mimas 0.1.0

data/lib/mimas/hooks.rb

@@ -0,0 +1,25 @@
+module Mimas
+  class Hooks
+    POINTS = [ :before_push, :after_push ]
+
+    def initialize
+      @hooks = Hash[POINTS.zip([[], [], []])].freeze
+    end
+
+    def [](hook)
+      @hooks[hook]
+    end
+
+    def merge(with_hooks)
+      POINTS.each do |point|
+        @hooks[point].push(*with_hooks[point])
+      end
+    end
+
+    POINTS.each do |point|
+      define_method(point) do |&block|
+        @hooks[point] << block
+      end
+    end
+  end
+end

data/lib/mimas/plugins.rb

@@ -0,0 +1,19 @@
+module Mimas
+  MUTEX = Mutex.new
+  private_constant :MUTEX
+
+  PLUGINS = Set.new([])
+  private_constant :PLUGINS
+
+  module Plugins
+    extend self
+
+    def fetch
+      MUTEX.synchronize { PLUGINS }
+    end
+
+    def register(plugin)
+      MUTEX.synchronize { PLUGINS << plugin }
+    end
+  end
+end

data/lib/mimas/scripts/configure_ruby.sh

@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+
+set -e
+
+cat << STRING >> ~/.profile
+
+# Use chruby to auto-switch Ruby versions
+source /usr/local/share/chruby/chruby.sh
+source /usr/local/share/chruby/auto.sh
+STRING
+
+source /usr/local/share/chruby/chruby.sh
+source /usr/local/share/chruby/auto.sh
+
+echo 'gem: --no-document' >> ~/.gemrc
+
+gem update --system
+gem install bundler
+bundle config set --global without 'development test'

data/lib/mimas/scripts/create_deploy_user.sh

@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+export DEBIAN_FRONTEND=noninteractive
+
+DEPLOY_USER="${DEPLOY_USER:-deploy}"
+
+if ! id $DEPLOY_USER >/dev/null 2>&1; then
+  printf "Creating the $DEPLOY_USER user\n\n"
+  useradd $DEPLOY_USER -s /bin/bash -m
+  printf "$DEPLOY_USER user created\n\n"
+else
+  printf "$DEPLOY_USER user exists. Configuring the user..."
+fi
+
+sudo passwd -ld $DEPLOY_USER
+sudo loginctl enable-linger $DEPLOY_USER
+sudo rsync --archive --chown=$DEPLOY_USER:$DEPLOY_USER ~/.ssh /home/$DEPLOY_USER
+
+sudo touch /etc/logrotate.d/$DEPLOY_USER
+sudo cat << STRING > /etc/logrotate.d/$DEPLOY_USER
+/home/$DEPLOY_USER/http/*/logs/*.log {
+  daily
+  rotate 30
+  compress
+  missingok
+}
+STRING
+
+printf "$DEPLOY_USER user configured\n\n"

data/lib/mimas/scripts/harden.sh

@@ -0,0 +1,125 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+export DEBIAN_FRONTEND=noninteractive
+
+printf "Upgrading APT\n\n"
+apt-get update && apt-get -y upgrade
+
+printf "Enabling UFW\n\n"
+ufw default deny incoming
+ufw default allow outgoing
+ufw allow OpenSSH
+ufw allow http
+ufw allow https
+ufw --force enable
+printf "UFW enabled\n\n"
+
+printf "Creating the admin user\n\n"
+
+if ! id admin >/dev/null 2>&1; then
+  # Add a new user, set the default shell, and create a home directory
+  useradd admin -s /bin/bash -m
+fi
+
+# Disable password login
+passwd -ld admin
+# Sync the private keys to allow SSH access
+rsync --archive --chown=admin:admin ~/.ssh /home/admin
+
+# Allow passwordless sudo for `admin`
+echo "%admin $(cat /etc/hostname)=(root) NOPASSWD:ALL" > /etc/sudoers.d/admin
+
+# Validate the modified sudoers file
+if ! visudo -c -f /etc/sudoers.d/admin; then
+  printf "Failed to configure passwordless sudo for the admin user.\n\n"
+  exit 1
+fi
+
+printf "Installing fail2ban\n\n"
+# Install fail2ban to block abusive IPs
+apt-get install fail2ban -y
+touch /etc/fail2ban/jail.local
+cat << STRING >> /etc/fail2ban/jail.local
+[DEFAULT]
+bantime = 1d
+findtime = 10m
+maxretry = 5
+
+[sshd]
+enabled = true
+STRING
+systemctl enable fail2ban
+printf "fail2ban installed and enabled\n\n"
+
+printf "Enhanching kernel and system security...\n\n"
+cat << STRING > /etc/sysctl.d/mimas-security.conf
+# Disable ICMP redirects.
+net.ipv4.conf.all.send_redirects = 0
+net.ipv4.conf.default.send_redirects = 0
+net.ipv4.conf.all.accept_redirects = 0
+net.ipv4.conf.default.accept_redirects = 0
+net.ipv6.conf.all.accept_redirects = 0
+net.ipv6.conf.default.accept_redirects = 0
+
+# ICMP noise hygiene.
+net.ipv4.icmp_echo_ignore_broadcasts = 1
+net.ipv4.icmp_ignore_bogus_error_responses = 1
+
+# Drop spoofed/martian packets at the door.
+net.ipv4.conf.all.rp_filter = 1
+net.ipv4.conf.default.rp_filter = 1
+net.ipv4.conf.all.accept_source_route = 0
+net.ipv4.conf.default.accept_source_route = 0
+net.ipv6.conf.all.accept_source_route = 0
+net.ipv6.conf.default.accept_source_route = 0
+
+# SYN-flood resilience as the server handles
+# port 80/443 traffic from the internet.
+net.ipv4.tcp_syncookies = 1
+net.ipv4.tcp_synack_retries = 2
+net.ipv4.tcp_syn_retries = 5
+
+# Hide kernel internals from unprivileged eyes (kernel pointer leaks, dmesg,
+# perf side channels) and disable unprivileged eBPF.
+kernel.kptr_restrict = 2
+kernel.dmesg_restrict = 1
+kernel.perf_event_paranoid = 3
+kernel.unprivileged_bpf_disabled = 1
+net.core.bpf_jit_harden = 2
+
+# Only processes with CAP_SYS_PTRACE may ptrace.
+kernel.yama.ptrace_scope = 2
+
+# Block runtime kernel replacement via kexec (one-way until reboot).
+# CAVEAT: if you ever set up kdump crash dumps, remove this line first.
+kernel.kexec_load_disabled = 1
+
+# Filesystem link/dump hardening.
+fs.protected_hardlinks = 1
+fs.protected_symlinks = 1
+fs.suid_dumpable = 0
+
+# Turn off Martian logging
+net.ipv4.conf.all.log_martians = 0
+net.ipv4.conf.default.log_martians = 0
+STRING
+
+sysctl --system >/dev/null
+
+printf "System security settings applied.\n\n"
+
+printf "Installing molly-guard\n\n"
+apt-get install molly-guard
+printf "molly-guard installed.\n\n"
+
+# Disable root login and password authentication
+touch /etc/ssh/sshd_config.d/mimas.conf
+cat << STRING >> /etc/ssh/sshd_config.d/mimas.conf
+PermitRootLogin no
+PasswordAuthentication no
+STRING
+systemctl restart ssh
+passwd -ld root
+
+printf "Password auth and root login disabled\n\n"

data/lib/mimas/scripts/install_caddy.sh

@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+export DEBIAN_FRONTEND=noninteractive
+
+# Update the apt source for Caddy
+sudo apt-get install -y debian-keyring debian-archive-keyring apt-transport-https
+curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' | sudo gpg --dearmor --no-tty --batch --yes -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg
+curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' | sudo tee /etc/apt/sources.list.d/caddy-stable.list
+sudo chmod o+r /usr/share/keyrings/caddy-stable-archive-keyring.gpg
+sudo chmod o+r /etc/apt/sources.list.d/caddy-stable.list
+sudo apt-get update
+
+# Download and install the Caddy binary
+mkdir ~/tmp
+cd ~/tmp
+apt-get download caddy
+mkdir -p caddy-unpack
+dpkg -x $(find caddy*.deb) ~/tmp/caddy-unpack
+sudo mv ~/tmp/caddy-unpack/usr/bin/caddy /usr/local/bin/caddy
+cd ~/
+rm -rf ~/tmp
+
+DEPLOY_USER="${DEPLOY_USER:-deploy}"
+
+# Give the deploy user sudo access to control the Caddy service only
+sudo touch /etc/sudoers.d/$DEPLOY_USER
+
+cat << STRING >> /etc/sudoers.d/$DEPLOY_USER
+deploy $(cat /etc/hostname)=(root) NOPASSWD: /bin/systemctl reload caddy
+deploy $(cat /etc/hostname)=(root) NOPASSWD: /bin/systemctl status caddy
+STRING
+
+sudo mkdir -p /home/$DEPLOY_USER/http
+sudo touch /home/$DEPLOY_USER/http/Caddyfile
+sudo touch /home/$DEPLOY_USER/http/caddy.global
+
+sudo cat <<STRING >> /home/$DEPLOY_USER/http/caddy.global
+{
+  servers {
+    protocols h1 h2
+  }
+}
+STRING
+
+sudo cat <<STRING >> /home/$DEPLOY_USER/http/Caddyfile
+import caddy.global
+import */Caddyfile
+STRING
+
+sudo chown $DEPLOY_USER:$DEPLOY_USER -R /home/$DEPLOY_USER

data/lib/mimas/scripts/install_ruby_prerequisites.sh

@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+export DEBIAN_FRONTEND=noninteractive
+
+# Install Ruby prerequisites
+sudo apt-get install $PREREQUISITES -y
+
+# Install Ruby Install
+wget https://github.com/postmodern/ruby-install/releases/download/v0.10.2/ruby-install-0.10.2.tar.gz
+tar -xzvf ruby-install-0.10.2.tar.gz
+cd ruby-install-0.10.2/
+sudo make install
+cd ..
+rm ruby-install-0.10.2.tar.gz
+rm -rf ruby-install-0.10.2/
+
+# Install chruby
+wget https://github.com/postmodern/chruby/releases/download/v0.3.9/chruby-0.3.9.tar.gz
+tar -xzvf chruby-0.3.9.tar.gz
+cd chruby-0.3.9/
+sudo make install
+cd ..
+rm chruby-0.3.9.tar.gz
+rm -rf chruby-0.3.9/
+

data/lib/mimas/server/caddy.rb

@@ -0,0 +1,17 @@
+module Mimas
+  class Server
+    module Caddy
+      def install_caddy(sudo_user:)
+        ssh(self, user: sudo_user) do |session|
+          session.script("install_caddy", sudo: true, vars: { DEPLOY_USER: self.user })
+
+          caddy_service = template("caddy.service", deploy_user: self.user)
+          session.upload StringIO.new(caddy_service), "/tmp/caddy.service"
+          session.run "sudo mv /tmp/caddy.service /etc/systemd/system/caddy.service"
+
+          session.run "sudo systemctl daemon-reload && sudo systemctl enable --now caddy"
+        end
+      end
+    end
+  end
+end

data/lib/mimas/server/console.rb

@@ -0,0 +1,34 @@
+module Mimas
+  class Server
+    module Console
+      def start_console(site)
+        console_command = site.console
+
+        system('stty cbreak -echo')
+        Net::SSH.start(host, user) do |session|
+          session.open_channel do |channel|
+            channel.request_pty do
+              channel.exec("cd #{current_path(site)} && /bin/bash -lc #{console_command}") do
+                channel.on_data do |_, data|
+                  $stdout.print(data) if data
+                end
+
+                channel.on_extended_data do |_, data|
+                  $stdout.print(data) if data
+                end
+
+                session.listen_to($stdin) do |stdin|
+                  input = stdin.readpartial(1024)
+                  channel.send_data(input) unless input.empty?
+                end
+              end
+            end
+          end
+          session.loop
+        end
+      ensure
+        system('stty sane')
+      end
+    end
+  end
+end

data/lib/mimas/server/deploy_user.rb

@@ -0,0 +1,11 @@
+module Mimas
+  class Server
+    module DeployUser
+      def setup_deploy_user(sudo_user:)
+        ssh(self, user: sudo_user) do |session|
+          session.script("create_deploy_user", sudo: true, vars: { DEPLOY_USER: self.user })
+        end
+      end
+    end
+  end
+end

data/lib/mimas/server/harden.rb

@@ -0,0 +1,20 @@
+module Mimas
+  class Server
+    module Harden
+      def harden
+        ssh(self, user: "root") do |session|
+          session.script("harden", vars: { DEPLOY_USER: self.user })
+
+          say "Rebooting server...".bold.blue
+          session.run "reboot.no-molly-guard"
+        rescue SSH::Session::NonZeroExitCode => e
+          say "Sorry, an error occured while hardening the server".bold.red
+          say e.to_s.bold.red
+          raise e
+        rescue Errno::ECONNRESET
+          # Triggered by reboot
+        end
+      end
+    end
+  end
+end

data/lib/mimas/server/prerequisites.rb

@@ -0,0 +1,25 @@
+module Mimas
+  class Server
+    module Prerequisites
+      extend self
+
+      def for_ruby
+        %w[
+            xz-utils
+            build-essential
+            zlib1g-dev
+            libyaml-dev
+            libssl-dev
+            libncurses-dev
+            libffi-dev
+            rustc
+            libjemalloc-dev
+        ]
+      end
+
+      def utilities
+        %w[curl jq]
+      end
+    end
+  end
+end

data/lib/mimas/server/ruby.rb

@@ -0,0 +1,37 @@
+module Mimas
+  class Server
+    module Ruby
+      def install_ruby_prerequisites(sudo_user:)
+        ssh(self, user: sudo_user) do |session|
+          prerequisites = Prerequisites.for_ruby + Prerequisites.utilities
+          prerequisites = prerequisites.join(" ")
+
+          session.script("install_ruby_prerequisites",
+            sudo: true,
+            vars: { PREREQUISITES: "'#{prerequisites}'" }
+          )
+        end
+      end
+
+      def install_ruby(version: Config.current.ruby_version)
+        ssh(self) do |session|
+          current_ruby = session.run "/usr/bin/env bash -lc 'which ruby'", capture: true, silent: true
+
+          if current_ruby != ""
+            ruby_grep = session.run "/usr/bin/env bash -lc 'chruby' | grep #{version}", capture: true, silent: true
+            if ruby_grep.size > 0
+              return say "Ruby #{version} is already installed!"
+            end
+          end
+
+          session.run "ruby-install --no-install-deps --cleanup #{version} -- --enable-yjit --with-jemalloc --disable-install-rdoc"
+          session.run "echo '#{version}' > ~/.ruby-version"
+
+          if current_ruby == ""
+            session.script("configure_ruby")
+          end
+        end
+      end
+    end
+  end
+end

data/lib/mimas/server.rb

@@ -0,0 +1,37 @@
+module Mimas
+  class Server
+    include SSH, Template, Terminal::Printer
+
+    # Server setup helpers
+    include Harden, DeployUser, Ruby, Caddy
+
+    attr_reader :name, :host, :user, :ssh_options
+
+    def initialize(name, args)
+      @name = name
+      @host = args[:host]
+      @user = args[:user]
+      @ssh_options = args.except(:host, :user)
+    end
+
+    def user_home
+      @user_home ||= Pathname.new(File.join("/", "home", @user.to_s))
+    end
+
+    def http_root
+      @http_root ||= user_home.join("http")
+    end
+
+    def user_systemd_path
+      @user_systemd_path ||= user_home.join(".config", "systemd", "user")
+    end
+
+    def site_root(site)
+      http_root.join("#{site.domain}")
+    end
+
+    def current_path(site)
+      site_root(site).join("current")
+    end
+  end
+end

data/lib/mimas/site.rb

@@ -0,0 +1,24 @@
+module Mimas
+  class Site
+    attr_reader :name
+    def initialize(name, args)
+      @name = name
+      args[:services]           ||= []
+      args[:deploy]             ||= "bundle install"
+      args[:env]                ||= ""
+      args[:healthcheck_path]   ||= "/"
+
+      args.each do |key, value|
+        define_singleton_method(key) { value }
+      end
+    end
+
+    def static?
+      !ruby_app?
+    end
+
+    def ruby_app?
+      services.any?
+    end
+  end
+end

data/lib/mimas/ssh.rb

@@ -0,0 +1,78 @@
+module Mimas
+  module SSH
+    def ssh(server, user: nil, &block)
+      Session.new(server, user: user).perform(&block)
+    end
+
+    class Session
+      class NonZeroExitCode < StandardError
+        attr_reader :exit_code, :output
+        def initialize(command:, exit_code:, output:)
+          @command = command
+          @exit_code = exit_code
+          @output = output
+        end
+
+        def to_s
+          "'#{@command}' exited with code: #{@exit_code}"
+        end
+      end
+
+      def initialize(server, user:)
+        @server = server
+        @user = user || server.user
+      end
+
+      def perform(&block)
+        @ssh = Net::SSH.start(@server.host, @user, timeout: 60, **@server.ssh_options)
+        @hostname = run("cat /etc/hostname", capture: true).chomp
+        yield(self)
+      ensure
+        @ssh&.close
+      end
+
+      def run(command, capture: false, silent: false)
+        status = {}
+        output = ""
+        @ssh.exec!(command, status: status) do |channel, stream, data|
+          if stream == :stdout && capture
+            output << data
+          elsif stream == :stderr
+            print "#{data}".bold.red unless capture
+          else
+            print "#{data}".white unless capture
+          end
+        end
+
+        if status[:exit_code] != 0 && !silent
+          raise NonZeroExitCode.new(command: command, exit_code: status[:exit_code], output: output)
+        end
+
+        return output if capture
+      end
+
+      def upload(source_file, destination_file)
+        @ssh.scp.upload! source_file, destination_file
+      end
+
+      def script(name, sudo: false, vars: {})
+        filename = "#{name}.sh"
+        remote_location = "/tmp/#{filename}"
+
+        source_path = File.expand_path("./scripts/#{filename}", __dir__)
+        upload source_path, remote_location
+        run "chmod +x #{remote_location}"
+
+        vars = vars.to_a.map { it.join("=") }.join(" ")
+
+        exec_command = remote_location
+        exec_command = "#{vars} #{exec_command}".strip
+        exec_command = "sudo #{exec_command}" if sudo
+
+        run exec_command
+
+        run "rm #{remote_location}"
+      end
+    end
+  end
+end

data/lib/mimas/template.rb

@@ -0,0 +1,28 @@
+require "fileutils"
+
+module Mimas
+  module Template
+    BASE_DIRECTORY = File.join(__dir__, "templates")
+
+    def template(file_name, dir: BASE_DIRECTORY, **vars)
+      template = read_template(file_name, dir: dir)
+      template.result_with_hash(vars)
+    end
+
+    def read_file(file_name, dir: BASE_DIRECTORY)
+      File.read(File.join(dir, file_name))
+    end
+
+    def copy_file(destination, source_file_name, rename: nil)
+      source = File.join(BASE_DIRECTORY, source_file_name)
+      FileUtils.copy(source, File.join(destination, rename || source_file_name))
+    end
+
+    private
+
+      def read_template(file_name, dir:)
+        file = File.read(File.join(dir, "#{file_name}.erb"))
+        ERB.new(file, trim_mode: "-")
+      end
+  end
+end

data/lib/mimas/templates/Caddyfile.ruby.erb

@@ -0,0 +1,12 @@
+<%= domain %> {
+  reverse_proxy {
+    to unix/<%= unix_socket %>
+
+    lb_try_duration 5s
+  }
+
+  log {
+    format console
+    output file <%= site_root %>/logs/caddy.log
+  }
+}

data/lib/mimas/templates/Caddyfile.static.erb

@@ -0,0 +1,15 @@
+<%= domain %> {
+  root <%= site_root %>/current/root
+  encode
+  file_server
+
+  handle_errors {
+    rewrite /404.html
+    file_server
+  }
+
+  log {
+    format console
+    output file <%= site_root %>/logs/caddy.log
+  }
+}

data/lib/mimas/templates/caddy.service.erb

@@ -0,0 +1,19 @@
+[Unit]
+Description=Caddy
+Documentation=https://caddyserver.com/docs/
+After=network.target network-online.target
+Requires=network-online.target
+
+[Service]
+Type=notify
+User=<%= deploy_user %>
+ExecStart=/usr/local/bin/caddy run --environ --config /home/<%= deploy_user %>/http/Caddyfile
+ExecReload=/usr/local/bin/caddy reload --config /home/<%= deploy_user %>/http/Caddyfile --force
+TimeoutStopSec=5s
+LimitNOFILE=1048576
+PrivateTmp=true
+ProtectSystem=full
+AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
+
+[Install]
+WantedBy=multi-user.target