@geekmidas/cli 10.0.0-alpha.12 → 10.0.0-alpha.120

package/dist/serverSetup-CKs4K9gD.cjs

@@ -0,0 +1,630 @@
+const require_errors = require("./errors-DMC4Umsb.cjs");
+const require_compose = require("./compose-Mdgea4Yt.cjs");
+const require_workspace = require("./workspace-BwqQnool.cjs");
+const require_seeds = require("./seeds-C2w4UqVP.cjs");
+const require_config = require("./config.cjs");
+const require_sniffer = require("./sniffer-CF7wNxMo.cjs");
+const require_index = require("./index.cjs");
+const require_github = require("./github-BAeaC1Pl.cjs");
+let node_path = require("node:path");
+let node_fs = require("node:fs");
+let node_fs_promises = require("node:fs/promises");
+let node_os = require("node:os");
+let node_child_process = require("node:child_process");
+//#region src/compose/serverScript.ts
+/**
+* What `gkm compose:server` runs on the server, as root (through the admin
+* user's sudo). Plain bash, so `--dry-run` can print exactly what will run,
+* and safe to run again: every step changes only what is missing or wrong.
+*
+* Arguments, in order: the admin user (the one running sudo), the deploy
+* user, the SSH port, the deploy key's public line, and its comment.
+*
+* The last line it prints is `HOSTKEY=<fingerprint>` — the server's own
+* ed25519 host key, which the command checks the network's against before
+* pinning it for CI.
+*/
+const SERVER_SCRIPT = String.raw`set -euo pipefail
+export DEBIAN_FRONTEND=noninteractive
+ADMIN="$1"; DEPLOY="$2"; SSH_PORT="$3"; PUB="$4"; COMMENT="$5"
+say() { echo "   $*"; }
+fail() { echo "   ✗ $*" >&2; exit 1; }
+
+. /etc/os-release
+case "$ID" in
+	ubuntu | debian) ;;
+	*) fail "gkm sets up Ubuntu and Debian servers; this one is $ID." ;;
+esac
+
+# ── SSH: keys only, no root ────────────────────────────────────────────────
+# Before password logins are turned off, the admin must have a key to come
+# back with — otherwise this would lock them out.
+ADMIN_HOME="$(getent passwd "$ADMIN" | cut -d: -f6)"
+[ -s "$ADMIN_HOME/.ssh/authorized_keys" ] ||
+	fail "$ADMIN has no key in $ADMIN_HOME/.ssh/authorized_keys; turning off password logins would lock them out."
+# First match wins in sshd_config, and 00- sorts before what a provider ships
+# (cloud-init's 50-cloud-init.conf turns password logins back on).
+cat > /etc/ssh/sshd_config.d/00-gkm-hardening.conf <<'EOF'
+# Written by gkm compose:server.
+PermitRootLogin no
+PasswordAuthentication no
+KbdInteractiveAuthentication no
+EOF
+# The deploy migrates through an SSH tunnel to the server's loopback.
+cat > /etc/ssh/sshd_config.d/60-gkm-deploy.conf <<EOF
+# Written by gkm compose:server.
+Match User $DEPLOY
+    AllowTcpForwarding local
+EOF
+sshd -t
+systemctl reload ssh 2>/dev/null || systemctl reload sshd
+# What sshd actually does now, whatever else is in its config.
+EFFECTIVE="$(sshd -T)"
+for setting in 'permitrootlogin no' 'passwordauthentication no' 'kbdinteractiveauthentication no'; do
+	grep -qx "$setting" <<<"$EFFECTIVE" || fail "sshd still does not say '$setting'; another file in /etc/ssh overrides it."
+done
+FORWARD="$(sshd -T -C "user=$DEPLOY,host=localhost,addr=127.0.0.1" | sed -n 's/^allowtcpforwarding //p')"
+case "$FORWARD" in
+	yes | all | local) ;;
+	*) fail "sshd does not let $DEPLOY forward ports (allowtcpforwarding $FORWARD)." ;;
+esac
+say "sshd: keys only, no root login; $DEPLOY may open local tunnels"
+# Root is reached through the admin's sudo, which this script is running
+# under — so its password, the one a provider mails out, can go.
+passwd -l root >/dev/null
+say "root's password locked; $ADMIN's sudo is the way to root"
+
+# ── Firewall: SSH, HTTP, HTTPS ─────────────────────────────────────────────
+command -v ufw >/dev/null || { apt-get update -qq && apt-get install -y -qq ufw >/dev/null; }
+ufw default deny incoming >/dev/null
+ufw default allow outgoing >/dev/null
+ufw allow "$SSH_PORT/tcp" >/dev/null
+ufw allow 80/tcp >/dev/null
+ufw allow 443/tcp >/dev/null
+ufw --force enable >/dev/null
+say "firewall: $SSH_PORT, 80, 443 in; everything out"
+EXTRA="$(ufw status | awk 'NR > 4 && $1 != "" { print $1 }' | grep -vxE "(($SSH_PORT|80|443)(/tcp)?|OpenSSH)" | sort -u || true)"
+if [ -n "$EXTRA" ]; then
+	say "⚠ also open: $(echo $EXTRA). gkm uses none of them; close each with: sudo ufw delete allow <port>"
+fi
+
+# ── Updates and bans ───────────────────────────────────────────────────────
+apt-get update -qq
+apt-get install -y -qq unattended-upgrades fail2ban >/dev/null
+cat > /etc/apt/apt.conf.d/20auto-upgrades <<'EOF'
+APT::Periodic::Update-Package-Lists "1";
+APT::Periodic::Unattended-Upgrade "1";
+EOF
+cat > /etc/fail2ban/jail.d/gkm.local <<EOF
+# Written by gkm compose:server.
+[sshd]
+enabled = true
+port = $SSH_PORT
+EOF
+systemctl enable --now unattended-upgrades fail2ban >/dev/null 2>&1
+systemctl restart fail2ban
+say "security updates install daily; fail2ban watches sshd"
+
+# ── Docker, from Docker's own repository ───────────────────────────────────
+if ! command -v docker >/dev/null || ! docker compose version >/dev/null 2>&1; then
+	say "installing Docker…"
+	apt-get install -y -qq ca-certificates curl >/dev/null
+	install -m 0755 -d /etc/apt/keyrings
+	curl -fsSL "https://download.docker.com/linux/$ID/gpg" -o /etc/apt/keyrings/docker.asc
+	chmod a+r /etc/apt/keyrings/docker.asc
+	echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/$ID $VERSION_CODENAME stable" \
+		> /etc/apt/sources.list.d/docker.list
+	apt-get update -qq
+	apt-get install -y -qq docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin >/dev/null
+fi
+systemctl enable --now docker >/dev/null 2>&1
+say "docker $(docker version --format '{{.Server.Version}}')"
+
+# ── The deploy user: no password, no sudo, in the docker group ─────────────
+id "$DEPLOY" >/dev/null 2>&1 || adduser --disabled-password --gecos "" "$DEPLOY" >/dev/null
+usermod -aG docker "$DEPLOY"
+DEPLOY_HOME="$(getent passwd "$DEPLOY" | cut -d: -f6)"
+install -d -m 700 -o "$DEPLOY" -g "$DEPLOY" "$DEPLOY_HOME/.ssh"
+AUTH="$DEPLOY_HOME/.ssh/authorized_keys"
+touch "$AUTH"
+# One managed line: this key (or an earlier one by the same name) replaced,
+# with nothing allowed but the commands and the tunnel the deploy uses.
+KEYBODY="$(awk '{ print $2 }' <<<"$PUB")"
+grep -v -F -e "$KEYBODY" -e " $COMMENT" "$AUTH" > "$AUTH.new" || true
+echo "restrict,port-forwarding $PUB" >> "$AUTH.new"
+mv "$AUTH.new" "$AUTH"
+chown "$DEPLOY:$DEPLOY" "$AUTH"
+chmod 600 "$AUTH"
+say "user $DEPLOY (docker group), deploy key authorized with restrict,port-forwarding"
+OTHERS="$(grep -v -F -e "$KEYBODY" "$AUTH" | grep -c . || true)"
+if [ "$OTHERS" -gt 0 ]; then
+	say "⚠ $AUTH holds $OTHERS other key(s). Review: sudo cat $AUTH"
+fi
+
+echo "HOSTKEY=$(ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub | awk '{ print $2 }')"
+`;
+/**
+* What runs as root to give a fresh server its admin — the guide's first
+* step, for a server only root can log in to yet: a sudo user, with root's
+* keys so the same key logs in. `adduser` asks for its password, which sudo
+* will ask for.
+*/
+const ADMIN_SCRIPT = `set -euo pipefail
+ADMIN="$1"
+if ! id "$ADMIN" >/dev/null 2>&1; then
+	echo "   creating $ADMIN — choose the password sudo will ask for:"
+	adduser --gecos "" "$ADMIN"
+fi
+usermod -aG sudo "$ADMIN"
+HOME_DIR="$(getent passwd "$ADMIN" | cut -d: -f6)"
+install -d -m 700 -o "$ADMIN" -g "$ADMIN" "$HOME_DIR/.ssh"
+AUTH="$HOME_DIR/.ssh/authorized_keys"
+touch "$AUTH"
+# The keys alone: a provider's options on root's lines (a command="…" that
+# says "log in as ubuntu") would stop the admin's login too. A server root
+# logs in to with a password has none; ssh-copy-id brings the admin's.
+{ grep -oE '(ssh|ecdsa|sk)-[^ ]+ [A-Za-z0-9+/=]+( .*)?$' /root/.ssh/authorized_keys 2>/dev/null || true; } |
+	while IFS= read -r key; do
+		grep -qxF "$key" "$AUTH" || echo "$key" >> "$AUTH"
+	done
+chown "$ADMIN:$ADMIN" "$AUTH"
+chmod 600 "$AUTH"
+echo "   $ADMIN is a sudo user, with root's SSH keys (if root had any)"
+`;
+//#endregion
+//#region src/compose/serverSetup.ts
+/**
+* `gkm compose:server` — make a VPS ready for a stage's compose deploys, from
+* this machine, in one go.
+*
+* It logs in as the server's admin — a sudo user, never root — and, through
+* sudo, sets the server up the way a production VPS should be: SSH by key
+* only with root's login off, a firewall open on SSH, 80 and 443 alone,
+* security updates installed daily, fail2ban on sshd, and Docker from
+* Docker's own repository. It then creates the stage's deploy user (in the
+* docker group, no sudo, no password) and authorizes a deploy key on it that
+* may run commands and open the tunnel migrations use, nothing more.
+*
+* Off the server: it makes the deploy key pair here, pins the server's host
+* key — checked against the fingerprint the server reports of itself — and
+* gives both to the stage's GitHub environment as `DEPLOY_SSH_KEY` and
+* `DEPLOY_KNOWN_HOSTS`, which the generated deploy workflow reads. Last, it
+* logs in exactly as CI will, and checks Docker and the tunnel answer.
+*
+* A fresh server only root can log in to gets its admin first: as root —
+* with root's key, or its password on a brand-new server — it creates the
+* user, and `ssh-copy-id` puts your key on it when root had none to give.
+* Root's password is locked once the admin's sudo works.
+*
+* Once it has, the stage's state records that it is done (`server:compose`,
+* stamped with who and when) — nothing personal: the admin is whoever runs
+* it, with their own key.
+* Safe to run again: each step changes only what is missing or wrong.
+*/
+/** The stage's record of its server, as `compose:server` last set it up. */
+const SERVER_RECORD = "server:compose";
+/** The admin named is root, whose login this command turns off. */
+var ComposeServerAdminIsRoot = class extends require_errors.GkmError {
+	constructor() {
+		super("The admin can't be root: setting up the server turns root's SSH login off. Name the sudo user you log in as (--admin <user>). A fresh server with only root gets one: run this again with the name it should have, and gkm offers to create it with root's key.");
+		this.name = "ComposeServerAdminIsRoot";
+	}
+};
+/** The admin named is the deploy user, which has no sudo. */
+var ComposeServerAdminIsDeployUser = class extends require_errors.GkmError {
+	user;
+	constructor(user) {
+		super(`'${user}' is the stage's deploy user (deploy.compose.server), which gkm creates without sudo. Name the sudo user you log in as with --admin.`);
+		this.user = user;
+		this.name = "ComposeServerAdminIsDeployUser";
+	}
+};
+/** No key logs the admin in, and nothing was done to make one. */
+var ComposeServerAdminUnreachable = class extends require_errors.GkmError {
+	target;
+	stderr;
+	constructor(target, stderr) {
+		super(`Could not log in as ${target} with a key (ssh said: ${stderr.trim() || "nothing"}). Check \`ssh ${target}\` works without a password — copy your key with \`ssh-copy-id ${target}\` — then run this again.`);
+		this.target = target;
+		this.stderr = stderr;
+		this.name = "ComposeServerAdminUnreachable";
+	}
+};
+/**
+* The server was set up already, and this person cannot log in to it as
+* the admin they named. Root's login and passwords are off there, so only
+* an admin can let them in.
+*/
+var ComposeServerAccessNeeded = class extends require_errors.GkmError {
+	target;
+	setUpBy;
+	setUpOn;
+	constructor(target, setUpBy, setUpOn) {
+		super(`${target} can't log in with your key, and the server was set up by ${setUpBy} on ${setUpOn} — root and password logins are off there. Ask them, or another admin, to add your public key to ${target.split("@")[0]}'s ~/.ssh/authorized_keys (or create you a sudo user with it), then run this again.`);
+		this.target = target;
+		this.setUpBy = setUpBy;
+		this.setUpOn = setUpOn;
+		this.name = "ComposeServerAccessNeeded";
+	}
+};
+/** `ssh-keygen` could not make the deploy key pair. */
+var DeployKeyNotMade = class extends require_errors.GkmError {
+	keyFile;
+	stderr;
+	constructor(keyFile, stderr) {
+		super(`Could not make the deploy key ${keyFile} (ssh-keygen said: ${stderr.trim() || "nothing"}). Pass another path with --key-file.`);
+		this.keyFile = keyFile;
+		this.stderr = stderr;
+		this.name = "DeployKeyNotMade";
+	}
+};
+/** The script on the server stopped before it finished. */
+var ComposeServerSetupFailed = class extends require_errors.GkmError {
+	target;
+	code;
+	constructor(target, code) {
+		super(`Setting up ${target} stopped (exit ${code}); its output is above. Fix what it names and run this again — every step it already finished is left as it is.`);
+		this.target = target;
+		this.code = code;
+		this.name = "ComposeServerSetupFailed";
+	}
+};
+/** The host key the network shows is not the one the server holds. */
+var ComposeServerHostKeyMismatch = class extends require_errors.GkmError {
+	host;
+	server;
+	scanned;
+	constructor(host, server, scanned) {
+		super(`${host}'s host key is ${server} on the server, but ${scanned || "nothing"} over the network. Something between here and the server answered for it, or the server is not the one you logged in to. Nothing was given to GitHub; find out why before running this again.`);
+		this.host = host;
+		this.server = server;
+		this.scanned = scanned;
+		this.name = "ComposeServerHostKeyMismatch";
+	}
+};
+/** The deploy key logged in, but cannot do what a deploy does. */
+var ComposeServerCheckFailed = class extends require_errors.GkmError {
+	target;
+	check;
+	output;
+	constructor(target, check, output) {
+		super(check === "docker" ? `The deploy key can't run docker as ${target} (ssh said: ${output.trim() || "nothing"}).` : `The deploy key can't open a tunnel as ${target} (got: ${output.trim() || "nothing"}). Check its line in the deploy user's authorized_keys says restrict,port-forwarding, and that sshd allows it forwarding.`);
+		this.target = target;
+		this.check = check;
+		this.output = output;
+		this.name = "ComposeServerCheckFailed";
+	}
+};
+/** `'…'`, for a value in a command line the remote shell reads. */
+function shellQuote(value) {
+	return `'${value.replaceAll("'", `'\\''`)}'`;
+}
+/**
+* The remote command that runs `script` with `args`: written to a temporary
+* file (so the script keeps the terminal for any password it asks), run,
+* and removed. `sudo` for everything but root.
+*/
+function remoteCommand(script, args, sudo) {
+	return [
+		`f="$(mktemp)"`,
+		`echo ${Buffer.from(script).toString("base64")} | base64 -d > "$f"`,
+		`${sudo ? "sudo " : ""}bash "$f" ${args.map(shellQuote).join(" ")}; s=$?`,
+		`rm -f "$f"`,
+		"exit $s"
+	].join("; ");
+}
+function sshOptions(server) {
+	return [
+		"-o",
+		"ConnectTimeout=20",
+		"-p",
+		String(server.port)
+	];
+}
+/** How the admin (or root) logs in: the server's options and their key. */
+function loginOptions(server, identity) {
+	return [...sshOptions(server), ...identity ? [
+		"-i",
+		identity,
+		"-o",
+		"IdentitiesOnly=yes"
+	] : []];
+}
+/** `user@host`, as `ssh` takes it. */
+function at(user, host) {
+	return `${user}@${host}`;
+}
+/** The real runner: the system's programs. */
+const systemRunner = (command, args, options = {}) => new Promise((resolve, reject) => {
+	const child = (0, node_child_process.spawn)(command, args, {
+		stdio: [
+			options.interactive ? "inherit" : "pipe",
+			"pipe",
+			options.interactive ? "inherit" : "pipe"
+		],
+		timeout: options.interactive ? void 0 : 6e4
+	});
+	let stdout = "";
+	let stderr = "";
+	child.stdout?.on("data", (chunk) => {
+		stdout += chunk.toString();
+		if (options.interactive) process.stdout.write(chunk);
+	});
+	child.stderr?.on("data", (chunk) => {
+		stderr += chunk.toString();
+	});
+	child.on("error", reject);
+	child.on("close", (code) => resolve({
+		code: code ?? 1,
+		stdout,
+		stderr
+	}));
+	if (child.stdin) child.stdin.end(options.input ?? "");
+});
+/** Whether `answer` is a yes, `fallback` when nothing was typed. */
+function isYes(answer, fallback) {
+	const value = answer.trim().toLowerCase();
+	return value === "" ? fallback : value === "y" || value === "yes";
+}
+/** The SHA256 fingerprint of each key in `keys`, by `ssh-keygen -lf -`. */
+async function fingerprints(run, keys) {
+	const { stdout } = await run("ssh-keygen", ["-lf", "-"], { input: keys });
+	return stdout.split("\n").map((line) => line.split(" ")[1]).filter((value) => Boolean(value));
+}
+/** The default deploy key pair for a stage. */
+function defaultKeyFile(project, stage) {
+	return (0, node_path.join)((0, node_os.homedir)(), ".ssh", `gkm-${project}-${stage}`);
+}
+/** `gkm compose:server`. */
+async function composeServerCommand(options, deps = {}) {
+	const run = deps.run ?? systemRunner;
+	const gh = deps.gh ?? require_github.ghCli;
+	const ask = deps.ask ?? ((question) => require_index.prompt(question, { instead: "Name the server user with --admin and pass --yes." }));
+	const github = options.github !== false;
+	const { stage } = options;
+	const cwd = (0, node_path.resolve)(options.cwd ?? process.cwd());
+	const { workspace } = await require_config.loadWorkspaceConfig(cwd);
+	require_workspace.assertDeployedStage(workspace.stages, stage);
+	const server = require_compose.composeServer({
+		stage,
+		local: false,
+		config: workspace.deploy?.compose?.server,
+		custom: (await (await require_seeds.secretsStoreFor(workspace, stage)).read(stage))?.custom
+	});
+	const state = deps.state ?? await require_sniffer.createStateStore({
+		config: workspace.state,
+		workspaceRoot: workspace.root,
+		workspaceName: workspace.name,
+		namespace: workspace.deploy?.namespace
+	});
+	const record = (await state.read(stage))?.resources[SERVER_RECORD];
+	const done = (record?.data)?.host === server.host ? record : void 0;
+	const identity = options.identity ? (0, node_path.resolve)(options.identity) : void 0;
+	const asAdmin = loginOptions(server, identity);
+	const sshUser = (await run("ssh", [
+		"-G",
+		...asAdmin,
+		server.host
+	])).stdout.match(/^user (\S+)$/m)?.[1] ?? "";
+	const admin = (options.admin ?? (sshUser && sshUser !== "root" ? sshUser : await ask(`The sudo user you log in to ${server.host} as (not root): `))).trim();
+	if (!admin || admin === "root") throw new ComposeServerAdminIsRoot();
+	if (admin === server.user) throw new ComposeServerAdminIsDeployUser(admin);
+	const keyFile = (0, node_path.resolve)(options.keyFile ?? defaultKeyFile(workspace.name, stage));
+	const comment = `gkm-${workspace.name}-${stage}-deploy`;
+	const repo = github ? options.repo ?? gh([
+		"repo",
+		"view",
+		"--json",
+		"nameWithOwner",
+		"-q",
+		".nameWithOwner"
+	]) : void 0;
+	const adminTarget = at(admin, server.host);
+	const deployTarget = at(server.user, server.host);
+	console.log(`\n🖥  Server for stage "${stage}"\n`);
+	console.log(`  Server:      ${server.host} (ssh port ${server.port})`);
+	console.log(`  Admin:       ${admin} — logs in with ${identity ?? "your SSH key"}, runs sudo${options.admin ? "" : " (your SSH login)"}`);
+	console.log(`  Deploy user: ${server.user} — docker group, no sudo, no password`);
+	console.log(`  Deploy key:  ${keyFile}${(0, node_fs.existsSync)(keyFile) ? "" : " (new, made here)"}`);
+	console.log(`  GitHub:      ${repo ? `environment "${stage}" of ${repo}: DEPLOY_SSH_KEY, DEPLOY_KNOWN_HOSTS` : "left alone (--no-github)"}`);
+	if (done) console.log(`\n  Already set up by ${require_seeds.describeActor(done.updatedBy)} on ${done.updatedAt.slice(0, 10)}; running again changes only what is missing or wrong.`);
+	console.log("\n  On the server, through sudo:");
+	for (const step of [
+		"SSH: keys only, root's login off (and nothing else may turn passwords back on)",
+		`root's password locked — ${admin}'s sudo is the way to root`,
+		`firewall: ${server.port}, 80 and 443 in, everything out`,
+		"security updates installed daily (unattended-upgrades); fail2ban on sshd",
+		"Docker and its compose plugin, from Docker's repository",
+		`user ${server.user}, the deploy key authorized with restrict,port-forwarding`
+	]) console.log(`    · ${step}`);
+	if (options.dryRun) {
+		console.log(`\n  The script, run as: sudo bash setup.sh ${[
+			admin,
+			server.user,
+			String(server.port),
+			"<deploy key>",
+			comment
+		].map(shellQuote).join(" ")}\n`);
+		console.log(SERVER_SCRIPT.replace(/^/gm, "    "));
+		console.log("  --dry-run: nothing changed.\n");
+		return {
+			server,
+			admin,
+			keyFile,
+			...repo ? { repo } : {}
+		};
+	}
+	if (!options.yes && !isYes(await ask(`\n  Set up ${server.host}? [y/N] `), false)) {
+		console.log("  Nothing changed.\n");
+		return {
+			server,
+			admin,
+			keyFile,
+			...repo ? { repo } : {}
+		};
+	}
+	if (!(0, node_fs.existsSync)(keyFile)) {
+		await (0, node_fs_promises.mkdir)((0, node_path.dirname)(keyFile), {
+			recursive: true,
+			mode: 448
+		});
+		const made = await run("ssh-keygen", [
+			"-t",
+			"ed25519",
+			"-N",
+			"",
+			"-C",
+			comment,
+			"-f",
+			keyFile
+		]);
+		if (made.code !== 0) throw new DeployKeyNotMade(keyFile, made.stderr);
+		console.log(`\n  ✓ Made the deploy key ${keyFile}`);
+	}
+	const publicKey = (await (0, node_fs_promises.readFile)(`${keyFile}.pub`, "utf-8")).trim();
+	const probe = (user) => run("ssh", [
+		"-o",
+		"BatchMode=yes",
+		"-o",
+		"StrictHostKeyChecking=accept-new",
+		...asAdmin,
+		at(user, server.host),
+		"true"
+	]);
+	let login = await probe(admin);
+	if (login.code !== 0 && done) throw new ComposeServerAccessNeeded(adminTarget, require_seeds.describeActor(done.updatedBy), done.updatedAt.slice(0, 10));
+	if (login.code !== 0) {
+		const rootHasKey = (await probe("root")).code === 0;
+		if (isYes(await ask(rootHasKey ? `\n  ${admin} can't log in with a key, but root can. Create ${admin} as a sudo user with root's keys? [Y/n] ` : `\n  ${admin} can't log in with a key. Is this a new server, where ${admin} still has to be created? Log in as root with its password to create it [y/N] `), rootHasKey)) {
+			const created = await run("ssh", [
+				"-t",
+				...asAdmin,
+				at("root", server.host),
+				remoteCommand(ADMIN_SCRIPT, [admin], false)
+			], { interactive: true });
+			if (created.code !== 0) throw new ComposeServerSetupFailed(at("root", server.host), created.code);
+			login = await probe(admin);
+		}
+		if (login.code !== 0 && isYes(await ask(`\n  ${admin} can't log in with a key. Copy yours there with ssh-copy-id (asks ${admin}'s password)? [Y/n] `), true)) {
+			const copied = await run("ssh-copy-id", [
+				...identity ? ["-i", identity] : [],
+				"-p",
+				String(server.port),
+				adminTarget
+			], { interactive: true });
+			if (copied.code !== 0) throw new ComposeServerAdminUnreachable(adminTarget, copied.stderr);
+		}
+		login = await probe(admin);
+		if (login.code !== 0) throw new ComposeServerAdminUnreachable(adminTarget, login.stderr);
+	}
+	console.log(`  ✓ ${adminTarget} logs in with a key\n`);
+	const setup = await run("ssh", [
+		"-t",
+		...asAdmin,
+		adminTarget,
+		remoteCommand(SERVER_SCRIPT, [
+			admin,
+			server.user,
+			String(server.port),
+			publicKey,
+			comment
+		], true)
+	], { interactive: true });
+	if (setup.code !== 0) throw new ComposeServerSetupFailed(adminTarget, setup.code);
+	const serverFingerprint = setup.stdout.replaceAll("\r", "").match(/^HOSTKEY=(\S+)$/m)?.[1];
+	if (!serverFingerprint) throw new ComposeServerSetupFailed(adminTarget, setup.code);
+	const knownHosts = (await run("ssh-keyscan", [
+		"-t",
+		"ed25519",
+		"-p",
+		String(server.port),
+		server.host
+	])).stdout.split("\n").filter((line) => line.trim() && !line.startsWith("#")).join("\n");
+	const [scanned = ""] = await fingerprints(run, knownHosts);
+	if (scanned !== serverFingerprint) throw new ComposeServerHostKeyMismatch(server.host, serverFingerprint, scanned);
+	console.log(`\n  ✓ Host key ${scanned}, as the server reports it`);
+	if (repo) {
+		gh([
+			"api",
+			"--method",
+			"PUT",
+			`repos/${repo}/environments/${stage}`
+		]);
+		gh([
+			"variable",
+			"set",
+			"DEPLOY_KNOWN_HOSTS",
+			"--env",
+			stage,
+			"--repo",
+			repo,
+			"--body",
+			knownHosts
+		]);
+		gh([
+			"secret",
+			"set",
+			"DEPLOY_SSH_KEY",
+			"--env",
+			stage,
+			"--repo",
+			repo
+		], await (0, node_fs_promises.readFile)(keyFile, "utf-8"));
+		console.log(`  ✓ GitHub: environment "${stage}", DEPLOY_SSH_KEY and DEPLOY_KNOWN_HOSTS`);
+	}
+	const known = (0, node_path.join)((0, node_path.dirname)(keyFile), `.gkm-known-${workspace.name}-${stage}`);
+	await (0, node_fs_promises.writeFile)(known, `${knownHosts}\n`);
+	try {
+		const asCi = [
+			"-i",
+			keyFile,
+			"-o",
+			"IdentitiesOnly=yes",
+			"-o",
+			"BatchMode=yes",
+			"-o",
+			`UserKnownHostsFile=${known}`,
+			"-o",
+			"StrictHostKeyChecking=yes",
+			...sshOptions(server)
+		];
+		const docker = await run("ssh", [
+			...asCi,
+			deployTarget,
+			"docker",
+			"version",
+			"--format",
+			"{{.Server.Version}}"
+		]);
+		if (docker.code !== 0) throw new ComposeServerCheckFailed(deployTarget, "docker", docker.stderr);
+		console.log(`  ✓ ${deployTarget} runs docker (engine ${docker.stdout.trim()})`);
+		const tunnel = await run("ssh", [
+			...asCi,
+			"-W",
+			`127.0.0.1:${server.port}`,
+			deployTarget
+		]);
+		if (!tunnel.stdout.startsWith("SSH-2.0")) throw new ComposeServerCheckFailed(deployTarget, "tunnel", tunnel.stdout.slice(0, 80) || tunnel.stderr);
+		console.log(`  ✓ ${deployTarget} opens tunnels (migrations)`);
+	} finally {
+		await (0, node_fs_promises.rm)(known, { force: true });
+	}
+	await (await require_seeds.DeployJournal.open(state, stage, () => require_seeds.createComposeState(stage))).ready({
+		key: SERVER_RECORD,
+		type: "server",
+		data: { host: server.host }
+	}, server.host);
+	console.log(`  ✓ Recorded in the "${stage}" state`);
+	console.log(`\n✅ ${server.host} is ready for "${stage}".${repo ? " CI deploys it with the key it was given." : ""} To deploy from here, load the key first: ssh-add ${keyFile}\n`);
+	return {
+		server,
+		admin,
+		keyFile,
+		knownHosts,
+		...repo ? { repo } : {}
+	};
+}
+//#endregion
+exports.composeServerCommand = composeServerCommand;
+
+//# sourceMappingURL=serverSetup-CKs4K9gD.cjs.map