@lamalibre/create-lamaste 4.0.0

package/src/lib/ownership.js

@@ -0,0 +1,231 @@
+import { execa } from 'execa';
+import { constants } from 'node:fs';
+import { chmod, chown, lstat, mkdir, open, readdir, rename, rm } from 'node:fs/promises';
+import crypto from 'node:crypto';
+import { basename, dirname, join } from 'node:path';
+
+/**
+ * Filesystem operations create-lamaste performs as root on paths the lamaste
+ * user can write to (its config directory, the web root, /etc/authelia).
+ *
+ * The panel may be compromised, and it can trigger create-lamaste itself
+ * (self-update), so anything it controls may be a trap: a symlink where a
+ * file is expected, planted between a check and a use. These helpers never
+ * follow a symlink the lamaste user could have placed:
+ * - new files are created with O_EXCL | O_NOFOLLOW under a random name and
+ *   renamed into place (rename replaces a symlink, it does not follow it);
+ * - ownership and mode are changed through the open file descriptor
+ *   (fchown/fchmod), never by path;
+ * - recursive changes use coreutils (chown -R, rm -rf), which do not follow
+ *   symlinks and are safe against a tree changing underneath them.
+ */
+
+const NOFOLLOW_READ = constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK;
+
+/**
+ * Atomically write `content` to `path`, owned by uid:gid with `mode`.
+ *
+ * @param {string} path
+ * @param {string | Uint8Array} content
+ * @param {{ mode: number, uid: number, gid: number }} options
+ */
+export async function writeFileNoFollow(path, content, { mode, uid, gid }) {
+  const tmp = join(dirname(path), `.${basename(path)}.${crypto.randomBytes(8).toString('hex')}`);
+  const fh = await open(
+    tmp,
+    constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW,
+    0o600,
+  );
+  try {
+    await fh.writeFile(content);
+    await fh.chown(uid, gid);
+    await fh.chmod(mode);
+    await fh.sync();
+  } catch (err) {
+    await fh.close();
+    await rm(tmp, { force: true });
+    throw err;
+  }
+  await fh.close();
+  try {
+    await rename(tmp, path);
+  } catch (err) {
+    await rm(tmp, { force: true });
+    throw err;
+  }
+}
+
+/**
+ * Set owner and mode of the regular file at `path` through a descriptor.
+ * A symlink, a missing file or anything but a regular file is left alone.
+ *
+ * @returns {Promise<boolean>} whether the file exists and was checked
+ */
+export async function setFileOwnership(path, { uid, gid, mode }) {
+  let fh;
+  try {
+    fh = await open(path, NOFOLLOW_READ);
+  } catch (err) {
+    if (err.code === 'ENOENT' || err.code === 'ELOOP') return false;
+    throw err;
+  }
+  try {
+    const st = await fh.stat();
+    if (!st.isFile()) return false;
+    if (st.uid !== uid || st.gid !== gid) await fh.chown(uid, gid);
+    if ((st.mode & 0o7777) !== mode) await fh.chmod(mode);
+    return true;
+  } finally {
+    await fh.close();
+  }
+}
+
+/**
+ * Set owner and mode of the directory at `path` through a descriptor,
+ * creating it (root-owned parent assumed) if it does not exist.
+ */
+export async function ensureDirectory(path, { uid, gid, mode }) {
+  await mkdir(path, { recursive: true, mode });
+  const fh = await open(path, NOFOLLOW_READ | constants.O_DIRECTORY);
+  try {
+    const st = await fh.stat();
+    if (st.uid !== uid || st.gid !== gid) await fh.chown(uid, gid);
+    if ((st.mode & 0o7777) !== mode) await fh.chmod(mode);
+  } finally {
+    await fh.close();
+  }
+}
+
+/** `rm -rf` without following symlinks or crossing filesystems. */
+export async function removeTree(path) {
+  await execa('rm', ['-rf', '--one-file-system', '--', path]);
+}
+
+/** `chown -R` without following symlinks (coreutils' default for -R). */
+export async function chownTree(path, owner) {
+  await execa('chown', ['-R', '-P', '--', owner, path]);
+}
+
+/**
+ * Make the install directory (code the panel runs, and the lamaste-server
+ * CLI that administrators run as root) writable by root only. Earlier
+ * versions handed it to the lamaste user: a compromised panel could then
+ * rewrite code that root executes. Its contents are not reused — the tree
+ * may hold symlinks that would redirect the redeploy's writes — so a tree
+ * not already owned by root is moved aside, a fresh root-owned directory
+ * takes its place, and the caller redeploys every component into it and
+ * then removes the old tree.
+ *
+ * @param {string} installDir
+ * @returns {Promise<{ previous: string | null }>} the moved-aside tree, if any
+ */
+export async function ensureRootOwnedInstallDir(installDir) {
+  let needsReset = false;
+  try {
+    const st = await lstat(installDir);
+    if (!st.isDirectory() || st.uid !== 0) {
+      needsReset = true;
+    } else {
+      for (const entry of await readdir(installDir)) {
+        if ((await lstat(join(installDir, entry))).uid !== 0) {
+          needsReset = true;
+          break;
+        }
+      }
+    }
+  } catch (err) {
+    if (err.code !== 'ENOENT') throw err;
+  }
+
+  let previous = null;
+  if (needsReset) {
+    previous = `${installDir}.lamaste-owned-${Date.now()}`;
+    await rename(installDir, previous);
+  }
+  await ensureDirectory(installDir, { uid: 0, gid: 0, mode: 0o755 });
+  return { previous };
+}
+
+/**
+ * Hand the web root to the lamaste user, readable by nginx through the
+ * www-data group: directories 2750 (new files inherit the group), files
+ * 0640. Earlier versions kept it www-data-owned and let the panel write it
+ * through wildcard sudo rules. Modes are fixed while the tree is still
+ * owned by www-data, before the lamaste user can touch it.
+ *
+ * @param {string} webRoot
+ * @param {{ lamasteUid: number, wwwDataGid: number }} ids
+ * @returns {Promise<{ migrated: boolean }>}
+ */
+export async function migrateWebRoot(webRoot, { lamasteUid, wwwDataGid }) {
+  let st = null;
+  try {
+    st = await lstat(webRoot);
+  } catch (err) {
+    if (err.code !== 'ENOENT') throw err;
+  }
+  if (st && st.isDirectory() && st.uid === lamasteUid) {
+    await ensureDirectory(webRoot, { uid: lamasteUid, gid: wwwDataGid, mode: 0o2750 });
+    return { migrated: false };
+  }
+  if (st && !st.isDirectory()) throw new Error(`${webRoot} is not a directory`);
+  if (st) {
+    await execa('find', [webRoot, '-xdev', '-type', 'd', '-exec', 'chmod', '2750', '{}', '+']);
+    await execa('find', [webRoot, '-xdev', '-type', 'f', '-exec', 'chmod', '0640', '{}', '+']);
+    await chownTree(webRoot, `${lamasteUid}:${wwwDataGid}`);
+  }
+  await ensureDirectory(webRoot, { uid: lamasteUid, gid: wwwDataGid, mode: 0o2750 });
+  return { migrated: st !== null };
+}
+
+/**
+ * Give /etc/authelia to the lamaste user (the panel writes Authelia's
+ * configuration) and its group to the Authelia account (which reads the
+ * configuration and keeps its database and notification file there).
+ * Earlier versions ran Authelia as root with every file root-owned. Files
+ * are re-owned while the directory still belongs to root, so the lamaste
+ * user cannot interfere; the directory itself is handed over last.
+ *
+ * @param {string} dir
+ * @param {{ lamasteUid: number, lamasteGid: number, autheliaUid: number, autheliaGid: number }} ids
+ * @returns {Promise<{ migrated: boolean }>}
+ */
+export async function migrateAutheliaDir(dir, ids) {
+  const { lamasteUid, lamasteGid, autheliaUid, autheliaGid } = ids;
+  let st = null;
+  try {
+    st = await lstat(dir);
+  } catch (err) {
+    if (err.code !== 'ENOENT') throw err;
+  }
+  if (st && st.isDirectory() && st.uid === lamasteUid) {
+    await ensureDirectory(dir, { uid: lamasteUid, gid: autheliaGid, mode: 0o2770 });
+    return { migrated: false };
+  }
+  if (st && !st.isDirectory()) throw new Error(`${dir} is not a directory`);
+
+  if (st) {
+    for (const entry of await readdir(dir, { withFileTypes: true })) {
+      if (!entry.isFile()) continue;
+      const path = join(dir, entry.name);
+      const name = entry.name;
+      if (name === '.secrets.json') {
+        // The panel's own record of the secrets; Authelia reads them from its config.
+        await chown(path, lamasteUid, lamasteGid);
+        await chmod(path, 0o600);
+      } else if (name.startsWith('db.sqlite3') || name === 'notifications.txt') {
+        await chown(path, autheliaUid, autheliaGid);
+        await chmod(path, 0o600);
+      } else if (name === 'users.yml') {
+        // Authelia rewrites it in place when a user changes their password.
+        await chown(path, lamasteUid, autheliaGid);
+        await chmod(path, 0o660);
+      } else {
+        await chown(path, lamasteUid, autheliaGid);
+        await chmod(path, 0o640);
+      }
+    }
+  }
+  await ensureDirectory(dir, { uid: lamasteUid, gid: autheliaGid, mode: 0o2770 });
+  return { migrated: st !== null };
+}

package/src/lib/relay-services.js

@@ -0,0 +1,103 @@
+import { readFile, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { ensureAutheliaUser, ensureChiselGroup, lookupId } from './accounts.js';
+import { installPinnedAuthelia, installPinnedChisel } from './binaries.js';
+import {
+  chownTree,
+  ensureDirectory,
+  migrateAutheliaDir,
+  migrateWebRoot,
+  setFileOwnership,
+} from './ownership.js';
+import {
+  AUTHELIA_CONFIG_DIR,
+  AUTHELIA_LOG_DIR,
+  AUTHELIA_UNIT_PATH,
+  AUTHELIA_USER,
+  CHISEL_GROUP,
+  CHISEL_UNIT_PATH,
+  WEB_ROOT,
+  generateAutheliaUnit,
+  generateChiselUnit,
+} from './service-config.js';
+
+async function writeIfChanged(path, content) {
+  let current = null;
+  try {
+    current = await readFile(path, 'utf8');
+  } catch (err) {
+    if (err.code !== 'ENOENT') throw err;
+  }
+  if (current === content) return false;
+  await writeFile(path, content, { mode: 0o644 });
+  return true;
+}
+
+/**
+ * Everything the relay's services need from root, for a fresh install and
+ * for every redeploy: service accounts, the pinned chisel and Authelia
+ * binaries, their systemd units, and the ownership of the directories the
+ * panel writes without privileges. Idempotent.
+ *
+ * Does not start, stop or restart anything: the caller runs
+ * `systemctl daemon-reload` and restarts what changed. Onboarding enables
+ * and starts chisel and Authelia on a fresh install.
+ *
+ * @param {{ configDir: string, pkiDir: string }} ctx
+ * @param {(line: string) => void} report
+ * @returns {Promise<{ chiselChanged: boolean, autheliaChanged: boolean }>}
+ *   whether the binary or unit of each changed (a running service needs a
+ *   restart to pick it up)
+ */
+export async function provisionRelayServices(ctx, report) {
+  report(`Ensuring the ${CHISEL_GROUP} group and the ${AUTHELIA_USER} account...`);
+  await ensureChiselGroup();
+  await ensureAutheliaUser();
+
+  const lamasteUid = await lookupId('user', 'lamaste');
+  const lamasteGid = await lookupId('group', 'lamaste');
+  const wwwDataGid = await lookupId('group', 'www-data');
+  const chiselGid = await lookupId('group', CHISEL_GROUP);
+  const autheliaUid = await lookupId('user', AUTHELIA_USER);
+  const autheliaGid = await lookupId('group', AUTHELIA_USER);
+
+  report('Installing the pinned chisel release...');
+  const chisel = await installPinnedChisel();
+  report('Installing the pinned Authelia release...');
+  const authelia = await installPinnedAuthelia();
+  if (authelia.keptNewer) {
+    report(`Keeping the installed Authelia ${authelia.version} (newer than the pinned release)`);
+  }
+
+  report('Setting ownership of the web root, Authelia and chisel files...');
+  await migrateWebRoot(WEB_ROOT, { lamasteUid, wwwDataGid });
+  const autheliaDir = await migrateAutheliaDir(AUTHELIA_CONFIG_DIR, {
+    lamasteUid,
+    lamasteGid,
+    autheliaUid,
+    autheliaGid,
+  });
+  await ensureDirectory(AUTHELIA_LOG_DIR, { uid: autheliaUid, gid: autheliaGid, mode: 0o750 });
+  await chownTree(AUTHELIA_LOG_DIR, `${autheliaUid}:${autheliaGid}`);
+  // chisel runs as nobody:lamaste-chisel; the panel creates the key (as
+  // lamaste, group lamaste-chisel). Earlier versions made it nobody:nogroup 0400.
+  await setFileOwnership(join(ctx.configDir, 'chisel-server.key'), {
+    uid: lamasteUid,
+    gid: chiselGid,
+    mode: 0o640,
+  });
+  // The panel is the CA: the PKI directory is its own. Files earlier
+  // versions created through sudo may still be root-owned.
+  await chownTree(ctx.pkiDir, `${lamasteUid}:${lamasteGid}`).catch((err) => {
+    if (!/No such file/.test(err.stderr ?? '')) throw err;
+  });
+
+  report('Writing the chisel and Authelia units...');
+  const chiselUnitChanged = await writeIfChanged(CHISEL_UNIT_PATH, generateChiselUnit(ctx));
+  const autheliaUnitChanged = await writeIfChanged(AUTHELIA_UNIT_PATH, generateAutheliaUnit());
+
+  return {
+    chiselChanged: chisel.changed || chiselUnitChanged,
+    autheliaChanged: authelia.changed || autheliaUnitChanged || autheliaDir.migrated,
+  };
+}

package/src/lib/secrets.js

@@ -0,0 +1,19 @@
+import { randomBytes } from 'node:crypto';
+
+/**
+ * Generate a URL-safe random password string.
+ * @param {number} [length=24] Number of random bytes (output is base64url-encoded, so longer).
+ * @returns {string}
+ */
+export function generatePassword(length = 24) {
+  return randomBytes(length).toString('base64url');
+}
+
+/**
+ * Generate a hex-encoded random secret.
+ * @param {number} [length=32] Number of random bytes.
+ * @returns {string}
+ */
+export function generateHex(length = 32) {
+  return randomBytes(length).toString('hex');
+}

package/src/lib/service-config.js

@@ -0,0 +1,311 @@
+/**
+ * Shared systemd unit and sudoers content generators.
+ * Used by both the full installer (panel.js) and the redeploy flow (redeploy.js).
+ */
+
+/**
+ * Generate the lamalibre-lamaste-serverd systemd service unit content.
+ *
+ * @param {{ installDir: string, configDir: string }} ctx
+ * @returns {string}
+ */
+export function generateServiceUnit(ctx) {
+  return `[Unit]
+Description=Lamaste Panel Server
+After=network.target
+
+[Service]
+Type=simple
+User=lamaste
+Group=lamaste
+# Lets the panel hand the chisel authfile to the group chisel runs as.
+SupplementaryGroups=lamaste-chisel
+WorkingDirectory=${ctx.installDir}/serverd
+ExecStart=/usr/bin/node src/index.js
+Environment=NODE_ENV=production
+Environment=CONFIG_FILE=${ctx.configDir}/panel.json
+Restart=always
+RestartSec=5
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=lamalibre-lamaste-serverd
+
+# Security hardening
+# Note: NoNewPrivileges is intentionally omitted — the panel uses sudo for
+# the fixed commands and root-owned helpers listed in /etc/sudoers.d/lamaste
+# (systemctl, nginx -t, lamaste-priv, lamaste-certbot, lamaste-cert-info).
+ProtectHome=true
+ReadWritePaths=${ctx.configDir} /var/www/lamaste
+PrivateTmp=true
+
+[Install]
+WantedBy=multi-user.target
+`;
+}
+
+/**
+ * Generate the lamaste sudoers file content.
+ *
+ * The panel runs as `lamaste`; this file is everything it may do as root.
+ * Every rule is a fixed command line or a root-owned program that validates
+ * its own arguments — no rule ends in, or contains, a wildcard. (A sudoers
+ * `*` matches spaces, so a wildcard rule such as `mv /tmp/x-* /var/www/*`
+ * also accepts `mv /tmp/x-a -t /etc/sudoers.d /var/www/y`.)
+ *
+ * What the panel does NOT need root for, and therefore has no rule for:
+ * - its PKI (/etc/lamalibre/lamaste/pki, owned by lamaste — the panel is the CA),
+ * - static sites (/var/www/lamaste, owned lamaste:www-data),
+ * - Authelia's configuration (/etc/authelia, owned lamaste:lamaste-authelia),
+ * - the chisel authfile and key (group lamaste-chisel, of which lamaste is a member).
+ * Binaries, systemd units and service accounts are installed by create-lamaste,
+ * which runs as root; the panel never writes a unit or a binary.
+ *
+ * @returns {string}
+ */
+export function generateSudoersContent() {
+  return `# Lamaste serverd sudo rules — generated by create-lamaste; do not edit.
+# Every rule is a fixed command line or a root-owned program that validates its
+# own arguments. There are no wildcards: a sudoers \`*\` matches spaces too.
+
+# --- systemctl: managed services ---
+lamaste ALL=(root) NOPASSWD: /usr/bin/systemctl start nginx
+lamaste ALL=(root) NOPASSWD: /usr/bin/systemctl stop nginx
+lamaste ALL=(root) NOPASSWD: /usr/bin/systemctl restart nginx
+lamaste ALL=(root) NOPASSWD: /usr/bin/systemctl reload nginx
+lamaste ALL=(root) NOPASSWD: /usr/bin/systemctl start chisel
+lamaste ALL=(root) NOPASSWD: /usr/bin/systemctl stop chisel
+# Chisel reloads its authfile by itself. The panel restarts it only when a
+# change revokes access (a removed or rotated credential, a withdrawn port
+# grant) — \`try-restart\`, so a chisel stopped on purpose stays stopped.
+lamaste ALL=(root) NOPASSWD: /usr/bin/systemctl restart chisel
+lamaste ALL=(root) NOPASSWD: /usr/bin/systemctl try-restart chisel
+lamaste ALL=(root) NOPASSWD: /usr/bin/systemctl enable chisel
+# Disabled (with stop) when startup reconciliation cannot secure chisel, so a
+# reboot does not start it on a stale authfile; re-enabled once it succeeds.
+lamaste ALL=(root) NOPASSWD: /usr/bin/systemctl disable chisel
+lamaste ALL=(root) NOPASSWD: /usr/bin/systemctl start authelia
+lamaste ALL=(root) NOPASSWD: /usr/bin/systemctl stop authelia
+lamaste ALL=(root) NOPASSWD: /usr/bin/systemctl restart authelia
+lamaste ALL=(root) NOPASSWD: /usr/bin/systemctl reload authelia
+lamaste ALL=(root) NOPASSWD: /usr/bin/systemctl enable authelia
+lamaste ALL=(root) NOPASSWD: /usr/bin/systemctl enable certbot.timer
+lamaste ALL=(root) NOPASSWD: /usr/bin/systemctl start certbot.timer
+lamaste ALL=(root) NOPASSWD: /usr/bin/systemctl start lamalibre-lamaste-serverd
+lamaste ALL=(root) NOPASSWD: /usr/bin/systemctl stop lamalibre-lamaste-serverd
+lamaste ALL=(root) NOPASSWD: /usr/bin/systemctl restart lamalibre-lamaste-serverd
+lamaste ALL=(root) NOPASSWD: /usr/bin/systemctl start lamalibre-lamaste-gatekeeper
+lamaste ALL=(root) NOPASSWD: /usr/bin/systemctl stop lamalibre-lamaste-gatekeeper
+lamaste ALL=(root) NOPASSWD: /usr/bin/systemctl restart lamalibre-lamaste-gatekeeper
+
+# --- nginx config test ---
+lamaste ALL=(root) NOPASSWD: /usr/sbin/nginx -t
+
+# --- root-owned programs that validate their own arguments ---
+# lamaste-priv: install/enable/remove the panel's nginx vhosts (every directive
+# checked against an allow-list — nginx opens the files a vhost names as
+# root), store a TOTP secret with Authelia's CLI as the Authelia user, and
+# start a self-update (create-lamaste@<version>) in a transient unit.
+lamaste ALL=(root) NOPASSWD: /usr/local/sbin/lamaste-priv
+# Let's Encrypt: certbot and openssl with fixed flags, hostnames and email
+# validated. See scripts/lamaste-certbot, scripts/lamaste-cert-info.
+lamaste ALL=(root) NOPASSWD: /usr/local/sbin/lamaste-certbot
+lamaste ALL=(root) NOPASSWD: /usr/local/sbin/lamaste-cert-info
+`;
+}
+
+/**
+ * Generate the lamalibre-lamaste-gatekeeper systemd service unit content.
+ *
+ * @param {{ installDir: string, configDir: string }} ctx
+ * @returns {string}
+ */
+export function generateGatekeeperServiceUnit(ctx) {
+  return `[Unit]
+Description=Lamaste Gatekeeper — tunnel authorization service
+After=network.target authelia.service
+
+[Service]
+Type=simple
+User=lamaste
+Group=lamaste
+WorkingDirectory=${ctx.installDir}/gatekeeper
+ExecStart=/usr/bin/node dist/server/index.js
+Environment=NODE_ENV=production
+Environment=LAMALIBRE_LAMASTE_DATA_DIR=${ctx.configDir}
+Restart=always
+RestartSec=5
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=lamalibre-lamaste-gatekeeper
+
+# Security hardening
+ProtectHome=true
+ReadWritePaths=${ctx.configDir}
+PrivateTmp=true
+NoNewPrivileges=true
+
+[Install]
+WantedBy=multi-user.target
+`;
+}
+
+/**
+ * Root-owned sudoers wrapper scripts shipped in this package's scripts/
+ * directory and installed to /usr/local/sbin. The sudoers rules reference
+ * these absolute paths; each script validates its arguments and runs its
+ * command with a fixed argument vector.
+ */
+export const SUDOERS_WRAPPERS = [
+  { name: 'lamaste-priv', dest: '/usr/local/sbin/lamaste-priv', interpreter: 'node' },
+  { name: 'lamaste-certbot', dest: '/usr/local/sbin/lamaste-certbot', interpreter: 'bash' },
+  { name: 'lamaste-cert-info', dest: '/usr/local/sbin/lamaste-cert-info', interpreter: 'bash' },
+];
+
+/**
+ * Wrappers earlier versions installed that no sudoers rule references any
+ * more; create-lamaste removes them on upgrade. The panel signs agent CSRs
+ * and renames PKI files itself: it owns the PKI directory and the CA key.
+ */
+export const RETIRED_SUDOERS_WRAPPERS = [
+  '/usr/local/sbin/lamaste-sign-csr',
+  '/usr/local/sbin/lamaste-pki-rename',
+];
+
+/**
+ * The group the chisel server runs as. The 0640 chisel authfile (every
+ * agent's tunnel password) belongs to it; the lamaste user is a member so the
+ * panel can hand the file to the group without privileges. Must match
+ * CHISEL_AUTHFILE_GROUP in @lamalibre/lamaste/server.
+ */
+export const CHISEL_GROUP = 'lamaste-chisel';
+
+/** The system account Authelia runs as (see accounts.js). */
+export const AUTHELIA_USER = 'lamaste-authelia';
+
+export const CHISEL_BIN = '/usr/local/bin/chisel';
+export const AUTHELIA_BIN = '/usr/local/bin/authelia';
+export const CHISEL_UNIT_PATH = '/etc/systemd/system/chisel.service';
+export const AUTHELIA_UNIT_PATH = '/etc/systemd/system/authelia.service';
+export const AUTHELIA_CONFIG_DIR = '/etc/authelia';
+export const AUTHELIA_LOG_DIR = '/var/log/authelia';
+export const WEB_ROOT = '/var/www/lamaste';
+
+/**
+ * The chisel server unit. The authfile carries per-agent credentials and
+ * port grants; chisel reloads it on change. The process runs as `nobody`
+ * with group {@link CHISEL_GROUP}, the only group that can read the 0640
+ * authfile and key the panel writes. `--keyfile` keeps the SSH host identity
+ * stable across restarts.
+ *
+ * Installed by create-lamaste only; onboarding enables and starts it.
+ *
+ * @param {{ configDir: string }} ctx
+ * @returns {string}
+ */
+export function generateChiselUnit(ctx) {
+  return `[Unit]
+Description=Chisel Tunnel Server
+After=network.target
+
+[Service]
+Type=simple
+User=nobody
+Group=${CHISEL_GROUP}
+ExecStart=${CHISEL_BIN} server --reverse --port 9090 --host 127.0.0.1 --keyfile ${ctx.configDir}/chisel-server.key --authfile ${ctx.configDir}/chisel-users
+Restart=always
+RestartSec=5
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=chisel
+
+NoNewPrivileges=yes
+CapabilityBoundingSet=
+ProtectSystem=strict
+ProtectHome=yes
+PrivateTmp=yes
+PrivateDevices=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectControlGroups=yes
+RestrictNamespaces=yes
+LockPersonality=yes
+
+[Install]
+WantedBy=multi-user.target
+`;
+}
+
+/**
+ * The Authelia unit, after upstream's packaged unit: a dedicated
+ * unprivileged account, files it creates readable by its group only, and a
+ * read-only view of the system except its configuration directory (the
+ * SQLite database and notification file live there) and its log directory.
+ *
+ * Installed by create-lamaste only; onboarding writes the configuration,
+ * then enables and starts it.
+ *
+ * @returns {string}
+ */
+export function generateAutheliaUnit() {
+  return `[Unit]
+Description=Authelia Authentication Server
+After=network.target
+
+[Service]
+Type=simple
+User=${AUTHELIA_USER}
+Group=${AUTHELIA_USER}
+UMask=027
+Environment=AUTHELIA_SERVER_DISABLE_HEALTHCHECK=true
+ExecStart=${AUTHELIA_BIN} --config ${AUTHELIA_CONFIG_DIR}/configuration.yml
+Restart=always
+RestartSec=5
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=authelia
+
+NoNewPrivileges=yes
+CapabilityBoundingSet=
+ProtectSystem=strict
+ReadWritePaths=${AUTHELIA_CONFIG_DIR} ${AUTHELIA_LOG_DIR}
+ProtectHome=yes
+PrivateTmp=yes
+PrivateDevices=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectControlGroups=yes
+RestrictNamespaces=yes
+LockPersonality=yes
+SystemCallArchitectures=native
+SystemCallFilter=@system-service
+SystemCallErrorNumber=EPERM
+
+[Install]
+WantedBy=multi-user.target
+`;
+}
+
+/** sites-available name of the port-80 catch-all. */
+export const HTTP_REDIRECT_SITE = 'lamalibre-lamaste-http-redirect';
+
+/**
+ * The port-80 catch-all: every plain-HTTP request is redirected to HTTPS on
+ * the same host and path. Without it nothing listens on :80 and `http://`
+ * links to the relay's hostnames are refused.
+ *
+ * It does not get in the way of Let's Encrypt: certbot's nginx authenticator
+ * (`certonly --nginx`, and renewals) clones this default_server block per
+ * hostname for the length of an HTTP-01 challenge, answers the challenge
+ * path ahead of the redirect, and restores the file afterwards — verified
+ * on Ubuntu 24.04 (nginx 1.24, certbot 2.9) for new names, names with an
+ * existing 443 block, multi-name lineages, and forced renewals.
+ */
+export function generateHttpRedirectVhost() {
+  return `# Managed by Lamaste — plain HTTP is redirected to HTTPS.
+server {
+    listen 80 default_server;
+    server_name _;
+    return 301 https://$host$request_uri;
+}
+`;
+}