@envsync-cloud/deploy-cli 0.8.12 → 0.8.14

package/dist/index.js

@@ -6,7 +6,7 @@ var __export = (target, all) => {
 };
 
 // src/index.ts
-import { createHash, randomBytes } from "crypto";
+import { createHash, randomBytes, randomInt } from "crypto";
 import { spawnSync } from "child_process";
 import fs3 from "fs";
 import path3 from "path";
@@ -5156,6 +5156,7 @@ var BACKUPS_ROOT = path3.join(HOST_ROOT, "backups");
 var REPO_ROOT = process.env.ENVSYNC_REPO_ROOT ?? path3.join(HOST_ROOT, "repo");
 var DEPLOY_ENV = path3.join(ETC_ROOT, "deploy.env");
 var DEPLOY_YAML = path3.join(ETC_ROOT, "deploy.yaml");
+var WIREGUARD_ROOT = path3.join(ETC_ROOT, "wireguard");
 var LICENSE_ROOT = path3.join(ETC_ROOT, "license");
 var LICENSE_BUNDLE_FILE = path3.join(LICENSE_ROOT, "enterprise-license-bundle.json");
 var LICENSE_CERT_FILE = path3.join(LICENSE_ROOT, "enterprise-cert.pem");
@@ -5176,6 +5177,10 @@ var OTEL_AGENT_CONF = path3.join(DEPLOY_ROOT, "otel-agent.yaml");
 var CLICKSTACK_CLICKHOUSE_CONF = path3.join(DEPLOY_ROOT, "clickhouse-listen.xml");
 var INTERNAL_CONFIG_JSON = path3.join(DEPLOY_ROOT, "config.json");
 var UPGRADE_BACKUPS_ROOT = path3.join(BACKUPS_ROOT, "upgrade");
+var WIREGUARD_STATE_FILE = path3.join(WIREGUARD_ROOT, "state.json");
+var WIREGUARD_PRIVATE_KEY_FILE = path3.join(WIREGUARD_ROOT, "server-private.key");
+var WIREGUARD_PUBLIC_KEY_FILE = path3.join(WIREGUARD_ROOT, "server-public.key");
+var WIREGUARD_CONFIG_FILE = path3.join(WIREGUARD_ROOT, "envsync-wg.conf");
 var DEPLOY_RENDER_PATHS = {
   traefikStateRoot: TRAEFIK_STATE_ROOT,
   deployRoot: DEPLOY_ROOT,
@@ -5202,6 +5207,11 @@ var REMOVE_TARGETS = [
   LICENSE_ROOT_CA_FILE,
   INTERNAL_CONFIG_JSON,
   VERSIONS_LOCK,
+  WIREGUARD_ROOT,
+  WIREGUARD_STATE_FILE,
+  WIREGUARD_PRIVATE_KEY_FILE,
+  WIREGUARD_PUBLIC_KEY_FILE,
+  WIREGUARD_CONFIG_FILE,
   STACK_FILE,
   BOOTSTRAP_BASE_STACK_FILE,
   BOOTSTRAP_STACK_FILE,
@@ -5327,6 +5337,28 @@ ${stderr}` : ""}`);
   }
   return result.stdout?.toString() ?? "";
 }
+function runCapture(cmd, args, opts = {}) {
+  const result = spawnSync(cmd, args, {
+    cwd: opts.cwd,
+    env: { ...process.env, ...opts.env },
+    input: opts.input,
+    stdio: "pipe",
+    encoding: "utf8"
+  });
+  if (result.status !== 0) {
+    const stderr = typeof result.stderr === "string" ? result.stderr : "";
+    throw new Error(`Command failed: ${cmd} ${args.join(" ")}${stderr ? `
+${stderr}` : ""}`);
+  }
+  return (result.stdout ?? "").toString().trim();
+}
+function parseJsonOrDefault(value, fallback) {
+  try {
+    return JSON.parse(value);
+  } catch {
+    return fallback;
+  }
+}
 function tryRun(cmd, args, opts = {}) {
   try {
     return run(cmd, args, opts);
@@ -5413,6 +5445,93 @@ function deterministicInstallFingerprint(rootDomain, stackName) {
 function randomStrongPassword() {
   return `EnvSync!${randomBytes(8).toString("hex")}Aa1`;
 }
+function randomWireguardPort() {
+  return randomInt(5e4, 65535);
+}
+function loadWireguardState() {
+  if (!exists2(WIREGUARD_STATE_FILE)) return null;
+  const raw = JSON.parse(fs3.readFileSync(WIREGUARD_STATE_FILE, "utf8"));
+  return {
+    private_key: raw.private_key,
+    public_key: raw.public_key,
+    listen_port: raw.listen_port,
+    network: raw.network,
+    server_ip: raw.server_ip,
+    peers: Array.isArray(raw.peers) ? raw.peers : []
+  };
+}
+function saveWireguardState(state) {
+  if (currentOptions.dryRun) {
+    logDryRun(`Would save WireGuard state to ${WIREGUARD_STATE_FILE}`);
+    return;
+  }
+  writeFile(WIREGUARD_STATE_FILE, JSON.stringify(state, null, 2), 384);
+}
+function ensureWireguardState() {
+  ensureDir(WIREGUARD_ROOT);
+  let state = loadWireguardState();
+  if (state) {
+    state.private_key = state.private_key?.trim();
+    state.public_key = state.public_key?.trim();
+    state.network = state.network || "10.66.0.0/24";
+    state.server_ip = state.server_ip || "10.66.0.1";
+    state.listen_port = state.listen_port || randomWireguardPort();
+    state.peers = Array.isArray(state.peers) ? state.peers : [];
+    if (state.private_key && !state.public_key) {
+      state.public_key = runCapture("wg", ["pubkey"], { input: `${state.private_key}
+` });
+    }
+    if (!state.private_key || !state.public_key) {
+      state = null;
+    }
+  }
+  if (!state) {
+    const privateKey = runCapture("wg", ["genkey"]);
+    const publicKey = runCapture("wg", ["pubkey"], { input: `${privateKey}
+` });
+    state = {
+      private_key: privateKey,
+      public_key: publicKey,
+      listen_port: randomWireguardPort(),
+      network: "10.66.0.0/24",
+      server_ip: "10.66.0.1",
+      peers: []
+    };
+    saveWireguardState(state);
+  }
+  writeFileMaybe(WIREGUARD_PRIVATE_KEY_FILE, `${state.private_key}
+`, 384);
+  writeFileMaybe(WIREGUARD_PUBLIC_KEY_FILE, `${state.public_key}
+`);
+  return state;
+}
+function wireguardPeerAllowedIp(state) {
+  const usedIps = new Set(state.peers.map((peer) => peer.allowed_ip));
+  for (let i = 2; i <= 254; i++) {
+    const candidate = `${state.server_ip.split(".").slice(0, 3).join(".")}.${i}/32`;
+    if (!usedIps.has(candidate)) {
+      return candidate;
+    }
+  }
+  throw new Error("WireGuard client IP pool exhausted in subnet 10.66.0.0/24.");
+}
+function writeWireguardConfig(state) {
+  const peersSection = state.peers.map((peer) => `
+[Peer]
+PublicKey = ${peer.public_key}
+AllowedIPs = ${peer.allowed_ip}`).join("\n");
+  const content = `[Interface]
+Address = ${state.server_ip}/24
+ListenPort = ${state.listen_port}
+PrivateKey = ${state.private_key}
+PostUp = iptables -A FORWARD -i envsync-wg -j ACCEPT
+PostDown = iptables -D FORWARD -i envsync-wg -j ACCEPT
+PostUp = iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
+PostDown = iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
+${peersSection}
+`;
+  writeFileMaybe(WIREGUARD_CONFIG_FILE, content);
+}
 function emptyApiSlotState() {
   return {
     api_image: "",
@@ -5548,6 +5667,9 @@ function renderHelpBlock() {
     "  validate-topology    Validate Enterprise edition topology rules",
     "  upgrade [version]    Pin a target release and deploy it",
     "  upgrade-deps         Refresh dependency images and redeploy",
+    "  vpn pubkey           Generate or print WireGuard server public key",
+    "  vpn whitelist <key>  Add a client public key to allowed peers",
+    "  vpn status           Show WireGuard server/peer status",
     "  license issue-cert   Issue and install an Enterprise certificate bundle",
     "  license renew-cert   Renew and install the Enterprise certificate bundle",
     "  license validate-cert Validate the installed Enterprise certificate bundle files",
@@ -7179,7 +7301,19 @@ async function cmdPreinstall() {
   ensureDir(TRAEFIK_STATE_ROOT);
   run("bash", ["-lc", "command -v apt-get >/dev/null"]);
   run("sudo", ["apt-get", "update"]);
-  run("sudo", ["apt-get", "install", "-y", "docker.io", "docker-compose-v2", "git", "curl", "jq", "openssl", "tar"]);
+  run("sudo", [
+    "apt-get",
+    "install",
+    "-y",
+    "docker.io",
+    "docker-compose-v2",
+    "git",
+    "curl",
+    "jq",
+    "openssl",
+    "tar",
+    "wireguard-tools"
+  ]);
   run("sudo", ["systemctl", "enable", "--now", "docker"]);
   try {
     run("docker", ["swarm", "init"]);
@@ -8165,6 +8299,171 @@ async function cmdRestore(archivePath, autoDeploy = false) {
   }
   logInfo("Next: envsync-deploy deploy");
 }
+async function cmdVpn(args) {
+  const action = args[0];
+  switch (action) {
+    case "pubkey":
+      await cmdVpnPubkey();
+      break;
+    case "whitelist":
+      await cmdVpnWhitelist(args[1]);
+      break;
+    case "status":
+      await cmdVpnStatus();
+      break;
+    default:
+      throw new Error("Usage: envsync-deploy vpn <pubkey|whitelist|status>");
+  }
+}
+async function cmdVpnPubkey() {
+  logSection("WireGuard VPN");
+  const state = ensureWireguardState();
+  writeWireguardConfig(state);
+  logInfo(`WireGuard interface: envsync-wg`);
+  logInfo(`Server config: ${WIREGUARD_CONFIG_FILE}`);
+  logInfo(`Private key: ${WIREGUARD_PRIVATE_KEY_FILE}`);
+  logInfo(`Public key: ${WIREGUARD_PUBLIC_KEY_FILE}`);
+  logInfo(`Server listen port: ${state.listen_port}`);
+  logInfo(`Network: ${state.network}`);
+  console.log("");
+  logSuccess(`Server public key: ${state.public_key}`);
+}
+async function cmdVpnWhitelist(clientPublicKeyArg) {
+  if (!clientPublicKeyArg) {
+    throw new Error("usage: envsync-deploy vpn whitelist <client_public_key>");
+  }
+  const clientPublicKey = clientPublicKeyArg.trim();
+  if (!clientPublicKey) {
+    throw new Error("client public key cannot be empty");
+  }
+  const state = ensureWireguardState();
+  const existing = state.peers.find((peer) => peer.public_key === clientPublicKey);
+  if (existing) {
+    logWarn(`Client key already whitelisted for ${existing.allowed_ip}`);
+    return;
+  }
+  const allowedIp = wireguardPeerAllowedIp(state);
+  state.peers.push({
+    public_key: clientPublicKey,
+    allowed_ip: allowedIp,
+    added_at: (/* @__PURE__ */ new Date()).toISOString()
+  });
+  state.peers.sort((a, b) => a.public_key.localeCompare(b.public_key));
+  saveWireguardState(state);
+  writeWireguardConfig(state);
+  logSuccess(`Whitelisted client ${clientPublicKey}`);
+  console.log(`AllowedIP: ${allowedIp}`);
+  console.log(`Append to client config:`);
+  console.log(`[Peer]`);
+  console.log(`PublicKey = ${clientPublicKey}`);
+  console.log(`AllowedIPs = ${allowedIp}`);
+}
+function getVpnStackName() {
+  try {
+    return loadConfig().services.stack_name;
+  } catch {
+    return "envsync";
+  }
+}
+function listStackServiceNames(stackName) {
+  const raw = tryRun("docker", ["service", "ls", "--filter", `label=com.docker.stack.namespace=${stackName}`, "--format", "{{.Name}}"], {
+    quiet: true
+  });
+  if (!raw.trim()) return [];
+  return raw.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
+}
+function listServicePublishedPorts(serviceName) {
+  const raw = tryRun("docker", ["service", "inspect", "--format", "{{json .Endpoint.Ports}}", serviceName], { quiet: true });
+  const ports = parseJsonOrDefault(raw, []);
+  const list = Array.isArray(ports) ? ports : [];
+  if (list.length === 0) return [];
+  return list.map((port) => {
+    const typed = port;
+    if (!typed || typeof typed !== "object") return "";
+    if (!typed.PublishedPort || !typed.TargetPort || !typed.Protocol) return "";
+    const mode = typed.PublishMode || "ingress";
+    return `${typed.PublishedPort}/${typed.Protocol} -> ${typed.TargetPort}/${typed.Protocol} (${mode})`;
+  }).filter(Boolean);
+}
+function listRunningContainerEndpoints(serviceName) {
+  const raw = tryRun(
+    "docker",
+    ["service", "ps", serviceName, "--filter", "desired-state=running", "--no-trunc", "--format", "{{.ID}}"],
+    { quiet: true }
+  );
+  const taskIds = raw.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
+  if (taskIds.length === 0) return [];
+  const results = [];
+  for (const taskId of taskIds) {
+    const taskRaw = tryRun("docker", ["inspect", taskId, "--format", "{{json .}}"], { quiet: true });
+    if (!taskRaw) continue;
+    const inspections = parseJsonOrDefault(taskRaw, []);
+    if (!Array.isArray(inspections) || inspections.length === 0) continue;
+    const inspect = inspections[0];
+    const containerId = inspect.Status?.ContainerStatus?.ContainerID ?? "";
+    const addresses = Array.isArray(inspect.NetworksAttachments) ? inspect.NetworksAttachments.flatMap((attachment) => {
+      const networkName = attachment.Network?.Spec?.Name ?? "overlay";
+      const ips = Array.isArray(attachment.Addresses) ? attachment.Addresses : [];
+      return ips.map((ip) => {
+        const trimmed = typeof ip === "string" ? ip.trim() : "";
+        return trimmed ? `${networkName}:${trimmed}` : "";
+      }).filter(Boolean);
+    }) : [];
+    const line = `task ${taskId.slice(0, 12)} container=${containerId.slice(0, 12) || "unknown"} ${addresses.length ? `ips=${addresses.join(", ")}` : "ips=none"}`;
+    results.push(line);
+  }
+  return results;
+}
+async function cmdVpnStatus() {
+  logSection("WireGuard VPN");
+  const state = loadWireguardState();
+  if (!state) {
+    logWarn("WireGuard state not initialized.");
+    logInfo("Run: envsync-deploy vpn pubkey");
+    return;
+  }
+  logInfo(`Config file: ${WIREGUARD_CONFIG_FILE}`);
+  logInfo(`State file: ${WIREGUARD_STATE_FILE}`);
+  logInfo(`Server endpoint: 0.0.0.0:${state.listen_port}`);
+  logInfo(`Network: ${state.network}`);
+  logInfo(`Server IP: ${state.server_ip}`);
+  if (state.peers.length === 0) {
+    logInfo("Peers: none");
+  } else {
+    logInfo("Peers:");
+    for (const peer of state.peers) {
+      console.log(`  ${peer.public_key} -> ${peer.allowed_ip}`);
+    }
+  }
+  console.log("");
+  logInfo("Container endpoints:");
+  const stackName = getVpnStackName();
+  const services = listStackServiceNames(stackName);
+  if (services.length === 0) {
+    logWarn(`No running services found for stack ${stackName}`);
+  } else {
+    for (const service of services) {
+      const ports = listServicePublishedPorts(service);
+      const endpoints = listRunningContainerEndpoints(service);
+      console.log(`  ${service}`);
+      console.log(`    Published ports: ${ports.length ? ports.join(", ") : "none"}`);
+      if (endpoints.length === 0) {
+        console.log("    Containers: none running");
+      } else {
+        for (const endpoint of endpoints) {
+          console.log(`    ${endpoint}`);
+        }
+      }
+    }
+  }
+  try {
+    const ifaceStatus = runCapture("wg", ["show", "envsync-wg"]);
+    console.log("Runtime:");
+    console.log(ifaceStatus);
+  } catch {
+    logWarn("WireGuard interface is not running in kernel yet. Run wg-quick up on the generated config to activate.");
+  }
+}
 async function main() {
   const argv = process.argv.slice(2);
   const command = argv[0];
@@ -8212,6 +8511,9 @@ async function main() {
     case "upgrade-deps":
       await cmdUpgradeDeps();
       break;
+    case "vpn":
+      await cmdVpn(positionals);
+      break;
     case "license":
       await cmdLicense(positionals[0]);
       break;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@envsync-cloud/deploy-cli",
-  "version": "0.8.12",
+  "version": "0.8.14",
   "description": "CLI for self-hosted EnvSync deployment on Docker Swarm",
   "type": "module",
   "bin": {