@aaricchen1991/deploy 0.1.0

package/PUBLISHING.md

@@ -0,0 +1,131 @@
+# 发布 @aaricchen1991/deploy 到 npm
+
+本文说明如何将 `@aaricchen1991/deploy` 包发布到 npm，以便用户通过 `npx @aaricchen1991/deploy` 使用。
+
+## 前置条件
+
+1. **npm 账号**  
+   在 [npmjs.com](https://www.npmjs.com/) 注册并登录。
+
+2. **@aaricchen1991 命名空间**
+   - 包名为 `@aaricchen1991/deploy`，使用 npm 用户名（或组织）`aaricchen1991` 作为 scope。个人包无需创建 Organization，使用当前登录账号即可发布到 `@aaricchen1991`。
+
+3. **登录 npm**
+   ```bash
+   npm login
+   ```
+   按提示输入用户名、密码与邮箱/OTP。
+
+4. **双因素认证（2FA）或 Granular Access Token**  
+   npm 要求发布包时必须满足其一：
+   - **启用账号 2FA**：在 [npm 账号设置](https://www.npmjs.com/settings/~aaricchen1991/account) 中开启 Two-Factor Authentication，发布时 `npm publish` 会提示输入 OTP。
+   - **使用 Granular Access Token（适合 CI/脚本）**：在 [Access Tokens](https://www.npmjs.com/settings/~aaricchen1991/tokens) 创建 Token，权限勾选 **Publish packages**，若需在无 2FA 环境下发布可勾选 **Bypass 2FA for publish**；发布时用 `npm config set //registry.npmjs.org/:_authToken YOUR_TOKEN` 或环境变量 `NPM_TOKEN`。
+
+   若未满足，会报错：`403 Forbidden - Two-factor authentication or granular access token with bypass 2fa enabled is required to publish packages`。
+
+## 发布前准备
+
+### 1. 开放发布（当前为 private）
+
+仓库内 `package.json` 中通常为 `"private": true`，避免误发到 npm。发布前需改为可发布：
+
+- **方式 A**：临时改为 `"private": false` 再执行 `npm publish`，发布后可改回 `true`。
+- **方式 B**：在 CI 或本地发布脚本里用 `npm pkg set private=false` 再 publish，不提交该改动。
+
+### 2. 控制发布内容（推荐）
+
+在 `apps/deploy/package.json` 中增加 `files` 字段，只发布构建产物和必要文件，避免把源码、测试、配置等发到 npm：
+
+```json
+{
+  "name": "@aaricchen1991/deploy",
+  "version": "0.1.0",
+  "files": ["dist", "README.md"]
+}
+```
+
+未设置 `files` 时，npm 会按 `.npmignore` 或默认规则排除；设置后仅包含列出的文件/目录。
+
+### 3. 构建
+
+在仓库根目录或 `apps/deploy` 目录下执行：
+
+```bash
+# 在仓库根目录
+pnpm --filter @aaricchen1991/deploy build
+
+# 或在 apps/deploy 下
+cd apps/deploy && pnpm build
+```
+
+确认 `apps/deploy/dist/` 下已生成 `cli.js` 及依赖的 `.js` 等文件。
+
+## 发布命令
+
+### 在 monorepo 根目录发布指定包
+
+```bash
+# 从仓库根目录发布 apps/deploy
+npm publish apps/deploy --access public
+```
+
+- `--access public`：作用域包（如 `@aaricchen1991/deploy`）默认视为 restricted，需显式指定 `public` 才能被所有人安装。
+
+### 进入包目录再发布
+
+```bash
+cd apps/deploy
+pnpm build
+npm pkg set private=false
+npm publish --access public
+# 如需保持仓库不发布，可再改回：npm pkg set private=true
+```
+
+## 版本号
+
+- 遵循 [语义化版本](https://semver.org/lang/zh-CN/)（如 `0.1.0`、`1.0.0`）。
+- 修改版本号：
+  ```bash
+  cd apps/deploy
+  npm version patch   # 0.1.0 -> 0.1.1
+  npm version minor   # 0.1.0 -> 0.2.0
+  npm version major   # 0.1.0 -> 1.0.0
+  ```
+  会同时改 `package.json` 的 `version` 并产生一次 git commit + tag（若未加 `--no-git-tag-version`）。
+
+## 发布后使用方式
+
+用户可这样使用已发布的包：
+
+```bash
+# 直接执行（不安装到本地）
+npx @aaricchen1991/deploy --help
+npx @aaricchen1991/deploy init --config domains.yaml
+
+# 全局安装后使用命令 n2-deploy
+npm install -g @aaricchen1991/deploy
+n2-deploy init --config domains.yaml
+```
+
+## 可选：发布前检查清单
+
+- [ ] 已执行 `pnpm --filter @aaricchen1991/deploy build`，且 `dist/` 内容正确
+- [ ] `package.json` 中 `version` 已更新，且未带 `-dev` 等后缀（除非发 beta）
+- [ ] 已设置 `files` 或通过 `.npmignore` 控制发布内容
+- [ ] 已 `npm login`，且有权限发布到 `@aaricchen1991` 作用域
+- [ ] 使用 `npm publish --access public`（针对作用域包）
+- [ ] 发布后可用 `npx @aaricchen1991/deploy --version` 校验版本
+
+## 常见问题
+
+**Q: 提示 "You must sign up for private packages"**  
+A: 作用域包默认视为私有，需加 `--access public` 发布为公开包。
+
+**Q: 403 Forbidden**  
+A: 检查是否已登录、是否有该组织/包的发布权限，以及包名是否与 npm 上已有包冲突。
+
+**Q: 403 Forbidden - Two-factor authentication or granular access token with bypass 2fa enabled is required**  
+A: npm 要求发布时必须启用账号 2FA，或使用具有 “Bypass 2FA for publish” 的 Granular Access Token。请在 npm 网站 Account 中开启 2FA，或在 Tokens 中创建并选用上述 Token 后再执行 `npm publish`。
+
+**Q: 发布后 npx 拉到的仍是旧版本**  
+A: 使用 `npx @aaricchen1991/deploy@latest` 或指定版本号 `npx @aaricchen1991/deploy@0.1.0`，并确认本地/缓存已更新。

package/README.md

@@ -0,0 +1,256 @@
+# @aaricchen1991/deploy
+
+服务器部署与运维 CLI（包名 `@aaricchen1991/deploy`，命令 `n2-deploy`）：服务器初始化、Nginx 配置生成、SSL 证书申请/续期及日志查看。设计为在**部署服务器上**执行（或从本机指定配置生成文件）。
+
+## 功能概览
+
+| 命令       | 说明                                                                                 |
+| ---------- | ------------------------------------------------------------------------------------ |
+| `init`     | 服务器初始化（幂等）：安装 Nginx、创建目录、安装 `deploy.sh`、占位证书。可重复执行。 |
+| `nginx`    | 根据域名配置文件生成 Nginx 配置；可选安装到系统并 reload。                           |
+| `ssl`      | 为配置中的全部域名申请/续期 SSL 证书（acme.sh + 阿里云 DNS），并写入统一日志。       |
+| `ssl-logs` | 查看 SSL 操作日志（创建、续期、成功、失败），支持行数、跟随、按动作/结果过滤。       |
+
+## 安装
+
+### 从本仓库使用
+
+在仓库根目录：
+
+```bash
+pnpm install
+pnpm --filter @aaricchen1991/deploy build
+```
+
+执行时需在**仓库根目录**或通过 `--config` 指定域名配置路径：
+
+```bash
+node apps/deploy/dist/cli.js <command> [options]
+```
+
+或使用根目录脚本（会先构建再执行）：
+
+```bash
+pnpm run deploy:cli -- <command> [options]
+```
+
+### 发布为 npm 包后
+
+```bash
+npx @aaricchen1991/deploy --help
+```
+
+（安装后执行的命令仍为 `n2-deploy`，与包名 `@aaricchen1991/deploy` 对应。）
+
+如何将本包发布到 npm，见 [PUBLISHING.md](./PUBLISHING.md)。
+
+## 域名配置文件
+
+域名与端口以 **domains.yaml** 为唯一数据源，格式与仓库内 `scripts/deploy/domains.yaml` 一致：
+
+```yaml
+api:
+  backend_port: 3000
+  domains:
+    - n2-api.example.com
+
+admin:
+  domains:
+    - n2-admin.example.com
+
+tenant:
+  domains:
+    - n2-tenant.example.com
+
+client:
+  domains:
+    - n2-client.example.com
+```
+
+- `api.backend_port`：API 后端端口（Nginx 反向代理目标）。
+- 各应用的 `domains`：该应用对外提供服务的域名列表。
+
+默认读取当前工作目录下的 `domains.yaml`，可通过 `-c, --config <path>` 指定路径。
+
+---
+
+## 命令说明
+
+### init — 服务器初始化
+
+在部署服务器上执行（建议使用 root 或 sudo），完成：
+
+- 检测系统（Alibaba Cloud Linux / CentOS / Ubuntu 等）并安装 Nginx（若未安装）
+- 创建 `/var/www/{admin,tenant,client}`、`/opt/deploy`、`/etc/nginx/ssl` 等目录
+- 将 `deploy.sh` 安装到 `/opt/deploy/`
+- 根据 domains 配置生成占位 SSL 证书与 Nginx 配置并安装，使 Nginx 可正常启动
+
+**用法：**
+
+```bash
+n2-deploy init [options]
+```
+
+| 选项                   | 默认值         | 说明                                                        |
+| ---------------------- | -------------- | ----------------------------------------------------------- |
+| `-c, --config <path>`  | `domains.yaml` | 域名配置文件路径                                            |
+| `--scripts-dir <path>` | 见下方         | 部署脚本目录（含 deploy.sh、server-setup.sh、ssl/_、lib/_） |
+
+**脚本目录解析顺序：**
+
+1. 环境变量 `N2_DEPLOY_SCRIPTS_DIR`
+2. 当前目录下的 `scripts/deploy`（在仓库根目录执行时）
+3. 包内 `assets/deploy`（若存在）
+
+**示例：**
+
+```bash
+# 在仓库根目录执行
+node apps/deploy/dist/cli.js init --config scripts/deploy/domains.yaml
+
+# 指定脚本目录（例如在服务器上单独拷贝了脚本）
+sudo n2-deploy init --config /etc/n2/domains.yaml --scripts-dir /opt/n2-scripts
+```
+
+---
+
+### nginx — 生成/安装 Nginx 配置
+
+根据 domains 配置生成 `n2.conf`（API 反向代理 + 各前端静态站点 + HTTP 跳 HTTPS），可仅生成文件或同时安装到系统并 reload。
+
+**用法：**
+
+```bash
+n2-deploy nginx [options]
+```
+
+| 选项                  | 默认值          | 说明                                                               |
+| --------------------- | --------------- | ------------------------------------------------------------------ |
+| `-c, --config <path>` | `domains.yaml`  | 域名配置文件路径                                                   |
+| `-o, --output <path>` | `nginx/n2.conf` | 生成的配置文件输出路径                                             |
+| `-i, --install`       | —               | 安装到系统 Nginx 目录并执行 `nginx -t` 与 `systemctl reload nginx` |
+
+**示例：**
+
+```bash
+# 仅生成到当前目录
+n2-deploy nginx --config scripts/deploy/domains.yaml --output ./n2.conf
+
+# 生成并安装到系统（需在服务器上且有相应权限）
+sudo n2-deploy nginx --config /etc/n2/domains.yaml --install
+```
+
+---
+
+### ssl — SSL 证书申请/续期
+
+为 domains 配置中的**所有域名**申请或续期证书（Let's Encrypt，通过 acme.sh + 阿里云 DNS API），安装到 `/etc/nginx/ssl/` 并触发 Nginx reload。所有操作会写入 SSL 专用日志，便于排查与审计。
+
+**用法：**
+
+```bash
+n2-deploy ssl [options]
+```
+
+| 选项                    | 默认值                     | 说明                     |
+| ----------------------- | -------------------------- | ------------------------ |
+| `-c, --config <path>`   | `domains.yaml`             | 域名配置文件路径         |
+| `--ali-key <key>`       | 环境变量                   | 阿里云 Access Key ID     |
+| `--ali-secret <secret>` | 环境变量                   | 阿里云 Access Key Secret |
+| `--log-file <path>`     | `/opt/deploy/logs/ssl.log` | SSL 日志文件路径         |
+| `--scripts-dir <path>`  | 同 init                    | 部署脚本目录             |
+
+**凭证来源（按优先级）：**  
+`--ali-key` / `--ali-secret` → 环境变量 `ALIYUN_ACCESS_KEY_ID` / `ALIYUN_ACCESS_KEY_SECRET` → 环境变量 `Ali_Key` / `Ali_Secret`。
+
+**示例：**
+
+```bash
+# 使用环境变量
+export ALIYUN_ACCESS_KEY_ID="your_key"
+export ALIYUN_ACCESS_KEY_SECRET="your_secret"
+sudo n2-deploy ssl --config /etc/n2/domains.yaml
+
+# 使用命令行参数（注意 shell 历史中可能暴露密钥）
+sudo n2-deploy ssl --config scripts/deploy/domains.yaml \
+  --ali-key "your_key" --ali-secret "your_secret"
+```
+
+**说明：**
+
+- 首次使用前需在服务器上执行过 `init`，或已手动将 SSL 相关脚本安装到 `/opt/ssl/`（如 `check-and-setup-ssl.sh`）。
+- 证书会安装到 `/etc/nginx/ssl/<domain>.crt` 与 `<domain>.key`，Nginx 配置中已引用该路径。
+- 建议通过 cron 或 systemd timer 定期执行 `n2-deploy ssl` 以实现自动续期。
+
+---
+
+### ssl-logs — 查看 SSL 日志
+
+查看 SSL 操作日志（创建、续期、成功、失败等）。日志为文本格式，部分行为结构化行（制表符分隔：时间、类型、域名、结果、消息）。
+
+**用法：**
+
+```bash
+n2-deploy ssl-logs [options]
+```
+
+| 选项                | 默认值                     | 说明                                                           |
+| ------------------- | -------------------------- | -------------------------------------------------------------- |
+| `--log-file <path>` | `/opt/deploy/logs/ssl.log` | SSL 日志文件路径                                               |
+| `-n, --lines <n>`   | `50`                       | 显示最后 N 行                                                  |
+| `-f, --follow`      | —                          | 持续跟踪（等同 `tail -f`）                                     |
+| `--action <action>` | —                          | 按动作过滤：`create` / `renew` / `success` / `failure` / `run` |
+| `--result <result>` | —                          | 按结果过滤：`ok` / `fail`                                      |
+
+**示例：**
+
+```bash
+# 查看最后 50 行
+n2-deploy ssl-logs
+
+# 查看最后 200 行并只显示失败
+n2-deploy ssl-logs --lines 200 --result fail
+
+# 实时跟踪
+n2-deploy ssl-logs --follow
+```
+
+---
+
+## 环境变量
+
+| 变量                                      | 说明                                                                                                           |
+| ----------------------------------------- | -------------------------------------------------------------------------------------------------------------- |
+| `N2_DEPLOY_SCRIPTS_DIR`                   | 部署脚本根目录（含 deploy.sh、server-setup.sh、ssl/、lib/）。未设置时使用 `cwd/scripts/deploy` 或包内 assets。 |
+| `ALIYUN_ACCESS_KEY_ID` / `Ali_Key`        | 阿里云 Access Key ID（ssl 命令）。                                                                             |
+| `ALIYUN_ACCESS_KEY_SECRET` / `Ali_Secret` | 阿里云 Access Key Secret（ssl 命令）。                                                                         |
+
+## 典型流程
+
+1. **首次部署服务器**
+   - 将本仓库或 `scripts/deploy` 拷贝到服务器（或设置 `N2_DEPLOY_SCRIPTS_DIR`）。
+   - 准备 `domains.yaml`（可放在 `/etc/n2/domains.yaml`）。
+   - 执行：`sudo n2-deploy init --config /etc/n2/domains.yaml`。
+   - 执行：`sudo n2-deploy ssl --config /etc/n2/domains.yaml` 并配置阿里云凭证。
+   - 之后由 CI 通过 SSH 执行 `/opt/deploy/deploy.sh` 完成应用部署。
+
+2. **仅更新 Nginx 配置（如新增域名）**
+   - 修改 `domains.yaml` 后执行：  
+     `sudo n2-deploy nginx --config /etc/n2/domains.yaml --install`
+   - 若新增了域名，再执行一次 `n2-deploy ssl` 为新域名申请证书。
+
+3. **定期续期证书**
+   - 使用 cron：例如每月执行一次  
+     `0 3 1 * * /usr/bin/n2-deploy ssl --config /etc/n2/domains.yaml`
+   - 或使用 systemd timer 调用同一命令。
+
+4. **排查 SSL 问题**
+   - `n2-deploy ssl-logs --result fail` 查看失败记录。
+   - `n2-deploy ssl-logs --follow` 在再次执行 `ssl` 时实时查看输出。
+
+## 与 CI/CD 的关系
+
+- **GitHub Actions** 只负责构建产物（API 镜像、前端 tar）并部署到服务器（SSH + `/opt/deploy/deploy.sh`）。
+- **服务器环境与 SSL** 不在此流程中完成，需在服务器上预先执行 `n2-deploy init` 与 `n2-deploy ssl`（或等价的手动/脚本步骤）。
+
+详见仓库根目录 [docs/deployment.md](../../docs/deployment.md)。

package/dist/cli.d.ts

@@ -0,0 +1,6 @@
+#!/usr/bin/env node
+/**
+ * n2-deploy CLI: server init, nginx config, SSL management.
+ */
+export {};
+//# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;GAEG"}

package/dist/cli.js

@@ -0,0 +1,95 @@
+#!/usr/bin/env node
+/**
+ * n2-deploy CLI: server init, nginx config, SSL management.
+ */
+import { Command } from "commander";
+import { runInit } from "./commands/init.js";
+import { runNginx } from "./commands/nginx.js";
+import { runSslLogs } from "./commands/ssl-logs.js";
+import { runSsl } from "./commands/ssl.js";
+const program = new Command();
+program
+    .name("n2-deploy")
+    .description("Server init, nginx config generation, and SSL certificate management")
+    .version("0.1.0");
+program
+    .command("init")
+    .description("Initialize server (idempotent): nginx, dirs, deploy.sh, placeholder certs")
+    .option("-c, --config <path>", "Path to domains.yaml", "domains.yaml")
+    .option("--scripts-dir <path>", "Path to deploy scripts (default: cwd/scripts/deploy or N2_DEPLOY_SCRIPTS_DIR)")
+    .action(async (opts) => {
+    try {
+        await runInit({ config: opts.config, scriptsDir: opts.scriptsDir });
+    }
+    catch (e) {
+        console.error(e);
+        process.exit(1);
+    }
+});
+program
+    .command("nginx")
+    .description("Generate nginx config from domains config; optionally install and reload")
+    .option("-c, --config <path>", "Path to domains.yaml", "domains.yaml")
+    .option("-o, --output <path>", "Output path for nginx config", "nginx/n2.conf")
+    .option("-i, --install", "Install to system nginx dir and reload")
+    .action(async (opts) => {
+    try {
+        await runNginx({
+            config: opts.config,
+            output: opts.output,
+            install: opts.install,
+        });
+    }
+    catch (e) {
+        console.error(e);
+        process.exit(1);
+    }
+});
+program
+    .command("ssl")
+    .description("Setup/renew SSL certificates for all domains (acme.sh + Aliyun DNS)")
+    .option("-c, --config <path>", "Path to domains.yaml", "domains.yaml")
+    .option("--ali-key <key>", "Aliyun Access Key ID (or set ALIYUN_ACCESS_KEY_ID)")
+    .option("--ali-secret <secret>", "Aliyun Access Key Secret (or set ALIYUN_ACCESS_KEY_SECRET)")
+    .option("--log-file <path>", "SSL log file path", "/opt/deploy/logs/ssl.log")
+    .option("--scripts-dir <path>", "Path to deploy scripts")
+    .action(async (opts) => {
+    try {
+        await runSsl({
+            config: opts.config,
+            aliKey: opts.aliKey,
+            aliSecret: opts.aliSecret,
+            logFile: opts.logFile,
+            scriptsDir: opts.scriptsDir,
+        });
+    }
+    catch (e) {
+        console.error(e);
+        process.exit(1);
+    }
+});
+program
+    .command("ssl-logs")
+    .description("View SSL log (create, renew, success, failure)")
+    .option("--log-file <path>", "SSL log file path", "/opt/deploy/logs/ssl.log")
+    .option("-n, --lines <n>", "Number of lines to show", "50")
+    .option("-f, --follow", "Follow log (tail -f)")
+    .option("--action <action>", "Filter by action: create | renew | success | failure | run")
+    .option("--result <result>", "Filter by result: ok | fail")
+    .action(async (opts) => {
+    try {
+        await runSslLogs({
+            logFile: opts.logFile,
+            lines: parseInt(opts.lines, 10) || 50,
+            follow: opts.follow,
+            action: opts.action,
+            result: opts.result,
+        });
+    }
+    catch (e) {
+        console.error(e);
+        process.exit(1);
+    }
+});
+program.parse();
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;GAEG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAE3C,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,WAAW,CAAC;KACjB,WAAW,CACV,sEAAsE,CACvE;KACA,OAAO,CAAC,OAAO,CAAC,CAAC;AAEpB,OAAO;KACJ,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CACV,2EAA2E,CAC5E;KACA,MAAM,CAAC,qBAAqB,EAAE,sBAAsB,EAAE,cAAc,CAAC;KACrE,MAAM,CACL,sBAAsB,EACtB,+EAA+E,CAChF;KACA,MAAM,CAAC,KAAK,EAAC,IAAI,EAAC,EAAE;IACnB,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;IACtE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACjB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,OAAO,CAAC;KAChB,WAAW,CACV,0EAA0E,CAC3E;KACA,MAAM,CAAC,qBAAqB,EAAE,sBAAsB,EAAE,cAAc,CAAC;KACrE,MAAM,CACL,qBAAqB,EACrB,8BAA8B,EAC9B,eAAe,CAChB;KACA,MAAM,CAAC,eAAe,EAAE,wCAAwC,CAAC;KACjE,MAAM,CAAC,KAAK,EAAC,IAAI,EAAC,EAAE;IACnB,IAAI,CAAC;QACH,MAAM,QAAQ,CAAC;YACb,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACjB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,KAAK,CAAC;KACd,WAAW,CACV,qEAAqE,CACtE;KACA,MAAM,CAAC,qBAAqB,EAAE,sBAAsB,EAAE,cAAc,CAAC;KACrE,MAAM,CACL,iBAAiB,EACjB,oDAAoD,CACrD;KACA,MAAM,CACL,uBAAuB,EACvB,4DAA4D,CAC7D;KACA,MAAM,CAAC,mBAAmB,EAAE,mBAAmB,EAAE,0BAA0B,CAAC;KAC5E,MAAM,CAAC,sBAAsB,EAAE,wBAAwB,CAAC;KACxD,MAAM,CAAC,KAAK,EAAC,IAAI,EAAC,EAAE;IACnB,IAAI,CAAC;QACH,MAAM,MAAM,CAAC;YACX,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACjB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,UAAU,CAAC;KACnB,WAAW,CAAC,gDAAgD,CAAC;KAC7D,MAAM,CAAC,mBAAmB,EAAE,mBAAmB,EAAE,0BAA0B,CAAC;KAC5E,MAAM,CAAC,iBAAiB,EAAE,yBAAyB,EAAE,IAAI,CAAC;KAC1D,MAAM,CAAC,cAAc,EAAE,sBAAsB,CAAC;KAC9C,MAAM,CACL,mBAAmB,EACnB,4DAA4D,CAC7D;KACA,MAAM,CAAC,mBAAmB,EAAE,6BAA6B,CAAC;KAC1D,MAAM,CAAC,KAAK,EAAC,IAAI,EAAC,EAAE;IACnB,IAAI,CAAC;QACH,MAAM,UAAU,CAAC;YACf,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,EAAE;YACrC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACjB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,OAAO,CAAC,KAAK,EAAE,CAAC"}

package/dist/commands/init.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Server init (idempotent): nginx, dirs, deploy.sh, placeholder certs.
+ * Uses server-setup.sh from scripts dir when available.
+ */
+export interface InitOptions {
+    config: string;
+    scriptsDir?: string;
+}
+export declare function runInit(opts: InitOptions): Promise<void>;
+//# sourceMappingURL=init.d.ts.map

package/dist/commands/init.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../src/commands/init.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAYH,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,wBAAsB,OAAO,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CA0G9D"}

package/dist/commands/init.js

@@ -0,0 +1,104 @@
+/**
+ * Server init (idempotent): nginx, dirs, deploy.sh, placeholder certs.
+ * Uses server-setup.sh from scripts dir when available.
+ */
+import { spawn } from "node:child_process";
+import fs from "node:fs";
+import path from "node:path";
+import { getAllDomains, parseDomainsYaml } from "../lib/domains.js";
+import { error, info, warn } from "../lib/logger.js";
+import { generateNginxConf } from "../lib/nginx.js";
+import { getScriptsDir } from "../lib/paths.js";
+const DEFAULT_SSL_LOG = "/opt/deploy/logs/ssl.log";
+export async function runInit(opts) {
+    const configPath = path.resolve(process.cwd(), opts.config);
+    if (!fs.existsSync(configPath)) {
+        error(`Domains config not found: ${configPath}`);
+        process.exit(1);
+    }
+    const yaml = fs.readFileSync(configPath, "utf8");
+    const config = parseDomainsYaml(yaml);
+    const domains = getAllDomains(config);
+    const nginxConf = generateNginxConf(config);
+    const scriptsDir = opts.scriptsDir ||
+        process.env.N2_DEPLOY_SCRIPTS_DIR ||
+        getScriptsDir(process.cwd());
+    if (!scriptsDir || !fs.existsSync(path.join(scriptsDir, "server-setup.sh"))) {
+        error("Deploy scripts directory not found. Set N2_DEPLOY_SCRIPTS_DIR or run from repo root (scripts/deploy must exist).");
+        process.exit(1);
+    }
+    info("Using scripts directory: " + scriptsDir);
+    const tmpDir = path.join(process.env.TMPDIR || "/tmp", `n2-deploy-init-${Date.now()}`);
+    fs.mkdirSync(path.join(tmpDir, "nginx"), { recursive: true });
+    fs.mkdirSync(path.join(tmpDir, "ssl"), { recursive: true });
+    try {
+        fs.writeFileSync(path.join(tmpDir, "nginx", "n2.conf"), nginxConf);
+        const deploySh = path.join(scriptsDir, "deploy.sh");
+        if (fs.existsSync(deploySh)) {
+            fs.copyFileSync(deploySh, path.join(tmpDir, "deploy.sh"));
+            fs.chmodSync(path.join(tmpDir, "deploy.sh"), 0o755);
+        }
+        else {
+            error("deploy.sh not found in scripts directory");
+            process.exit(1);
+        }
+        const setupSh = path.join(scriptsDir, "server-setup.sh");
+        fs.copyFileSync(setupSh, path.join(tmpDir, "server-setup.sh"));
+        fs.chmodSync(path.join(tmpDir, "server-setup.sh"), 0o755);
+        const sslDir = path.join(scriptsDir, "ssl");
+        if (fs.existsSync(sslDir)) {
+            const sslDest = path.join(tmpDir, "ssl");
+            for (const name of fs.readdirSync(sslDir)) {
+                const src = path.join(sslDir, name);
+                if (fs.statSync(src).isFile()) {
+                    fs.copyFileSync(src, path.join(sslDest, name));
+                    fs.chmodSync(path.join(sslDest, name), 0o755);
+                }
+            }
+        }
+        fs.writeFileSync(path.join(tmpDir, "ssl", "domains.txt"), domains.join("\n") + "\n");
+        const libDir = path.join(scriptsDir, "lib");
+        if (fs.existsSync(libDir)) {
+            const libDest = path.join(tmpDir, "lib");
+            fs.mkdirSync(libDest, { recursive: true });
+            for (const name of fs.readdirSync(libDir)) {
+                fs.copyFileSync(path.join(libDir, name), path.join(libDest, name));
+            }
+        }
+        info("Running server-setup.sh (may require sudo)...");
+        await new Promise((resolve, reject) => {
+            const child = spawn("bash", [path.join(tmpDir, "server-setup.sh")], {
+                cwd: tmpDir,
+                stdio: "inherit",
+                env: { ...process.env, SCRIPT_DIR: tmpDir },
+            });
+            child.on("close", code => {
+                if (code === 0)
+                    resolve();
+                else
+                    reject(new Error(`server-setup.sh exited with ${code}`));
+            });
+            child.on("error", reject);
+        });
+        const logDir = path.dirname(DEFAULT_SSL_LOG);
+        if (logDir && !fs.existsSync(logDir)) {
+            try {
+                fs.mkdirSync(logDir, { recursive: true });
+                info("Created log directory: " + logDir);
+            }
+            catch {
+                warn("Could not create log directory: " + logDir);
+            }
+        }
+        info("Server initialization completed.");
+    }
+    finally {
+        try {
+            fs.rmSync(tmpDir, { recursive: true, force: true });
+        }
+        catch {
+            // ignore
+        }
+    }
+}
+//# sourceMappingURL=init.js.map

package/dist/commands/init.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"init.js","sourceRoot":"","sources":["../../src/commands/init.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACpE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAEhD,MAAM,eAAe,GAAG,0BAA0B,CAAC;AAOnD,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAiB;IAC7C,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5D,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/B,KAAK,CAAC,6BAA6B,UAAU,EAAE,CAAC,CAAC;QACjD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,SAAS,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAE5C,MAAM,UAAU,GACd,IAAI,CAAC,UAAU;QACf,OAAO,CAAC,GAAG,CAAC,qBAAqB;QACjC,aAAa,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAE/B,IAAI,CAAC,UAAU,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC,EAAE,CAAC;QAC5E,KAAK,CACH,kHAAkH,CACnH,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,CAAC,2BAA2B,GAAG,UAAU,CAAC,CAAC;IAE/C,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CACtB,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,MAAM,EAC5B,kBAAkB,IAAI,CAAC,GAAG,EAAE,EAAE,CAC/B,CAAC;IACF,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9D,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE5D,IAAI,CAAC;QACH,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,SAAS,CAAC,CAAC;QAEnE,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;QACpD,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5B,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;YAC1D,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,KAAK,CAAC,CAAC;QACtD,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,0CAA0C,CAAC,CAAC;YAClD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC;QACzD,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC,CAAC;QAC/D,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,iBAAiB,CAAC,EAAE,KAAK,CAAC,CAAC;QAE1D,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAC5C,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YACzC,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;gBACpC,IAAI,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;oBAC9B,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;oBAC/C,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;gBAChD,CAAC;YACH,CAAC;QACH,CAAC;QACD,EAAE,CAAC,aAAa,CACd,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,aAAa,CAAC,EACvC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAC1B,CAAC;QAEF,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAC5C,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YACzC,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3C,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC1C,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;YACrE,CAAC;QACH,CAAC;QAED,IAAI,CAAC,+CAA+C,CAAC,CAAC;QACtD,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC1C,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC,EAAE;gBAClE,GAAG,EAAE,MAAM;gBACX,KAAK,EAAE,SAAS;gBAChB,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE;aAC5C,CAAC,CAAC;YACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE;gBACvB,IAAI,IAAI,KAAK,CAAC;oBAAE,OAAO,EAAE,CAAC;;oBACrB,MAAM,CAAC,IAAI,KAAK,CAAC,+BAA+B,IAAI,EAAE,CAAC,CAAC,CAAC;YAChE,CAAC,CAAC,CAAC;YACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC5B,CAAC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAC7C,IAAI,MAAM,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACrC,IAAI,CAAC;gBACH,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC1C,IAAI,CAAC,yBAAyB,GAAG,MAAM,CAAC,CAAC;YAC3C,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,CAAC,kCAAkC,GAAG,MAAM,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;QAED,IAAI,CAAC,kCAAkC,CAAC,CAAC;IAC3C,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YACH,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/commands/nginx.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Generate nginx config from domains config; optionally install and reload.
+ */
+export interface NginxOptions {
+    config: string;
+    output: string;
+    install?: boolean;
+}
+export declare function runNginx(opts: NginxOptions): Promise<void>;
+//# sourceMappingURL=nginx.d.ts.map

package/dist/commands/nginx.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nginx.d.ts","sourceRoot":"","sources":["../../src/commands/nginx.ts"],"names":[],"mappings":"AAAA;;GAEG;AASH,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAID,wBAAsB,QAAQ,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA6BhE"}