@envsync-cloud/deploy-cli 0.8.14 → 0.8.15

package/dist/index.js

@@ -4756,6 +4756,39 @@ function renderFrontendRuntimeConfig(config, generated) {
   }, null, 2)};
 `;
 }
+function renderNetutilsService(config) {
+  const netutils = config.netutils;
+  if (!netutils?.enabled) return "";
+  const forwards = Array.isArray(netutils.forwards) ? netutils.forwards : [];
+  if (forwards.length === 0) return "";
+  const commands = forwards.map((forward) => {
+    const protocol = forward.protocol ?? "tcp";
+    if (protocol === "udp") {
+      return `socat UDP-LISTEN:${forward.host_port},fork,reuseaddr UDP:${forward.service}:${forward.service_port} &`;
+    }
+    return `socat TCP-LISTEN:${forward.host_port},fork,reuseaddr TCP:${forward.service}:${forward.service_port} &`;
+  }).join("\n          ");
+  const ports = forwards.map((forward) => {
+    const protocol = forward.protocol ?? "tcp";
+    return `      - target: ${forward.host_port}
+      published: ${forward.host_port}
+      protocol: ${protocol}
+      mode: ingress`;
+  }).join("\n");
+  return `
+  netutils:
+    image: alpine/socat
+    command:
+      - sh
+      - -c
+      - |
+          set -eu
+          ${commands}
+          wait
+    ports:
+${ports}
+    networks: [envsync]`;
+}
 function renderOtelAgentConfig(config) {
   return [
     "receivers:",
@@ -4812,6 +4845,7 @@ function renderStack(config, runtimeEnv, generated, mode, paths) {
   const s3ServiceName = `${stackName}-s3-service`;
   const s3ConsoleRouterName = `${stackName}-s3-console-router`;
   const s3ConsoleServiceName = `${stackName}-s3-console-service`;
+  const netutilsService = renderNetutilsService(config);
   const apiEnvironment = {
     ...runtimeEnv,
     OTEL_EXPORTER_OTLP_ENDPOINT: "http://otel-agent:4318",
@@ -5079,7 +5113,7 @@ ${renderEnvList({
 ${apiLicenseVolume}
     networks: [envsync]
     deploy:
-      replicas: ${slotHasApiDeployment(deployment.slots.green) ? 1 : 0}` : ""}
+      replicas: ${slotHasApiDeployment(deployment.slots.green) ? 1 : 0}` : ""}${netutilsService}
 
 networks:
   envsync:
@@ -5448,6 +5482,91 @@ function randomStrongPassword() {
 function randomWireguardPort() {
   return randomInt(5e4, 65535);
 }
+function parsePort(value, label) {
+  const numericValue = typeof value === "string" ? Number(value.trim()) : Number(value);
+  if (!Number.isInteger(numericValue) || numericValue < 1 || numericValue > 65535) {
+    throw new Error(`Invalid ${label}: expected an integer from 1 to 65535.`);
+  }
+  return numericValue;
+}
+function parseNetutilsForwardsFromInput(raw, stackName) {
+  const chunks = asStringList(raw);
+  if (chunks.length === 0) {
+    return [];
+  }
+  const candidates = chunks.map((chunk) => {
+    const parts = chunk.split(":");
+    if (parts.length < 3 || parts.length > 4) {
+      throw new Error(
+        `Invalid netutils forward '${chunk}'. Expected format service:service_port:host_port[:protocol].`
+      );
+    }
+    return {
+      service: parts[0].trim(),
+      service_port: parts[1].trim(),
+      host_port: parts[2].trim(),
+      protocol: parts[3] ?? "tcp"
+    };
+  });
+  return normalizeNetutilsForwards(candidates, stackName, true).forwards;
+}
+function normalizeNetutilsProtocol(raw) {
+  if (typeof raw === "string") {
+    const protocol = raw.toLowerCase();
+    if (protocol === "tcp" || protocol === "udp") return protocol;
+    throw new Error(`Invalid protocol '${raw}'. Supported values are tcp or udp.`);
+  }
+  return "tcp";
+}
+function normalizeNetutilsForwards(raw, stackName, enabled) {
+  if (!Array.isArray(raw)) {
+    return {
+      enabled,
+      forwards: []
+    };
+  }
+  const usedHostPorts = /* @__PURE__ */ new Set();
+  const unique = /* @__PURE__ */ new Set();
+  const forwards = [];
+  for (const entry of raw) {
+    const candidate = entry ?? {};
+    const rawService = typeof candidate.service === "string" ? candidate.service.trim() : "";
+    if (!rawService) {
+      throw new Error("Invalid netutils forward: missing service");
+    }
+    const service = rawService.includes(".") || rawService.includes(":") || rawService.startsWith(`${stackName}_`) ? rawService : rawService;
+    const servicePort = parsePort(candidate.service_port, "service_port");
+    const hostPort = parsePort(candidate.host_port, "host_port");
+    const protocol = normalizeNetutilsProtocol(candidate.protocol);
+    const mapKey = `${service}:${servicePort}:${hostPort}:${protocol}`;
+    if (unique.has(mapKey)) {
+      continue;
+    }
+    const hostKey = `${protocol}:${hostPort}`;
+    if (usedHostPorts.has(hostKey)) {
+      throw new Error(
+        `Duplicate netutils host port mapping detected for ${protocol.toUpperCase()} ${hostPort}. Use unique host ports per protocol.`
+      );
+    }
+    unique.add(mapKey);
+    usedHostPorts.add(hostKey);
+    forwards.push({
+      service,
+      service_port: servicePort,
+      host_port: hostPort,
+      protocol
+    });
+  }
+  forwards.sort((a, b) => {
+    if (a.protocol !== b.protocol) return a.protocol.localeCompare(b.protocol);
+    if (a.host_port !== b.host_port) return a.host_port - b.host_port;
+    return a.service.localeCompare(b.service);
+  });
+  return {
+    enabled,
+    forwards
+  };
+}
 function loadWireguardState() {
   if (!exists2(WIREGUARD_STATE_FILE)) return null;
   const raw = JSON.parse(fs3.readFileSync(WIREGUARD_STATE_FILE, "utf8"));
@@ -5581,6 +5700,9 @@ function parseEnvFile(content) {
   }
   return out;
 }
+function asStringList(value) {
+  return value.split(",").map((item) => item.trim()).filter((item) => item.length > 0);
+}
 async function ask(question, fallback = "") {
   if (!process.stdin.isTTY) return fallback;
   const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
@@ -5915,6 +6037,7 @@ function normalizeConfig(raw) {
       db_snapshot_on_api_upgrade: raw.upgrade?.db_snapshot_on_api_upgrade ?? true,
       keep_failed_upgrade_db_snapshot: raw.upgrade?.keep_failed_upgrade_db_snapshot ?? true
     },
+    netutils: normalizeNetutilsForwards(raw.netutils?.forwards, stackName, raw.netutils?.enabled ?? false),
     license: raw.license ? {
       server_url: raw.license.server_url,
       key: raw.license.key,
@@ -7342,6 +7465,14 @@ async function cmdSetup() {
   const publicAuth = await ask("Expose auth.<domain> publicly (true/false)", "true") === "true";
   const publicObs = await ask("Expose obs.<domain> publicly (true/false)", "true") === "true";
   const mailpitEnabled = await ask("Enable mailpit (true/false)", "false") === "true";
+  const netutilsEnabled = await ask("Enable WireGuard jump host access (true/false)", "false") === "true";
+  const netutilsForwards = netutilsEnabled ? parseNetutilsForwardsFromInput(
+    await ask(
+      "Netutils forwards (format service:service_port:host_port[:protocol], comma-separated)",
+      "postgres:5432:15432:tcp,keycloak:8080:18080:tcp"
+    ),
+    "envsync"
+  ) : [];
   const licenseServerUrl = await ask("Enterprise license server URL", DEFAULT_ENTERPRISE_LICENSE_SERVER_URL);
   const licenseKey = licenseServerUrl ? await ask("Enterprise license key", "") : "";
   const certificateBundleFile = licenseServerUrl ? "" : await ask("Enterprise certificate bundle file (optional)", "");
@@ -7418,6 +7549,10 @@ async function cmdSetup() {
       install_fingerprint: installFingerprint,
       certificate_bundle_file: certificateBundleFile || void 0,
       certificate_validity_days: 1095
+    },
+    netutils: {
+      enabled: netutilsEnabled,
+      forwards: netutilsForwards
     }
   };
   saveDesiredConfig(config);
@@ -8397,9 +8532,9 @@ function listRunningContainerEndpoints(serviceName) {
   for (const taskId of taskIds) {
     const taskRaw = tryRun("docker", ["inspect", taskId, "--format", "{{json .}}"], { quiet: true });
     if (!taskRaw) continue;
-    const inspections = parseJsonOrDefault(taskRaw, []);
-    if (!Array.isArray(inspections) || inspections.length === 0) continue;
-    const inspect = inspections[0];
+    const parsedTaskInspect = parseJsonOrDefault(taskRaw, null);
+    const inspect = Array.isArray(parsedTaskInspect) ? parsedTaskInspect[0] : parsedTaskInspect;
+    if (!inspect || typeof inspect !== "object") continue;
     const containerId = inspect.Status?.ContainerStatus?.ContainerID ?? "";
     const addresses = Array.isArray(inspect.NetworksAttachments) ? inspect.NetworksAttachments.flatMap((attachment) => {
       const networkName = attachment.Network?.Spec?.Name ?? "overlay";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@envsync-cloud/deploy-cli",
-  "version": "0.8.14",
+  "version": "0.8.15",
   "description": "CLI for self-hosted EnvSync deployment on Docker Swarm",
   "type": "module",
   "bin": {