@lamalibre/create-lamaste 4.0.0

package/vendor/server/src/commands/reset-admin.js

@@ -0,0 +1,478 @@
+/**
+ * lamaste-server reset-admin — Emergency recovery tool for admin authentication.
+ *
+ * Requires root access on the server (run via DigitalOcean console).
+ * Reverts admin auth from hardware-bound back to P12:
+ *
+ * 1. Generate new admin keypair + CSR + sign + P12
+ * 2. Revoke old hardware-bound admin cert
+ * 3. Set adminAuthMode: 'p12' in panel.json
+ * 4. Clear 2FA if enabled
+ * 5. Re-enable IP:9292 vhost
+ * 6. Restart serverd + reload nginx
+ * 7. Print new P12 password
+ *
+ * The PKI directory and panel.json belong to the lamaste user — and the
+ * panel, if compromised, could have left symlinks there for root to write
+ * through. So every file operation inside them runs as lamaste (openssl, cp,
+ * chmod) or creates a fresh file (O_EXCL | O_NOFOLLOW) that is renamed into
+ * place; root never writes through an existing path there.
+ */
+
+import crypto from 'node:crypto';
+import { readFile, rename, access, constants, unlink, open, rm } from 'node:fs/promises';
+import { basename, dirname, join } from 'node:path';
+import chalk from 'chalk';
+import { execa } from 'execa';
+import { CONFIG_PATH, PKI_DIR, PANEL_SERVICE, STATE_DIR } from '../config.js';
+import { emitStep, emitError, emitComplete } from '../ndjson.js';
+
+/**
+ * Atomically write the P12 password to a file (temp -> fsync -> chmod -> rename).
+ * @param {string} destPath
+ * @param {string} password
+ */
+async function atomicWritePassword(destPath, password) {
+  const tmpPath = `${destPath}.tmp`;
+  // Best-effort cleanup of a stale temp from a prior crashed run so 'wx' below
+  // does not spuriously fail.
+  await unlink(tmpPath).catch(() => {});
+  // Use 'wx' to fail if a stale temp file exists (avoids races).
+  const fh = await open(tmpPath, 'wx', 0o600);
+  try {
+    await fh.writeFile(password, 'utf-8');
+    await fh.sync();
+  } finally {
+    await fh.close();
+  }
+  await rename(tmpPath, destPath);
+}
+
+/**
+ * uid/gid of the lamaste user, as execa options: commands run with them act
+ * inside the lamaste-owned PKI directory with lamaste's rights only.
+ *
+ * @returns {Promise<{ uid: number, gid: number }>}
+ */
+async function lamasteIdentity() {
+  const uid = Number.parseInt((await execa('id', ['-u', 'lamaste'])).stdout.trim(), 10);
+  const gid = Number.parseInt((await execa('id', ['-g', 'lamaste'])).stdout.trim(), 10);
+  if (!Number.isInteger(uid) || !Number.isInteger(gid)) {
+    throw new Error('Cannot resolve the lamaste user');
+  }
+  return { uid, gid };
+}
+
+/**
+ * Write `content` to `destPath` (in a lamaste-owned directory) as a fresh
+ * file owned by `owner`, renamed into place.
+ *
+ * @param {string} destPath
+ * @param {string} content
+ * @param {{ uid: number, gid: number }} owner
+ * @param {number} mode
+ */
+async function writeOwnedFile(destPath, content, owner, mode) {
+  const tmp = join(
+    dirname(destPath),
+    `.${basename(destPath)}.${crypto.randomBytes(8).toString('hex')}`,
+  );
+  const fh = await open(
+    tmp,
+    constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW,
+    0o600,
+  );
+  try {
+    await fh.writeFile(content, 'utf-8');
+    await fh.chown(owner.uid, owner.gid);
+    await fh.chmod(mode);
+    await fh.sync();
+  } catch (err) {
+    await fh.close();
+    await rm(tmp, { force: true });
+    throw err;
+  }
+  await fh.close();
+  await rename(tmp, destPath);
+}
+
+/**
+ * Add a certificate serial to the panel's revocation list (`revoked_certs`
+ * in `state.db`). Runs as lamaste: the database is in WAL mode, and a write
+ * as root could leave root-owned `-wal`/`-shm` files the panel cannot open.
+ * The serial and label reach the child through its environment, never
+ * through the code it runs.
+ *
+ * @param {string} serial
+ * @param {string} label
+ * @param {{ uid: number, gid: number }} lamaste
+ */
+async function revokeInStateDb(serial, label, lamaste) {
+  const script = `
+    import { DatabaseSync } from 'node:sqlite';
+    const db = new DatabaseSync(process.env.STATE_DB);
+    db.exec('PRAGMA busy_timeout = 5000');
+    db.exec('BEGIN IMMEDIATE');
+    try {
+      const seen = db.prepare('SELECT serial FROM revoked_certs WHERE serial = ?').get(process.env.SERIAL);
+      if (!seen) {
+        db.prepare('INSERT INTO revoked_certs (serial, label, revoked_at) VALUES (?, ?, ?)')
+          .run(process.env.SERIAL, process.env.LABEL, new Date().toISOString());
+      }
+      db.exec('COMMIT');
+    } catch (err) {
+      db.exec('ROLLBACK');
+      throw err;
+    }
+    db.close();
+  `;
+  await execa(process.execPath, ['--no-warnings', '--input-type=module', '-e', script], {
+    ...lamaste,
+    cwd: STATE_DIR,
+    env: { STATE_DB: `${STATE_DIR}/state.db`, SERIAL: serial, LABEL: label },
+    extendEnv: false,
+  });
+}
+
+/**
+ * @param {{ json: boolean, passwordFile?: string }} options
+ */
+export async function runResetAdmin({ json, passwordFile }) {
+  // Verify running as root
+  if (process.getuid && process.getuid() !== 0) {
+    const msg = 'lamaste-server reset-admin must be run as root.';
+    if (json) {
+      emitError(msg);
+    } else {
+      console.error(`\n  Error: ${msg}`);
+      console.error(`  Usage: sudo lamaste-server reset-admin\n`);
+    }
+    process.exit(1);
+  }
+
+  if (!json) {
+    console.log('');
+    console.log('  Lamaste Admin Reset');
+    console.log('  Reverting admin authentication to P12...');
+    console.log('');
+  }
+
+  // 1. Read current config
+  if (json) emitStep('read-config', 'running');
+  let config;
+  try {
+    const raw = await readFile(CONFIG_PATH, 'utf-8');
+    config = JSON.parse(raw);
+    if (json) emitStep('read-config', 'complete');
+  } catch (err) {
+    const msg = `Cannot read config at ${CONFIG_PATH}: ${err.message}`;
+    if (json) {
+      emitStep('read-config', 'failed', msg);
+      emitError(msg);
+    } else {
+      console.error(`  Error: ${msg}`);
+    }
+    process.exit(1);
+  }
+
+  const lamaste = await lamasteIdentity();
+
+  // 2. Verify CA exists
+  try {
+    await access(`${PKI_DIR}/ca.key`, constants.R_OK);
+    await access(`${PKI_DIR}/ca.crt`, constants.R_OK);
+  } catch {
+    const msg = `CA key/cert not found in ${PKI_DIR}`;
+    if (json) emitError(msg);
+    else console.error(`  Error: ${msg}`);
+    process.exit(1);
+  }
+
+  // 3. Read old admin cert serial for revocation
+  if (json) emitStep('generate-cert', 'running');
+  let oldSerial = '';
+  try {
+    const { stdout } = await execa(
+      'openssl',
+      ['x509', '-in', `${PKI_DIR}/client.crt`, '-serial', '-noout'],
+      lamaste,
+    );
+    const match = stdout.match(/serial=([A-Fa-f0-9]+)/);
+    oldSerial = match ? match[1] : '';
+  } catch {
+    // Old cert may not exist
+  }
+
+  // 4. Generate new admin key
+  if (!json) console.log('  Generating new admin private key...');
+  await execa('openssl', ['genrsa', '-out', `${PKI_DIR}/client.key.new`, '4096'], lamaste);
+
+  // 5. Create CSR
+  if (!json) console.log('  Creating certificate signing request...');
+  await execa(
+    'openssl',
+    [
+      'req',
+      '-new',
+      '-key',
+      `${PKI_DIR}/client.key.new`,
+      '-out',
+      `${PKI_DIR}/client.csr`,
+      '-subj',
+      '/CN=admin/O=Lamaste',
+    ],
+    lamaste,
+  );
+
+  // 6. Sign with CA
+  if (!json) console.log('  Signing certificate with CA...');
+  await execa(
+    'openssl',
+    [
+      'x509',
+      '-req',
+      '-in',
+      `${PKI_DIR}/client.csr`,
+      '-CA',
+      `${PKI_DIR}/ca.crt`,
+      '-CAkey',
+      `${PKI_DIR}/ca.key`,
+      '-CAcreateserial',
+      '-out',
+      `${PKI_DIR}/client.crt.new`,
+      '-days',
+      '730',
+      '-sha256',
+    ],
+    lamaste,
+  );
+
+  // 7. Create P12 bundle
+  const p12Password = crypto.randomBytes(16).toString('hex');
+  if (!json) console.log('  Creating PKCS12 bundle...');
+  await execa(
+    'openssl',
+    [
+      'pkcs12',
+      '-export',
+      '-keypbe',
+      'PBE-SHA1-3DES',
+      '-certpbe',
+      'PBE-SHA1-3DES',
+      '-macalg',
+      'sha1',
+      '-out',
+      `${PKI_DIR}/client.p12.new`,
+      '-inkey',
+      `${PKI_DIR}/client.key.new`,
+      '-in',
+      `${PKI_DIR}/client.crt.new`,
+      '-certfile',
+      `${PKI_DIR}/ca.crt`,
+      '-passout',
+      'stdin',
+    ],
+    { ...lamaste, input: p12Password },
+  );
+
+  if (json) emitStep('generate-cert', 'complete');
+
+  // 8. Back up old files
+  if (json) emitStep('backup', 'running');
+  else console.log('  Backing up old certificates...');
+  for (const ext of ['key', 'crt', 'p12']) {
+    try {
+      await access(`${PKI_DIR}/client.${ext}`, constants.F_OK);
+      await execa(
+        'cp',
+        ['--', `${PKI_DIR}/client.${ext}`, `${PKI_DIR}/client.${ext}.bak`],
+        lamaste,
+      );
+    } catch {
+      // Old file may not exist
+    }
+  }
+  if (json) emitStep('backup', 'complete');
+
+  // 9. Move new files into place (atomic rename)
+  if (json) emitStep('install-cert', 'running');
+  else console.log('  Installing new certificates...');
+  await rename(`${PKI_DIR}/client.key.new`, `${PKI_DIR}/client.key`);
+  await rename(`${PKI_DIR}/client.crt.new`, `${PKI_DIR}/client.crt`);
+  await rename(`${PKI_DIR}/client.p12.new`, `${PKI_DIR}/client.p12`);
+
+  // 10. Persist P12 password for future redeployments and for NDJSON consumers.
+  // Atomic write (temp -> fsync -> chmod 0600 -> rename) so partial writes never
+  // expose the secret. Hard-fail if the write fails — never fall back to emitting
+  // the password value over stdout.
+  const defaultPasswordPath = `${PKI_DIR}/.p12-password`;
+  const targetPasswordPath = passwordFile || defaultPasswordPath;
+  try {
+    await atomicWritePassword(defaultPasswordPath, p12Password);
+    if (targetPasswordPath !== defaultPasswordPath) {
+      await atomicWritePassword(targetPasswordPath, p12Password);
+    }
+  } catch (err) {
+    const msg = `Failed to write P12 password file: ${err.message}`;
+    if (json) {
+      emitError(msg);
+    } else {
+      console.error(`  Error: ${msg}`);
+    }
+    process.exit(1);
+  }
+
+  // 11. Clean up
+  await unlink(`${PKI_DIR}/client.csr`).catch(() => {});
+  await unlink(`${PKI_DIR}/ca.srl`).catch(() => {});
+
+  // 12. Set file permissions (the files are lamaste's: openssl ran as lamaste)
+  await execa('chmod', ['600', `${PKI_DIR}/client.key`, `${PKI_DIR}/client.p12`], lamaste);
+  await execa('chmod', ['644', `${PKI_DIR}/client.crt`], lamaste);
+
+  if (json) emitStep('install-cert', 'complete');
+
+  // 13. Revoke old cert — in the panel's revocation list (state.db,
+  // revoked_certs), which the mTLS middleware checks on every request.
+  if (oldSerial) {
+    if (json) emitStep('revoke-old', 'running');
+    else console.log('  Revoking old admin certificate...');
+    try {
+      await revokeInStateDb(oldSerial, 'admin (reset-admin)', lamaste);
+    } catch (err) {
+      // The new certificate is already installed; a revocation that did not
+      // happen must not pass silently — the old certificate would still work.
+      const msg = `Could not revoke the old admin certificate (serial ${oldSerial}): ${err.stderr || err.message}`;
+      if (json) {
+        emitStep('revoke-old', 'failed', msg);
+        emitError(msg);
+      } else {
+        console.error(`  Error: ${msg}`);
+      }
+      process.exit(1);
+    }
+    if (json) emitStep('revoke-old', 'complete');
+  }
+
+  // 14. Clear 2FA if enabled
+  if (config.panel2fa && config.panel2fa.enabled) {
+    config.panel2fa = { enabled: false, secret: null, setupComplete: false };
+    config.sessionSecret = null;
+    if (!json) console.log('  Two-factor authentication has been disabled.');
+  }
+
+  // 15. Re-enable IP vhost if it was disabled by 2FA
+  if (json) emitStep('config', 'running');
+  try {
+    const ipAvailable = '/etc/nginx/sites-available/lamalibre-lamaste-panel-ip';
+    const ipEnabled = '/etc/nginx/sites-enabled/lamalibre-lamaste-panel-ip';
+    await access(ipAvailable, constants.F_OK);
+    await execa('ln', ['-sf', ipAvailable, ipEnabled]);
+    if (!json) console.log('  IP vhost re-enabled.');
+  } catch {
+    // IP vhost may not exist
+  }
+
+  // 16. Update config
+  if (!json) console.log('  Updating panel configuration...');
+  config.adminAuthMode = 'p12';
+  await writeOwnedFile(CONFIG_PATH, JSON.stringify(config, null, 2) + '\n', lamaste, 0o640);
+  if (json) emitStep('config', 'complete');
+
+  // 17. Restart serverd
+  if (json) emitStep('restart', 'running');
+  else console.log('  Restarting panel server...');
+  try {
+    await execa('systemctl', ['restart', PANEL_SERVICE]);
+    if (!json) console.log('  Panel server restarted successfully.');
+  } catch (err) {
+    const msg = `panel server restart failed: ${err.stderr || err.message}`;
+    if (!json) {
+      console.error(`  Warning: ${msg}`);
+      console.error(`  You may need to restart it manually: systemctl restart ${PANEL_SERVICE}`);
+    }
+  }
+
+  // 18. Reload nginx
+  if (!json) console.log('  Reloading nginx...');
+  try {
+    await execa('nginx', ['-t']);
+    await execa('systemctl', ['reload', 'nginx']);
+    if (!json) console.log('  nginx reloaded successfully.');
+  } catch (err) {
+    const msg = `nginx reload failed: ${err.stderr || err.message}`;
+    if (!json) {
+      console.error(`  Warning: ${msg}`);
+      console.error('  You may need to restart nginx manually: systemctl restart nginx');
+    }
+  }
+
+  if (json) {
+    emitStep('restart', 'complete');
+    // SECURITY: never emit the password value in NDJSON. The password lives at
+    // p12PasswordPath (mode 0600). Consumers (the desktop app) read the file
+    // directly via privileged escalation (e.g. `pkexec cat`) and store it in
+    // the OS keychain. The path-only contract avoids leaks into Tauri event
+    // logs, journald, or anything else that captures NDJSON.
+    emitComplete({ p12PasswordPath: targetPasswordPath });
+    return;
+  }
+
+  // 19. Determine IP for scp command
+  let serverIp = '';
+  try {
+    const { stdout } = await execa('hostname', ['-I']);
+    const first = stdout.trim().split(/\s+/)[0];
+    if (first) serverIp = first;
+  } catch {
+    serverIp = '<server-ip>';
+  }
+
+  // 20. Print result
+  const b = chalk.bold;
+  const c = chalk.cyan;
+  const d = chalk.dim;
+
+  console.log('');
+  console.log('  ' + '='.repeat(44));
+  console.log(b('  Admin certificate has been reset to P12.'));
+  console.log(b('  Panel 2FA has been disabled (if it was on).'));
+  console.log(b('  IP:9292 access has been restored.'));
+  console.log('');
+  console.log('  1. Download your client certificate:');
+  console.log('');
+  console.log(`     ${c(`scp root@${serverIp}:${PKI_DIR}/client.p12 .`)}`);
+  console.log('');
+  console.log('  2. Import client.p12 into your browser:');
+  console.log('');
+  console.log(`     ${d('macOS:   Double-click the file \u2192 Keychain Access')}`);
+  console.log(
+    `     ${d('         \u2192 select "System" keychain \u2192 enter the password below')}`,
+  );
+  console.log(
+    `     ${d('         \u2192 find cert \u2192 double-click \u2192 Trust \u2192 Always Trust')}`,
+  );
+  console.log(`     ${d('Linux:   Chrome \u2192 Settings \u2192 Privacy & Security')}`);
+  console.log(`     ${d('         \u2192 Security \u2192 Manage certificates \u2192 Import')}`);
+  console.log(`     ${d('Windows: Double-click the file \u2192 Certificate Import Wizard')}`);
+  console.log('');
+  // SECURITY: the new certificate password is NEVER written to a log sink
+  // (stdout/stderr/console). It is persisted at ${defaultPasswordPath}
+  // (mode 0600, root-readable only) — the single source of truth for
+  // redeployment scripts and for the desktop app, which reads it via
+  // privileged escalation. Operators retrieve the password with:
+  //   sudo cat ${defaultPasswordPath}
+  console.log('  3. Certificate password:');
+  console.log('');
+  console.log(`     ${d(`stored at ${defaultPasswordPath} (mode 0600)`)}`);
+  console.log(`     ${d(`retrieve with: sudo cat ${defaultPasswordPath}`)}`);
+  console.log('');
+  console.error(`     ${b('*** (redacted — read the password file above)')}`);
+  console.log('');
+  console.log('  4. Open the Lamaste panel:');
+  console.log('');
+  console.log(`     ${c(`https://${serverIp}:9292`)}`);
+  console.log('');
+  console.log('  ' + '='.repeat(44));
+  console.log('');
+}

package/vendor/server/src/commands/restart.js

@@ -0,0 +1,94 @@
+/**
+ * lamaste-server restart — Restart the panel server and optionally the gatekeeper.
+ *
+ * Waits for the service to reach active state after restart.
+ */
+
+import chalk from 'chalk';
+import { execa } from 'execa';
+import { PANEL_SERVICE, GATEKEEPER_SERVICE } from '../config.js';
+import { emitStep, emitError, emitComplete } from '../ndjson.js';
+
+const HEALTH_CHECK_ATTEMPTS = 10;
+const HEALTH_CHECK_INTERVAL_MS = 1000;
+
+/**
+ * @param {string[]} args  Remaining CLI arguments after 'restart'
+ * @param {{ json: boolean }} options
+ */
+export async function runRestart(args, { json }) {
+  const all = args.includes('--all');
+  const gatekeeperOnly = args.includes('--gatekeeper');
+  const services = gatekeeperOnly
+    ? [GATEKEEPER_SERVICE]
+    : all
+      ? [PANEL_SERVICE, GATEKEEPER_SERVICE]
+      : [PANEL_SERVICE];
+
+  for (const service of services) {
+    if (json) {
+      emitStep(service, 'running', `Restarting ${service}`);
+    } else {
+      process.stderr.write(`  Restarting ${chalk.cyan(service)}...`);
+    }
+
+    try {
+      await execa('systemctl', ['restart', service]);
+    } catch (err) {
+      const msg = `Failed to restart ${service}: ${err.stderr || err.message}`;
+      if (json) {
+        emitStep(service, 'failed', msg);
+        emitError(msg);
+      } else {
+        console.error(` ${chalk.red('failed')}`);
+        console.error(`  ${chalk.red(msg)}`);
+      }
+      process.exit(1);
+    }
+
+    // Wait for service to become active
+    let healthy = false;
+    for (let i = 0; i < HEALTH_CHECK_ATTEMPTS; i++) {
+      await sleep(HEALTH_CHECK_INTERVAL_MS);
+      try {
+        const { stdout } = await execa('systemctl', ['is-active', service]);
+        if (stdout.trim() === 'active') {
+          healthy = true;
+          break;
+        }
+      } catch {
+        // Not active yet, retry
+      }
+    }
+
+    if (!healthy) {
+      const msg = `Service ${service} did not become active within ${HEALTH_CHECK_ATTEMPTS} seconds`;
+      if (json) {
+        emitStep(service, 'failed', msg);
+        emitError(msg);
+      } else {
+        console.error(` ${chalk.yellow('timeout')}`);
+        console.error(`  ${chalk.yellow(msg)}`);
+      }
+      process.exit(1);
+    }
+
+    if (json) {
+      emitStep(service, 'complete');
+    } else {
+      console.log(` ${chalk.green('ok')}`);
+    }
+  }
+
+  if (json) {
+    emitComplete({ restarted: services });
+  }
+}
+
+/**
+ * @param {number} ms
+ * @returns {Promise<void>}
+ */
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}