@envsync-cloud/deploy 0.20.8 → 0.20.10

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (3) hide show
  1. package/dist/cli.js +16 -1
  2. package/dist/index.js +17 -2
  3. package/package.json +2 -2
package/dist/cli.js CHANGED
@@ -1,7 +1,7 @@
1
1
  #!/usr/bin/env node
2
2
 
3
3
  // src/cli.ts
4
- import { createHash as createHash2, randomBytes as randomBytes2, randomInt } from "crypto";
4
+ import { createHash as createHash2, generateKeyPairSync, randomBytes as randomBytes2, randomInt } from "crypto";
5
5
  import { spawnSync } from "child_process";
6
6
  import fs4 from "fs";
7
7
  import path4 from "path";
@@ -1088,11 +1088,14 @@ ${includeRuntimeInfra ? `
1088
1088
  environment:
1089
1089
  ${renderEnvList({
1090
1090
  MINIKMS_ROOT_KEY: runtimeEnv.MINIKMS_ROOT_KEY,
1091
+ MINIKMS_SESSION_SIGNING_KEY_FILE: "/run/secrets/minikms-session-signing-key",
1091
1092
  MINIKMS_DB_URL: `postgres://postgres:${runtimeEnv.MINIKMS_DB_PASSWORD}@minikms_db:5432/minikms?sslmode=disable`,
1092
1093
  MINIKMS_REDIS_URL: "redis://redis:6379",
1093
1094
  MINIKMS_GRPC_ADDR: "0.0.0.0:50051",
1094
1095
  MINIKMS_TLS_ENABLED: "false"
1095
1096
  })}
1097
+ volumes:
1098
+ - ${paths.deployRoot}/minikms-session-signing-key.pem:/run/secrets/minikms-session-signing-key:ro
1096
1099
  networks: [envsync]` : ""}
1097
1100
 
1098
1101
  clickstack:
@@ -1476,6 +1479,7 @@ var NGINX_VPN_CONF = path4.join(DEPLOY_ROOT, "nginx-vpn.conf");
1476
1479
  var OTEL_AGENT_CONF = path4.join(DEPLOY_ROOT, "otel-agent.yaml");
1477
1480
  var CLICKSTACK_CLICKHOUSE_CONF = path4.join(DEPLOY_ROOT, "clickhouse-listen.xml");
1478
1481
  var INTERNAL_CONFIG_JSON = path4.join(DEPLOY_ROOT, "config.json");
1482
+ var MINIKMS_SESSION_SIGNING_KEY_FILE = path4.join(DEPLOY_ROOT, "minikms-session-signing-key.pem");
1479
1483
  var UPGRADE_BACKUPS_ROOT = path4.join(BACKUPS_ROOT, "upgrade");
1480
1484
  var WIREGUARD_STATE_FILE = path4.join(WIREGUARD_ROOT, "state.json");
1481
1485
  var WIREGUARD_PRIVATE_KEY_FILE = path4.join(WIREGUARD_ROOT, "server-private.key");
@@ -1813,6 +1817,10 @@ function exists2(target) {
1813
1817
  function randomSecret(bytes = 24) {
1814
1818
  return randomBytes2(bytes).toString("hex");
1815
1819
  }
1820
+ function generateMinikmsSessionSigningKey() {
1821
+ const { privateKey } = generateKeyPairSync("ec", { namedCurve: "P-256" });
1822
+ return privateKey.export({ type: "pkcs8", format: "pem" }).toString();
1823
+ }
1816
1824
  function deterministicInstallFingerprint(rootDomain, stackName) {
1817
1825
  return `envsync-${createHash2("sha256").update(`${rootDomain}:${stackName}`).digest("hex").slice(0, 32)}`;
1818
1826
  }
@@ -2479,6 +2487,7 @@ function emptyGeneratedState() {
2479
2487
  keycloak_api_client_secret: "",
2480
2488
  openfga_db_password: "",
2481
2489
  minikms_root_key: "",
2490
+ minikms_session_signing_key: "",
2482
2491
  minikms_db_password: ""
2483
2492
  },
2484
2493
  bootstrap: {
@@ -2515,6 +2524,7 @@ function normalizeGeneratedState(raw) {
2515
2524
  keycloak_api_client_secret: raw?.secrets?.keycloak_api_client_secret ?? defaults.secrets.keycloak_api_client_secret,
2516
2525
  openfga_db_password: raw?.secrets?.openfga_db_password ?? defaults.secrets.openfga_db_password,
2517
2526
  minikms_root_key: raw?.secrets?.minikms_root_key ?? defaults.secrets.minikms_root_key,
2527
+ minikms_session_signing_key: raw?.secrets?.minikms_session_signing_key ?? defaults.secrets.minikms_session_signing_key,
2518
2528
  minikms_db_password: raw?.secrets?.minikms_db_password ?? defaults.secrets.minikms_db_password
2519
2529
  },
2520
2530
  bootstrap: {
@@ -2565,6 +2575,7 @@ function mergeGeneratedState(env, generated) {
2565
2575
  keycloak_api_client_secret: env.KEYCLOAK_API_CLIENT_SECRET ?? normalized.secrets.keycloak_api_client_secret,
2566
2576
  openfga_db_password: env.OPENFGA_DB_PASSWORD ?? normalized.secrets.openfga_db_password,
2567
2577
  minikms_root_key: env.MINIKMS_ROOT_KEY ?? normalized.secrets.minikms_root_key,
2578
+ minikms_session_signing_key: env.MINIKMS_SESSION_SIGNING_KEY ?? normalized.secrets.minikms_session_signing_key,
2568
2579
  minikms_db_password: env.MINIKMS_DB_PASSWORD ?? normalized.secrets.minikms_db_password
2569
2580
  },
2570
2581
  bootstrap: normalized.bootstrap
@@ -2593,6 +2604,7 @@ function ensureGeneratedRuntimeState(config, generated) {
2593
2604
  keycloak_api_client_secret: generated.secrets.keycloak_api_client_secret || randomSecret(),
2594
2605
  openfga_db_password: generated.secrets.openfga_db_password || randomSecret(),
2595
2606
  minikms_root_key: generated.secrets.minikms_root_key || randomBytes2(32).toString("hex"),
2607
+ minikms_session_signing_key: generated.secrets.minikms_session_signing_key || generateMinikmsSessionSigningKey(),
2596
2608
  minikms_db_password: generated.secrets.minikms_db_password || randomSecret()
2597
2609
  },
2598
2610
  bootstrap: generated.bootstrap
@@ -2758,6 +2770,9 @@ function writeDeployArtifacts(config, generated) {
2758
2770
  ensureSetupTokenFile(SETUP_TOKEN_FILE, setupToken);
2759
2771
  logInfo(`Setup token fingerprint: ${setupTokenFingerprint(setupToken)} (${SETUP_TOKEN_FILE})`);
2760
2772
  }
2773
+ if (generated.secrets.minikms_session_signing_key) {
2774
+ writeFileMaybe(MINIKMS_SESSION_SIGNING_KEY_FILE, generated.secrets.minikms_session_signing_key, 384);
2775
+ }
2761
2776
  writeFileMaybe(DEPLOY_ENV, renderEnvFile(runtimeEnv), 384);
2762
2777
  writeFileMaybe(
2763
2778
  INTERNAL_CONFIG_JSON,
package/dist/index.js CHANGED
@@ -1085,11 +1085,14 @@ ${includeRuntimeInfra ? `
1085
1085
  environment:
1086
1086
  ${renderEnvList({
1087
1087
  MINIKMS_ROOT_KEY: runtimeEnv.MINIKMS_ROOT_KEY,
1088
+ MINIKMS_SESSION_SIGNING_KEY_FILE: "/run/secrets/minikms-session-signing-key",
1088
1089
  MINIKMS_DB_URL: `postgres://postgres:${runtimeEnv.MINIKMS_DB_PASSWORD}@minikms_db:5432/minikms?sslmode=disable`,
1089
1090
  MINIKMS_REDIS_URL: "redis://redis:6379",
1090
1091
  MINIKMS_GRPC_ADDR: "0.0.0.0:50051",
1091
1092
  MINIKMS_TLS_ENABLED: "false"
1092
1093
  })}
1094
+ volumes:
1095
+ - ${paths.deployRoot}/minikms-session-signing-key.pem:/run/secrets/minikms-session-signing-key:ro
1093
1096
  networks: [envsync]` : ""}
1094
1097
 
1095
1098
  clickstack:
@@ -1438,7 +1441,7 @@ var init_org_setup = __esm({
1438
1441
 
1439
1442
  // src/cli.ts
1440
1443
  var cli_exports = {};
1441
- import { createHash as createHash2, randomBytes as randomBytes2, randomInt } from "crypto";
1444
+ import { createHash as createHash2, generateKeyPairSync, randomBytes as randomBytes2, randomInt } from "crypto";
1442
1445
  import { spawnSync } from "child_process";
1443
1446
  import fs4 from "fs";
1444
1447
  import path4 from "path";
@@ -1675,6 +1678,10 @@ function exists2(target) {
1675
1678
  function randomSecret(bytes = 24) {
1676
1679
  return randomBytes2(bytes).toString("hex");
1677
1680
  }
1681
+ function generateMinikmsSessionSigningKey() {
1682
+ const { privateKey } = generateKeyPairSync("ec", { namedCurve: "P-256" });
1683
+ return privateKey.export({ type: "pkcs8", format: "pem" }).toString();
1684
+ }
1678
1685
  function deterministicInstallFingerprint(rootDomain, stackName) {
1679
1686
  return `envsync-${createHash2("sha256").update(`${rootDomain}:${stackName}`).digest("hex").slice(0, 32)}`;
1680
1687
  }
@@ -2341,6 +2348,7 @@ function emptyGeneratedState() {
2341
2348
  keycloak_api_client_secret: "",
2342
2349
  openfga_db_password: "",
2343
2350
  minikms_root_key: "",
2351
+ minikms_session_signing_key: "",
2344
2352
  minikms_db_password: ""
2345
2353
  },
2346
2354
  bootstrap: {
@@ -2377,6 +2385,7 @@ function normalizeGeneratedState(raw) {
2377
2385
  keycloak_api_client_secret: raw?.secrets?.keycloak_api_client_secret ?? defaults.secrets.keycloak_api_client_secret,
2378
2386
  openfga_db_password: raw?.secrets?.openfga_db_password ?? defaults.secrets.openfga_db_password,
2379
2387
  minikms_root_key: raw?.secrets?.minikms_root_key ?? defaults.secrets.minikms_root_key,
2388
+ minikms_session_signing_key: raw?.secrets?.minikms_session_signing_key ?? defaults.secrets.minikms_session_signing_key,
2380
2389
  minikms_db_password: raw?.secrets?.minikms_db_password ?? defaults.secrets.minikms_db_password
2381
2390
  },
2382
2391
  bootstrap: {
@@ -2427,6 +2436,7 @@ function mergeGeneratedState(env, generated) {
2427
2436
  keycloak_api_client_secret: env.KEYCLOAK_API_CLIENT_SECRET ?? normalized.secrets.keycloak_api_client_secret,
2428
2437
  openfga_db_password: env.OPENFGA_DB_PASSWORD ?? normalized.secrets.openfga_db_password,
2429
2438
  minikms_root_key: env.MINIKMS_ROOT_KEY ?? normalized.secrets.minikms_root_key,
2439
+ minikms_session_signing_key: env.MINIKMS_SESSION_SIGNING_KEY ?? normalized.secrets.minikms_session_signing_key,
2430
2440
  minikms_db_password: env.MINIKMS_DB_PASSWORD ?? normalized.secrets.minikms_db_password
2431
2441
  },
2432
2442
  bootstrap: normalized.bootstrap
@@ -2455,6 +2465,7 @@ function ensureGeneratedRuntimeState(config, generated) {
2455
2465
  keycloak_api_client_secret: generated.secrets.keycloak_api_client_secret || randomSecret(),
2456
2466
  openfga_db_password: generated.secrets.openfga_db_password || randomSecret(),
2457
2467
  minikms_root_key: generated.secrets.minikms_root_key || randomBytes2(32).toString("hex"),
2468
+ minikms_session_signing_key: generated.secrets.minikms_session_signing_key || generateMinikmsSessionSigningKey(),
2458
2469
  minikms_db_password: generated.secrets.minikms_db_password || randomSecret()
2459
2470
  },
2460
2471
  bootstrap: generated.bootstrap
@@ -2620,6 +2631,9 @@ function writeDeployArtifacts(config, generated) {
2620
2631
  ensureSetupTokenFile(SETUP_TOKEN_FILE, setupToken);
2621
2632
  logInfo(`Setup token fingerprint: ${setupTokenFingerprint(setupToken)} (${SETUP_TOKEN_FILE})`);
2622
2633
  }
2634
+ if (generated.secrets.minikms_session_signing_key) {
2635
+ writeFileMaybe(MINIKMS_SESSION_SIGNING_KEY_FILE, generated.secrets.minikms_session_signing_key, 384);
2636
+ }
2623
2637
  writeFileMaybe(DEPLOY_ENV, renderEnvFile(runtimeEnv), 384);
2624
2638
  writeFileMaybe(
2625
2639
  INTERNAL_CONFIG_JSON,
@@ -5155,7 +5169,7 @@ async function main() {
5155
5169
  process.exit(1);
5156
5170
  }
5157
5171
  }
5158
- var NETUTILS_EXPOSE_ALL_START_PORT, NETUTILS_EXPOSE_ALL_PORTS, HOST_ROOT, ETC_ROOT, TRAEFIK_STATE_ROOT, DEPLOY_ROOT, RELEASES_ROOT, BACKUPS_ROOT, REPO_ROOT, DEPLOY_ENV, DEPLOY_YAML, WIREGUARD_ROOT, LICENSE_ROOT, SETUP_TOKEN_FILE, LICENSE_BUNDLE_FILE, LICENSE_CERT_FILE, LICENSE_KEY_FILE, LICENSE_ROOT_CA_FILE, LICENSE_FILE_MODE, LICENSE_DIR_MODE, VERSIONS_LOCK, STACK_FILE, BOOTSTRAP_BASE_STACK_FILE, BOOTSTRAP_STACK_FILE, TRAEFIK_DYNAMIC_FILE, KEYCLOAK_REALM_FILE, NGINX_WEB_CONF, NGINX_LANDING_CONF, NGINX_API_MAINTENANCE_CONF, NGINX_VPN_CONF, OTEL_AGENT_CONF, CLICKSTACK_CLICKHOUSE_CONF, INTERNAL_CONFIG_JSON, UPGRADE_BACKUPS_ROOT, WIREGUARD_STATE_FILE, WIREGUARD_PRIVATE_KEY_FILE, WIREGUARD_PUBLIC_KEY_FILE, WIREGUARD_CONFIG_FILE, DEPLOY_RENDER_PATHS, REMOVE_TARGETS, REMOVE_CONFIRMATION_TOKEN, STACK_VOLUMES, REQUIRED_BOOTSTRAP_ENV_KEYS, REQUIRED_CLICKSTACK_SAVED_SEARCHES, REQUIRED_CLICKSTACK_TAGS, CLICKSTACK_SELFHOST_TEAM_NAME, SEMVER_VERSION_RE, currentOptions, DEFAULT_SOURCE_REPO_URL, DEFAULT_ENTERPRISE_LICENSE_SERVER_URL, MANAGED_VERSIONED_IMAGE_PREFIXES, MINIKMS_MIGRATE_SQL;
5172
+ var NETUTILS_EXPOSE_ALL_START_PORT, NETUTILS_EXPOSE_ALL_PORTS, HOST_ROOT, ETC_ROOT, TRAEFIK_STATE_ROOT, DEPLOY_ROOT, RELEASES_ROOT, BACKUPS_ROOT, REPO_ROOT, DEPLOY_ENV, DEPLOY_YAML, WIREGUARD_ROOT, LICENSE_ROOT, SETUP_TOKEN_FILE, LICENSE_BUNDLE_FILE, LICENSE_CERT_FILE, LICENSE_KEY_FILE, LICENSE_ROOT_CA_FILE, LICENSE_FILE_MODE, LICENSE_DIR_MODE, VERSIONS_LOCK, STACK_FILE, BOOTSTRAP_BASE_STACK_FILE, BOOTSTRAP_STACK_FILE, TRAEFIK_DYNAMIC_FILE, KEYCLOAK_REALM_FILE, NGINX_WEB_CONF, NGINX_LANDING_CONF, NGINX_API_MAINTENANCE_CONF, NGINX_VPN_CONF, OTEL_AGENT_CONF, CLICKSTACK_CLICKHOUSE_CONF, INTERNAL_CONFIG_JSON, MINIKMS_SESSION_SIGNING_KEY_FILE, UPGRADE_BACKUPS_ROOT, WIREGUARD_STATE_FILE, WIREGUARD_PRIVATE_KEY_FILE, WIREGUARD_PUBLIC_KEY_FILE, WIREGUARD_CONFIG_FILE, DEPLOY_RENDER_PATHS, REMOVE_TARGETS, REMOVE_CONFIRMATION_TOKEN, STACK_VOLUMES, REQUIRED_BOOTSTRAP_ENV_KEYS, REQUIRED_CLICKSTACK_SAVED_SEARCHES, REQUIRED_CLICKSTACK_TAGS, CLICKSTACK_SELFHOST_TEAM_NAME, SEMVER_VERSION_RE, currentOptions, DEFAULT_SOURCE_REPO_URL, DEFAULT_ENTERPRISE_LICENSE_SERVER_URL, MANAGED_VERSIONED_IMAGE_PREFIXES, MINIKMS_MIGRATE_SQL;
5159
5173
  var init_cli = __esm({
5160
5174
  "src/cli.ts"() {
5161
5175
  "use strict";
@@ -5220,6 +5234,7 @@ var init_cli = __esm({
5220
5234
  OTEL_AGENT_CONF = path4.join(DEPLOY_ROOT, "otel-agent.yaml");
5221
5235
  CLICKSTACK_CLICKHOUSE_CONF = path4.join(DEPLOY_ROOT, "clickhouse-listen.xml");
5222
5236
  INTERNAL_CONFIG_JSON = path4.join(DEPLOY_ROOT, "config.json");
5237
+ MINIKMS_SESSION_SIGNING_KEY_FILE = path4.join(DEPLOY_ROOT, "minikms-session-signing-key.pem");
5223
5238
  UPGRADE_BACKUPS_ROOT = path4.join(BACKUPS_ROOT, "upgrade");
5224
5239
  WIREGUARD_STATE_FILE = path4.join(WIREGUARD_ROOT, "state.json");
5225
5240
  WIREGUARD_PRIVATE_KEY_FILE = path4.join(WIREGUARD_ROOT, "server-private.key");
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@envsync-cloud/deploy",
3
- "version": "0.20.8",
3
+ "version": "0.20.10",
4
4
  "description": "OSS CLI for self-hosted EnvSync deployment on Docker Swarm",
5
5
  "type": "module",
6
6
  "bin": {
@@ -46,7 +46,7 @@
46
46
  "zod": "^3.25.76"
47
47
  },
48
48
  "devDependencies": {
49
- "@envsync-cloud/deploy-core": "0.20.8",
49
+ "@envsync-cloud/deploy-core": "0.20.10",
50
50
  "tsup": "^8.5.0",
51
51
  "typescript": "^5.9.2"
52
52
  },