@lamalibre/create-lamaste 4.0.0

package/vendor/serverd/src/lib/gatekeeper-client.js

@@ -0,0 +1,135 @@
+/**
+ * Tiny gatekeeper admin-API client for callers other than the
+ * /api/gatekeeper/* proxy routes.
+ *
+ * Reads the shared secret on first use (cached for the process lifetime)
+ * and forwards a request to http://127.0.0.1:9294/api/...
+ *
+ * Used by the user-delete route to cascade-revoke grants belonging to a
+ * deleted Authelia user, and by other internal callers that need to talk
+ * to gatekeeper without going through the panel's own mTLS layer.
+ */
+
+import { readFile } from 'node:fs/promises';
+import path from 'node:path';
+import { getConfigPath } from './config.js';
+
+const GATEKEEPER_BASE = 'http://127.0.0.1:9294';
+let cachedSecret = null;
+let secretLoaded = false;
+
+/**
+ * Load the gatekeeper API secret. Supports both the new JSON envelope
+ * (`gatekeeper-secret.json`) written by the gatekeeper service and the
+ * legacy plain-text file (`gatekeeper-secret`). Returns null if neither
+ * exists — callers must treat this as "gatekeeper not installed".
+ */
+async function loadSecret() {
+  if (secretLoaded) return cachedSecret;
+  secretLoaded = true;
+
+  const configDir = path.dirname(getConfigPath());
+
+  // Prefer the JSON envelope written by recent gatekeeper builds
+  try {
+    const raw = await readFile(path.join(configDir, 'gatekeeper-secret.json'), 'utf-8');
+    const parsed = JSON.parse(raw);
+    if (parsed && typeof parsed.secret === 'string' && parsed.secret.length > 0) {
+      cachedSecret = parsed.secret;
+      return cachedSecret;
+    }
+  } catch {
+    // Fall through to legacy
+  }
+
+  // Legacy plain-text fallback
+  try {
+    const raw = (await readFile(path.join(configDir, 'gatekeeper-secret'), 'utf-8')).trim();
+    if (raw.length > 0) {
+      cachedSecret = raw;
+      return cachedSecret;
+    }
+  } catch {
+    // No secret available
+  }
+
+  cachedSecret = null;
+  return cachedSecret;
+}
+
+/**
+ * Result envelope.
+ *
+ * @typedef {{ ok: true, statusCode: number, data: unknown }
+ *          | { ok: false, statusCode: number, error: string, reason: 'unreachable' | 'no-secret' | 'http-error' }
+ *          } GatekeeperResult
+ */
+
+/**
+ * Forward a request to the gatekeeper service.
+ *
+ * Network failures (ECONNREFUSED, etc.) and missing-secret conditions
+ * are reported as `{ ok: false, reason: ... }` rather than thrown — the
+ * panel server treats gatekeeper as best-effort during cascade operations.
+ *
+ * @param {string} method
+ * @param {string} apiPath - e.g. "/api/grants?principalType=user&principalId=alice"
+ * @param {unknown} [body]
+ * @returns {Promise<GatekeeperResult>}
+ */
+export async function gatekeeperRequest(method, apiPath, body) {
+  const secret = await loadSecret();
+  if (!secret) {
+    return {
+      ok: false,
+      statusCode: 503,
+      error: 'gatekeeper secret not available',
+      reason: 'no-secret',
+    };
+  }
+
+  const url = `${GATEKEEPER_BASE}${apiPath}`;
+  // Only set Content-Type when we actually have a body. Fastify rejects
+  // `Content-Type: application/json` with an empty body (e.g. DELETE) as
+  // 400 Bad Request.
+  const headers = { 'X-Gatekeeper-Secret': secret };
+  const options = { method, headers };
+  if (body !== undefined && body !== null) {
+    headers['Content-Type'] = 'application/json';
+    options.body = typeof body === 'string' ? body : JSON.stringify(body);
+  }
+
+  let response;
+  try {
+    response = await fetch(url, options);
+  } catch (err) {
+    return {
+      ok: false,
+      statusCode: 503,
+      error: `gatekeeper unreachable: ${err.message}`,
+      reason: 'unreachable',
+    };
+  }
+
+  const text = await response.text();
+  let data;
+  try {
+    data = text.length > 0 ? JSON.parse(text) : null;
+  } catch {
+    data = { raw: text };
+  }
+
+  if (response.status >= 400) {
+    return {
+      ok: false,
+      statusCode: response.status,
+      error:
+        data && typeof data === 'object' && 'error' in data && typeof data.error === 'string'
+          ? data.error
+          : `gatekeeper returned HTTP ${response.status}`,
+      reason: 'http-error',
+    };
+  }
+
+  return { ok: true, statusCode: response.status, data };
+}

package/vendor/serverd/src/lib/invite-page.js

@@ -0,0 +1,281 @@
+import crypto from 'node:crypto';
+import { mkdir, open, rename, rm } from 'node:fs/promises';
+import path from 'node:path';
+
+const INVITE_DIR = '/var/www/lamaste/invite';
+
+/**
+ * Generate and write the invitation acceptance HTML page. The web root
+ * belongs to the lamaste user (group www-data, setgid directories), so no
+ * privileges are needed; the file is 0640 and nginx reads it via the group.
+ */
+export async function writeInvitePage() {
+  const html = generateInvitePageHtml();
+
+  await mkdir(INVITE_DIR, { recursive: true, mode: 0o750 });
+
+  const dest = path.join(INVITE_DIR, 'index.html');
+  const tmp = path.join(INVITE_DIR, `.index-${crypto.randomBytes(8).toString('hex')}.html`);
+  try {
+    const fh = await open(tmp, 'wx', 0o640);
+    try {
+      await fh.writeFile(html, 'utf-8');
+      await fh.chmod(0o640);
+      await fh.sync();
+    } finally {
+      await fh.close();
+    }
+    await rename(tmp, dest);
+  } catch (err) {
+    await rm(tmp, { force: true }).catch(() => {});
+    throw err;
+  }
+}
+
+function generateInvitePageHtml() {
+  return `<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>Lamaste — Accept Invitation</title>
+  <style>
+    *, *::before, *::after { box-sizing: border-box; margin: 0; padding: 0; }
+    body {
+      font-family: ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, monospace;
+      background: #09090b; color: #a1a1aa;
+      min-height: 100vh; display: flex; align-items: center; justify-content: center;
+      padding: 1.5rem;
+    }
+    .card {
+      background: #18181b; border: 1px solid #27272a; border-radius: 0.75rem;
+      max-width: 480px; width: 100%; padding: 2.5rem;
+    }
+    .icon { text-align: center; font-size: 3rem; margin-bottom: 1rem; }
+    h1 { color: #f4f4f5; font-size: 1.25rem; text-align: center; margin-bottom: 0.5rem; }
+    .subtitle { text-align: center; margin-bottom: 2rem; font-size: 0.875rem; }
+    .field { margin-bottom: 1.25rem; }
+    .field label {
+      display: block; font-size: 0.8125rem; color: #a1a1aa;
+      margin-bottom: 0.375rem; font-weight: 600;
+    }
+    .field input {
+      width: 100%; padding: 0.625rem 0.875rem;
+      background: #09090b; border: 1px solid #27272a; border-radius: 0.5rem;
+      color: #f4f4f5; font-family: inherit; font-size: 0.875rem;
+      outline: none; transition: border-color 0.15s;
+    }
+    .field input:focus { border-color: #22d3ee; }
+    .field input:disabled { color: #71717a; cursor: not-allowed; }
+    .field .hint { font-size: 0.75rem; color: #52525b; margin-top: 0.25rem; }
+    .error-msg {
+      background: #1c0f0f; border: 1px solid #7f1d1d; border-radius: 0.5rem;
+      padding: 0.75rem 1rem; margin-bottom: 1.25rem;
+      font-size: 0.8125rem; color: #fca5a5;
+    }
+    .success-card { text-align: center; }
+    .success-card h1 { color: #4ade80; margin-bottom: 1rem; }
+    .success-card p { margin-bottom: 1.5rem; font-size: 0.875rem; line-height: 1.6; }
+    .btn {
+      display: block; width: 100%;
+      background: #22d3ee; color: #09090b; font-weight: 700;
+      border: none; border-radius: 0.5rem; padding: 0.75rem;
+      font-size: 0.875rem; cursor: pointer; font-family: inherit;
+      transition: background-color 0.15s;
+    }
+    .btn:hover { background: #06b6d4; }
+    .btn:disabled { opacity: 0.5; cursor: not-allowed; }
+    .btn-outline {
+      background: transparent; border: 1px solid #27272a; color: #a1a1aa;
+    }
+    .btn-outline:hover { border-color: #22d3ee; color: #f4f4f5; }
+    .loading {
+      display: flex; align-items: center; justify-content: center; gap: 0.5rem;
+      padding: 3rem 0; font-size: 0.875rem;
+    }
+    .spinner {
+      width: 1.25rem; height: 1.25rem;
+      border: 2px solid #27272a; border-top-color: #22d3ee;
+      border-radius: 50%; animation: spin 0.6s linear infinite;
+    }
+    @keyframes spin { to { transform: rotate(360deg); } }
+    .detail-row {
+      display: flex; justify-content: space-between; align-items: center;
+      padding: 0.5rem 0; border-bottom: 1px solid #27272a;
+      font-size: 0.8125rem;
+    }
+    .detail-row:last-child { border-bottom: none; }
+    .detail-label { color: #71717a; }
+    .detail-value { color: #e4e4e7; font-weight: 500; }
+    .details-box {
+      background: #09090b; border: 1px solid #27272a; border-radius: 0.5rem;
+      padding: 0.75rem 1rem; margin-bottom: 1.5rem;
+    }
+  </style>
+</head>
+<body>
+  <div class="card" id="app">
+    <div class="loading">
+      <div class="spinner"></div>
+      Loading invitation...
+    </div>
+  </div>
+
+  <script>
+    (function() {
+      var app = document.getElementById('app');
+      var pathParts = window.location.pathname.split('/');
+      var token = pathParts[pathParts.length - 1] || pathParts[pathParts.length - 2];
+
+      if (!token || token === 'invite') {
+        showError('Invalid invitation link.');
+        return;
+      }
+
+      // Fetch invitation details
+      fetch('/api/invite/' + encodeURIComponent(token))
+        .then(function(res) {
+          if (res.ok) return res.json();
+          return res.json().then(function(data) { throw new Error(data.error || 'Invalid invitation'); });
+        })
+        .then(function(data) {
+          showForm(data);
+        })
+        .catch(function(err) {
+          showError(err.message);
+        });
+
+      function showError(message) {
+        app.innerHTML =
+          '<div class="icon">\\u26A0\\uFE0F</div>' +
+          '<h1>Invitation Unavailable</h1>' +
+          '<p class="subtitle">' + escapeHtml(message) + '</p>';
+      }
+
+      function showForm(data) {
+        var expiresDate = new Date(data.expiresAt);
+        var expiresStr = expiresDate.toLocaleDateString(undefined, {
+          year: 'numeric', month: 'long', day: 'numeric',
+          hour: '2-digit', minute: '2-digit'
+        });
+
+        app.innerHTML =
+          '<div class="icon">\\u2709\\uFE0F</div>' +
+          '<h1>You\\u2019ve Been Invited</h1>' +
+          '<p class="subtitle">Set your password to create your account.</p>' +
+          '<div class="details-box">' +
+            '<div class="detail-row">' +
+              '<span class="detail-label">Username</span>' +
+              '<span class="detail-value">' + escapeHtml(data.username) + '</span>' +
+            '</div>' +
+            '<div class="detail-row">' +
+              '<span class="detail-label">Email</span>' +
+              '<span class="detail-value">' + escapeHtml(data.email) + '</span>' +
+            '</div>' +
+            '<div class="detail-row">' +
+              '<span class="detail-label">Expires</span>' +
+              '<span class="detail-value">' + escapeHtml(expiresStr) + '</span>' +
+            '</div>' +
+          '</div>' +
+          '<div id="form-error"></div>' +
+          '<form id="accept-form">' +
+            '<div class="field">' +
+              '<label for="password">Password</label>' +
+              '<input type="password" id="password" placeholder="Minimum 8 characters" required minlength="8" maxlength="128">' +
+            '</div>' +
+            '<div class="field">' +
+              '<label for="confirm-password">Confirm Password</label>' +
+              '<input type="password" id="confirm-password" placeholder="Re-enter your password" required>' +
+            '</div>' +
+            '<button type="submit" class="btn" id="submit-btn">Create Account</button>' +
+          '</form>';
+
+        document.getElementById('accept-form').addEventListener('submit', function(e) {
+          e.preventDefault();
+          var password = document.getElementById('password').value;
+          var confirm = document.getElementById('confirm-password').value;
+          var errorDiv = document.getElementById('form-error');
+          var submitBtn = document.getElementById('submit-btn');
+
+          errorDiv.innerHTML = '';
+
+          if (password.length < 8) {
+            errorDiv.innerHTML = '<div class="error-msg">Password must be at least 8 characters.</div>';
+            return;
+          }
+          if (password !== confirm) {
+            errorDiv.innerHTML = '<div class="error-msg">Passwords do not match.</div>';
+            return;
+          }
+
+          submitBtn.disabled = true;
+          submitBtn.textContent = 'Creating account...';
+
+          fetch('/api/invite/' + encodeURIComponent(token) + '/accept', {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ password: password })
+          })
+            .then(function(res) {
+              if (res.ok) return res.json();
+              return res.json().then(function(d) { throw new Error(d.error || 'Failed to create account'); });
+            })
+            .then(function(result) {
+              showSuccess(result);
+            })
+            .catch(function(err) {
+              errorDiv.innerHTML = '<div class="error-msg">' + escapeHtml(err.message) + '</div>';
+              submitBtn.disabled = false;
+              submitBtn.textContent = 'Create Account';
+            });
+        });
+      }
+
+      function showSuccess(result) {
+        app.className = 'card success-card';
+        var loginBtn = result.loginUrl
+          ? '<a href="' + escapeHtml(result.loginUrl) + '" class="btn" style="text-decoration:none;text-align:center;display:block;margin-top:1rem">Go to Login</a>'
+          : '';
+
+        if (result.totpUri) {
+          app.innerHTML =
+            '<div class="icon">\\u2705</div>' +
+            '<h1>Account Created</h1>' +
+            '<p>Your account <strong style="color:#22d3ee">' + escapeHtml(result.username) + '</strong> has been created.</p>' +
+            '<p style="margin-bottom:1.5rem">Scan this QR code with your authenticator app (Google Authenticator, Authy, etc.) to set up two-factor authentication.</p>' +
+            '<div id="qr-container" style="display:flex;justify-content:center;margin-bottom:1.5rem;background:#fff;border-radius:0.5rem;padding:1rem;max-width:220px;margin-left:auto;margin-right:auto"></div>' +
+            '<p style="font-size:0.75rem;color:#52525b;margin-bottom:1rem;word-break:break-all"><strong style="color:#a1a1aa">Manual entry:</strong> ' + escapeHtml(result.totpUri.match(/secret=([^&]+)/)?.[1] || '') + '</p>' +
+            '<div class="error-msg" style="background:#0f1c1c;border-color:#134e4a;color:#5eead4;text-align:center">\\u26A0\\uFE0F Save this before navigating away — it cannot be shown again.</div>' +
+            loginBtn;
+
+          // Load QR code library and render
+          var script = document.createElement('script');
+          script.src = 'https://cdn.jsdelivr.net/npm/qrcode-generator@1.4.4/qrcode.min.js';
+          script.onload = function() {
+            var qr = qrcode(0, 'M');
+            qr.addData(result.totpUri);
+            qr.make();
+            var container = document.getElementById('qr-container');
+            if (container) container.innerHTML = qr.createSvgTag(4, 0);
+          };
+          document.head.appendChild(script);
+        } else {
+          app.innerHTML =
+            '<div class="icon">\\u2705</div>' +
+            '<h1>Account Created</h1>' +
+            '<p>Your account <strong style="color:#22d3ee">' + escapeHtml(result.username) + '</strong> has been created successfully.</p>' +
+            '<p>Contact your administrator to set up two-factor authentication.</p>' +
+            loginBtn;
+        }
+      }
+
+      function escapeHtml(str) {
+        var div = document.createElement('div');
+        div.appendChild(document.createTextNode(str));
+        return div.innerHTML;
+      }
+    })();
+  </script>
+</body>
+</html>`;
+}

package/vendor/serverd/src/lib/ip-utils.js

@@ -0,0 +1,79 @@
+/**
+ * IP address matching utilities — allow/deny list evaluation with CIDR support.
+ * Used by push-install policy enforcement.
+ */
+
+/**
+ * Check whether an IP is allowed given allow and deny lists.
+ * Deny list takes precedence. Empty allow list means all IPs allowed.
+ * @param {string} ip
+ * @param {string[]} allowedIps
+ * @param {string[]} deniedIps
+ * @returns {boolean}
+ */
+export function isIpAllowed(ip, allowedIps, deniedIps) {
+  // Check deny list first (takes precedence)
+  if (deniedIps.length > 0 && matchesAny(ip, deniedIps)) {
+    return false;
+  }
+
+  // Empty allow list means all IPs allowed
+  if (allowedIps.length === 0) {
+    return true;
+  }
+
+  // Check allow list
+  return matchesAny(ip, allowedIps);
+}
+
+/**
+ * Strip the ::ffff: prefix from IPv4-mapped IPv6 addresses so that
+ * comparisons work consistently against plain IPv4 entries.
+ */
+function normalizeIp(ip) {
+  if (ip.startsWith('::ffff:')) {
+    return ip.slice(7);
+  }
+  return ip;
+}
+
+/**
+ * Check if an IP matches any entry in a list of IPs/CIDRs.
+ */
+function matchesAny(ip, list) {
+  const normalized = normalizeIp(ip);
+  for (const entry of list) {
+    const normalizedEntry = normalizeIp(entry);
+    if (normalizedEntry.includes('/')) {
+      if (ipInCidr(normalized, normalizedEntry)) return true;
+    } else {
+      if (normalized === normalizedEntry) return true;
+    }
+  }
+  return false;
+}
+
+/**
+ * Check if an IPv4 address is within a CIDR range.
+ */
+function ipInCidr(ip, cidr) {
+  const [range, bitsStr] = cidr.split('/');
+  const bits = parseInt(bitsStr, 10);
+  if (bits < 0 || bits > 32) return false;
+  const mask = bits === 0 ? 0 : ~(2 ** (32 - bits) - 1);
+  const ipNum = ipToNum(ip);
+  const rangeNum = ipToNum(range);
+  if (ipNum === null || rangeNum === null) return false;
+  return (ipNum & mask) === (rangeNum & mask);
+}
+
+/**
+ * Convert an IPv4 address string to a 32-bit number.
+ */
+function ipToNum(ip) {
+  const parts = ip.split('.');
+  if (parts.length !== 4) return null;
+  const nums = parts.map(Number);
+  if (nums.some((n) => isNaN(n) || n < 0 || n > 255)) return null;
+  return ((nums[0] << 24) | (nums[1] << 16) | (nums[2] << 8) | nums[3]) >>> 0;
+}

package/vendor/serverd/src/lib/migrations/state/0001_enrollment_tokens.sql

@@ -0,0 +1,17 @@
+CREATE TABLE enrollment_tokens (
+  id            INTEGER PRIMARY KEY AUTOINCREMENT,
+  token         TEXT    NOT NULL,
+  label         TEXT    NOT NULL,
+  capabilities  TEXT    NOT NULL,
+  allowed_sites TEXT    NOT NULL,
+  type          TEXT,
+  delegated_by  TEXT,
+  scope         TEXT,
+  created_at    TEXT    NOT NULL,
+  expires_at    TEXT    NOT NULL,
+  used          INTEGER NOT NULL DEFAULT 0,
+  used_at       TEXT
+);
+
+CREATE INDEX idx_enrollment_label_active ON enrollment_tokens(label, used);
+CREATE INDEX idx_enrollment_created_at  ON enrollment_tokens(created_at);

package/vendor/serverd/src/lib/migrations/state/0002_tickets.sql

@@ -0,0 +1,70 @@
+CREATE TABLE tickets (
+  index_hash    TEXT    PRIMARY KEY,
+  id            TEXT    NOT NULL,
+  scope         TEXT    NOT NULL,
+  instance_id   TEXT    NOT NULL,
+  source        TEXT    NOT NULL,
+  target        TEXT    NOT NULL,
+  created_at    TEXT    NOT NULL,
+  expires_at    TEXT    NOT NULL,
+  used          INTEGER NOT NULL DEFAULT 0,
+  used_at       TEXT,
+  session_id    TEXT,
+  transport     TEXT    NOT NULL
+);
+
+CREATE INDEX idx_tickets_target_active ON tickets(target, used);
+CREATE INDEX idx_tickets_instance_id   ON tickets(instance_id);
+CREATE INDEX idx_tickets_created_at    ON tickets(created_at);
+
+CREATE TABLE ticket_scopes (
+  name          TEXT    PRIMARY KEY,
+  version       TEXT    NOT NULL,
+  description   TEXT    NOT NULL,
+  scopes        TEXT    NOT NULL,
+  transport     TEXT    NOT NULL,
+  hooks         TEXT    NOT NULL DEFAULT '{}',
+  installed_at  TEXT    NOT NULL
+);
+
+CREATE TABLE ticket_instances (
+  instance_id    TEXT    PRIMARY KEY,
+  scope          TEXT    NOT NULL,
+  agent_label    TEXT    NOT NULL,
+  registered_at  TEXT    NOT NULL,
+  last_heartbeat TEXT    NOT NULL,
+  status         TEXT    NOT NULL,
+  transport      TEXT    NOT NULL
+);
+
+CREATE INDEX idx_ticket_instances_scope_agent ON ticket_instances(scope, agent_label);
+CREATE INDEX idx_ticket_instances_status      ON ticket_instances(status);
+
+CREATE TABLE ticket_assignments (
+  agent_label    TEXT    NOT NULL,
+  instance_scope TEXT    NOT NULL,
+  assigned_at    TEXT    NOT NULL,
+  assigned_by    TEXT    NOT NULL DEFAULT 'admin',
+  PRIMARY KEY (agent_label, instance_scope)
+);
+
+CREATE INDEX idx_ticket_assignments_instance_scope ON ticket_assignments(instance_scope);
+
+CREATE TABLE ticket_sessions (
+  session_id                 TEXT    PRIMARY KEY,
+  ticket_id                  TEXT    NOT NULL,
+  scope                      TEXT    NOT NULL,
+  instance_id                TEXT    NOT NULL,
+  source                     TEXT    NOT NULL,
+  target                     TEXT    NOT NULL,
+  created_at                 TEXT    NOT NULL,
+  last_activity_at           TEXT    NOT NULL,
+  status                     TEXT    NOT NULL,
+  reconnect_grace_seconds    INTEGER NOT NULL DEFAULT 60,
+  terminated_by              TEXT,
+  terminated_at              TEXT
+);
+
+CREATE INDEX idx_sessions_target_active   ON ticket_sessions(target, status);
+CREATE INDEX idx_sessions_instance_id     ON ticket_sessions(instance_id);
+CREATE INDEX idx_sessions_last_activity   ON ticket_sessions(last_activity_at);

package/vendor/serverd/src/lib/migrations/state/0003_plugins.sql

@@ -0,0 +1,15 @@
+CREATE TABLE plugins (
+  name          TEXT    PRIMARY KEY,
+  display_name  TEXT,
+  package_name  TEXT    NOT NULL,
+  version       TEXT    NOT NULL,
+  description   TEXT,
+  capabilities  TEXT    NOT NULL DEFAULT '[]',
+  packages      TEXT,
+  panel         TEXT,
+  config        TEXT,
+  modes         TEXT,
+  status        TEXT    NOT NULL,
+  installed_at  TEXT    NOT NULL,
+  enabled_at    TEXT
+);

package/vendor/serverd/src/lib/migrations/state/0004_agents.sql

@@ -0,0 +1,19 @@
+CREATE TABLE agents (
+  label             TEXT    PRIMARY KEY,
+  serial            TEXT    NOT NULL,
+  capabilities      TEXT    NOT NULL DEFAULT '[]',
+  allowed_sites     TEXT    NOT NULL DEFAULT '[]',
+  enrollment_method TEXT    NOT NULL DEFAULT 'p12',
+  delegated_by      TEXT,
+  created_at        TEXT    NOT NULL,
+  expires_at        TEXT    NOT NULL,
+  revoked           INTEGER NOT NULL DEFAULT 0,
+  revoked_at        TEXT
+);
+CREATE INDEX idx_agents_serial ON agents(serial);
+
+CREATE TABLE revoked_certs (
+  serial      TEXT PRIMARY KEY,
+  label       TEXT NOT NULL,
+  revoked_at  TEXT NOT NULL
+);