@aifabrix/server-setup 1.2.0 → 1.3.0

package/README.md

@@ -59,7 +59,7 @@ After install, your builder-server is up. Use the **AI Fabrix Builder CLI** for
 
 | Command | Description |
 | -------- | ----------- |
-| `af-server install [ user@host ] [ -d DATA_DIR ] [ --dev-domain DOMAIN ] [ --ssl-dir PATH ] [ -i SSH_KEY ]` | Install: Docker, nginx, SSL proxy, sync user, cron. |
+| `af-server install [ user@host ] [ -d DATA_DIR ] [ --dev-domain DOMAIN ] [ --ssl-dir PATH ] [ -i SSH_KEY ]` | Install or update: Docker, nginx (builder vhost always updated from template), SSL proxy, sync user, cron. Re-run to apply latest config. |
 | `af-server backup [ user@host ] [ -d DATA_DIR ] [ -o output.zip ] [ -i SSH_KEY ]` | On-demand backup (config + DB + keys). |
 | `af-server backup [ user@host ] --schedule [ --backup-dir PATH ] [ --keep-days N ] [ -i SSH_KEY ]` | Cron backup (daily 02:00, keep last N, default 7). |
 | `af-server restore backup.zip [ user@host ] [ -d DATA_DIR ] [ --force ] [ -i SSH_KEY ]` | Restore backup to DATA_DIR. |

package/assets/builder/builder-server/nginx-builder-server.conf.template

@@ -1,12 +1,8 @@
 # Nginx snippet for builder-server onboarding API (https://DEV_DOMAIN_PLACEHOLDER).
 # Generated from template by af-server install (substitutes DEV_DOMAIN, SSL_DIR, BUILDER_SERVER_PORT, DATA_DIR).
 # SSL cert and key from SSL_DIR_PLACEHOLDER (wildcard.crt, wildcard.key).
-# Client cert: ssl_client_certificate uses DATA_DIR_PLACEHOLDER/ca.crt (Builder CA; created by builder-server on first run).
-# If the backend returns 400 Bad Request for requests with client cert, nginx may be sending $ssl_client_cert with
-# literal newlines (header folding). Use njs to send cert on one line: load_module modules/ngx_http_js_module.so;
-# then js_set $client_cert_escaped cert.oneline; js_include cert-escaped.js; and proxy_set_header X-Client-Cert $client_cert_escaped;
-# (cert-escaped.js: function cert(r){return r.variables.ssl_client_cert?r.variables.ssl_client_cert.replace(/\n/g,'\\n'):'';}).
-# Reload nginx after placing: sudo nginx -t && sudo systemctl reload nginx.
+# Client cert: ssl_client_certificate uses DATA_DIR_PLACEHOLDER/ca.crt (Builder CA).
+# Client sends X-Client-Cert as base64-encoded PEM; nginx forwards it to the backend.
 
 server {
     listen 443 ssl;
@@ -25,6 +21,6 @@ server {
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header X-Forwarded-Proto $scheme;
-        proxy_set_header X-Client-Cert $ssl_client_cert;
+        proxy_set_header X-Client-Cert $http_x_client_cert;
     }
 }

package/assets/setup-dev-server-no-node.sh

@@ -1,6 +1,7 @@
 #!/bin/sh
 # Idempotent dev server setup script (no Node/Builder on server). Safe to run multiple times.
 # Run via af-server install user@host. REPO_ROOT must be set to the dir containing builder/builder-server/nginx-builder-server.conf.template.
+# On empty server: installs Docker, nginx, admin user, optional Portainer/Mutagen; then updates nginx config and ensures builder-server container.
 # Optional env: DEV_DOMAIN, SSL_DIR, DATA_DIR, SETUP_ADMIN_USER, SYNC_USER, BUILDER_SERVER_PORT, NGINX_CONF_DIR, SETUP_HOSTNAME, INSTALL_PORTAINER=1, SKIP_DOCKER_TLS=1.
 
 set -e
@@ -101,25 +102,23 @@ if ! command -v nginx >/dev/null 2>&1; then
   systemctl enable nginx
   systemctl start nginx
 fi
-
 NGINX_CONF="$NGINX_CONF_DIR/$DEV_DOMAIN.conf"
 NGINX_TEMPLATE="$REPO_ROOT/builder/builder-server/nginx-builder-server.conf.template"
-if [ ! -f "$NGINX_CONF" ] && [ -f "$NGINX_TEMPLATE" ]; then
+# Always update builder vhost from template so re-running install applies latest config.
+if [ -f "$NGINX_TEMPLATE" ]; then
   sed -e "s|DEV_DOMAIN_PLACEHOLDER|$DEV_DOMAIN|g" \
       -e "s|SSL_DIR_PLACEHOLDER|$SSL_DIR|g" \
       -e "s|BUILDER_SERVER_PORT_PLACEHOLDER|$BUILDER_SERVER_PORT|g" \
       -e "s|DATA_DIR_PLACEHOLDER|$DATA_DIR|g" \
       "$NGINX_TEMPLATE" > "$NGINX_CONF"
-  if nginx -t 2>/dev/null; then
-    systemctl reload nginx
-  fi
 elif [ ! -f "$NGINX_CONF" ]; then
   echo "Warning: SSL prereqs required. Place $NGINX_CONF (see SETUP.md) and ensure $SSL_DIR/wildcard.crt and $SSL_DIR/wildcard.key exist."
 fi
-if command -v nginx >/dev/null 2>&1; then
-  if nginx -t 2>/dev/null; then
-    systemctl reload nginx
-  fi
+if command -v nginx >/dev/null 2>&1 && nginx -t 2>/dev/null; then
+  systemctl reload nginx
+elif [ -f "$NGINX_TEMPLATE" ] && command -v nginx >/dev/null 2>&1; then
+  echo "Warning: nginx -t failed (config was still written to $NGINX_CONF). Nginx was NOT reloaded."
+  nginx -t 2>&1 || true
 fi
 
 # --- Mutagen ---
@@ -171,17 +170,60 @@ DOCKER_EOF
 fi
 
 # --- Builder-server data dir and container ---
-# Container runs as uid 1001 (nodejs); data dir must be writable for bootstrap (key, CA, DB).
+# Paths match AI Fabrix Builder: aifabrix build + resolve use DATA_DIR=/mnt/data in container; host DATA_DIR (e.g. /opt/aifabrix/builder-server/data) is the HDD/mount. See builder/builder-server/README.md and env.template.
+# Nginx uses DATA_DIR/ca.crt for ssl_client_certificate; container must use the same host path so CA matches.
+CONTAINER_DATA_PATH="/mnt/data"
+BUILDER_IMAGE="aifabrix/builder-server:latest"
 mkdir -p "$DATA_DIR"
 chown -R 1001:65533 "$DATA_DIR"
 chmod 755 "$DATA_DIR"
+DATA_DIR_ABS=$(cd "$DATA_DIR" && pwd)
 if command -v docker >/dev/null 2>&1; then
-  if ! docker ps -a --format '{{.Names}}' 2>/dev/null | grep -q '^builder-server$'; then
-    echo "Builder-server container not found. Build and run manually (see builder/builder-server/README.md):"
-    echo "  docker build -t builder-server:latest -f builder/builder-server/Dockerfile ."
-    echo "  docker run -d --name builder-server --restart unless-stopped -p ${BUILDER_SERVER_PORT}:3000 -v $DATA_DIR:/data -e PORT=3000 builder-server:latest"
+  CONTAINER_NAME=""
+  for n in builder-server aifabrix-builder-server; do
+    if docker ps -a --format '{{.Names}}' 2>/dev/null | grep -q "^${n}$"; then
+      CONTAINER_NAME="$n"
+      break
+    fi
+  done
+  if [ -n "$CONTAINER_NAME" ]; then
+    # Ensure container uses DATA_DIR as bind mount so nginx and app share same ca.crt (check /mnt/data first, then /data)
+    DATA_MOUNT_SOURCE=$(docker inspect --format '{{range .Mounts}}{{if eq .Destination "/mnt/data"}}{{.Source}}{{end}}{{end}}' "$CONTAINER_NAME" 2>/dev/null)
+    if [ -z "$DATA_MOUNT_SOURCE" ]; then
+      DATA_MOUNT_SOURCE=$(docker inspect --format '{{range .Mounts}}{{if eq .Destination "/data"}}{{.Source}}{{end}}{{end}}' "$CONTAINER_NAME" 2>/dev/null)
+    fi
+    MOUNT_SOURCE_ABS=""
+    if [ -n "$DATA_MOUNT_SOURCE" ] && [ -d "$DATA_MOUNT_SOURCE" ]; then
+      MOUNT_SOURCE_ABS=$(cd "$DATA_MOUNT_SOURCE" && pwd)
+    fi
+    if [ "$MOUNT_SOURCE_ABS" != "$DATA_DIR_ABS" ]; then
+      echo "Recreating builder-server container to use DATA_DIR bind mount ($DATA_DIR_ABS -> $CONTAINER_DATA_PATH) so nginx and container share the same CA."
+      BUILDER_IMAGE=$(docker inspect --format '{{.Config.Image}}' "$CONTAINER_NAME" 2>/dev/null) || true
+      [ -z "$BUILDER_IMAGE" ] && BUILDER_IMAGE="aifabrix/builder-server:latest"
+      docker stop "$CONTAINER_NAME" 2>/dev/null || true
+      docker rm "$CONTAINER_NAME" 2>/dev/null || true
+      CONTAINER_NAME=""
+    fi
+  fi
+  if [ -z "$CONTAINER_NAME" ]; then
+    IMG_TO_USE="$BUILDER_IMAGE"
+    if ! docker images -q "$IMG_TO_USE" 2>/dev/null | grep -q .; then
+      IMG_TO_USE="builder-server:latest"
+    fi
+    if docker images -q "$IMG_TO_USE" 2>/dev/null | grep -q .; then
+      docker run -d --name aifabrix-builder-server --restart unless-stopped \
+        -p "${BUILDER_SERVER_PORT}:3000" \
+        -v "$DATA_DIR_ABS:$CONTAINER_DATA_PATH" \
+        -e PORT=3000 \
+        -e DATA_DIR="$CONTAINER_DATA_PATH" \
+        -e ENCRYPTION_KEY_PATH="${CONTAINER_DATA_PATH}/secrets-encryption.key" \
+        "$IMG_TO_USE"
+    else
+      echo "Builder-server image not found. Get the image from the AI Fabrix Builder (aifabrix build builder-server; then push/deploy to this host). No source or docker build on server. See builder/builder-server/README.md."
+      echo "After the image is on this host, re-run af-server install. Install will start the container with: -v $DATA_DIR_ABS:$CONTAINER_DATA_PATH and DATA_DIR=$CONTAINER_DATA_PATH."
+    fi
   else
-    docker start builder-server 2>/dev/null || true
+    docker start "$CONTAINER_NAME" 2>/dev/null || true
   fi
 fi
 

package/dist/install.js

@@ -65,7 +65,7 @@ export function runInstallLocal(options = {}) {
     try {
         fs.writeFileSync(path.join(tmpDir, 'setup.sh'), getSetupScript(), { mode: 0o755 });
         fs.writeFileSync(path.join(builderSubdir, 'nginx-builder-server.conf.template'), getNginxTemplate());
-        const env = `REPO_ROOT=${tmpDir} DATA_DIR=${dataDir} DEV_DOMAIN=${devDomain} SSL_DIR=${sslDir} BUILDER_SERVER_PORT=${builderServerPort}`;
+        const env = [`REPO_ROOT=${tmpDir}`, `DATA_DIR=${dataDir}`, `DEV_DOMAIN=${devDomain}`, `SSL_DIR=${sslDir}`, `BUILDER_SERVER_PORT=${builderServerPort}`].join(' ');
         execSync(`sudo ${env} ${tmpDir}/setup.sh`, { stdio: 'inherit' });
     }
     finally {

package/dist/restore.js

@@ -45,7 +45,7 @@ export async function runRestore(options) {
                     await exec(conn, `chown 1001:65533 ${dataDir}/${k}`);
                 }
             }
-            const restart = await exec(conn, 'docker restart builder-server 2>/dev/null || true');
+            const restart = await exec(conn, 'docker restart builder-server 2>/dev/null; docker restart aifabrix-builder-server 2>/dev/null || true');
             if (restart.stderr && !restart.stderr.includes('No such container')) {
                 process.stderr.write(restart.stderr);
             }
@@ -89,7 +89,7 @@ export async function runRestoreLocal(options) {
             }
         }
         try {
-            execSync('docker restart builder-server 2>/dev/null || true', { stdio: 'inherit' });
+            execSync('docker restart builder-server 2>/dev/null; docker restart aifabrix-builder-server 2>/dev/null || true', { stdio: 'inherit' });
         }
         catch {
             // container may not exist

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aifabrix/server-setup",
-  "version": "1.2.0",
+  "version": "1.3.0",
   "description": "CLI to install, backup, and restore AI Fabrix builder-server (config + DB) over SSH",
   "type": "module",
   "main": "dist/cli.js",