@factiii/stack 0.1.200 ā 0.1.203
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/LICENSE +21 -21
- package/README.md +403 -403
- package/bin/stack +334 -334
- package/dist/cli/dev-sync.js +16 -16
- package/dist/plugins/addons/auth/index.js +7 -7
- package/dist/plugins/addons/vercel/index.js +9 -9
- package/dist/plugins/addons/vercel/scanfix/config.js +10 -10
- package/dist/plugins/addons/vercel/scanfix/token.js +15 -15
- package/dist/plugins/approved.json +13 -13
- package/dist/plugins/pipelines/aws/index.js +12 -12
- package/dist/plugins/pipelines/aws/policies/bootstrap-policy.json +135 -135
- package/dist/plugins/pipelines/aws/prod.js +1 -1
- package/dist/plugins/pipelines/factiii/index.d.ts.map +1 -1
- package/dist/plugins/pipelines/factiii/index.js +2 -14
- package/dist/plugins/pipelines/factiii/index.js.map +1 -1
- package/dist/plugins/pipelines/factiii/prod.js +21 -21
- package/dist/plugins/pipelines/factiii/scanfix/port-convention.d.ts.map +1 -1
- package/dist/plugins/pipelines/factiii/scanfix/port-convention.js +2 -4
- package/dist/plugins/pipelines/factiii/scanfix/port-convention.js.map +1 -1
- package/dist/plugins/pipelines/factiii/staging.js +23 -23
- package/dist/plugins/pipelines/factiii/workflows/stack-ci.yml +75 -75
- package/dist/plugins/pipelines/factiii/workflows/stack-cicd-prod.yml +73 -73
- package/dist/plugins/servers/amazon-linux/index.js +16 -16
- package/dist/plugins/servers/mac/index.js +12 -12
- package/dist/plugins/servers/mac/staging.js +2 -2
- package/dist/plugins/servers/ubuntu/index.js +23 -23
- package/dist/plugins/servers/windows/index.js +15 -15
- package/dist/scanfix/commands/mac.d.ts.map +1 -1
- package/dist/scanfix/commands/mac.js +5 -4
- package/dist/scanfix/commands/mac.js.map +1 -1
- package/dist/scanfix/fixes/certbot.d.ts.map +1 -1
- package/dist/scanfix/fixes/certbot.js +4 -18
- package/dist/scanfix/fixes/certbot.js.map +1 -1
- package/dist/scanfix/fixes/docker.d.ts.map +1 -1
- package/dist/scanfix/fixes/docker.js +5 -14
- package/dist/scanfix/fixes/docker.js.map +1 -1
- package/dist/scanfix/ssl-cert-helper.d.ts.map +1 -1
- package/dist/scanfix/ssl-cert-helper.js +18 -4
- package/dist/scanfix/ssl-cert-helper.js.map +1 -1
- package/dist/scripts/generate-all.js +73 -73
- package/dist/utils/deployment-report.js +2 -2
- package/dist/utils/secret-prompts.js +34 -34
- package/dist/utils/template-generator.js +74 -74
- package/package.json +100 -114
- package/dist/plugins/pipelines/factiii/scanfix/docker.d.ts +0 -20
- package/dist/plugins/pipelines/factiii/scanfix/docker.d.ts.map +0 -1
- package/dist/plugins/pipelines/factiii/scanfix/docker.js +0 -131
- package/dist/plugins/pipelines/factiii/scanfix/docker.js.map +0 -1
package/dist/cli/dev-sync.js
CHANGED
|
@@ -361,19 +361,19 @@ async function syncToServer(tarPath, environment, config, sshKeyPath) {
|
|
|
361
361
|
await exec(`scp -i "${sshKeyPath}" -o StrictHostKeyChecking=no "${tarPath}" "${user}@${host}:/tmp/infrastructure.tar.gz"`, { maxBuffer: 50 * 1024 * 1024 });
|
|
362
362
|
// SSH to server and extract
|
|
363
363
|
console.log(' Extracting on server...');
|
|
364
|
-
await exec(`ssh -i "${sshKeyPath}" -o StrictHostKeyChecking=no "${user}@${host}" \
|
|
365
|
-
"mkdir -p ~/.factiii/infrastructure && \
|
|
366
|
-
cd ~/.factiii/infrastructure && \
|
|
367
|
-
tar -xzf /tmp/infrastructure.tar.gz && \
|
|
368
|
-
rm /tmp/infrastructure.tar.gz && \
|
|
369
|
-
echo 'Installing infrastructure dependencies...' && \
|
|
370
|
-
export PATH=\"/opt/homebrew/bin:/usr/local/bin:\$PATH\" && \
|
|
371
|
-
if [ -f 'pnpm-lock.yaml' ]; then \
|
|
372
|
-
command -v pnpm >/dev/null 2>&1 || npm install -g pnpm && \
|
|
373
|
-
pnpm install; \
|
|
374
|
-
else \
|
|
375
|
-
npm install; \
|
|
376
|
-
fi && \
|
|
364
|
+
await exec(`ssh -i "${sshKeyPath}" -o StrictHostKeyChecking=no "${user}@${host}" \
|
|
365
|
+
"mkdir -p ~/.factiii/infrastructure && \
|
|
366
|
+
cd ~/.factiii/infrastructure && \
|
|
367
|
+
tar -xzf /tmp/infrastructure.tar.gz && \
|
|
368
|
+
rm /tmp/infrastructure.tar.gz && \
|
|
369
|
+
echo 'Installing infrastructure dependencies...' && \
|
|
370
|
+
export PATH=\"/opt/homebrew/bin:/usr/local/bin:\$PATH\" && \
|
|
371
|
+
if [ -f 'pnpm-lock.yaml' ]; then \
|
|
372
|
+
command -v pnpm >/dev/null 2>&1 || npm install -g pnpm && \
|
|
373
|
+
pnpm install; \
|
|
374
|
+
else \
|
|
375
|
+
npm install; \
|
|
376
|
+
fi && \
|
|
377
377
|
echo '[OK] Infrastructure synced successfully'"`);
|
|
378
378
|
console.log(` [OK] Synced to ${environment}\n`);
|
|
379
379
|
}
|
|
@@ -400,9 +400,9 @@ async function deployAfterSync(environment, config, sshKeyPath) {
|
|
|
400
400
|
const repoName = config.name || 'app';
|
|
401
401
|
console.log(`Deploying to ${environment}...`);
|
|
402
402
|
try {
|
|
403
|
-
await exec(`ssh -i "${sshKeyPath}" -o StrictHostKeyChecking=no "${user}@${host}" \
|
|
404
|
-
"export PATH=\"/opt/homebrew/bin:/usr/local/bin:\$PATH\" && \
|
|
405
|
-
cd ~/.factiii/${repoName} && \
|
|
403
|
+
await exec(`ssh -i "${sshKeyPath}" -o StrictHostKeyChecking=no "${user}@${host}" \
|
|
404
|
+
"export PATH=\"/opt/homebrew/bin:/usr/local/bin:\$PATH\" && \
|
|
405
|
+
cd ~/.factiii/${repoName} && \
|
|
406
406
|
GITHUB_ACTIONS=true node ~/.factiii/infrastructure/bin/factiii deploy --${environment}"`);
|
|
407
407
|
console.log(` [OK] Deployed to ${environment}\n`);
|
|
408
408
|
}
|
|
@@ -142,13 +142,13 @@ class AuthAddon {
|
|
|
142
142
|
}
|
|
143
143
|
}
|
|
144
144
|
static helpText = {
|
|
145
|
-
JWT_SECRET: `
|
|
146
|
-
JWT signing secret for @factiii/auth.
|
|
147
|
-
|
|
148
|
-
This is auto-generated (256-bit random) when you run:
|
|
149
|
-
npx stack fix --secrets
|
|
150
|
-
|
|
151
|
-
The secret is stored in Ansible Vault and used to sign
|
|
145
|
+
JWT_SECRET: `
|
|
146
|
+
JWT signing secret for @factiii/auth.
|
|
147
|
+
|
|
148
|
+
This is auto-generated (256-bit random) when you run:
|
|
149
|
+
npx stack fix --secrets
|
|
150
|
+
|
|
151
|
+
The secret is stored in Ansible Vault and used to sign
|
|
152
152
|
authentication tokens (JWT) for your application.`,
|
|
153
153
|
};
|
|
154
154
|
// ============================================================
|
|
@@ -128,15 +128,15 @@ class VercelAddon {
|
|
|
128
128
|
return false;
|
|
129
129
|
}
|
|
130
130
|
static helpText = {
|
|
131
|
-
VERCEL_TOKEN: `
|
|
132
|
-
Vercel API Token for deployments.
|
|
133
|
-
|
|
134
|
-
Get from: https://vercel.com/account/tokens
|
|
135
|
-
|
|
136
|
-
Create a new token with:
|
|
137
|
-
- Scope: Full Account (or specific team)
|
|
138
|
-
- Expiration: No Expiration (or custom)
|
|
139
|
-
|
|
131
|
+
VERCEL_TOKEN: `
|
|
132
|
+
Vercel API Token for deployments.
|
|
133
|
+
|
|
134
|
+
Get from: https://vercel.com/account/tokens
|
|
135
|
+
|
|
136
|
+
Create a new token with:
|
|
137
|
+
- Scope: Full Account (or specific team)
|
|
138
|
+
- Expiration: No Expiration (or custom)
|
|
139
|
+
|
|
140
140
|
The token will be stored securely in Ansible Vault.`,
|
|
141
141
|
};
|
|
142
142
|
// ============================================================
|
|
@@ -259,13 +259,13 @@ exports.fixes = [
|
|
|
259
259
|
return false;
|
|
260
260
|
}
|
|
261
261
|
},
|
|
262
|
-
manualFix: `
|
|
263
|
-
Add Vercel to stack.yml:
|
|
264
|
-
|
|
265
|
-
vercel: {}
|
|
266
|
-
|
|
267
|
-
Then run: npx stack fix
|
|
268
|
-
(Auto-creates project, detects framework, and saves IDs via Vercel API)
|
|
262
|
+
manualFix: `
|
|
263
|
+
Add Vercel to stack.yml:
|
|
264
|
+
|
|
265
|
+
vercel: {}
|
|
266
|
+
|
|
267
|
+
Then run: npx stack fix
|
|
268
|
+
(Auto-creates project, detects framework, and saves IDs via Vercel API)
|
|
269
269
|
`,
|
|
270
270
|
},
|
|
271
271
|
{
|
|
@@ -335,9 +335,9 @@ Then run: npx stack fix
|
|
|
335
335
|
return false;
|
|
336
336
|
}
|
|
337
337
|
},
|
|
338
|
-
manualFix: `
|
|
339
|
-
Run: npx stack fix
|
|
340
|
-
(Auto-creates .vercel/project.json from Vercel API ā no CLI needed)
|
|
338
|
+
manualFix: `
|
|
339
|
+
Run: npx stack fix
|
|
340
|
+
(Auto-creates .vercel/project.json from Vercel API ā no CLI needed)
|
|
341
341
|
`,
|
|
342
342
|
},
|
|
343
343
|
{
|
|
@@ -107,12 +107,12 @@ exports.fixes = [
|
|
|
107
107
|
return false;
|
|
108
108
|
}
|
|
109
109
|
},
|
|
110
|
-
manualFix: `
|
|
111
|
-
Store VERCEL_TOKEN in Ansible Vault manually:
|
|
112
|
-
|
|
113
|
-
npx stack deploy --secrets set VERCEL_TOKEN
|
|
114
|
-
|
|
115
|
-
Or get token from: https://vercel.com/account/tokens
|
|
110
|
+
manualFix: `
|
|
111
|
+
Store VERCEL_TOKEN in Ansible Vault manually:
|
|
112
|
+
|
|
113
|
+
npx stack deploy --secrets set VERCEL_TOKEN
|
|
114
|
+
|
|
115
|
+
Or get token from: https://vercel.com/account/tokens
|
|
116
116
|
`,
|
|
117
117
|
},
|
|
118
118
|
{
|
|
@@ -128,15 +128,15 @@ Or get token from: https://vercel.com/account/tokens
|
|
|
128
128
|
return !process.env.VERCEL_TOKEN;
|
|
129
129
|
},
|
|
130
130
|
fix: null,
|
|
131
|
-
manualFix: `
|
|
132
|
-
VERCEL_TOKEN is not required in your environment during development.
|
|
133
|
-
It will be automatically read from Ansible Vault during deployment.
|
|
134
|
-
|
|
135
|
-
If you want to set it in your shell for testing:
|
|
136
|
-
export VERCEL_TOKEN="your-token-here"
|
|
137
|
-
|
|
138
|
-
Or add to your shell profile (~/.bashrc, ~/.zshrc):
|
|
139
|
-
export VERCEL_TOKEN="$(npx stack deploy --secrets get VERCEL_TOKEN)"
|
|
131
|
+
manualFix: `
|
|
132
|
+
VERCEL_TOKEN is not required in your environment during development.
|
|
133
|
+
It will be automatically read from Ansible Vault during deployment.
|
|
134
|
+
|
|
135
|
+
If you want to set it in your shell for testing:
|
|
136
|
+
export VERCEL_TOKEN="your-token-here"
|
|
137
|
+
|
|
138
|
+
Or add to your shell profile (~/.bashrc, ~/.zshrc):
|
|
139
|
+
export VERCEL_TOKEN="$(npx stack deploy --secrets get VERCEL_TOKEN)"
|
|
140
140
|
`,
|
|
141
141
|
},
|
|
142
142
|
];
|
|
@@ -1,13 +1,13 @@
|
|
|
1
|
-
{
|
|
2
|
-
"version": 1,
|
|
3
|
-
"description": "List of approved/validated external plugins for Factiii Stack",
|
|
4
|
-
"approved": [
|
|
5
|
-
"@factiii/stack-plugin-expo",
|
|
6
|
-
"@factiii/stack-plugin-prisma-trpc",
|
|
7
|
-
"@factiii/stack-plugin-nextjs"
|
|
8
|
-
],
|
|
9
|
-
"lastUpdated": "2024-12-16"
|
|
10
|
-
}
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
1
|
+
{
|
|
2
|
+
"version": 1,
|
|
3
|
+
"description": "List of approved/validated external plugins for Factiii Stack",
|
|
4
|
+
"approved": [
|
|
5
|
+
"@factiii/stack-plugin-expo",
|
|
6
|
+
"@factiii/stack-plugin-prisma-trpc",
|
|
7
|
+
"@factiii/stack-plugin-nextjs"
|
|
8
|
+
],
|
|
9
|
+
"lastUpdated": "2024-12-16"
|
|
10
|
+
}
|
|
11
|
+
|
|
12
|
+
|
|
13
|
+
|
|
@@ -166,17 +166,17 @@ class AWSPipeline {
|
|
|
166
166
|
'free-tier': free_tier_js_1.default,
|
|
167
167
|
};
|
|
168
168
|
static helpText = {
|
|
169
|
-
SSH: `
|
|
170
|
-
SSH private key for accessing the EC2 instance.
|
|
171
|
-
|
|
172
|
-
Option A: Auto-generate via AWS (recommended)
|
|
173
|
-
- Factiii will create an EC2 Key Pair via AWS API
|
|
174
|
-
|
|
175
|
-
Option B: Use existing key
|
|
169
|
+
SSH: `
|
|
170
|
+
SSH private key for accessing the EC2 instance.
|
|
171
|
+
|
|
172
|
+
Option A: Auto-generate via AWS (recommended)
|
|
173
|
+
- Factiii will create an EC2 Key Pair via AWS API
|
|
174
|
+
|
|
175
|
+
Option B: Use existing key
|
|
176
176
|
ssh-keygen -t ed25519 -C "deploy-key" -f ~/.ssh/deploy_key`,
|
|
177
|
-
AWS_SECRET_ACCESS_KEY: `
|
|
178
|
-
AWS Secret Access Key
|
|
179
|
-
|
|
177
|
+
AWS_SECRET_ACCESS_KEY: `
|
|
178
|
+
AWS Secret Access Key
|
|
179
|
+
|
|
180
180
|
Get from AWS Console: IAM -> Users -> Security credentials`,
|
|
181
181
|
};
|
|
182
182
|
// ============================================================
|
|
@@ -498,8 +498,8 @@ class AWSPipeline {
|
|
|
498
498
|
}
|
|
499
499
|
try {
|
|
500
500
|
const repoName = config.name ?? 'app';
|
|
501
|
-
await AWSPipeline.sshExec(envConfig, `
|
|
502
|
-
cd ~/.factiii && docker compose stop ${repoName}-prod
|
|
501
|
+
await AWSPipeline.sshExec(envConfig, `
|
|
502
|
+
cd ~/.factiii && docker compose stop ${repoName}-prod
|
|
503
503
|
`);
|
|
504
504
|
return { success: true, message: 'Production containers stopped' };
|
|
505
505
|
}
|
|
@@ -1,135 +1,135 @@
|
|
|
1
|
-
{
|
|
2
|
-
"Version": "2012-10-17",
|
|
3
|
-
"Statement": [
|
|
4
|
-
{
|
|
5
|
-
"Sid": "FactiiiEC2Full",
|
|
6
|
-
"Effect": "Allow",
|
|
7
|
-
"Action": [
|
|
8
|
-
"ec2:CreateVpc",
|
|
9
|
-
"ec2:DeleteVpc",
|
|
10
|
-
"ec2:DescribeVpcs",
|
|
11
|
-
"ec2:ModifyVpcAttribute",
|
|
12
|
-
"ec2:CreateSubnet",
|
|
13
|
-
"ec2:DeleteSubnet",
|
|
14
|
-
"ec2:DescribeSubnets",
|
|
15
|
-
"ec2:ModifySubnetAttribute",
|
|
16
|
-
"ec2:CreateInternetGateway",
|
|
17
|
-
"ec2:DeleteInternetGateway",
|
|
18
|
-
"ec2:AttachInternetGateway",
|
|
19
|
-
"ec2:DetachInternetGateway",
|
|
20
|
-
"ec2:DescribeInternetGateways",
|
|
21
|
-
"ec2:CreateRouteTable",
|
|
22
|
-
"ec2:DeleteRouteTable",
|
|
23
|
-
"ec2:CreateRoute",
|
|
24
|
-
"ec2:AssociateRouteTable",
|
|
25
|
-
"ec2:DescribeRouteTables",
|
|
26
|
-
"ec2:CreateSecurityGroup",
|
|
27
|
-
"ec2:DeleteSecurityGroup",
|
|
28
|
-
"ec2:AuthorizeSecurityGroupIngress",
|
|
29
|
-
"ec2:RevokeSecurityGroupIngress",
|
|
30
|
-
"ec2:DescribeSecurityGroups",
|
|
31
|
-
"ec2:CreateKeyPair",
|
|
32
|
-
"ec2:DeleteKeyPair",
|
|
33
|
-
"ec2:DescribeKeyPairs",
|
|
34
|
-
"ec2:RunInstances",
|
|
35
|
-
"ec2:TerminateInstances",
|
|
36
|
-
"ec2:DescribeInstances",
|
|
37
|
-
"ec2:AllocateAddress",
|
|
38
|
-
"ec2:ReleaseAddress",
|
|
39
|
-
"ec2:AssociateAddress",
|
|
40
|
-
"ec2:DescribeAddresses",
|
|
41
|
-
"ec2:DescribeAvailabilityZones",
|
|
42
|
-
"ec2:DescribeImages",
|
|
43
|
-
"ec2:CreateTags"
|
|
44
|
-
],
|
|
45
|
-
"Resource": "*"
|
|
46
|
-
},
|
|
47
|
-
{
|
|
48
|
-
"Sid": "FactiiiRDSFull",
|
|
49
|
-
"Effect": "Allow",
|
|
50
|
-
"Action": [
|
|
51
|
-
"rds:CreateDBInstance",
|
|
52
|
-
"rds:DeleteDBInstance",
|
|
53
|
-
"rds:DescribeDBInstances",
|
|
54
|
-
"rds:CreateDBSubnetGroup",
|
|
55
|
-
"rds:DeleteDBSubnetGroup",
|
|
56
|
-
"rds:DescribeDBSubnetGroups",
|
|
57
|
-
"rds:AddTagsToResource",
|
|
58
|
-
"rds:ListTagsForResource"
|
|
59
|
-
],
|
|
60
|
-
"Resource": "*"
|
|
61
|
-
},
|
|
62
|
-
{
|
|
63
|
-
"Sid": "FactiiiS3Full",
|
|
64
|
-
"Effect": "Allow",
|
|
65
|
-
"Action": [
|
|
66
|
-
"s3:CreateBucket",
|
|
67
|
-
"s3:DeleteBucket",
|
|
68
|
-
"s3:ListBucket",
|
|
69
|
-
"s3:PutBucketEncryption",
|
|
70
|
-
"s3:PutBucketPublicAccessBlock",
|
|
71
|
-
"s3:PutBucketCORS",
|
|
72
|
-
"s3:GetBucketEncryption",
|
|
73
|
-
"s3:GetBucketPublicAccessBlock",
|
|
74
|
-
"s3:GetBucketCORS",
|
|
75
|
-
"s3:PutObject",
|
|
76
|
-
"s3:GetObject",
|
|
77
|
-
"s3:ListAllMyBuckets"
|
|
78
|
-
],
|
|
79
|
-
"Resource": "*"
|
|
80
|
-
},
|
|
81
|
-
{
|
|
82
|
-
"Sid": "FactiiiECRFull",
|
|
83
|
-
"Effect": "Allow",
|
|
84
|
-
"Action": [
|
|
85
|
-
"ecr:CreateRepository",
|
|
86
|
-
"ecr:DeleteRepository",
|
|
87
|
-
"ecr:DescribeRepositories",
|
|
88
|
-
"ecr:GetAuthorizationToken",
|
|
89
|
-
"ecr:PutLifecyclePolicy",
|
|
90
|
-
"ecr:BatchGetImage",
|
|
91
|
-
"ecr:BatchCheckLayerAvailability",
|
|
92
|
-
"ecr:PutImage",
|
|
93
|
-
"ecr:InitiateLayerUpload",
|
|
94
|
-
"ecr:UploadLayerPart",
|
|
95
|
-
"ecr:CompleteLayerUpload"
|
|
96
|
-
],
|
|
97
|
-
"Resource": "*"
|
|
98
|
-
},
|
|
99
|
-
{
|
|
100
|
-
"Sid": "FactiiiSES",
|
|
101
|
-
"Effect": "Allow",
|
|
102
|
-
"Action": [
|
|
103
|
-
"ses:VerifyDomainIdentity",
|
|
104
|
-
"ses:VerifyDomainDkim",
|
|
105
|
-
"ses:GetAccountSendingEnabled",
|
|
106
|
-
"ses:GetIdentityVerificationAttributes",
|
|
107
|
-
"ses:GetIdentityDkimAttributes"
|
|
108
|
-
],
|
|
109
|
-
"Resource": "*"
|
|
110
|
-
},
|
|
111
|
-
{
|
|
112
|
-
"Sid": "FactiiiIAMLimited",
|
|
113
|
-
"Effect": "Allow",
|
|
114
|
-
"Action": [
|
|
115
|
-
"iam:CreateUser",
|
|
116
|
-
"iam:DeleteUser",
|
|
117
|
-
"iam:GetUser",
|
|
118
|
-
"iam:PutUserPolicy",
|
|
119
|
-
"iam:DeleteUserPolicy",
|
|
120
|
-
"iam:CreateAccessKey",
|
|
121
|
-
"iam:ListAccessKeys",
|
|
122
|
-
"iam:ListUsers"
|
|
123
|
-
],
|
|
124
|
-
"Resource": "*"
|
|
125
|
-
},
|
|
126
|
-
{
|
|
127
|
-
"Sid": "FactiiiSTS",
|
|
128
|
-
"Effect": "Allow",
|
|
129
|
-
"Action": [
|
|
130
|
-
"sts:GetCallerIdentity"
|
|
131
|
-
],
|
|
132
|
-
"Resource": "*"
|
|
133
|
-
}
|
|
134
|
-
]
|
|
135
|
-
}
|
|
1
|
+
{
|
|
2
|
+
"Version": "2012-10-17",
|
|
3
|
+
"Statement": [
|
|
4
|
+
{
|
|
5
|
+
"Sid": "FactiiiEC2Full",
|
|
6
|
+
"Effect": "Allow",
|
|
7
|
+
"Action": [
|
|
8
|
+
"ec2:CreateVpc",
|
|
9
|
+
"ec2:DeleteVpc",
|
|
10
|
+
"ec2:DescribeVpcs",
|
|
11
|
+
"ec2:ModifyVpcAttribute",
|
|
12
|
+
"ec2:CreateSubnet",
|
|
13
|
+
"ec2:DeleteSubnet",
|
|
14
|
+
"ec2:DescribeSubnets",
|
|
15
|
+
"ec2:ModifySubnetAttribute",
|
|
16
|
+
"ec2:CreateInternetGateway",
|
|
17
|
+
"ec2:DeleteInternetGateway",
|
|
18
|
+
"ec2:AttachInternetGateway",
|
|
19
|
+
"ec2:DetachInternetGateway",
|
|
20
|
+
"ec2:DescribeInternetGateways",
|
|
21
|
+
"ec2:CreateRouteTable",
|
|
22
|
+
"ec2:DeleteRouteTable",
|
|
23
|
+
"ec2:CreateRoute",
|
|
24
|
+
"ec2:AssociateRouteTable",
|
|
25
|
+
"ec2:DescribeRouteTables",
|
|
26
|
+
"ec2:CreateSecurityGroup",
|
|
27
|
+
"ec2:DeleteSecurityGroup",
|
|
28
|
+
"ec2:AuthorizeSecurityGroupIngress",
|
|
29
|
+
"ec2:RevokeSecurityGroupIngress",
|
|
30
|
+
"ec2:DescribeSecurityGroups",
|
|
31
|
+
"ec2:CreateKeyPair",
|
|
32
|
+
"ec2:DeleteKeyPair",
|
|
33
|
+
"ec2:DescribeKeyPairs",
|
|
34
|
+
"ec2:RunInstances",
|
|
35
|
+
"ec2:TerminateInstances",
|
|
36
|
+
"ec2:DescribeInstances",
|
|
37
|
+
"ec2:AllocateAddress",
|
|
38
|
+
"ec2:ReleaseAddress",
|
|
39
|
+
"ec2:AssociateAddress",
|
|
40
|
+
"ec2:DescribeAddresses",
|
|
41
|
+
"ec2:DescribeAvailabilityZones",
|
|
42
|
+
"ec2:DescribeImages",
|
|
43
|
+
"ec2:CreateTags"
|
|
44
|
+
],
|
|
45
|
+
"Resource": "*"
|
|
46
|
+
},
|
|
47
|
+
{
|
|
48
|
+
"Sid": "FactiiiRDSFull",
|
|
49
|
+
"Effect": "Allow",
|
|
50
|
+
"Action": [
|
|
51
|
+
"rds:CreateDBInstance",
|
|
52
|
+
"rds:DeleteDBInstance",
|
|
53
|
+
"rds:DescribeDBInstances",
|
|
54
|
+
"rds:CreateDBSubnetGroup",
|
|
55
|
+
"rds:DeleteDBSubnetGroup",
|
|
56
|
+
"rds:DescribeDBSubnetGroups",
|
|
57
|
+
"rds:AddTagsToResource",
|
|
58
|
+
"rds:ListTagsForResource"
|
|
59
|
+
],
|
|
60
|
+
"Resource": "*"
|
|
61
|
+
},
|
|
62
|
+
{
|
|
63
|
+
"Sid": "FactiiiS3Full",
|
|
64
|
+
"Effect": "Allow",
|
|
65
|
+
"Action": [
|
|
66
|
+
"s3:CreateBucket",
|
|
67
|
+
"s3:DeleteBucket",
|
|
68
|
+
"s3:ListBucket",
|
|
69
|
+
"s3:PutBucketEncryption",
|
|
70
|
+
"s3:PutBucketPublicAccessBlock",
|
|
71
|
+
"s3:PutBucketCORS",
|
|
72
|
+
"s3:GetBucketEncryption",
|
|
73
|
+
"s3:GetBucketPublicAccessBlock",
|
|
74
|
+
"s3:GetBucketCORS",
|
|
75
|
+
"s3:PutObject",
|
|
76
|
+
"s3:GetObject",
|
|
77
|
+
"s3:ListAllMyBuckets"
|
|
78
|
+
],
|
|
79
|
+
"Resource": "*"
|
|
80
|
+
},
|
|
81
|
+
{
|
|
82
|
+
"Sid": "FactiiiECRFull",
|
|
83
|
+
"Effect": "Allow",
|
|
84
|
+
"Action": [
|
|
85
|
+
"ecr:CreateRepository",
|
|
86
|
+
"ecr:DeleteRepository",
|
|
87
|
+
"ecr:DescribeRepositories",
|
|
88
|
+
"ecr:GetAuthorizationToken",
|
|
89
|
+
"ecr:PutLifecyclePolicy",
|
|
90
|
+
"ecr:BatchGetImage",
|
|
91
|
+
"ecr:BatchCheckLayerAvailability",
|
|
92
|
+
"ecr:PutImage",
|
|
93
|
+
"ecr:InitiateLayerUpload",
|
|
94
|
+
"ecr:UploadLayerPart",
|
|
95
|
+
"ecr:CompleteLayerUpload"
|
|
96
|
+
],
|
|
97
|
+
"Resource": "*"
|
|
98
|
+
},
|
|
99
|
+
{
|
|
100
|
+
"Sid": "FactiiiSES",
|
|
101
|
+
"Effect": "Allow",
|
|
102
|
+
"Action": [
|
|
103
|
+
"ses:VerifyDomainIdentity",
|
|
104
|
+
"ses:VerifyDomainDkim",
|
|
105
|
+
"ses:GetAccountSendingEnabled",
|
|
106
|
+
"ses:GetIdentityVerificationAttributes",
|
|
107
|
+
"ses:GetIdentityDkimAttributes"
|
|
108
|
+
],
|
|
109
|
+
"Resource": "*"
|
|
110
|
+
},
|
|
111
|
+
{
|
|
112
|
+
"Sid": "FactiiiIAMLimited",
|
|
113
|
+
"Effect": "Allow",
|
|
114
|
+
"Action": [
|
|
115
|
+
"iam:CreateUser",
|
|
116
|
+
"iam:DeleteUser",
|
|
117
|
+
"iam:GetUser",
|
|
118
|
+
"iam:PutUserPolicy",
|
|
119
|
+
"iam:DeleteUserPolicy",
|
|
120
|
+
"iam:CreateAccessKey",
|
|
121
|
+
"iam:ListAccessKeys",
|
|
122
|
+
"iam:ListUsers"
|
|
123
|
+
],
|
|
124
|
+
"Resource": "*"
|
|
125
|
+
},
|
|
126
|
+
{
|
|
127
|
+
"Sid": "FactiiiSTS",
|
|
128
|
+
"Effect": "Allow",
|
|
129
|
+
"Action": [
|
|
130
|
+
"sts:GetCallerIdentity"
|
|
131
|
+
],
|
|
132
|
+
"Resource": "*"
|
|
133
|
+
}
|
|
134
|
+
]
|
|
135
|
+
}
|
|
@@ -154,7 +154,7 @@ async function writeEnvFile(envConfig, repoDir, environment, envVarsString) {
|
|
|
154
154
|
else {
|
|
155
155
|
// We're remote - SSH to write
|
|
156
156
|
console.log(` š Writing ${envFileName} on remote server (${envVars.length} variables)...`);
|
|
157
|
-
await sshExecCommand(envConfig, `cat > ${repoDir}/${envFileName} << 'ENVEOF'
|
|
157
|
+
await sshExecCommand(envConfig, `cat > ${repoDir}/${envFileName} << 'ENVEOF'
|
|
158
158
|
${envFileContent}ENVEOF`);
|
|
159
159
|
}
|
|
160
160
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/plugins/pipelines/factiii/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAKH,OAAO,KAAK,EACV,aAAa,EACb,KAAK,EACL,YAAY,EACZ,GAAG,EACH,YAAY,EACZ,aAAa,EACb,iBAAiB,EACjB,aAAa,EACb,aAAa,EACd,MAAM,yBAAyB,CAAC;
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/plugins/pipelines/factiii/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAKH,OAAO,KAAK,EACV,aAAa,EACb,KAAK,EACL,YAAY,EACZ,GAAG,EACH,YAAY,EACZ,aAAa,EACb,iBAAiB,EACjB,aAAa,EACb,aAAa,EACd,MAAM,yBAAyB,CAAC;AAqCjC,OAAO,KAAK,cAAc,MAAM,sBAAsB,CAAC;AAKvD,cAAM,eAAe;IAKnB,MAAM,CAAC,QAAQ,CAAC,EAAE,aAAa;IAC/B,MAAM,CAAC,QAAQ,CAAC,IAAI,sBAAsB;IAC1C,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAc;IAClD,MAAM,CAAC,QAAQ,CAAC,OAAO,WAAW;IAKlC,MAAM,CAAC,QAAQ,CAAC,eAAe,EAAE,MAAM,EAAE,CAAM;IAG/C,MAAM,CAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEnD;IAGF,MAAM,CAAC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAKtD;IAEF;;;OAGG;WACU,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC;IAInF;;OAEG;IACH,MAAM,CAAC,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO;IAMrD;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,GAAG,YAAY;IAkJlE,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,EAAE,CA6B1B;IAMF;;;;;OAKG;IACH,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,KAAK,GAAG,MAAM;IAKvC;;OAEG;IACH,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAsB5E;;;OAGG;IACH,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM;IAuBzC;;;;OAIG;IACH,MAAM,CAAC,YAAY,CACjB,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,KAAK,EACZ,MAAM,EAAE,aAAa,EACrB,OAAO,EAAE,MAAM,EACf,MAAM,GAAE,OAAc,GACrB,IAAI;IAyCP;;;;;;;;OAQG;WACU,mBAAmB,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IA0GhG,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,aAAa,EAAE,CA6VvC;IAMF;;OAEG;WACU,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,cAAc,CAAC;IAIlF;;OAEG;IACH,MAAM,CAAC,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM;IAIpD;;OAEG;IACH,MAAM,CAAC,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAIxD;;OAEG;IACH,MAAM,CAAC,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAIxD;;OAEG;IACH,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAIrD;;OAEG;WACU,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI9D;;OAEG;WACU,iBAAiB,CAC5B,MAAM,EAAE,aAAa,EACrB,SAAS,EAAE,iBAAiB,GAC3B,OAAO,CAAC,YAAY,CAAC;IAIxB;;OAEG;WACU,oBAAoB,CAC/B,MAAM,EAAE,aAAa,EACrB,aAAa,EAAE,iBAAiB,GAC/B,OAAO,CAAC,YAAY,CAAC;IAIxB;;;OAGG;WACU,2BAA2B,CACtC,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,YAAY,CAAC;IAQxB,OAAO,CAAC,OAAO,CAAgB;gBAEnB,MAAM,EAAE,aAAa;IAIjC;;;;;;;OAOG;IACG,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,GAAE,aAAkB,GAAG,OAAO,CAAC,YAAY,CAAC;IAsFnF;;;;;OAKG;IACG,SAAS,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IA6BpG;;;;;OAKG;IACG,QAAQ,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IA6BtI;;OAEG;YACW,cAAc;IA6G5B;;;OAGG;IACG,MAAM,CAAC,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAKhF;;OAEG;IACG,QAAQ,CAAC,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;CAInF;AAED,eAAe,eAAe,CAAC"}
|
|
@@ -95,11 +95,10 @@ const domain_js_1 = require("./scanfix/domain.js");
|
|
|
95
95
|
const port_convention_js_1 = require("./scanfix/port-convention.js");
|
|
96
96
|
const start_sh_js_1 = require("./scanfix/start-sh.js");
|
|
97
97
|
const db_seed_js_1 = require("./scanfix/db-seed.js");
|
|
98
|
-
const docker_js_1 = require("./scanfix/docker.js");
|
|
99
98
|
// Import AWS scanfix arrays (AWS provisioning runs as part of factiii pipeline)
|
|
100
99
|
const config_js_2 = require("../aws/scanfix/config.js");
|
|
101
100
|
const credentials_js_1 = require("../aws/scanfix/credentials.js");
|
|
102
|
-
const
|
|
101
|
+
const docker_js_1 = require("../aws/scanfix/docker.js");
|
|
103
102
|
const vpc_js_1 = require("../aws/scanfix/vpc.js");
|
|
104
103
|
const security_groups_js_1 = require("../aws/scanfix/security-groups.js");
|
|
105
104
|
const ec2_js_1 = require("../aws/scanfix/ec2.js");
|
|
@@ -329,7 +328,7 @@ class FactiiiPipeline {
|
|
|
329
328
|
...vpc_js_1.vpcFixes,
|
|
330
329
|
...security_groups_js_1.securityGroupFixes,
|
|
331
330
|
...ec2_js_1.ec2Fixes,
|
|
332
|
-
...
|
|
331
|
+
...docker_js_1.dockerFixes,
|
|
333
332
|
...rds_js_1.rdsFixes,
|
|
334
333
|
...s3_js_1.s3Fixes,
|
|
335
334
|
...ecr_js_1.ecrFixes,
|
|
@@ -949,12 +948,6 @@ class FactiiiPipeline {
|
|
|
949
948
|
return { success: false, error: reach.reason };
|
|
950
949
|
}
|
|
951
950
|
if (reach.via === 'ssh') {
|
|
952
|
-
// Ensure Docker is installed and running before deploying via SSH
|
|
953
|
-
const dockerReady = await (0, docker_js_1.ensureRemoteDocker)(stage, this._config);
|
|
954
|
-
if (!dockerReady) {
|
|
955
|
-
console.log('\nā Docker is not available on ' + stage + ' server ā cannot deploy');
|
|
956
|
-
return { success: false, error: 'Docker not available on remote server' };
|
|
957
|
-
}
|
|
958
951
|
// For prod with AWS config: build locally on dev machine, then SSH only for pull+restart
|
|
959
952
|
// This avoids building Docker on resource-constrained prod servers (e.g., t3.micro 1GB RAM)
|
|
960
953
|
if (stage === 'prod' && this._config.aws) {
|
|
@@ -1073,11 +1066,6 @@ class FactiiiPipeline {
|
|
|
1073
1066
|
const domain = envValues[0]?.domain || 'unknown';
|
|
1074
1067
|
console.log('');
|
|
1075
1068
|
console.log('āā ' + stage.toUpperCase() + ' (via SSH ā ' + domain + ')');
|
|
1076
|
-
// Ensure Docker is installed and running before SSHing for full fix
|
|
1077
|
-
const dockerReady = await (0, docker_js_1.ensureRemoteDocker)(stage, this._config);
|
|
1078
|
-
if (!dockerReady) {
|
|
1079
|
-
console.log(' [!] Docker not available on ' + stage + ' ā remote fix may fail');
|
|
1080
|
-
}
|
|
1081
1069
|
const sshResult = await (0, ssh_helper_js_1.sshRemoteFactiiiCommand)(stage, this._config, 'fix --' + stage);
|
|
1082
1070
|
console.log('āā');
|
|
1083
1071
|
// The remote fix already printed its own summary inline.
|