@lamalibre/create-lamaste 4.0.0

package/vendor/docs/03-architecture/e2e-three-vm-sequences.md

@@ -0,0 +1,457 @@
+# Three-VM E2E Test — Sequence Diagrams
+
+## Orchestration Flow
+
+```mermaid
+sequenceDiagram
+    participant Mac as macOS (Developer)
+    participant H as Host VM
+    participant A as Agent VM
+    participant V as Visitor VM
+
+    rect rgb(40, 40, 60)
+    note over Mac: Phase 1 — Create VMs
+    Mac->>H: multipass launch 24.04
+    Mac->>A: multipass launch 24.04
+    Mac->>V: multipass launch 24.04
+    end
+
+    rect rgb(40, 60, 40)
+    note over Mac,H: Phase 2 — Setup
+    Mac->>Mac: npm pack create-lamaste
+    Mac->>H: transfer tarball
+    Mac->>H: npm install -g + create-lamaste --dev
+    Mac->>H: transfer test scripts
+    Mac->>A: transfer test scripts
+    Mac->>V: transfer test scripts
+    Mac->>H: setup-host.sh (dnsmasq, certbot shim, onboarding, test user, agent cert)
+    H-->>Mac: credentials JSON
+    Mac->>H: extract agent P12
+    H-->>Mac: client.p12
+    Mac->>A: transfer agent P12
+    Mac->>A: setup-agent.sh (/etc/hosts, chisel, extract PEM certs)
+    Mac->>V: setup-visitor.sh (curl, jq, oathtool, /etc/hosts)
+    end
+
+    rect rgb(60, 40, 40)
+    note over Mac,H: Phase 3 — Single-VM E2E
+    Mac->>H: run-all.sh (inside host)
+    H-->>Mac: test results + logs
+    end
+
+    rect rgb(60, 60, 40)
+    note over Mac,V: Phase 4 — Three-VM E2E
+    Mac->>Mac: run-all.sh (from macOS, multipass exec into VMs)
+    Mac->>H: tests 01–08 (via multipass exec)
+    Mac->>A: tests 02–06 (via multipass exec)
+    Mac->>V: tests 04, 06–08 (via multipass exec)
+    end
+
+    rect rgb(40, 40, 40)
+    note over Mac: Phase 5 — Summary + Cleanup
+    Mac->>Mac: collect logs, print results
+    Mac-->>H: multipass delete (if --cleanup)
+    Mac-->>A: multipass delete (if --cleanup)
+    Mac-->>V: multipass delete (if --cleanup)
+    end
+```
+
+## Test 01 — Onboarding Complete Verification
+
+```mermaid
+sequenceDiagram
+    participant Mac as macOS (Test Runner)
+    participant H as Host VM
+    participant A as Agent VM
+    participant V as Visitor VM
+
+    Mac->>H: GET /api/onboarding/status (mTLS)
+    H-->>Mac: { status: COMPLETED }
+
+    Mac->>H: systemctl is-active nginx, chisel, authelia, lamalibre-lamaste-serverd
+    H-->>Mac: active (all 4 services)
+
+    Mac->>H: ls /etc/lamalibre/lamaste/pki/{ca.crt, client.crt, client.key}
+    H-->>Mac: files exist
+
+    Mac->>H: curl https://panel.TEST_DOMAIN (mTLS)
+    H-->>Mac: 200 OK (React app)
+
+    Mac->>H: dig TEST_DOMAIN @127.0.0.1
+    H-->>Mac: HOST_IP
+
+    Mac->>A: curl https://HOST_IP:9292 (no mTLS cert)
+    A-->>Mac: TLS handshake failure
+
+    Mac->>V: curl https://HOST_IP:9292 (no mTLS cert)
+    V-->>Mac: TLS handshake failure
+
+    Mac->>V: curl https://auth.TEST_DOMAIN/
+    V-->>Mac: 200 OK (Authelia portal)
+```
+
+## Test 02 — Tunnel Traffic
+
+```mermaid
+sequenceDiagram
+    participant Mac as macOS (Test Runner)
+    participant H as Host VM
+    participant A as Agent VM
+
+    note over Mac,H: Setup
+    Mac->>H: POST /api/tunnels {subdomain: e2etraffic, port: 18080, agentLabel: test-agent} (mTLS)
+    H-->>Mac: { id, fqdn: e2etraffic.TEST_DOMAIN, agentLabel: test-agent }
+    Mac->>H: GET /api/tunnels/agent-config?agent=test-agent (mTLS)
+    H-->>Mac: tunnels include e2etraffic:18080
+    Mac->>H: read chisel-users (grant only, no password printed)
+    H-->>Mac: agent-test-agent grants ^R:127\.0\.0\.1:18080$
+
+    Mac->>A: echo marker > /tmp/e2e-tunnel-index.html
+    Mac->>A: python3 -m http.server 18080 --bind 127.0.0.1 &
+    Mac->>A: lamaste-agent update (rewrites + restarts the chisel user unit)
+
+    note over Mac,A: Wait for tunnel
+    loop Poll up to 15s
+        Mac->>H: curl http://127.0.0.1:18080/
+        H-->>Mac: 200 (tunnel established)
+    end
+
+    note over Mac,H: Authenticate with Authelia
+    Mac->>H: POST /api/users/testuser/reset-totp (mTLS)
+    H-->>Mac: { otpauth URI, TOTP secret }
+    Mac->>Mac: oathtool --totp secret
+    Mac->>H: POST https://auth.TEST_DOMAIN/api/firstfactor
+    H-->>Mac: session cookie
+    Mac->>H: POST https://auth.TEST_DOMAIN/api/secondfactor/totp
+    H-->>Mac: authenticated session
+
+    note over Mac,H: Verify traffic
+    Mac->>H: curl http://127.0.0.1:18080/e2e-tunnel-index.html (direct)
+    H-->>Mac: 200 + marker content
+
+    Mac->>H: curl https://e2etraffic.TEST_DOMAIN/ -b session (via nginx)
+    H-->>Mac: 200 + marker content
+
+    note over Mac,A: Agent chisel client hygiene
+    Mac->>A: inspect unit + chisel.env + running argv
+    A-->>Mac: EnvironmentFile=chisel.env (0600), https://tunnel.TEST_DOMAIN:443, no --auth / password / --tls-skip-verify
+
+    note over Mac,H: Request body limit
+    Mac->>H: POST 2 MB body via nginx
+    H-->>Mac: not 413 (default limit 10 MB)
+    Mac->>H: POST 11 MB body via nginx
+    H-->>Mac: 413
+
+    note over Mac,A: Cleanup
+    Mac->>A: pkill python3
+    Mac->>H: DELETE /api/tunnels/{id} (mTLS)
+    Mac->>A: lamaste-agent update
+```
+
+## Test 03 — Tunnel Toggle
+
+```mermaid
+sequenceDiagram
+    participant Mac as macOS (Test Runner)
+    participant H as Host VM
+    participant A as Agent VM
+
+    Mac->>H: POST /api/tunnels {subdomain: e2etoggle, port: 18081, agentLabel: test-agent} (mTLS)
+    H-->>Mac: { id, fqdn, agentLabel: test-agent }
+
+    Mac->>A: start HTTP server + lamaste-agent update
+
+    note over Mac,H: Verify initial traffic
+    Mac->>H: curl http://127.0.0.1:18081/
+    H-->>Mac: 200 + marker
+
+    note over Mac,H: Disable tunnel
+    Mac->>H: PATCH /api/tunnels/{id} {enabled: false} (mTLS)
+    H-->>Mac: OK
+    Mac->>H: read chisel-users grants
+    H-->>Mac: test-agent no longer granted ^R:127\.0\.0\.1:18081$
+    Mac->>H: ls /etc/nginx/sites-enabled/lamalibre-lamaste-app-e2etoggle
+    H-->>Mac: not found (vhost symlink removed)
+    Mac->>H: curl https://FQDN/
+    H-->>Mac: marker NOT present
+
+    note over Mac,H: Re-enable tunnel
+    Mac->>H: PATCH /api/tunnels/{id} {enabled: true} (mTLS)
+    H-->>Mac: OK (grant restored)
+    Mac->>H: curl http://127.0.0.1:18081/
+    H-->>Mac: 200 + marker
+
+    note over Mac,H: Reassign to a second agent
+    Mac->>H: POST /api/certs/agent (second agent, no chisel client)
+    Mac->>H: PATCH /api/tunnels/{id} {agentLabel: <second agent>} (mTLS)
+    H-->>Mac: grant moved; test-agent's agent-config no longer lists the tunnel
+    Mac->>H: poll 127.0.0.1:18081 for 15s
+    H-->>Mac: stays closed (test-agent's client may no longer bind it)
+    Mac->>H: PATCH /api/tunnels/{id} {agentLabel: test-agent} (mTLS)
+    Mac->>A: lamaste-agent update
+    Mac->>H: curl http://127.0.0.1:18081/
+    H-->>Mac: 200 + marker
+
+    note over Mac,H: Authenticated access
+    Mac->>H: Authelia first + second factor
+    Mac->>H: curl https://FQDN/ -b session
+    H-->>Mac: 200 + marker
+
+    Mac->>A: pkill python3
+    Mac->>H: DELETE /api/tunnels/{id} (mTLS)
+```
+
+## Test 04 — Authelia Authentication (from Visitor)
+
+```mermaid
+sequenceDiagram
+    participant Mac as macOS (Test Runner)
+    participant H as Host VM
+    participant A as Agent VM
+    participant V as Visitor VM
+
+    note over Mac,A: Setup tunnel + HTTP server
+    Mac->>H: POST /api/tunnels {subdomain: e2eauth, port: 18082, agentLabel: test-agent} (mTLS)
+    Mac->>H: POST /api/users/testuser/reset-totp (mTLS)
+    H-->>Mac: TOTP secret
+    Mac->>A: start HTTP server + lamaste-agent update
+
+    note over Mac,V: Unauthenticated access
+    Mac->>V: curl https://FQDN/ (no session)
+    V->>H: HTTPS request (port 443)
+    H-->>V: 302 redirect → auth.TEST_DOMAIN
+    V-->>Mac: redirect URL contains auth.TEST_DOMAIN
+
+    note over Mac,V: Authenticate
+    Mac->>V: POST https://auth.TEST_DOMAIN/api/firstfactor
+    V->>H: username + password
+    H-->>V: session cookie
+    V-->>Mac: cookie saved
+
+    Mac->>V: oathtool --totp secret
+    Mac->>V: POST https://auth.TEST_DOMAIN/api/secondfactor/totp
+    V->>H: TOTP code + session
+    H-->>V: authenticated
+    V-->>Mac: OK
+
+    note over Mac,V: Authenticated access
+    Mac->>V: curl https://FQDN/ -b session
+    V->>H: request with Authelia session
+    H->>H: nginx forward auth → Authelia OK
+    H->>H: proxy to chisel → agent HTTP server
+    H-->>V: 200 + marker content
+    V-->>Mac: marker verified
+
+    note over Mac,V: Invalid session
+    Mac->>V: curl https://FQDN/ -b fake_cookie
+    V->>H: request with invalid session
+    H-->>V: 302/401 (rejected)
+    V-->>Mac: marker NOT present
+
+    Mac->>A: pkill python3
+    Mac->>H: DELETE /api/tunnels/{id}
+```
+
+## Test 05 — Admin Journey (Panel CRUD)
+
+```mermaid
+sequenceDiagram
+    participant Mac as macOS (Test Runner)
+    participant H as Host VM
+
+    note over Mac,H: Panel accessibility
+    Mac->>H: GET https://127.0.0.1:9292/ (mTLS)
+    H-->>Mac: 200 HTML with <div id="root">
+    Mac->>H: GET https://127.0.0.1:9292/ (NO mTLS)
+    H-->>Mac: TLS handshake failure
+
+    note over Mac,H: System endpoints
+    Mac->>H: GET /api/health (mTLS)
+    H-->>Mac: { status: ok }
+    Mac->>H: GET /api/system/stats (mTLS)
+    H-->>Mac: { cpu, memory, disk }
+
+    note over Mac,H: Tunnel CRUD
+    Mac->>H: POST /api/tunnels {subdomain, port, agentLabel: test-agent}
+    H-->>Mac: { id, agentLabel }
+    Mac->>H: GET /api/tunnels
+    H-->>Mac: tunnel in list
+    Mac->>H: PATCH /api/tunnels/{id} {enabled: false}
+    Mac->>H: PATCH /api/tunnels/{id} {enabled: true}
+    Mac->>H: DELETE /api/tunnels/{id}
+    Mac->>H: GET /api/tunnels
+    H-->>Mac: tunnel gone
+
+    note over Mac,H: User CRUD
+    Mac->>H: POST /api/users {username, password, ...}
+    H-->>Mac: created
+    Mac->>H: GET /api/users
+    H-->>Mac: user in list
+    Mac->>H: PUT /api/users/{username} {displayname}
+    Mac->>H: POST /api/users/{username}/reset-totp
+    H-->>Mac: { otpauth URI }
+    Mac->>H: DELETE /api/users/{username}
+
+    note over Mac,H: Services + Certs
+    Mac->>H: GET /api/services
+    H-->>Mac: [nginx, chisel, authelia, lamalibre-lamaste-serverd]
+    Mac->>H: GET /api/certs
+    H-->>Mac: certificate info
+```
+
+## Test 06 — Tunnel User Journey (Full 2FA from Visitor)
+
+```mermaid
+sequenceDiagram
+    participant Mac as macOS (Test Runner)
+    participant H as Host VM
+    participant A as Agent VM
+    participant V as Visitor VM
+
+    Mac->>H: POST /api/tunnels {subdomain: e2ejourney, port: 18090, agentLabel: test-agent} (mTLS)
+    Mac->>H: POST /api/users/testuser/reset-totp (mTLS)
+    H-->>Mac: TOTP secret
+
+    Mac->>A: write marker + start HTTP server + lamaste-agent update
+
+    note over Mac,V: Step 1 — Unauthenticated
+    Mac->>V: curl https://FQDN/
+    V->>H: request (no session)
+    H-->>V: 302 → auth.TEST_DOMAIN
+    V-->>Mac: redirected, marker NOT present
+
+    note over Mac,V: Step 2 — First factor
+    Mac->>V: POST /api/firstfactor {username, password}
+    V->>H: credentials
+    H-->>V: session cookie
+
+    note over Mac,V: Step 3 — Second factor
+    Mac->>V: oathtool → TOTP code
+    Mac->>V: POST /api/secondfactor/totp {token}
+    V->>H: TOTP + session
+    H-->>V: authenticated
+
+    note over Mac,V: Step 4 — Access tunneled app
+    Mac->>V: curl https://FQDN/ -b session
+    V->>H: authenticated request
+    H->>A: chisel reverse tunnel
+    A-->>H: HTTP response (marker)
+    H-->>V: 200 + marker
+    V-->>Mac: verified
+
+    note over Mac,V: Step 5 — Session persistence
+    Mac->>V: curl https://FQDN/ -b session (again)
+    V-->>Mac: 200 + marker (still valid)
+
+    note over Mac,V: Step 6 — Invalid session
+    Mac->>V: curl https://FQDN/ -b fake_cookie
+    V-->>Mac: 302/401, marker NOT present
+
+    Mac->>A: cleanup (pkill, rm)
+    Mac->>H: DELETE /api/tunnels/{id}
+```
+
+## Test 07 — Static Site Visitor Journey
+
+```mermaid
+sequenceDiagram
+    participant Mac as macOS (Test Runner)
+    participant H as Host VM
+    participant V as Visitor VM
+
+    Mac->>H: POST /api/sites {subdomain: e2eblog, autheliaProtected: true} (mTLS)
+    H-->>Mac: { id, fqdn }
+    Mac->>H: write marker HTML to /var/www/lamaste/{id}/index.html
+    Mac->>H: POST /api/users/testuser/reset-totp (mTLS)
+    H-->>Mac: TOTP secret
+
+    note over Mac,V: Protected — no auth
+    Mac->>V: curl https://FQDN/
+    V->>H: request (no session)
+    H-->>V: 302 → auth.TEST_DOMAIN
+    V-->>Mac: redirected
+
+    note over Mac,V: Protected — with auth
+    Mac->>V: Authelia first factor + second factor (TOTP)
+    Mac->>V: curl https://FQDN/ -b session
+    V->>H: authenticated
+    H-->>V: 200 + marker
+    V-->>Mac: verified
+
+    note over Mac,H: Disable Authelia protection
+    Mac->>H: PATCH /api/sites/{id} {autheliaProtected: false} (mTLS)
+    Mac->>Mac: sleep 2
+
+    note over Mac,V: Unprotected — no auth needed
+    Mac->>V: curl https://FQDN/ (no session)
+    V->>H: request
+    H-->>V: 200 + marker (public access)
+    V-->>Mac: verified
+
+    note over Mac,H: Re-enable Authelia protection
+    Mac->>H: PATCH /api/sites/{id} {autheliaProtected: true} (mTLS)
+    Mac->>Mac: sleep 2
+
+    note over Mac,V: Protected again — no auth
+    Mac->>V: curl https://FQDN/ (no session)
+    V-->>Mac: 302/401 (enforced again)
+
+    Mac->>H: DELETE /api/sites/{id} (mTLS)
+```
+
+## Test 08 — Invitation Journey
+
+```mermaid
+sequenceDiagram
+    participant Mac as macOS (Test Runner)
+    participant H as Host VM
+    participant V as Visitor VM
+
+    note over Mac,H: Create invitation
+    Mac->>H: POST /api/invitations {username: inviteduser, email} (mTLS)
+    H-->>Mac: { id, token, inviteUrl }
+    Mac->>H: GET /api/invitations (mTLS)
+    H-->>Mac: invitation in list
+
+    note over Mac,V: Accept invitation (public endpoints, no mTLS)
+    Mac->>V: GET https://auth.TEST_DOMAIN/api/invite/{token}
+    V->>H: public request
+    H-->>V: { username, email, expiresAt }
+    V-->>Mac: invitation details
+
+    Mac->>V: POST https://auth.TEST_DOMAIN/api/invite/{token}/accept {password}
+    V->>H: accept with password
+    H-->>V: user created
+    V-->>Mac: OK
+
+    note over Mac,H: Verify user created
+    Mac->>H: GET /api/users (mTLS)
+    H-->>Mac: inviteduser in list
+
+    note over Mac,V: Authenticate as invited user
+    Mac->>H: POST /api/users/inviteduser/reset-totp (mTLS)
+    H-->>Mac: TOTP secret
+    Mac->>V: POST /api/firstfactor {inviteduser, password}
+    V->>H: credentials
+    H-->>V: session cookie
+    Mac->>V: oathtool → TOTP code
+    Mac->>V: POST /api/secondfactor/totp
+    V->>H: TOTP + session
+    H-->>V: authenticated
+
+    Mac->>V: GET /api/verify -b session
+    V->>H: verify session
+    H-->>V: 200 (valid)
+
+    note over Mac,V: Token reuse prevention
+    Mac->>V: GET /api/invite/{token}
+    V->>H: reuse token
+    H-->>V: 410 Gone
+
+    Mac->>V: POST /api/invite/{token}/accept
+    V->>H: reuse token
+    H-->>V: 410 Gone
+
+    Mac->>H: DELETE /api/users/inviteduser (mTLS)
+    Mac->>H: DELETE /api/invitations/{id} (mTLS)
+```

package/vendor/docs/03-architecture/installer-flow.md

@@ -0,0 +1,151 @@
+# Installer Flow
+
+## What `npx @lamalibre/create-lamaste@4.0.0` Does
+
+The installer is a **zero-prompt, fire-and-forget** command. It assumes:
+
+- Fresh Ubuntu 24.04 droplet
+- Running as root (or with sudo)
+- Internet connectivity
+
+It requires **no user input**. All configuration happens later through the browser UI.
+
+## Execution Flow
+
+```
+$ npx @lamalibre/create-lamaste@4.0.0
+
+  Lamaste Installer v1.0.0
+
+  ✔ Detecting environment
+  ✔ Hardening OS
+    ├─ Creating 1GB swap
+    ├─ Configuring UFW firewall (22, 443, 9292)
+    ├─ Installing fail2ban
+    ├─ Hardening SSH (no password auth)
+    └─ Installing dependencies (curl, openssl, nginx, certbot)
+  ✔ Installing Node.js 20 LTS
+  ✔ Generating mTLS certificates
+    ├─ CA certificate (10yr validity)
+    ├─ Client certificate (2yr validity)
+    └─ Browser bundle (client.p12)
+  ✔ Configuring nginx
+    ├─ Self-signed TLS for IP:9292
+    ├─ mTLS enforcement
+    └─ Proxy to panel backend
+  ✔ Deploying Lamaste Panel
+    ├─ Creating system user and root-owned install directory
+    ├─ Installing chisel and Authelia (pinned, SHA-256 verified)
+    ├─ Installing lamalibre-lamaste-serverd, CLI, UI, docs
+    ├─ Configuring systemd service
+    ├─ Installing lamaste-priv and sudoers wrappers
+    ├─ Writing sudoers rules (visudo-checked)
+    └─ Starting panel service
+  ✔ Deploying Gatekeeper
+  ✔ Verifying installation
+
+  ══════════════════════════════════════════════════════════
+  ✔ Lamaste installed successfully!
+
+  1. Download your certificate:
+     scp root@<droplet-ip>:/etc/lamalibre/lamaste/pki/client.p12 ~/Downloads/
+
+  2. Import certificate into your browser:
+     - macOS: Double-click client.p12 → Keychain Access → Always Trust
+     - Password: <generated-p12-password>
+
+  3. Open the management panel:
+     https://<droplet-ip>:9292
+
+  4. You can now disconnect from SSH.
+     Everything else is managed through the browser.
+  ══════════════════════════════════════════════════════════
+```
+
+## Tasks Breakdown
+
+### 1. Environment Detection
+
+- Verify Ubuntu 24.04
+- Verify root or sudo access
+- Detect droplet IP address (from metadata API or hostname -I)
+- Check available RAM and disk
+
+### 2. OS Hardening
+
+- Create 1GB swap file
+- Configure UFW: allow 22, 443, 9292; deny all else
+- Install and configure fail2ban (SSH + nginx jails)
+- Harden SSH: `PasswordAuthentication no`, `PermitRootLogin prohibit-password`
+- Install system packages: curl, openssl, nginx, certbot, python3-certbot-nginx
+
+### 3. Node.js Installation
+
+- Install Node.js 20 LTS via NodeSource repository
+- Verify node and npm are available
+
+### 4. mTLS Certificate Generation
+
+- Generate CA key + self-signed CA cert (10yr)
+- Generate client key + CSR → sign with CA (2yr)
+- Create PKCS12 bundle with random password
+- Set file permissions (600 for keys, 644 for certs)
+- Store everything under `/etc/lamalibre/lamaste/pki/`
+
+### 5. nginx Configuration
+
+- Generate self-signed TLS cert for IP-based access
+- Write mTLS snippet (`ssl_verify_client on`, `ssl_client_certificate ca.crt`)
+- Write IP:9292 vhost with mTLS + proxy to 127.0.0.1:3100
+- Test config (`nginx -t`) and reload
+
+### 6. Panel Deployment
+
+- Create the `lamaste` system user
+- Create `/opt/lamalibre/lamaste/` **root-owned** (read-only for `lamaste`; a tree owned by anyone else is moved aside and replaced) and write the certificate help page into it
+- Create the `lamaste-chisel` group and the `lamaste-authelia` account; install Chisel 1.12.0 and Authelia 4.39.28 to `/usr/local/bin` (fixed release URLs, SHA-256 verified before unpacking; a newer Authelia is kept); write `chisel.service` and `authelia.service`; set ownership of `/var/www/lamaste` (`lamaste:www-data`), `/etc/authelia` (`lamaste:lamaste-authelia`) and `/var/log/authelia` (`lamaste-authelia`). The services are started by onboarding
+- Deploy lamalibre-lamaste-serverd from bundled `vendor/lamaste-serverd/` directory + npm install, the `lamaste-server` CLI, and lamaste-server-ui from bundled `vendor/lamaste-server-ui/dist/` (pre-built, avoids Vite build on low-RAM VPS)
+- Write `/etc/lamalibre/lamaste/panel.json` with droplet IP and paths
+- Write systemd unit file for panel service
+- Install the root-owned programs `/usr/local/sbin/lamaste-priv`, `lamaste-certbot` and `lamaste-cert-info`
+- Write `/etc/sudoers.d/lamaste` — fixed `systemctl` lines, `nginx -t`, and the three programs; no wildcards — staged, checked with `visudo -c`, then renamed into place
+- Enable and start the service
+
+### 6b. Gatekeeper Deployment
+
+- Deploy the gatekeeper into `/opt/lamalibre/lamaste/gatekeeper` (root-owned), create its state files, write its unit and start it
+
+### 7. Verification
+
+- HTTP health check to 127.0.0.1:3100/api/health
+- Verify nginx is proxying correctly
+- Verify mTLS is enforced (curl without cert should fail)
+
+### 8. Summary Output
+
+- Print scp command for certificate download
+- Print p12 password
+- Print panel URL
+- Print disconnect instruction
+
+## Design Decisions
+
+### Why zero-prompt?
+
+The installer doesn't need domain, email, or ports — all of that is configured through the onboarding UI. This eliminates user error during SSH and makes the installer idempotent and scriptable.
+
+### Why not Docker?
+
+512MB RAM. Docker itself consumes ~100MB, which doesn't leave room for the services. Native systemd services are lighter and simpler to manage.
+
+### Why self-signed TLS for IP access?
+
+There's no domain yet during initial setup. The browser will show a certificate warning, but the mTLS client cert still protects the connection. Once onboarding adds a domain, Let's Encrypt provides a real cert for the domain-based access.
+
+### What happens when re-running on an existing installation?
+
+If an existing Lamaste installation is detected (`/etc/lamalibre/lamaste/panel.json` exists), the installer enters **redeploy mode** by default. This redeploys the panel, CLI, UI, docs and gatekeeper into a root-owned install directory, merges configuration, re-checks the pinned Chisel and Authelia installs, their units and the directory ownership, rewrites the root-owned programs and the sudoers rules, and restarts what changed -- skipping OS hardening, mTLS certificates, and the panel's nginx vhosts. See [Upgrades](../05-operations/upgrades.md). Use `--force-full` to run the complete installation instead.
+
+### Why not use the lamalibre-lamaste-serverd directly on port 9292?
+
+nginx handles TLS termination and mTLS verification at the connection level. The lamalibre-lamaste-serverd never sees unauthenticated traffic. This is more secure than implementing TLS in Node.js.