@envsync-cloud/deploy-cli 0.8.6 → 0.8.7

package/dist/index.js

@@ -1,3 +1,5 @@
+#!/usr/bin/env node
+
 // src/index.ts
 import { createHash, randomBytes } from "crypto";
 import { spawnSync } from "child_process";
@@ -84,6 +86,11 @@ function buildRuntimeEnv(config, generated) {
     ENVSYNC_LANDING_ENABLED: oss ? "false" : "true",
     ENVSYNC_SINGLE_ORG_MODE: oss ? "true" : "false",
     ENVSYNC_LICENSE_ENFORCEMENT: oss ? "false" : "true",
+    ENVSYNC_LICENSE_MODE: oss ? "none" : "certificate",
+    ENVSYNC_LICENSE_BUNDLE_PATH: oss ? "" : "/etc/envsync/license/enterprise-license-bundle.json",
+    ENVSYNC_LICENSE_CERT_PATH: oss ? "" : "/etc/envsync/license/enterprise-cert.pem",
+    ENVSYNC_LICENSE_KEY_PATH: oss ? "" : "/etc/envsync/license/enterprise-key.pem",
+    ENVSYNC_LICENSE_ROOT_CA_CERT_PATH: oss ? "" : "/etc/envsync/license/root-ca.pem",
     DB_AUTO_MIGRATE: "false",
     PORT: `${config.services.api_port}`,
     DATABASE_HOST: "postgres",
@@ -447,6 +454,7 @@ function renderStack(config, runtimeEnv, generated, mode, paths) {
   const includeRuntimeInfra = mode !== "base";
   const includeAppServices = mode === "full";
   const landingEnabled = !isOssConfig(config);
+  const apiLicenseVolume = landingEnabled ? "\n    volumes:\n      - /etc/envsync/license:/etc/envsync/license:ro" : "";
   const deployment = createSteadyApiDeploymentState(config, generated);
   const stackName = config.services.stack_name;
   const s3RouterName = `${stackName}-s3-router`;
@@ -693,6 +701,7 @@ ${renderEnvList({
     ENVSYNC_DEPLOY_SLOT: "blue",
     ENVSYNC_DEPLOY_RELEASE_VERSION: deployment.slots.blue.release_version || config.release.version
   })}
+${apiLicenseVolume}
     networks: [envsync]
     deploy:
       replicas: ${slotHasApiDeployment(deployment.slots.blue) ? 1 : 0}
@@ -705,6 +714,7 @@ ${renderEnvList({
     ENVSYNC_DEPLOY_SLOT: "green",
     ENVSYNC_DEPLOY_RELEASE_VERSION: deployment.slots.green.release_version || config.release.version
   })}
+${apiLicenseVolume}
     networks: [envsync]
     deploy:
       replicas: ${slotHasApiDeployment(deployment.slots.green) ? 1 : 0}` : ""}
@@ -784,6 +794,11 @@ var BACKUPS_ROOT = path2.join(HOST_ROOT, "backups");
 var REPO_ROOT = process.env.ENVSYNC_REPO_ROOT ?? path2.join(HOST_ROOT, "repo");
 var DEPLOY_ENV = path2.join(ETC_ROOT, "deploy.env");
 var DEPLOY_YAML = path2.join(ETC_ROOT, "deploy.yaml");
+var LICENSE_ROOT = path2.join(ETC_ROOT, "license");
+var LICENSE_BUNDLE_FILE = path2.join(LICENSE_ROOT, "enterprise-license-bundle.json");
+var LICENSE_CERT_FILE = path2.join(LICENSE_ROOT, "enterprise-cert.pem");
+var LICENSE_KEY_FILE = path2.join(LICENSE_ROOT, "enterprise-key.pem");
+var LICENSE_ROOT_CA_FILE = path2.join(LICENSE_ROOT, "root-ca.pem");
 var VERSIONS_LOCK = path2.join(DEPLOY_ROOT, "versions.lock.json");
 var STACK_FILE = path2.join(DEPLOY_ROOT, "docker-stack.yaml");
 var BOOTSTRAP_BASE_STACK_FILE = path2.join(DEPLOY_ROOT, "docker-stack.bootstrap.base.yaml");
@@ -855,6 +870,7 @@ var CLICKSTACK_SELFHOST_TEAM_NAME = "EnvSync Self-Hosted Team";
 var SEMVER_VERSION_RE = /^\d+\.\d+\.\d+$/;
 var currentOptions = { dryRun: false, force: false };
 var DEFAULT_SOURCE_REPO_URL = "https://github.com/EnvSync-Cloud/envsync.git";
+var DEFAULT_ENTERPRISE_LICENSE_SERVER_URL = "https://license.envsync.cloud";
 var MANAGED_VERSIONED_IMAGE_PREFIXES = {
   api: "ghcr.io/envsync-cloud/envsync-api:",
   keycloak: "envsync-keycloak:",
@@ -978,6 +994,9 @@ function exists2(target) {
 function randomSecret(bytes = 24) {
   return randomBytes(bytes).toString("hex");
 }
+function deterministicInstallFingerprint(rootDomain, stackName) {
+  return `envsync-${createHash("sha256").update(`${rootDomain}:${stackName}`).digest("hex").slice(0, 32)}`;
+}
 function randomStrongPassword() {
   return `EnvSync!${randomBytes(8).toString("hex")}Aa1`;
 }
@@ -1114,6 +1133,9 @@ function renderHelpBlock() {
     "  validate-topology    Validate Enterprise edition topology rules",
     "  upgrade [version]    Pin a target release and deploy it",
     "  upgrade-deps         Refresh dependency images and redeploy",
+    "  license issue-cert   Issue and install an Enterprise certificate bundle",
+    "  license renew-cert   Renew and install the Enterprise certificate bundle",
+    "  license validate-cert Validate the installed Enterprise certificate bundle files",
     "  backup               Create a managed self-host backup archive",
     "  restore <archive>    Restore a backup archive into the managed self-host roots",
     "",
@@ -1189,6 +1211,7 @@ function printOperatorOverview() {
     "`envsync-deploy bootstrap --force`",
     "`envsync-deploy deploy`",
     "`envsync-deploy upgrade`",
+    "`envsync-deploy license issue-cert`",
     "`envsync-deploy health --json`",
     "`envsync-deploy plan-topology --json`",
     "`envsync-deploy backup`",
@@ -1277,6 +1300,7 @@ function normalizeConfig(raw) {
   const { release_channel: _legacyReleaseChannel, ...rest } = raw;
   const rootDomain = requireDefined(raw.domain?.root_domain, "domain.root_domain");
   const acmeEmail = requireDefined(raw.domain?.acme_email, "domain.acme_email");
+  const stackName = requireDefined(raw.services?.stack_name, "services.stack_name");
   return {
     ...rest,
     edition: raw.edition ?? "enterprise",
@@ -1301,7 +1325,7 @@ function normalizeConfig(raw) {
       otel_agent: raw.images?.otel_agent ?? "otel/opentelemetry-collector-contrib:0.111.0"
     },
     services: {
-      stack_name: requireDefined(raw.services?.stack_name, "services.stack_name"),
+      stack_name: stackName,
       api_port: requireDefined(raw.services?.api_port, "services.api_port"),
       public_http_port: raw.services?.public_http_port ?? 80,
       public_https_port: raw.services?.public_https_port ?? 443,
@@ -1349,6 +1373,16 @@ function normalizeConfig(raw) {
       maintenance_mode_enabled: raw.upgrade?.maintenance_mode_enabled ?? true,
       db_snapshot_on_api_upgrade: raw.upgrade?.db_snapshot_on_api_upgrade ?? true,
       keep_failed_upgrade_db_snapshot: raw.upgrade?.keep_failed_upgrade_db_snapshot ?? true
+    },
+    license: raw.license ? {
+      server_url: raw.license.server_url,
+      key: raw.license.key,
+      install_fingerprint: raw.license.install_fingerprint ?? deterministicInstallFingerprint(rootDomain, stackName),
+      certificate_bundle_file: raw.license.certificate_bundle_file,
+      certificate_validity_days: raw.license.certificate_validity_days
+    } : raw.edition === "oss" ? void 0 : {
+      install_fingerprint: deterministicInstallFingerprint(rootDomain, stackName),
+      certificate_validity_days: 1095
     }
   };
 }
@@ -2666,6 +2700,7 @@ async function cmdPreinstall() {
   ensureDir(RELEASES_ROOT);
   ensureDir(BACKUPS_ROOT);
   ensureDir(ETC_ROOT);
+  ensureDir(LICENSE_ROOT);
   ensureDir(TRAEFIK_STATE_ROOT);
   run("bash", ["-lc", "command -v apt-get >/dev/null"]);
   run("sudo", ["apt-get", "update"]);
@@ -2698,7 +2733,12 @@ async function cmdSetup() {
   const publicAuth = await ask("Expose auth.<domain> publicly (true/false)", "true") === "true";
   const publicObs = await ask("Expose obs.<domain> publicly (true/false)", "true") === "true";
   const mailpitEnabled = await ask("Enable mailpit (true/false)", "false") === "true";
+  const licenseServerUrl = await ask("Enterprise license server URL", DEFAULT_ENTERPRISE_LICENSE_SERVER_URL);
+  const licenseKey = licenseServerUrl ? await ask("Enterprise license key", "") : "";
+  const certificateBundleFile = licenseServerUrl ? "" : await ask("Enterprise certificate bundle file (optional)", "");
+  const installFingerprint = deterministicInstallFingerprint(rootDomain, "envsync");
   const config = {
+    edition: "enterprise",
     source: defaultSourceConfig(releaseVersion),
     release: {
       version: releaseVersion
@@ -2760,6 +2800,13 @@ async function cmdSetup() {
       maintenance_mode_enabled: true,
       db_snapshot_on_api_upgrade: true,
       keep_failed_upgrade_db_snapshot: true
+    },
+    license: {
+      server_url: licenseServerUrl || void 0,
+      key: licenseKey || void 0,
+      install_fingerprint: installFingerprint,
+      certificate_bundle_file: certificateBundleFile || void 0,
+      certificate_validity_days: 1095
     }
   };
   saveDesiredConfig(config);
@@ -2775,6 +2822,7 @@ async function cmdBootstrap() {
   const runtimeEnv = buildRuntimeEnv(config, nextGenerated);
   logReleaseContext(config);
   assertSwarmManager();
+  await ensureEnterpriseCertificateBundle(config);
   if (currentOptions.dryRun) {
     logWarn("Dry-run mode: bootstrap reset will be previewed but not executed.");
   }
@@ -3236,6 +3284,154 @@ function sha256File(filePath) {
   hash.update(fs2.readFileSync(filePath));
   return hash.digest("hex");
 }
+function parseEnterpriseLicenseBundle(raw) {
+  if (!raw || typeof raw !== "object") {
+    throw new Error("Invalid Enterprise license certificate bundle: expected an object.");
+  }
+  const candidate = raw;
+  const requiredStrings = [
+    "certificate_pem",
+    "private_key_pem",
+    "root_ca_pem",
+    "serial_hex",
+    "certificate_fingerprint_sha256",
+    "root_ca_fingerprint_sha256",
+    "issued_at",
+    "expires_at"
+  ];
+  for (const key of requiredStrings) {
+    if (typeof candidate[key] !== "string" || candidate[key].length === 0) {
+      throw new Error(`Invalid Enterprise license certificate bundle: missing ${String(key)}.`);
+    }
+  }
+  if (!candidate.metadata || candidate.metadata.edition !== "enterprise") {
+    throw new Error("Invalid Enterprise license certificate bundle: missing enterprise metadata.");
+  }
+  return candidate;
+}
+function readEnterpriseLicenseBundle(bundlePath) {
+  return parseEnterpriseLicenseBundle(JSON.parse(fs2.readFileSync(bundlePath, "utf8")));
+}
+function normalizeLicenseServerUrl(serverUrl, route) {
+  const trimmed = serverUrl.replace(/\/+$/, "");
+  return `${trimmed}/v1/certificates/${route}`;
+}
+async function requestEnterpriseLicenseCertificate(config, route) {
+  const license = config.license;
+  if (!license?.server_url) {
+    throw new Error(`Missing license.server_url in ${DEPLOY_YAML}. Set it or use license.certificate_bundle_file.`);
+  }
+  if (!license.key) {
+    throw new Error(`Missing license.key in ${DEPLOY_YAML}.`);
+  }
+  const installFingerprint = license.install_fingerprint || deterministicInstallFingerprint(config.domain.root_domain, config.services.stack_name);
+  const response = await fetch(normalizeLicenseServerUrl(license.server_url, route), {
+    method: "POST",
+    headers: {
+      "content-type": "application/json",
+      "x-license-server-access-key": license.key
+    },
+    body: JSON.stringify({
+      license_key: license.key,
+      install_fingerprint: installFingerprint,
+      root_domain: config.domain.root_domain,
+      stack_name: config.services.stack_name,
+      edition: "enterprise",
+      requested_validity_days: license.certificate_validity_days ?? 1095
+    })
+  });
+  const body = await response.json().catch(() => ({}));
+  if (!response.ok || !body.bundle) {
+    throw new Error(body.error || body.message || `License certificate ${route} failed with HTTP ${response.status}`);
+  }
+  return parseEnterpriseLicenseBundle(body.bundle);
+}
+function writeEnterpriseLicenseBundle(bundle) {
+  writeFileMaybe(LICENSE_BUNDLE_FILE, JSON.stringify(bundle, null, 2) + "\n", 384);
+  writeFileMaybe(LICENSE_CERT_FILE, bundle.certificate_pem.endsWith("\n") ? bundle.certificate_pem : `${bundle.certificate_pem}
+`, 384);
+  writeFileMaybe(LICENSE_KEY_FILE, bundle.private_key_pem.endsWith("\n") ? bundle.private_key_pem : `${bundle.private_key_pem}
+`, 384);
+  writeFileMaybe(LICENSE_ROOT_CA_FILE, bundle.root_ca_pem.endsWith("\n") ? bundle.root_ca_pem : `${bundle.root_ca_pem}
+`, 420);
+}
+async function ensureEnterpriseCertificateBundle(config) {
+  if (isOssConfig2(config)) return;
+  if (exists2(LICENSE_BUNDLE_FILE) && exists2(LICENSE_CERT_FILE) && exists2(LICENSE_KEY_FILE) && exists2(LICENSE_ROOT_CA_FILE)) {
+    validateEnterpriseLicenseBundleFiles(config, false);
+    return;
+  }
+  if (currentOptions.dryRun) {
+    logDryRun(`Would install or issue Enterprise certificate bundle under ${LICENSE_ROOT}`);
+    return;
+  }
+  if (config.license?.certificate_bundle_file) {
+    logStep("Installing Enterprise certificate bundle from configured file");
+    const bundle = readEnterpriseLicenseBundle(config.license.certificate_bundle_file);
+    writeEnterpriseLicenseBundle(bundle);
+    validateEnterpriseLicenseBundleFiles(config, false);
+    return;
+  }
+  if (config.license?.server_url && config.license.key) {
+    logStep("Issuing Enterprise certificate bundle from license server");
+    const bundle = await requestEnterpriseLicenseCertificate(config, "issue");
+    writeEnterpriseLicenseBundle(bundle);
+    validateEnterpriseLicenseBundleFiles(config, false);
+    return;
+  }
+  throw new Error(
+    `Enterprise deployments require a certificate bundle. Configure license.server_url and license.key, set license.certificate_bundle_file, or run 'envsync-deploy license issue-cert'.`
+  );
+}
+function validateEnterpriseLicenseBundleFiles(config, verbose = true) {
+  if (isOssConfig2(config)) {
+    if (verbose) logInfo("OSS deployments do not use Enterprise license certificates.");
+    return null;
+  }
+  const bundle = readEnterpriseLicenseBundle(LICENSE_BUNDLE_FILE);
+  if (bundle.metadata.install_fingerprint !== config.license?.install_fingerprint) {
+    throw new Error("Installed Enterprise certificate bundle does not match deploy.yaml license.install_fingerprint.");
+  }
+  if (bundle.metadata.stack_name !== config.services.stack_name) {
+    throw new Error("Installed Enterprise certificate bundle does not match deploy.yaml services.stack_name.");
+  }
+  if (bundle.metadata.root_domain !== config.domain.root_domain) {
+    throw new Error("Installed Enterprise certificate bundle does not match deploy.yaml domain.root_domain.");
+  }
+  for (const filePath of [LICENSE_CERT_FILE, LICENSE_KEY_FILE, LICENSE_ROOT_CA_FILE]) {
+    if (!exists2(filePath)) throw new Error(`Missing Enterprise license file: ${filePath}`);
+  }
+  if (verbose) {
+    logSuccess(`Enterprise certificate bundle is installed at ${LICENSE_ROOT}`);
+    logInfo(`Certificate serial: ${bundle.serial_hex}`);
+    logInfo(`Certificate expires: ${bundle.expires_at}`);
+  }
+  return bundle;
+}
+async function cmdLicense(action = "validate-cert") {
+  logSection("Enterprise License");
+  const config = loadConfig();
+  if (isOssConfig2(config)) {
+    logInfo("OSS deployments do not require license verification.");
+    return;
+  }
+  if (action === "issue-cert" || action === "renew-cert") {
+    const route = action === "renew-cert" ? "renew" : "issue";
+    if (currentOptions.dryRun) {
+      logDryRun(`Would ${route} Enterprise certificate bundle and install it under ${LICENSE_ROOT}`);
+      return;
+    }
+    const bundle = config.license?.certificate_bundle_file ? readEnterpriseLicenseBundle(config.license.certificate_bundle_file) : await requestEnterpriseLicenseCertificate(config, route);
+    writeEnterpriseLicenseBundle(bundle);
+    validateEnterpriseLicenseBundleFiles(config);
+    return;
+  }
+  if (action === "validate-cert") {
+    validateEnterpriseLicenseBundleFiles(config);
+    return;
+  }
+  throw new Error("Unknown license action. Expected issue-cert, renew-cert, or validate-cert.");
+}
 function stackVolumeName(config, name) {
   return `${config.services.stack_name}_${name}`;
 }
@@ -3347,6 +3543,9 @@ async function cmdBackup() {
     for (const volume of STACK_VOLUMES) {
       backupDockerVolume(stackVolumeName(config, volume), path2.join(staged, "volumes", volume));
     }
+    if (!isOssConfig2(config)) {
+      logDryRun(`Would include Enterprise license material from ${LICENSE_ROOT}`);
+    }
     logDryRun(`Would write manifest ${manifestPath}`);
     logDryRun(`Would create archive ${tarPath}`);
     logSuccess("Backup dry-run completed");
@@ -3374,6 +3573,9 @@ async function cmdBackup() {
     writeFile(path2.join(staged, "keycloak-realm.envsync.json"), fs2.readFileSync(KEYCLOAK_REALM_FILE, "utf8"));
     writeFile(path2.join(staged, "otel-agent.yaml"), fs2.readFileSync(OTEL_AGENT_CONF, "utf8"));
     writeFile(path2.join(staged, "clickhouse-listen.xml"), fs2.readFileSync(CLICKSTACK_CLICKHOUSE_CONF, "utf8"));
+    if (!isOssConfig2(config) && exists2(LICENSE_ROOT)) {
+      fs2.cpSync(LICENSE_ROOT, path2.join(staged, "license"), { recursive: true });
+    }
     const volumesDir = path2.join(staged, "volumes");
     for (const volume of STACK_VOLUMES) {
       backupDockerVolume(stackVolumeName(config, volume), path2.join(volumesDir, volume));
@@ -3450,6 +3652,11 @@ async function cmdRestore(archivePath, autoDeploy = false) {
   writeFile(KEYCLOAK_REALM_FILE, fs2.readFileSync(path2.join(restoreRoot, "keycloak-realm.envsync.json"), "utf8"));
   writeFile(OTEL_AGENT_CONF, fs2.readFileSync(path2.join(restoreRoot, "otel-agent.yaml"), "utf8"));
   writeFile(CLICKSTACK_CLICKHOUSE_CONF, fs2.readFileSync(path2.join(restoreRoot, "clickhouse-listen.xml"), "utf8"));
+  const restoredLicenseRoot = path2.join(restoreRoot, "license");
+  if (exists2(restoredLicenseRoot)) {
+    fs2.rmSync(LICENSE_ROOT, { recursive: true, force: true });
+    fs2.cpSync(restoredLicenseRoot, LICENSE_ROOT, { recursive: true });
+  }
   const config = loadConfig();
   for (const volume of STACK_VOLUMES) {
     restoreDockerVolume(stackVolumeName(config, volume), path2.join(restoreRoot, "volumes", volume));
@@ -3511,6 +3718,9 @@ async function main() {
     case "upgrade-deps":
       await cmdUpgradeDeps();
       break;
+    case "license":
+      await cmdLicense(positionals[0]);
+      break;
     case "backup":
       await cmdBackup();
       break;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@envsync-cloud/deploy-cli",
-  "version": "0.8.6",
+  "version": "0.8.7",
   "description": "CLI for self-hosted EnvSync deployment on Docker Swarm",
   "type": "module",
   "bin": {