1.14.0 — Capacity buttons and an external-infrastructure switch

2026-08-19

django-mojo 1.14.0 adds guarded capacity actions to the admin portal — add or remove an app node, an RDS read replica, or a cache replica without opening the AWS console — and one file-only INFRASTRUCTURE_MODE switch that turns off every portal infrastructure mutation for installations whose infrastructure team runs its own IaC. Certificate inventory health also stops counting superseded rows, and failed issuance attempts can be cleaned up from the portal.

Added

• Capacity actions in the admin portal's fleet drill-in: add an app node — it clones a healthy fleet member, boots under its own identity, converges to the fleet's proven commit, and only then registers with the load balancer — plus drain and terminate as two separate guarded steps, RDS read replicas (Aurora and standalone resolved live), and cache replicas with a failover-aware floor. Superuser-only, consequence-stating typed confirmations, progress polled to proven state, never "AWS says available". New endpoints under /api/aws/capacity.
• INFRASTRUCTURE_MODE — a file-only setting (managed default, external). External installations get every portal infrastructure mutation refused with a clear reason (engine-version upgrades, the framework update, capacity actions) while health, metrics, drift findings and diagnostics stay fully readable. System Setup shows the mode; bootstrap publishes it to API consumers; an unrecognized value fails closed to external and is logged.
• A cleanup action for failed certificate issuance attempts (certificate/remove-failed), permission-checked and guarded for house certificates.

Changed

• Certificate inventory health counts only each certificate's current lifecycle row — superseded rows left behind by renewals no longer inflate status or expiring counts.
• In external mode the framework update row explains itself ("the update is applied by your infrastructure team's IaC") instead of losing its control silently.
• The owner-tier settings capability now states its real authority — superuser-only, which is what the writers always enforced. No permission surface changed; the docs were corrected to match.

Fixed

• Importing the admin portal's REST module no longer resolves to the same-named services module (a package star-import shadowing accident that bit anything importing it by the documented path).

Upgrade notes

• No migrations.
• External-IaC installations: set INFRASTRUCTURE_MODE=external, and pin or hold EDGE_FRAMEWORK_VERSION — a deploy retry with an unset pin still installs the latest published django-mojo.
• Capacity actions use new IAM actions (image capture, instance launch, target registration, and the RDS/ElastiCache modify calls); missing grants degrade with the denied action named, never a raw provider error.