@envsync-cloud/deploy-cli 0.8.14 → 0.8.16

package/dist/index.js

@@ -4756,6 +4756,39 @@ function renderFrontendRuntimeConfig(config, generated) {
   }, null, 2)};
 `;
 }
+function renderNetutilsService(config) {
+  const netutils = config.netutils;
+  if (!netutils?.enabled) return "";
+  const forwards = Array.isArray(netutils.forwards) ? netutils.forwards : [];
+  if (forwards.length === 0) return "";
+  const commands = forwards.map((forward) => {
+    const protocol = forward.protocol ?? "tcp";
+    if (protocol === "udp") {
+      return `socat UDP-LISTEN:${forward.host_port},fork,reuseaddr UDP:${forward.service}:${forward.service_port} &`;
+    }
+    return `socat TCP-LISTEN:${forward.host_port},fork,reuseaddr TCP:${forward.service}:${forward.service_port} &`;
+  }).join("\n          ");
+  const ports = forwards.map((forward) => {
+    const protocol = forward.protocol ?? "tcp";
+    return `      - target: ${forward.host_port}
+      published: ${forward.host_port}
+      protocol: ${protocol}
+      mode: ingress`;
+  }).join("\n");
+  return `
+  netutils:
+    image: alpine/socat
+    command:
+      - sh
+      - -c
+      - |
+          set -eu
+          ${commands}
+          wait
+    ports:
+${ports}
+    networks: [envsync]`;
+}
 function renderOtelAgentConfig(config) {
   return [
     "receivers:",
@@ -4812,6 +4845,7 @@ function renderStack(config, runtimeEnv, generated, mode, paths) {
   const s3ServiceName = `${stackName}-s3-service`;
   const s3ConsoleRouterName = `${stackName}-s3-console-router`;
   const s3ConsoleServiceName = `${stackName}-s3-console-service`;
+  const netutilsService = renderNetutilsService(config);
   const apiEnvironment = {
     ...runtimeEnv,
     OTEL_EXPORTER_OTLP_ENDPOINT: "http://otel-agent:4318",
@@ -5079,7 +5113,7 @@ ${renderEnvList({
 ${apiLicenseVolume}
     networks: [envsync]
     deploy:
-      replicas: ${slotHasApiDeployment(deployment.slots.green) ? 1 : 0}` : ""}
+      replicas: ${slotHasApiDeployment(deployment.slots.green) ? 1 : 0}` : ""}${netutilsService}
 
 networks:
   envsync:
@@ -5147,6 +5181,30 @@ function validateStaticBundle(kind, targetDir) {
 }
 
 // src/index.ts
+var NETUTILS_EXPOSE_ALL_START_PORT = 15e3;
+var NETUTILS_EXPOSE_ALL_PORTS = [
+  { service: "postgres", service_port: 5432, protocol: "tcp" },
+  { service: "envsync_api_blue", service_port: 4e3, protocol: "tcp" },
+  { service: "envsync_api_green", service_port: 4e3, protocol: "tcp" },
+  { service: "envsync-management-api", service_port: 4001, protocol: "tcp" },
+  { service: "keycloak", service_port: 8080, protocol: "tcp" },
+  { service: "openfga", service_port: 8090, protocol: "tcp" },
+  { service: "minikms", service_port: 50051, protocol: "tcp" },
+  { service: "keycloak_db", service_port: 5432, protocol: "tcp" },
+  { service: "openfga_db", service_port: 5432, protocol: "tcp" },
+  { service: "minikms_db", service_port: 5432, protocol: "tcp" },
+  { service: "redis", service_port: 6379, protocol: "tcp" },
+  { service: "rustfs", service_port: 9e3, protocol: "tcp" },
+  { service: "rustfs", service_port: 9001, protocol: "tcp" },
+  { service: "clickstack", service_port: 8080, protocol: "tcp" },
+  { service: "otel-agent", service_port: 4317, protocol: "tcp" },
+  { service: "otel-agent", service_port: 4318, protocol: "tcp" },
+  { service: "traefik", service_port: 80, protocol: "tcp" },
+  { service: "traefik", service_port: 443, protocol: "tcp" },
+  { service: "web_nginx", service_port: 80, protocol: "tcp" },
+  { service: "landing_nginx", service_port: 80, protocol: "tcp" },
+  { service: "api_maintenance", service_port: 80, protocol: "tcp" }
+];
 var HOST_ROOT = process.env.ENVSYNC_HOST_ROOT ?? "/opt/envsync";
 var ETC_ROOT = process.env.ENVSYNC_ETC_ROOT ?? "/etc/envsync";
 var TRAEFIK_STATE_ROOT = process.env.ENVSYNC_TRAEFIK_STATE_ROOT ?? "/var/lib/envsync/traefik";
@@ -5352,6 +5410,69 @@ ${stderr}` : ""}`);
   }
   return (result.stdout ?? "").toString().trim();
 }
+function chunkByMax(items, max) {
+  if (items.length === 0) return [];
+  const chunks = [];
+  for (let i = 0; i < items.length; i += max) {
+    chunks.push(items.slice(i, i + max));
+  }
+  return chunks;
+}
+function formatPortRangesForIptables(ports) {
+  const sortedPorts = Array.from(new Set(ports)).map((port) => parseInt(String(port), 10)).filter((port) => Number.isInteger(port) && port >= 1 && port <= 65535).sort((a, b) => a - b);
+  if (sortedPorts.length === 0) return [];
+  const ranges = [];
+  let rangeStart = sortedPorts[0];
+  let previous = sortedPorts[0];
+  for (let i = 1; i < sortedPorts.length; i++) {
+    const current = sortedPorts[i];
+    if (current === previous + 1) {
+      previous = current;
+      continue;
+    }
+    ranges.push(rangeStart === previous ? `${rangeStart}` : `${rangeStart}:${previous}`);
+    rangeStart = current;
+    previous = current;
+  }
+  ranges.push(rangeStart === previous ? `${rangeStart}` : `${rangeStart}:${previous}`);
+  return ranges;
+}
+function formatNetutilsFirewallRules(config) {
+  if (!config?.netutils?.enabled || !Array.isArray(config.netutils.forwards) || config.netutils.forwards.length === 0) {
+    return [];
+  }
+  const tcpPorts = config.netutils.forwards.filter((item) => item.protocol === "tcp").map((item) => item.host_port);
+  const udpPorts = config.netutils.forwards.filter((item) => item.protocol === "udp").map((item) => item.host_port);
+  const tcpRanges = formatPortRangesForIptables(tcpPorts);
+  const udpRanges = formatPortRangesForIptables(udpPorts);
+  if (tcpRanges.length === 0 && udpRanges.length === 0) return [];
+  const lines = [];
+  const addRules = (protocol, ranges) => {
+    for (const chunk of chunkByMax(ranges, 15)) {
+      const portSpec = chunk.join(",");
+      lines.push(
+        `PostUp = iptables -I DOCKER-USER -i envsync-wg -p ${protocol} -m multiport --dports ${portSpec} -j ACCEPT`
+      );
+      lines.push(`PostUp = iptables -A DOCKER-USER -p ${protocol} -m multiport --dports ${portSpec} -j DROP`);
+      lines.push(
+        `PostDown = iptables -D DOCKER-USER -p ${protocol} -m multiport --dports ${portSpec} -j DROP`
+      );
+      lines.push(
+        `PostDown = iptables -D DOCKER-USER -i envsync-wg -p ${protocol} -m multiport --dports ${portSpec} -j ACCEPT`
+      );
+    }
+  };
+  addRules("tcp", tcpRanges);
+  addRules("udp", udpRanges);
+  return lines;
+}
+function tryLoadOptionalConfig() {
+  try {
+    return loadConfig();
+  } catch {
+    return null;
+  }
+}
 function parseJsonOrDefault(value, fallback) {
   try {
     return JSON.parse(value);
@@ -5448,6 +5569,100 @@ function randomStrongPassword() {
 function randomWireguardPort() {
   return randomInt(5e4, 65535);
 }
+function parsePort(value, label) {
+  const numericValue = typeof value === "string" ? Number(value.trim()) : Number(value);
+  if (!Number.isInteger(numericValue) || numericValue < 1 || numericValue > 65535) {
+    throw new Error(`Invalid ${label}: expected an integer from 1 to 65535.`);
+  }
+  return numericValue;
+}
+function parseNetutilsForwardsFromInput(raw, stackName) {
+  const chunks = asStringList(raw);
+  if (chunks.length === 0) {
+    return [];
+  }
+  const candidates = chunks.map((chunk) => {
+    const parts = chunk.split(":");
+    if (parts.length < 3 || parts.length > 4) {
+      throw new Error(
+        `Invalid netutils forward '${chunk}'. Expected format service:service_port:host_port[:protocol].`
+      );
+    }
+    return {
+      service: parts[0].trim(),
+      service_port: parts[1].trim(),
+      host_port: parts[2].trim(),
+      protocol: parts[3] ?? "tcp"
+    };
+  });
+  return normalizeNetutilsForwards(candidates, stackName, true).forwards;
+}
+function buildNetutilsExposeAllForwards(stackName) {
+  const candidates = NETUTILS_EXPOSE_ALL_PORTS.map((forward, index) => ({
+    service: forward.service,
+    service_port: forward.service_port,
+    host_port: NETUTILS_EXPOSE_ALL_START_PORT + index,
+    protocol: forward.protocol
+  }));
+  return normalizeNetutilsForwards(candidates, stackName, true).forwards;
+}
+function normalizeNetutilsProtocol(raw) {
+  if (typeof raw === "string") {
+    const protocol = raw.toLowerCase();
+    if (protocol === "tcp" || protocol === "udp") return protocol;
+    throw new Error(`Invalid protocol '${raw}'. Supported values are tcp or udp.`);
+  }
+  return "tcp";
+}
+function normalizeNetutilsForwards(raw, stackName, enabled) {
+  if (!Array.isArray(raw)) {
+    return {
+      enabled,
+      forwards: []
+    };
+  }
+  const usedHostPorts = /* @__PURE__ */ new Set();
+  const unique = /* @__PURE__ */ new Set();
+  const forwards = [];
+  for (const entry of raw) {
+    const candidate = entry ?? {};
+    const rawService = typeof candidate.service === "string" ? candidate.service.trim() : "";
+    if (!rawService) {
+      throw new Error("Invalid netutils forward: missing service");
+    }
+    const service = rawService.includes(".") || rawService.includes(":") || rawService.startsWith(`${stackName}_`) ? rawService : rawService;
+    const servicePort = parsePort(candidate.service_port, "service_port");
+    const hostPort = parsePort(candidate.host_port, "host_port");
+    const protocol = normalizeNetutilsProtocol(candidate.protocol);
+    const mapKey = `${service}:${servicePort}:${hostPort}:${protocol}`;
+    if (unique.has(mapKey)) {
+      continue;
+    }
+    const hostKey = `${protocol}:${hostPort}`;
+    if (usedHostPorts.has(hostKey)) {
+      throw new Error(
+        `Duplicate netutils host port mapping detected for ${protocol.toUpperCase()} ${hostPort}. Use unique host ports per protocol.`
+      );
+    }
+    unique.add(mapKey);
+    usedHostPorts.add(hostKey);
+    forwards.push({
+      service,
+      service_port: servicePort,
+      host_port: hostPort,
+      protocol
+    });
+  }
+  forwards.sort((a, b) => {
+    if (a.protocol !== b.protocol) return a.protocol.localeCompare(b.protocol);
+    if (a.host_port !== b.host_port) return a.host_port - b.host_port;
+    return a.service.localeCompare(b.service);
+  });
+  return {
+    enabled,
+    forwards
+  };
+}
 function loadWireguardState() {
   if (!exists2(WIREGUARD_STATE_FILE)) return null;
   const raw = JSON.parse(fs3.readFileSync(WIREGUARD_STATE_FILE, "utf8"));
@@ -5516,6 +5731,8 @@ function wireguardPeerAllowedIp(state) {
   throw new Error("WireGuard client IP pool exhausted in subnet 10.66.0.0/24.");
 }
 function writeWireguardConfig(state) {
+  const config = tryLoadOptionalConfig();
+  const netutilsFirewallRules = formatNetutilsFirewallRules(config);
   const peersSection = state.peers.map((peer) => `
 [Peer]
 PublicKey = ${peer.public_key}
@@ -5528,6 +5745,7 @@ PostUp = iptables -A FORWARD -i envsync-wg -j ACCEPT
 PostDown = iptables -D FORWARD -i envsync-wg -j ACCEPT
 PostUp = iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
 PostDown = iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
+${netutilsFirewallRules.join("\n")}
 ${peersSection}
 `;
   writeFileMaybe(WIREGUARD_CONFIG_FILE, content);
@@ -5581,6 +5799,9 @@ function parseEnvFile(content) {
   }
   return out;
 }
+function asStringList(value) {
+  return value.split(",").map((item) => item.trim()).filter((item) => item.length > 0);
+}
 async function ask(question, fallback = "") {
   if (!process.stdin.isTTY) return fallback;
   const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
@@ -5915,6 +6136,7 @@ function normalizeConfig(raw) {
       db_snapshot_on_api_upgrade: raw.upgrade?.db_snapshot_on_api_upgrade ?? true,
       keep_failed_upgrade_db_snapshot: raw.upgrade?.keep_failed_upgrade_db_snapshot ?? true
     },
+    netutils: normalizeNetutilsForwards(raw.netutils?.forwards, stackName, raw.netutils?.enabled ?? false),
     license: raw.license ? {
       server_url: raw.license.server_url,
       key: raw.license.key,
@@ -7342,6 +7564,26 @@ async function cmdSetup() {
   const publicAuth = await ask("Expose auth.<domain> publicly (true/false)", "true") === "true";
   const publicObs = await ask("Expose obs.<domain> publicly (true/false)", "true") === "true";
   const mailpitEnabled = await ask("Enable mailpit (true/false)", "false") === "true";
+  const netutilsEnabled = await ask("Enable WireGuard jump host access (true/false)", "false") === "true";
+  const netutilsExposeAll = netutilsEnabled ? await ask("Expose all EnvSync service ports over WireGuard (true/false)", "false") === "true" : false;
+  let netutilsForwards = [];
+  if (netutilsEnabled) {
+    if (netutilsExposeAll) {
+      netutilsForwards = buildNetutilsExposeAllForwards("envsync");
+      logInfo("Netutils exposes all preset (auto-generated):");
+      for (const forward of netutilsForwards) {
+        console.log(`  ${forward.service}:${forward.service_port} -> ${forward.host_port} (${forward.protocol})`);
+      }
+    } else {
+      netutilsForwards = parseNetutilsForwardsFromInput(
+        await ask(
+          "Netutils forwards (format service:service_port:host_port[:protocol], comma-separated)",
+          "postgres:5432:15432:tcp,keycloak:8080:18080:tcp"
+        ),
+        "envsync"
+      );
+    }
+  }
   const licenseServerUrl = await ask("Enterprise license server URL", DEFAULT_ENTERPRISE_LICENSE_SERVER_URL);
   const licenseKey = licenseServerUrl ? await ask("Enterprise license key", "") : "";
   const certificateBundleFile = licenseServerUrl ? "" : await ask("Enterprise certificate bundle file (optional)", "");
@@ -7418,6 +7660,10 @@ async function cmdSetup() {
       install_fingerprint: installFingerprint,
       certificate_bundle_file: certificateBundleFile || void 0,
       certificate_validity_days: 1095
+    },
+    netutils: {
+      enabled: netutilsEnabled,
+      forwards: netutilsForwards
     }
   };
   saveDesiredConfig(config);
@@ -8397,9 +8643,9 @@ function listRunningContainerEndpoints(serviceName) {
   for (const taskId of taskIds) {
     const taskRaw = tryRun("docker", ["inspect", taskId, "--format", "{{json .}}"], { quiet: true });
     if (!taskRaw) continue;
-    const inspections = parseJsonOrDefault(taskRaw, []);
-    if (!Array.isArray(inspections) || inspections.length === 0) continue;
-    const inspect = inspections[0];
+    const parsedTaskInspect = parseJsonOrDefault(taskRaw, null);
+    const inspect = Array.isArray(parsedTaskInspect) ? parsedTaskInspect[0] : parsedTaskInspect;
+    if (!inspect || typeof inspect !== "object") continue;
     const containerId = inspect.Status?.ContainerStatus?.ContainerID ?? "";
     const addresses = Array.isArray(inspect.NetworksAttachments) ? inspect.NetworksAttachments.flatMap((attachment) => {
       const networkName = attachment.Network?.Spec?.Name ?? "overlay";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@envsync-cloud/deploy-cli",
-  "version": "0.8.14",
+  "version": "0.8.16",
   "description": "CLI for self-hosted EnvSync deployment on Docker Swarm",
   "type": "module",
   "bin": {