@flui-cloud/cli 0.0.1

package/lib/src/modules/infrastructure/firewalls/services/firewall-reconciliation.service.js

@@ -0,0 +1,212 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var FirewallReconciliationService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FirewallReconciliationService = void 0;
+const common_1 = require("@nestjs/common");
+const firewall_desired_state_service_1 = require("./firewall-desired-state.service");
+const firewall_provider_factory_1 = require("../../../providers/services/firewall-provider.factory");
+const label_service_1 = require("../../../common/services/label.service");
+const cluster_firewall_entity_1 = require("../entities/cluster-firewall.entity");
+let FirewallReconciliationService = FirewallReconciliationService_1 = class FirewallReconciliationService {
+    constructor(desiredStateService, firewallProviderFactory, labelService) {
+        this.desiredStateService = desiredStateService;
+        this.firewallProviderFactory = firewallProviderFactory;
+        this.labelService = labelService;
+        this.logger = new common_1.Logger(FirewallReconciliationService_1.name);
+    }
+    /**
+     * Update desired rules and apply them atomically.
+     * If provider application fails, no changes are saved to the database.
+     */
+    async updateAndApplyRules(firewallId, newRules) {
+        this.logger.log(`Updating and applying rules for firewall ${firewallId} (atomic operation)`);
+        // Get current firewall state
+        const firewall = await this.desiredStateService.getFirewallById(firewallId);
+        const cluster = firewall.cluster;
+        if (!cluster) {
+            throw new common_1.BadRequestException('Cluster not found for firewall');
+        }
+        // Canonicalize and validate new rules
+        const canonicalRules = this.desiredStateService.canonicalizeRules(newRules);
+        const newDesiredHash = this.desiredStateService.calculateHash(canonicalRules);
+        // Check if rules actually changed
+        if (newDesiredHash === firewall.desiredHash) {
+            this.logger.log(`No changes detected for firewall ${firewallId}, skipping update`);
+            return firewall;
+        }
+        // Mark as reconciling temporarily (without persisting to DB yet)
+        await this.desiredStateService.updateReconciliationStatus(firewallId, cluster_firewall_entity_1.ReconciliationStatus.RECONCILING);
+        try {
+            const provider = this.firewallProviderFactory.getFirewallProvider(cluster.provider);
+            // Apply to provider FIRST (fail fast if provider has issues)
+            if (firewall.providerFirewallId) {
+                this.logger.log(`Applying rules to existing provider firewall ${firewall.providerFirewallId}`);
+                await provider.updateFirewallRules(firewall.providerFirewallId, canonicalRules);
+            }
+            else {
+                // Create new provider firewall
+                this.logger.log(`Creating new provider firewall for cluster ${cluster.id}`);
+                const firewallName = this.generateFirewallName(cluster.name);
+                const labelsRecord = this.generateFirewallLabels(firewall.id, cluster.id);
+                const labels = Object.entries(labelsRecord).map(([key, value]) => ({
+                    key,
+                    value,
+                }));
+                const labelSelector = `flui-cluster-id=${cluster.id}`;
+                const providerFirewall = await provider.createFirewall({
+                    name: firewallName,
+                    rules: canonicalRules,
+                    labels,
+                    applyToLabelSelector: labelSelector,
+                });
+                firewall.providerFirewallId = providerFirewall.firewallId;
+                this.logger.log(`Created provider firewall ${providerFirewall.firewallId}`);
+            }
+            // SUCCESS: Now save to database
+            this.logger.log(`Provider update successful, saving to database for firewall ${firewallId}`);
+            const savedFirewall = await this.desiredStateService.updateDesiredAndAppliedState(firewall, canonicalRules, firewall.providerFirewallId);
+            this.logger.log(`Firewall ${firewallId} updated and applied successfully`);
+            return savedFirewall;
+        }
+        catch (error) {
+            this.logger.error(`Failed to apply rules to provider for firewall ${firewallId}: ${error.message}`, error.stack);
+            // Restore previous status (don't save the new rules)
+            await this.desiredStateService.updateReconciliationStatus(firewallId, firewall.reconciliationStatus, // Restore original status
+            `Failed to apply rules: ${error.message}`);
+            // Re-throw to return HTTP 500 to client
+            throw error;
+        }
+    }
+    /**
+     * Reconcile firewall: create or update provider firewall to match desired state
+     */
+    async reconcile(firewallId) {
+        this.logger.log(`Starting reconciliation for firewall ${firewallId}`);
+        const firewall = await this.desiredStateService.getFirewallById(firewallId);
+        // Mark as reconciling
+        await this.desiredStateService.updateReconciliationStatus(firewallId, cluster_firewall_entity_1.ReconciliationStatus.RECONCILING);
+        try {
+            const cluster = firewall.cluster;
+            if (!cluster) {
+                throw new common_1.BadRequestException('Cluster not found for firewall');
+            }
+            const provider = this.firewallProviderFactory.getFirewallProvider(cluster.provider);
+            const canonicalRules = this.desiredStateService.canonicalizeRules(firewall.desiredRules);
+            // Generate firewall name
+            const firewallName = this.generateFirewallName(cluster.name);
+            // Generate labels for firewall
+            const labelsRecord = this.generateFirewallLabels(firewall.id, cluster.id);
+            const labels = Object.entries(labelsRecord).map(([key, value]) => ({
+                key,
+                value,
+            }));
+            if (firewall.providerFirewallId) {
+                // Update existing provider firewall
+                this.logger.log(`Updating provider firewall ${firewall.providerFirewallId}`);
+                await provider.updateFirewallRules(firewall.providerFirewallId, canonicalRules);
+                // Mark reconciliation complete
+                return await this.desiredStateService.markReconciliationComplete(firewallId, canonicalRules, firewall.providerFirewallId);
+            }
+            else {
+                // Create new provider firewall
+                this.logger.log(`Creating new provider firewall for cluster ${cluster.id}`);
+                const labelSelector = `flui-cluster-id=${cluster.id}`;
+                const providerFirewall = await provider.createFirewall({
+                    name: firewallName,
+                    rules: canonicalRules,
+                    labels,
+                    applyToLabelSelector: labelSelector,
+                });
+                this.logger.log(`Created provider firewall ${providerFirewall.firewallId} for cluster ${cluster.id}`);
+                // Mark reconciliation complete
+                return await this.desiredStateService.markReconciliationComplete(firewallId, canonicalRules, providerFirewall.firewallId);
+            }
+        }
+        catch (error) {
+            this.logger.error(`Reconciliation failed for firewall ${firewallId}: ${error.message}`, error.stack);
+            await this.desiredStateService.updateReconciliationStatus(firewallId, cluster_firewall_entity_1.ReconciliationStatus.ERROR, error.message);
+            throw error;
+        }
+    }
+    /**
+     * Fetch actual state from provider and compare with desired state
+     */
+    async fetchActualState(firewallId) {
+        const firewall = await this.desiredStateService.getFirewallById(firewallId);
+        if (!firewall.providerFirewallId) {
+            return [];
+        }
+        const cluster = firewall.cluster;
+        const provider = this.firewallProviderFactory.getFirewallProvider(cluster.provider);
+        const providerFirewall = await provider.getFirewall(firewall.providerFirewallId);
+        return providerFirewall.rules || [];
+    }
+    /**
+     * Delete provider firewall
+     */
+    async deleteProviderFirewall(firewallId) {
+        const firewall = await this.desiredStateService.getFirewallById(firewallId);
+        if (!firewall.providerFirewallId) {
+            this.logger.warn(`No provider firewall ID for firewall ${firewallId}, skipping deletion`);
+            return;
+        }
+        const cluster = firewall.cluster;
+        const provider = this.firewallProviderFactory.getFirewallProvider(cluster.provider);
+        this.logger.log(`Deleting provider firewall ${firewall.providerFirewallId}`);
+        await provider.deleteFirewall(firewall.providerFirewallId);
+        this.logger.log(`Deleted provider firewall ${firewall.providerFirewallId}`);
+    }
+    /**
+     * Cleanup orphaned provider firewalls by cluster ID
+     * Used as fallback during cluster deletion
+     */
+    async cleanupOrphanedFirewalls(clusterId, provider) {
+        this.logger.log(`Cleaning up orphaned firewalls for cluster ${clusterId}`);
+        const firewallProvider = this.firewallProviderFactory.getFirewallProvider(provider);
+        const firewalls = await firewallProvider.listFirewalls({
+            labelSelector: `flui-cluster-id=${clusterId}`,
+        });
+        for (const firewall of firewalls) {
+            // Verify it's a Flui-managed firewall
+            if (firewall.labels?.['managed-by'] === 'flui-cloud' &&
+                firewall.labels['flui-cluster-id'] === clusterId) {
+                this.logger.log(`Deleting orphaned firewall ${firewall.id}`);
+                await firewallProvider.deleteFirewall(firewall.id);
+            }
+        }
+    }
+    /**
+     * Generate firewall name with short ID
+     */
+    generateFirewallName(clusterName) {
+        const shortId = Math.random().toString(36).substring(2, 8);
+        return `flui-${clusterName}-${shortId}`;
+    }
+    /**
+     * Generate standard labels for firewall
+     */
+    generateFirewallLabels(firewallId, clusterId) {
+        return {
+            'managed-by': 'flui-cloud',
+            'flui-resource-type': 'cluster-firewall',
+            'flui-cluster-id': clusterId,
+            'flui-firewall-id': firewallId,
+        };
+    }
+};
+exports.FirewallReconciliationService = FirewallReconciliationService;
+exports.FirewallReconciliationService = FirewallReconciliationService = FirewallReconciliationService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [firewall_desired_state_service_1.FirewallDesiredStateService,
+        firewall_provider_factory_1.FirewallProviderFactory,
+        label_service_1.LabelService])
+], FirewallReconciliationService);

package/lib/src/modules/infrastructure/firewalls/templates/firewall-rules.template.d.ts

@@ -0,0 +1,54 @@
+import { FirewallRule } from '../../../providers/interfaces/firewall-provider.interface';
+/**
+ * Firewall rules — public surface only.
+ *
+ * Intra-cluster and inter-cluster traffic (Prometheus scrape, Loki ingest,
+ * kubelet, K3s API, DB/Redis NodePorts, ClusterIP services) flows over the
+ * environment VNet/Subnet and never touches the public interface.
+ *
+ * Observability + workload cluster public ports:
+ *   22     SSH (management, sourceCidrs)
+ *   80     Traefik HTTP (api/app/auth via nip.io ingress)
+ *   443    Traefik HTTPS
+ */
+export declare const OBSERVABILITY_FIREWALL_RULES: (sourceCidrs: string[]) => FirewallRule[];
+export declare const WORKLOAD_FIREWALL_RULES: (sourceCidrs: string[]) => FirewallRule[];
+export declare const OBSERVABILITY_PORTS: {
+    readonly SSH: {
+        readonly port: 22;
+        readonly protocol: "tcp";
+        readonly description: "SSH management";
+    };
+    readonly HTTP_INGRESS: {
+        readonly port: 80;
+        readonly protocol: "tcp";
+        readonly description: "HTTP Ingress (Traefik)";
+    };
+    readonly HTTPS_INGRESS: {
+        readonly port: 443;
+        readonly protocol: "tcp";
+        readonly description: "HTTPS Ingress (Traefik)";
+    };
+};
+export declare const WORKLOAD_PORTS: {
+    readonly SSH: {
+        readonly port: 22;
+        readonly protocol: "tcp";
+        readonly description: "SSH management";
+    };
+    readonly HTTP_INGRESS: {
+        readonly port: 80;
+        readonly protocol: "tcp";
+        readonly description: "HTTP Ingress (Traefik)";
+    };
+    readonly HTTPS_INGRESS: {
+        readonly port: 443;
+        readonly protocol: "tcp";
+        readonly description: "HTTPS Ingress (Traefik)";
+    };
+};
+export declare function validateFirewallRules(rules: FirewallRule[]): {
+    valid: boolean;
+    errors: string[];
+};
+export declare function getFirewallRulesForClusterType(clusterType: 'observability' | 'workload', sourceCidrs: string[]): FirewallRule[];

package/lib/src/modules/infrastructure/firewalls/templates/firewall-rules.template.js

@@ -0,0 +1,167 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WORKLOAD_PORTS = exports.OBSERVABILITY_PORTS = exports.WORKLOAD_FIREWALL_RULES = exports.OBSERVABILITY_FIREWALL_RULES = void 0;
+exports.validateFirewallRules = validateFirewallRules;
+exports.getFirewallRulesForClusterType = getFirewallRulesForClusterType;
+/**
+ * Firewall rules — public surface only.
+ *
+ * Intra-cluster and inter-cluster traffic (Prometheus scrape, Loki ingest,
+ * kubelet, K3s API, DB/Redis NodePorts, ClusterIP services) flows over the
+ * environment VNet/Subnet and never touches the public interface.
+ *
+ * Observability + workload cluster public ports:
+ *   22     SSH (management, sourceCidrs)
+ *   80     Traefik HTTP (api/app/auth via nip.io ingress)
+ *   443    Traefik HTTPS
+ */
+const OBSERVABILITY_FIREWALL_RULES = (sourceCidrs) => [
+    {
+        description: 'SSH access for server management',
+        direction: 'in',
+        protocol: 'tcp',
+        port: '22',
+        sourceIps: sourceCidrs,
+    },
+    {
+        description: 'HTTP Ingress (Traefik)',
+        direction: 'in',
+        protocol: 'tcp',
+        port: '80',
+        sourceIps: ['0.0.0.0/0', '::/0'],
+    },
+    {
+        description: 'HTTPS Ingress (Traefik)',
+        direction: 'in',
+        protocol: 'tcp',
+        port: '443',
+        sourceIps: ['0.0.0.0/0', '::/0'],
+    },
+    {
+        description: 'Allow all outbound TCP traffic',
+        direction: 'out',
+        protocol: 'tcp',
+        destinationIps: ['0.0.0.0/0', '::/0'],
+    },
+    {
+        description: 'Allow all outbound UDP traffic',
+        direction: 'out',
+        protocol: 'udp',
+        destinationIps: ['0.0.0.0/0', '::/0'],
+    },
+];
+exports.OBSERVABILITY_FIREWALL_RULES = OBSERVABILITY_FIREWALL_RULES;
+const WORKLOAD_FIREWALL_RULES = (sourceCidrs) => [
+    {
+        description: 'SSH access for cluster management',
+        direction: 'in',
+        protocol: 'tcp',
+        port: '22',
+        sourceIps: sourceCidrs,
+    },
+    {
+        description: 'HTTP Ingress (Traefik)',
+        direction: 'in',
+        protocol: 'tcp',
+        port: '80',
+        sourceIps: ['0.0.0.0/0', '::/0'],
+    },
+    {
+        description: 'HTTPS Ingress (Traefik)',
+        direction: 'in',
+        protocol: 'tcp',
+        port: '443',
+        sourceIps: ['0.0.0.0/0', '::/0'],
+    },
+    {
+        description: 'Allow all outbound TCP traffic',
+        direction: 'out',
+        protocol: 'tcp',
+        destinationIps: ['0.0.0.0/0', '::/0'],
+    },
+    {
+        description: 'Allow all outbound UDP traffic',
+        direction: 'out',
+        protocol: 'udp',
+        destinationIps: ['0.0.0.0/0', '::/0'],
+    },
+    {
+        description: 'Allow all outbound ICMP (for ping, traceroute)',
+        direction: 'out',
+        protocol: 'icmp',
+        destinationIps: ['0.0.0.0/0', '::/0'],
+    },
+];
+exports.WORKLOAD_FIREWALL_RULES = WORKLOAD_FIREWALL_RULES;
+exports.OBSERVABILITY_PORTS = {
+    SSH: { port: 22, protocol: 'tcp', description: 'SSH management' },
+    HTTP_INGRESS: {
+        port: 80,
+        protocol: 'tcp',
+        description: 'HTTP Ingress (Traefik)',
+    },
+    HTTPS_INGRESS: {
+        port: 443,
+        protocol: 'tcp',
+        description: 'HTTPS Ingress (Traefik)',
+    },
+};
+exports.WORKLOAD_PORTS = {
+    SSH: { port: 22, protocol: 'tcp', description: 'SSH management' },
+    HTTP_INGRESS: {
+        port: 80,
+        protocol: 'tcp',
+        description: 'HTTP Ingress (Traefik)',
+    },
+    HTTPS_INGRESS: {
+        port: 443,
+        protocol: 'tcp',
+        description: 'HTTPS Ingress (Traefik)',
+    },
+};
+function validateFirewallRules(rules) {
+    const errors = [];
+    const hasSshAccess = rules.some((r) => r.direction === 'in' && r.protocol === 'tcp' && r.port === '22');
+    if (!hasSshAccess) {
+        errors.push('Firewall must include SSH access (port 22) to prevent server lockout');
+    }
+    const hasOutbound = rules.some((r) => r.direction === 'out');
+    if (!hasOutbound) {
+        errors.push('Firewall must allow outbound traffic for system updates and package installation');
+    }
+    rules.forEach((rule, index) => {
+        if (rule.sourceIps) {
+            rule.sourceIps.forEach((cidr) => {
+                if (!isValidCidr(cidr)) {
+                    errors.push(`Invalid CIDR format in rule ${index + 1}: ${cidr}`);
+                }
+            });
+        }
+        if (rule.destinationIps) {
+            rule.destinationIps.forEach((cidr) => {
+                if (!isValidCidr(cidr)) {
+                    errors.push(`Invalid CIDR format in rule ${index + 1}: ${cidr}`);
+                }
+            });
+        }
+    });
+    return {
+        valid: errors.length === 0,
+        errors,
+    };
+}
+function isValidCidr(cidr) {
+    const ipv4Regex = /^(\d{1,3}\.){3}\d{1,3}\/\d{1,2}$/;
+    const ipv6Regex = /^([0-9a-fA-F:]+)\/\d{1,3}$/;
+    return ipv4Regex.test(cidr) || ipv6Regex.test(cidr);
+}
+function getFirewallRulesForClusterType(clusterType, sourceCidrs) {
+    switch (clusterType) {
+        case 'observability':
+            return (0, exports.OBSERVABILITY_FIREWALL_RULES)(sourceCidrs);
+        case 'workload':
+            return (0, exports.WORKLOAD_FIREWALL_RULES)(sourceCidrs);
+        default:
+            return (0, exports.WORKLOAD_FIREWALL_RULES)(sourceCidrs);
+    }
+}

package/lib/src/modules/infrastructure/operations/helpers/operation-steps.helper.d.ts

@@ -0,0 +1,34 @@
+import { OperationType, OperationStep } from '../../servers/entities/infrastructure-operations.entity';
+/**
+ * Step configuration interface
+ */
+export interface OperationStepConfig {
+    step: OperationStep;
+    description: string;
+    weight: number;
+}
+/**
+ * Generate step configuration dynamically based on operation context
+ * This allows steps to adapt to different scenarios (e.g., single-node vs multi-node clusters)
+ */
+export declare function getOperationSteps(operationType: OperationType, context?: Record<string, any>): OperationStepConfig[];
+/**
+ * Calculate total progress based on step index and current step progress
+ */
+export declare function calculateOperationProgress(operationType: OperationType, currentStepIndex: number, currentStepProgress?: number, context?: Record<string, any>): number;
+/**
+ * Calculate progress using saved operation steps from metadata
+ */
+export declare function calculateOperationProgressFromSaved(savedSteps: OperationStepConfig[], currentStepIndex: number, currentStepProgress?: number): number;
+/**
+ * Get step configuration for an operation
+ */
+export declare function getStepConfig(operationType: OperationType, stepIndex: number, context?: Record<string, any>): OperationStepConfig | undefined;
+/**
+ * Get step configuration from saved metadata
+ */
+export declare function getStepConfigFromSaved(savedSteps: OperationStepConfig[], stepIndex: number): OperationStepConfig | undefined;
+/**
+ * Get total number of steps for an operation
+ */
+export declare function getTotalSteps(operationType: OperationType, context?: Record<string, any>): number;