fix: stop and start an instance from the instance's own menu

1.3.0 put suspend and resume in the main menu and on the command line, which
meant remembering a separate command and picking the instance separately for
each of the two. They belong where you are already looking at the instance.

The menu of one instance now ends with a single line above "Back", worded for the
state that instance is in when the menu is drawn:

  Instance 2 - supa2.didgibot.com - running
    ...
    Suspend it (stop it, keep its data)

  Instance 2 - supa2.didgibot.com - suspended
    ...
    Resume it (start it again with its data)

The state is read again every time the menu is drawn, so right after suspending
an instance the same line reads "Resume it". The instance's state is in the menu
title, and the instance picker names it next to every instance, so you can see
which ones are awake before choosing one.

- The main menu's two entries "Suspend instance" and "Resume instance" are gone.
  "Show instance" is now "Show instance (and suspend or resume it)": one way in.
- Asking for the tunnel command of a sleeping instance says it is suspended and
  to resume it from this menu, instead of printing a command that cannot work.
- The line printed after suspending, and the one `supaspin list` prints under a
  sleeping instance, point at the menu line rather than at a command.

`supaspin suspend N` and `supaspin resume N` still work for scripting.

Verified on instance 2 (supa2.didgibot.com): suspended from the instance menu,
the menu came back reading "Resume it" and the picker showed "(suspended)",
resumed from the same line, 12/12 pods with 0 restarts and its 55 tables and
11 MB of data intact.

Tests: 136 pass (6 new). Version 1.3.0 -> 1.3.1.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

CLAUDE.md

@@ -21,8 +21,14 @@ The number is `MAJOR.MINOR.PATCH` (semantic versioning: `1.1.1` is major 1, mino
 4. **Tag every release.** After the pull request is merged, create the git tag `vX.Y.Z` (for example `v1.1.1`) on
    the commit on `main` that contains that number in `VERSION`. The tag name must equal `VERSION` with a `v` in
    front. A version without a tag is not released. Never move or delete a tag that was already published; if a
-   release is wrong, ship a new PATCH instead. With the Gitea API: `POST /api/v1/repos/igor/supaspin/tags` with
+   release is wrong, ship a new PATCH instead. With the Gitea API: `POST /api/v1/repos/public/supaspin/tags` with
    `tag_name`, `target` (the commit) and `message`.
+
+   The owner in an API address must be `public`. The repository used to sit under the user `igor` and Gitea still
+   forwards the old address for anything a browser or git does, but it answers an API call to
+   `/api/v1/repos/igor/supaspin/...` with a redirect that curl does not follow for a POST: the command returns an
+   empty body and no error, which looks exactly like a rejected token. Opening or merging a pull request needs the
+   same `public` owner.
 5. **Check the result.** Reinstall from the merged `main` (`sudo bash install.sh`), then run `supaspin --version` and
    compare it with `VERSION` and the tag.
 6. If you find a version in `VERSION` that has no tag, or a tag that does not match `VERSION`, tell Igor before doing

README.md

@@ -1,6 +1,6 @@
 # supaspin
 
-Version 1.2.0
+Version 1.3.1
 
 Create, list, show and delete throwaway [Supabase](https://supabase.com) instances on a
 single-node [microk8s](https://microk8s.io) server, from a terminal menu.
@@ -40,7 +40,7 @@ of instances at once. Numbers are reused: create picks the lowest free one.
 ## Install
 
 ```bash
-curl -fsSL https://git.didgibot.com/igor/supaspin/raw/branch/main/install.sh | sudo bash
+curl -fsSL https://git.didgibot.com/public/supaspin/raw/branch/main/install.sh | sudo bash
 ```
 
 **If your Gitea requires sign-in even for public repositories** (the download then fails with
@@ -48,13 +48,13 @@ curl -fsSL https://git.didgibot.com/igor/supaspin/raw/branch/main/install.sh | s
 `repository: read`):
 
 ```bash
-curl -fsSL -H "Authorization: token $TOKEN" https://git.didgibot.com/igor/supaspin/raw/branch/main/install.sh | sudo SUPASPIN_TOKEN=$TOKEN bash
+curl -fsSL -H "Authorization: token $TOKEN" https://git.didgibot.com/public/supaspin/raw/branch/main/install.sh | sudo SUPASPIN_TOKEN=$TOKEN bash
 ```
 
 or clone the repository and install from the checkout:
 
 ```bash
-git clone ssh://git@git.didgibot.com:2226/igor/supaspin.git && sudo bash supaspin/install.sh
+git clone ssh://git@git.didgibot.com:2226/public/supaspin.git && sudo bash supaspin/install.sh
 ```
 
 Run it again to upgrade. It installs `/usr/local/bin/supaspin`, its values template and the
@@ -90,7 +90,7 @@ Supabase Helm chart (0.8.0, Postgres 17.6.1.136) once into `/var/lib/supaspin/ch
 |---|---|
 | Create instance | picks the lowest free number, asks whether to use the saved mail settings or enter different ones, creates the disks, installs Supabase, waits until every pod is ready, writes `<root>/<N>/.env` |
 | List instances | number, hostname, pods ready, memory in use, disk use per image, `.env` path, and for each instance the tunnel command with plain instructions (open it, keep it in the background, close it) |
-| Show instance | the `.env` (secrets hidden unless you ask), the tunnel command, pod status and recent events |
+| Show instance (and suspend or resume it) | the `.env` (secrets hidden unless you ask), the tunnel command, pod status and recent events - and the one line that stops this instance or starts it again, worded for whichever state it is in |
 | Delete instance | asks you to type the number; removes everything (see below) |
 | Copy instance values into another .env file | puts an instance's `.env` values into your app's `.env`, on this server or on another computer (see below) |
 | Apply current memory caps to running instances | puts this version's memory limits on instances that already exist, replacing their pods one service at a time; databases, uploads and `.env` files are not touched |
@@ -108,9 +108,11 @@ sudo supaspin tunnel N                # the tunnel commands, step by step
 sudo supaspin push-env N TARGET [--port P] [--key FILE] [--dry-run]   # see "Copying an instance's values"
 sudo supaspin delete N [--yes]
 sudo supaspin upgrade [N]             # apply this version's memory caps to running instances
+sudo supaspin suspend N               # stop an instance, keep its data (see "Suspending an instance")
+sudo supaspin resume N                # start it again
 sudo supaspin mail                    # change the saved default mail settings
 sudo supaspin setup                   # change settings
-supaspin --version                    # prints "supaspin 1.2.0"
+supaspin --version                    # prints "supaspin 1.3.1"
 ```
 
 ### Connecting your app
@@ -209,6 +211,51 @@ Creating that instance again restores the saved certificate, so repeated create/
 not hit Let's Encrypt's limit of 5 certificates per hostname per week. If a create fails midway,
 run `supaspin delete N` to clean up.
 
+## Suspending an instance
+
+An instance you are not using right now does not have to be deleted. It can be stopped and
+started again with its data, from the menu:
+
+```
+sudo supaspin  ->  Show instance (and suspend or resume it)  ->  pick the instance
+                                                             ->  Suspend it (stop it, keep its data)
+```
+
+The picker names every instance with its state next to it, so you can see at a glance which ones
+are awake. Inside an instance the same line reads **Resume it** when the instance is asleep, so
+there is one line to look for either way and nothing to remember. Stopping takes about half a
+minute; starting takes a minute or two, because the database answers first and the rest wait for it.
+
+The same two actions without the menu, if you prefer typing:
+
+```bash
+sudo supaspin suspend 2
+sudo supaspin resume 2
+```
+
+What the server gets back while an instance sleeps:
+
+- the memory it had reserved (1.875 GiB) and everything it was actually using (1.5 to 2.5 GiB),
+- its twelve pod slots, out of the 110 a node allows,
+- its two ports on the server: Postgres on 544N and Studio on 300N are free for something else.
+
+What is kept, untouched:
+
+- the database and the uploaded files - the disk images stay mounted and keep their contents,
+- the `.env` file with its passwords and keys, so your app needs no change when the instance is back,
+- the HTTPS certificate, which goes on renewing itself while the instance sleeps,
+- the hostname and every Kubernetes object. Until you resume it, the hostname answers "service
+  unavailable" instead of not answering at all.
+
+Disk space is **not** given back: that is the data you are keeping. `sudo supaspin list` shows the
+state of every instance, and a suspended one is listed as `suspended` with no tunnel commands,
+because nothing is listening on its ports. Asking for the tunnel command of a sleeping instance
+says so instead of handing you a command that cannot work.
+
+Suspending is written into the instance's stored settings, not done by hand to the running pods,
+so it survives anything that re-applies the chart. `sudo supaspin upgrade` on a suspended instance
+stores the new memory limits and leaves it asleep; they take effect when you resume it.
+
 ## Memory per instance
 
 | Service | Request | Limit | Highest use measured |

VERSION

@@ -1 +1 @@
-1.2.0
+1.3.1

install.sh

@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 # One-line install (run on the Kubernetes server):
-#   curl -fsSL https://git.didgibot.com/igor/supaspin/raw/branch/main/install.sh | sudo bash
+#   curl -fsSL https://git.didgibot.com/public/supaspin/raw/branch/main/install.sh | sudo bash
 # Installs /usr/local/bin/supaspin and its Helm values template. Safe to run again to upgrade.
 #
 # If your Gitea requires sign-in even for public repositories, give a read-only token:
@@ -12,7 +12,7 @@
 # SUPASPIN_TOKEN=<token>        Gitea token (read access to the repository) for the download
 set -euo pipefail
 
-REPO="https://git.didgibot.com/igor/supaspin"
+REPO="https://git.didgibot.com/public/supaspin"
 REF="${SUPASPIN_REF:-main}"
 
 [ "$(id -u)" -eq 0 ] || { echo "Run as root: curl -fsSL $REPO/raw/branch/main/install.sh | sudo bash" >&2; exit 1; }

supaspin

@@ -8,6 +8,10 @@ Run as root: supaspin            (menu)
              supaspin upgrade [N]
                Puts this version's memory caps on instances that already run, one service
                at a time. Without N every instance. Data and .env files are not touched.
+             supaspin suspend N | resume N
+               Suspend stops every pod of one instance and gives back its memory, its pod
+               slots and its two server ports. The disks, the passwords in .env, the
+               certificate and the hostname stay. Resume starts it again with its data.
              supaspin push-env N TARGET [--port P] [--key FILE] [--dry-run]
                TARGET = a .env file on this server (/path/.env) or on another computer
                (user@host:/path/.env, Windows: user@host:C:/path/.env). Puts the instance's
@@ -35,7 +39,7 @@ import tty
 
 import yaml
 
-VERSION = "1.2.0"
+VERSION = "1.3.1"
 CONFIG_PATH = os.environ.get("SUPASPIN_CONFIG", "/etc/supaspin/config.yaml")
 STATE_DIR = os.environ.get("SUPASPIN_STATE", "/var/lib/supaspin")
 CHART_REPO = "https://supabase-community.github.io/supabase-kubernetes"
@@ -208,6 +212,24 @@ def apply_memory(values):
     return values
 
 
+def set_replicas(values, count):
+    """How many copies of each service to run. Zero stops the instance: the pods go away and give
+    back their memory, their processor time, their pod slots and the two ports they hold on the
+    server, while the disks, the passwords, the certificate and the hostname stay exactly as they
+    are. One starts it again."""
+    dep = values.setdefault("deployment", {})
+    for svc in SERVICES:
+        dep.setdefault(svc, {})["replicaCount"] = count
+    return values
+
+
+def is_suspended(values):
+    """True when the stored settings say to run no copy of any service."""
+    dep = values.get("deployment") or {}
+    counts = [(dep.get(svc) or {}).get("replicaCount", 1) for svc in SERVICES]
+    return all(c == 0 for c in counts)
+
+
 def memory_limits(values):
     """{service: limit} as the values dictionary has it, for telling before from after."""
     dep = values.get("deployment") or {}
@@ -807,20 +829,80 @@ def post_render_args(n):
             "--post-renderer-args", "post-render", "--post-renderer-args", str(n)]
 
 
-def upgrade_instance(cfg, n, log):
-    """Bring a running instance up to the memory caps this version of supaspin carries, without
-    deleting anything. The values Helm kept from the install are read back, the memory block in
-    them is replaced, and the chart is applied again: the pods are replaced one service at a time
-    and the database, the uploads and the .env file are untouched."""
+def stored_values(cfg, n):
+    """The settings Helm kept from the install. They carry every secret of the instance, which is
+    why supaspin deletes its own copy of them as soon as Helm has read it."""
     ns, rel = namespace(n), release(n)
-    host = cfg["slots"].get(n, "?")
-    log(f"Instance {n} ({host})")
     r = helm("get", "values", rel, "-n", ns, "-o", "yaml", check=False)
     if r.returncode != 0:
         raise RuntimeError(f"instance {n}: no Helm release {rel} in namespace {ns}\n{r.stderr.strip()}")
     values = yaml.safe_load(r.stdout) or {}
     if not values.get("deployment"):
-        raise RuntimeError(f"instance {n}: the stored values of {rel} look empty; not touching it")
+        raise RuntimeError(f"instance {n}: the stored settings of {rel} look empty; not touching it")
+    return values
+
+
+def apply_values(cfg, n, values):
+    """Hand the settings to Helm, which works out what to change and changes only that."""
+    vfile = write_values_file(n, values)
+    try:
+        helm("upgrade", release(n), chart_path(cfg), "-n", namespace(n), "-f", vfile,
+             *post_render_args(n))
+    finally:
+        os.remove(vfile)  # holds every secret
+
+
+def wait_gone(n, log, timeout=300):
+    """Wait until the instance's own pods have stopped."""
+    end = time.time() + timeout
+    while time.time() < end:
+        _, total, _ = pod_summary(n)
+        log(f"  pods still running: {total}", live=True)
+        if total == 0:
+            log("")
+            return
+        time.sleep(3)
+    raise RuntimeError("the pods did not stop in time")
+
+
+def suspend_instance(cfg, n, log):
+    """Stop every pod of an instance and keep everything else. The database, the uploads, the
+    passwords in .env, the certificate and the hostname are untouched; the instance answers
+    nothing until it is resumed."""
+    log(f"Suspending instance {n} ({cfg['slots'].get(n, '?')})")
+    values = stored_values(cfg, n)
+    if is_suspended(values):
+        log("  already suspended")
+        return False
+    apply_values(cfg, n, set_replicas(values, 0))
+    wait_gone(n, log)
+    log(f"  instance {n} is suspended; its disks and its .env file are untouched")
+    log("  start it again in this instance's menu: \"Resume it\"")
+    return True
+
+
+def resume_instance(cfg, n, log):
+    """Start a suspended instance again, with the data it had when it was suspended."""
+    log(f"Resuming instance {n} ({cfg['slots'].get(n, '?')})")
+    values = stored_values(cfg, n)
+    if not is_suspended(values):
+        log("  already running")
+        return False
+    apply_values(cfg, n, set_replicas(values, 1))
+    log("  the database answers first; the services that need it retry until it does")
+    wait_ready(n, log)
+    log(f"  instance {n} is running again: https://{cfg['slots'].get(n, '?')}")
+    return True
+
+
+def upgrade_instance(cfg, n, log):
+    """Bring a running instance up to the memory caps this version of supaspin carries, without
+    deleting anything. The values Helm kept from the install are read back, the memory block in
+    them is replaced, and the chart is applied again: the pods are replaced one service at a time
+    and the database, the uploads and the .env file are untouched."""
+    log(f"Instance {n} ({cfg['slots'].get(n, '?')})")
+    values = stored_values(cfg, n)
+    asleep = is_suspended(values)
     before = memory_limits(values)
     after = memory_limits(apply_memory(values))
     changed = [svc for svc in SERVICES if before[svc] != after[svc]]
@@ -831,11 +913,12 @@ def upgrade_instance(cfg, n, log):
         # differently (the Studio rollout, the host ports, the gateway routes are all decided
         # while the manifests are rendered). Helm changes nothing if nothing differs.
         log("  caps already current; re-applying the chart in case anything else differs")
-    vfile = write_values_file(n, values)
-    try:
-        helm("upgrade", rel, chart_path(cfg), "-n", ns, "-f", vfile, *post_render_args(n))
-    finally:
-        os.remove(vfile)  # holds every secret
+    apply_values(cfg, n, values)
+    if asleep:
+        # A suspended instance stays suspended: the new caps are stored and take effect the moment
+        # it is resumed. Waiting for its pods would wait for ever - by design it has none.
+        log(f"  instance {n} is suspended; the new caps apply when you resume it")
+        return bool(changed)
     wait_ready(n, log)
     log(f"  instance {n} is running with the current settings")
     return bool(changed)
@@ -923,12 +1006,29 @@ def disk_use(cfg, n):
     return ", ".join(parts)
 
 
+def instance_state(n):
+    """What the cluster is currently asked to run for this instance: "running", "suspended",
+    "partly suspended" (some services stopped, which should not happen on its own) or "unknown"
+    when the instance has no workloads at all."""
+    want = []
+    for kind in ("deployments", "statefulsets"):
+        data = kjson("get", kind, "-n", namespace(n), "-l", f"app.kubernetes.io/instance={release(n)}")
+        for item in (data or {}).get("items", []):
+            want.append(item["spec"].get("replicas", 1))
+    if not want:
+        return "unknown"
+    if all(w == 0 for w in want):
+        return "suspended"
+    return "partly suspended" if any(w == 0 for w in want) else "running"
+
+
 def list_rows(cfg):
     rows = []
     for n in sorted(existing_numbers(cfg)):
         ready, total, _ = pod_summary(n)
         env = f"{inst_dir(cfg, n)}/.env"
         rows.append({"n": n, "host": cfg["slots"].get(n, "?"), "pods": f"{ready}/{total}",
+                     "state": instance_state(n),
                      "memory": memory_use(n), "disk": disk_use(cfg, n),
                      "env": env if os.path.exists(env) else "(none)"})
     return rows
@@ -1560,7 +1660,7 @@ def pick_instance(cfg, title):
     if not nums:
         print("No instances.")
         return None
-    i = menu(title, [f"{n}  {cfg['slots'].get(n, '?')}" for n in nums])
+    i = menu(title, [f"{n}  {cfg['slots'].get(n, '?')}  ({instance_state(n)})" for n in nums])
     return None if i is None else nums[i]
 
 
@@ -1619,11 +1719,19 @@ def setup_dialog(cfg, log):
     return cfg
 
 
-def show_menu(cfg, n):
+def show_menu(cfg, n, log=None):
+    """Everything you can do to one instance, including stopping and starting it. The stop/start
+    line is worded for the state the instance is in when the menu is drawn, and the state is read
+    again every time you come back to it, so the menu never offers something that makes no sense."""
+    log = log or log_line
     while True:
-        i = menu(f"Instance {n} - {cfg['slots'].get(n, '?')}",
-                 [".env", ".env (secrets shown)", "Tunnel command", "Pods and events", "Back"])
-        if i is None or i == 4:
+        state = instance_state(n)
+        asleep = state == "suspended"
+        switch = ("Resume it (start it again with its data)" if asleep
+                  else "Suspend it (stop it, keep its data)")
+        items = [".env", ".env (secrets shown)", "Tunnel command", "Pods and events", switch, "Back"]
+        i = menu(f"Instance {n} - {cfg['slots'].get(n, '?')} - {state}", items)
+        if i is None or i == 5:
             return
         print()
         try:
@@ -1631,10 +1739,14 @@ def show_menu(cfg, n):
                 text = read_env(cfg, n)
                 print(f"{inst_dir(cfg, n)}/.env\n\n" + (text if i == 1 else mask_env(text)))
             elif i == 2:
-                print(tunnel_help(cfg, n))
-            else:
+                print(tunnel_help(cfg, n) if not asleep else
+                      f"Instance {n} is suspended: nothing is listening on its ports.\n"
+                      "Resume it from this menu and the tunnel commands work again.")
+            elif i == 3:
                 print(kubectl("get", "pods", "-n", namespace(n), "-o", "wide").stdout)
                 print(kubectl("get", "events", "-n", namespace(n), "--sort-by=.lastTimestamp").stdout[-3000:])
+            else:
+                (resume_instance if asleep else suspend_instance)(cfg, n, log)
         except Exception as e:
             print(f"{RED}{e}{OFF}")
         pause()
@@ -1646,8 +1758,12 @@ def print_list(cfg):
         print("No instances.")
         return
     for r in rows:
-        print(f"{BOLD}{r['n']}{OFF}  {r['host']}  pods {r['pods']}  memory {r['memory']}")
+        state = r.get("state", "running")
+        print(f"{BOLD}{r['n']}{OFF}  {r['host']}  {state}  pods {r['pods']}  memory {r['memory']}")
         print(f"     disk {r['disk']}\n     env  {r['env']}")
+        if state == "suspended":
+            print(f"     start it again in this instance's menu: \"Resume it\"\n")
+            continue  # the tunnel is pointless while nothing listens on the ports
         for line in tunnel_guide(cfg, r["n"]):
             print(f"     {line}" if line else "")
         print()
@@ -1655,10 +1771,12 @@ def print_list(cfg):
 
 def main_menu(cfg, log):
     while True:
-        i = menu(f"supaspin {VERSION}", ["Create instance", "List instances", "Show instance",
-                                          "Delete instance", "Copy instance values into another .env file",
-                                          "Apply current memory caps to running instances",
-                                          "Mail settings", "Settings", "Quit"])
+        i = menu(f"supaspin {VERSION}",
+                 ["Create instance", "List instances",
+                  "Show instance (and suspend or resume it)", "Delete instance",
+                  "Copy instance values into another .env file",
+                  "Apply current memory caps to running instances",
+                  "Mail settings", "Settings", "Quit"])
         if i is None or i == 8:
             return
         print()
@@ -1668,9 +1786,9 @@ def main_menu(cfg, log):
             elif i == 1:
                 print_list(cfg)
             elif i == 2:
-                n = pick_instance(cfg, "Show which instance?")
+                n = pick_instance(cfg, "Which instance?")
                 if n:
-                    show_menu(cfg, n)
+                    show_menu(cfg, n, log)
                     continue
             elif i == 3:
                 n = pick_instance(cfg, "Delete which instance?")
@@ -1738,6 +1856,14 @@ def main(argv):
                 delete_instance(cfg, n, log_line)
         elif cmd == "upgrade":
             upgrade_all(cfg, log_line, n)
+        elif cmd in ("suspend", "resume"):
+            if n is None:
+                # No "all" here on purpose: stopping every instance is not something to type by
+                # accident, and resuming them all at once would start 36 pods in one go.
+                print(f"supaspin {cmd} N  - which instance? ({cmd} takes one number)",
+                      file=sys.stderr)
+                return 2
+            (suspend_instance if cmd == "suspend" else resume_instance)(cfg, n, log_line)
         elif cmd == "push-env":
             return push_env_command(cfg, argv[2:])
         elif cmd == "mail":

tests/test_supaspin.py

@@ -1105,3 +1105,247 @@ class HostPortRollout(unittest.TestCase):
         self.assertNotIn("strategy", d["spec"])
         self.assertEqual(d["spec"]["template"]["spec"]["containers"][0]["ports"][0]["hostPort"],
                          sp.pg_port(1))
+
+
+class SuspendResume(unittest.TestCase):
+    """Suspending an instance stops its pods and keeps everything else: the disks, the passwords,
+    the certificate and the hostname. Resuming starts it again with the same data."""
+
+    RUNNING = {
+        "deployment": {
+            "analytics": {"enabled": True,
+                          "resources": {"limits": {"memory": "1536Mi"},
+                                        "requests": {"memory": "128Mi"}}},
+            "db": {"resources": {"limits": {"memory": "2048Mi"},
+                                 "requests": {"memory": "512Mi"}}},
+        },
+        "secret": {"jwt": {"secret": "keep-me"}, "db": {"password": "keep-me-too"}},
+        "persistence": {"db": {"enabled": True, "size": "2048Mi"}},
+    }
+
+    def setUp(self):
+        self.calls = []
+        self.written = {}
+        self.log = []
+        self.waited = []
+
+    @contextlib.contextmanager
+    def fake_helm(self, stored):
+        P = collections.namedtuple("P", "returncode stdout stderr")
+
+        def helm(*args, check=True):
+            self.calls.append(list(args))
+            if args[0] == "get":
+                return P(0, yaml.safe_dump(stored), "")
+            if args[0] == "upgrade":
+                with open(args[args.index("-f") + 1]) as f:
+                    self.written = yaml.safe_load(f)
+            return P(0, "", "")
+
+        with mock.patch.object(sp, "helm", helm), \
+                mock.patch.object(sp, "wait_ready",
+                                  lambda n, log, **kw: self.waited.append(("ready", n))), \
+                mock.patch.object(sp, "wait_gone",
+                                  lambda n, log, **kw: self.waited.append(("gone", n))), \
+                mock.patch.object(sp, "STATE_DIR", tempfile.mkdtemp()):
+            yield
+
+    def suspended(self):
+        return sp.set_replicas(yaml.safe_load(yaml.safe_dump(self.RUNNING)), 0)
+
+    # ---- the setting itself ----
+
+    def test_set_replicas_covers_every_service(self):
+        v = sp.set_replicas({}, 0)
+        self.assertEqual(sorted(v["deployment"]), sorted(sp.SERVICES))
+        self.assertTrue(all(d["replicaCount"] == 0 for d in v["deployment"].values()))
+        self.assertTrue(sp.is_suspended(v))
+
+    def test_a_service_missing_the_setting_counts_as_running(self):
+        self.assertFalse(sp.is_suspended(self.RUNNING))
+        self.assertFalse(sp.is_suspended({"deployment": {}}))
+
+    def test_one_service_left_running_is_not_suspended(self):
+        v = sp.set_replicas({}, 0)
+        v["deployment"]["kong"]["replicaCount"] = 1
+        self.assertFalse(sp.is_suspended(v))
+
+    # ---- suspend ----
+
+    def test_suspend_stops_every_service_and_keeps_the_rest(self):
+        with self.fake_helm(self.RUNNING):
+            self.assertTrue(sp.suspend_instance(CFG, 1, self.log.append))
+        for svc in sp.SERVICES:
+            self.assertEqual(self.written["deployment"][svc]["replicaCount"], 0)
+        self.assertEqual(self.written["secret"]["jwt"]["secret"], "keep-me")
+        self.assertEqual(self.written["secret"]["db"]["password"], "keep-me-too")
+        self.assertEqual(self.written["persistence"]["db"]["size"], "2048Mi")
+        # the memory caps are kept as they were: they apply again on resume
+        self.assertEqual(self.written["deployment"]["analytics"]["resources"]["limits"]["memory"],
+                         "1536Mi")
+        self.assertEqual(self.waited, [("gone", 1)])
+
+    def test_suspend_waits_for_the_pods_to_be_gone_not_for_them_to_be_ready(self):
+        with self.fake_helm(self.RUNNING):
+            sp.suspend_instance(CFG, 2, self.log.append)
+        self.assertEqual([w[0] for w in self.waited], ["gone"])
+
+    def test_suspending_a_suspended_instance_changes_nothing(self):
+        with self.fake_helm(self.suspended()):
+            self.assertFalse(sp.suspend_instance(CFG, 1, self.log.append))
+        self.assertEqual([c[0] for c in self.calls], ["get"])
+        self.assertEqual(self.waited, [])
+
+    def test_the_values_file_with_the_secrets_is_deleted_again(self):
+        with self.fake_helm(self.RUNNING):
+            sp.suspend_instance(CFG, 1, self.log.append)
+        path = [c[c.index("-f") + 1] for c in self.calls if c[0] == "upgrade"][0]
+        self.assertFalse(os.path.exists(path))
+
+    # ---- resume ----
+
+    def test_resume_starts_every_service_again(self):
+        with self.fake_helm(self.suspended()):
+            self.assertTrue(sp.resume_instance(CFG, 3, self.log.append))
+        for svc in sp.SERVICES:
+            self.assertEqual(self.written["deployment"][svc]["replicaCount"], 1)
+        self.assertFalse(sp.is_suspended(self.written))
+        self.assertEqual(self.waited, [("ready", 3)])
+
+    def test_resuming_a_running_instance_changes_nothing(self):
+        with self.fake_helm(self.RUNNING):
+            self.assertFalse(sp.resume_instance(CFG, 1, self.log.append))
+        self.assertEqual([c[0] for c in self.calls], ["get"])
+        self.assertEqual(self.waited, [])
+
+    def test_a_suspended_instance_keeps_its_data_settings(self):
+        with self.fake_helm(self.suspended()):
+            sp.resume_instance(CFG, 1, self.log.append)
+        self.assertEqual(self.written["persistence"]["db"]["size"], "2048Mi")
+        self.assertEqual(self.written["secret"]["jwt"]["secret"], "keep-me")
+
+    # ---- upgrade must not trip over a suspended instance ----
+
+    def test_upgrade_leaves_a_suspended_instance_suspended_and_does_not_wait(self):
+        with self.fake_helm(self.suspended()):
+            sp.upgrade_instance(CFG, 1, self.log.append)
+        self.assertTrue(sp.is_suspended(self.written))        # not woken up
+        self.assertEqual(self.waited, [])                     # would never finish
+        self.assertEqual(self.written["deployment"]["analytics"]["resources"]["limits"]["memory"],
+                         f"{sp.MEMORY['analytics'][1]}Mi")    # new caps stored for the resume
+
+    def test_upgrade_still_waits_for_a_running_instance(self):
+        with self.fake_helm(self.RUNNING):
+            sp.upgrade_instance(CFG, 1, self.log.append)
+        self.assertEqual(self.waited, [("ready", 1)])
+
+
+class InstanceState(unittest.TestCase):
+    """What `supaspin list` says about an instance, read from what the cluster is asked to run."""
+
+    def state(self, deployments, statefulsets):
+        def kjson(*args):
+            kind = args[1]
+            counts = deployments if kind == "deployments" else statefulsets
+            return {"items": [{"spec": {"replicas": c}} for c in counts]}
+
+        with mock.patch.object(sp, "kjson", kjson):
+            return sp.instance_state(1)
+
+    def test_running(self):
+        self.assertEqual(self.state([1] * 11, [1]), "running")
+
+    def test_suspended(self):
+        self.assertEqual(self.state([0] * 11, [0]), "suspended")
+
+    def test_the_database_alone_still_running_is_reported_honestly(self):
+        self.assertEqual(self.state([0] * 11, [1]), "partly suspended")
+
+    def test_nothing_there(self):
+        self.assertEqual(self.state([], []), "unknown")
+
+    def test_the_list_shows_the_state_and_no_tunnel_for_a_sleeping_instance(self):
+        rows = [{"n": 1, "host": "supa1.example.com", "pods": "0/0", "state": "suspended",
+                 "memory": "n/a", "disk": "db 1/2M", "env": "/data/supabase/1/.env"}]
+        out = io.StringIO()
+        with mock.patch.object(sp, "list_rows", lambda cfg: rows), \
+                contextlib.redirect_stdout(out):
+            sp.print_list(CFG)
+        text = out.getvalue()
+        self.assertIn("suspended", text)
+        self.assertIn("Resume it", text)          # the menu line, not a command to remember
+        self.assertNotIn("ssh -N -L", text)
+
+
+class InstanceMenu(unittest.TestCase):
+    """Stopping and starting an instance lives inside the instance you are looking at: one line,
+    worded for the state the instance is in, so there is no second command to remember."""
+
+    def run_menu(self, state, choose):
+        """Draw the menu for an instance in `state`, pick the item whose text `choose` matches
+        (None: leave at once). Returns (the item texts, what was called)."""
+        seen, called = [], []
+
+        def menu(title, items):
+            seen.append((title, list(items)))
+            if choose is None:
+                return None
+            for i, text in enumerate(items):
+                if choose in text:
+                    return i
+            raise AssertionError(f"no item matching {choose!r} in {items}")
+
+        calls = {"suspend": lambda cfg, n, log: called.append(("suspend", n)),
+                 "resume": lambda cfg, n, log: called.append(("resume", n))}
+        out = io.StringIO()
+        with mock.patch.object(sp, "menu", menu), \
+                mock.patch.object(sp, "instance_state", lambda n: state), \
+                mock.patch.object(sp, "pause", lambda: (_ for _ in ()).throw(StopIteration)), \
+                mock.patch.object(sp, "suspend_instance", calls["suspend"]), \
+                mock.patch.object(sp, "resume_instance", calls["resume"]), \
+                mock.patch.object(sp, "read_env", lambda cfg, n: "A=b\n"), \
+                contextlib.redirect_stdout(out):
+            try:
+                sp.show_menu(CFG, 2, lambda *a, **k: None)
+            except StopIteration:
+                pass  # the menu would loop for ever; stop at the first "press Enter"
+        return seen[0][1], called, out.getvalue(), seen[0][0]
+
+    def test_a_running_instance_offers_to_suspend_it(self):
+        items, called, _, title = self.run_menu("running", None)
+        self.assertTrue(any("Suspend it" in t for t in items), items)
+        self.assertFalse(any("Resume" in t for t in items), items)
+        self.assertIn("running", title)
+
+    def test_a_suspended_instance_offers_to_resume_it(self):
+        items, called, _, title = self.run_menu("suspended", None)
+        self.assertTrue(any("Resume it" in t for t in items), items)
+        self.assertFalse(any("Suspend" in t for t in items), items)
+        self.assertIn("suspended", title)
+
+    def test_choosing_it_suspends_this_instance(self):
+        _, called, _, _ = self.run_menu("running", "Suspend it")
+        self.assertEqual(called, [("suspend", 2)])
+
+    def test_choosing_it_resumes_this_instance(self):
+        _, called, _, _ = self.run_menu("suspended", "Resume it")
+        self.assertEqual(called, [("resume", 2)])
+
+    def test_the_tunnel_of_a_sleeping_instance_says_why_it_is_pointless(self):
+        _, _, text, _ = self.run_menu("suspended", "Tunnel")
+        self.assertIn("suspended", text)
+        self.assertNotIn("ssh -N -L", text)
+
+    def test_the_picker_names_the_state_of_every_instance(self):
+        seen = []
+
+        def menu(title, items):
+            seen.append(list(items))
+            return None
+
+        with mock.patch.object(sp, "menu", menu), \
+                mock.patch.object(sp, "existing_numbers", lambda cfg: {1, 2}), \
+                mock.patch.object(sp, "instance_state", lambda n: "suspended" if n == 2 else "running"):
+            sp.pick_instance(CFG, "Which instance?")
+        self.assertEqual(seen[0], ["1  supa1.example.com  (running)",
+                                   "2  supa2.example.com  (suspended)"])