Dry-Run Mode

--dry-run previews every fix that would be applied without changing anything on your server or filesystem. Always run this first.

Usage

stacksentry -t https://your-app.com --mode full --fix --dry-run \
  --ssh-host your-server-ip \
  --ssh-user root \
  --ssh-password yourpass

Example Output

🔍  DRY-RUN — no changes will be made to the server or files.
 
  Checks that will be fixed automatically: 3
  Checks requiring manual action (APP layer): 6
 
━━  DRY-RUN PLAN  ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
 
  🔧  [WEBSERVER] WS-HSTS-001
      Would run 5 SSH command(s) on YOUR_SERVER_IP:
        $ mkdir -p /etc/nginx/snippets
        $ cat > /etc/nginx/snippets/stacksentry-hsts.conf << 'CONF'
          add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
          CONF
        $ ln -sf /etc/nginx/snippets/stacksentry-hsts.conf /etc/nginx/conf.d/
        $ nginx -t
        $ systemctl reload nginx
 
  🔧  [WEBSERVER] WS-SEC-001
      Would run 5 SSH command(s) on YOUR_SERVER_IP
 
  🔧  [HOST] HOST-SSH-001
      ⚠️  PASSWORD → KEY MIGRATION REQUIRED
      Step 1: Generate Ed25519 key → ~/.stacksentry/keys/server.pem
      Step 2: Install public key on server
      Step 3: Verify key login
      Step 4: Apply PermitRootLogin prohibit-password
 
  📋  [APP] APP-COOKIE-001  — Manual action required
      Add to your Flask application:
        app.config["SESSION_COOKIE_SECURE"] = True
        app.config["SESSION_COOKIE_HTTPONLY"] = True
        app.config["SESSION_COOKIE_SAMESITE"] = "Lax"
 
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
 
  Would fix automatically: 3
  Manual action required:   6
  Total fixes planned:      9
 
  ✅ Review complete. Run without --dry-run to apply.

What Dry-Run Does Not Show

Dry-run cannot show the exact output of validation commands (nginx -t, sshd -t) because those commands are not run. If a fix would fail validation on your server, that will only be known when you run without --dry-run.

This is expected behaviour — the dry-run gives you a complete picture of intent, not a guaranteed outcome.

After Reviewing

Once you have confirmed the plan looks correct:

# Remove --dry-run to apply
stacksentry -t https://your-app.com --mode full --fix \
  --ssh-host your-server-ip \
  --ssh-user root \
  --ssh-password yourpass