@kvbox/server 0.0.0-stage → 0.5.6

package/package.json

@@ -1,6 +1,50 @@
 {
   "name": "@kvbox/server",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.5.6",
+  "description": "kvbox host daemon: owns Firecracker microVMs on a Linux host and serves the kvbox API. Managed with the @kvbox/cli CLI.",
+  "type": "module",
+  "license": "MIT",
+  "bin": {
+    "kvbox-server": "dist/kvbox-server.js"
+  },
+  "files": [
+    "dist",
+    "scripts"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/ghalex/kvbox.git",
+    "directory": "packages/server"
+  },
+  "homepage": "https://kvbox.sh",
+  "keywords": [
+    "firecracker",
+    "microvm",
+    "sandbox",
+    "vm",
+    "server"
+  ],
+  "os": [
+    "linux"
+  ],
+  "engines": {
+    "node": ">=22.13"
+  },
+  "scripts": {
+    "dev": "tsx src/index.ts",
+    "build": "tsup"
+  },
+  "dependencies": {
+    "@hono/node-server": "^2.1.5",
+    "commander": "^15.0.0",
+    "hono": "^4.13.13",
+    "undici": "^8.12.3",
+    "zod": "^4.6.7"
+  },
+  "devDependencies": {
+    "@kvbox/shared": "workspace:*"
+  }
+}

package/scripts/net-setup.sh

@@ -0,0 +1,318 @@
+#!/usr/bin/env bash
+# Host networking for kvbox: bridge kvbox0 (172.30.0.1/24), IP forwarding, NAT to the
+# default route, and FORWARD accept rules for the bridge (Docker sets FORWARD's policy
+# to DROP, so NAT alone is not enough). Needs root; re-execs itself with sudo.
+# Idempotent. The bridge and the rules vanish on host reboot, so this runs from
+# install-server.sh once and from kvbox-server at start whenever the bridge is missing.
+#
+#   net-setup.sh [up]            create/repair everything
+#   net-setup.sh down            remove the rules and the bridge (detaches any taps still on it)
+#   net-setup.sh status          show what is in place; exit 1 if anything is missing
+#   net-setup.sh tap add <name>           create tap <name> owned by the calling user, plugged into the bridge
+#   net-setup.sh tap add <name> detached  the same, but up and not plugged in yet (a restored box keeps
+#                                         its old addresses until kvbox-agent changes them)
+#   net-setup.sh tap attach <name>        plug a detached tap into the bridge
+#   net-setup.sh tap del <name>           delete it
+#   net-setup.sh proxy add <box-id> <box-ip> <host-port> <guest-port> [tcp|udp]
+#                                         port <host-port> on this host's public side reaches <box-ip>:<guest-port>
+#                                         (DNAT + forward accept, rules tagged kvbox:<box-id>; tcp by default)
+#   net-setup.sh proxy rm  <box-id> <box-ip> <host-port> <guest-port> [tcp|udp]   remove exactly that
+#   net-setup.sh relay up <conf> [port]   install <conf> (written by kvbox-server relay) as /etc/wireguard/kvbox.conf,
+#                                         keep the tunnel to the relay up, now and after reboots (wg-quick@kvbox), and
+#                                         let the control plane's HTTPS port (default 7777) in on the tunnel interface
+#                                         (a host firewall such as ufw would otherwise drop it; box ports are forwarded)
+#   net-setup.sh relay down               take the tunnel down and remove the conf
+#   net-setup.sh relay status             is the tunnel up, when did the relay last answer
+#
+#   KVBOX_BRIDGE   (default kvbox0)         KVBOX_SUBNET  (default 172.30.0.0/24)
+#   KVBOX_GATEWAY  (default 172.30.0.1)     the host's address on the bridge
+set -euo pipefail
+
+BRIDGE="${KVBOX_BRIDGE:-kvbox0}"
+SUBNET="${KVBOX_SUBNET:-172.30.0.0/24}"
+GATEWAY="${KVBOX_GATEWAY:-172.30.0.1}"
+PREFIX="${SUBNET#*/}"
+TAG="kvbox:$BRIDGE"   # iptables comment; `down` finds our rules by it
+action="${1:-up}"
+tap_op="${2:-}"; tap_name="${3:-}"; tap_mode="${4:-}"
+px_op="${2:-}"; px_box="${3:-}"; px_ip="${4:-}"; px_hport="${5:-}"; px_gport="${6:-}"; px_proto="${7:-tcp}"
+relay_op="${2:-}"; relay_conf="${3:-}"; relay_port="${4:-7777}"
+RELAY_IF=kvbox   # wg-quick@kvbox reads /etc/wireguard/kvbox.conf
+
+if [[ -t 1 ]]; then GREEN=$'\033[0;32m'; RED=$'\033[0;31m'; DIM=$'\033[2m'; NC=$'\033[0m'; else GREEN=""; RED=""; DIM=""; NC=""; fi
+ok()   { printf '%s✓%s %s\n' "$GREEN" "$NC" "$*"; }
+skip() { printf '%s–%s %s\n' "$DIM" "$NC" "$*"; }
+fail() { printf '%s✗%s %s\n' "$RED" "$NC" "$*" >&2; exit 1; }
+
+case "$action" in
+  up|down|status) ;;
+  tap) [[ "$tap_op" =~ ^(add|attach|del)$ && "$tap_name" =~ ^[a-z0-9][a-z0-9._-]{0,14}$ && "$tap_mode" =~ ^(|detached)$ ]] \
+         || fail "usage: $0 tap add <name> [detached] | tap attach <name> | tap del <name>  (name: up to 15 chars, [a-z0-9._-])" ;;
+  proxy) [[ "$px_op" =~ ^(add|rm)$ && "$px_box" =~ ^[a-z0-9][a-z0-9._-]{0,14}$ && "$px_ip" =~ ^[0-9]{1,3}(\.[0-9]{1,3}){3}$ \
+            && "$px_hport" =~ ^[0-9]{1,5}$ && "$px_gport" =~ ^[0-9]{1,5}$ && "$px_hport" -ne 22 && "$px_proto" =~ ^(tcp|udp)$ ]] \
+           || fail "usage: $0 proxy add|rm <box-id> <box-ip> <host-port> <guest-port> [tcp|udp]  (host port is never 22)" ;;
+  relay) if [[ ! "$relay_op" =~ ^(up|down|status)$ ]] || { [[ "$relay_op" == up ]] && [[ -z "$relay_conf" ]]; } || [[ ! "$relay_port" =~ ^[0-9]{1,5}$ ]]; then
+           fail "usage: $0 relay up <conf> [port] | relay down | relay status"
+         fi ;;
+  *) fail "usage: $0 [up|down|status|tap add|attach|del <name>|proxy add|rm ...|relay up|down|status]" ;;
+esac
+for bin in ip iptables sysctl; do command -v "$bin" >/dev/null 2>&1 || fail "$bin not found"; done
+if [[ "$action" == relay ]]; then
+  # The conf is read before sudo drops the caller's view of its home: resolve it while we are still that user.
+  [[ "$relay_op" != up ]] || [[ -r "$relay_conf" ]] || fail "cannot read $relay_conf"
+  [[ "$relay_op" != up ]] || relay_conf="$(readlink -f "$relay_conf")"
+  command -v wg-quick >/dev/null 2>&1 || fail "WireGuard is not installed on this host (apt install wireguard-tools), so it cannot use a relay"
+  command -v systemctl >/dev/null 2>&1 || fail "systemd is needed to keep the relay tunnel up across reboots"
+fi
+if [[ $EUID -ne 0 ]]; then
+  # From a terminal sudo may prompt; from kvbox-server (no tty) it must not hang.
+  # KVBOX_TAP_USER tells the root side who should own a new tap (Firecracker runs as that user).
+  export KVBOX_TAP_USER="${KVBOX_TAP_USER:-$(id -un)}"
+  if [[ -t 0 ]]; then exec sudo --preserve-env=KVBOX_TAP_USER,KVBOX_BRIDGE,KVBOX_SUBNET,KVBOX_GATEWAY "$0" "$@"; fi
+  exec sudo -n --preserve-env=KVBOX_TAP_USER,KVBOX_BRIDGE,KVBOX_SUBNET,KVBOX_GATEWAY "$0" "$@"
+fi
+if [[ "$action" == proxy ]]; then
+  command -v iptables-save >/dev/null 2>&1 || fail "iptables-save not found"
+fi
+
+# ── rule set ─────────────────────────────────────────────────────────────────
+# RULE_DESC[i] is what we tell the user; RULE_SPEC[i] is "<table> <chain> <rule...>".
+# Added with -I (ahead of Docker's chains), checked with -C, found again by the comment tag.
+RULE_DESC=(
+  "NAT: boxes reach the internet using this host's address"
+  "firewall: traffic from boxes may leave through $BRIDGE"
+  "firewall: replies may come back to boxes"
+)
+RULE_SPEC=(
+  "nat POSTROUTING -s $SUBNET ! -o $BRIDGE -m comment --comment $TAG -j MASQUERADE"
+  "filter FORWARD -i $BRIDGE -m comment --comment $TAG -j ACCEPT"
+  "filter FORWARD -o $BRIDGE -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment $TAG -j ACCEPT"
+)
+has_rule()  { local t=$1 c=$2; shift 2; iptables -t "$t" -C "$c" "$@" 2>/dev/null; }
+add_rule()  { local t=$1 c=$2; shift 2; iptables -t "$t" -I "$c" 1 "$@"; }
+del_rule()  { local t=$1 c=$2; shift 2; while iptables -t "$t" -C "$c" "$@" 2>/dev/null; do iptables -t "$t" -D "$c" "$@"; done; }
+
+bridge_exists() { [[ -d "/sys/class/net/$BRIDGE" ]]; }
+taps_on_bridge() { local t out=""; for t in "/sys/class/net/$BRIDGE/brif"/*; do [[ -e "$t" ]] && out+="${t##*/} "; done; printf '%s' "$out"; }
+bridge_has_ip() { ip -4 -o addr show dev "$BRIDGE" 2>/dev/null | grep -q " inet $GATEWAY/$PREFIX "; }
+# Administrative UP flag only: an empty bridge reports operstate "down" (NO-CARRIER) until a tap joins.
+bridge_is_up()  { ip link show "$BRIDGE" 2>/dev/null | head -1 | grep -q "[<,]UP[,>]"; }
+
+# ── up ───────────────────────────────────────────────────────────────────────
+do_up() {
+  if bridge_exists; then skip "bridge $BRIDGE already exists"; else ip link add "$BRIDGE" type bridge; ok "created bridge $BRIDGE (the virtual switch boxes plug into)"; fi
+  if bridge_has_ip; then skip "$BRIDGE already has address $GATEWAY"; else ip addr add "$GATEWAY/$PREFIX" dev "$BRIDGE"; ok "gave this host address $GATEWAY on $BRIDGE (boxes use it as their gateway)"; fi
+  if bridge_is_up; then skip "$BRIDGE is already up"; else ip link set "$BRIDGE" up; ok "brought $BRIDGE up"; fi
+  if [[ "$(sysctl -n net.ipv4.ip_forward)" == 1 ]]; then skip "IP forwarding already enabled"; else sysctl -q -w net.ipv4.ip_forward=1; ok "enabled IP forwarding (this host routes for the boxes)"; fi
+  local i
+  for i in "${!RULE_SPEC[@]}"; do
+    # shellcheck disable=SC2086  # the rule is a word list by design
+    if has_rule ${RULE_SPEC[$i]}; then skip "${RULE_DESC[$i]} (already set)"; else add_rule ${RULE_SPEC[$i]}; ok "${RULE_DESC[$i]}"; fi
+  done
+  echo
+  ok "host network ready: boxes get addresses in $SUBNET on $BRIDGE, gateway $GATEWAY, internet via NAT"
+}
+
+# ── down ─────────────────────────────────────────────────────────────────────
+do_down() {
+  local i
+  for i in "${!RULE_SPEC[@]}"; do
+    # shellcheck disable=SC2086
+    if has_rule ${RULE_SPEC[$i]}; then del_rule ${RULE_SPEC[$i]}; ok "removed: ${RULE_DESC[$i]}"; else skip "not set: ${RULE_DESC[$i]}"; fi
+  done
+  if bridge_exists; then
+    local taps; taps="$(taps_on_bridge)"
+    [[ -z "$taps" ]] || printf '! detaching taps still on %s: %s\n' "$BRIDGE" "$taps"
+    ip link del "$BRIDGE"; ok "deleted bridge $BRIDGE"
+  else
+    skip "bridge $BRIDGE does not exist"
+  fi
+  # IP forwarding is left as is: other software (Docker) relies on it too.
+  local n=0 t rule
+  while IFS=$'\t' read -r t rule; do
+    [[ -n "$rule" ]] || continue
+    # shellcheck disable=SC2086  # iptables-save wrote the rule as a word list
+    eval "iptables -t $t -D $rule" && n=$((n + 1))
+  done < <(proxy_rules)
+  if [[ $n -gt 0 ]]; then ok "removed $n box port forward rule(s)"; else skip "no box port forwards"; fi
+}
+
+# ── status ───────────────────────────────────────────────────────────────────
+do_status() {
+  local missing=0 i
+  bad() { printf '%s✗%s %s\n' "$RED" "$NC" "$*"; missing=1; }
+  if bridge_exists && bridge_has_ip && bridge_is_up; then ok "bridge $BRIDGE is up with address $GATEWAY/$PREFIX"
+  elif ! bridge_exists; then bad "bridge $BRIDGE does not exist"
+  elif ! bridge_has_ip; then bad "bridge $BRIDGE has no address $GATEWAY"
+  else bad "bridge $BRIDGE is down"; fi
+  if [[ "$(sysctl -n net.ipv4.ip_forward)" == 1 ]]; then ok "IP forwarding enabled"; else bad "IP forwarding disabled"; fi
+  for i in "${!RULE_SPEC[@]}"; do
+    # shellcheck disable=SC2086
+    if has_rule ${RULE_SPEC[$i]}; then ok "${RULE_DESC[$i]}"; else bad "missing: ${RULE_DESC[$i]}"; fi
+  done
+  local taps; taps="$(taps_on_bridge)"
+  if [[ -z "$taps" ]]; then skip "no boxes attached to $BRIDGE yet"; else ok "boxes attached to $BRIDGE: $taps"; fi
+  local fwds; fwds="$(proxy_summary)"
+  if [[ -z "$fwds" ]]; then skip "no box ports published on this host"; else ok "box ports published on this host:"; printf '%s\n' "$fwds"; fi
+  if [[ $missing -eq 0 ]]; then echo; ok "host network is ready"; else echo; printf '%s✗%s host network incomplete; run: kvbox-server net up\n' "$RED" "$NC"; fi
+  return $missing
+}
+
+# ── tap add|del ──────────────────────────────────────────────────────────────
+# One tap per box: a virtual cable with one end in the VM and the other plugged into the bridge.
+do_tap_add() {
+  local tap=$1 mode=${2:-} owner="${KVBOX_TAP_USER:-${SUDO_USER:-root}}"
+  bridge_exists || fail "bridge $BRIDGE does not exist; run: kvbox-server net up"
+  if [[ -d "/sys/class/net/$tap" ]]; then
+    skip "tap $tap already exists"
+  else
+    ip tuntap add dev "$tap" mode tap user "$owner"
+    ok "created tap $tap (owner $owner)"
+  fi
+  if [[ "$mode" == detached ]]; then
+    ip link set "$tap" up
+    ok "tap $tap is up, not plugged into $BRIDGE yet"
+  else
+    do_tap_attach "$tap"
+  fi
+}
+do_tap_attach() {
+  local tap=$1
+  [[ -d "/sys/class/net/$tap" ]] || fail "tap $tap does not exist"
+  ip link set "$tap" master "$BRIDGE" up
+  ok "tap $tap plugged into $BRIDGE"
+}
+do_tap_del() {
+  local tap=$1
+  if [[ -d "/sys/class/net/$tap" ]]; then ip link del "$tap"; ok "deleted tap $tap"; else skip "tap $tap does not exist"; fi
+}
+
+# ── proxy add|rm ─────────────────────────────────────────────────────────────
+# A box's port on the host's public side (#49: SSH; #30: anything). Three rules per forward, all
+# tagged kvbox:<box-id>: DNAT for traffic arriving from outside, DNAT for traffic the host itself
+# sends to its own address (so the forward works from the host too), and a FORWARD accept so the
+# new connection may enter the bridge (the base rules only let replies back in).
+proxy_specs() {
+  local ip=$2 hport=$3 gport=$4 proto=${5:-tcp} tag="kvbox:$1"
+  printf '%s\n' \
+    "nat PREROUTING ! -i $BRIDGE -p $proto --dport $hport -m comment --comment $tag -j DNAT --to-destination $ip:$gport" \
+    "nat OUTPUT -p $proto --dport $hport -m addrtype --dst-type LOCAL -m comment --comment $tag -j DNAT --to-destination $ip:$gport" \
+    "filter FORWARD -o $BRIDGE -d $ip -p $proto --dport $gport -m comment --comment $tag -j ACCEPT"
+}
+do_proxy_add() {
+  local spec added=0
+  while read -r spec; do
+    # shellcheck disable=SC2086
+    if ! has_rule $spec; then add_rule $spec; added=1; fi
+  done < <(proxy_specs "$@")
+  if [[ $added -eq 1 ]]; then ok "$5 port $3 on this host now reaches box $1's port $4"; else skip "$5 port $3 on this host already reaches box $1's port $4"; fi
+}
+do_proxy_rm() {
+  local spec removed=0
+  while read -r spec; do
+    # shellcheck disable=SC2086
+    if has_rule $spec; then del_rule $spec; removed=1; fi
+  done < <(proxy_specs "$@")
+  if [[ $removed -eq 1 ]]; then ok "$5 port $3 on this host no longer reaches box $1"; else skip "$5 port $3 on this host was not forwarding to box $1"; fi
+}
+# Every forward rule in place, as "<table>\t<rule without -A>", found by its kvbox:<box-id> tag
+# (the bridge's own rules carry kvbox:<bridge> and are not forwards).
+proxy_rules() {
+  local t
+  for t in nat filter; do
+    iptables-save -t "$t" 2>/dev/null | sed -n 's/^-A //p' | sed 's/--comment "\([^"]*\)"/--comment \1/' \
+      | grep -E -- "--comment kvbox:[a-z0-9._-]+( |$)" | grep -v -F -- "--comment $TAG " | sed "s/^/$t\t/" || true
+  done
+}
+# One line per published port: "port 31207 -> box a3f9c1 (172.30.0.2:22)".
+proxy_summary() {
+  proxy_rules | grep -F "PREROUTING" | sed -E 's/.*-p ([a-z]+) .*--dport ([0-9]+) .*--comment kvbox:([^ ]+) .*--to-destination ([0-9.:]+).*/  \1 port \2 -> box \3 (\4)/'
+}
+
+# ── relay up|down|status ─────────────────────────────────────────────────────
+# The host's end of the tunnel to its relay (#50). kvbox-server writes the wg-quick conf (private
+# key inside) under its state dir; root copies it to /etc/wireguard and lets systemd keep the tunnel
+# up. Nothing here knows the relay's rules: the relay forwards its public IP down to us, and SNATs,
+# so the only route we need is the relay's own tunnel address (in the conf's AllowedIPs).
+relay_unit="wg-quick@$RELAY_IF"
+relay_target="/etc/wireguard/$RELAY_IF.conf"
+# Only the control plane's calls arrive for this host itself; box ports are DNAT'd and go through
+# FORWARD, where the bridge rules already let them in ahead of any firewall chain.
+relay_input_spec() { printf '%s' "filter INPUT -i $RELAY_IF -p tcp --dport $1 -m comment --comment kvbox:relay -j ACCEPT"; }
+relay_input_rules() { iptables-save -t filter 2>/dev/null | sed -n 's/^-A //p' | sed 's/--comment "\([^"]*\)"/--comment \1/' | grep -F -- "--comment kvbox:relay " || true; }
+do_relay_up() {
+  local src=$1 port=$2
+  install -d -m 0700 /etc/wireguard
+  if [[ -f "$relay_target" ]] && cmp -s "$src" "$relay_target"; then
+    skip "tunnel conf already installed"
+  else
+    install -m 0600 -o root -g root "$src" "$relay_target"
+    ok "installed the tunnel conf as $relay_target (root only)"
+  fi
+  if systemctl is-active --quiet "$relay_unit"; then
+    # Re-read the conf without dropping the tunnel: a changed relay key or endpoint takes effect now.
+    if wg syncconf "$RELAY_IF" <(wg-quick strip "$RELAY_IF") 2>/dev/null; then ok "tunnel $RELAY_IF reloaded"; else systemctl restart "$relay_unit"; ok "tunnel $RELAY_IF restarted"; fi
+  else
+    systemctl enable --now "$relay_unit" >/dev/null 2>&1 || fail "could not bring the tunnel up (journalctl -u $relay_unit)"
+    ok "tunnel $RELAY_IF is up and comes back after a reboot"
+  fi
+  local spec; spec="$(relay_input_spec "$port")"
+  # shellcheck disable=SC2086  # the rule is a word list by design
+  if has_rule $spec; then skip "the control plane may already reach port $port through the tunnel"; else add_rule $spec; ok "firewall: the control plane may reach port $port through the tunnel"; fi
+  # A rule for another port from an earlier `relay up` would stay open for nothing.
+  local rule
+  while IFS= read -r rule; do
+    [[ -n "$rule" ]] || continue
+    [[ "$rule" == *"--dport $port "* ]] && continue
+    # shellcheck disable=SC2086  # iptables-save wrote the rule as a word list
+    eval "iptables -t filter -D $rule" && ok "firewall: closed the tunnel's old port $(sed -E 's/.*--dport ([0-9]+) .*/\1/' <<<"$rule")"
+  done < <(relay_input_rules)
+}
+do_relay_down() {
+  local rule n=0
+  while IFS= read -r rule; do
+    [[ -n "$rule" ]] || continue
+    # shellcheck disable=SC2086
+    eval "iptables -t filter -D $rule" && n=$((n + 1))
+  done < <(relay_input_rules)
+  if [[ $n -gt 0 ]]; then ok "firewall: the tunnel's port is closed again"; fi
+  if systemctl is-enabled --quiet "$relay_unit" 2>/dev/null || systemctl is-active --quiet "$relay_unit"; then
+    systemctl disable --now "$relay_unit" >/dev/null 2>&1 || true
+    ok "tunnel $RELAY_IF is down"
+  else
+    skip "tunnel $RELAY_IF was not up"
+  fi
+  if [[ -f "$relay_target" ]]; then rm -f "$relay_target"; ok "removed $relay_target"; else skip "no tunnel conf installed"; fi
+}
+do_relay_status() {
+  [[ -f "$relay_target" ]] || { skip "no relay tunnel configured on this host"; return 1; }
+  if ! systemctl is-active --quiet "$relay_unit"; then printf '%s✗%s tunnel %s is down (journalctl -u %s)\n' "$RED" "$NC" "$RELAY_IF" "$relay_unit"; return 1; fi
+  local hs; hs="$(wg show "$RELAY_IF" latest-handshakes 2>/dev/null | awk '{print $2}' | head -1)"
+  if [[ -z "$hs" || "$hs" == 0 ]]; then
+    printf '%s!%s tunnel %s is up but the relay has not answered yet\n' "$RED" "$NC" "$RELAY_IF"; return 1
+  fi
+  ok "tunnel $RELAY_IF is up; the relay last answered $(( $(date +%s) - hs )) s ago"
+  local rules; rules="$(relay_input_rules)"
+  if [[ -z "$rules" ]]; then printf '%s✗%s the control plane cannot reach this host through the tunnel (no firewall rule); rerun kvbox server relay\n' "$RED" "$NC"; return 1; fi
+  ok "firewall: the control plane may reach port $(sed -E 's/.*--dport ([0-9]+) .*/\1/' <<<"$rules" | head -1) through the tunnel"
+}
+
+case "$action" in
+  up) do_up ;;
+  down) do_down ;;
+  status) do_status ;;
+  tap) case "$tap_op" in
+         add) do_tap_add "$tap_name" "$tap_mode" ;;
+         attach) do_tap_attach "$tap_name" ;;
+         del) do_tap_del "$tap_name" ;;
+       esac ;;
+  proxy) case "$px_op" in
+           add) do_proxy_add "$px_box" "$px_ip" "$px_hport" "$px_gport" "$px_proto" ;;
+           rm) do_proxy_rm "$px_box" "$px_ip" "$px_hport" "$px_gport" "$px_proto" ;;
+         esac ;;
+  relay) case "$relay_op" in
+           up) do_relay_up "$relay_conf" "$relay_port" ;;
+           down) do_relay_down ;;
+           status) do_relay_status ;;
+         esac ;;
+esac

package/README.md

@@ -1,3 +0,0 @@
-# Temporary Holding Version
-
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.