Add WAL file for database and log instance deployment failures

OTSSignsOrchestrator.Core/Services/IDockerCliService.cs

@@ -1,3 +1,4 @@
+using MySqlConnector;
 using OTSSignsOrchestrator.Core.Models.DTOs;
 
 namespace OTSSignsOrchestrator.Core.Services;
@@ -17,25 +18,75 @@ public interface IDockerCliService
     Task<bool> EnsureDirectoryAsync(string path);
 
     /// <summary>
-    /// Ensures the required folders exist on an SMB/CIFS share, creating any that are missing.
-    /// If <paramref name="cifsShareFolder"/> is non-empty, creates it first as a subfolder of the share,
+    /// Ensures the required folders exist on an NFS export, creating any that are missing.
+    /// If <paramref name="nfsExportFolder"/> is non-empty, creates it first as a subfolder of the export,
     /// then creates the volume folders inside it.
-    /// Uses smbclient on the remote host to interact with the share without requiring a mount.
+    /// Temporarily mounts the NFS export on the Docker host to create the directories.
     /// </summary>
-    Task<bool> EnsureSmbFoldersAsync(
-        string cifsServer,
-        string cifsShareName,
-        string cifsUsername,
-        string cifsPassword,
+    Task<bool> EnsureNfsFoldersAsync(
+        string nfsServer,
+        string nfsExport,
         IEnumerable<string> folderNames,
-        string? cifsShareFolder = null);
+        string? nfsExportFolder = null);
+
+    /// <summary>
+    /// Same as <see cref="EnsureNfsFoldersAsync"/> but returns the error message on failure
+    /// so callers can surface actionable diagnostics.
+    /// </summary>
+    Task<(bool Success, string? Error)> EnsureNfsFoldersWithErrorAsync(
+        string nfsServer,
+        string nfsExport,
+        IEnumerable<string> folderNames,
+        string? nfsExportFolder = null);
 
     /// <summary>
     /// Removes all Docker volumes whose names start with <paramref name="stackName"/>_.
     /// Volumes currently in use by running containers will be skipped.
-    /// Safe for CIFS volumes since data lives on the remote share, not in the local volume.
+    /// Safe for NFS volumes since data lives on the remote export, not in the local volume.
     /// </summary>
     Task<bool> RemoveStackVolumesAsync(string stackName);
+
+    /// <summary>
+    /// Lists all nodes in the Docker Swarm cluster.
+    /// Must be executed against a Swarm manager node.
+    /// </summary>
+    Task<List<NodeInfo>> ListNodesAsync();
+
+    /// <summary>
+    /// Force-updates a service so all its tasks are restarted and pick up any changed
+    /// secrets or config (equivalent to docker service update --force).
+    /// </summary>
+    Task<bool> ForceUpdateServiceAsync(string serviceName);
+
+    /// <summary>
+    /// Opens a <see cref="MySqlConnection"/> to a remote MySQL server through the
+    /// implementation's transport (e.g. an SSH tunnel).  The caller must dispose
+    /// both the connection <b>and</b> the returned <c>tunnel</c> handle when finished.
+    /// </summary>
+    /// <returns>
+    /// A tuple of (connection, tunnel).  <c>tunnel</c> is <see cref="IDisposable"/>
+    /// and MUST be disposed after the connection is closed.
+    /// </returns>
+    Task<(MySqlConnection Connection, IDisposable Tunnel)> OpenMySqlConnectionAsync(
+        string mysqlHost, int port,
+        string adminUser, string adminPassword);
+
+    /// <summary>
+    /// Executes <c>ALTER USER … IDENTIFIED BY …</c> on a remote MySQL server via
+    /// <see cref="OpenMySqlConnectionAsync"/>.
+    /// </summary>
+    Task<(bool Success, string Error)> AlterMySqlUserPasswordAsync(
+        string mysqlHost, int port,
+        string adminUser, string adminPassword,
+        string targetUser, string newPassword);
+
+    /// <summary>
+    /// Atomically swaps one secret reference on a running service:
+    /// removes <paramref name="oldSecretName"/> and adds <paramref name="newSecretName"/>,
+    /// preserving the in-container path as <paramref name="targetAlias"/> (defaults to
+    /// <paramref name="oldSecretName"/> when null, keeping the same /run/secrets/ filename).
+    /// </summary>
+    Task<bool> ServiceSwapSecretAsync(string serviceName, string oldSecretName, string newSecretName, string? targetAlias = null);
 }
 
 public class StackInfo