@bongos/core 1.21.175 → 1.21.176

package/scripts/bongos/provision-config.js

@@ -0,0 +1,233 @@
+// scripts/bongos/provision-config.js — the provisioner's CONFIG block, its env
+// readers and the lazy dependency loader. Extracted FIRST so every other piece
+// can share it without requiring provision.js back (the split must stay a DAG).
+//
+// Carved out of scripts/bongos/provision.js by task 1003206 (goal 1000079, the R03
+// de-monolith plan) to bring the control-plane CLI under the 1,500-line ratchet.
+// A STRUCTURAL move: bodies unchanged, provision.js requires every name back, so
+// the intent runner and its unit templates behave exactly as before.
+
+'use strict';
+
+const path = require('node:path');
+
+const REPO_ROOT = path.resolve(__dirname, '..', '..');
+
+// The verified OAuth-cred placement helpers (task 1979) — reused by the GitHub App
+// Manifest flow (task 2080) to VALIDATE the creds GitHub returns before writing them
+// and to PARSE the post-restart /healthz auth_configured probe. A sibling script; a
+// plain require (its require.main guard means importing it runs no CLI).
+const oauthSecret = require('./oauth-secret');
+
+// The HTTP User-Agent the manifest conversion stamps its GitHub call with (GitHub
+// requires a UA). Overridable so a fork can identify itself; not secret.
+const MANIFEST_UA = process.env.PROVISION_GITHUB_UA || 'cloudbongos-provisioner';
+
+// The running core version (no caret) — for naming the vendored tarball the standalone
+// scaffold pins. Fail-soft (a partial checkout returns null; the scaffold then errors
+// with guidance rather than pinning a `…-null.tgz`). Mirrors init.js coreVersionSafe().
+function coreVersionSafe() {
+  try { return require(path.join(REPO_ROOT, 'src/module-api')).CORE_VERSION; } catch { return null; }
+}
+
+// What an allowFail step returns when its command failed (task 1004128). It KEEPS the
+// output: a caller that opts into allowFail needs the reason, and returning an empty
+// string made every upgrade pre-flight report a generic "the dry run did not complete"
+// while `sudo: unknown user …` sat in the journal. WITHHELD when the step is
+// secret-bearing (a `shown` call site), where only an exit status may ever surface.
+function softFailResult(e, secretBearing) {
+  if (secretBearing) return { ok: true, stdout: '', softFailed: true };
+  return { ok: true, stdout: (e.stdout || '').toString(), stderr: (e.stderr || '').toString(), softFailed: true };
+}
+
+function numEnv(name, dflt) {
+  const v = process.env[name];
+  if (v == null || v === '') return dflt;
+  const n = Number(v);
+  return Number.isFinite(n) && n > 0 ? n : dflt;
+}
+// A boolean env flag: '1'/'true'/'yes'/'on' (case-insensitive) → true, else false.
+function boolEnv(name) {
+  return /^(1|true|yes|on)$/i.test(String(process.env[name] || '').trim());
+}
+function hasFlag(args, name) { return args.includes(name); }
+
+const CONFIG = {
+  // The port range a CO-TENANT instance process binds on the shared box. 3000 (OTB)
+  // and 3002 (cloudbongos.com) are taken; new co-tenant instances start at 3003.
+  portBase: numEnv('PROVISION_PORT_BASE', 3003),
+  reservedPorts: (process.env.PROVISION_RESERVED_PORTS || '3000,3001,3002')
+    .split(',').map((s) => Number(s.trim())).filter(Number.isFinite),
+  // Where a per-instance secrets file lives: /etc/<slug>/web.env (the standup
+  // runbook's /etc/cloudbongos/web.env shape). chmod 600, OUTSIDE the repo.
+  etcBase: process.env.PROVISION_ETC_BASE || '/etc',
+  // The dir holding per-instance Caddy site snippets. Each instance gets its OWN
+  // <slug>.caddy file (idempotent overwrite, no fragile append to a shared file);
+  // the main Caddyfile carries a one-time `import <dir>/*.caddy` (operator setup).
+  caddySnippetDir: process.env.PROVISION_CADDY_SNIPPET_DIR || '/etc/caddy/sites',
+  // The base Caddyfile the running Caddy loads — read (never written) to prove it imports
+  // the snippets and carries the on-demand TLS ask (task 1002860, ADR 0303).
+  caddyfile: process.env.PROVISION_CADDYFILE || '/etc/caddy/Caddyfile',
+  // Where nightly pg_dump backups land (db-backup-nightly.sh's GDS_BACKUP_DIR
+  // default). Shared across co-tenant instances on one box — dumps are named
+  // `<db>-<ts>.sql.gz`, so each instance's files + retention prune stay scoped to
+  // its own DB. Owned by the app user, mode 0750. (task 2213, productizes 2210.)
+  backupDir: process.env.PROVISION_BACKUP_DIR || '/var/backups/gds',
+  // Where supervisord program configs land when supervision is supervisord rather than
+  // systemd (ADR 0306). Unused on a systemd box. No sudo is applied to writes here: the
+  // planes that select supervisord run unprivileged and already own this dir.
+  supervisorConfDir: process.env.PROVISION_SUPERVISOR_CONF_DIR || '/etc/supervisor/conf.d',
+  // The DigitalOcean token. No runner leg spends it since the dedicated droplet path went
+  // (task 1004185); the read stays because it is what makes this file a registered
+  // credential reader (modules/government/protected-surfaces.json + the tripwire in
+  // tests/government_protected_surfaces.mjs). Dropping it is a governance change of its own.
+  doToken: process.env.DO_API_TOKEN || null,
+  // The Cloudflare DNS hook (the instance's infra/box-dns-cloudflare.sh).
+  // P4 (#1945) formalizes the UPSERT: point the instance's domain at the target
+  // public IP (below), in the domain's OWN Cloudflare zone, proxied=false (see
+  // dnsUpsertEnv). No hook configured → DNS is skipped (a co-tenant instance is
+  // still reachable by IP; TLS then can't be issued until DNS lands).
+  dnsHook: process.env.BOX_DNS_HOOK || null,
+  // This box's PUBLIC IP — the A-record target for a CO-TENANT instance's domain.
+  // Set in the control-plane /etc/<inst>/box.env (never the web tier). Under
+  // remote-exec (PROVISION_REMOTE_HOST) this is the CO-HOSTING box's IP — where the
+  // co-tenant actually runs (ADR 0130).
+  publicIp: process.env.PROVISION_PUBLIC_IP || process.env.BOX_PUBLIC_IP || null,
+  // The CONTROL PLANE's OWN public IP — the A-record target for a STANDALONE instance
+  // (task 2074). A standalone runs control-plane-LOCAL (its scaffolded repo dir lives
+  // here, not on the remote co-hosting box), so its domain must point at THIS box, not
+  // at publicIp (which, under remote-exec, is the co-hosting box). Only needed when
+  // remote-exec splits the two boxes; all-local (no remoteHost) falls back to publicIp
+  // since the control plane and the run box are then the same machine.
+  controlPlaneIp: process.env.PROVISION_CONTROL_PLANE_IP || null,
+  // Parent dir for the OWN repo checkout of an ADR 0108 standalone-topology instance —
+  // today that is the 'cloud-host' hosting shape. Each lives at <standaloneBase>/<slug>
+  // with @bongos/core installed as an npm dep. Distinct from co-tenant, which shares THIS
+  // control-plane checkout. The name stays "standalone" because it describes the TOPOLOGY,
+  // not the shape whose stored value task 1004182 renamed; PROVISION_STANDALONE_BASE is
+  // set on the live box and named in the /new-project skill, so renaming it breaks both.
+  standaloneBase: process.env.PROVISION_STANDALONE_BASE || '/srv/cloudbongos',
+  // ── Privilege escalation (task 2066, ADR 0128) ───────────────────────────
+  // The intent runner runs as a NON-root user (provision-intent-runner.service:
+  // User= the app user) that holds passwordless sudo. That user cannot itself write under
+  // /etc, reload systemd/Caddy, or peer-auth to Postgres as a superuser — so the
+  // runbook steps below FAIL as bare commands (the goal-35 blocker). With
+  // PROVISION_SUDO=1 (alias PROVISION_PRIVILEGED=1) the privileged steps escalate:
+  //   • /etc writes         → temp file (lars-writable) + `sudo install -D -m <mode>`
+  //   • systemctl / rm /etc  → `sudo …`
+  //   • createdb / migrate   → `sudo -u postgres …` (postgres peer-auths as the PG
+  //     superuser — the Ubuntu default — so it never needs `lars` to be a PG role)
+  // OFF (default) preserves the run-as-root / test / co-tenant-legacy behavior
+  // (bare commands, direct fs writes), so nothing outside a sudo context changes.
+  // Dry-run ALWAYS logs the exact command either way. NB: the runner unit must NOT
+  // set NoNewPrivileges=true — it blocks sudo (see infra/provision-intent-runner.service).
+  privileged: boolEnv('PROVISION_SUDO') || boolEnv('PROVISION_PRIVILEGED'),
+  // ── Remote orchestration over SSH (task 2065, ADR 0130) ──────────────────
+  // The token-separation endgame (ADR 0126): run this runner ON the token-holding
+  // control-plane box, and have it drive co-tenant workloads that still LIVE on the
+  // co-hosting box over SSH — so the co-hosting box can hold ZERO cloud tokens.
+  // When PROVISION_REMOTE_HOST is set, the BOX-MUTATING steps (createdb, migrate,
+  // /etc writes, systemctl, Caddy, healthz) run on that host over `ssh`; the
+  // TOKEN step (the Cloudflare DNS hook) + the standalone repo scaffold STAY local
+  // on the control plane, where the token + the packaging tools live. UNSET
+  // (default) = every step runs locally, byte-identical to today.
+  remoteHost: process.env.PROVISION_REMOTE_HOST || null,
+  // The co-hosting box's checkout dir — the remote migrate's cwd. NO baked-in default
+  // (task 1002756: the founder-pinned path was an identity leak, and a silent wrong
+  // cwd aims mutating SSH steps at a dir that may not exist); remote mode requires it
+  // explicitly (guarded at the makeExec call), local mode never reads it.
+  remoteCwd: process.env.PROVISION_REMOTE_CHECKOUT || null,
+  // ssh options for the control-plane → co-hosting hop. BatchMode so a missing key
+  // fails fast (never hangs on a prompt); accept-new pins the host key on first
+  // connect (the operator can pre-seed known_hosts for strict pinning).
+  sshOpts: process.env.PROVISION_SSH_OPTS || '-o BatchMode=yes -o StrictHostKeyChecking=accept-new',
+  // ── Box capacity (ADR 0285, task 1003927) ─────────────────────────────────
+  // How many projects the box the runner places on may hold. UNSET (default)
+  // derives it from that box's own MemTotal by the ADR's formula (15 on today's
+  // s-1vcpu-2gb, 39 after the resize), so a resize raises it with no knob to
+  // remember; set it only to pin a number the measurement should not decide (a box
+  // that also hosts something the ledger cannot see). The floor is the live
+  // MemAvailable a placement must still find — two warm projects plus margin
+  // (modules/provisioning/capacity.js holds the default). Both live in box.env;
+  // mirror an override into web.env so the fleet API reports the same number.
+  boxCeiling: numEnv('PROVISION_BOX_CEILING', null),
+  memFloorMb: numEnv('PROVISION_MEM_FLOOR_MB', null),
+  // The Postgres pool cap written into a CO-LOCATED instance's web.env as PGPOOL_MAX
+  // (task 1003928, ADR 0285 §3). pg's default is 10 per process and the shared server
+  // allows 97 non-superuser backends, so nine busy projects exhaust it whatever the
+  // RAM headroom. Idle projects hold zero backends, so this bounds bursts, not the
+  // steady state: 3 × 15 slots + the control plane's own 10 stays under the 97. The
+  // control plane keeps pg's default (it is not provisioned by this runner), so it is
+  // not written there.
+  instancePoolMax: numEnv('PROVISION_INSTANCE_PGPOOL_MAX', 3),
+};
+
+// task 1002757 — the provisioner's git identity resolves from the instance's own
+// apex (env → bot@<apex> → neutral), never the hub's address hardcoded.
+const { provisionerBotEmail, provisionerBotName } = require('./instance-apex');
+
+const MAX_INTENT_ATTEMPTS = numEnv('PROVISION_INTENT_MAX_ATTEMPTS', 3);
+
+// Manifest-placement verification budget (task 1002720 / QA-walk F23): a child
+// instance is a full Node boot away from reporting auth_configured=true, and the
+// old 10×1s poll routinely lost that race — recording a failure for a setup that
+// succeeded, then burning the SINGLE-USE manifest code on the retry. ~3 min of
+// patience; the poll runs after the intent loop, so it delays nothing.
+const MANIFEST_VERIFY_TRIES = numEnv('PROVISION_MANIFEST_VERIFY_TRIES', 90);
+const MANIFEST_VERIFY_INTERVAL_MS = numEnv('PROVISION_MANIFEST_VERIFY_INTERVAL_MS', 2000);
+
+// ---------------------------------------------------------------------------
+// Lazy dep load (so --help / arg errors need no Postgres).
+// ---------------------------------------------------------------------------
+let _deps;
+function loadDeps() {
+  if (_deps) return _deps;
+  // eslint-disable-next-line global-require
+  const { pool } = require(path.join(REPO_ROOT, 'src/bongos/pool'));
+  // eslint-disable-next-line global-require
+  const provisioning = require(path.join(REPO_ROOT, 'modules/provisioning/provisioning'));
+  // Cross-site identity (ADR 0141 §4, task #1002109). Resolve the hub-side module by a
+  // VARIABLE key, gated on isModuleEnabled — the module-loader's own dynamic-dispatch
+  // pattern (the run-unit-tests.js precedent), NOT a static 'modules/platform-identity/'
+  // literal that would couple this publishable core file to an instance-EXCLUDED module
+  // (fitness Check 16b / task 2135). A vanilla core that neither ships nor enables the
+  // module never resolves it → no MODULE_NOT_FOUND on a fresh boot. Null here → federation
+  // dormant (shouldFederate skips) → the instance owns its auth, byte-identical to today.
+  let platformIdentity = null, hubKeys = null, projectCatalog = null;
+  const PI_KEY = 'platform-identity';
+  let piEnabled = false;
+  try { piEnabled = require(path.join(REPO_ROOT, 'src/modules')).isModuleEnabled(PI_KEY); } catch { piEnabled = false; }
+  if (piEnabled) {
+    const piBase = path.join(REPO_ROOT, 'modules', PI_KEY);
+    try { platformIdentity = require(path.join(piBase, 'platform-identity')); hubKeys = require(path.join(piBase, 'hub-keys')); projectCatalog = require(path.join(piBase, 'project-catalog')); }
+    catch { platformIdentity = null; hubKeys = null; projectCatalog = null; }
+  }
+  _deps = { pool, provisioning, platformIdentity, hubKeys, projectCatalog };
+  return _deps;
+}
+
+// ---------------------------------------------------------------------------
+// PURE step-command generators (exported for tests). Each returns the exact shell
+// command a runbook step runs. Kept pure so the runbook and its tests build from ONE
+// source of truth.
+// ---------------------------------------------------------------------------
+
+// A slug is validated DNS/db-safe upstream (provisioning.isValidSlug), so it is
+// already shell-safe (only [a-z0-9-]). We still never interpolate untrusted text.
+
+module.exports = {
+  CONFIG,
+  MANIFEST_UA,
+  MANIFEST_VERIFY_INTERVAL_MS,
+  MANIFEST_VERIFY_TRIES,
+  MAX_INTENT_ATTEMPTS,
+  REPO_ROOT,
+  coreVersionSafe,
+  hasFlag,
+  loadDeps,
+  numEnv,
+  oauthSecret,
+  provisionerBotEmail,
+  provisionerBotName,
+  softFailResult,
+};