@envsync-cloud/deploy-cli 0.8.15 → 0.8.16

package/dist/index.js

@@ -5181,6 +5181,30 @@ function validateStaticBundle(kind, targetDir) {
 }
 
 // src/index.ts
+var NETUTILS_EXPOSE_ALL_START_PORT = 15e3;
+var NETUTILS_EXPOSE_ALL_PORTS = [
+  { service: "postgres", service_port: 5432, protocol: "tcp" },
+  { service: "envsync_api_blue", service_port: 4e3, protocol: "tcp" },
+  { service: "envsync_api_green", service_port: 4e3, protocol: "tcp" },
+  { service: "envsync-management-api", service_port: 4001, protocol: "tcp" },
+  { service: "keycloak", service_port: 8080, protocol: "tcp" },
+  { service: "openfga", service_port: 8090, protocol: "tcp" },
+  { service: "minikms", service_port: 50051, protocol: "tcp" },
+  { service: "keycloak_db", service_port: 5432, protocol: "tcp" },
+  { service: "openfga_db", service_port: 5432, protocol: "tcp" },
+  { service: "minikms_db", service_port: 5432, protocol: "tcp" },
+  { service: "redis", service_port: 6379, protocol: "tcp" },
+  { service: "rustfs", service_port: 9e3, protocol: "tcp" },
+  { service: "rustfs", service_port: 9001, protocol: "tcp" },
+  { service: "clickstack", service_port: 8080, protocol: "tcp" },
+  { service: "otel-agent", service_port: 4317, protocol: "tcp" },
+  { service: "otel-agent", service_port: 4318, protocol: "tcp" },
+  { service: "traefik", service_port: 80, protocol: "tcp" },
+  { service: "traefik", service_port: 443, protocol: "tcp" },
+  { service: "web_nginx", service_port: 80, protocol: "tcp" },
+  { service: "landing_nginx", service_port: 80, protocol: "tcp" },
+  { service: "api_maintenance", service_port: 80, protocol: "tcp" }
+];
 var HOST_ROOT = process.env.ENVSYNC_HOST_ROOT ?? "/opt/envsync";
 var ETC_ROOT = process.env.ENVSYNC_ETC_ROOT ?? "/etc/envsync";
 var TRAEFIK_STATE_ROOT = process.env.ENVSYNC_TRAEFIK_STATE_ROOT ?? "/var/lib/envsync/traefik";
@@ -5386,6 +5410,69 @@ ${stderr}` : ""}`);
   }
   return (result.stdout ?? "").toString().trim();
 }
+function chunkByMax(items, max) {
+  if (items.length === 0) return [];
+  const chunks = [];
+  for (let i = 0; i < items.length; i += max) {
+    chunks.push(items.slice(i, i + max));
+  }
+  return chunks;
+}
+function formatPortRangesForIptables(ports) {
+  const sortedPorts = Array.from(new Set(ports)).map((port) => parseInt(String(port), 10)).filter((port) => Number.isInteger(port) && port >= 1 && port <= 65535).sort((a, b) => a - b);
+  if (sortedPorts.length === 0) return [];
+  const ranges = [];
+  let rangeStart = sortedPorts[0];
+  let previous = sortedPorts[0];
+  for (let i = 1; i < sortedPorts.length; i++) {
+    const current = sortedPorts[i];
+    if (current === previous + 1) {
+      previous = current;
+      continue;
+    }
+    ranges.push(rangeStart === previous ? `${rangeStart}` : `${rangeStart}:${previous}`);
+    rangeStart = current;
+    previous = current;
+  }
+  ranges.push(rangeStart === previous ? `${rangeStart}` : `${rangeStart}:${previous}`);
+  return ranges;
+}
+function formatNetutilsFirewallRules(config) {
+  if (!config?.netutils?.enabled || !Array.isArray(config.netutils.forwards) || config.netutils.forwards.length === 0) {
+    return [];
+  }
+  const tcpPorts = config.netutils.forwards.filter((item) => item.protocol === "tcp").map((item) => item.host_port);
+  const udpPorts = config.netutils.forwards.filter((item) => item.protocol === "udp").map((item) => item.host_port);
+  const tcpRanges = formatPortRangesForIptables(tcpPorts);
+  const udpRanges = formatPortRangesForIptables(udpPorts);
+  if (tcpRanges.length === 0 && udpRanges.length === 0) return [];
+  const lines = [];
+  const addRules = (protocol, ranges) => {
+    for (const chunk of chunkByMax(ranges, 15)) {
+      const portSpec = chunk.join(",");
+      lines.push(
+        `PostUp = iptables -I DOCKER-USER -i envsync-wg -p ${protocol} -m multiport --dports ${portSpec} -j ACCEPT`
+      );
+      lines.push(`PostUp = iptables -A DOCKER-USER -p ${protocol} -m multiport --dports ${portSpec} -j DROP`);
+      lines.push(
+        `PostDown = iptables -D DOCKER-USER -p ${protocol} -m multiport --dports ${portSpec} -j DROP`
+      );
+      lines.push(
+        `PostDown = iptables -D DOCKER-USER -i envsync-wg -p ${protocol} -m multiport --dports ${portSpec} -j ACCEPT`
+      );
+    }
+  };
+  addRules("tcp", tcpRanges);
+  addRules("udp", udpRanges);
+  return lines;
+}
+function tryLoadOptionalConfig() {
+  try {
+    return loadConfig();
+  } catch {
+    return null;
+  }
+}
 function parseJsonOrDefault(value, fallback) {
   try {
     return JSON.parse(value);
@@ -5510,6 +5597,15 @@ function parseNetutilsForwardsFromInput(raw, stackName) {
   });
   return normalizeNetutilsForwards(candidates, stackName, true).forwards;
 }
+function buildNetutilsExposeAllForwards(stackName) {
+  const candidates = NETUTILS_EXPOSE_ALL_PORTS.map((forward, index) => ({
+    service: forward.service,
+    service_port: forward.service_port,
+    host_port: NETUTILS_EXPOSE_ALL_START_PORT + index,
+    protocol: forward.protocol
+  }));
+  return normalizeNetutilsForwards(candidates, stackName, true).forwards;
+}
 function normalizeNetutilsProtocol(raw) {
   if (typeof raw === "string") {
     const protocol = raw.toLowerCase();
@@ -5635,6 +5731,8 @@ function wireguardPeerAllowedIp(state) {
   throw new Error("WireGuard client IP pool exhausted in subnet 10.66.0.0/24.");
 }
 function writeWireguardConfig(state) {
+  const config = tryLoadOptionalConfig();
+  const netutilsFirewallRules = formatNetutilsFirewallRules(config);
   const peersSection = state.peers.map((peer) => `
 [Peer]
 PublicKey = ${peer.public_key}
@@ -5647,6 +5745,7 @@ PostUp = iptables -A FORWARD -i envsync-wg -j ACCEPT
 PostDown = iptables -D FORWARD -i envsync-wg -j ACCEPT
 PostUp = iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
 PostDown = iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
+${netutilsFirewallRules.join("\n")}
 ${peersSection}
 `;
   writeFileMaybe(WIREGUARD_CONFIG_FILE, content);
@@ -7466,13 +7565,25 @@ async function cmdSetup() {
   const publicObs = await ask("Expose obs.<domain> publicly (true/false)", "true") === "true";
   const mailpitEnabled = await ask("Enable mailpit (true/false)", "false") === "true";
   const netutilsEnabled = await ask("Enable WireGuard jump host access (true/false)", "false") === "true";
-  const netutilsForwards = netutilsEnabled ? parseNetutilsForwardsFromInput(
-    await ask(
-      "Netutils forwards (format service:service_port:host_port[:protocol], comma-separated)",
-      "postgres:5432:15432:tcp,keycloak:8080:18080:tcp"
-    ),
-    "envsync"
-  ) : [];
+  const netutilsExposeAll = netutilsEnabled ? await ask("Expose all EnvSync service ports over WireGuard (true/false)", "false") === "true" : false;
+  let netutilsForwards = [];
+  if (netutilsEnabled) {
+    if (netutilsExposeAll) {
+      netutilsForwards = buildNetutilsExposeAllForwards("envsync");
+      logInfo("Netutils exposes all preset (auto-generated):");
+      for (const forward of netutilsForwards) {
+        console.log(`  ${forward.service}:${forward.service_port} -> ${forward.host_port} (${forward.protocol})`);
+      }
+    } else {
+      netutilsForwards = parseNetutilsForwardsFromInput(
+        await ask(
+          "Netutils forwards (format service:service_port:host_port[:protocol], comma-separated)",
+          "postgres:5432:15432:tcp,keycloak:8080:18080:tcp"
+        ),
+        "envsync"
+      );
+    }
+  }
   const licenseServerUrl = await ask("Enterprise license server URL", DEFAULT_ENTERPRISE_LICENSE_SERVER_URL);
   const licenseKey = licenseServerUrl ? await ask("Enterprise license key", "") : "";
   const certificateBundleFile = licenseServerUrl ? "" : await ask("Enterprise certificate bundle file (optional)", "");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@envsync-cloud/deploy-cli",
-  "version": "0.8.15",
+  "version": "0.8.16",
   "description": "CLI for self-hosted EnvSync deployment on Docker Swarm",
   "type": "module",
   "bin": {