@ebowwa/hetzner 0.2.1 → 0.3.0

package/bootstrap/genesis.js

@@ -1,424 +0,0 @@
-"use strict";
-/**
- * Genesis Server Bootstrap Generator
- *
- * Generates cloud-init YAML scripts for Genesis server provisioning.
- * Genesis is a bootstrap/control plane node that runs com.hetzner.codespaces
- * and manages Hetzner VPS worker nodes.
- *
- * Security Integration:
- * This module integrates all security modules in the correct order:
- * 1. UFW Firewall (network-level defense)
- * 2. Kernel Hardening (system-level hardening)
- * 3. SSH Hardening (service-level hardening)
- * 4. Security Audit (verification and reporting)
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.GenesisBootstrapPresets = void 0;
-exports.generateGenesisBootstrap = generateGenesisBootstrap;
-exports.generateRemoteGenesisBootstrap = generateRemoteGenesisBootstrap;
-var ssh_hardening_1 = require("./ssh-hardening");
-var kernel_hardening_1 = require("./kernel-hardening");
-var firewall_1 = require("./firewall");
-var security_audit_1 = require("./security-audit");
-/**
- * Generate a cloud-init YAML script for Genesis server bootstrap
- *
- * @param options - Genesis bootstrap configuration options
- * @returns Cloud-init YAML string
- */
-function generateGenesisBootstrap(options) {
-    var adminSSHKey = options.adminSSHKey, _a = options.genesisRepo, genesisRepo = _a === void 0 ? "https://github.com/ebowwa/com.hetzner.codespaces" : _a, _b = options.genesisBranch, genesisBranch = _b === void 0 ? "main" : _b, _c = options.hostname, hostname = _c === void 0 ? "genesis" : _c, _d = options.defaultServerType, defaultServerType = _d === void 0 ? "cpx11" : _d, _e = options.defaultLocation, defaultLocation = _e === void 0 ? "fsn1" : _e, _f = options.maxWorkers, maxWorkers = _f === void 0 ? "10" : _f, _g = options.packages, packages = _g === void 0 ? [] : _g, _h = options.additionalCommands, additionalCommands = _h === void 0 ? [] : _h, _j = options.enableSecurity, enableSecurity = _j === void 0 ? true : _j;
-    if (!adminSSHKey) {
-        throw new Error("adminSSHKey is required for Genesis bootstrap");
-    }
-    var lines = [];
-    // Cloud-config header
-    lines.push("#cloud-config");
-    lines.push("# Genesis Server Bootstrap Configuration");
-    lines.push("# Version: 1.0.0");
-    lines.push("");
-    lines.push("# This cloud-init config bootstraps a Genesis server that:");
-    lines.push("# - Runs com.hetzner.codespaces web application");
-    lines.push("# - Uses the existing Hetzner API to create any server");
-    lines.push("# - Can be ephemeral and recreated at any time");
-    lines.push("");
-    lines.push("# IMPORTANT: Never store secrets in cloud-init! Use Vault/SOPS/external sources.");
-    lines.push("");
-    // STAGE 1: Network & Early Setup
-    lines.push("# =====================================================");
-    lines.push("# STAGE 1: Network & Early Setup (Network stage)");
-    lines.push("# =====================================================");
-    lines.push("");
-    lines.push("hostname: ".concat(hostname));
-    lines.push("manage_etc_hosts: true");
-    lines.push("timezone: UTC");
-    lines.push("");
-    // STAGE 2: SSH & Security
-    lines.push("# =====================================================");
-    lines.push("# STAGE 2: SSH & Security (Network stage)");
-    lines.push("# =====================================================");
-    lines.push("");
-    lines.push("ssh_pwauth: false");
-    lines.push("");
-    lines.push("# Create genesis service user");
-    lines.push("users:");
-    lines.push("  - name: genesis");
-    lines.push("    gecos: Genesis Service Account");
-    lines.push("    primary_group: genesis");
-    lines.push("    groups: docker,wheel");
-    lines.push("    sudo: ALL=(ALL) NOPASSWD:ALL");
-    lines.push("    shell: /bin/bash");
-    lines.push("    lock_passwd: true");
-    lines.push("    ssh_authorized_keys:");
-    lines.push("      - ".concat(adminSSHKey));
-    lines.push("");
-    // STAGE 3: Package Management
-    lines.push("# =====================================================");
-    lines.push("# STAGE 3: Package Management (Config stage)");
-    lines.push("# =====================================================");
-    lines.push("");
-    lines.push("package_update: true");
-    lines.push("package_upgrade: false");
-    lines.push("package_reboot_if_required: true");
-    lines.push("");
-    lines.push("packages:");
-    lines.push("  - curl");
-    lines.push("  - wget");
-    lines.push("  - git");
-    lines.push("  - unzip");
-    lines.push("  - jq");
-    lines.push("  - build-essential");
-    // Security Module 1: UFW Firewall packages
-    if (enableSecurity) {
-        lines.push("  # Security: UFW Firewall");
-        lines.push.apply(lines, (0, firewall_1.ufwFirewallPackages)());
-    }
-    // Security Module 2: Kernel hardening packages
-    if (enableSecurity) {
-        lines.push("  # Security: Kernel hardening");
-        lines.push.apply(lines, (0, kernel_hardening_1.kernelHardeningPackages)());
-    }
-    // Security Module 3: SSH hardening packages (fail2ban)
-    if (enableSecurity) {
-        lines.push("  # Security: SSH hardening");
-        lines.push.apply(lines, (0, ssh_hardening_1.sshdHardeningPackages)());
-    }
-    // Security Module 4: Security audit packages (lynis)
-    if (enableSecurity) {
-        lines.push("  # Security: Security audit");
-        lines.push.apply(lines, (0, security_audit_1.securityAuditPackages)());
-    }
-    // Add additional packages
-    for (var _i = 0, packages_1 = packages; _i < packages_1.length; _i++) {
-        var pkg = packages_1[_i];
-        lines.push("  - ".concat(pkg));
-    }
-    lines.push("");
-    // STAGE 4: Application Setup
-    lines.push("# =====================================================");
-    lines.push("# STAGE 4: Application Setup (Config stage)");
-    lines.push("# =====================================================");
-    lines.push("");
-    lines.push("write_files:");
-    // Genesis directories
-    lines.push("  # Genesis application directories");
-    lines.push("  - path: /opt/genesis");
-    lines.push("    owner: genesis:genesis");
-    lines.push("    permissions: '0755'");
-    lines.push("");
-    lines.push("  - path: /opt/genesis/data");
-    lines.push("    owner: genesis:genesis");
-    lines.push("    permissions: '0755'");
-    lines.push("");
-    lines.push("  - path: /var/log/genesis");
-    lines.push("    owner: genesis:genesis");
-    lines.push("    permissions: '0755'");
-    lines.push("");
-    // Environment file template
-    lines.push("  # Environment file template (do NOT include actual secrets)");
-    lines.push("  - path: /etc/default/genesis.template");
-    lines.push("    owner: genesis:genesis");
-    lines.push("    permissions: '0640'");
-    lines.push("    content: |");
-    lines.push("      # Genesis Server Environment Configuration");
-    lines.push("      # Copy this to /etc/default/genesis and fill in required values");
-    lines.push("      #");
-    lines.push("      # DO NOT commit actual secrets to version control!");
-    lines.push("");
-    lines.push("      # Application Settings");
-    lines.push("      NODE_ENV=production");
-    lines.push("      PORT=3000");
-    lines.push("      HOST=0.0.0.0");
-    lines.push("");
-    lines.push("      # Hetzner API (REQUIRED - use Vault or Secrets Manager in production)");
-    lines.push("      # HETZNER_API_TOKEN should be set securely after bootstrap");
-    lines.push("      HETZNER_DEFAULT_TYPE=" + defaultServerType);
-    lines.push("      HETZNER_DEFAULT_LOCATION=" + defaultLocation);
-    lines.push("      MAX_WORKER_NODES=" + maxWorkers);
-    lines.push("");
-    // Systemd service unit
-    lines.push("  # Genesis systemd service unit");
-    lines.push("  - path: /etc/systemd/system/genesis.service");
-    lines.push("    owner: root:root");
-    lines.push("    permissions: '0644'");
-    lines.push("    content: |");
-    lines.push("      [Unit]");
-    lines.push("      Description=Genesis Application Server (com.hetzner.codespaces)");
-    lines.push("      Documentation=https://github.com/ebowwa/com.hetzner.codespaces");
-    lines.push("      After=network-online.target");
-    lines.push("      Wants=network-online.target");
-    lines.push("");
-    lines.push("      [Service]");
-    lines.push("      Type=simple");
-    lines.push("      User=genesis");
-    lines.push("      Group=genesis");
-    lines.push("      WorkingDirectory=/opt/genesis");
-    lines.push("");
-    lines.push("      # Execution");
-    lines.push("      ExecStart=/usr/bin/bun start");
-    lines.push("      ExecReload=/bin/kill -HUP $MAINPID");
-    lines.push("");
-    lines.push("      # Restart Policy (with rate limiting)");
-    lines.push("      Restart=on-failure");
-    lines.push("      RestartSec=5s");
-    lines.push("      StartLimitIntervalSec=300");
-    lines.push("      StartLimitBurst=5");
-    lines.push("");
-    lines.push("      # Logging");
-    lines.push("      StandardOutput=journal");
-    lines.push("      StandardError=journal");
-    lines.push("      SyslogIdentifier=genesis");
-    lines.push("");
-    lines.push("      # Environment");
-    lines.push('      Environment="NODE_ENV=production"');
-    lines.push("      EnvironmentFile=/etc/default/genesis");
-    lines.push("      EnvironmentFile=-/etc/default/genesis.local");
-    lines.push("");
-    lines.push("      # Resource Limits");
-    lines.push("      LimitNOFILE=65536");
-    lines.push("");
-    // Security hardening for genesis service
-    if (enableSecurity) {
-        lines.push("      # Security Hardening");
-        lines.push("      NoNewPrivileges=true");
-        lines.push("      PrivateTmp=true");
-        lines.push("      ProtectSystem=strict");
-        lines.push("      ProtectHome=true");
-        lines.push("      ReadWritePaths=/opt/genesis/data /var/log/genesis");
-    }
-    else {
-        lines.push("      # Security Hardening (minimal)");
-        lines.push("      NoNewPrivileges=false");
-        lines.push("      PrivateTmp=false");
-    }
-    lines.push("");
-    lines.push("      [Install]");
-    lines.push("      WantedBy=multi-user.target");
-    lines.push("");
-    // Bootstrap status tracking
-    lines.push("  # Bootstrap status tracking");
-    lines.push("  - path: /root/.genesis-bootstrap-status");
-    lines.push("    owner: root:root");
-    lines.push("    permissions: '0644'");
-    lines.push("    content: |");
-    lines.push("      status=started");
-    lines.push("      started_at=$(date -Iseconds)");
-    lines.push("      source=cloud-init");
-    lines.push("      version=1.0.0");
-    if (enableSecurity) {
-        lines.push("      security=enabled");
-    }
-    lines.push("");
-    // Add bun to /etc/environment
-    lines.push("  # Add bun to /etc/environment for all users/shells");
-    lines.push("  # Format: Simple KEY=\"value\" pairs, no variable expansion");
-    lines.push("  - path: /etc/environment");
-    lines.push("    owner: root:root");
-    lines.push("    permissions: '0644'");
-    lines.push("    content: |");
-    lines.push('      PATH="/root/.bun/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"');
-    lines.push("");
-    // Security Module 1: UFW Firewall configuration files
-    if (enableSecurity) {
-        lines.push("  # Security Module 1: UFW Firewall configuration");
-        lines.push.apply(lines, (0, firewall_1.ufwFirewallWriteFiles)(firewall_1.DEFAULT_UFW_GENESIS_OPTIONS));
-    }
-    // Security Module 2: Kernel hardening configuration files
-    if (enableSecurity) {
-        lines.push("  # Security Module 2: Kernel hardening");
-        lines.push.apply(lines, (0, kernel_hardening_1.kernelHardeningWriteFiles)());
-    }
-    // Security Module 3: SSH hardening configuration files
-    if (enableSecurity) {
-        lines.push("  # Security Module 3: SSH hardening");
-        lines.push.apply(lines, (0, ssh_hardening_1.sshdHardeningWriteFiles)());
-    }
-    // Security Module 4: Security audit script
-    if (enableSecurity) {
-        lines.push("  # Security Module 4: Security audit");
-        lines.push.apply(lines, (0, security_audit_1.securityAuditWriteFiles)());
-    }
-    // STAGE 5: Run Commands
-    lines.push("# =====================================================");
-    lines.push("# STAGE 5: Run Commands (Config stage)");
-    lines.push("# =====================================================");
-    lines.push("");
-    lines.push("runcmd:");
-    // Install Bun
-    lines.push("  # Install Bun runtime");
-    lines.push("  - curl -fsSL https://bun.sh/install | bash");
-    lines.push("");
-    // Clone genesis application
-    lines.push("  # Clone/pull genesis application");
-    var cloneCmd = genesisBranch
-        ? "git clone --depth 1 --branch ".concat(genesisBranch, " ").concat(genesisRepo, " /opt/genesis")
-        : "git clone --depth 1 ".concat(genesisRepo, " /opt/genesis");
-    lines.push("  - |");
-    lines.push("    if [ ! -d /opt/genesis/.git ]; then");
-    lines.push("      ".concat(cloneCmd));
-    lines.push("    else");
-    lines.push("      cd /opt/genesis && git pull");
-    lines.push("    fi");
-    lines.push("");
-    // Install dependencies
-    lines.push("  # Install dependencies");
-    lines.push("  - cd /opt/genesis && bun install");
-    lines.push("");
-    // Build application
-    lines.push("  # Build application (if needed)");
-    lines.push("  - cd /opt/genesis && bun run build");
-    lines.push("");
-    // Configure environment warning
-    lines.push("  # Configure environment (prompt for secrets or use external source)");
-    lines.push("  - |");
-    lines.push("    echo \"WARNING: HETZNER_API_TOKEN must be configured in /etc/default/genesis\"");
-    lines.push("");
-    // Enable and start service
-    lines.push("  # Enable and start genesis service");
-    lines.push("  - systemctl daemon-reload");
-    lines.push("  - systemctl enable genesis.service");
-    lines.push("  - systemctl start genesis.service");
-    lines.push("");
-    // Security Module 1: UFW Firewall activation (runs first)
-    if (enableSecurity) {
-        lines.push("  # Security Module 1: Activate UFW Firewall");
-        lines.push.apply(lines, (0, firewall_1.ufwFirewallRunCmd)(firewall_1.DEFAULT_UFW_GENESIS_OPTIONS));
-    }
-    // Security Module 2: Kernel hardening activation
-    if (enableSecurity) {
-        lines.push("  # Security Module 2: Apply kernel hardening");
-        lines.push.apply(lines, (0, kernel_hardening_1.kernelHardeningRunCmd)());
-    }
-    // Security Module 3: SSH hardening activation
-    if (enableSecurity) {
-        lines.push("  # Security Module 3: Activate SSH hardening");
-        lines.push.apply(lines, (0, ssh_hardening_1.sshdHardeningRunCmd)());
-    }
-    // Security Module 4: Security audit (runs last)
-    if (enableSecurity) {
-        lines.push("  # Security Module 4: Run security audit");
-        lines.push.apply(lines, (0, security_audit_1.securityAuditRunCmd)());
-    }
-    // Mark bootstrap complete
-    lines.push("  # Mark bootstrap complete");
-    lines.push('  - echo "status=complete" >> /root/.genesis-bootstrap-status');
-    lines.push('  - echo "completed_at=$(date -Iseconds)" >> /root/.genesis-bootstrap-status');
-    if (enableSecurity) {
-        lines.push('  - echo "security_hardening=applied" >> /root/.genesis-bootstrap-status');
-    }
-    lines.push("");
-    // Additional commands
-    if (additionalCommands.length > 0) {
-        lines.push("  # Additional custom commands");
-        for (var _k = 0, additionalCommands_1 = additionalCommands; _k < additionalCommands_1.length; _k++) {
-            var cmd = additionalCommands_1[_k];
-            lines.push("  - ".concat(cmd));
-        }
-        lines.push("");
-    }
-    // STAGE 6: Final
-    lines.push("# =====================================================");
-    lines.push("# STAGE 6: Final (Final stage)");
-    lines.push("# =====================================================");
-    lines.push("");
-    lines.push('final_message: "Genesis server bootstrap completed after $UPTIME seconds"');
-    return lines.join("\n");
-}
-/**
- * Generate a minimal cloud-init script that uses #include to fetch from a URL
- *
- * This is useful for larger bootstrap scripts or when you want to update
- * the bootstrap without code changes.
- *
- * @param url - URL to fetch the cloud-init config from
- * @returns Cloud-init YAML string with #include directive
- */
-function generateRemoteGenesisBootstrap(url) {
-    return "#include\n".concat(url);
-}
-/**
- * Genesis bootstrap configuration presets for common scenarios
- */
-exports.GenesisBootstrapPresets = {
-    /**
-     * Default Genesis server with standard configuration and full security
-     */
-    default: function (adminSSHKey) {
-        return generateGenesisBootstrap({
-            adminSSHKey: adminSSHKey,
-        });
-    },
-    /**
-     * Genesis server with ARM architecture (CAX series - best €/performance)
-     */
-    arm: function (adminSSHKey) {
-        return generateGenesisBootstrap({
-            adminSSHKey: adminSSHKey,
-            defaultServerType: "cax21",
-        });
-    },
-    /**
-     * Genesis server with high-performance CPU (CPX series)
-     */
-    performance: function (adminSSHKey) {
-        return generateGenesisBootstrap({
-            adminSSHKey: adminSSHKey,
-            defaultServerType: "cpx21",
-        });
-    },
-    /**
-     * Genesis server with dedicated CPU (CCX series)
-     */
-    dedicated: function (adminSSHKey) {
-        return generateGenesisBootstrap({
-            adminSSHKey: adminSSHKey,
-            defaultServerType: "ccx13",
-        });
-    },
-    /**
-     * Development Genesis server without security hardening
-     */
-    development: function (adminSSHKey) {
-        return generateGenesisBootstrap({
-            adminSSHKey: adminSSHKey,
-            enableSecurity: false,
-            packages: ["htop", "vim", "tmux", "strace"],
-            additionalCommands: [
-                "echo 'Genesis development server ready' | wall",
-            ],
-        });
-    },
-    /**
-     * Secure Genesis server with full hardening and verbose logging
-     */
-    secure: function (adminSSHKey) {
-        return generateGenesisBootstrap({
-            adminSSHKey: adminSSHKey,
-            packages: ["lynis"],
-            additionalCommands: [
-                "echo 'Genesis secure server ready - security audit completed' | wall",
-            ],
-        });
-    },
-};