@envsync-cloud/deploy-cli 0.8.13 → 0.8.15

package/dist/index.js

@@ -6,7 +6,7 @@ var __export = (target, all) => {
 };
 
 // src/index.ts
-import { createHash, randomBytes } from "crypto";
+import { createHash, randomBytes, randomInt } from "crypto";
 import { spawnSync } from "child_process";
 import fs3 from "fs";
 import path3 from "path";
@@ -4400,7 +4400,6 @@ function buildRuntimeEnv2(config, generated) {
   const oss = isOssConfig(config);
   const enterprise = !oss;
   const license = config.license ?? {};
-  const accessProxy = config.access_proxy;
   return {
     NODE_ENV: "production",
     ENVSYNC_EDITION: oss ? "oss" : "enterprise",
@@ -4429,13 +4428,6 @@ function buildRuntimeEnv2(config, generated) {
     POSTGRES_USER: "postgres",
     POSTGRES_PASSWORD: "envsync-postgres",
     POSTGRES_DB: "envsync",
-    ENVSYNC_ACCESS_PROXY_ENABLED: `${accessProxy?.enabled ?? false}`,
-    ENVSYNC_ACCESS_PROXY_PROVIDER: accessProxy?.provider ?? "",
-    ENVSYNC_ACCESS_PROXY_DOMAIN: accessProxy?.domain ?? "",
-    ENVSYNC_ACCESS_PROXY_SERVICE_SCOPE: accessProxy?.service_scope ?? "all",
-    ENVSYNC_ACCESS_PROXY_SERVICES: Array.isArray(accessProxy?.services) ? accessProxy.services.join(",") : "",
-    ENVSYNC_ACCESS_PROXY_ADVERTISE_ROUTES: `${accessProxy?.advertise_routes ?? false}`,
-    ENVSYNC_ACCESS_PROXY_INCLUDE_ADMIN_SERVICES: `${accessProxy?.include_admin_services ?? false}`,
     S3_BUCKET: bucketName,
     S3_REGION: "us-east-1",
     S3_ACCESS_KEY: "envsync-rustfs",
@@ -4745,16 +4737,11 @@ function renderFrontendRuntimeConfig(config, generated) {
   const otelEndpoint = publicHttpsUrl(config, hosts.obs);
   const managementApiEnabled = !isOssConfig(config);
   const activeReleaseVersion = generated.deployment.slots[generated.deployment.active_slot].release_version || config.release.version;
-  const accessProxy = config.access_proxy;
   const managementApiUrl = managementApiEnabled ? publicHttpsUrl(config, hosts.manage_api) : "";
   return `window.__ENVSYNC_RUNTIME_CONFIG__ = ${JSON.stringify({
     apiBaseUrl: publicHttpsUrl(config, hosts.api),
     appBaseUrl: publicHttpsUrl(config, hosts.app),
     authBaseUrl: publicHttpsUrl(config, hosts.auth),
-    accessProxyEnabled: accessProxy?.enabled ?? false,
-    accessProxyDomain: accessProxy?.domain ?? "",
-    accessProxyServiceScope: accessProxy?.service_scope ?? "all",
-    accessProxyServices: accessProxy?.services ?? [],
     managementApiUrl,
     keycloakRealm: config.auth.keycloak_realm,
     webClientId: config.auth.web_client_id,
@@ -4769,6 +4756,39 @@ function renderFrontendRuntimeConfig(config, generated) {
   }, null, 2)};
 `;
 }
+function renderNetutilsService(config) {
+  const netutils = config.netutils;
+  if (!netutils?.enabled) return "";
+  const forwards = Array.isArray(netutils.forwards) ? netutils.forwards : [];
+  if (forwards.length === 0) return "";
+  const commands = forwards.map((forward) => {
+    const protocol = forward.protocol ?? "tcp";
+    if (protocol === "udp") {
+      return `socat UDP-LISTEN:${forward.host_port},fork,reuseaddr UDP:${forward.service}:${forward.service_port} &`;
+    }
+    return `socat TCP-LISTEN:${forward.host_port},fork,reuseaddr TCP:${forward.service}:${forward.service_port} &`;
+  }).join("\n          ");
+  const ports = forwards.map((forward) => {
+    const protocol = forward.protocol ?? "tcp";
+    return `      - target: ${forward.host_port}
+      published: ${forward.host_port}
+      protocol: ${protocol}
+      mode: ingress`;
+  }).join("\n");
+  return `
+  netutils:
+    image: alpine/socat
+    command:
+      - sh
+      - -c
+      - |
+          set -eu
+          ${commands}
+          wait
+    ports:
+${ports}
+    networks: [envsync]`;
+}
 function renderOtelAgentConfig(config) {
   return [
     "receivers:",
@@ -4825,6 +4845,7 @@ function renderStack(config, runtimeEnv, generated, mode, paths) {
   const s3ServiceName = `${stackName}-s3-service`;
   const s3ConsoleRouterName = `${stackName}-s3-console-router`;
   const s3ConsoleServiceName = `${stackName}-s3-console-service`;
+  const netutilsService = renderNetutilsService(config);
   const apiEnvironment = {
     ...runtimeEnv,
     OTEL_EXPORTER_OTLP_ENDPOINT: "http://otel-agent:4318",
@@ -5092,7 +5113,7 @@ ${renderEnvList({
 ${apiLicenseVolume}
     networks: [envsync]
     deploy:
-      replicas: ${slotHasApiDeployment(deployment.slots.green) ? 1 : 0}` : ""}
+      replicas: ${slotHasApiDeployment(deployment.slots.green) ? 1 : 0}` : ""}${netutilsService}
 
 networks:
   envsync:
@@ -5169,6 +5190,7 @@ var BACKUPS_ROOT = path3.join(HOST_ROOT, "backups");
 var REPO_ROOT = process.env.ENVSYNC_REPO_ROOT ?? path3.join(HOST_ROOT, "repo");
 var DEPLOY_ENV = path3.join(ETC_ROOT, "deploy.env");
 var DEPLOY_YAML = path3.join(ETC_ROOT, "deploy.yaml");
+var WIREGUARD_ROOT = path3.join(ETC_ROOT, "wireguard");
 var LICENSE_ROOT = path3.join(ETC_ROOT, "license");
 var LICENSE_BUNDLE_FILE = path3.join(LICENSE_ROOT, "enterprise-license-bundle.json");
 var LICENSE_CERT_FILE = path3.join(LICENSE_ROOT, "enterprise-cert.pem");
@@ -5189,6 +5211,10 @@ var OTEL_AGENT_CONF = path3.join(DEPLOY_ROOT, "otel-agent.yaml");
 var CLICKSTACK_CLICKHOUSE_CONF = path3.join(DEPLOY_ROOT, "clickhouse-listen.xml");
 var INTERNAL_CONFIG_JSON = path3.join(DEPLOY_ROOT, "config.json");
 var UPGRADE_BACKUPS_ROOT = path3.join(BACKUPS_ROOT, "upgrade");
+var WIREGUARD_STATE_FILE = path3.join(WIREGUARD_ROOT, "state.json");
+var WIREGUARD_PRIVATE_KEY_FILE = path3.join(WIREGUARD_ROOT, "server-private.key");
+var WIREGUARD_PUBLIC_KEY_FILE = path3.join(WIREGUARD_ROOT, "server-public.key");
+var WIREGUARD_CONFIG_FILE = path3.join(WIREGUARD_ROOT, "envsync-wg.conf");
 var DEPLOY_RENDER_PATHS = {
   traefikStateRoot: TRAEFIK_STATE_ROOT,
   deployRoot: DEPLOY_ROOT,
@@ -5215,6 +5241,11 @@ var REMOVE_TARGETS = [
   LICENSE_ROOT_CA_FILE,
   INTERNAL_CONFIG_JSON,
   VERSIONS_LOCK,
+  WIREGUARD_ROOT,
+  WIREGUARD_STATE_FILE,
+  WIREGUARD_PRIVATE_KEY_FILE,
+  WIREGUARD_PUBLIC_KEY_FILE,
+  WIREGUARD_CONFIG_FILE,
   STACK_FILE,
   BOOTSTRAP_BASE_STACK_FILE,
   BOOTSTRAP_STACK_FILE,
@@ -5340,6 +5371,28 @@ ${stderr}` : ""}`);
   }
   return result.stdout?.toString() ?? "";
 }
+function runCapture(cmd, args, opts = {}) {
+  const result = spawnSync(cmd, args, {
+    cwd: opts.cwd,
+    env: { ...process.env, ...opts.env },
+    input: opts.input,
+    stdio: "pipe",
+    encoding: "utf8"
+  });
+  if (result.status !== 0) {
+    const stderr = typeof result.stderr === "string" ? result.stderr : "";
+    throw new Error(`Command failed: ${cmd} ${args.join(" ")}${stderr ? `
+${stderr}` : ""}`);
+  }
+  return (result.stdout ?? "").toString().trim();
+}
+function parseJsonOrDefault(value, fallback) {
+  try {
+    return JSON.parse(value);
+  } catch {
+    return fallback;
+  }
+}
 function tryRun(cmd, args, opts = {}) {
   try {
     return run(cmd, args, opts);
@@ -5426,6 +5479,178 @@ function deterministicInstallFingerprint(rootDomain, stackName) {
 function randomStrongPassword() {
   return `EnvSync!${randomBytes(8).toString("hex")}Aa1`;
 }
+function randomWireguardPort() {
+  return randomInt(5e4, 65535);
+}
+function parsePort(value, label) {
+  const numericValue = typeof value === "string" ? Number(value.trim()) : Number(value);
+  if (!Number.isInteger(numericValue) || numericValue < 1 || numericValue > 65535) {
+    throw new Error(`Invalid ${label}: expected an integer from 1 to 65535.`);
+  }
+  return numericValue;
+}
+function parseNetutilsForwardsFromInput(raw, stackName) {
+  const chunks = asStringList(raw);
+  if (chunks.length === 0) {
+    return [];
+  }
+  const candidates = chunks.map((chunk) => {
+    const parts = chunk.split(":");
+    if (parts.length < 3 || parts.length > 4) {
+      throw new Error(
+        `Invalid netutils forward '${chunk}'. Expected format service:service_port:host_port[:protocol].`
+      );
+    }
+    return {
+      service: parts[0].trim(),
+      service_port: parts[1].trim(),
+      host_port: parts[2].trim(),
+      protocol: parts[3] ?? "tcp"
+    };
+  });
+  return normalizeNetutilsForwards(candidates, stackName, true).forwards;
+}
+function normalizeNetutilsProtocol(raw) {
+  if (typeof raw === "string") {
+    const protocol = raw.toLowerCase();
+    if (protocol === "tcp" || protocol === "udp") return protocol;
+    throw new Error(`Invalid protocol '${raw}'. Supported values are tcp or udp.`);
+  }
+  return "tcp";
+}
+function normalizeNetutilsForwards(raw, stackName, enabled) {
+  if (!Array.isArray(raw)) {
+    return {
+      enabled,
+      forwards: []
+    };
+  }
+  const usedHostPorts = /* @__PURE__ */ new Set();
+  const unique = /* @__PURE__ */ new Set();
+  const forwards = [];
+  for (const entry of raw) {
+    const candidate = entry ?? {};
+    const rawService = typeof candidate.service === "string" ? candidate.service.trim() : "";
+    if (!rawService) {
+      throw new Error("Invalid netutils forward: missing service");
+    }
+    const service = rawService.includes(".") || rawService.includes(":") || rawService.startsWith(`${stackName}_`) ? rawService : rawService;
+    const servicePort = parsePort(candidate.service_port, "service_port");
+    const hostPort = parsePort(candidate.host_port, "host_port");
+    const protocol = normalizeNetutilsProtocol(candidate.protocol);
+    const mapKey = `${service}:${servicePort}:${hostPort}:${protocol}`;
+    if (unique.has(mapKey)) {
+      continue;
+    }
+    const hostKey = `${protocol}:${hostPort}`;
+    if (usedHostPorts.has(hostKey)) {
+      throw new Error(
+        `Duplicate netutils host port mapping detected for ${protocol.toUpperCase()} ${hostPort}. Use unique host ports per protocol.`
+      );
+    }
+    unique.add(mapKey);
+    usedHostPorts.add(hostKey);
+    forwards.push({
+      service,
+      service_port: servicePort,
+      host_port: hostPort,
+      protocol
+    });
+  }
+  forwards.sort((a, b) => {
+    if (a.protocol !== b.protocol) return a.protocol.localeCompare(b.protocol);
+    if (a.host_port !== b.host_port) return a.host_port - b.host_port;
+    return a.service.localeCompare(b.service);
+  });
+  return {
+    enabled,
+    forwards
+  };
+}
+function loadWireguardState() {
+  if (!exists2(WIREGUARD_STATE_FILE)) return null;
+  const raw = JSON.parse(fs3.readFileSync(WIREGUARD_STATE_FILE, "utf8"));
+  return {
+    private_key: raw.private_key,
+    public_key: raw.public_key,
+    listen_port: raw.listen_port,
+    network: raw.network,
+    server_ip: raw.server_ip,
+    peers: Array.isArray(raw.peers) ? raw.peers : []
+  };
+}
+function saveWireguardState(state) {
+  if (currentOptions.dryRun) {
+    logDryRun(`Would save WireGuard state to ${WIREGUARD_STATE_FILE}`);
+    return;
+  }
+  writeFile(WIREGUARD_STATE_FILE, JSON.stringify(state, null, 2), 384);
+}
+function ensureWireguardState() {
+  ensureDir(WIREGUARD_ROOT);
+  let state = loadWireguardState();
+  if (state) {
+    state.private_key = state.private_key?.trim();
+    state.public_key = state.public_key?.trim();
+    state.network = state.network || "10.66.0.0/24";
+    state.server_ip = state.server_ip || "10.66.0.1";
+    state.listen_port = state.listen_port || randomWireguardPort();
+    state.peers = Array.isArray(state.peers) ? state.peers : [];
+    if (state.private_key && !state.public_key) {
+      state.public_key = runCapture("wg", ["pubkey"], { input: `${state.private_key}
+` });
+    }
+    if (!state.private_key || !state.public_key) {
+      state = null;
+    }
+  }
+  if (!state) {
+    const privateKey = runCapture("wg", ["genkey"]);
+    const publicKey = runCapture("wg", ["pubkey"], { input: `${privateKey}
+` });
+    state = {
+      private_key: privateKey,
+      public_key: publicKey,
+      listen_port: randomWireguardPort(),
+      network: "10.66.0.0/24",
+      server_ip: "10.66.0.1",
+      peers: []
+    };
+    saveWireguardState(state);
+  }
+  writeFileMaybe(WIREGUARD_PRIVATE_KEY_FILE, `${state.private_key}
+`, 384);
+  writeFileMaybe(WIREGUARD_PUBLIC_KEY_FILE, `${state.public_key}
+`);
+  return state;
+}
+function wireguardPeerAllowedIp(state) {
+  const usedIps = new Set(state.peers.map((peer) => peer.allowed_ip));
+  for (let i = 2; i <= 254; i++) {
+    const candidate = `${state.server_ip.split(".").slice(0, 3).join(".")}.${i}/32`;
+    if (!usedIps.has(candidate)) {
+      return candidate;
+    }
+  }
+  throw new Error("WireGuard client IP pool exhausted in subnet 10.66.0.0/24.");
+}
+function writeWireguardConfig(state) {
+  const peersSection = state.peers.map((peer) => `
+[Peer]
+PublicKey = ${peer.public_key}
+AllowedIPs = ${peer.allowed_ip}`).join("\n");
+  const content = `[Interface]
+Address = ${state.server_ip}/24
+ListenPort = ${state.listen_port}
+PrivateKey = ${state.private_key}
+PostUp = iptables -A FORWARD -i envsync-wg -j ACCEPT
+PostDown = iptables -D FORWARD -i envsync-wg -j ACCEPT
+PostUp = iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
+PostDown = iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
+${peersSection}
+`;
+  writeFileMaybe(WIREGUARD_CONFIG_FILE, content);
+}
 function emptyApiSlotState() {
   return {
     api_image: "",
@@ -5475,9 +5700,6 @@ function parseEnvFile(content) {
   }
   return out;
 }
-function asBool(value) {
-  return value.trim().toLowerCase() === "true" || value.trim().toLowerCase() === "y" || value.trim().toLowerCase() === "yes";
-}
 function asStringList(value) {
   return value.split(",").map((item) => item.trim()).filter((item) => item.length > 0);
 }
@@ -5567,6 +5789,9 @@ function renderHelpBlock() {
     "  validate-topology    Validate Enterprise edition topology rules",
     "  upgrade [version]    Pin a target release and deploy it",
     "  upgrade-deps         Refresh dependency images and redeploy",
+    "  vpn pubkey           Generate or print WireGuard server public key",
+    "  vpn whitelist <key>  Add a client public key to allowed peers",
+    "  vpn status           Show WireGuard server/peer status",
     "  license issue-cert   Issue and install an Enterprise certificate bundle",
     "  license renew-cert   Renew and install the Enterprise certificate bundle",
     "  license validate-cert Validate the installed Enterprise certificate bundle files",
@@ -5812,6 +6037,7 @@ function normalizeConfig(raw) {
       db_snapshot_on_api_upgrade: raw.upgrade?.db_snapshot_on_api_upgrade ?? true,
       keep_failed_upgrade_db_snapshot: raw.upgrade?.keep_failed_upgrade_db_snapshot ?? true
     },
+    netutils: normalizeNetutilsForwards(raw.netutils?.forwards, stackName, raw.netutils?.enabled ?? false),
     license: raw.license ? {
       server_url: raw.license.server_url,
       key: raw.license.key,
@@ -5822,30 +6048,6 @@ function normalizeConfig(raw) {
     } : raw.edition === "oss" ? void 0 : {
       install_fingerprint: deterministicInstallFingerprint(rootDomain, stackName),
       certificate_validity_days: 1095
-    },
-    access_proxy: {
-      enabled: raw.access_proxy?.enabled ?? false,
-      provider: "tsdproxy",
-      auth_token: raw.access_proxy?.auth_token ?? "",
-      domain: raw.access_proxy?.domain ?? `tsdproxy.${rootDomain}`,
-      service_scope: raw.access_proxy?.service_scope === "selected" ? "selected" : "all",
-      services: Array.isArray(raw.access_proxy?.services) ? raw.access_proxy.services.filter((s) => typeof s === "string" && s.trim().length > 0) : [
-        "api",
-        "web",
-        "landing",
-        "keycloak",
-        "openfga",
-        "postgre*",
-        "redis",
-        "rustfs",
-        "clickstack",
-        "obs",
-        "envsync_api_*",
-        "envsync_management-api",
-        "envsync-api"
-      ],
-      advertise_routes: raw.access_proxy?.advertise_routes ?? false,
-      include_admin_services: raw.access_proxy?.include_admin_services ?? false
     }
   };
 }
@@ -7222,7 +7424,19 @@ async function cmdPreinstall() {
   ensureDir(TRAEFIK_STATE_ROOT);
   run("bash", ["-lc", "command -v apt-get >/dev/null"]);
   run("sudo", ["apt-get", "update"]);
-  run("sudo", ["apt-get", "install", "-y", "docker.io", "docker-compose-v2", "git", "curl", "jq", "openssl", "tar"]);
+  run("sudo", [
+    "apt-get",
+    "install",
+    "-y",
+    "docker.io",
+    "docker-compose-v2",
+    "git",
+    "curl",
+    "jq",
+    "openssl",
+    "tar",
+    "wireguard-tools"
+  ]);
   run("sudo", ["systemctl", "enable", "--now", "docker"]);
   try {
     run("docker", ["swarm", "init"]);
@@ -7251,18 +7465,18 @@ async function cmdSetup() {
   const publicAuth = await ask("Expose auth.<domain> publicly (true/false)", "true") === "true";
   const publicObs = await ask("Expose obs.<domain> publicly (true/false)", "true") === "true";
   const mailpitEnabled = await ask("Enable mailpit (true/false)", "false") === "true";
+  const netutilsEnabled = await ask("Enable WireGuard jump host access (true/false)", "false") === "true";
+  const netutilsForwards = netutilsEnabled ? parseNetutilsForwardsFromInput(
+    await ask(
+      "Netutils forwards (format service:service_port:host_port[:protocol], comma-separated)",
+      "postgres:5432:15432:tcp,keycloak:8080:18080:tcp"
+    ),
+    "envsync"
+  ) : [];
   const licenseServerUrl = await ask("Enterprise license server URL", DEFAULT_ENTERPRISE_LICENSE_SERVER_URL);
   const licenseKey = licenseServerUrl ? await ask("Enterprise license key", "") : "";
   const certificateBundleFile = licenseServerUrl ? "" : await ask("Enterprise certificate bundle file (optional)", "");
   const installFingerprint = deterministicInstallFingerprint(rootDomain, "envsync");
-  const enableAccessProxy = asBool(await ask("Enable private access proxy for container services (y/N)", "n"));
-  const accessProxyProvider = enableAccessProxy ? await ask("Private access proxy provider", "tsdproxy") : "tsdproxy";
-  const accessProxyAuthToken = enableAccessProxy ? await ask("Proxy auth token or API key", "") : "";
-  const accessProxyDomain = enableAccessProxy ? await ask("Private access domain", `tsdproxy.${rootDomain}`) : `tsdproxy.${rootDomain}`;
-  const accessProxyExposeAll = enableAccessProxy ? asBool(await ask("Expose all services through proxy (Y/n)", "y")) : true;
-  const accessProxyServices = !accessProxyExposeAll ? asStringList(await ask("Service hostnames to expose (comma-separated)", "postgres,api,web,landing,keycloak,minikms,openfga,rustfs,clickstack,obs,manage-api")) : [];
-  const includeAdminServices = enableAccessProxy ? asBool(await ask("Expose admin/maintenance services (y/N)", "n")) : false;
-  const accessProxyAdvertiseRoutes = enableAccessProxy ? asBool(await ask("Advertise overlay subnet routes through the proxy provider (y/N)", "n")) : false;
   const config = {
     edition: "enterprise",
     source: defaultSourceConfig(releaseVersion),
@@ -7336,15 +7550,9 @@ async function cmdSetup() {
       certificate_bundle_file: certificateBundleFile || void 0,
       certificate_validity_days: 1095
     },
-    access_proxy: {
-      enabled: enableAccessProxy,
-      provider: accessProxyProvider,
-      auth_token: accessProxyAuthToken,
-      domain: accessProxyDomain,
-      service_scope: accessProxyExposeAll ? "all" : "selected",
-      services: accessProxyServices,
-      advertise_routes: accessProxyAdvertiseRoutes,
-      include_admin_services: includeAdminServices
+    netutils: {
+      enabled: netutilsEnabled,
+      forwards: netutilsForwards
     }
   };
   saveDesiredConfig(config);
@@ -8226,6 +8434,171 @@ async function cmdRestore(archivePath, autoDeploy = false) {
   }
   logInfo("Next: envsync-deploy deploy");
 }
+async function cmdVpn(args) {
+  const action = args[0];
+  switch (action) {
+    case "pubkey":
+      await cmdVpnPubkey();
+      break;
+    case "whitelist":
+      await cmdVpnWhitelist(args[1]);
+      break;
+    case "status":
+      await cmdVpnStatus();
+      break;
+    default:
+      throw new Error("Usage: envsync-deploy vpn <pubkey|whitelist|status>");
+  }
+}
+async function cmdVpnPubkey() {
+  logSection("WireGuard VPN");
+  const state = ensureWireguardState();
+  writeWireguardConfig(state);
+  logInfo(`WireGuard interface: envsync-wg`);
+  logInfo(`Server config: ${WIREGUARD_CONFIG_FILE}`);
+  logInfo(`Private key: ${WIREGUARD_PRIVATE_KEY_FILE}`);
+  logInfo(`Public key: ${WIREGUARD_PUBLIC_KEY_FILE}`);
+  logInfo(`Server listen port: ${state.listen_port}`);
+  logInfo(`Network: ${state.network}`);
+  console.log("");
+  logSuccess(`Server public key: ${state.public_key}`);
+}
+async function cmdVpnWhitelist(clientPublicKeyArg) {
+  if (!clientPublicKeyArg) {
+    throw new Error("usage: envsync-deploy vpn whitelist <client_public_key>");
+  }
+  const clientPublicKey = clientPublicKeyArg.trim();
+  if (!clientPublicKey) {
+    throw new Error("client public key cannot be empty");
+  }
+  const state = ensureWireguardState();
+  const existing = state.peers.find((peer) => peer.public_key === clientPublicKey);
+  if (existing) {
+    logWarn(`Client key already whitelisted for ${existing.allowed_ip}`);
+    return;
+  }
+  const allowedIp = wireguardPeerAllowedIp(state);
+  state.peers.push({
+    public_key: clientPublicKey,
+    allowed_ip: allowedIp,
+    added_at: (/* @__PURE__ */ new Date()).toISOString()
+  });
+  state.peers.sort((a, b) => a.public_key.localeCompare(b.public_key));
+  saveWireguardState(state);
+  writeWireguardConfig(state);
+  logSuccess(`Whitelisted client ${clientPublicKey}`);
+  console.log(`AllowedIP: ${allowedIp}`);
+  console.log(`Append to client config:`);
+  console.log(`[Peer]`);
+  console.log(`PublicKey = ${clientPublicKey}`);
+  console.log(`AllowedIPs = ${allowedIp}`);
+}
+function getVpnStackName() {
+  try {
+    return loadConfig().services.stack_name;
+  } catch {
+    return "envsync";
+  }
+}
+function listStackServiceNames(stackName) {
+  const raw = tryRun("docker", ["service", "ls", "--filter", `label=com.docker.stack.namespace=${stackName}`, "--format", "{{.Name}}"], {
+    quiet: true
+  });
+  if (!raw.trim()) return [];
+  return raw.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
+}
+function listServicePublishedPorts(serviceName) {
+  const raw = tryRun("docker", ["service", "inspect", "--format", "{{json .Endpoint.Ports}}", serviceName], { quiet: true });
+  const ports = parseJsonOrDefault(raw, []);
+  const list = Array.isArray(ports) ? ports : [];
+  if (list.length === 0) return [];
+  return list.map((port) => {
+    const typed = port;
+    if (!typed || typeof typed !== "object") return "";
+    if (!typed.PublishedPort || !typed.TargetPort || !typed.Protocol) return "";
+    const mode = typed.PublishMode || "ingress";
+    return `${typed.PublishedPort}/${typed.Protocol} -> ${typed.TargetPort}/${typed.Protocol} (${mode})`;
+  }).filter(Boolean);
+}
+function listRunningContainerEndpoints(serviceName) {
+  const raw = tryRun(
+    "docker",
+    ["service", "ps", serviceName, "--filter", "desired-state=running", "--no-trunc", "--format", "{{.ID}}"],
+    { quiet: true }
+  );
+  const taskIds = raw.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
+  if (taskIds.length === 0) return [];
+  const results = [];
+  for (const taskId of taskIds) {
+    const taskRaw = tryRun("docker", ["inspect", taskId, "--format", "{{json .}}"], { quiet: true });
+    if (!taskRaw) continue;
+    const parsedTaskInspect = parseJsonOrDefault(taskRaw, null);
+    const inspect = Array.isArray(parsedTaskInspect) ? parsedTaskInspect[0] : parsedTaskInspect;
+    if (!inspect || typeof inspect !== "object") continue;
+    const containerId = inspect.Status?.ContainerStatus?.ContainerID ?? "";
+    const addresses = Array.isArray(inspect.NetworksAttachments) ? inspect.NetworksAttachments.flatMap((attachment) => {
+      const networkName = attachment.Network?.Spec?.Name ?? "overlay";
+      const ips = Array.isArray(attachment.Addresses) ? attachment.Addresses : [];
+      return ips.map((ip) => {
+        const trimmed = typeof ip === "string" ? ip.trim() : "";
+        return trimmed ? `${networkName}:${trimmed}` : "";
+      }).filter(Boolean);
+    }) : [];
+    const line = `task ${taskId.slice(0, 12)} container=${containerId.slice(0, 12) || "unknown"} ${addresses.length ? `ips=${addresses.join(", ")}` : "ips=none"}`;
+    results.push(line);
+  }
+  return results;
+}
+async function cmdVpnStatus() {
+  logSection("WireGuard VPN");
+  const state = loadWireguardState();
+  if (!state) {
+    logWarn("WireGuard state not initialized.");
+    logInfo("Run: envsync-deploy vpn pubkey");
+    return;
+  }
+  logInfo(`Config file: ${WIREGUARD_CONFIG_FILE}`);
+  logInfo(`State file: ${WIREGUARD_STATE_FILE}`);
+  logInfo(`Server endpoint: 0.0.0.0:${state.listen_port}`);
+  logInfo(`Network: ${state.network}`);
+  logInfo(`Server IP: ${state.server_ip}`);
+  if (state.peers.length === 0) {
+    logInfo("Peers: none");
+  } else {
+    logInfo("Peers:");
+    for (const peer of state.peers) {
+      console.log(`  ${peer.public_key} -> ${peer.allowed_ip}`);
+    }
+  }
+  console.log("");
+  logInfo("Container endpoints:");
+  const stackName = getVpnStackName();
+  const services = listStackServiceNames(stackName);
+  if (services.length === 0) {
+    logWarn(`No running services found for stack ${stackName}`);
+  } else {
+    for (const service of services) {
+      const ports = listServicePublishedPorts(service);
+      const endpoints = listRunningContainerEndpoints(service);
+      console.log(`  ${service}`);
+      console.log(`    Published ports: ${ports.length ? ports.join(", ") : "none"}`);
+      if (endpoints.length === 0) {
+        console.log("    Containers: none running");
+      } else {
+        for (const endpoint of endpoints) {
+          console.log(`    ${endpoint}`);
+        }
+      }
+    }
+  }
+  try {
+    const ifaceStatus = runCapture("wg", ["show", "envsync-wg"]);
+    console.log("Runtime:");
+    console.log(ifaceStatus);
+  } catch {
+    logWarn("WireGuard interface is not running in kernel yet. Run wg-quick up on the generated config to activate.");
+  }
+}
 async function main() {
   const argv = process.argv.slice(2);
   const command = argv[0];
@@ -8273,6 +8646,9 @@ async function main() {
     case "upgrade-deps":
       await cmdUpgradeDeps();
       break;
+    case "vpn":
+      await cmdVpn(positionals);
+      break;
     case "license":
       await cmdLicense(positionals[0]);
       break;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@envsync-cloud/deploy-cli",
-  "version": "0.8.13",
+  "version": "0.8.15",
   "description": "CLI for self-hosted EnvSync deployment on Docker Swarm",
   "type": "module",
   "bin": {