@envsync-cloud/deploy-cli 0.8.13 → 0.8.14

package/dist/index.js

@@ -6,7 +6,7 @@ var __export = (target, all) => {
 };
 
 // src/index.ts
-import { createHash, randomBytes } from "crypto";
+import { createHash, randomBytes, randomInt } from "crypto";
 import { spawnSync } from "child_process";
 import fs3 from "fs";
 import path3 from "path";
@@ -4400,7 +4400,6 @@ function buildRuntimeEnv2(config, generated) {
   const oss = isOssConfig(config);
   const enterprise = !oss;
   const license = config.license ?? {};
-  const accessProxy = config.access_proxy;
   return {
     NODE_ENV: "production",
     ENVSYNC_EDITION: oss ? "oss" : "enterprise",
@@ -4429,13 +4428,6 @@ function buildRuntimeEnv2(config, generated) {
     POSTGRES_USER: "postgres",
     POSTGRES_PASSWORD: "envsync-postgres",
     POSTGRES_DB: "envsync",
-    ENVSYNC_ACCESS_PROXY_ENABLED: `${accessProxy?.enabled ?? false}`,
-    ENVSYNC_ACCESS_PROXY_PROVIDER: accessProxy?.provider ?? "",
-    ENVSYNC_ACCESS_PROXY_DOMAIN: accessProxy?.domain ?? "",
-    ENVSYNC_ACCESS_PROXY_SERVICE_SCOPE: accessProxy?.service_scope ?? "all",
-    ENVSYNC_ACCESS_PROXY_SERVICES: Array.isArray(accessProxy?.services) ? accessProxy.services.join(",") : "",
-    ENVSYNC_ACCESS_PROXY_ADVERTISE_ROUTES: `${accessProxy?.advertise_routes ?? false}`,
-    ENVSYNC_ACCESS_PROXY_INCLUDE_ADMIN_SERVICES: `${accessProxy?.include_admin_services ?? false}`,
     S3_BUCKET: bucketName,
     S3_REGION: "us-east-1",
     S3_ACCESS_KEY: "envsync-rustfs",
@@ -4745,16 +4737,11 @@ function renderFrontendRuntimeConfig(config, generated) {
   const otelEndpoint = publicHttpsUrl(config, hosts.obs);
   const managementApiEnabled = !isOssConfig(config);
   const activeReleaseVersion = generated.deployment.slots[generated.deployment.active_slot].release_version || config.release.version;
-  const accessProxy = config.access_proxy;
   const managementApiUrl = managementApiEnabled ? publicHttpsUrl(config, hosts.manage_api) : "";
   return `window.__ENVSYNC_RUNTIME_CONFIG__ = ${JSON.stringify({
     apiBaseUrl: publicHttpsUrl(config, hosts.api),
     appBaseUrl: publicHttpsUrl(config, hosts.app),
     authBaseUrl: publicHttpsUrl(config, hosts.auth),
-    accessProxyEnabled: accessProxy?.enabled ?? false,
-    accessProxyDomain: accessProxy?.domain ?? "",
-    accessProxyServiceScope: accessProxy?.service_scope ?? "all",
-    accessProxyServices: accessProxy?.services ?? [],
     managementApiUrl,
     keycloakRealm: config.auth.keycloak_realm,
     webClientId: config.auth.web_client_id,
@@ -5169,6 +5156,7 @@ var BACKUPS_ROOT = path3.join(HOST_ROOT, "backups");
 var REPO_ROOT = process.env.ENVSYNC_REPO_ROOT ?? path3.join(HOST_ROOT, "repo");
 var DEPLOY_ENV = path3.join(ETC_ROOT, "deploy.env");
 var DEPLOY_YAML = path3.join(ETC_ROOT, "deploy.yaml");
+var WIREGUARD_ROOT = path3.join(ETC_ROOT, "wireguard");
 var LICENSE_ROOT = path3.join(ETC_ROOT, "license");
 var LICENSE_BUNDLE_FILE = path3.join(LICENSE_ROOT, "enterprise-license-bundle.json");
 var LICENSE_CERT_FILE = path3.join(LICENSE_ROOT, "enterprise-cert.pem");
@@ -5189,6 +5177,10 @@ var OTEL_AGENT_CONF = path3.join(DEPLOY_ROOT, "otel-agent.yaml");
 var CLICKSTACK_CLICKHOUSE_CONF = path3.join(DEPLOY_ROOT, "clickhouse-listen.xml");
 var INTERNAL_CONFIG_JSON = path3.join(DEPLOY_ROOT, "config.json");
 var UPGRADE_BACKUPS_ROOT = path3.join(BACKUPS_ROOT, "upgrade");
+var WIREGUARD_STATE_FILE = path3.join(WIREGUARD_ROOT, "state.json");
+var WIREGUARD_PRIVATE_KEY_FILE = path3.join(WIREGUARD_ROOT, "server-private.key");
+var WIREGUARD_PUBLIC_KEY_FILE = path3.join(WIREGUARD_ROOT, "server-public.key");
+var WIREGUARD_CONFIG_FILE = path3.join(WIREGUARD_ROOT, "envsync-wg.conf");
 var DEPLOY_RENDER_PATHS = {
   traefikStateRoot: TRAEFIK_STATE_ROOT,
   deployRoot: DEPLOY_ROOT,
@@ -5215,6 +5207,11 @@ var REMOVE_TARGETS = [
   LICENSE_ROOT_CA_FILE,
   INTERNAL_CONFIG_JSON,
   VERSIONS_LOCK,
+  WIREGUARD_ROOT,
+  WIREGUARD_STATE_FILE,
+  WIREGUARD_PRIVATE_KEY_FILE,
+  WIREGUARD_PUBLIC_KEY_FILE,
+  WIREGUARD_CONFIG_FILE,
   STACK_FILE,
   BOOTSTRAP_BASE_STACK_FILE,
   BOOTSTRAP_STACK_FILE,
@@ -5340,6 +5337,28 @@ ${stderr}` : ""}`);
   }
   return result.stdout?.toString() ?? "";
 }
+function runCapture(cmd, args, opts = {}) {
+  const result = spawnSync(cmd, args, {
+    cwd: opts.cwd,
+    env: { ...process.env, ...opts.env },
+    input: opts.input,
+    stdio: "pipe",
+    encoding: "utf8"
+  });
+  if (result.status !== 0) {
+    const stderr = typeof result.stderr === "string" ? result.stderr : "";
+    throw new Error(`Command failed: ${cmd} ${args.join(" ")}${stderr ? `
+${stderr}` : ""}`);
+  }
+  return (result.stdout ?? "").toString().trim();
+}
+function parseJsonOrDefault(value, fallback) {
+  try {
+    return JSON.parse(value);
+  } catch {
+    return fallback;
+  }
+}
 function tryRun(cmd, args, opts = {}) {
   try {
     return run(cmd, args, opts);
@@ -5426,6 +5445,93 @@ function deterministicInstallFingerprint(rootDomain, stackName) {
 function randomStrongPassword() {
   return `EnvSync!${randomBytes(8).toString("hex")}Aa1`;
 }
+function randomWireguardPort() {
+  return randomInt(5e4, 65535);
+}
+function loadWireguardState() {
+  if (!exists2(WIREGUARD_STATE_FILE)) return null;
+  const raw = JSON.parse(fs3.readFileSync(WIREGUARD_STATE_FILE, "utf8"));
+  return {
+    private_key: raw.private_key,
+    public_key: raw.public_key,
+    listen_port: raw.listen_port,
+    network: raw.network,
+    server_ip: raw.server_ip,
+    peers: Array.isArray(raw.peers) ? raw.peers : []
+  };
+}
+function saveWireguardState(state) {
+  if (currentOptions.dryRun) {
+    logDryRun(`Would save WireGuard state to ${WIREGUARD_STATE_FILE}`);
+    return;
+  }
+  writeFile(WIREGUARD_STATE_FILE, JSON.stringify(state, null, 2), 384);
+}
+function ensureWireguardState() {
+  ensureDir(WIREGUARD_ROOT);
+  let state = loadWireguardState();
+  if (state) {
+    state.private_key = state.private_key?.trim();
+    state.public_key = state.public_key?.trim();
+    state.network = state.network || "10.66.0.0/24";
+    state.server_ip = state.server_ip || "10.66.0.1";
+    state.listen_port = state.listen_port || randomWireguardPort();
+    state.peers = Array.isArray(state.peers) ? state.peers : [];
+    if (state.private_key && !state.public_key) {
+      state.public_key = runCapture("wg", ["pubkey"], { input: `${state.private_key}
+` });
+    }
+    if (!state.private_key || !state.public_key) {
+      state = null;
+    }
+  }
+  if (!state) {
+    const privateKey = runCapture("wg", ["genkey"]);
+    const publicKey = runCapture("wg", ["pubkey"], { input: `${privateKey}
+` });
+    state = {
+      private_key: privateKey,
+      public_key: publicKey,
+      listen_port: randomWireguardPort(),
+      network: "10.66.0.0/24",
+      server_ip: "10.66.0.1",
+      peers: []
+    };
+    saveWireguardState(state);
+  }
+  writeFileMaybe(WIREGUARD_PRIVATE_KEY_FILE, `${state.private_key}
+`, 384);
+  writeFileMaybe(WIREGUARD_PUBLIC_KEY_FILE, `${state.public_key}
+`);
+  return state;
+}
+function wireguardPeerAllowedIp(state) {
+  const usedIps = new Set(state.peers.map((peer) => peer.allowed_ip));
+  for (let i = 2; i <= 254; i++) {
+    const candidate = `${state.server_ip.split(".").slice(0, 3).join(".")}.${i}/32`;
+    if (!usedIps.has(candidate)) {
+      return candidate;
+    }
+  }
+  throw new Error("WireGuard client IP pool exhausted in subnet 10.66.0.0/24.");
+}
+function writeWireguardConfig(state) {
+  const peersSection = state.peers.map((peer) => `
+[Peer]
+PublicKey = ${peer.public_key}
+AllowedIPs = ${peer.allowed_ip}`).join("\n");
+  const content = `[Interface]
+Address = ${state.server_ip}/24
+ListenPort = ${state.listen_port}
+PrivateKey = ${state.private_key}
+PostUp = iptables -A FORWARD -i envsync-wg -j ACCEPT
+PostDown = iptables -D FORWARD -i envsync-wg -j ACCEPT
+PostUp = iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
+PostDown = iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
+${peersSection}
+`;
+  writeFileMaybe(WIREGUARD_CONFIG_FILE, content);
+}
 function emptyApiSlotState() {
   return {
     api_image: "",
@@ -5475,12 +5581,6 @@ function parseEnvFile(content) {
   }
   return out;
 }
-function asBool(value) {
-  return value.trim().toLowerCase() === "true" || value.trim().toLowerCase() === "y" || value.trim().toLowerCase() === "yes";
-}
-function asStringList(value) {
-  return value.split(",").map((item) => item.trim()).filter((item) => item.length > 0);
-}
 async function ask(question, fallback = "") {
   if (!process.stdin.isTTY) return fallback;
   const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
@@ -5567,6 +5667,9 @@ function renderHelpBlock() {
     "  validate-topology    Validate Enterprise edition topology rules",
     "  upgrade [version]    Pin a target release and deploy it",
     "  upgrade-deps         Refresh dependency images and redeploy",
+    "  vpn pubkey           Generate or print WireGuard server public key",
+    "  vpn whitelist <key>  Add a client public key to allowed peers",
+    "  vpn status           Show WireGuard server/peer status",
     "  license issue-cert   Issue and install an Enterprise certificate bundle",
     "  license renew-cert   Renew and install the Enterprise certificate bundle",
     "  license validate-cert Validate the installed Enterprise certificate bundle files",
@@ -5822,30 +5925,6 @@ function normalizeConfig(raw) {
     } : raw.edition === "oss" ? void 0 : {
       install_fingerprint: deterministicInstallFingerprint(rootDomain, stackName),
       certificate_validity_days: 1095
-    },
-    access_proxy: {
-      enabled: raw.access_proxy?.enabled ?? false,
-      provider: "tsdproxy",
-      auth_token: raw.access_proxy?.auth_token ?? "",
-      domain: raw.access_proxy?.domain ?? `tsdproxy.${rootDomain}`,
-      service_scope: raw.access_proxy?.service_scope === "selected" ? "selected" : "all",
-      services: Array.isArray(raw.access_proxy?.services) ? raw.access_proxy.services.filter((s) => typeof s === "string" && s.trim().length > 0) : [
-        "api",
-        "web",
-        "landing",
-        "keycloak",
-        "openfga",
-        "postgre*",
-        "redis",
-        "rustfs",
-        "clickstack",
-        "obs",
-        "envsync_api_*",
-        "envsync_management-api",
-        "envsync-api"
-      ],
-      advertise_routes: raw.access_proxy?.advertise_routes ?? false,
-      include_admin_services: raw.access_proxy?.include_admin_services ?? false
     }
   };
 }
@@ -7222,7 +7301,19 @@ async function cmdPreinstall() {
   ensureDir(TRAEFIK_STATE_ROOT);
   run("bash", ["-lc", "command -v apt-get >/dev/null"]);
   run("sudo", ["apt-get", "update"]);
-  run("sudo", ["apt-get", "install", "-y", "docker.io", "docker-compose-v2", "git", "curl", "jq", "openssl", "tar"]);
+  run("sudo", [
+    "apt-get",
+    "install",
+    "-y",
+    "docker.io",
+    "docker-compose-v2",
+    "git",
+    "curl",
+    "jq",
+    "openssl",
+    "tar",
+    "wireguard-tools"
+  ]);
   run("sudo", ["systemctl", "enable", "--now", "docker"]);
   try {
     run("docker", ["swarm", "init"]);
@@ -7255,14 +7346,6 @@ async function cmdSetup() {
   const licenseKey = licenseServerUrl ? await ask("Enterprise license key", "") : "";
   const certificateBundleFile = licenseServerUrl ? "" : await ask("Enterprise certificate bundle file (optional)", "");
   const installFingerprint = deterministicInstallFingerprint(rootDomain, "envsync");
-  const enableAccessProxy = asBool(await ask("Enable private access proxy for container services (y/N)", "n"));
-  const accessProxyProvider = enableAccessProxy ? await ask("Private access proxy provider", "tsdproxy") : "tsdproxy";
-  const accessProxyAuthToken = enableAccessProxy ? await ask("Proxy auth token or API key", "") : "";
-  const accessProxyDomain = enableAccessProxy ? await ask("Private access domain", `tsdproxy.${rootDomain}`) : `tsdproxy.${rootDomain}`;
-  const accessProxyExposeAll = enableAccessProxy ? asBool(await ask("Expose all services through proxy (Y/n)", "y")) : true;
-  const accessProxyServices = !accessProxyExposeAll ? asStringList(await ask("Service hostnames to expose (comma-separated)", "postgres,api,web,landing,keycloak,minikms,openfga,rustfs,clickstack,obs,manage-api")) : [];
-  const includeAdminServices = enableAccessProxy ? asBool(await ask("Expose admin/maintenance services (y/N)", "n")) : false;
-  const accessProxyAdvertiseRoutes = enableAccessProxy ? asBool(await ask("Advertise overlay subnet routes through the proxy provider (y/N)", "n")) : false;
   const config = {
     edition: "enterprise",
     source: defaultSourceConfig(releaseVersion),
@@ -7335,16 +7418,6 @@ async function cmdSetup() {
       install_fingerprint: installFingerprint,
       certificate_bundle_file: certificateBundleFile || void 0,
       certificate_validity_days: 1095
-    },
-    access_proxy: {
-      enabled: enableAccessProxy,
-      provider: accessProxyProvider,
-      auth_token: accessProxyAuthToken,
-      domain: accessProxyDomain,
-      service_scope: accessProxyExposeAll ? "all" : "selected",
-      services: accessProxyServices,
-      advertise_routes: accessProxyAdvertiseRoutes,
-      include_admin_services: includeAdminServices
     }
   };
   saveDesiredConfig(config);
@@ -8226,6 +8299,171 @@ async function cmdRestore(archivePath, autoDeploy = false) {
   }
   logInfo("Next: envsync-deploy deploy");
 }
+async function cmdVpn(args) {
+  const action = args[0];
+  switch (action) {
+    case "pubkey":
+      await cmdVpnPubkey();
+      break;
+    case "whitelist":
+      await cmdVpnWhitelist(args[1]);
+      break;
+    case "status":
+      await cmdVpnStatus();
+      break;
+    default:
+      throw new Error("Usage: envsync-deploy vpn <pubkey|whitelist|status>");
+  }
+}
+async function cmdVpnPubkey() {
+  logSection("WireGuard VPN");
+  const state = ensureWireguardState();
+  writeWireguardConfig(state);
+  logInfo(`WireGuard interface: envsync-wg`);
+  logInfo(`Server config: ${WIREGUARD_CONFIG_FILE}`);
+  logInfo(`Private key: ${WIREGUARD_PRIVATE_KEY_FILE}`);
+  logInfo(`Public key: ${WIREGUARD_PUBLIC_KEY_FILE}`);
+  logInfo(`Server listen port: ${state.listen_port}`);
+  logInfo(`Network: ${state.network}`);
+  console.log("");
+  logSuccess(`Server public key: ${state.public_key}`);
+}
+async function cmdVpnWhitelist(clientPublicKeyArg) {
+  if (!clientPublicKeyArg) {
+    throw new Error("usage: envsync-deploy vpn whitelist <client_public_key>");
+  }
+  const clientPublicKey = clientPublicKeyArg.trim();
+  if (!clientPublicKey) {
+    throw new Error("client public key cannot be empty");
+  }
+  const state = ensureWireguardState();
+  const existing = state.peers.find((peer) => peer.public_key === clientPublicKey);
+  if (existing) {
+    logWarn(`Client key already whitelisted for ${existing.allowed_ip}`);
+    return;
+  }
+  const allowedIp = wireguardPeerAllowedIp(state);
+  state.peers.push({
+    public_key: clientPublicKey,
+    allowed_ip: allowedIp,
+    added_at: (/* @__PURE__ */ new Date()).toISOString()
+  });
+  state.peers.sort((a, b) => a.public_key.localeCompare(b.public_key));
+  saveWireguardState(state);
+  writeWireguardConfig(state);
+  logSuccess(`Whitelisted client ${clientPublicKey}`);
+  console.log(`AllowedIP: ${allowedIp}`);
+  console.log(`Append to client config:`);
+  console.log(`[Peer]`);
+  console.log(`PublicKey = ${clientPublicKey}`);
+  console.log(`AllowedIPs = ${allowedIp}`);
+}
+function getVpnStackName() {
+  try {
+    return loadConfig().services.stack_name;
+  } catch {
+    return "envsync";
+  }
+}
+function listStackServiceNames(stackName) {
+  const raw = tryRun("docker", ["service", "ls", "--filter", `label=com.docker.stack.namespace=${stackName}`, "--format", "{{.Name}}"], {
+    quiet: true
+  });
+  if (!raw.trim()) return [];
+  return raw.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
+}
+function listServicePublishedPorts(serviceName) {
+  const raw = tryRun("docker", ["service", "inspect", "--format", "{{json .Endpoint.Ports}}", serviceName], { quiet: true });
+  const ports = parseJsonOrDefault(raw, []);
+  const list = Array.isArray(ports) ? ports : [];
+  if (list.length === 0) return [];
+  return list.map((port) => {
+    const typed = port;
+    if (!typed || typeof typed !== "object") return "";
+    if (!typed.PublishedPort || !typed.TargetPort || !typed.Protocol) return "";
+    const mode = typed.PublishMode || "ingress";
+    return `${typed.PublishedPort}/${typed.Protocol} -> ${typed.TargetPort}/${typed.Protocol} (${mode})`;
+  }).filter(Boolean);
+}
+function listRunningContainerEndpoints(serviceName) {
+  const raw = tryRun(
+    "docker",
+    ["service", "ps", serviceName, "--filter", "desired-state=running", "--no-trunc", "--format", "{{.ID}}"],
+    { quiet: true }
+  );
+  const taskIds = raw.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
+  if (taskIds.length === 0) return [];
+  const results = [];
+  for (const taskId of taskIds) {
+    const taskRaw = tryRun("docker", ["inspect", taskId, "--format", "{{json .}}"], { quiet: true });
+    if (!taskRaw) continue;
+    const inspections = parseJsonOrDefault(taskRaw, []);
+    if (!Array.isArray(inspections) || inspections.length === 0) continue;
+    const inspect = inspections[0];
+    const containerId = inspect.Status?.ContainerStatus?.ContainerID ?? "";
+    const addresses = Array.isArray(inspect.NetworksAttachments) ? inspect.NetworksAttachments.flatMap((attachment) => {
+      const networkName = attachment.Network?.Spec?.Name ?? "overlay";
+      const ips = Array.isArray(attachment.Addresses) ? attachment.Addresses : [];
+      return ips.map((ip) => {
+        const trimmed = typeof ip === "string" ? ip.trim() : "";
+        return trimmed ? `${networkName}:${trimmed}` : "";
+      }).filter(Boolean);
+    }) : [];
+    const line = `task ${taskId.slice(0, 12)} container=${containerId.slice(0, 12) || "unknown"} ${addresses.length ? `ips=${addresses.join(", ")}` : "ips=none"}`;
+    results.push(line);
+  }
+  return results;
+}
+async function cmdVpnStatus() {
+  logSection("WireGuard VPN");
+  const state = loadWireguardState();
+  if (!state) {
+    logWarn("WireGuard state not initialized.");
+    logInfo("Run: envsync-deploy vpn pubkey");
+    return;
+  }
+  logInfo(`Config file: ${WIREGUARD_CONFIG_FILE}`);
+  logInfo(`State file: ${WIREGUARD_STATE_FILE}`);
+  logInfo(`Server endpoint: 0.0.0.0:${state.listen_port}`);
+  logInfo(`Network: ${state.network}`);
+  logInfo(`Server IP: ${state.server_ip}`);
+  if (state.peers.length === 0) {
+    logInfo("Peers: none");
+  } else {
+    logInfo("Peers:");
+    for (const peer of state.peers) {
+      console.log(`  ${peer.public_key} -> ${peer.allowed_ip}`);
+    }
+  }
+  console.log("");
+  logInfo("Container endpoints:");
+  const stackName = getVpnStackName();
+  const services = listStackServiceNames(stackName);
+  if (services.length === 0) {
+    logWarn(`No running services found for stack ${stackName}`);
+  } else {
+    for (const service of services) {
+      const ports = listServicePublishedPorts(service);
+      const endpoints = listRunningContainerEndpoints(service);
+      console.log(`  ${service}`);
+      console.log(`    Published ports: ${ports.length ? ports.join(", ") : "none"}`);
+      if (endpoints.length === 0) {
+        console.log("    Containers: none running");
+      } else {
+        for (const endpoint of endpoints) {
+          console.log(`    ${endpoint}`);
+        }
+      }
+    }
+  }
+  try {
+    const ifaceStatus = runCapture("wg", ["show", "envsync-wg"]);
+    console.log("Runtime:");
+    console.log(ifaceStatus);
+  } catch {
+    logWarn("WireGuard interface is not running in kernel yet. Run wg-quick up on the generated config to activate.");
+  }
+}
 async function main() {
   const argv = process.argv.slice(2);
   const command = argv[0];
@@ -8273,6 +8511,9 @@ async function main() {
     case "upgrade-deps":
       await cmdUpgradeDeps();
       break;
+    case "vpn":
+      await cmdVpn(positionals);
+      break;
     case "license":
       await cmdLicense(positionals[0]);
       break;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@envsync-cloud/deploy-cli",
-  "version": "0.8.13",
+  "version": "0.8.14",
   "description": "CLI for self-hosted EnvSync deployment on Docker Swarm",
   "type": "module",
   "bin": {