster_id:
+        error_exit(f"cluster-id not found in {deployment_file}")
+
+    # 3. Derive chart name from stack name + cluster-id suffix
+    # Sanitize stack name for use in chart name
+    sanitized_stack_name = stack_name.replace("_", "-").replace(" ", "-")
+
+    # Extract hex suffix from cluster-id (after the prefix)
+    # cluster-id format: "laconic-<hex>" -> extract the hex part
+    cluster_id_suffix = cluster_id.split("-", 1)[1] if "-" in cluster_id else cluster_id
+
+    # Combine to create human-readable + unique chart name
+    chart_name = f"{sanitized_stack_name}-{cluster_id_suffix}"
+
+    if opts.o.debug:
+        print(f"Cluster ID: {cluster_id}")
+        print(f"Chart name: {chart_name}")
+
+    # 4. Get compose files from stack (pods + jobs)
+    pods = get_pod_list(parsed_stack)
+    if not pods:
+        error_exit(f"No pods found in stack: {stack_path}")
+
+    jobs = get_job_list(parsed_stack)
+
+    if opts.o.debug:
+        print(f"Found {len(pods)} pod(s) in stack: {pods}")
+        if jobs:
+            print(f"Found {len(jobs)} job(s) in stack: {jobs}")
+
+    compose_files = []
+    for pod in pods:
+        pod_file = get_pod_file_path(stack_path, parsed_stack, pod)
+        if not pod_file.exists():
+            error_exit(f"Pod file not found: {pod_file}")
+        compose_files.append(pod_file)
+        if opts.o.debug:
+            print(f"Found compose file: {pod_file.name}")
+
+    # Add job compose files
+    job_files = []
+    for job in jobs:
+        job_file = get_job_file_path(stack_path, parsed_stack, job)
+        if not job_file.exists():
+            error_exit(f"Job file not found: {job_file}")
+        compose_files.append(job_file)
+        job_files.append(job_file)
+        if opts.o.debug:
+            print(f"Found job compose file: {job_file.name}")
+
+    try:
+        version = get_kompose_version()
+        print(f"Using kompose version: {version}")
+    except Exception as e:
+        error_exit(f"Failed to get kompose version: {e}")
+
+    # 5. Create chart directory and invoke Kompose
+    chart_dir = deployment_dir_path / "chart"
+
+    print(f"Converting {len(compose_files)} compose file(s) to Helm chart using Kompose...")
+
+    try:
+        output = convert_to_helm_chart(
+            compose_files=compose_files,
+            output_dir=chart_dir,
+            chart_name=chart_name
+        )
+        if opts.o.debug:
+            print(f"Kompose output:\n{output}")
+    except Exception as e:
+        error_exit(f"Helm chart generation failed: {e}")
+
+    # 6. Post-process generated chart
+    _post_process_chart(chart_dir, chart_name, jobs)
+
+    # 7. Generate README.md with basic installation instructions
+    readme_content = f"""# {chart_name} Helm Chart
+
+Generated by laconic-so from stack: `{stack_path}`
+
+## Prerequisites
+
+- Kubernetes cluster (v1.27+)
+- Helm (v3.12+)
+- kubectl configured to access your cluster
+
+## Installation
+
+```bash
+# Install the chart
+helm install {chart_name} {chart_dir}
+
+# Alternatively, install with your own release name
+# helm install <your-release-name> {chart_dir}
+
+# Check deployment status
+kubectl get pods
+```
+
+## Upgrade
+
+To apply changes made to chart, perform upgrade:
+
+```bash
+helm upgrade {chart_name} {chart_dir}
+```
+
+## Uninstallation
+
+```bash
+helm uninstall {chart_name}
+```
+
+## Configuration
+
+The chart was generated from Docker Compose files using Kompose.
+
+### Customization
+
+Edit the generated template files in `templates/` to customize:
+- Image repositories and tags
+- Resource limits (CPU, memory)
+- Persistent volume sizes
+- Replica counts
+"""
+
+    readme_path = chart_dir / "README.md"
+    readme_path.write_text(readme_content)
+
+    if opts.o.debug:
+        print(f"Generated README: {readme_path}")
+
+    # 7. Success message
+    print(f"\n{'=' * 60}")
+    print("✓ Helm chart generated successfully!")
+    print(f"{'=' * 60}")
+    print("\nChart details:")
+    print(f"  Name:     {chart_name}")
+    print(f"  Location: {chart_dir.absolute()}")
+    print(f"  Stack:    {stack_path}")
+
+    # Count generated files
+    template_files = list((chart_dir / "templates").glob("*.yaml")) if (chart_dir / "templates").exists() else []
+    print(f"  Files:    {len(template_files)} template(s) generated")
+
+    print("\nDeployment directory structure:")
+    print(f"  {deployment_dir_path}/")
+    print("  ├── deployment.yml  (cluster-id)")
+    print("  ├── spec.yml        (reference)")
+    print("  ├── stack.yml       (reference)")
+    print("  └── chart/          (self-sufficient Helm chart)")
+
+    print("\nNext steps:")
+    print("  1. Review the chart:")
+    print(f"     cd {chart_dir}")
+    print("     cat Chart.yaml")
+    print("")
+    print("  2. Review generated templates:")
+    print("     ls templates/")
+    print("")
+    print("  3. Install to Kubernetes:")
+    print(f"     helm install {chart_name} {chart_dir}")
+    print("")
+    print("     # Or use your own release name")
+    print(f"     helm install <your-release-name> {chart_dir}")
+    print("")
+    print("  4. Check deployment:")
+    print("     kubectl get pods")
+    print("")

stack_orchestrator/deploy/k8s/helm/job_runner.py

@@ -0,0 +1,149 @@
+# Copyright © 2025 Vulcanize
+
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http:#www.gnu.org/licenses/>.
+
+import subprocess
+import tempfile
+import os
+import json
+from pathlib import Path
+from stack_orchestrator.util import get_yaml
+
+
+def get_release_name_from_chart(chart_dir: Path) -> str:
+    """
+    Read the chart name from Chart.yaml to use as the release name.
+
+    Args:
+        chart_dir: Path to the Helm chart directory
+
+    Returns:
+        Chart name from Chart.yaml
+
+    Raises:
+        Exception if Chart.yaml not found or name is missing
+    """
+    chart_yaml_path = chart_dir / "Chart.yaml"
+    if not chart_yaml_path.exists():
+        raise Exception(f"Chart.yaml not found: {chart_yaml_path}")
+
+    yaml = get_yaml()
+    chart_yaml = yaml.load(open(chart_yaml_path, "r"))
+
+    if "name" not in chart_yaml:
+        raise Exception(f"Chart name not found in {chart_yaml_path}")
+
+    return chart_yaml["name"]
+
+
+def run_helm_job(
+    chart_dir: Path,
+    job_name: str,
+    release: str = None,
+    namespace: str = "default",
+    timeout: int = 600,
+    verbose: bool = False
+) -> None:
+    """
+    Run a one-time job from a Helm chart.
+
+    This function:
+    1. Uses provided release name, or reads it from Chart.yaml if not provided
+    2. Uses helm template to render the job manifest with the job enabled
+    3. Applies the job manifest to the cluster
+    4. Waits for the job to complete
+
+    Args:
+        chart_dir: Path to the Helm chart directory
+        job_name: Name of the job to run (without -job suffix)
+        release: Optional Helm release name (defaults to chart name from Chart.yaml)
+        namespace: Kubernetes namespace
+        timeout: Timeout in seconds for job completion (default: 600)
+        verbose: Enable verbose output
+
+    Raises:
+        Exception if the job fails or times out
+    """
+    if not chart_dir.exists():
+        raise Exception(f"Chart directory not found: {chart_dir}")
+
+    # Use provided release name, or get it from Chart.yaml
+    if release is None:
+        release = get_release_name_from_chart(chart_dir)
+        if verbose:
+            print(f"Using release name from Chart.yaml: {release}")
+    else:
+        if verbose:
+            print(f"Using provided release name: {release}")
+
+    job_template_file = f"templates/{job_name}-job.yaml"
+
+    if verbose:
+        print(f"Running job '{job_name}' from helm chart: {chart_dir}")
+
+    # Use helm template to render the job manifest
+    with tempfile.NamedTemporaryFile(mode='w', suffix='.yaml', delete=False) as tmp_file:
+        try:
+            # Render job template with job enabled
+            # Use --set-json to properly handle job names with dashes
+            jobs_dict = {job_name: {"enabled": True}}
+            values_json = json.dumps(jobs_dict)
+            helm_cmd = [
+                "helm", "template", release, str(chart_dir),
+                "--show-only", job_template_file,
+                "--set-json", f"jobs={values_json}"
+            ]
+
+            if verbose:
+                print(f"Running: {' '.join(helm_cmd)}")
+
+            result = subprocess.run(helm_cmd, check=True, capture_output=True, text=True)
+            tmp_file.write(result.stdout)
+            tmp_file.flush()
+
+            if verbose:
+                print(f"Generated job manifest:\n{result.stdout}")
+
+            # Parse the manifest to get the actual job name
+            yaml = get_yaml()
+            manifest = yaml.load(result.stdout)
+            actual_job_name = manifest.get("metadata", {}).get("name", job_name)
+
+            # Apply the job manifest
+            kubectl_apply_cmd = ["kubectl", "apply", "-f", tmp_file.name, "-n", namespace]
+            subprocess.run(kubectl_apply_cmd, check=True, capture_output=True, text=True)
+
+            if verbose:
+                print(f"Job {actual_job_name} created, waiting for completion...")
+
+            # Wait for job completion
+            wait_cmd = [
+                "kubectl", "wait", "--for=condition=complete",
+                f"job/{actual_job_name}",
+                f"--timeout={timeout}s",
+                "-n", namespace
+            ]
+
+            subprocess.run(wait_cmd, check=True, capture_output=True, text=True)
+
+            if verbose:
+                print(f"Job {job_name} completed successfully")
+
+        except subprocess.CalledProcessError as e:
+            error_msg = e.stderr if e.stderr else str(e)
+            raise Exception(f"Job failed: {error_msg}")
+        finally:
+            # Clean up temp file
+            if os.path.exists(tmp_file.name):
+                os.unlink(tmp_file.name)

stack_orchestrator/deploy/k8s/helm/kompose_wrapper.py

@@ -0,0 +1,109 @@
+# Copyright © 2025 Vulcanize
+
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http:#www.gnu.org/licenses/>.
+
+import subprocess
+import shutil
+from pathlib import Path
+from typing import List
+
+
+def check_kompose_available() -> bool:
+    """Check if kompose binary is available in PATH."""
+    return shutil.which("kompose") is not None
+
+
+def get_kompose_version() -> str:
+    """
+    Get the installed kompose version.
+
+    Returns:
+        Version string (e.g., "1.34.0")
+
+    Raises:
+        Exception if kompose is not available
+    """
+    if not check_kompose_available():
+        raise Exception("kompose not found in PATH")
+
+    result = subprocess.run(
+        ["kompose", "version"],
+        capture_output=True,
+        text=True,
+        timeout=10
+    )
+
+    if result.returncode != 0:
+        raise Exception(f"Failed to get kompose version: {result.stderr}")
+
+    # Parse version from output like "1.34.0 (HEAD)"
+    # Output format: "1.34.0 (HEAD)" or just "1.34.0"
+    version_line = result.stdout.strip()
+    version = version_line.split()[0] if version_line else "unknown"
+
+    return version
+
+
+def convert_to_helm_chart(compose_files: List[Path], output_dir: Path, chart_name: str = None) -> str:
+    """
+    Invoke kompose to convert Docker Compose files to a Helm chart.
+
+    Args:
+        compose_files: List of paths to docker-compose.yml files
+        output_dir: Directory where the Helm chart will be generated
+        chart_name: Optional name for the chart (defaults to directory name)
+
+    Returns:
+        stdout from kompose command
+
+    Raises:
+        Exception if kompose conversion fails
+    """
+    if not check_kompose_available():
+        raise Exception(
+            "kompose not found in PATH. "
+            "Install from: https://kompose.io/installation/"
+        )
+
+    # Ensure output directory exists
+    output_dir.mkdir(parents=True, exist_ok=True)
+
+    # Build kompose command
+    cmd = ["kompose", "convert"]
+
+    # Add all compose files
+    for compose_file in compose_files:
+        if not compose_file.exists():
+            raise Exception(f"Compose file not found: {compose_file}")
+        cmd.extend(["-f", str(compose_file)])
+
+    # Add chart flag and output directory
+    cmd.extend(["--chart", "-o", str(output_dir)])
+
+    # Execute kompose
+    result = subprocess.run(
+        cmd,
+        capture_output=True,
+        text=True,
+        timeout=60
+    )
+
+    if result.returncode != 0:
+        raise Exception(
+            f"Kompose conversion failed:\n"
+            f"Command: {' '.join(cmd)}\n"
+            f"Error: {result.stderr}"
+        )
+
+    return result.stdout

stack_orchestrator/deploy/spec.py

@@ -92,9 +92,8 @@ class Spec:
         return self.obj.get(item, default)
 
     def init_from_file(self, file_path: Path):
-        with file_path:
-            self.obj = get_yaml().load(open(file_path, "r"))
-            self.file_path = file_path
+        self.obj = get_yaml().load(open(file_path, "r"))
+        self.file_path = file_path
 
     def get_image_registry(self):
         return self.obj.get(constants.image_registry_key)

stack_orchestrator/deploy/stack.py

@@ -27,5 +27,4 @@ class Stack:
         self.name = name
 
     def init_from_file(self, file_path: Path):
-        with file_path:
-            self.obj = get_yaml().load(open(file_path, "r"))
+        self.obj = get_yaml().load(open(file_path, "r"))

stack_orchestrator/deploy/webapp/deploy_webapp.py

@@ -91,6 +91,7 @@ def create_deployment(ctx, deployment_dir, image, url, kube_config, image_regist
         deploy_command_context,
         spec_file_name,
         deployment_dir,
+        False,
         None,
         None
     )

stack_orchestrator/deploy/webapp/deploy_webapp_from_registry.py

@@ -33,6 +33,7 @@ from stack_orchestrator.deploy.webapp.util import (
     LaconicRegistryClient,
     TimedLogger,
     build_container_image,
+    confirm_auction,
     push_container_image,
     file_hash,
     deploy_to_k8s,
@@ -42,6 +43,7 @@ from stack_orchestrator.deploy.webapp.util import (
     match_owner,
     skip_by_tag,
     confirm_payment,
+    load_known_requests,
 )
 
 
@@ -52,6 +54,7 @@ def process_app_deployment_request(
     deployment_record_namespace,
     dns_record_namespace,
     default_dns_suffix,
+    dns_value,
     deployment_parent_dir,
     kube_config,
     image_registry,
@@ -249,6 +252,7 @@ def process_app_deployment_request(
         dns_record,
         dns_lrn,
         deployment_dir,
+        dns_value,
         app_deployment_request,
         webapp_deployer_record,
         logger,
@@ -257,12 +261,6 @@ def process_app_deployment_request(
     logger.log("END - process_app_deployment_request")
 
 
-def load_known_requests(filename):
-    if filename and os.path.exists(filename):
-        return json.load(open(filename, "r"))
-    return {}
-
-
 def dump_known_requests(filename, requests, status="SEEN"):
     if not filename:
         return
@@ -308,6 +306,7 @@ def dump_known_requests(filename, requests, status="SEEN"):
     help="How to handle requests with an FQDN: prohibit, allow, preexisting",
     default="prohibit",
 )
+@click.option("--ip", help="IP address of the k8s deployment (to be set in DNS record)", default=None)
 @click.option("--record-namespace-dns", help="eg, lrn://laconic/dns", required=True)
 @click.option(
     "--record-namespace-deployments",
@@ -350,6 +349,12 @@ def dump_known_requests(filename, requests, status="SEEN"):
     "my payment address are examined).",
     is_flag=True,
 )
+@click.option(
+    "--auction-requests",
+    help="Handle requests with auction id set (skips payment confirmation).",
+    is_flag=True,
+    default=False,
+)
 @click.option(
     "--config-upload-dir",
     help="The directory containing uploaded config.",
@@ -358,6 +363,9 @@ def dump_known_requests(filename, requests, status="SEEN"):
 @click.option(
     "--private-key-file", help="The private key for decrypting config.", required=True
 )
+@click.option(
+    "--registry-lock-file", help="File path to use for registry mutex lock", default=None
+)
 @click.option(
     "--private-key-passphrase",
     help="The passphrase for the private key.",
@@ -376,6 +384,7 @@ def command(  # noqa: C901
     only_update_state,
     dns_suffix,
     fqdn_policy,
+    ip,
     record_namespace_dns,
     record_namespace_deployments,
     dry_run,
@@ -390,6 +399,8 @@ def command(  # noqa: C901
     private_key_file,
     private_key_passphrase,
     all_requests,
+    auction_requests,
+    registry_lock_file,
 ):
     if request_id and discover:
         print("Cannot specify both --request-id and --discover", file=sys.stderr)
@@ -422,6 +433,13 @@ def command(  # noqa: C901
         )
         sys.exit(2)
 
+    if fqdn_policy == "allow" and not ip:
+        print(
+            "--ip is required with 'allow' fqdn-policy",
+            file=sys.stderr,
+        )
+        sys.exit(2)
+
     tempdir = tempfile.mkdtemp()
     gpg = gnupg.GPG(gnupghome=tempdir)
 
@@ -441,7 +459,7 @@ def command(  # noqa: C901
         include_tags = [tag.strip() for tag in include_tags.split(",") if tag]
         exclude_tags = [tag.strip() for tag in exclude_tags.split(",") if tag]
 
-        laconic = LaconicRegistryClient(laconic_config, log_file=sys.stderr)
+        laconic = LaconicRegistryClient(laconic_config, log_file=sys.stderr, mutex_lock_file=registry_lock_file)
         webapp_deployer_record = laconic.get_record(lrn, require=True)
         payment_address = webapp_deployer_record.attributes.paymentAddress
         main_logger.log(f"Payment address: {payment_address}")
@@ -582,8 +600,29 @@ def command(  # noqa: C901
                     requests_to_check_for_payment.append(r)
 
         requests_to_execute = []
-        if min_required_payment:
-            for r in requests_to_check_for_payment:
+        for r in requests_to_check_for_payment:
+            if r.attributes.auction:
+                if auction_requests:
+                    if confirm_auction(
+                        laconic,
+                        r,
+                        lrn,
+                        payment_address,
+                        main_logger
+                    ):
+                        main_logger.log(f"{r.id}: Auction confirmed.")
+                        requests_to_execute.append(r)
+                    else:
+                        main_logger.log(
+                            f"Skipping request {r.id}: unable to verify auction."
+                        )
+                        dump_known_requests(state_file, [r], status="SKIP")
+                else:
+                    main_logger.log(
+                        f"Skipping request {r.id}: not handling requests with auction."
+                    )
+                    dump_known_requests(state_file, [r], status="SKIP")
+            elif min_required_payment:
                 main_logger.log(f"{r.id}: Confirming payment...")
                 if confirm_payment(
                     laconic,
@@ -599,8 +638,8 @@ def command(  # noqa: C901
                         f"Skipping request {r.id}: unable to verify payment."
                     )
                     dump_known_requests(state_file, [r], status="UNPAID")
-        else:
-            requests_to_execute = requests_to_check_for_payment
+            else:
+                requests_to_execute.append(r)
 
         main_logger.log(
             "Found %d unsatisfied request(s) to process." % len(requests_to_execute)
@@ -625,7 +664,7 @@ def command(  # noqa: C901
                         )
                         run_log_file = open(run_log_file_path, "wt")
                         run_reg_client = LaconicRegistryClient(
-                            laconic_config, log_file=run_log_file
+                            laconic_config, log_file=run_log_file, mutex_lock_file=registry_lock_file
                         )
 
                     build_logger = TimedLogger(run_id, run_log_file)
@@ -637,6 +676,7 @@ def command(  # noqa: C901
                         record_namespace_deployments,
                         record_namespace_dns,
                         dns_suffix,
+                        ip,
                         os.path.abspath(deployment_parent_dir),
                         kube_config,
                         image_registry,

stack_orchestrator/deploy/webapp/handle_deployment_auction.py

@@ -0,0 +1,220 @@
+# Copyright ©2023 Vulcanize
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http:#www.gnu.org/licenses/>.
+
+import sys
+import json
+
+import click
+
+from stack_orchestrator.deploy.webapp.util import (
+    AttrDict,
+    LaconicRegistryClient,
+    TimedLogger,
+    load_known_requests,
+    AUCTION_KIND_PROVIDER,
+    AuctionStatus,
+)
+
+
+def process_app_deployment_auction(
+    ctx,
+    laconic: LaconicRegistryClient,
+    request,
+    current_status,
+    reveal_file_path,
+    bid_amount,
+    logger,
+):
+    # Fetch auction details
+    auction_id = request.attributes.auction
+    auction = laconic.get_auction(auction_id)
+    if not auction:
+        raise Exception(f"Unable to locate auction: {auction_id}")
+
+    # Check auction kind
+    if auction.kind != AUCTION_KIND_PROVIDER:
+        raise Exception(f"Auction kind needs to be ${AUCTION_KIND_PROVIDER}, got {auction.kind}")
+
+    if current_status == "PENDING":
+        # Skip if pending auction not in commit state
+        if auction.status != AuctionStatus.COMMIT:
+            logger.log(f"Skipping pending request, auction {auction_id} status: {auction.status}")
+            return "SKIP", ""
+
+        # Check max_price
+        bid_amount_int = int(bid_amount)
+        max_price_int = int(auction.maxPrice.quantity)
+        if max_price_int < bid_amount_int:
+            logger.log(f"Skipping auction {auction_id} with max_price ({max_price_int}) less than bid_amount ({bid_amount_int})")
+            return "SKIP", ""
+
+        # Bid on the auction
+        reveal_file_path = laconic.commit_bid(auction_id, bid_amount_int)
+        logger.log(f"Commited bid on auction {auction_id} with amount {bid_amount_int}")
+
+        return "COMMIT", reveal_file_path
+
+    if current_status == "COMMIT":
+        # Return if auction still in commit state
+        if auction.status == AuctionStatus.COMMIT:
+            logger.log(f"Auction {auction_id} status: {auction.status}")
+            return current_status, reveal_file_path
+
+        # Reveal bid
+        if auction.status == AuctionStatus.REVEAL:
+            laconic.reveal_bid(auction_id, reveal_file_path)
+            logger.log(f"Revealed bid on auction {auction_id}")
+
+            return "REVEAL", reveal_file_path
+
+        raise Exception(f"Unexpected auction {auction_id} status: {auction.status}")
+
+    if current_status == "REVEAL":
+        # Return if auction still in reveal state
+        if auction.status == AuctionStatus.REVEAL:
+            logger.log(f"Auction {auction_id} status: {auction.status}")
+            return current_status, reveal_file_path
+
+        # Return if auction is completed
+        if auction.status == AuctionStatus.COMPLETED:
+            logger.log(f"Auction {auction_id} completed")
+            return "COMPLETED", ""
+
+        raise Exception(f"Unexpected auction {auction_id} status: {auction.status}")
+
+    raise Exception(f"Got request with unexpected status: {current_status}")
+
+
+def dump_known_auction_requests(filename, requests, status="SEEN"):
+    if not filename:
+        return
+    known_requests = load_known_requests(filename)
+    for r in requests:
+        known_requests[r.id] = {"revealFile": r.revealFile, "status": status}
+    with open(filename, "w") as f:
+        json.dump(known_requests, f)
+
+
+@click.command()
+@click.option(
+    "--laconic-config", help="Provide a config file for laconicd", required=True
+)
+@click.option(
+    "--state-file",
+    help="File to store state about previously seen auction requests.",
+    required=True,
+)
+@click.option(
+    "--bid-amount",
+    help="Bid to place on application deployment auctions (in alnt)",
+    required=True,
+)
+@click.option(
+    "--registry-lock-file", help="File path to use for registry mutex lock", default=None
+)
+@click.option(
+    "--dry-run", help="Don't do anything, just report what would be done.", is_flag=True
+)
+@click.pass_context
+def command(
+    ctx,
+    laconic_config,
+    state_file,
+    bid_amount,
+    registry_lock_file,
+    dry_run,
+):
+    if int(bid_amount) < 0:
+        print("--bid-amount cannot be less than 0", file=sys.stderr)
+        sys.exit(2)
+
+    logger = TimedLogger(file=sys.stderr)
+
+    try:
+        laconic = LaconicRegistryClient(laconic_config, log_file=sys.stderr, mutex_lock_file=registry_lock_file)
+        auctions_requests = laconic.app_deployment_auctions()
+
+        previous_requests = {}
+        logger.log(f"Loading known auctions from {state_file}...")
+        previous_requests = load_known_requests(state_file)
+
+        # Process new requests first
+        auctions_requests.sort(key=lambda r: r.createTime)
+        auctions_requests.reverse()
+
+        requests_to_execute = []
+
+        for r in auctions_requests:
+            logger.log(f"BEGIN: Examining request {r.id}")
+            result_status = "PENDING"
+            reveal_file_path = ""
+            try:
+                application = r.attributes.application
+
+                # Handle already seen requests
+                if r.id in previous_requests:
+                    # If it's not in commit or reveal status, skip the request as we've already seen it
+                    current_status = previous_requests[r.id].get("status", "")
+                    result_status = current_status
+                    if current_status not in ["COMMIT", "REVEAL"]:
+                        logger.log(f"Skipping request {r.id}, we've already seen it.")
+                        continue
+
+                    reveal_file_path = previous_requests[r.id].get("revealFile", "")
+                    logger.log(f"Found existing auction request {r.id} for application {application}, status {current_status}.")
+                else:
+                    # It's a fresh request, check application record
+                    app = laconic.get_record(application)
+                    if not app:
+                        logger.log(f"Skipping request {r.id}, cannot locate app.")
+                        result_status = "ERROR"
+                        continue
+
+                    logger.log(f"Found pending auction request {r.id} for application {application}.")
+
+                # Add requests to be processed
+                requests_to_execute.append((r, result_status, reveal_file_path))
+
+            except Exception as e:
+                result_status = "ERROR"
+                logger.log(f"ERROR: examining request {r.id}: " + str(e))
+            finally:
+                logger.log(f"DONE: Examining request {r.id} with result {result_status}.")
+                if result_status in ["ERROR"]:
+                    dump_known_auction_requests(state_file, [AttrDict({"id": r.id, "revealFile": reveal_file_path})], result_status)
+
+        logger.log(f"Found {len(requests_to_execute)} request(s) to process.")
+
+        if not dry_run:
+            for r, current_status, reveal_file_path in requests_to_execute:
+                logger.log(f"Processing {r.id}: BEGIN")
+                result_status = "ERROR"
+                try:
+                    result_status, reveal_file_path = process_app_deployment_auction(
+                        ctx,
+                        laconic,
+                        r,
+                        current_status,
+                        reveal_file_path,
+                        bid_amount,
+                        logger,
+                    )
+                except Exception as e:
+                    logger.log(f"ERROR {r.id}:" + str(e))
+                finally:
+                    logger.log(f"Processing {r.id}: END - {result_status}")
+                    dump_known_auction_requests(state_file, [AttrDict({"id": r.id, "revealFile": reveal_file_path})], result_status)
+    except Exception as e:
+        logger.log("UNCAUGHT ERROR:" + str(e))
+        raise e

stack_orchestrator/deploy/webapp/publish_deployment_auction.py

@@ -0,0 +1,124 @@
+# Copyright ©2023 Vulcanize
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http:#www.gnu.org/licenses/>.
+
+import sys
+
+import click
+import yaml
+
+from stack_orchestrator.deploy.webapp.util import (
+    AUCTION_KIND_PROVIDER,
+    TOKEN_DENOM,
+    LaconicRegistryClient,
+)
+
+
+def fatal(msg: str):
+    print(msg, file=sys.stderr)
+    sys.exit(1)
+
+
+@click.command()
+@click.option(
+    "--laconic-config", help="Provide a config file for laconicd", required=True
+)
+@click.option(
+    "--app",
+    help="The LRN of the application to deploy.",
+    required=True,
+)
+@click.option(
+    "--commits-duration",
+    help="Auction commits duration (in seconds) (default: 600).",
+    default=600,
+)
+@click.option(
+    "--reveals-duration",
+    help="Auction reveals duration (in seconds) (default: 600).",
+    default=600,
+)
+@click.option(
+    "--commit-fee",
+    help="Auction bid commit fee (in alnt) (default: 100000).",
+    default=100000,
+)
+@click.option(
+    "--reveal-fee",
+    help="Auction bid reveal fee (in alnt) (default: 100000).",
+    default=100000,
+)
+@click.option(
+    "--max-price",
+    help="Max acceptable bid price (in alnt).",
+    required=True,
+)
+@click.option(
+    "--num-providers",
+    help="Max acceptable bid price (in alnt).",
+    required=True,
+)
+@click.option(
+    "--dry-run",
+    help="Don't publish anything, just report what would be done.",
+    is_flag=True,
+)
+@click.pass_context
+def command(
+    ctx,
+    laconic_config,
+    app,
+    commits_duration,
+    reveals_duration,
+    commit_fee,
+    reveal_fee,
+    max_price,
+    num_providers,
+    dry_run,
+):
+    laconic = LaconicRegistryClient(laconic_config)
+
+    app_record = laconic.get_record(app)
+    if not app_record:
+        fatal(f"Unable to locate app: {app}")
+
+    provider_auction_params = {
+        "kind": AUCTION_KIND_PROVIDER,
+        "commits_duration": commits_duration,
+        "reveals_duration": reveals_duration,
+        "denom": TOKEN_DENOM,
+        "commit_fee": commit_fee,
+        "reveal_fee": reveal_fee,
+        "max_price": max_price,
+        "num_providers": num_providers,
+    }
+    auction_id = laconic.create_deployment_auction(provider_auction_params)
+    print("Deployment auction created:", auction_id)
+
+    if not auction_id:
+        fatal("Unable to create a provider auction")
+
+    deployment_auction = {
+        "record": {
+            "type": "ApplicationDeploymentAuction",
+            "application": app,
+            "auction": auction_id,
+        }
+    }
+
+    if dry_run:
+        print(yaml.dump(deployment_auction))
+        return
+
+    # Publish the deployment auction record
+    laconic.publish(deployment_auction)

stack_orchestrator/deploy/webapp/registry_mutex.py

@@ -0,0 +1,77 @@
+from functools import wraps
+import os
+import time
+
+# Define default file path for the lock
+DEFAULT_LOCK_FILE_PATH = "/tmp/registry_mutex_lock_file"
+LOCK_TIMEOUT = 30
+LOCK_RETRY_INTERVAL = 3
+
+
+def acquire_lock(client, lock_file_path, timeout):
+    # Lock alreay acquired by the current client
+    if client.mutex_lock_acquired:
+        return
+
+    while True:
+        try:
+            # Check if lock file exists and is potentially stale
+            if os.path.exists(lock_file_path):
+                with open(lock_file_path, 'r') as lock_file:
+                    timestamp = float(lock_file.read().strip())
+
+                # If lock is stale, remove the lock file
+                if time.time() - timestamp > timeout:
+                    print(f"Stale lock detected, removing lock file {lock_file_path}")
+                    os.remove(lock_file_path)
+                else:
+                    print(f"Lock file {lock_file_path} exists and is recent, waiting...")
+                    time.sleep(LOCK_RETRY_INTERVAL)
+                    continue
+
+            # Try to create a new lock file with the current timestamp
+            fd = os.open(lock_file_path, os.O_CREAT | os.O_EXCL | os.O_RDWR)
+            with os.fdopen(fd, 'w') as lock_file:
+                lock_file.write(str(time.time()))
+
+            client.mutex_lock_acquired = True
+            print(f"Registry lock acquired, {lock_file_path}")
+
+            # Lock successfully acquired
+            return
+
+        except FileExistsError:
+            print(f"Lock file {lock_file_path} exists, waiting...")
+            time.sleep(LOCK_RETRY_INTERVAL)
+
+
+def release_lock(client, lock_file_path):
+    try:
+        os.remove(lock_file_path)
+
+        client.mutex_lock_acquired = False
+        print(f"Registry lock released, {lock_file_path}")
+    except FileNotFoundError:
+        # Lock file already removed
+        pass
+
+
+def registry_mutex():
+    def decorator(func):
+        @wraps(func)
+        def wrapper(self, *args, **kwargs):
+            lock_file_path = DEFAULT_LOCK_FILE_PATH
+            if self.mutex_lock_file:
+                lock_file_path = self.mutex_lock_file
+
+            # Acquire the lock before running the function
+            acquire_lock(self, lock_file_path, LOCK_TIMEOUT)
+            try:
+                return func(self, *args, **kwargs)
+            finally:
+                # Release the lock after the function completes
+                release_lock(self, lock_file_path)
+
+        return wrapper
+
+    return decorator

stack_orchestrator/deploy/webapp/request_webapp_deployment.py

@@ -3,7 +3,6 @@
 # it under the terms of the GNU Affero General Public License as published by
 # the Free Software Foundation, either version 3 of the License, or
 # (at your option) any later version.
-import base64
 
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ -17,6 +16,7 @@ import shutil
 import sys
 import tempfile
 from datetime import datetime
+import base64
 
 import gnupg
 import click
@@ -24,6 +24,8 @@ import requests
 import yaml
 
 from stack_orchestrator.deploy.webapp.util import (
+    AUCTION_KIND_PROVIDER,
+    AuctionStatus,
     LaconicRegistryClient,
 )
 from dotenv import dotenv_values
@@ -43,10 +45,13 @@ def fatal(msg: str):
     help="The LRN of the application to deploy.",
     required=True,
 )
+@click.option(
+    "--auction-id",
+    help="Deployment auction id. Can be used instead of deployer and payment.",
+)
 @click.option(
     "--deployer",
     help="The LRN of the deployer to process this request.",
-    required=True,
 )
 @click.option("--env-file", help="environment file for webapp")
 @click.option("--config-ref", help="The ref of an existing config upload to use.")
@@ -64,10 +69,11 @@ def fatal(msg: str):
     is_flag=True,
 )
 @click.pass_context
-def command(
+def command(  # noqa: C901
     ctx,
     laconic_config,
     app,
+    auction_id,
     deployer,
     env_file,
     config_ref,
@@ -75,58 +81,135 @@ def command(
     use_payment,
     dns,
     dry_run,
-):  # noqa: C901
-    tempdir = tempfile.mkdtemp()
-    try:
-        laconic = LaconicRegistryClient(laconic_config)
+):
+    if auction_id and deployer:
+        print("Cannot specify both --auction-id and --deployer", file=sys.stderr)
+        sys.exit(2)
 
-        app_record = laconic.get_record(app)
-        if not app_record:
-            fatal(f"Unable to locate app: {app}")
+    if not auction_id and not deployer:
+        print("Must specify either --auction-id or --deployer", file=sys.stderr)
+        sys.exit(2)
 
+    if auction_id and (make_payment or use_payment):
+        print("Cannot specify --auction-id with --make-payment or --use-payment", file=sys.stderr)
+        sys.exit(2)
+
+    if env_file and config_ref:
+        fatal("Cannot use --env-file and --config-ref at the same time.")
+
+    laconic = LaconicRegistryClient(laconic_config)
+
+    app_record = laconic.get_record(app)
+    if not app_record:
+        fatal(f"Unable to locate app: {app}")
+
+    # Deployers to send requests to
+    deployer_records = []
+
+    auction = None
+    auction_winners = None
+    if auction_id:
+        # Fetch auction record for given auction
+        auction_records_by_id = laconic.app_deployment_auctions({"auction": auction_id})
+        if len(auction_records_by_id) == 0:
+            fatal(f"Unable to locate record for auction: {auction_id}")
+
+        # Cross check app against application in the auction record
+        auction_app = auction_records_by_id[0].attributes.application
+        if auction_app != app:
+            fatal(f"Requested application {app} does not match application from auction record {auction_app}")
+
+        # Fetch auction details
+        auction = laconic.get_auction(auction_id)
+        if not auction:
+            fatal(f"Unable to locate auction: {auction_id}")
+
+        # Check auction owner
+        if auction.ownerAddress != laconic.whoami().address:
+            fatal(f"Auction {auction_id} owner mismatch")
+
+        # Check auction kind
+        if auction.kind != AUCTION_KIND_PROVIDER:
+            fatal(f"Auction kind needs to be ${AUCTION_KIND_PROVIDER}, got {auction.kind}")
+
+        # Check auction status
+        if auction.status != AuctionStatus.COMPLETED:
+            fatal(f"Auction {auction_id} not completed yet, status {auction.status}")
+
+        # Check that winner list is not empty
+        if len(auction.winnerAddresses) == 0:
+            fatal(f"Auction {auction_id} has no winners")
+
+        auction_winners = auction.winnerAddresses
+
+        # Get deployer record for all the auction winners
+        for auction_winner in auction_winners:
+            # TODO: Match auction winner address with provider address?
+            deployer_records_by_owner = laconic.webapp_deployers({"paymentAddress": auction_winner})
+            if len(deployer_records_by_owner) == 0:
+                print(f"WARNING: Unable to locate deployer for auction winner {auction_winner}")
+
+            # Take first record with name set
+            target_deployer_record = deployer_records_by_owner[0]
+            for r in deployer_records_by_owner:
+                if len(r.names) > 0:
+                    target_deployer_record = r
+                    break
+            deployer_records.append(target_deployer_record)
+    else:
         deployer_record = laconic.get_record(deployer)
         if not deployer_record:
             fatal(f"Unable to locate deployer: {deployer}")
 
-        if env_file and config_ref:
-            fatal("Cannot use --env-file and --config-ref at the same time.")
+        deployer_records.append(deployer_record)
 
-        # If env_file
+    # Create and send request to each deployer
+    deployment_requests = []
+    for deployer_record in deployer_records:
+        # Upload config to deployers if env_file is passed
         if env_file:
-            gpg = gnupg.GPG(gnupghome=tempdir)
+            tempdir = tempfile.mkdtemp()
+            try:
+                gpg = gnupg.GPG(gnupghome=tempdir)
 
-            # Import the deployer's public key
-            result = gpg.import_keys(
-                base64.b64decode(deployer_record.attributes.publicKey)
-            )
-            if 1 != result.imported:
-                fatal("Failed to import deployer's public key.")
+                # Import the deployer's public key
+                result = gpg.import_keys(
+                    base64.b64decode(deployer_record.attributes.publicKey)
+                )
+                if 1 != result.imported:
+                    fatal("Failed to import deployer's public key.")
 
-            recip = gpg.list_keys()[0]["uids"][0]
+                recip = gpg.list_keys()[0]["uids"][0]
 
-            # Wrap the config
-            config = {
-                # Include account (and payment?) details
-                "authorized": [laconic.whoami().address],
-                "config": {"env": dict(dotenv_values(env_file))},
-            }
-            serialized = yaml.dump(config)
+                # Wrap the config
+                config = {
+                    # Include account (and payment?) details
+                    "authorized": [laconic.whoami().address],
+                    "config": {"env": dict(dotenv_values(env_file))},
+                }
+                serialized = yaml.dump(config)
 
-            # Encrypt
-            result = gpg.encrypt(serialized, recip, always_trust=True, armor=False)
-            if not result.ok:
-                fatal("Failed to encrypt config.")
+                # Encrypt
+                result = gpg.encrypt(serialized, recip, always_trust=True, armor=False)
+                if not result.ok:
+                    fatal("Failed to encrypt config.")
 
-            # Upload it to the deployer's API
-            response = requests.post(
-                f"{deployer_record.attributes.apiUrl}/upload/config",
-                data=result.data,
-                headers={"Content-Type": "application/octet-stream"},
-            )
-            if not response.ok:
-                response.raise_for_status()
+                # Upload it to the deployer's API
+                response = requests.post(
+                    f"{deployer_record.attributes.apiUrl}/upload/config",
+                    data=result.data,
+                    headers={"Content-Type": "application/octet-stream"},
+                )
+                if not response.ok:
+                    response.raise_for_status()
 
-            config_ref = response.json()["id"]
+                config_ref = response.json()["id"]
+            finally:
+                shutil.rmtree(tempdir, ignore_errors=True)
+
+        target_deployer = deployer
+        if (not deployer) and len(deployer_record.names):
+            target_deployer = deployer_record.names[0]
 
         deployment_request = {
             "record": {
@@ -134,11 +217,14 @@ def command(
                 "application": app,
                 "version": "1.0.0",
                 "name": f"{app_record.attributes.name}@{app_record.attributes.version}",
-                "deployer": deployer,
+                "deployer": target_deployer,
                 "meta": {"when": str(datetime.utcnow())},
             }
         }
 
+        if auction_id:
+            deployment_request["record"]["auction"] = auction_id
+
         if config_ref:
             deployment_request["record"]["config"] = {"ref": config_ref}
 
@@ -165,11 +251,12 @@ def command(
         elif use_payment:
             deployment_request["record"]["payment"] = use_payment
 
+        deployment_requests.append(deployment_request)
+
+    # Send all requests
+    for deployment_request in deployment_requests:
         if dry_run:
             print(yaml.dump(deployment_request))
-            return
+            continue
 
-        # Send the request
         laconic.publish(deployment_request)
-    finally:
-        shutil.rmtree(tempdir, ignore_errors=True)

stack_orchestrator/deploy/webapp/request_webapp_undeployment.py

@@ -0,0 +1,106 @@
+# Copyright ©2023 Vulcanize
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http:#www.gnu.org/licenses/>.
+
+import sys
+
+import click
+import yaml
+
+from stack_orchestrator.deploy.webapp.util import (LaconicRegistryClient)
+
+
+def fatal(msg: str):
+    print(msg, file=sys.stderr)
+    sys.exit(1)
+
+
+@click.command()
+@click.option(
+    "--laconic-config", help="Provide a config file for laconicd", required=True
+)
+@click.option(
+    "--deployer",
+    help="The LRN of the deployer to process this request.",
+    required=True
+)
+@click.option(
+    "--deployment",
+    help="Deployment record (ApplicationDeploymentRecord) id of the deployment to remove.",
+    required=True,
+)
+@click.option(
+    "--make-payment",
+    help="The payment to make (in alnt).  The value should be a number or 'auto' to use the deployer's minimum required payment.",
+)
+@click.option(
+    "--use-payment", help="The TX id of an existing, unused payment", default=None
+)
+@click.option(
+    "--dry-run",
+    help="Don't publish anything, just report what would be done.",
+    is_flag=True,
+)
+@click.pass_context
+def command(
+    ctx,
+    laconic_config,
+    deployer,
+    deployment,
+    make_payment,
+    use_payment,
+    dry_run,
+):
+    if make_payment and use_payment:
+        fatal("Cannot use --make-payment and --use-payment at the same time.")
+
+    laconic = LaconicRegistryClient(laconic_config)
+
+    deployer_record = laconic.get_record(deployer)
+    if not deployer_record:
+        fatal(f"Unable to locate deployer: {deployer}")
+
+    undeployment_request = {
+        "record": {
+            "type": "ApplicationDeploymentRemovalRequest",
+            "version": "1.0.0",
+            "deployer": deployer,
+            "deployment": deployment,
+        }
+    }
+
+    if make_payment:
+        amount = 0
+        if dry_run:
+            undeployment_request["record"]["payment"] = "DRY_RUN"
+        elif "auto" == make_payment:
+            if "minimumPayment" in deployer_record.attributes:
+                amount = int(
+                    deployer_record.attributes.minimumPayment.replace("alnt", "")
+                )
+        else:
+            amount = make_payment
+        if amount:
+            receipt = laconic.send_tokens(
+                deployer_record.attributes.paymentAddress, amount
+            )
+            undeployment_request["record"]["payment"] = receipt.tx.hash
+            print("Payment TX:", receipt.tx.hash)
+    elif use_payment:
+        undeployment_request["record"]["payment"] = use_payment
+
+    if dry_run:
+        print(yaml.dump(undeployment_request))
+        return
+
+    laconic.publish(undeployment_request)

stack_orchestrator/deploy/webapp/undeploy_webapp_from_registry.py

@@ -178,6 +178,9 @@ def dump_known_requests(filename, requests):
     "my payment address are examined).",
     is_flag=True,
 )
+@click.option(
+    "--registry-lock-file", help="File path to use for registry mutex lock", default=None
+)
 @click.pass_context
 def command(  # noqa: C901
     ctx,
@@ -195,6 +198,7 @@ def command(  # noqa: C901
     min_required_payment,
     lrn,
     all_requests,
+    registry_lock_file,
 ):
     if request_id and discover:
         print("Cannot specify both --request-id and --discover", file=sys.stderr)
@@ -212,7 +216,7 @@ def command(  # noqa: C901
     include_tags = [tag.strip() for tag in include_tags.split(",") if tag]
     exclude_tags = [tag.strip() for tag in exclude_tags.split(",") if tag]
 
-    laconic = LaconicRegistryClient(laconic_config, log_file=sys.stderr)
+    laconic = LaconicRegistryClient(laconic_config, log_file=sys.stderr, mutex_lock_file=registry_lock_file)
     deployer_record = laconic.get_record(lrn, require=True)
     payment_address = deployer_record.attributes.paymentAddress
     main_logger.log(f"Payment address: {payment_address}")
@@ -311,6 +315,7 @@ def command(  # noqa: C901
             main_logger.log(f"ERROR examining {r.id}: {e}")
 
     requests_to_execute = []
+    # TODO: Handle requests with auction
     if min_required_payment:
         for r in requests_to_check_for_payment:
             main_logger.log(f"{r.id}: Confirming payment...")

stack_orchestrator/deploy/webapp/util.py

@@ -24,6 +24,21 @@ import tempfile
 import uuid
 import yaml
 
+from enum import Enum
+
+from stack_orchestrator.deploy.webapp.registry_mutex import registry_mutex
+
+
+class AuctionStatus(str, Enum):
+    COMMIT = "commit"
+    REVEAL = "reveal"
+    COMPLETED = "completed"
+    EXPIRED = "expired"
+
+
+TOKEN_DENOM = "alnt"
+AUCTION_KIND_PROVIDER = "provider"
+
 
 class AttrDict(dict):
     def __init__(self, *args, **kwargs):
@@ -58,6 +73,12 @@ class TimedLogger:
         self.last = datetime.datetime.now()
 
 
+def load_known_requests(filename):
+    if filename and os.path.exists(filename):
+        return json.load(open(filename, "r"))
+    return {}
+
+
 def logged_cmd(log_file, *vargs):
     result = None
     try:
@@ -92,76 +113,8 @@ def is_id(name_or_id: str):
     return not is_lrn(name_or_id)
 
 
-def confirm_payment(laconic, record, payment_address, min_amount, logger):
-    req_owner = laconic.get_owner(record)
-    if req_owner == payment_address:
-        # No need to confirm payment if the sender and recipient are the same account.
-        return True
-
-    if not record.attributes.payment:
-        logger.log(f"{record.id}: no payment tx info")
-        return False
-
-    tx = laconic.get_tx(record.attributes.payment)
-    if not tx:
-        logger.log(f"{record.id}: cannot locate payment tx")
-        return False
-
-    if tx.code != 0:
-        logger.log(
-            f"{record.id}: payment tx {tx.hash} was not successful - code: {tx.code}, log: {tx.log}"
-        )
-        return False
-
-    if tx.sender != req_owner:
-        logger.log(
-            f"{record.id}: payment sender {tx.sender} in tx {tx.hash} does not match deployment "
-            f"request owner {req_owner}"
-        )
-        return False
-
-    if tx.recipient != payment_address:
-        logger.log(
-            f"{record.id}: payment recipient {tx.recipient} in tx {tx.hash} does not match {payment_address}"
-        )
-        return False
-
-    pay_denom = "".join([i for i in tx.amount if not i.isdigit()])
-    if pay_denom != "alnt":
-        logger.log(
-            f"{record.id}: {pay_denom} in tx {tx.hash} is not an expected payment denomination"
-        )
-        return False
-
-    pay_amount = int("".join([i for i in tx.amount if i.isdigit()]))
-    if pay_amount < min_amount:
-        logger.log(
-            f"{record.id}: payment amount {tx.amount} is less than minimum {min_amount}"
-        )
-        return False
-
-    # Check if the payment was already used on a
-    used = laconic.app_deployments(
-        {"deployer": payment_address, "payment": tx.hash}, all=True
-    )
-    if len(used):
-        logger.log(f"{record.id}: payment {tx.hash} already used on deployment {used}")
-        return False
-
-    used = laconic.app_deployment_removals(
-        {"deployer": payment_address, "payment": tx.hash}, all=True
-    )
-    if len(used):
-        logger.log(
-            f"{record.id}: payment {tx.hash} already used on deployment removal {used}"
-        )
-        return False
-
-    return True
-
-
 class LaconicRegistryClient:
-    def __init__(self, config_file, log_file=None):
+    def __init__(self, config_file, log_file=None, mutex_lock_file=None):
         self.config_file = config_file
         self.log_file = log_file
         self.cache = AttrDict(
@@ -172,6 +125,9 @@ class LaconicRegistryClient:
             }
         )
 
+        self.mutex_lock_file = mutex_lock_file
+        self.mutex_lock_acquired = False
+
     def whoami(self, refresh=False):
         if not refresh and "whoami" in self.cache:
             return self.cache["whoami"]
@@ -370,6 +326,34 @@ class LaconicRegistryClient:
         if require:
             raise Exception("Cannot locate tx:", hash)
 
+    def get_auction(self, auction_id, require=False):
+        args = [
+            "laconic",
+            "-c",
+            self.config_file,
+            "registry",
+            "auction",
+            "get",
+            "--id",
+            auction_id,
+        ]
+
+        results = None
+        try:
+            results = [
+                AttrDict(r) for r in json.loads(logged_cmd(self.log_file, *args)) if r
+            ]
+        except:  # noqa: E722
+            pass
+
+        if results and len(results):
+            return results[0]
+
+        if require:
+            raise Exception("Cannot locate auction:", auction_id)
+
+        return None
+
     def app_deployment_requests(self, criteria=None, all=True):
         if criteria is None:
             criteria = {}
@@ -398,6 +382,21 @@ class LaconicRegistryClient:
         criteria["type"] = "ApplicationDeploymentRemovalRecord"
         return self.list_records(criteria, all)
 
+    def webapp_deployers(self, criteria=None, all=True):
+        if criteria is None:
+            criteria = {}
+        criteria = criteria.copy()
+        criteria["type"] = "WebappDeployer"
+        return self.list_records(criteria, all)
+
+    def app_deployment_auctions(self, criteria=None, all=True):
+        if criteria is None:
+            criteria = {}
+        criteria = criteria.copy()
+        criteria["type"] = "ApplicationDeploymentAuction"
+        return self.list_records(criteria, all)
+
+    @registry_mutex()
     def publish(self, record, names=None):
         if names is None:
             names = []
@@ -428,6 +427,7 @@ class LaconicRegistryClient:
         finally:
             logged_cmd(self.log_file, "rm", "-rf", tmpdir)
 
+    @registry_mutex()
     def set_name(self, name, record_id):
         logged_cmd(
             self.log_file,
@@ -441,6 +441,7 @@ class LaconicRegistryClient:
             record_id,
         )
 
+    @registry_mutex()
     def delete_name(self, name):
         logged_cmd(
             self.log_file,
@@ -453,6 +454,7 @@ class LaconicRegistryClient:
             name,
         )
 
+    @registry_mutex()
     def send_tokens(self, address, amount, type="alnt"):
         args = [
             "laconic",
@@ -471,6 +473,67 @@ class LaconicRegistryClient:
 
         return AttrDict(json.loads(logged_cmd(self.log_file, *args)))
 
+    @registry_mutex()
+    def create_deployment_auction(self, auction):
+        args = [
+            "laconic",
+            "-c",
+            self.config_file,
+            "registry",
+            "auction",
+            "create",
+            "--kind",
+            auction["kind"],
+            "--commits-duration",
+            str(auction["commits_duration"]),
+            "--reveals-duration",
+            str(auction["reveals_duration"]),
+            "--denom",
+            auction["denom"],
+            "--commit-fee",
+            str(auction["commit_fee"]),
+            "--reveal-fee",
+            str(auction["reveal_fee"]),
+            "--max-price",
+            str(auction["max_price"]),
+            "--num-providers",
+            str(auction["num_providers"])
+        ]
+
+        return json.loads(logged_cmd(self.log_file, *args))["auctionId"]
+
+    @registry_mutex()
+    def commit_bid(self, auction_id, amount, type="alnt"):
+        args = [
+            "laconic",
+            "-c",
+            self.config_file,
+            "registry",
+            "auction",
+            "bid",
+            "commit",
+            auction_id,
+            str(amount),
+            type,
+        ]
+
+        return json.loads(logged_cmd(self.log_file, *args))["reveal_file"]
+
+    @registry_mutex()
+    def reveal_bid(self, auction_id, reveal_file_path):
+        logged_cmd(
+            self.log_file,
+            "laconic",
+            "-c",
+            self.config_file,
+            "registry",
+            "auction",
+            "bid",
+            "reveal",
+            auction_id,
+            reveal_file_path,
+        )
+
 
 def file_hash(filename):
     return hashlib.sha1(open(filename).read().encode()).hexdigest()
@@ -626,6 +689,7 @@ def publish_deployment(
     dns_record,
     dns_lrn,
     deployment_dir,
+    dns_value=None,
     app_deployment_request=None,
     webapp_deployer_record=None,
     logger=None,
@@ -658,6 +722,8 @@ def publish_deployment(
     }
     if app_deployment_request:
         new_dns_record["record"]["request"] = app_deployment_request.id
+    if dns_value:
+        new_dns_record["record"]["value"] = dns_value
 
     if logger:
         logger.log("Publishing DnsRecord.")
@@ -677,12 +743,15 @@ def publish_deployment(
             },
         }
     }
+
     if app_deployment_request:
         new_deployment_record["record"]["request"] = app_deployment_request.id
-        if app_deployment_request.attributes.payment:
-            new_deployment_record["record"][
-                "payment"
-            ] = app_deployment_request.attributes.payment
+
+        # Set auction or payment id from request
+        if app_deployment_request.attributes.auction:
+            new_deployment_record["record"]["auction"] = app_deployment_request.attributes.auction
+        elif app_deployment_request.attributes.payment:
+            new_deployment_record["record"]["payment"] = app_deployment_request.attributes.payment
 
     if webapp_deployer_record:
         new_deployment_record["record"]["deployer"] = webapp_deployer_record.names[0]
@@ -730,3 +799,108 @@ def skip_by_tag(r, include_tags, exclude_tags):
         return True
 
     return False
+
+
+def confirm_payment(laconic: LaconicRegistryClient, record, payment_address, min_amount, logger):
+    req_owner = laconic.get_owner(record)
+    if req_owner == payment_address:
+        # No need to confirm payment if the sender and recipient are the same account.
+        return True
+
+    if not record.attributes.payment:
+        logger.log(f"{record.id}: no payment tx info")
+        return False
+
+    tx = laconic.get_tx(record.attributes.payment)
+    if not tx:
+        logger.log(f"{record.id}: cannot locate payment tx")
+        return False
+
+    if tx.code != 0:
+        logger.log(
+            f"{record.id}: payment tx {tx.hash} was not successful - code: {tx.code}, log: {tx.log}"
+        )
+        return False
+
+    if tx.sender != req_owner:
+        logger.log(
+            f"{record.id}: payment sender {tx.sender} in tx {tx.hash} does not match deployment "
+            f"request owner {req_owner}"
+        )
+        return False
+
+    if tx.recipient != payment_address:
+        logger.log(
+            f"{record.id}: payment recipient {tx.recipient} in tx {tx.hash} does not match {payment_address}"
+        )
+        return False
+
+    pay_denom = "".join([i for i in tx.amount if not i.isdigit()])
+    if pay_denom != "alnt":
+        logger.log(
+            f"{record.id}: {pay_denom} in tx {tx.hash} is not an expected payment denomination"
+        )
+        return False
+
+    pay_amount = int("".join([i for i in tx.amount if i.isdigit()]))
+    if pay_amount < min_amount:
+        logger.log(
+            f"{record.id}: payment amount {tx.amount} is less than minimum {min_amount}"
+        )
+        return False
+
+    # Check if the payment was already used on a deployment
+    used = laconic.app_deployments(
+        {"deployer": record.attributes.deployer, "payment": tx.hash}, all=True
+    )
+    if len(used):
+        # Fetch the app name from request record
+        used_request = laconic.get_record(used[0].attributes.request, require=True)
+
+        # Check that payment was used for deployment of same application
+        if record.attributes.application != used_request.attributes.application:
+            logger.log(f"{record.id}: payment {tx.hash} already used on a different application deployment {used}")
+            return False
+
+    used = laconic.app_deployment_removals(
+        {"deployer": record.attributes.deployer, "payment": tx.hash}, all=True
+    )
+    if len(used):
+        logger.log(
+            f"{record.id}: payment {tx.hash} already used on deployment removal {used}"
+        )
+        return False
+
+    return True
+
+
+def confirm_auction(laconic: LaconicRegistryClient, record, deployer_lrn, payment_address, logger):
+    auction_id = record.attributes.auction
+    auction = laconic.get_auction(auction_id)
+
+    # Fetch auction record for given auction
+    auction_records_by_id = laconic.app_deployment_auctions({"auction": auction_id})
+    if len(auction_records_by_id) == 0:
+        logger.log(f"{record.id}: unable to locate record for auction {auction_id}")
+        return False
+
+    # Cross check app against application in the auction record
+    requested_app = laconic.get_record(record.attributes.application, require=True)
+    auction_app = laconic.get_record(auction_records_by_id[0].attributes.application, require=True)
+    if requested_app.id != auction_app.id:
+        logger.log(
+            f"{record.id}: requested application {record.attributes.application} does not match application from "
+            f"auction record {auction_records_by_id[0].attributes.application}"
+        )
+        return False
+
+    if not auction:
+        logger.log(f"{record.id}: unable to locate auction {auction_id}")
+        return False
+
+    # Check if the deployer payment address is in auction winners list
+    if payment_address not in auction.winnerAddresses:
+        logger.log(f"{record.id}: deployer payment address not in auction winners.")
+        return False
+
+    return True

stack_orchestrator/main.py

@@ -26,7 +26,10 @@ from stack_orchestrator.deploy.webapp import (run_webapp,
                                               deploy_webapp_from_registry,
                                               undeploy_webapp_from_registry,
                                               publish_webapp_deployer,
-                                              request_webapp_deployment)
+                                              publish_deployment_auction,
+                                              handle_deployment_auction,
+                                              request_webapp_deployment,
+                                              request_webapp_undeployment)
 from stack_orchestrator.deploy import deploy
 from stack_orchestrator import version
 from stack_orchestrator.deploy import deployment
@@ -64,7 +67,10 @@ cli.add_command(deploy_webapp.command, "deploy-webapp")
 cli.add_command(deploy_webapp_from_registry.command, "deploy-webapp-from-registry")
 cli.add_command(undeploy_webapp_from_registry.command, "undeploy-webapp-from-registry")
 cli.add_command(publish_webapp_deployer.command, "publish-deployer-to-registry")
+cli.add_command(publish_deployment_auction.command, "publish-deployment-auction")
+cli.add_command(handle_deployment_auction.command, "handle-deployment-auction")
 cli.add_command(request_webapp_deployment.command, "request-webapp-deployment")
+cli.add_command(request_webapp_undeployment.command, "request-webapp-undeployment")
 cli.add_command(deploy.command, "deploy")  # deploy is an alias for deploy-system
 cli.add_command(deploy.command, "deploy-system")
 cli.add_command(deployment.command, "deployment")

stack_orchestrator/util.py

@@ -78,6 +78,22 @@ def get_pod_list(parsed_stack):
     return result
 
 
+def get_job_list(parsed_stack):
+    # Return list of jobs from stack config, or empty list if no jobs defined
+    if "jobs" not in parsed_stack:
+        return []
+    jobs = parsed_stack["jobs"]
+    if not jobs:
+        return []
+    if type(jobs[0]) is str:
+        result = jobs
+    else:
+        result = []
+        for job in jobs:
+            result.append(job["name"])
+    return result
+
+
 def get_plugin_code_paths(stack) -> List[Path]:
     parsed_stack = get_parsed_stack_config(stack)
     pods = parsed_stack["pods"]
@@ -119,6 +135,21 @@ def resolve_compose_file(stack, pod_name: str):
     return compose_base.joinpath(f"docker-compose-{pod_name}.yml")
 
 
+# Find a job compose file in compose-jobs directory
+def resolve_job_compose_file(stack, job_name: str):
+    if stack_is_external(stack):
+        # First try looking in the external stack for the job compose file
+        compose_jobs_base = Path(stack).parent.parent.joinpath("compose-jobs")
+        proposed_file = compose_jobs_base.joinpath(f"docker-compose-{job_name}.yml")
+        if proposed_file.exists():
+            return proposed_file
+        # If we don't find it fall through to the internal case
+    # TODO: Add internal compose-jobs directory support if needed
+    # For now, jobs are expected to be in external stacks only
+    compose_jobs_base = Path(stack).parent.parent.joinpath("compose-jobs")
+    return compose_jobs_base.joinpath(f"docker-compose-{job_name}.yml")
+
+
 def get_pod_file_path(stack, parsed_stack, pod_name: str):
     pods = parsed_stack["pods"]
     if type(pods[0]) is str:
@@ -131,6 +162,18 @@ def get_pod_file_path(stack, parsed_stack, pod_name: str):
     return result
 
 
+def get_job_file_path(stack, parsed_stack, job_name: str):
+    if "jobs" not in parsed_stack or not parsed_stack["jobs"]:
+        return None
+    jobs = parsed_stack["jobs"]
+    if type(jobs[0]) is str:
+        result = resolve_job_compose_file(stack, job_name)
+    else:
+        # TODO: Support complex job definitions if needed
+        result = resolve_job_compose_file(stack, job_name)
+    return result
+
+
 def get_pod_script_paths(parsed_stack, pod_name: str):
     pods = parsed_stack["pods"]
     result = []
@@ -180,9 +223,7 @@ def get_k8s_dir():
 def get_parsed_deployment_spec(spec_file):
     spec_file_path = Path(spec_file)
     try:
-        with spec_file_path:
-            deploy_spec = get_yaml().load(open(spec_file_path, "r"))
-            return deploy_spec
+        return get_yaml().load(open(spec_file_path, "r"))
     except FileNotFoundError as error:
         # We try here to generate a useful diagnostic error
         print(f"Error: spec file: {spec_file_path} does not exist")