@fastybird/smart-panel-backend 1.1.0-alpha.2 → 1.1.0-alpha.20

package/dist/plugins/remote-access-cloudflare-tunnel/remote-access-cloudflare-tunnel.plugin.js

@@ -0,0 +1,135 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RemoteAccessCloudflareTunnelPlugin = void 0;
+const common_1 = require("@nestjs/common");
+const config_1 = require("@nestjs/config");
+const plugins_type_mapper_service_1 = require("../../modules/config/services/plugins-type-mapper.service");
+const extensions_service_1 = require("../../modules/extensions/services/extensions.service");
+const managed_service_manager_service_1 = require("../../modules/extensions/services/managed-service-manager.service");
+const platform_module_1 = require("../../modules/platform/platform.module");
+const remote_access_module_1 = require("../../modules/remote-access/remote-access.module");
+const remote_access_provider_registry_service_1 = require("../../modules/remote-access/services/remote-access-provider-registry.service");
+const api_tag_decorator_1 = require("../../modules/swagger/decorators/api-tag.decorator");
+const swagger_models_registry_service_1 = require("../../modules/swagger/services/swagger-models-registry.service");
+const factory_reset_registry_service_1 = require("../../modules/system/services/factory-reset-registry.service");
+const setup_controller_1 = require("./controllers/setup.controller");
+const status_controller_1 = require("./controllers/status.controller");
+const update_config_dto_1 = require("./dto/update-config.dto");
+const config_model_1 = require("./models/config.model");
+const remote_access_cloudflare_tunnel_constants_1 = require("./remote-access-cloudflare-tunnel.constants");
+const remote_access_cloudflare_tunnel_openapi_1 = require("./remote-access-cloudflare-tunnel.openapi");
+const cloudflare_tunnel_managed_service_1 = require("./services/cloudflare-tunnel-managed.service");
+const cloudflare_tunnel_provider_service_1 = require("./services/cloudflare-tunnel-provider.service");
+const cloudflare_tunnel_setup_service_1 = require("./services/cloudflare-tunnel-setup.service");
+const cloudflared_cli_service_1 = require("./services/cloudflared-cli.service");
+const cloudflared_metrics_service_1 = require("./services/cloudflared-metrics.service");
+const cloudflared_process_service_1 = require("./services/cloudflared-process.service");
+let RemoteAccessCloudflareTunnelPlugin = class RemoteAccessCloudflareTunnelPlugin {
+    constructor(pluginsMapperService, swaggerRegistry, extensionsService, managedServiceManager, providerRegistry, factoryResetRegistry, tunnelManagedService, providerService) {
+        this.pluginsMapperService = pluginsMapperService;
+        this.swaggerRegistry = swaggerRegistry;
+        this.extensionsService = extensionsService;
+        this.managedServiceManager = managedServiceManager;
+        this.providerRegistry = providerRegistry;
+        this.factoryResetRegistry = factoryResetRegistry;
+        this.tunnelManagedService = tunnelManagedService;
+        this.providerService = providerService;
+    }
+    onModuleInit() {
+        this.pluginsMapperService.registerMapping({
+            type: remote_access_cloudflare_tunnel_constants_1.REMOTE_ACCESS_CLOUDFLARE_TUNNEL_PLUGIN_NAME,
+            class: config_model_1.RemoteAccessCloudflareTunnelPluginConfigModel,
+            configDto: update_config_dto_1.UpdateRemoteAccessCloudflareTunnelPluginConfigDto,
+            secretFields: [
+                {
+                    path: 'tunnel_token',
+                    configuredPath: 'tunnel_token_configured',
+                    inputPaths: ['tunnelToken'],
+                },
+            ],
+        });
+        for (const model of remote_access_cloudflare_tunnel_openapi_1.REMOTE_ACCESS_CLOUDFLARE_TUNNEL_PLUGIN_SWAGGER_EXTRA_MODELS) {
+            this.swaggerRegistry.register(model);
+        }
+        this.extensionsService.registerPluginMetadata({
+            type: remote_access_cloudflare_tunnel_constants_1.REMOTE_ACCESS_CLOUDFLARE_TUNNEL_PLUGIN_NAME,
+            name: 'Cloudflare Tunnel',
+            description: 'Publish this installation to the internet through a Cloudflare Tunnel, without opening a port.',
+            author: 'FastyBird',
+            defaultEnabled: false,
+            readme: `# Cloudflare Tunnel
+
+> Plugin · by FastyBird · platform: remote-access
+
+Publishes this installation to the public internet through a Cloudflare Tunnel: an outbound-only, encrypted connection from this device to the Cloudflare edge. Once a tunnel token is configured, the admin UI is reachable at your own hostname over HTTPS — no port forwarding, no public IP address, and no inbound firewall rule required.
+
+## What you get
+
+- A public HTTPS hostname of your choosing (e.g. \`panel.example.com\`), backed by Cloudflare's own TLS certificate
+- The tunnel connector managed entirely from the Smart Panel admin UI — install, connect, disconnect and remove, all without a terminal
+- The option to protect the published hostname further with Cloudflare Access, layering an identity check in front of the Smart Panel login
+
+## Requirements
+
+- \`raspberry\` or \`generic\` platform with systemd and the existing sudoers allowlist (Docker and the Home Assistant add-on are not supported — see the docs for alternatives)
+- A tunnel already created in the Cloudflare Zero Trust dashboard, and its token pasted into the setup wizard here
+
+## Security
+
+Once connected, this installation is reachable from the public internet through the published hostname; only the Smart Panel login protects it unless you also configure Cloudflare Access. Review who else has access to the account before publishing sensitive installations.
+
+## Configuration
+
+| Option | Description | Default |
+|--------|-------------|---------|
+| \`public_hostname\` | Public hostname the tunnel publishes, e.g. \`panel.example.com\` | — |
+| \`protocol\` | Protocol cloudflared uses to connect to the Cloudflare edge | \`auto\` |
+| \`tunnel_token\` | Tunnel token from the Cloudflare Zero Trust dashboard | — |`,
+            links: {
+                documentation: 'https://smart-panel.fastybird.com/docs',
+                repository: 'https://github.com/FastyBird/smart-panel',
+            },
+        });
+        this.providerRegistry.register(this.providerService);
+        this.managedServiceManager.register(this.tunnelManagedService);
+        this.factoryResetRegistry.register(remote_access_cloudflare_tunnel_constants_1.REMOTE_ACCESS_CLOUDFLARE_TUNNEL_PLUGIN_NAME, () => this.tunnelManagedService.factoryReset(), 90);
+    }
+};
+exports.RemoteAccessCloudflareTunnelPlugin = RemoteAccessCloudflareTunnelPlugin;
+exports.RemoteAccessCloudflareTunnelPlugin = RemoteAccessCloudflareTunnelPlugin = __decorate([
+    (0, api_tag_decorator_1.ApiTag)({
+        tagName: remote_access_cloudflare_tunnel_constants_1.REMOTE_ACCESS_CLOUDFLARE_TUNNEL_PLUGIN_NAME,
+        displayName: remote_access_cloudflare_tunnel_constants_1.REMOTE_ACCESS_CLOUDFLARE_TUNNEL_PLUGIN_API_TAG_NAME,
+        description: remote_access_cloudflare_tunnel_constants_1.REMOTE_ACCESS_CLOUDFLARE_TUNNEL_PLUGIN_API_TAG_DESCRIPTION,
+    }),
+    (0, common_1.Module)({
+        imports: [remote_access_module_1.RemoteAccessModule, platform_module_1.PlatformModule, config_1.ConfigModule],
+        controllers: [status_controller_1.StatusController, setup_controller_1.SetupController],
+        providers: [
+            cloudflared_cli_service_1.CloudflaredCliService,
+            cloudflared_process_service_1.CloudflaredProcessService,
+            cloudflared_metrics_service_1.CloudflaredMetricsService,
+            cloudflare_tunnel_managed_service_1.CloudflareTunnelManagedService,
+            cloudflare_tunnel_provider_service_1.CloudflareTunnelProviderService,
+            cloudflare_tunnel_setup_service_1.CloudflareTunnelSetupService,
+        ],
+    }),
+    __metadata("design:paramtypes", [plugins_type_mapper_service_1.PluginsTypeMapperService,
+        swagger_models_registry_service_1.SwaggerModelsRegistryService,
+        extensions_service_1.ExtensionsService,
+        managed_service_manager_service_1.ManagedServiceManagerService,
+        remote_access_provider_registry_service_1.RemoteAccessProviderRegistryService,
+        factory_reset_registry_service_1.FactoryResetRegistryService,
+        cloudflare_tunnel_managed_service_1.CloudflareTunnelManagedService,
+        cloudflare_tunnel_provider_service_1.CloudflareTunnelProviderService])
+], RemoteAccessCloudflareTunnelPlugin);
+//# sourceMappingURL=remote-access-cloudflare-tunnel.plugin.js.map

package/dist/plugins/remote-access-cloudflare-tunnel/remote-access-cloudflare-tunnel.plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-access-cloudflare-tunnel.plugin.js","sourceRoot":"","sources":["../../../src/plugins/remote-access-cloudflare-tunnel/remote-access-cloudflare-tunnel.plugin.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAAsD;AACtD,2CAAkE;AAElE,2GAAqG;AACrG,6FAAyF;AACzF,uHAAiH;AACjH,4EAAwE;AACxE,2FAAsF;AACtF,0IAAmI;AACnI,0FAA4E;AAC5E,oHAA8G;AAC9G,iHAA2G;AAE3G,qEAAiE;AACjE,uEAAmE;AACnE,+DAA4F;AAC5F,wDAAsF;AACtF,2GAIqD;AACrD,uGAAwH;AACxH,oGAA8F;AAC9F,sGAAgG;AAChG,gGAA0F;AAC1F,gFAA2E;AAC3E,wFAAmF;AACnF,wFAAmF;AAmB5E,IAAM,kCAAkC,GAAxC,MAAM,kCAAkC;IAC9C,YACkB,oBAA8C,EAC9C,eAA6C,EAC7C,iBAAoC,EACpC,qBAAmD,EACnD,gBAAqD,EACrD,oBAAiD,EACjD,oBAAoD,EACpD,eAAgD;QAPhD,yBAAoB,GAApB,oBAAoB,CAA0B;QAC9C,oBAAe,GAAf,eAAe,CAA8B;QAC7C,sBAAiB,GAAjB,iBAAiB,CAAmB;QACpC,0BAAqB,GAArB,qBAAqB,CAA8B;QACnD,qBAAgB,GAAhB,gBAAgB,CAAqC;QACrD,yBAAoB,GAApB,oBAAoB,CAA6B;QACjD,yBAAoB,GAApB,oBAAoB,CAAgC;QACpD,oBAAe,GAAf,eAAe,CAAiC;IAC/D,CAAC;IAEJ,YAAY;QACX,IAAI,CAAC,oBAAoB,CAAC,eAAe,CAGvC;YACD,IAAI,EAAE,uFAA2C;YACjD,KAAK,EAAE,4DAA6C;YACpD,SAAS,EAAE,qEAAiD;YAC5D,YAAY,EAAE;gBACb;oBACC,IAAI,EAAE,cAAc;oBACpB,cAAc,EAAE,yBAAyB;oBACzC,UAAU,EAAE,CAAC,aAAa,CAAC;iBAC3B;aACD;SACD,CAAC,CAAC;QAEH,KAAK,MAAM,KAAK,IAAI,qGAA2D,EAAE,CAAC;YACjF,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACtC,CAAC;QAED,IAAI,CAAC,iBAAiB,CAAC,sBAAsB,CAAC;YAC7C,IAAI,EAAE,uFAA2C;YACjD,IAAI,EAAE,mBAAmB;YACzB,WAAW,EAAE,gGAAgG;YAC7G,MAAM,EAAE,WAAW;YACnB,cAAc,EAAE,KAAK;YACrB,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;iFA2BsE;YAC9E,KAAK,EAAE;gBACN,aAAa,EAAE,wCAAwC;gBACvD,UAAU,EAAE,0CAA0C;aACtD;SACD,CAAC,CAAC;QAEH,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAErD,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QAE/D,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CACjC,uFAA2C,EAC3C,GAAmD,EAAE,CAAC,IAAI,CAAC,oBAAoB,CAAC,YAAY,EAAE,EAC9F,EAAE,CACF,CAAC;IACH,CAAC;CACD,CAAA;AAnFY,gFAAkC;6CAAlC,kCAAkC;IAjB9C,IAAA,0BAAM,EAAC;QACP,OAAO,EAAE,uFAA2C;QACpD,WAAW,EAAE,+FAAmD;QAChE,WAAW,EAAE,sGAA0D;KACvE,CAAC;IACD,IAAA,eAAM,EAAC;QACP,OAAO,EAAE,CAAC,yCAAkB,EAAE,gCAAc,EAAE,qBAAgB,CAAC;QAC/D,WAAW,EAAE,CAAC,oCAAgB,EAAE,kCAAe,CAAC;QAChD,SAAS,EAAE;YACV,+CAAqB;YACrB,uDAAyB;YACzB,uDAAyB;YACzB,kEAA8B;YAC9B,oEAA+B;YAC/B,8DAA4B;SAC5B;KACD,CAAC;qCAGuC,sDAAwB;QAC7B,8DAA4B;QAC1B,sCAAiB;QACb,8DAA4B;QACjC,6EAAmC;QAC/B,4DAA2B;QAC3B,kEAA8B;QACnC,oEAA+B;GATtD,kCAAkC,CAmF9C"}

package/dist/plugins/remote-access-cloudflare-tunnel/scripts/cloudflared-setup.sh

@@ -0,0 +1,185 @@
+#!/bin/bash
+# Privileged Cloudflare Tunnel setup job, run by PrivilegedWorkerService as
+# `sudo -n systemd-run --scope --unit=smart-panel-remote-access-cloudflare
+# bash cloudflared-setup.sh` (see CloudflareTunnelSetupService.install()).
+# Idempotent: re-running is harmless once the package is already installed.
+#
+# Unlike tailscale-setup.sh, this script has exactly one step: install the
+# `cloudflared` package from the signed vendor apt repository — never a
+# downloaded script piped into a shell. Enabling a daemon and granting an
+# operator are Tailscale-specific: the Cloudflare Tunnel connector itself
+# runs unprivileged as a child process of the backend (D9), never through
+# systemd, so there is nothing else for this privileged job to do.
+#
+# --dry-run prints the commands each step would run instead of running them
+# and always finishes at "complete" with exit 0, regardless of the host OS —
+# it previews the real branching logic without requiring root, apt or a
+# Debian-family host, so it can run from a Jest spec on any platform.
+#
+# --print-plan is a separate, read-only mode for CloudflareTunnelManagedService's
+# D12 remedy builder: it prints one command per line for the detected
+# ID/VERSION_CODENAME from /etc/os-release and executes nothing at all — no
+# status file, no trap. This is what keeps the admin-facing "run this
+# yourself" remedy list from ever drifting out of sync with what the
+# privileged install step above actually runs. An unsupported (non-Debian-family)
+# distribution prints nothing on stdout — the caller's own signal to fall
+# back to a vendor link instead of a command list.
+set -e
+# Without this, `curl ... | tee ...` reports tee's exit status, not curl's —
+# a failed download would be silently treated as success by the `|| { ... }`
+# guards below.
+set -o pipefail
+
+STATUS_FILE="${STATUS_FILE:-/var/lib/smart-panel/remote-access-cloudflare-tunnel/cloudflare-tunnel-setup-status.json}"
+
+KEYRING_URL="https://pkg.cloudflare.com/cloudflare-main.gpg"
+KEYRING_PATH="/usr/share/keyrings/cloudflare-main.gpg"
+LIST_PATH="/etc/apt/sources.list.d/cloudflared.list"
+LIST_LINE="deb [signed-by=${KEYRING_PATH}] https://pkg.cloudflare.com/cloudflared any main"
+
+DRY_RUN=0
+PRINT_PLAN=0
+for arg in "$@"; do
+	case "$arg" in
+	--dry-run) DRY_RUN=1 ;;
+	--print-plan) PRINT_PLAN=1 ;;
+	esac
+done
+
+# Read-only, side-effect-free: print the plan and exit before this script
+# ever touches STATUS_FILE or registers the cleanup trap below.
+if [ "$PRINT_PLAN" -eq 1 ]; then
+	OS_ID=""
+
+	if [ -f /etc/os-release ]; then
+		# shellcheck source=/dev/null
+		. /etc/os-release
+		OS_ID="${ID:-}"
+	fi
+
+	case "$OS_ID" in
+	raspbian | debian | ubuntu)
+		# `sudo` sits on the `tee` side, not the whole pipeline - prefixing the
+		# entire line would only elevate `curl`/`echo` and leave `tee` unable to
+		# write these root-owned paths. The caller (CloudflareTunnelManagedService)
+		# only blind-prefixes `sudo` onto lines that do not already contain a pipe.
+		echo "curl -fsSL ${KEYRING_URL} | sudo tee ${KEYRING_PATH} >/dev/null"
+		echo "echo '${LIST_LINE}' | sudo tee ${LIST_PATH} >/dev/null"
+		echo "apt-get update -qq"
+		echo "apt-get install -y -qq --no-install-recommends cloudflared"
+		;;
+	*)
+		# Unsupported distribution: intentionally prints nothing on stdout — the
+		# caller's signal to fall back to a vendor link instead of a command
+		# list. A note on stderr only, for a human running this script directly.
+		echo "unsupported distribution (ID=${OS_ID:-unknown}); install manually: https://pkg.cloudflare.com/index.html" >&2
+		;;
+	esac
+
+	exit 0
+fi
+
+# Writes the canonical `{ state, step, message }` status PrivilegedWorkerService
+# expects, via a temp file + rename so a concurrent read never sees a
+# half-written file. printf %s (never direct interpolation into the format
+# string) and the sed escape below keep an unexpected value out of the JSON
+# structure.
+write_status() {
+	local state="$1"
+	local step="$2"
+	local message="${3:-}"
+	local tmp_file="${STATUS_FILE}.tmp"
+	local safe_message=""
+
+	if [ -n "$message" ]; then
+		safe_message=$(printf '%s' "$message" | tr -d '\000-\037' | sed 's/\\/\\\\/g; s/"/\\"/g')
+	fi
+
+	mkdir -p "$(dirname "$STATUS_FILE")"
+
+	printf '{\n\t"state": "%s",\n\t"step": "%s",\n\t"message": "%s"\n}\n' \
+		"$state" "$step" "$safe_message" >"$tmp_file"
+
+	mv "$tmp_file" "$STATUS_FILE"
+}
+
+# Only fires on an exit this script did not already report itself (a crash,
+# an unset-variable error, an unhandled command failure) — a step that
+# already wrote "failed" leaves that status alone.
+cleanup() {
+	local exit_code=$?
+
+	if [ "$exit_code" -ne 0 ]; then
+		if [ -f "$STATUS_FILE" ] && grep -q '"state": "failed"' "$STATUS_FILE" 2>/dev/null; then
+			return
+		fi
+
+		write_status "failed" "unknown" "Setup exited unexpectedly with code $exit_code"
+	fi
+}
+
+trap cleanup EXIT
+
+# ──────────────────────────────────────────────────────────────
+# Install the cloudflared package if missing
+# ──────────────────────────────────────────────────────────────
+if command -v cloudflared >/dev/null 2>&1; then
+	write_status "running" "install" "cloudflared is already installed"
+else
+	write_status "running" "install" "Installing the cloudflared package"
+
+	OS_ID=""
+
+	if [ -f /etc/os-release ]; then
+		# shellcheck source=/dev/null
+		. /etc/os-release
+		OS_ID="${ID:-}"
+	fi
+
+	case "$OS_ID" in
+	raspbian | debian | ubuntu)
+		if [ "$DRY_RUN" -eq 1 ]; then
+			echo "[dry-run] curl -fsSL $KEYRING_URL | tee $KEYRING_PATH"
+			echo "[dry-run] echo '$LIST_LINE' | tee $LIST_PATH"
+			echo "[dry-run] apt-get update -qq"
+			echo "[dry-run] apt-get install -y -qq --no-install-recommends cloudflared"
+		else
+			# Only the signed keyring and the apt source list are downloaded —
+			# never a script. apt-get itself verifies every package against
+			# this keyring before installing it.
+			curl -fsSL "$KEYRING_URL" | tee "$KEYRING_PATH" >/dev/null || {
+				write_status "failed" "install" "Failed to download the Cloudflare apt keyring"
+				exit 1
+			}
+			echo "$LIST_LINE" | tee "$LIST_PATH" >/dev/null || {
+				write_status "failed" "install" "Failed to write the Cloudflare apt source list"
+				exit 1
+			}
+			apt-get update -qq || {
+				write_status "failed" "install" "apt-get update failed"
+				exit 1
+			}
+			apt-get install -y -qq --no-install-recommends cloudflared || {
+				write_status "failed" "install" "apt-get install cloudflared failed"
+				exit 1
+			}
+		fi
+		;;
+	*)
+		if [ "$DRY_RUN" -eq 1 ]; then
+			echo "[dry-run] unsupported OS (ID=${OS_ID:-unknown}) — a real run would stop here and report failed/install"
+		else
+			write_status "failed" "install" "cloudflared must be installed manually: https://pkg.cloudflare.com/index.html"
+			exit 1
+		fi
+		;;
+	esac
+fi
+
+# ──────────────────────────────────────────────────────────────
+# Done
+# ──────────────────────────────────────────────────────────────
+write_status "complete" "complete" "Cloudflare Tunnel setup completed"
+
+trap - EXIT
+exit 0

package/dist/plugins/remote-access-cloudflare-tunnel/services/cloudflare-tunnel-managed.service.d.ts

@@ -0,0 +1,82 @@
+import { ConfigService as NestConfigService } from '@nestjs/config';
+import { EventEmitter2 } from '@nestjs/event-emitter';
+import { ConfigService } from '../../../modules/config/services/config.service';
+import { BaseManagedExtensionService } from '../../../modules/extensions/services/base-managed-extension.service';
+import { ConfigChangeResult } from '../../../modules/extensions/services/managed-extension-service.interface';
+import { PlatformService } from '../../../modules/platform/services/platform.service';
+import { RemoteAccessProviderStatus } from '../../../modules/remote-access/platforms/remote-access-provider.platform';
+import { RemoteAccessCloudflareTunnelPluginConfigModel } from '../models/config.model';
+import { CloudflaredCliService } from './cloudflared-cli.service';
+import { CloudflaredMetricsService } from './cloudflared-metrics.service';
+import { CloudflaredProcessService } from './cloudflared-process.service';
+export type CloudflareTunnelRequirementCode = 'platform-supported' | 'binary-installed' | 'version-supported' | 'token-configured';
+export interface CloudflareTunnelRequirementRemedy {
+    commands: string[];
+    note: string | null;
+}
+export interface CloudflareTunnelRequirement {
+    code: CloudflareTunnelRequirementCode;
+    satisfied: boolean;
+    message: string;
+    remedy: CloudflareTunnelRequirementRemedy | null;
+}
+export declare function compareCloudflaredVersions(a: string, b: string): number;
+export declare class CloudflareTunnelManagedService extends BaseManagedExtensionService {
+    private readonly cliService;
+    private readonly processService;
+    private readonly metricsService;
+    private readonly configService;
+    private readonly nestConfigService;
+    private readonly platformService;
+    private readonly eventEmitter;
+    private readonly logger;
+    readonly owner: {
+        readonly kind: "plugin";
+        readonly type: "remote-access-cloudflare-tunnel-plugin";
+    };
+    readonly serviceId = "tunnel";
+    readonly activationPolicy: "owner-enabled";
+    private pollTimer;
+    private lastStatus;
+    private lastError;
+    private pluginConfig;
+    private requirementsCache;
+    private lastKnownVersion;
+    constructor(cliService: CloudflaredCliService, processService: CloudflaredProcessService, metricsService: CloudflaredMetricsService, configService: ConfigService, nestConfigService: NestConfigService, platformService: PlatformService, eventEmitter: EventEmitter2);
+    start(): Promise<void>;
+    stop(): Promise<void>;
+    private emitStatus;
+    onConfigChanged(): Promise<ConfigChangeResult>;
+    isHealthy(): Promise<boolean>;
+    factoryReset(): Promise<{
+        success: boolean;
+        reason?: string;
+    }>;
+    getRequirements(): CloudflareTunnelRequirement[];
+    refreshRequirements(): Promise<CloudflareTunnelRequirement[]>;
+    private requirementsSatisfied;
+    private evaluateRequirementsLive;
+    private unevaluatedRequirement;
+    private attachRemedies;
+    private finalizeRequirement;
+    private buildFixedRemedy;
+    private buildInstallRemedy;
+    private runSetupScriptPrintPlan;
+    private evaluatePlatformSupported;
+    private evaluateBinaryAndVersion;
+    private evaluateTokenConfigured;
+    private firstBlockingRequirement;
+    private stateForRequirementCode;
+    computeStatus(): Promise<RemoteAccessProviderStatus>;
+    private isPollable;
+    private schedulePoll;
+    private clearPoll;
+    private pollTick;
+    private hasStatusChanged;
+    private buildStatus;
+    private buildEndpoints;
+    private buildDetails;
+    private buildAdvisories;
+    private getMetricsAddress;
+    getPluginConfig(): RemoteAccessCloudflareTunnelPluginConfigModel;
+}