@forgezero/agent 0.1.58 → 0.1.59

package/dist/fz-agent.js

@@ -8448,7 +8448,7 @@ function assertSupportedGuestImage(imageKey) {
 }
 
 // src/version.ts
-var VERSION2 = "0.1.58";
+var VERSION2 = "0.1.59";
 
 // src/ssh-bootstrap.ts
 class SshBootstrapError extends Error {
@@ -8583,7 +8583,7 @@ var verifiedBunArchive = async (directory) => {
   writeFileSync4(archive, bytes, { mode: 384, flag: "wx" });
   return archive;
 };
-var remote = (exec, ssh, destination, code, argv2, secret = false) => checked(exec, ["ssh", ...ssh, destination, "--", ...argv2], code, { secret });
+var remote = (exec, ssh, destination, code, argv2, secret = false, stdin) => checked(exec, ["ssh", ...ssh, destination, "--", ...argv2], code, { secret, ...stdin !== undefined ? { stdin } : {} });
 async function executeSshBootstrap(claim, options) {
   validateClaim(claim);
   if (!options.sshKeyPath.startsWith("/") || /[\r\n]/.test(options.sshKeyPath))
@@ -8622,14 +8622,11 @@ async function executeSshBootstrap(claim, options) {
       realm: claim.realm,
       nodeHostname: claim.target.nodeHostname,
       telemetryEndpoint: telemetry.origin,
-      enrolTokenFile: "/run/forgezero-bootstrap/enrol.token",
       profile: "app",
       software: [{ id: "bun", version: PINNED_BUN_VERSION }]
     };
     const files = {
       "config.json": `${JSON.stringify(config, null, 2)}
-`,
-      "enrol.token": `${claim.enrolmentToken}
 `
     };
     for (const [name, content] of Object.entries(files))
@@ -8753,7 +8750,7 @@ async function executeSshBootstrap(claim, options) {
       "/usr/local/lib/forgezero/agent/fz.js",
       "/usr/local/bin/fz"
     ]);
-    for (const name of ["config.json", "enrol.token"])
+    for (const name of ["config.json"])
       await remote(exec, ssh, destination, "REMOTE_CONFIG_INSTALL_FAILED", [
         "/usr/bin/sudo",
         "-n",
@@ -8769,10 +8766,12 @@ async function executeSshBootstrap(claim, options) {
       "/usr/local/bin/fz",
       "agent",
       "activate",
+      "credentials-stdin",
       "--bootstrap-config",
       "/run/forgezero-bootstrap/config.json",
       "--apply"
-    ], true);
+    ], true, `${JSON.stringify({ enrolmentToken: claim.enrolmentToken })}
+`);
     await remote(exec, ssh, destination, "REMOTE_CLEANUP_FAILED", [
       "/usr/bin/sudo",
       "-n",
@@ -13078,10 +13077,10 @@ var AGENT_CREDENTIAL_LOCATIONS = [
   "tenant-compute"
 ];
 var AGENT_CREDENTIAL_POLICY = {
-  operator: { vault: false, systemdFallback: false, attendedFile: true },
-  metal: { vault: false, systemdFallback: true, attendedFile: false },
-  "platform-compute": { vault: true, systemdFallback: true, attendedFile: false },
-  "tenant-compute": { vault: true, systemdFallback: true, attendedFile: false }
+  operator: { vault: false, systemdFallback: false, hiddenInput: true },
+  metal: { vault: false, systemdFallback: true, hiddenInput: false },
+  "platform-compute": { vault: true, systemdFallback: true, hiddenInput: false },
+  "tenant-compute": { vault: true, systemdFallback: true, hiddenInput: false }
 };
 var CREDENTIAL_NAME = /^[A-Z_][A-Z0-9_]*$/;
 var SCOPE_PART2 = /^[A-Za-z0-9_][A-Za-z0-9_.-]{0,127}$/;
@@ -13365,7 +13364,7 @@ async function runRecoveryHost(args, run2 = execute2) {
     nonEmpty("/etc/forgezero/creds/arangodb-jwt.cred");
     const hasDatabase = role !== "none";
     if (hasDatabase) {
-      nonEmpty("/etc/forgezero/creds/backup-s3-secret.cred");
+      nonEmpty("/etc/forgezero/creds/backup.s3.secretAccessKey.cred");
       nonEmpty("/etc/forgezero/creds/backup-recovery-root.cred");
     }
     const slot = activeSlot();
@@ -13412,7 +13411,7 @@ async function runRecoveryHost(args, run2 = execute2) {
       "--property=LoadCredentialEncrypted=arangodb-jwt:/etc/forgezero/creds/arangodb-jwt.cred",
       ...args.includes("--fleet-fenced") ? ["--property=Environment=FZ_RECOVERY_FLEET_FENCED=all-api-and-scheduler-replicas-are-stopped"] : [],
       ...args.includes("--backup-credentials") ? [
-        "--property=LoadCredentialEncrypted=backup-s3-secret:/etc/forgezero/creds/backup-s3-secret.cred",
+        "--property=LoadCredentialEncrypted=backup.s3.secretAccessKey:/etc/forgezero/creds/backup.s3.secretAccessKey.cred",
         "--property=LoadCredentialEncrypted=backup-recovery-root:/etc/forgezero/creds/backup-recovery-root.cred"
       ] : []
     ];
@@ -14177,10 +14176,11 @@ function planProvision(options) {
   const warpEnabled = warpValues.every(Boolean);
   if (warpValues.some(Boolean) && !warpEnabled)
     throw new Error("WARP configuration must be supplied together");
-  const enrolmentEnabled = Boolean(options.enrolTokenSourcePath && options.enrolTokenCredentialPath && options.enrolStatePath);
-  if (Boolean(options.enrolTokenSourcePath) !== Boolean(options.enrolTokenCredentialPath) || Boolean(options.enrolTokenCredentialPath) !== Boolean(options.enrolStatePath))
-    throw new Error("direct enrolment paths must be supplied together");
-  const enrolTokenSourcePath = enrolmentEnabled ? systemdPath(options.enrolTokenSourcePath, "enrolment source") : undefined;
+  const enrolmentEnabled = Boolean(options.enrolTokenCredentialPath && options.enrolStatePath);
+  if (Boolean(options.enrolTokenCredentialPath) !== Boolean(options.enrolStatePath) || options.enrolTokenSourcePath && !enrolmentEnabled) {
+    throw new Error("direct enrolment credential and state paths must be supplied together");
+  }
+  const enrolTokenSourcePath = options.enrolTokenSourcePath ? systemdPath(options.enrolTokenSourcePath, "enrolment source") : undefined;
   const enrolTokenCredentialPath = enrolmentEnabled ? systemdPath(options.enrolTokenCredentialPath, "enrolment credential") : undefined;
   const enrolStatePath = enrolmentEnabled ? systemdPath(options.enrolStatePath, "enrolment state") : undefined;
   const enrolStateDir = enrolStatePath?.replace(/\/[^/]+$/, "");
@@ -14308,7 +14308,12 @@ function planProvision(options) {
       ] : [],
       ...enrolmentEnabled ? [
         step2("enrolment state directory", { kind: "directories", directories: [{ path: enrolStateDir, mode: 448, owner: user, group: user }] }),
-        step2("encrypted one-time enrolment capability", { kind: "ensure-enrolment", state: enrolStatePath, source: enrolTokenSourcePath, credential: enrolTokenCredentialPath })
+        ...enrolTokenSourcePath ? [step2("encrypted one-time enrolment capability", {
+          kind: "ensure-enrolment",
+          state: enrolStatePath,
+          source: enrolTokenSourcePath,
+          credential: enrolTokenCredentialPath
+        })] : []
       ] : [],
       ...deploymentEnabled ? [step2("deployment directories", { kind: "directories", directories: [
         { path: deployRoot, mode: 493, owner: "root", group: "root" },
@@ -14657,6 +14662,7 @@ var JWT_CREDENTIAL = `${CREDS}/arangodb-jwt.cred`;
 var ENROL_CREDENTIAL = `${CREDS}/enrol-token.cred`;
 var TUNNEL_CREDENTIAL = `${CREDS}/CF_TUNNEL_CONNECTOR_TOKEN.cred`;
 var CF_API_CREDENTIAL = `${CREDS}/CF_API_TOKEN.cred`;
+var CF_TUNNEL_API_CREDENTIAL = `${CREDS}/CF_TUNNEL_TOKEN.cred`;
 var WARP_CONNECTOR_CREDENTIAL = `${CREDS}/CF_WARP_CONNECTOR_TOKEN.cred`;
 var REALTIME_PUBLISH_CREDENTIAL = `${CREDS}/REALTIME_PUBLISH_SECRET.cred`;
 var REALTIME_TICKET_CREDENTIAL = `${CREDS}/REALTIME_TICKET_SECRET.cred`;
@@ -14887,10 +14893,10 @@ function localBootstrapHost() {
         throw new Error(`Agent software requirements failed: ${result.output.trim()}`);
       return result;
     },
-    async installAgent(config, enrolTokenSourcePath) {
+    async installAgent(config) {
       const capabilities = await readCapabilities(localRunner);
       const deployRoot = config.deployRoot ?? "/opt/forgezero";
-      const hasBinding = config.kind === "enrolled-compute" || Boolean(enrolTokenSourcePath) || existsSync19("/var/lib/forgezero/enrolment.json");
+      const hasBinding = config.kind === "enrolled-compute" || existsSync19(ENROL_CREDENTIAL) || existsSync19("/var/lib/forgezero/enrolment.json");
       if (config.kind === "platform") {
         const lifecycle = config.database.role === "none" ? {
           apiUnits: ["forgezero@blue.service", "forgezero@green.service"],
@@ -14933,8 +14939,7 @@ function localBootstrapHost() {
         telemetryEndpoint: config.telemetryEndpoint,
         binPath: "/usr/local/lib/forgezero/agent/fz-agent",
         sourceBinPath: PACKAGED_AGENT_BIN,
-        ...config.kind === "enrolled-compute" || enrolTokenSourcePath ? {
-          enrolTokenSourcePath: config.kind === "enrolled-compute" ? config.enrolTokenFile : enrolTokenSourcePath,
+        ...hasBinding ? {
           enrolTokenCredentialPath: ENROL_CREDENTIAL,
           enrolStatePath: "/var/lib/forgezero/enrolment.json",
           apiUrl: config.apiUrl,