@lamalibre/create-lamaste 4.0.0

package/vendor/server/src/commands/certs.js

@@ -0,0 +1,224 @@
+/**
+ * lamaste-server certs — Certificate status and renewal.
+ *
+ * Subcommands:
+ *   status     Show certificate expiry and renewal status
+ *   renew      Force certificate renewal via certbot
+ *   agents     List agent certificates
+ */
+
+import chalk from 'chalk';
+import { execa } from 'execa';
+import { getMtlsCerts, listAgentCerts } from '@lamalibre/lamaste/server';
+import { PKI_DIR } from '../config.js';
+import { exec } from '../exec.js';
+import { emit, emitStep, emitError, emitComplete } from '../ndjson.js';
+
+/**
+ * @param {string[]} args
+ * @param {{ json: boolean }} options
+ */
+export async function runCerts(args, { json }) {
+  const sub = args[0] || 'status';
+
+  switch (sub) {
+    case 'status':
+      return certStatus({ json });
+    case 'renew':
+      return certRenew({ json });
+    case 'agents':
+      return agentCerts({ json });
+    default:
+      printCertUsage();
+      process.exit(1);
+  }
+}
+
+function printCertUsage() {
+  const b = chalk.bold;
+  const c = chalk.cyan;
+  console.log(`
+${b('Usage:')} lamaste-server certs <subcommand>
+
+${b('Subcommands:')}
+  ${c('status')}     Show mTLS and Let's Encrypt certificate status (default)
+  ${c('renew')}      Force Let's Encrypt certificate renewal
+  ${c('agents')}     List agent certificates with expiry info
+`);
+}
+
+/**
+ * @param {{ json: boolean }} options
+ */
+async function certStatus({ json }) {
+  // mTLS certs
+  const mtlsCerts = await getMtlsCerts(PKI_DIR, exec);
+
+  // Let's Encrypt certs
+  let letsencryptCerts = [];
+  try {
+    const { stdout } = await execa('sudo', ['certbot', 'certificates', '--non-interactive'], {
+      timeout: 30000,
+    });
+    letsencryptCerts = parseCertbotOutput(stdout);
+  } catch {
+    // certbot may not be installed or may have no certs
+  }
+
+  if (json) {
+    emit({ mtls: mtlsCerts, letsencrypt: letsencryptCerts });
+    return;
+  }
+
+  const b = chalk.bold;
+  const c = chalk.cyan;
+  const g = chalk.green;
+  const y = chalk.yellow;
+  const r = chalk.red;
+  const d = chalk.dim;
+
+  console.log('');
+  console.log(b('  mTLS Certificates'));
+  console.log(d('  ' + '\u2500'.repeat(40)));
+
+  if (mtlsCerts.length === 0) {
+    console.log(`  ${d('No mTLS certificates found.')}`);
+  }
+
+  for (const cert of mtlsCerts) {
+    const label = cert.type === 'mtls-ca' ? 'CA' : 'Client';
+    const status = cert.expiringSoon ? y('expiring soon') : g('valid');
+    console.log(
+      `  ${b(label + ':')}  ${status}  ${d(`expires in ${cert.daysUntilExpiry} days`)}  ${d(cert.expiresAt)}`,
+    );
+  }
+
+  if (letsencryptCerts.length > 0) {
+    console.log('');
+    console.log(b("  Let's Encrypt Certificates"));
+    console.log(d('  ' + '\u2500'.repeat(40)));
+
+    for (const cert of letsencryptCerts) {
+      const daysLeft = cert.daysUntilExpiry;
+      const status = daysLeft <= 7 ? r('critical') : daysLeft <= 30 ? y('expiring') : g('valid');
+      console.log(`  ${c(cert.domain)}  ${status}  ${d(`expires in ${daysLeft} days`)}`);
+    }
+  }
+
+  console.log('');
+}
+
+/**
+ * @param {{ json: boolean }} options
+ */
+async function certRenew({ json }) {
+  if (json) emitStep('renew', 'running', 'Forcing certificate renewal');
+  else process.stderr.write('  Forcing certificate renewal...');
+
+  try {
+    await execa(
+      'sudo',
+      ['certbot', 'renew', '--force-renewal', '--no-random-sleep-on-renew', '--non-interactive'],
+      {
+        timeout: 120000,
+      },
+    );
+
+    // Reload nginx to pick up new certs
+    await execa('sudo', ['nginx', '-t']);
+    await execa('sudo', ['systemctl', 'reload', 'nginx']);
+
+    if (json) {
+      emitStep('renew', 'complete');
+      emitComplete({ renewed: true });
+    } else {
+      console.log(` ${chalk.green('ok')}`);
+      console.log('  Certificates renewed and nginx reloaded.\n');
+    }
+  } catch (err) {
+    const msg = err.stderr || err.message;
+    if (json) {
+      emitStep('renew', 'failed', msg);
+      emitError(msg);
+    } else {
+      console.log(` ${chalk.red('failed')}`);
+      console.error(`  ${chalk.red(msg)}\n`);
+    }
+    process.exit(1);
+  }
+}
+
+/**
+ * @param {{ json: boolean }} options
+ */
+async function agentCerts({ json }) {
+  const agents = await listAgentCerts(PKI_DIR);
+
+  if (json) {
+    emit({ agents });
+    return;
+  }
+
+  const b = chalk.bold;
+  const c = chalk.cyan;
+  const r = chalk.red;
+  const y = chalk.yellow;
+  const d = chalk.dim;
+
+  console.log('');
+  console.log(b('  Agent Certificates'));
+  console.log(d('  ' + '\u2500'.repeat(50)));
+
+  if (agents.length === 0) {
+    console.log(`  ${d('No agent certificates.')}`);
+    console.log('');
+    return;
+  }
+
+  for (const agent of agents) {
+    const revoked = agent.revoked ? r(' [REVOKED]') : '';
+    const expiring = agent.expiringSoon ? y(' [EXPIRING]') : '';
+    const method = agent.enrollmentMethod === 'hardware-bound' ? d(' (hw-bound)') : '';
+    const certType = agent.certType === 'plugin-agent' ? d(' (plugin)') : '';
+    console.log(`  ${c(agent.label)}${certType}${method}  ${d(agent.serial)}${revoked}${expiring}`);
+
+    if (agent.capabilities.length > 0) {
+      console.log(`    ${d('capabilities:')} ${agent.capabilities.join(', ')}`);
+    }
+
+    if (agent.expiresAt) {
+      console.log(`    ${d(`expires: ${agent.expiresAt}`)}`);
+    }
+  }
+  console.log('');
+}
+
+/**
+ * Parse certbot certificates output into structured data.
+ * @param {string} output
+ * @returns {Array<{ domain: string, daysUntilExpiry: number, expiresAt: string }>}
+ */
+function parseCertbotOutput(output) {
+  const certs = [];
+  const blocks = output.split('Certificate Name:').slice(1);
+
+  for (const block of blocks) {
+    const domainMatch = block.match(/Domains:\s+(.+)/);
+    const expiryMatch = block.match(/Expiry Date:\s+(\S+ \S+ \S+ \S+ \S+)/);
+
+    if (domainMatch && expiryMatch) {
+      const domain = domainMatch[1].trim().split(/\s+/)[0];
+      const expiryDate = new Date(expiryMatch[1]);
+      const daysUntilExpiry = Math.floor(
+        (expiryDate.getTime() - Date.now()) / (1000 * 60 * 60 * 24),
+      );
+      certs.push({
+        domain,
+        daysUntilExpiry,
+        expiresAt: expiryDate.toISOString(),
+      });
+    }
+  }
+
+  return certs;
+}

package/vendor/server/src/commands/chisel.js

@@ -0,0 +1,132 @@
+/**
+ * lamaste-server chisel — manage chisel tunnel-server credentials.
+ *
+ * Subcommands:
+ *   rotate-credential --label <label>   Mint a fresh chisel password for an
+ *                                        existing agent and restart the
+ *                                        chisel service. The agent must
+ *                                        re-fetch via
+ *                                        `lamaste-agent chisel refresh-credential`.
+ */
+
+import chalk from 'chalk';
+import { panelRequest } from '../panel-api.js';
+import { emit, emitError, emitComplete } from '../ndjson.js';
+
+/**
+ * @param {string[]} args
+ * @param {{ json: boolean }} options
+ */
+export async function runChisel(args, { json }) {
+  const sub = args[0];
+
+  switch (sub) {
+    case 'rotate-credential':
+      return rotateCredential(args.slice(1), { json });
+    default:
+      printChiselUsage();
+      process.exit(sub ? 1 : 0);
+  }
+}
+
+function printChiselUsage() {
+  const b = chalk.bold;
+  const c = chalk.cyan;
+  console.log(`
+${b('Usage:')} lamaste-server chisel <subcommand>
+
+${b('Subcommands:')}
+  ${c('rotate-credential')} --label <label>   Mint a new chisel credential for an agent
+
+${b('Notes:')}
+  After rotating, the affected agent must run
+  ${c('lamaste-agent chisel refresh-credential --label <label>')} to pick up
+  the new credential. Until then its tunnels will fail to authenticate.
+`);
+}
+
+/**
+ * @param {string[]} args
+ * @param {{ json: boolean }} options
+ */
+async function rotateCredential(args, { json }) {
+  const label = getArg(args, 'label');
+  if (!label) {
+    const msg = 'Error: --label is required';
+    if (json) emitError(msg);
+    else console.error(`\n  ${msg}\n`);
+    process.exit(1);
+  }
+
+  if (!json) {
+    process.stderr.write(`  Rotating chisel credential for ${chalk.cyan(label)}...`);
+  }
+
+  try {
+    // The panel API does the heavy lifting: writes the new credential, regenerates
+    // the chisel-users authfile, and restarts the chisel service.
+    const result = await panelRequest(
+      'POST',
+      `/api/agents/${encodeURIComponent(label)}/chisel-credential/rotate`,
+    );
+
+    if (json) {
+      emitComplete({
+        label: result.label,
+        user: result.user,
+        password: result.password,
+        restartOk: result.restartOk,
+        restartError: result.restartError || null,
+      });
+      return;
+    }
+
+    console.log(` ${chalk.green('ok')}`);
+    console.log('');
+    console.log(`  ${chalk.bold('user:')}      ${chalk.cyan(result.user)}`);
+    // SECURITY: the rotated chisel password is NEVER written to a log sink
+    // (stdout/stderr/console). It is persisted server-side in the chisel
+    // credentials store (mode 0600). Scripted consumers must use the
+    // non-interactive JSON mode (`--json`), which emits the password in
+    // the NDJSON `complete` event for direct programmatic capture.
+    console.log(
+      `  ${chalk.bold('password:')}  ${chalk.dim('*** (redacted — use --json to retrieve)')}`,
+    );
+    if (!result.restartOk) {
+      console.log('');
+      console.log(
+        `  ${chalk.yellow('warning:')} chisel service restart failed: ${result.restartError}`,
+      );
+      console.log(
+        `  ${chalk.dim('Run `sudo systemctl restart chisel` manually before any tunnels reconnect.')}`,
+      );
+    }
+    console.log('');
+    console.log(
+      `  ${chalk.dim('On the agent host, run:')} ${chalk.cyan(`lamaste-agent chisel refresh-credential --label ${label}`)}`,
+    );
+    console.log('');
+  } catch (err) {
+    if (json) {
+      emitError(err.message);
+    } else {
+      console.log(` ${chalk.red('failed')}`);
+      console.error(`  ${chalk.red(err.message)}\n`);
+    }
+    process.exit(1);
+  }
+
+  // Silence linter for unused emit
+  void emit;
+}
+
+/**
+ * @param {string[]} args
+ * @param {string} name
+ * @returns {string | null}
+ */
+function getArg(args, name) {
+  const idx = args.indexOf(`--${name}`);
+  if (idx === -1 || idx + 1 >= args.length) return null;
+  return args[idx + 1];
+}

package/vendor/server/src/commands/logs.js

@@ -0,0 +1,49 @@
+/**
+ * lamaste-server logs — View server log output.
+ *
+ * Wraps journalctl for the panel service. Supports --follow and --lines.
+ */
+
+import { execa } from 'execa';
+import { PANEL_SERVICE, GATEKEEPER_SERVICE } from '../config.js';
+
+/**
+ * @param {string[]} args  Remaining CLI arguments after 'logs'
+ * @param {{ json: boolean }} options
+ */
+export async function runLogs(args, { json }) {
+  const follow = args.includes('--follow') || args.includes('-f');
+  const service = args.includes('--gatekeeper') ? GATEKEEPER_SERVICE : PANEL_SERVICE;
+
+  let lines = '50';
+  for (let i = 0; i < args.length; i++) {
+    if ((args[i] === '--lines' || args[i] === '-n') && args[i + 1]) {
+      lines = args[i + 1];
+    }
+  }
+
+  const journalArgs = ['-u', service, '-n', lines, '--no-pager'];
+
+  if (follow) {
+    journalArgs.push('-f');
+  }
+
+  if (json) {
+    journalArgs.push('-o', 'json');
+  }
+
+  // For --follow we need to stream output to the user's terminal.
+  // For non-follow we capture and print.
+  if (follow) {
+    const proc = execa('journalctl', journalArgs, { stdio: 'inherit' });
+    // Let the user Ctrl+C to stop
+    await proc.catch((err) => {
+      // SIGINT/SIGTERM are expected when tailing
+      if (err.signal === 'SIGINT' || err.signal === 'SIGTERM') return;
+      throw err;
+    });
+  } else {
+    const { stdout } = await execa('journalctl', journalArgs);
+    process.stdout.write(stdout + '\n');
+  }
+}