@lamalibre/create-lamaste 4.0.0

package/src/lib/summary.js

@@ -0,0 +1,131 @@
+import chalk from 'chalk';
+
+// eslint-disable-next-line no-control-regex
+const ansiPattern = new RegExp('\x1b\\[[0-9;]*m', 'g');
+const stripAnsi = (str) => str.replace(ansiPattern, '');
+
+/**
+ * Print an array of lines inside a bordered box with a title separator
+ * after the first 3 lines.
+ * @param {string[]} lines
+ */
+function printBox(lines) {
+  const maxLineWidth = Math.max(...lines.map((l) => stripAnsi(l).length));
+  const boxInnerWidth = Math.max(maxLineWidth + 2, 62);
+
+  const border = chalk.cyan;
+  const topBorder = border(`╔${'═'.repeat(boxInnerWidth)}╗`);
+  const bottomBorder = border(`╚${'═'.repeat(boxInnerWidth)}╝`);
+  const midBorder = border(`╠${'═'.repeat(boxInnerWidth)}╣`);
+
+  const padLine = (line) => {
+    const visibleLength = stripAnsi(line).length;
+    const padding = boxInnerWidth - visibleLength;
+    return `${border('║')}${line}${' '.repeat(Math.max(0, padding))}${border('║')}`;
+  };
+
+  console.log('');
+  console.log(topBorder);
+
+  // Title section (first 3 lines: empty, title, empty)
+  for (let i = 0; i < 3; i++) {
+    console.log(padLine(lines[i]));
+  }
+
+  // Separator
+  console.log(midBorder);
+
+  // Remaining content lines
+  for (let i = 3; i < lines.length; i++) {
+    console.log(padLine(lines[i]));
+  }
+
+  console.log(bottomBorder);
+  console.log('');
+}
+
+/**
+ * Print the post-install summary box with all the information the user needs
+ * to download their client certificate, import it, and access the panel.
+ *
+ * In redeploy mode, prints a shorter summary since the user already has
+ * their certificate and knows how to access the panel.
+ *
+ * @param {{ ip: string, pkiDir: string, installedVersion?: string, vendorVersion?: string }} ctx - Shared installer context.
+ */
+export async function printSummary(ctx) {
+  const ip = ctx.ip;
+  const panelUrl = `https://${ip}:9292`;
+
+  // Redeploy mode: short summary
+  if (ctx.installedVersion !== undefined) {
+    const lines = [
+      '',
+      `   ${chalk.green.bold('Panel updated successfully!')}`,
+      '',
+      `   ${chalk.white.bold('Version:')} ${chalk.dim(ctx.installedVersion || 'unknown')} ${chalk.white('→')} ${chalk.cyan(ctx.vendorVersion || 'unknown')}`,
+      '',
+      `   ${chalk.white.bold('Panel:')}   ${chalk.cyan.underline(panelUrl)}`,
+      '',
+      `   ${chalk.dim('Your certificates, nginx config, and OS settings are unchanged.')}`,
+      `   ${chalk.dim('Refresh your browser to see the updated panel.')}`,
+      '',
+    ];
+
+    printBox(lines);
+    return;
+  }
+
+  // Full install mode: complete summary with certificate instructions
+  const scpCmd = `scp root@${ip}:${ctx.pkiDir}/client.p12 .`;
+
+  const lines = [
+    '',
+    `   ${chalk.green.bold('Lamaste installed successfully!')}`,
+    '',
+    `   ${chalk.white.bold('1.')} ${chalk.white('Download your client certificate:')}`,
+    '',
+    `      ${chalk.cyan(scpCmd)}`,
+    '',
+    `   ${chalk.white.bold('2.')} ${chalk.white('Import client.p12 into your browser:')}`,
+    '',
+    `      ${chalk.white.bold('macOS:')}  ${chalk.white('Double-click the file → Keychain Access')}`,
+    `              ${chalk.white('→ select "System" keychain (not "login")')}`,
+    `              ${chalk.white('→ enter the password below when prompted')}`,
+    `              ${chalk.white('→ find cert in System keychain → double-click')}`,
+    `              ${chalk.white('→ Trust → Always Trust')}`,
+    `              ${chalk.dim('(ignore any "Local Items" import error — System is what matters)')}`,
+    '',
+    `      ${chalk.white.bold('Linux:')}  ${chalk.white('Chrome → Settings → Privacy & Security')}`,
+    `              ${chalk.white('→ Security → Manage certificates → Import')}`,
+    '',
+    `      ${chalk.white.bold('Windows:')} ${chalk.white('Double-click the file → Certificate Import')}`,
+    `               ${chalk.white('Wizard → enter the password below')}`,
+    '',
+    `   ${chalk.white.bold('3.')} ${chalk.white('Certificate password:')}`,
+    '',
+    `      ${chalk.yellow.bold(`cat ${ctx.pkiDir}/.p12-password`)}`,
+    '',
+    `   ${chalk.white.bold('4.')} ${chalk.white('Open the Lamaste panel:')}`,
+    '',
+    `      ${chalk.cyan.underline(panelUrl)}`,
+    '',
+    `      ${chalk.white('(Your browser will warn about the self-signed cert.')}`,
+    `       ${chalk.white('This is expected — click "Advanced" → "Proceed")')}`,
+    '',
+    `   ${chalk.white.bold('5.')} ${chalk.white('Bind admin cert to macOS Keychain')} ${chalk.yellow('(recommended)')}`,
+    `      ${chalk.dim('Makes the private key non-extractable — the P12 file')}`,
+    `      ${chalk.dim('and password can no longer grant panel access.')}`,
+    '',
+    `      ${chalk.cyan('npx @lamalibre/create-lamaste-admin')}`,
+    '',
+    `      ${chalk.dim('Run on your Mac after importing the P12 above.')}`,
+    `      ${chalk.dim('One-way operation — recovery requires server console.')}`,
+    '',
+    `   ${chalk.green('You can now disconnect from SSH.')}`,
+    `   ${chalk.green('The panel is running and accessible from your browser.')}`,
+    '',
+  ];
+
+  printBox(lines);
+}

package/src/lib/wrappers.js

@@ -0,0 +1,63 @@
+import { execa } from 'execa';
+import { existsSync } from 'node:fs';
+import { chmod, rename, rm, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { RETIRED_SUDOERS_WRAPPERS, SUDOERS_WRAPPERS } from './service-config.js';
+
+/**
+ * Install the root-owned programs the sudoers rules name, from this
+ * package's scripts/ directory, and remove the ones earlier versions
+ * installed that no rule references any more. Each script is syntax-checked
+ * first: an error would only surface when the panel needs it.
+ *
+ * Run before the sudoers file is written.
+ *
+ * @param {string} scriptsDir
+ * @param {(line: string) => void} report
+ */
+export async function installSudoersWrappers(scriptsDir, report) {
+  for (const w of SUDOERS_WRAPPERS) {
+    const src = join(scriptsDir, w.name);
+    if (!existsSync(src)) {
+      throw new Error(
+        `Sudoers wrapper script not found in package: ${src}. The provisioner package is incomplete.`,
+      );
+    }
+    report(`Validating ${w.name}...`);
+    if (w.interpreter === 'node') {
+      await execa('node', ['--check', src]);
+    } else {
+      await execa('bash', ['-n', src]);
+    }
+    report(`Installing ${w.name} to ${w.dest}...`);
+    await execa('install', ['-o', 'root', '-g', 'root', '-m', '0755', src, w.dest]);
+  }
+  for (const path of RETIRED_SUDOERS_WRAPPERS) {
+    await rm(path, { force: true });
+  }
+}
+
+const SUDOERS_PATH = '/etc/sudoers.d/lamaste';
+
+/**
+ * Install the sudoers file atomically: written under a name sudo ignores
+ * (it skips files in sudoers.d whose name contains a dot), checked with
+ * `visudo -c`, then renamed into place. An invalid file is never live, so a
+ * failure cannot lock sudo out.
+ *
+ * @param {string} content
+ */
+export async function installSudoersFile(content) {
+  const staged = `${SUDOERS_PATH}.lamaste-new`;
+  await writeFile(staged, content, { mode: 0o440 });
+  try {
+    await chmod(staged, 0o440);
+    await execa('visudo', ['-c', '-q', '-f', staged]);
+  } catch (error) {
+    await rm(staged, { force: true });
+    throw new Error(
+      `Sudoers validation failed — the installed rules are unchanged.\n${error.stderr || error.message}`,
+    );
+  }
+  await rename(staged, SUDOERS_PATH);
+}

package/src/tasks/gatekeeper.js

@@ -0,0 +1,233 @@
+import crypto from 'node:crypto';
+import { execa } from 'execa';
+import { writeFile, mkdir, cp, rm, lstat } from 'node:fs/promises';
+import { existsSync } from 'node:fs';
+import { setTimeout as sleep } from 'node:timers/promises';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+import { generateGatekeeperServiceUnit } from '../lib/service-config.js';
+import { lookupId } from '../lib/accounts.js';
+import { writeFileNoFollow } from '../lib/ownership.js';
+
+/**
+ * Deploy the gatekeeper package from vendor/ into <installDir>/gatekeeper,
+ * root-owned (the service runs it as lamaste, which may read but not change
+ * it). Shared by the full install and the redeploy.
+ *
+ * @param {string} vendorDir
+ * @param {string} installDir
+ * @returns {Promise<boolean>} false when the package is not bundled
+ */
+export async function deployGatekeeperPackage(vendorDir, installDir) {
+  const gatekeeperSrc = join(vendorDir, 'gatekeeper');
+  const gatekeeperDest = `${installDir}/gatekeeper`;
+  if (!existsSync(gatekeeperSrc)) return false;
+
+  await mkdir(gatekeeperDest, { recursive: true });
+  await cp(join(gatekeeperSrc, 'package.json'), join(gatekeeperDest, 'package.json'));
+  await rm(join(gatekeeperDest, 'dist'), { recursive: true, force: true });
+  await cp(join(gatekeeperSrc, 'dist'), join(gatekeeperDest, 'dist'), { recursive: true });
+  await execa('npm', ['install', '--production', '--ignore-scripts'], { cwd: gatekeeperDest });
+  return true;
+}
+
+async function exists(path) {
+  try {
+    await lstat(path);
+    return true;
+  } catch (err) {
+    if (err.code === 'ENOENT') return false;
+    throw err;
+  }
+}
+
+/**
+ * Gatekeeper deployment subtasks: deploy package, create state files,
+ * write systemd service, enable and start.
+ *
+ * @param {object} ctx  Shared installer context.
+ * @param {object} task Parent Listr2 task reference.
+ * @returns {import('listr2').ListrTask[]}
+ */
+export function gatekeeperTasks(ctx, task) {
+  const installDir = ctx.installDir;
+  const configDir = ctx.configDir;
+
+  const thisFile = fileURLToPath(import.meta.url);
+  const thisDir = dirname(thisFile);
+  const packageRoot = join(thisDir, '..', '..');
+  const vendorDir = join(packageRoot, 'vendor');
+
+  return task.newListr([
+    {
+      title: 'Deploying gatekeeper package',
+      task: async (_ctx, subtask) => {
+        subtask.output = 'Copying gatekeeper files and installing dependencies...';
+        if (!(await deployGatekeeperPackage(vendorDir, installDir))) {
+          subtask.output = 'Gatekeeper package not found in vendor, skipping';
+          return;
+        }
+        subtask.output = 'Gatekeeper package deployed';
+      },
+      rendererOptions: { persistentOutput: true },
+    },
+    {
+      title: 'Creating gatekeeper state files',
+      task: async (_ctx, subtask) => {
+        const groupsPath = join(configDir, 'groups.json');
+        const grantsPath = join(configDir, 'access-grants.json');
+        const settingsPath = join(configDir, 'gatekeeper.json');
+
+        // Create empty state files if they don't exist. The config
+        // directory belongs to lamaste: never write through what is there.
+        const owner = {
+          uid: await lookupId('user', 'lamaste'),
+          gid: await lookupId('group', 'lamaste'),
+          mode: 0o600,
+        };
+        if (!(await exists(groupsPath))) {
+          await writeFileNoFollow(groupsPath, '{"groups":[]}\n', owner);
+          subtask.output = 'Created groups.json';
+        }
+        if (!(await exists(grantsPath))) {
+          await writeFileNoFollow(grantsPath, '{"grants":[]}\n', owner);
+          subtask.output = 'Created access-grants.json';
+        }
+        if (!(await exists(settingsPath))) {
+          await writeFileNoFollow(settingsPath, '{}\n', owner);
+          subtask.output = 'Created gatekeeper.json';
+        }
+        subtask.output = 'State files ready';
+      },
+      rendererOptions: { persistentOutput: true },
+    },
+    {
+      title: 'Migrating legacy grants',
+      skip: () => {
+        const legacyPath = join(configDir, 'user-plugin-access.json');
+        return !existsSync(legacyPath) ? 'No legacy grants file found' : false;
+      },
+      task: async (_ctx, subtask) => {
+        // Migration is handled by the gatekeeper library on first startup.
+        // We just ensure the gatekeeper service will pick it up.
+        subtask.output = 'Legacy grants will be migrated on first gatekeeper startup';
+      },
+      rendererOptions: { persistentOutput: true },
+    },
+    {
+      title: 'Writing nginx proxy_cache config',
+      skip: () => {
+        const gatekeeperDest = `${installDir}/gatekeeper`;
+        return !existsSync(join(gatekeeperDest, 'dist'))
+          ? 'Gatekeeper package not deployed'
+          : false;
+      },
+      task: async (_ctx, subtask) => {
+        // Two-snippet design:
+        //   lamalibre-lamaste-authz-cache.conf        — http{} scope, defines the zone.
+        //   lamalibre-lamaste-authz-cache-loc.conf    — location{} scope, applies TTLs.
+        // Denials (403) are NOT cached so grant additions take effect
+        // immediately. Successful auth (200) is cached for 10s — matching
+        // the Cache-Control max-age Gatekeeper sets on the response. Omitting
+        // `proxy_ignore_headers Cache-Control` means nginx will honor the
+        // upstream max-age as a further shortening signal.
+        const cacheConfig = `# Lamaste Gatekeeper auth response cache zone
+# Scope: http{}. Included from nginx.conf.
+proxy_cache_path /var/cache/nginx/authz levels=1:2
+    keys_zone=lamaste_authz:1m
+    max_size=10m
+    inactive=5m;
+`;
+        const cacheLocConfig = `# Lamaste Gatekeeper auth_request cache policy
+# Scope: location{} using auth_request /authz/check.
+proxy_cache lamaste_authz;
+proxy_cache_key "$cookie_authelia_session$http_host";
+proxy_cache_valid 200 10s;
+proxy_cache_valid 403 0;
+proxy_cache_use_stale off;
+`;
+        const snippetPath = '/etc/nginx/snippets/lamalibre-lamaste-authz-cache.conf';
+        const locSnippetPath = '/etc/nginx/snippets/lamalibre-lamaste-authz-cache-loc.conf';
+
+        // Create snippets directory if needed
+        await execa('sudo', ['mkdir', '-p', '/etc/nginx/snippets']);
+
+        const tmpFile = `/tmp/nginx-authz-cache-${crypto.randomBytes(4).toString('hex')}`;
+        await writeFile(tmpFile, cacheConfig, 'utf-8');
+        await execa('sudo', ['mv', tmpFile, snippetPath]);
+        await execa('sudo', ['chmod', '644', snippetPath]);
+
+        const tmpLoc = `/tmp/nginx-authz-cache-loc-${crypto.randomBytes(4).toString('hex')}`;
+        await writeFile(tmpLoc, cacheLocConfig, 'utf-8');
+        await execa('sudo', ['mv', tmpLoc, locSnippetPath]);
+        await execa('sudo', ['chmod', '644', locSnippetPath]);
+
+        subtask.output = 'nginx proxy_cache config written';
+      },
+      rendererOptions: { persistentOutput: true },
+    },
+    {
+      title: 'Writing gatekeeper systemd service',
+      skip: () => {
+        const gatekeeperDest = `${installDir}/gatekeeper`;
+        return !existsSync(join(gatekeeperDest, 'dist'))
+          ? 'Gatekeeper package not deployed'
+          : false;
+      },
+      task: async (_ctx, subtask) => {
+        const serviceUnit = generateGatekeeperServiceUnit({ installDir, configDir });
+        const servicePath = '/etc/systemd/system/lamalibre-lamaste-gatekeeper.service';
+        await writeFile(servicePath, serviceUnit);
+        await execa('chmod', ['644', servicePath]);
+        subtask.output = 'Systemd service unit written';
+      },
+      rendererOptions: { persistentOutput: true },
+    },
+    {
+      title: 'Starting gatekeeper service',
+      skip: () => {
+        const gatekeeperDest = `${installDir}/gatekeeper`;
+        return !existsSync(join(gatekeeperDest, 'dist'))
+          ? 'Gatekeeper package not deployed'
+          : false;
+      },
+      task: async (_ctx, subtask) => {
+        await execa('systemctl', ['daemon-reload']);
+        await execa('systemctl', ['enable', 'lamalibre-lamaste-gatekeeper']);
+        await execa('systemctl', ['start', 'lamalibre-lamaste-gatekeeper']);
+
+        // Wait for startup
+        await sleep(2000);
+
+        const { stdout: status } = await execa('systemctl', [
+          'is-active',
+          'lamalibre-lamaste-gatekeeper',
+        ]);
+        if (status.trim() !== 'active') {
+          const { stdout: logs } = await execa('journalctl', [
+            '-u',
+            'lamalibre-lamaste-gatekeeper',
+            '-n',
+            '20',
+            '--no-pager',
+          ]);
+          throw new Error(`Gatekeeper service failed to start: ${status}\n${logs}`);
+        }
+
+        // Health check
+        try {
+          const { stdout } = await execa('curl', [
+            '-s',
+            '--max-time',
+            '5',
+            'http://127.0.0.1:9294/health',
+          ]);
+          subtask.output = `Gatekeeper service running. Health: ${stdout}`;
+        } catch (err) {
+          subtask.output = `Gatekeeper service active but health check pending (${err.message})`;
+        }
+      },
+      rendererOptions: { persistentOutput: true },
+    },
+  ]);
+}