@envsync-cloud/deploy-cli 0.8.15 → 0.9.0

package/README.md

@@ -148,4 +148,4 @@ bun run src/index.ts plan-topology /etc/envsync/deploy.yaml
 - `upgrade` and `deploy` reconcile managed versioned artifacts from `release.version`.
 - Custom image overrides are still preserved for advanced self-host setups.
 - Enterprise package publication now targets NPM Packages rather than the public npm registry.
-- The full deployment guide lives in [SELFHOSTING.md](/Users/bravo68web/Projects/OSS/EnvSync/monorepo/SELFHOSTING.md).
+- The full deployment guide lives in [SELFHOSTING.md](../../SELFHOSTING.md).

package/dist/index.js

@@ -4117,6 +4117,11 @@ var deployConfigSchema = external_exports.object({
   frontend: external_exports.object({
     dashboard_variant: external_exports.enum(["oss", "enterprise"]).optional(),
     include_manage_subtree: external_exports.boolean().optional()
+  }).default({}),
+  vpn: external_exports.object({
+    provider: external_exports.enum(["netbird", "none"]).default("none"),
+    internal_domain: external_exports.string().default("envsync.local"),
+    nb_setup_key: external_exports.string().default("")
   }).default({})
 });
 function readDeployConfigFile(filePath) {
@@ -4475,7 +4480,9 @@ function buildRuntimeEnv2(config, generated) {
     OTEL_SERVICE_NAME: "envsync-api",
     OTEL_SDK_DISABLED: "false",
     CLICKSTACK_URL: publicHttpsUrl(config, hosts.obs),
-    KEYCLOAK_IMAGE_TAG: keycloakImageTag(config.images.keycloak)
+    KEYCLOAK_IMAGE_TAG: keycloakImageTag(config.images.keycloak),
+    // Is this too hacky? We go Shawn way.
+    ...config.vpn?.provider && config.vpn.provider !== "none" && config.vpn.nb_setup_key ? { NB_SETUP_KEY: config.vpn.nb_setup_key } : {}
   };
 }
 function renderEnvFile(env) {
@@ -4789,6 +4796,104 @@ function renderNetutilsService(config) {
 ${ports}
     networks: [envsync]`;
 }
+var VPN_SERVICE_RENDERERS = {
+  none: () => null,
+  netbird: renderNetbirdService
+};
+function renderNetbirdService(config, paths, runtimeEnv) {
+  const nbSetupKey = runtimeEnv.NB_SETUP_KEY ?? "";
+  return {
+    serviceBlock: `
+  netbird_nginx:
+    image: ghcr.io/envsync-cloud/netbird-nginx
+    cap_add:
+      - NET_ADMIN
+      - SYS_ADMIN
+      - SYS_RESOURCE
+    networks: [envsync]
+    environment:
+${renderEnvList({ NB_SETUP_KEY: nbSetupKey })}
+    volumes:
+      - netbird_client:/var/lib/netbird
+      - ${paths.nginxVpnConf}:/etc/nginx/nginx.conf:ro`,
+    // Adding comment for readability, extra volume below. We gotta do something about too many ` bhaiya.
+    extraVolumes: ["netbird_client"]
+  };
+}
+function renderVpnService(config, paths, runtimeEnv) {
+  const provider = config.vpn?.provider ?? "none";
+  const renderer = VPN_SERVICE_RENDERERS[provider];
+  if (!renderer) return null;
+  return renderer(config, paths, runtimeEnv);
+}
+function renderNginxVpnConf(config) {
+  const domain = config.vpn?.internal_domain ?? "envsync.local";
+  return `events {}
+
+stream {
+  server {
+    listen 5432;
+    proxy_pass postgres:5432;
+  }
+  server {
+    listen 6379;
+    proxy_pass redis:6379;
+  }
+  server {
+    listen 50051;
+    proxy_pass minikms:50051;
+  }
+  server {
+    listen 5544;
+    proxy_pass minikms_db:5432;
+  }
+  server {
+    listen 8091;
+    proxy_pass openfga:8091;
+  }
+}
+
+http {
+  server {
+    listen 80;
+    server_name keycloak.${domain};
+    location / {
+      proxy_pass http://keycloak:8080/;
+      proxy_set_header Host $host;
+      proxy_set_header X-Real-IP $remote_addr;
+      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    }
+  }
+  server {
+    listen 80;
+    server_name openfga.${domain};
+    location / {
+      proxy_pass http://openfga:8090/;
+      proxy_set_header Host $host;
+      proxy_set_header X-Real-IP $remote_addr;
+    }
+  }
+  server {
+    listen 80;
+    server_name clickstack.${domain};
+    location / {
+      proxy_pass http://clickstack:8080/;
+      proxy_set_header Host $host;
+      proxy_set_header X-Real-IP $remote_addr;
+    }
+  }
+  server {
+    listen 80;
+    server_name rustfs.${domain};
+    location / {
+      proxy_pass http://rustfs:9001/;
+      proxy_set_header Host $host;
+      proxy_set_header X-Real-IP $remote_addr;
+    }
+  }
+}
+`;
+}
 function renderOtelAgentConfig(config) {
   return [
     "receivers:",
@@ -4846,6 +4951,7 @@ function renderStack(config, runtimeEnv, generated, mode, paths) {
   const s3ConsoleRouterName = `${stackName}-s3-console-router`;
   const s3ConsoleServiceName = `${stackName}-s3-console-service`;
   const netutilsService = renderNetutilsService(config);
+  const vpnResult = renderVpnService(config, paths, runtimeEnv);
   const apiEnvironment = {
     ...runtimeEnv,
     OTEL_EXPORTER_OTLP_ENDPOINT: "http://otel-agent:4318",
@@ -5113,7 +5219,7 @@ ${renderEnvList({
 ${apiLicenseVolume}
     networks: [envsync]
     deploy:
-      replicas: ${slotHasApiDeployment(deployment.slots.green) ? 1 : 0}` : ""}${netutilsService}
+      replicas: ${slotHasApiDeployment(deployment.slots.green) ? 1 : 0}` : ""}${netutilsService}${vpnResult?.serviceBlock ?? ""}
 
 networks:
   envsync:
@@ -5130,6 +5236,8 @@ volumes:
   clickstack_data:
   clickstack_ch_data:
   clickstack_ch_logs:
+  ${vpnResult?.extraVolumes.map((v) => `
+  ${v}:`).join("") ?? ""}
 
 configs:
   keycloak_realm:
@@ -5181,6 +5289,30 @@ function validateStaticBundle(kind, targetDir) {
 }
 
 // src/index.ts
+var NETUTILS_EXPOSE_ALL_START_PORT = 15e3;
+var NETUTILS_EXPOSE_ALL_PORTS = [
+  { service: "postgres", service_port: 5432, protocol: "tcp" },
+  { service: "envsync_api_blue", service_port: 4e3, protocol: "tcp" },
+  { service: "envsync_api_green", service_port: 4e3, protocol: "tcp" },
+  { service: "envsync-management-api", service_port: 4001, protocol: "tcp" },
+  { service: "keycloak", service_port: 8080, protocol: "tcp" },
+  { service: "openfga", service_port: 8090, protocol: "tcp" },
+  { service: "minikms", service_port: 50051, protocol: "tcp" },
+  { service: "keycloak_db", service_port: 5432, protocol: "tcp" },
+  { service: "openfga_db", service_port: 5432, protocol: "tcp" },
+  { service: "minikms_db", service_port: 5432, protocol: "tcp" },
+  { service: "redis", service_port: 6379, protocol: "tcp" },
+  { service: "rustfs", service_port: 9e3, protocol: "tcp" },
+  { service: "rustfs", service_port: 9001, protocol: "tcp" },
+  { service: "clickstack", service_port: 8080, protocol: "tcp" },
+  { service: "otel-agent", service_port: 4317, protocol: "tcp" },
+  { service: "otel-agent", service_port: 4318, protocol: "tcp" },
+  { service: "traefik", service_port: 80, protocol: "tcp" },
+  { service: "traefik", service_port: 443, protocol: "tcp" },
+  { service: "web_nginx", service_port: 80, protocol: "tcp" },
+  { service: "landing_nginx", service_port: 80, protocol: "tcp" },
+  { service: "api_maintenance", service_port: 80, protocol: "tcp" }
+];
 var HOST_ROOT = process.env.ENVSYNC_HOST_ROOT ?? "/opt/envsync";
 var ETC_ROOT = process.env.ENVSYNC_ETC_ROOT ?? "/etc/envsync";
 var TRAEFIK_STATE_ROOT = process.env.ENVSYNC_TRAEFIK_STATE_ROOT ?? "/var/lib/envsync/traefik";
@@ -5207,6 +5339,7 @@ var KEYCLOAK_REALM_FILE = path3.join(DEPLOY_ROOT, "keycloak-realm.envsync.json")
 var NGINX_WEB_CONF = path3.join(DEPLOY_ROOT, "nginx-web.conf");
 var NGINX_LANDING_CONF = path3.join(DEPLOY_ROOT, "nginx-landing.conf");
 var NGINX_API_MAINTENANCE_CONF = path3.join(DEPLOY_ROOT, "nginx-api-maintenance.conf");
+var NGINX_VPN_CONF = path3.join(DEPLOY_ROOT, "nginx-vpn.conf");
 var OTEL_AGENT_CONF = path3.join(DEPLOY_ROOT, "otel-agent.yaml");
 var CLICKSTACK_CLICKHOUSE_CONF = path3.join(DEPLOY_ROOT, "clickhouse-listen.xml");
 var INTERNAL_CONFIG_JSON = path3.join(DEPLOY_ROOT, "config.json");
@@ -5224,7 +5357,8 @@ var DEPLOY_RENDER_PATHS = {
   otelAgentConf: OTEL_AGENT_CONF,
   nginxLandingConf: NGINX_LANDING_CONF,
   nginxWebConf: NGINX_WEB_CONF,
-  nginxApiMaintenanceConf: NGINX_API_MAINTENANCE_CONF
+  nginxApiMaintenanceConf: NGINX_API_MAINTENANCE_CONF,
+  nginxVpnConf: NGINX_VPN_CONF
 };
 var REMOVE_TARGETS = [
   DEPLOY_ROOT,
@@ -5386,6 +5520,69 @@ ${stderr}` : ""}`);
   }
   return (result.stdout ?? "").toString().trim();
 }
+function chunkByMax(items, max) {
+  if (items.length === 0) return [];
+  const chunks = [];
+  for (let i = 0; i < items.length; i += max) {
+    chunks.push(items.slice(i, i + max));
+  }
+  return chunks;
+}
+function formatPortRangesForIptables(ports) {
+  const sortedPorts = Array.from(new Set(ports)).map((port) => parseInt(String(port), 10)).filter((port) => Number.isInteger(port) && port >= 1 && port <= 65535).sort((a, b) => a - b);
+  if (sortedPorts.length === 0) return [];
+  const ranges = [];
+  let rangeStart = sortedPorts[0];
+  let previous = sortedPorts[0];
+  for (let i = 1; i < sortedPorts.length; i++) {
+    const current = sortedPorts[i];
+    if (current === previous + 1) {
+      previous = current;
+      continue;
+    }
+    ranges.push(rangeStart === previous ? `${rangeStart}` : `${rangeStart}:${previous}`);
+    rangeStart = current;
+    previous = current;
+  }
+  ranges.push(rangeStart === previous ? `${rangeStart}` : `${rangeStart}:${previous}`);
+  return ranges;
+}
+function formatNetutilsFirewallRules(config) {
+  if (!config?.netutils?.enabled || !Array.isArray(config.netutils.forwards) || config.netutils.forwards.length === 0) {
+    return [];
+  }
+  const tcpPorts = config.netutils.forwards.filter((item) => item.protocol === "tcp").map((item) => item.host_port);
+  const udpPorts = config.netutils.forwards.filter((item) => item.protocol === "udp").map((item) => item.host_port);
+  const tcpRanges = formatPortRangesForIptables(tcpPorts);
+  const udpRanges = formatPortRangesForIptables(udpPorts);
+  if (tcpRanges.length === 0 && udpRanges.length === 0) return [];
+  const lines = [];
+  const addRules = (protocol, ranges) => {
+    for (const chunk of chunkByMax(ranges, 15)) {
+      const portSpec = chunk.join(",");
+      lines.push(
+        `PostUp = iptables -I DOCKER-USER -i envsync-wg -p ${protocol} -m multiport --dports ${portSpec} -j ACCEPT`
+      );
+      lines.push(`PostUp = iptables -A DOCKER-USER -p ${protocol} -m multiport --dports ${portSpec} -j DROP`);
+      lines.push(
+        `PostDown = iptables -D DOCKER-USER -p ${protocol} -m multiport --dports ${portSpec} -j DROP`
+      );
+      lines.push(
+        `PostDown = iptables -D DOCKER-USER -i envsync-wg -p ${protocol} -m multiport --dports ${portSpec} -j ACCEPT`
+      );
+    }
+  };
+  addRules("tcp", tcpRanges);
+  addRules("udp", udpRanges);
+  return lines;
+}
+function tryLoadOptionalConfig() {
+  try {
+    return loadConfig();
+  } catch {
+    return null;
+  }
+}
 function parseJsonOrDefault(value, fallback) {
   try {
     return JSON.parse(value);
@@ -5510,6 +5707,15 @@ function parseNetutilsForwardsFromInput(raw, stackName) {
   });
   return normalizeNetutilsForwards(candidates, stackName, true).forwards;
 }
+function buildNetutilsExposeAllForwards(stackName) {
+  const candidates = NETUTILS_EXPOSE_ALL_PORTS.map((forward, index) => ({
+    service: forward.service,
+    service_port: forward.service_port,
+    host_port: NETUTILS_EXPOSE_ALL_START_PORT + index,
+    protocol: forward.protocol
+  }));
+  return normalizeNetutilsForwards(candidates, stackName, true).forwards;
+}
 function normalizeNetutilsProtocol(raw) {
   if (typeof raw === "string") {
     const protocol = raw.toLowerCase();
@@ -5635,6 +5841,8 @@ function wireguardPeerAllowedIp(state) {
   throw new Error("WireGuard client IP pool exhausted in subnet 10.66.0.0/24.");
 }
 function writeWireguardConfig(state) {
+  const config = tryLoadOptionalConfig();
+  const netutilsFirewallRules = formatNetutilsFirewallRules(config);
   const peersSection = state.peers.map((peer) => `
 [Peer]
 PublicKey = ${peer.public_key}
@@ -5647,6 +5855,7 @@ PostUp = iptables -A FORWARD -i envsync-wg -j ACCEPT
 PostDown = iptables -D FORWARD -i envsync-wg -j ACCEPT
 PostUp = iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
 PostDown = iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
+${netutilsFirewallRules.join("\n")}
 ${peersSection}
 `;
   writeFileMaybe(WIREGUARD_CONFIG_FILE, content);
@@ -6038,6 +6247,11 @@ function normalizeConfig(raw) {
       keep_failed_upgrade_db_snapshot: raw.upgrade?.keep_failed_upgrade_db_snapshot ?? true
     },
     netutils: normalizeNetutilsForwards(raw.netutils?.forwards, stackName, raw.netutils?.enabled ?? false),
+    vpn: {
+      provider: raw.vpn?.provider ?? "none",
+      internal_domain: raw.vpn?.internal_domain ?? "envsync.local",
+      nb_setup_key: raw.vpn?.nb_setup_key ?? ""
+    },
     license: raw.license ? {
       server_url: raw.license.server_url,
       key: raw.license.key,
@@ -6371,6 +6585,9 @@ function writeDeployArtifacts(config, generated) {
   writeFileMaybe(NGINX_API_MAINTENANCE_CONF, renderApiMaintenanceConf());
   writeFileMaybe(OTEL_AGENT_CONF, renderOtelAgentConfig(config));
   writeFileMaybe(CLICKSTACK_CLICKHOUSE_CONF, renderClickstackClickHouseConfig());
+  if (config.vpn?.provider && config.vpn.provider !== "none") {
+    writeFileMaybe(NGINX_VPN_CONF, renderNginxVpnConf(config));
+  }
   logSuccess(currentOptions.dryRun ? "Deploy artifacts previewed" : "Deploy artifacts written");
 }
 function saveDesiredConfig(config) {
@@ -7466,14 +7683,33 @@ async function cmdSetup() {
   const publicObs = await ask("Expose obs.<domain> publicly (true/false)", "true") === "true";
   const mailpitEnabled = await ask("Enable mailpit (true/false)", "false") === "true";
   const netutilsEnabled = await ask("Enable WireGuard jump host access (true/false)", "false") === "true";
-  const netutilsForwards = netutilsEnabled ? parseNetutilsForwardsFromInput(
-    await ask(
-      "Netutils forwards (format service:service_port:host_port[:protocol], comma-separated)",
-      "postgres:5432:15432:tcp,keycloak:8080:18080:tcp"
-    ),
-    "envsync"
-  ) : [];
+  const netutilsExposeAll = netutilsEnabled ? await ask("Expose all EnvSync service ports over WireGuard (true/false)", "false") === "true" : false;
+  let netutilsForwards = [];
+  if (netutilsEnabled) {
+    if (netutilsExposeAll) {
+      netutilsForwards = buildNetutilsExposeAllForwards("envsync");
+      logInfo("Netutils exposes all preset (auto-generated):");
+      for (const forward of netutilsForwards) {
+        console.log(`  ${forward.service}:${forward.service_port} -> ${forward.host_port} (${forward.protocol})`);
+      }
+    } else {
+      netutilsForwards = parseNetutilsForwardsFromInput(
+        await ask(
+          "Netutils forwards (format service:service_port:host_port[:protocol], comma-separated)",
+          "postgres:5432:15432:tcp,keycloak:8080:18080:tcp"
+        ),
+        "envsync"
+      );
+    }
+  }
   const licenseServerUrl = await ask("Enterprise license server URL", DEFAULT_ENTERPRISE_LICENSE_SERVER_URL);
+  const vpnProvider = (await ask("VPN provider for internal service access (netbird/none)", "none")).toLowerCase();
+  let vpnInternalDomain = "envsync.local";
+  let vpnNbSetupKey = "";
+  if (vpnProvider !== "none") {
+    vpnInternalDomain = await ask("Internal root domain", "envsync.local");
+    vpnNbSetupKey = await ask("Netbird setup key", "");
+  }
   const licenseKey = licenseServerUrl ? await ask("Enterprise license key", "") : "";
   const certificateBundleFile = licenseServerUrl ? "" : await ask("Enterprise certificate bundle file (optional)", "");
   const installFingerprint = deterministicInstallFingerprint(rootDomain, "envsync");
@@ -7553,6 +7789,11 @@ async function cmdSetup() {
     netutils: {
       enabled: netutilsEnabled,
       forwards: netutilsForwards
+    },
+    vpn: {
+      provider: vpnProvider,
+      internal_domain: vpnInternalDomain,
+      nb_setup_key: vpnNbSetupKey
     }
   };
   saveDesiredConfig(config);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@envsync-cloud/deploy-cli",
-  "version": "0.8.15",
+  "version": "0.9.0",
   "description": "CLI for self-hosted EnvSync deployment on Docker Swarm",
   "type": "module",
   "bin": {